<p>You can negate a point (x, y) by simply changing it to (x, −y).</p>

<p>The document that defines ECDSA reminds us of this fact:</p>

<p><a href="https://www.secg.org/sec1-v2.pdf" rel="noreferrer">https://www.secg.org/sec1-v2.pdf</a></p>

<p>Here's a screenshot:</p>

<p><a href="https://i.sstatic.net/N07pS.png" rel="noreferrer"><img src="https://i.sstatic.net/N07pS.png" alt="Definition of point negation"></a></p>

<p>So once you have negated one of your points, just add it to the other one, and you have achieved subtraction.</p>

CC BY-SA 4.0
2020-01-14T17:21:09.263Z
2020-01-14T17:21:09.263Z
David Grayson
<p>As other's have said, the essential point is the algebraic definition for additive inverses in elliptic arithemetic.</p>

<pre><code> -(x,y)=(x,-y)
</code></pre>

<p>But if it helps, there are also some nice geometric illustrations like this one from Vitalik Buterin's <a href="https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627" rel="nofollow noreferrer">Exploring Elliptic Curve Pairings</a>:</p>

<p><a href="https://i.sstatic.net/vX5Ed.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/vX5Ed.jpg" alt="Elliptic arithmetic"></a></p>

<p>Suppose <code>R = (x,y)</code>. Since the elliptic curve is symmetric with respect to the <code>x</code>-axis, we can guarantee that the inverse <code>-R = -(x,y) = (x,-y)</code> will also be a point on the curve. And since <code>R</code> and <code>-R</code> have the same <code>x</code>-coordinate, the line that connects them is vertical representing their sum as the identity <code>O</code> or "the point at infinity". So we have <code>R + (-R) = O</code> as required.</p>

CC BY-SA 4.0
2020-01-16T18:12:12.383Z
2020-01-16T18:17:23.943Z
2020-01-16T18:17:23.943Z
sfmiller940
<p>Here is the sample of code for subtraction of two points.</p>

<pre><code># -*- coding: utf-8 -*-

def OnCurve(x,y): # Check if the point is on the curve
    A = (y*y)%P
    B = (x*x*x)%P
    C = False
    if A == (B + 7):
        C = True
    return C

def ECadd(xp,yp,xq,yq): # EC point addition
    m = ((yq-yp) * modinv(xq-xp,P))%P
    xr = (m*m-xp-xq)%P
    yr = (m*(xp-xr)-yp)%P
    return (xr,yr)

def legendre_symbol(a,p):
    ls = pow(a, (p - 1) / 2, p)
    return -1 if ls == p - 1 else ls

def modsqrt(a,p):
    if legendre_symbol(a, p) != 1:
        return 0
    elif a == 0:
        return 0
    elif p == 2:
        return p
    elif p % 4 == 3:
        return pow(a, (p + 1) / 4, p)
    s = p - 1
    e = 0
    while s % 2 == 0:
        s /= 2
        e += 1
    n = 2
    while legendre_symbol(n, p) != -1:
        n += 1
    x = pow(a, (s + 1) / 2, p)
    b = pow(a, s, p)
    g = pow(n, s, p)
    r = e
    while True:
        t = b
        m = 0
        for m in xrange(r):
            if t == 1:
                break
            t = pow(t, 2, p)
        if m == 0:
            return x
        gs = pow(g, 2 ** (r - m - 1), p)
        g = (gs * gs) % p
        x = (x * gs) % p
        b = (b * g) % p
        r = m

def modinv(a,n): # Extended Euclidean Algorithm in elliptic curves
    lm, hm = 1,0
    low, high = a%n,n
    while low &gt; 1:
        ratio = high/low
        nm = hm - lm * ratio
        new = high - low * ratio
        hm = lm
        high = low
        lm = nm
        low = new
    return lm % n

def ECadd(xp,yp,xq,yq): # EC point addition
    m = ((yq-yp) * modinv(xq-xp,P))%P
    xr = (m*m-xp-xq)%P
    yr = (m*(xp-xr)-yp)%P
    return (xr,yr)

def ECsub(xp,yp,xq,yq): # EC point subtraction
    X = (((yp+yq)*modinv(xq-xp,P))**2-xp-xq)%P
    A = (xp + X + xq)%P
    B = modsqrt(A,P)
    B1 = P - B
    Y = yq - (xq - X) * B
    X = X % P
    Y = Y % P
    if not OnCurve(X,Y):
        Y = yq - (xq - X) * B1
    Y = Y % P
    return X,Y

