<p>You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.</p>

<p>1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via <a href="https://en.wikipedia.org/wiki/Lagrange%27s_theorem_(group_theory)" rel="nofollow noreferrer">Lagrange's Theorem</a>).</p>

<p>2) Just use the curve equation. <code>y^2 = x^3 + 7</code> => <code>y = modsqrt(x^3 + 7)</code> (everything is mod P)</p>

CC BY-SA 4.0
2018-11-15T12:20:39.330Z
you did not understand my question, because

N is already a prime number ,,

y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,,

i said that i did this but not work with my new N
remon78eg
CC BY-SA 4.0
2018-11-15T12:49:12.390Z
yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same.
remon78eg
CC BY-SA 4.0
2018-11-15T20:36:05.703Z
Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from?
Mike D
CC BY-SA 4.0
2018-11-16T01:41:11.847Z
@MikeD OP is using "N" to refer to the field size, not the curve order.
Pieter Wuille
CC BY-SA 4.0
2018-11-16T02:08:42.660Z
@MikeD x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field.
Pieter Wuille
CC BY-SA 4.0
2018-11-16T10:18:20.477Z
@Pieter Wuille, yes, true.
remon78eg
CC BY-SA 4.0
2018-11-15T12:13:27.890Z
2018-11-15T12:13:27.890Z
Mike D
<p>G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).</p>

<p>It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point. </p>

<p>E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.</p>

CC BY-SA 4.0
2018-11-16T01:27:48.817Z
The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes.
Pieter Wuille
CC BY-SA 4.0
2018-11-16T01:33:21.963Z
For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking G. Maxwell's suggested point and multiplying it by (the curve order / its largest prime factor).
Pieter Wuille
CC BY-SA 4.0
2018-11-16T11:07:28.047Z
@Maxwell , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929)
remon78eg
CC BY-SA 4.0
2018-11-16T11:22:23.383Z
now, what is the (**N**) order number, (used in division, and creating signature)? , where:(((( **G*(N+1)=G** )))): –
remon78eg
CC BY-SA 4.0
2018-11-24T08:10:58.570Z
Remon: you need computer algebra software to figure that out. In `sage` you can use `F=GF(n); E=EllipticCurve(F,[0,7]); print(E.order());`, but note that the security of your curve is only the square root of the largest prime factor of that order, which is very low for yours.
Pieter Wuille
CC BY-SA 4.0
2018-12-19T03:52:30.067Z
@ Pieter Wuille , i will not use this curve for security, i will use it to do text compression (ZIP) , because i can know if any point on this curve is odd or even, even i multiply the G point with a very large number, this means i can know this very long number from a small point number, so i can store every long number in a small point number to compress it.
remon78eg
CC BY-SA 4.0
2018-12-19T04:25:40.910Z
Re: compression. You might want to consult [this article](https://en.wikipedia.org/wiki/Pigeonhole_principle) before announcing your IPO.
G. Maxwell
CC BY-SA 4.0
2018-11-16T01:10:49.823Z
2018-11-16T01:30:04.130Z
2018-11-16T01:30:04.130Z
G. Maxwell
<p>I have this bitcoin curve:</p>

<pre><code>y^2 = x^3 + 7
</code></pre>

<p>but the finite field Fp is modified to be:</p>

<pre><code>n=115792089237316195423570985008687907853269984665640564039457584007908834675927
</code></pre>

<p><strong>1-What is the G point?</strong></p>

<p><strong>2-how to get the Y coordinate for any X value?</strong></p>

<p>I'm using this <strong>C#</strong> code to get <strong>Y</strong> from <strong>X</strong>
but it works with original bitcoin curve only.</p>

<pre><code>    public BigInteger mod(BigInteger num, BigInteger by) {
        BigInteger res = num % by;
        if (res &lt; 0) { res += by; }
        return res;
    }

    public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
        BigInteger n_OVER_FOUR = (n + 1) / 4;
        BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
        BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
        BigInteger Y = beta;

        if (!modIt) { return Y; }
        Y = n - beta;
        return Y;
    }
</code></pre>

<cryptography>
How to get the generator G point for any new curve?
remon78eg
# How to get the generator G point for any new curve?

(Asked by: username_0 on 2018-11-15)

I have this bitcoin curve:

```
y^2 = x^3 + 7

```

but the finite field Fp is modified to be:

```
n=115792089237316195423570985008687907853269984665640564039457584007908834675927

```

**1-What is the G point?**

**2-how to get the Y coordinate for any X value?**

I'm using this **C#** code to get **Y** from **X**
but it works with original bitcoin curve only.

```
    public BigInteger mod(BigInteger num, BigInteger by) {
        BigInteger res = num % by;
        if (res < 0) { res += by; }
        return res;
    }

    public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
        BigInteger n_OVER_FOUR = (n + 1) / 4;
        BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
        BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
        BigInteger Y = beta;

        if (!modIt) { return Y; }
        Y = n - beta;
        return Y;
    }

```

**Tags:** cryptography


---

## 2 answers

### Answer by username_1 on 2018-11-15. Score: 2

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.

1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via [Lagrange's Theorem](https://en.wikipedia.org/wiki/Lagrange%27s_theorem_(group_theory))).

2) Just use the curve equation. `y^2 = x^3 + 7` => `y = modsqrt(x^3 + 7)` (everything is mod P)

> **Comments:**
> **username_0**: you did not understand my question, because  N is already a prime number ,,  y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,,  i said that i did this but not work with my new N  
> **username_0**: yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same.  
> **username_1**: Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from?  
> **username_2**: @username_1 OP is using "N" to refer to the field size, not the curve order.  
> **username_2**: @username_1 x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field.  
> **username_0**: @username_2, yes, true.  

---

### Answer by username_3 on 2018-11-16. Score: 0

G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).

It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point.

E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.

> **Comments:**
> **username_2**: The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes.  
> **username_2**: For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking username_3's suggested point and multiplying it by (the curve order / its largest prime factor).  
> **username_0**: @username_3 , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929)  
> **username_0**: now, what is the (**N**) order number, (used in division, and creating signature)? , where:(((( **G*(N+1)=G** )))): –  
> **username_2**: Remon: you need computer algebra software to figure that out. In `sage` you can use `F=GF(n); E=EllipticCurve(F,[0,7]); print(E.order());`, but note that the security of your curve is only the square root of the largest prime factor of that order, which is very low for yours.  
> **username_0**: @ username_2 username_2 , i will not use this curve for security, i will use it to do text compression (ZIP) , because i can know if any point on this curve is odd or even, even i multiply the G point with a very large number, this means i can know this very long number from a small point number, so i can store every long number in a small point number to compress it.  
> **username_3**: Re: compression. You might want to consult [this article](https://en.wikipedia.org/wiki/Pigeonhole_principle) before announcing your IPO.  

---

