<p>If the point (X,Y) is on the elliptic curve <em>y<sup>2</sup> = x<sup>3</sup> + ax + b</em>, then the point (X,-Y) is also on that curve. Substitution yields <em>(-y)<sup>2</sup> = x<sup>3</sup> + ax + b</em>, which is the same equation.</p>
<p>In fact, it is the case that if <em>kG = (X,Y)</em>, then <em>(-k)G = (N-k)G = (X,P-Y)</em>, where the multiplications with <em>G</em> are point multiplications, <em>N</em> is the curve order, and <em>P</em> is the field size (<em>P = 2<sup>256</sup> - 2<sup>32</sup> - 977</em> for <code>secp256k1</code>).</p>
<p>So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.</p>
<p>Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:</p>
<ul>
<li>The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.</li>
<li>The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.</li>
<li>The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.</li>
</ul>

CC BY-SA 4.0
2021-01-09T21:45:02.843Z
2021-01-09T21:45:02.843Z
Pieter Wuille
<p>As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined <a href="https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Point_multiplication" rel="nofollow noreferrer">here</a> so in your example to get the result for -10 * G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)</p>

CC BY-SA 4.0
2021-01-09T10:46:35.307Z
2021-01-09T10:46:35.307Z
Mike D
<p>There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an <a href="https://en.wikipedia.org/wiki/Elliptic_curve#Elliptic_curves_over_finite_fields" rel="nofollow noreferrer">elliptic curve over a finite field</a>. It is a cyclic group of points composed of positive-integers. You might want to learn about <a href="https://en.wikipedia.org/wiki/Modular_arithmetic" rel="nofollow noreferrer">modulo arithmetic</a> and <a href="https://en.wikipedia.org/wiki/Cyclic_group" rel="nofollow noreferrer">cyclic groups</a></p>

CC BY-SA 4.0
2021-01-09T10:28:44.960Z
Thanks, I understand the curve the point is on a cyclic group of points. I would have been more clear with my question. I have updated the main question.
Chegde
CC BY-SA 4.0
2021-01-08T17:10:30.983Z
2021-01-08T17:10:30.983Z
pinhead
<h3>How subtraction works</h3>
<p><code>P - Q = P + (-Q)</code> where <code>-Q</code> is the negated <code>Q</code>. (<code>-</code> changes the sign, or in another words, subtracts from the modulus)</p>
<p>An example: On <a href="https://enriquesl-git.github.io/ecc/interactive/modk-mul.html" rel="nofollow noreferrer">this website</a>. For this example, set p = 523;</p>
<p>Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate <code>4P - P</code>:</p>
<p>Set n = 4 to find 4P = (-236, 235)</p>
<p>For n = 1 to find P = (10, 22)</p>
<p>Now, we need to negate it, so set n = -1 to find -P = (10, -22)</p>
<p>Go to the addition tab to add -P to 4P, to find (22, -42)</p>
<p>Set n = 3 to see if we find the same value ... we do (22, -42)</p>
<hr />
<p>But, the answer is not &quot;negative&quot;, as pinhead explains.</p>

CC BY-SA 4.0
2021-01-09T09:25:02.080Z
I guess I should have been more clear with my question. The explanation of a point not being negative makes perfect sense.  I will explain what I am trying to understand. I will edit the main post.
Chegde
CC BY-SA 4.0
2021-01-08T18:51:56.100Z
2021-01-08T19:13:53.317Z
2021-01-08T19:13:53.317Z
MCCCS
<p>I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.</p>
<p>Let's take a point G<em>P. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y
G</em>10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)</p>
<p>Let's take another point G<em>Q for subtraction with G</em>P. for Q=20 I get,
G*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)</p>
<p>Now subtract G<em>P - G</em>Q, In normal math, it is 10-20= -10, but with EC math I get a point  (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)</p>
<p>which has the same X value as 10 but Y is different.  If I add G to the result the point is 9G but with a different value.</p>
<p>I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G</p>
<p>Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)</p>
<p>One valve is used for 10 and the other for a point which is a result of subtraction.</p>
<p>p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 72488970228380509287422715226575535698893157273063074627791787432852706183111
ysquared = ((x<em>x</em>x+7) % p)<br />
y = pow(ysquared, (p+1)/4, p)
print &quot;y1 = %s &quot; % y
print &quot;y2 = %s &quot; % (y * -1 % p)</p>
<p>So that question can also be, How to know which Y value to use if a value of X is given,</p>