P = 2**256 - 2**32 - 2**9 - 2**8 - 2**7 - 2**6 - 2**4 - 1

Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424

print Gx,Gy

Ax,Ay = ECadd(Gx,Gy,Gx,Gy)
print Ax,Ay

Bx,By = ECsub(Ax,Ay,Gx,Gy)
print Bx,By
</code></pre>

<p>This code is from <a href="https://github.com/ragestack/EC-Point-Operations" rel="nofollow noreferrer">here</a>.</p>

<p>It works perfect in Python 2.7.13.</p>

<p>In the earlier version of Python there is <code>OverflowError: (34, 'Result too large')</code>.</p>

CC BY-SA 4.0
2020-02-05T05:47:46.510Z
Please explain in this code what point values do the subtraction?
Izi Tors
CC BY-SA 4.0
2020-02-05T11:52:35.653Z
@IziTors i'am sorry but I can not understand your question
Denis Leonov
CC BY-SA 4.0
2020-01-15T16:14:23.760Z
2020-02-05T12:39:44.443Z
2020-02-05T12:39:44.443Z
Denis Leonov
<p>Please tell me if there is a formula for <code>A-B</code>, (That is, subtraction of two points / minus). I know how two points are added, <code>A + B</code> this addition is described in detail </p>

<p>(Please tell me how you can change the formula to subtract two points / minus) <code>A-B</code></p>

CC BY-SA 4.0
2020-01-16T18:22:38.633Z
There are many different types of elliptic curves. Please note that the given answers apply to secp256k1, the curve used in Bitcoin.
nickler
CC BY-SA 4.0
2020-02-07T05:13:53.120Z
@nickler incorrect.  The geometric addition rule holds for all elliptic curves and that is the basis for the negation rule described in the several answers existing before your comment was written.
Chan-Ho Suh
CC BY-SA 4.0
2020-02-10T14:39:57.777Z
The negation of a point (x, y) on a twisted Edwards curve is (-x, y) and not (x, -y) as the answers given here would indicate.
nickler
CC BY-SA 4.0
2020-02-14T14:07:00.413Z
@nickler there's confusion here between elliptic curve representation and the elliptic curve itself.  When not specified, it's standard to assume the form is Weisterstrass; you are referring to a particular non-standard form.  The answers given apply to any elliptic curve in Weierstrass form.  To state that they only apply to secp256k1 is wrong.
Chan-Ho Suh
CC BY-SA 4.0
2020-02-17T12:15:31.037Z
I didn't state it would _only_ apply to secp256k1. My comment was intended to address confusion about the different forms of elliptic curves because we can't expect readers to be aware of what some people consider standard and how the curves relate to each other.
nickler
<private-key><public-key><ecdsa><secp256k1><shared>
How to subtract two points on an elliptic curve?
Izi Tors
# How to subtract two points on an elliptic curve?

(Asked by: username_0 on 2020-01-14)

Please tell me if there is a formula for `A-B`, (That is, subtraction of two points / minus). I know how two points are added, `A + B` this addition is described in detail

(Please tell me how you can change the formula to subtract two points / minus) `A-B`

**Tags:** private-key, public-key, ecdsa, secp256k1, shared

> **Comments:**
> **username_1**: There are many different types of elliptic curves. Please note that the given answers apply to secp256k1, the curve used in Bitcoin.  
> **username_2**: @username_1 incorrect.  The geometric addition rule holds for all elliptic curves and that is the basis for the negation rule described in the several answers existing before your comment was written.  
> **username_1**: The negation of a point (x, y) on a twisted Edwards curve is (-x, y) and not (x, -y) as the answers given here would indicate.  
> **username_2**: @username_1 there's confusion here between elliptic curve representation and the elliptic curve itself.  When not specified, it's standard to assume the form is Weisterstrass; you are referring to a particular non-standard form.  The answers given apply to any elliptic curve in Weierstrass form.  To state that they only apply to secp256k1 is wrong.  
> **username_1**: I didn't state it would _only_ apply to secp256k1. My comment was intended to address confusion about the different forms of elliptic curves because we can't expect readers to be aware of what some people consider standard and how the curves relate to each other.  

---

## 3 answers

### Answer by username_3 on 2020-01-14. Score: 5

You can negate a point (x, y) by simply changing it to (x, −y).

