Parameters (SEC 2 §2.4.1): p = 2²⁵⁶ − 2³² − 977, a = 0, b = 7, cofactor 1, group order just below 2²⁵⁶. The special structure gives an efficiently computable endomorphism (GLV) that speeds up scalar multiplication. Identifiers: OID 1.3.132.0.10, JOSE crv secp256k1 with alg ES256K (RFC 8812), COSE −47. It is not offered in TLS 1.3, WebCrypto, Apple's Secure Enclave or most HSM default profiles.
NIST SP 800-186 Appendix H.2 allows secp256k1 "for blockchain-related applications". It carries Bitcoin's ECDSA and BIP-340 Schnorr signatures, Ethereum transactions, personal_sign and EIP-712 signatures (65 bytes with a recovery byte v), and Nostr events.
Generic libraries are slow on it: Node.js 26 with OpenSSL 3.6.5 signs about 6,500 secp256k1 messages per second against about 68,800 for P-256 on the same Apple M4 Max core, because OpenSSL has no optimized secp256k1 code. Use libsecp256k1 (Bitcoin Core's constant-time library) or @noble/curves, which in pure JavaScript runs secp256k1 as fast as its P-256. Blockchain conventions such as low-S and public key recovery differ from generic ECDSA; see the P-256 comparison.