<public-key><ecdsa>
Is it possible to know if the result of 2 point subtraction is before or after G
Chegde
# Is it possible to know if the result of 2 point subtraction is before or after G

(Asked by: username_0 on 2021-01-08)

I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.

Let's take a point G*P. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y
G*10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)

Let's take another point G*Q for subtraction with G*P. for Q=20 I get,
G\*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)

Now subtract G*P - G*Q, In normal math, it is 10-20= -10, but with EC math I get a point (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)

which has the same X value as 10 but Y is different. If I add G to the result the point is 9G but with a different value.

I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G

Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)

One valve is used for 10 and the other for a point which is a result of subtraction.

p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 72488970228380509287422715226575535698893157273063074627791787432852706183111
ysquared = ((x*x*x+7) % p)  
y = pow(ysquared, (p+1)/4, p)
print "y1 = %s " % y
print "y2 = %s " % (y \* -1 % p)

So that question can also be, How to know which Y value to use if a value of X is given,

**Tags:** public-key, ecdsa


---

## 4 answers

### Answer by username_1 on 2021-01-09. Score: 3

If the point (X,Y) is on the elliptic curve *y2 = x3 + ax + b*, then the point (X,-Y) is also on that curve. Substitution yields *(-y)2 = x3 + ax + b*, which is the same equation.

In fact, it is the case that if *kG = (X,Y)*, then *(-k)G = (N-k)G = (X,P-Y)*, where the multiplications with *G* are point multiplications, *N* is the curve order, and *P* is the field size (*P = 2256 - 232 - 977* for `secp256k1`).

So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.

Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:

* The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.
* The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.
* The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.


---

### Answer by username_2 on 2021-01-09. Score: 3

As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined [here](https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Point_multiplication) so in your example to get the result for -10 \* G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)


---

### Answer by username_3 on 2021-01-08. Score: 2

There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an [elliptic curve over a finite field](https://en.wikipedia.org/wiki/Elliptic_curve#Elliptic_curves_over_finite_fields). It is a cyclic group of points composed of positive-integers. You might want to learn about [modulo arithmetic](https://en.wikipedia.org/wiki/Modular_arithmetic) and [cyclic groups](https://en.wikipedia.org/wiki/Cyclic_group)

> **Comments:**
> **username_0**: Thanks, I understand the curve the point is on a cyclic group of points. I would have been more clear with my question. I have updated the main question.  

---

### Answer by username_4 on 2021-01-08. Score: 1

### How subtraction works

`P - Q = P + (-Q)` where `-Q` is the negated `Q`. (`-` changes the sign, or in another words, subtracts from the modulus)

An example: On [this website](https://enriquesl-git.github.io/ecc/interactive/modk-mul.html). For this example, set p = 523;

Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate `4P - P`:

Set n = 4 to find 4P = (-236, 235)

For n = 1 to find P = (10, 22)

Now, we need to negate it, so set n = -1 to find -P = (10, -22)

Go to the addition tab to add -P to 4P, to find (22, -42)

Set n = 3 to see if we find the same value ... we do (22, -42)

---

But, the answer is not "negative", as username_3 explains.

> **Comments:**
> **username_0**: I guess I should have been more clear with my question. The explanation of a point not being negative makes perfect sense.  I will explain what I am trying to understand. I will edit the main post.  

---