The document that defines ECDSA reminds us of this fact:

<https://www.secg.org/sec1-v2.pdf>

Here's a screenshot:

[![Definition of point negation](https://i.sstatic.net/N07pS.png)](https://i.sstatic.net/N07pS.png)

So once you have negated one of your points, just add it to the other one, and you have achieved subtraction.


---

### Answer by username_4 on 2020-01-16. Score: 2

As other's have said, the essential point is the algebraic definition for additive inverses in elliptic arithemetic.

```
 -(x,y)=(x,-y)

```

But if it helps, there are also some nice geometric illustrations like this one from Vitalik Buterin's [Exploring Elliptic Curve Pairings](https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627):

[![Elliptic arithmetic](https://i.sstatic.net/vX5Ed.jpg)](https://i.sstatic.net/vX5Ed.jpg)

Suppose `R = (x,y)`. Since the elliptic curve is symmetric with respect to the `x`-axis, we can guarantee that the inverse `-R = -(x,y) = (x,-y)` will also be a point on the curve. And since `R` and `-R` have the same `x`-coordinate, the line that connects them is vertical representing their sum as the identity `O` or "the point at infinity". So we have `R + (-R) = O` as required.


---

### Answer by username_5 on 2020-01-15. Score: 0

Here is the sample of code for subtraction of two points.

```
# -*- coding: utf-8 -*-

def OnCurve(x,y): # Check if the point is on the curve
    A = (y*y)%P
    B = (x*x*x)%P
    C = False
    if A == (B + 7):
        C = True
    return C

def ECadd(xp,yp,xq,yq): # EC point addition
    m = ((yq-yp) * modinv(xq-xp,P))%P
    xr = (m*m-xp-xq)%P
    yr = (m*(xp-xr)-yp)%P
    return (xr,yr)

def legendre_symbol(a,p):
    ls = pow(a, (p - 1) / 2, p)
    return -1 if ls == p - 1 else ls

def modsqrt(a,p):
    if legendre_symbol(a, p) != 1:
        return 0
    elif a == 0:
        return 0
    elif p == 2:
        return p
    elif p % 4 == 3:
        return pow(a, (p + 1) / 4, p)
    s = p - 1
    e = 0
    while s % 2 == 0:
        s /= 2
        e += 1
    n = 2
    while legendre_symbol(n, p) != -1:
        n += 1
    x = pow(a, (s + 1) / 2, p)
    b = pow(a, s, p)
    g = pow(n, s, p)
    r = e
    while True:
        t = b
        m = 0
        for m in xrange(r):
            if t == 1:
                break
            t = pow(t, 2, p)
        if m == 0:
            return x
        gs = pow(g, 2 ** (r - m - 1), p)
        g = (gs * gs) % p
        x = (x * gs) % p
        b = (b * g) % p
        r = m

def modinv(a,n): # Extended Euclidean Algorithm in elliptic curves
    lm, hm = 1,0
    low, high = a%n,n
    while low > 1:
        ratio = high/low
        nm = hm - lm * ratio
        new = high - low * ratio
        hm = lm
        high = low
        lm = nm
        low = new
    return lm % n

def ECadd(xp,yp,xq,yq): # EC point addition
    m = ((yq-yp) * modinv(xq-xp,P))%P
    xr = (m*m-xp-xq)%P
    yr = (m*(xp-xr)-yp)%P
    return (xr,yr)

def ECsub(xp,yp,xq,yq): # EC point subtraction
    X = (((yp+yq)*modinv(xq-xp,P))**2-xp-xq)%P
    A = (xp + X + xq)%P
    B = modsqrt(A,P)
    B1 = P - B
    Y = yq - (xq - X) * B
    X = X % P
    Y = Y % P
    if not OnCurve(X,Y):
        Y = yq - (xq - X) * B1
    Y = Y % P
    return X,Y

P = 2**256 - 2**32 - 2**9 - 2**8 - 2**7 - 2**6 - 2**4 - 1

Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424

print Gx,Gy

Ax,Ay = ECadd(Gx,Gy,Gx,Gy)
print Ax,Ay

Bx,By = ECsub(Ax,Ay,Gx,Gy)
print Bx,By

```

This code is from [here](https://github.com/ragestack/EC-Point-Operations).

It works perfect in Python 2.7.13.

In the earlier version of Python there is `OverflowError: (34, 'Result too large')`.

> **Comments:**
> **username_0**: Please explain in this code what point values do the subtraction?  
> **username_5**: @username_0 i'am sorry but I can not understand your question  

---

