A base point is a public elliptic-curve point, conventionally named G or B, chosen to generate the subgroup used by a cryptographic system. Scalar multiplication turns a private integer k into a public point kG. The practical purpose is shared structure: every participant uses the same curve and base point while retaining a different private scalar. section 4.1.1 section 5.1.1
The point must lie on the selected curve, so its coordinates satisfy the curve equation. Its order n is the number of scalar additions needed to return to the point at infinity. Prime-order base points are preferred: on a tiny extension-field example, points of composite order 55 eventually reach subgroups of orders 5 or 11, while a point of prime order 11 stays within its intended subgroup. section 4.1.1 section 13.3.2
A base-point parameter set supplies the values needed to perform scalar multiplication safely and consistently:
- The curve E and finite-field prime define where point arithmetic occurs. section 4.1.3
- The Base point stores the selected generator coordinates. section 4.1.3
- The order bounds private scalars and hash-derived secret keys; the cofactor records the remaining factor outside the main subgroup. section 4.1.1 section 4.1.3
From pass phrase to public key
A key-generation routine hashes a pass phrase modulo the base-point order, producing secret scalar sk, then computes PK = sk · Base on curve E. The base point is public and reusable; protecting sk is the security-critical requirement. section 4.1.3
Key exchange and signatures
For key exchange, Alice publishes A = kA G and Bob publishes B = kB G; both obtain the same point kA kB G. MQV similarly derives static and ephemeral public keys as scalar multiples of G. In Schnorr signing, a private key produces Pp = sp B and a fresh nonce produces Q = kB, allowing verification to reconstruct Q from the signature and public key. section 4.1.1 section 4.2.1 section 5.1.1
Figure 13.3 All points on tiny elliptic curve \(y^2=x^3+23x-1\) mod \(43\)
The point plot makes subgroup choice tangible: candidate points on a small curve have different orders, so only selected prime-order points serve as suitable base points. section 13.3.2
