How is the fixed point chosen?
If we carry on computing P+P+P… for long enough, since the number of curve points is finite, we must eventually get a result of O. [We will certainly have a*P = b*P for some a, b with b>a; This implies that c*P = O where c = b-a.] The least c for which this is true is called the order of the point, and a little group theory tells us that c must divide the order of the curve. For good security, the curve and fixed point are chosen so that the order of the fixed point F is a large prime number. This is quite easy to do once we know the order of the curve, provided it has a large prime factor. However finding the order of an arbitrary curve is tricky – it involves what is known as Schoof’s algorithm – and getting this algorithm to run in a reasonable time takes a lot of tricks. There are two alternative methods which instead construct curves of known order, one based on Complex Multiplication (which is also pretty difficult maths – but not as tricky as Schoof!) and the other based on “W
