user136095: I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.

user208: Over the field GF(2256 - 232 - 977), the equation y2 = x3 + 7 has exactly
115792089237316195423570985008687907852837564279074904382605163141518161494336
distinct solutions for (x, y), or roughly 2256 - 1.27077×2128. Together with the point at infinity (which is part of the group, but not the curve), the group size is one more than that. Since that yields a prime number, the group is cyclic (all prime-sized groups are), and only has itself and the trivial group (just the point at infinity) as subgroups.

136095: <p>I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.</p>
 208: <p>Over the field <em>GF(2<sup>256</sup> - 2<sup>32</sup> - 977)</em>, the equation <em>y<sup>2</sup> = x<sup>3</sup> + 7</em> has exactly</p>
<p>115792089237316195423570985008687907852837564279074904382605163141518161494336</p>
<p>distinct solutions for <em>(x, y)</em>, or roughly <em>2<sup>256</sup> - 1.27077×2<sup>128</sup></em>. Together with the point at infinity (which is part of the group, but not the curve), the group size is one more than that. Since that yields a prime number, the group is cyclic (all prime-sized groups are), and only has itself and the trivial group (just the point at infinity) as subgroups.</p>
