<p>According to <a href="https://www.secg.org/sec1-v2.pdf" rel="nofollow noreferrer">https://www.secg.org/sec1-v2.pdf</a>, points are encoded in compressed format as:</p>
<ul>
<li>0x02 + X coordinate: implicit Y coordinate is even</li>
<li>0x03 + X coordinate: implicit Y coordinate is odd</li>
</ul>
<p>You can call this parity or sign - it doesn't matter; they're the same thing in a finite field (and arguably, both are inaccurate). As the coordinates are numbers modulo an odd prime p (the field size; <em>p = 2<sup>256</sup> - 2<sup>32</sup> - 977</em> for the secp256k1 curve used in Bitcoin), <em>-x</em> and <em>p-x</em> are the same coordinate. One of these will always be odd, and the other will be even. One of them will be negative and the other will be positive.</p>
<p>The convention is that &quot;even&quot; refers to the coordinate which manifests as an even number when seen as an integer in the range <em>[0..p-1]</em>, and &quot;odd&quot; the opposite. This is an arbitrary choice, as another range could be chosen (such as <em>[-(p-1)/2..(p-1)/2]</em>) in which different coordinates would be seen as even or odd.</p>
<p>Yet, it helps distinguish. If <em>(x,y)</em> satisfies <em>y<sup>2</sup> = x<sup>3</sup> + 7 mod p</em>, so does <em>(x,y) = (x,p-y)</em>. To identify the solution, the criterion of &quot;even/odd when restricted to <em>[0..x-1]</em>&quot; is used in practice.</p>

CC BY-SA 4.0
2020-07-06T06:05:52.067Z
2020-07-06T06:05:52.067Z
Pieter Wuille
<p>In different places I've read that the 2 or 3 is the sign or is the parity of the elided Y coordinate?</p>
<p>Which of these is it, or are the sign and parity equivalent in some way?</p>

<public-key><secp256k1>
In compressed public keys, is the 2 or 3 the parity or the sign?
fadedbee
# In compressed public keys, is the 2 or 3 the parity or the sign?

(Asked by: username_0 on 2020-07-06)

In different places I've read that the 2 or 3 is the sign or is the parity of the elided Y coordinate?

Which of these is it, or are the sign and parity equivalent in some way?

**Tags:** public-key, secp256k1


---

## 1 answers

### Answer by username_1 on 2020-07-06. Score: 2

According to <https://www.secg.org/sec1-v2.pdf>, points are encoded in compressed format as:

* 0x02 + X coordinate: implicit Y coordinate is even
* 0x03 + X coordinate: implicit Y coordinate is odd

You can call this parity or sign - it doesn't matter; they're the same thing in a finite field (and arguably, both are inaccurate). As the coordinates are numbers modulo an odd prime p (the field size; *p = 2256 - 232 - 977* for the secp256k1 curve used in Bitcoin), *-x* and *p-x* are the same coordinate. One of these will always be odd, and the other will be even. One of them will be negative and the other will be positive.

The convention is that "even" refers to the coordinate which manifests as an even number when seen as an integer in the range *[0..p-1]*, and "odd" the opposite. This is an arbitrary choice, as another range could be chosen (such as *[-(p-1)/2..(p-1)/2]*) in which different coordinates would be seen as even or odd.

Yet, it helps distinguish. If *(x,y)* satisfies *y2 = x3 + 7 mod p*, so does *(x,y) = (x,p-y)*. To identify the solution, the criterion of "even/odd when restricted to *[0..x-1]*" is used in practice.


---

