secp224k1 is a short Weierstrass curve y² = x³ + ax + b over a 224-bit prime field with a 225-bit prime-order subgroup and cofactor 1; its estimated security level is 112 bits. Status: still secure, being phased out.
secp224k1 is y² = x³ + 5 over a 224-bit prime p with p ≡ 1 (mod 3), which gives it the same GLV endomorphism as the other SEC 2 Koblitz curves. Its group order n is a 225-bit prime, slightly larger than p — Hasse's bound allows that — so private keys and ECDSA s values can need 29 bytes instead of 28, which breaks code that assumes scalars fit in a field element.
It offers about 112 bits of security and was deprecated for TLS by RFC 8422 (code point 20); it is rarely used.
Names in standards
| Standard | Name |
|---|
| SEC 2 | secp224k1 |
Domain parameters
224-bit prime field · about 112-bit security
- Field prime p
- 0xfffffffffffffffffffffffffffffffffffffffffffffffeffffe56d
- Coefficient a
- 0x0
- Coefficient b
- 0x5
- Base point x
- 0xa1455b334df099df30fc28a169a467e9e47075a90f7e650eb6b7a45c
- Base point y
- 0x7e089fed7fba344282cafbd6f7e319f7c0b0bd59e2ca4bdb556d61a5
- Order n of the base point
- 0x10000000000000000000000000001dce8d2ec6184caf0a971769fb1f7
- Cofactor h
- 0x1
Used in
- Legacy TLS 1.2 (secp224k1)
Identifiers in registries
← All curves