<p>It isn't an <strong>encryption</strong> protocol as nothing is being encrypted. A public key is calculated from a private key and then the private key is used to generate digital signatures proving ownership of the private key associated with that public key without leaking the private key.</p>
<p>But yes with an elliptic curve the Y coordinate can be calculated from the X coordinate and vice versa. Just substitute <code>x</code> into</p>
<pre><code>y^2 = x^3 + 7 (mod p)
</code></pre>
<p>where p = <code>2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1</code></p>
<p>or rearrange to get:</p>
<pre><code>x^3 = y^2 - 7 (mod p)
</code></pre>
<p>There is a complication in that every valid X coordinate has two possible Y coordinates (as detailed in <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki" rel="nofollow noreferrer">BIP340</a>) but <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#design" rel="nofollow noreferrer">BIP340</a> also instructs you on which Y coordinate to pick for Schnorr public keys.</p>
<p>Pieter added in the comments that it is also the case (only for <code>y^2 = x^3 + B</code> curves like secp256k1) that every valid Y coordinate has three corresponding X coordinates.</p>

CC BY-SA 4.0
2023-08-04T14:00:52.920Z
Thanks for your answer.. Yes not encryption meant to say DSA... My bad. Thanks anyways
AncientTides
CC BY-SA 4.0
2023-08-04T14:34:50.367Z
Similar to how every valid X coordinate has 2 correponding Y coordinates, it is also the case (only for y^2=x^3+B curves like secp256k1) that every valid Y coordinate has **three** corresponding X coordinates.
Pieter Wuille
CC BY-SA 4.0
2023-08-04T23:27:15.047Z
@PieterWuille You know at this point, you're literally a guru..
AncientTides
CC BY-SA 4.0
2023-08-04T23:27:41.793Z
I refuse to believe that you're real 
AncientTides
CC BY-SA 4.0
2023-08-04T12:26:07.503Z
2023-08-04T15:38:38.227Z
2023-08-04T15:38:38.227Z
Michael Folkson
<p>Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points <code>publicKey_x</code> and <code>publicKey_y</code> are a results of calculated coordinates within the finite field &quot; <strong>G^K</strong> &quot; (where <strong>G</strong> is a combination of <code>GeneratorPoint_X</code> and <code>GeneratorPoint_Y</code> and <strong>k</strong> is order value of n).</p>
<p>My question is, <strong>if we have only the Y coordinate belonging to a given publicKey, can we get the X coordinate?</strong></p>
<p>or <strong>Is it only possible to derive Y from X and not the other way around?</strong></p>
<p>If so how can this be achieved?</p>

<ecdsa><secp256k1><schnorr-signatures>
What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p
AncientTides
# What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

(Asked by: username_0 on 2023-08-04)

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points `publicKey_x` and `publicKey_y` are a results of calculated coordinates within the finite field " **G^K** " (where **G** is a combination of `GeneratorPoint_X` and `GeneratorPoint_Y` and **k** is order value of n).

My question is, **if we have only the Y coordinate belonging to a given publicKey, can we get the X coordinate?**

or **Is it only possible to derive Y from X and not the other way around?**

If so how can this be achieved?

**Tags:** ecdsa, secp256k1, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2023-08-04. Score: 3 | Accepted answer

It isn't an **encryption** protocol as nothing is being encrypted. A public key is calculated from a private key and then the private key is used to generate digital signatures proving ownership of the private key associated with that public key without leaking the private key.

But yes with an elliptic curve the Y coordinate can be calculated from the X coordinate and vice versa. Just substitute `x` into

```
y^2 = x^3 + 7 (mod p)

```

where p = `2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1`

or rearrange to get:

```
x^3 = y^2 - 7 (mod p)

```

There is a complication in that every valid X coordinate has two possible Y coordinates (as detailed in [BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki)) but [BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#design) also instructs you on which Y coordinate to pick for Schnorr public keys.

username_2 added in the comments that it is also the case (only for `y^2 = x^3 + B` curves like secp256k1) that every valid Y coordinate has three corresponding X coordinates.

> **Comments:**
> **username_0**: Thanks for your answer.. Yes not encryption meant to say DSA... My bad. Thanks anyways  
> **username_2**: Similar to how every valid X coordinate has 2 correponding Y coordinates, it is also the case (only for y^2=x^3+B curves like secp256k1) that every valid Y coordinate has **three** corresponding X coordinates.  
> **username_0**: @username_2 You know at this point, you're literally a guru..  
> **username_0**: I refuse to believe that you're real   

---

