user6388: Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as secp256r1?
Edit: I found this page (https://bitcointalk.org/index.php?topic=151120.0) which speculates on some possible differences, but I'm hoping to find something concrete.

user52021: 
What are the advantages (and disadvantages) of using this over other specifications such as secp256r1?

Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1.  That isn't true today, and the fastest implementations of k1 are considerably faster than r1.
Secp256k1's security critical parameters are essentially fixed by its design criteria, while r1's parameters are generated based on a 'random number' with no documented origin, causing some to worry that it might have been intentionally weakened.
I don't believe a new application would standardize on a 256-bit curve at this time, but if I had to pick between k1 and r1 for something where compatibility wasn't a concern picking k1 would be an easy decision.

user208: I believe Satoshi was once asked this question, and answered that it was just some curve that existed and was presumed to be efficiently implemented.
I'll try to find a reference.

6388: <p>Bitcoin uses <strong>secp256k1</strong> as the specification for it's address system (<a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow">https://en.bitcoin.it/wiki/Secp256k1</a>). What are the advantages (and disadvantages) of using this over other specifications such as <strong>secp256r1</strong>?</p>

<p><strong>Edit</strong>: I found this page (<a href="https://bitcointalk.org/index.php?topic=151120.0" rel="nofollow">https://bitcointalk.org/index.php?topic=151120.0</a>) which speculates on some possible differences, but I'm hoping to find something concrete.</p>
 52021: <blockquote>
  <p>What are the advantages (and disadvantages) of using this over other specifications such as secp256r1?</p>
</blockquote>

<p>Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1.  That isn't true today, and the fastest implementations of k1 are considerably faster than r1.</p>

<p>Secp256k1's security critical parameters are essentially fixed by its design criteria, while r1's parameters are generated based on a 'random number' with no documented origin, causing some to worry that it might have been intentionally weakened.</p>

<p>I don't believe a new application would standardize on a 256-bit curve at this time, but if I had to pick between k1 and r1 for something where compatibility wasn't a concern picking k1 would be an easy decision.</p>
 208: <p>I believe Satoshi was once asked this question, and answered that it was just some curve that existed and was presumed to be efficiently implemented.</p>

<p>I'll try to find a reference.</p>
