<p>It is easy to find the largest integer solutions to the curve equation <em>y<sup>2</sup> = x<sup>3</sup> + 7 mod p</em>, where <em>p = 2<sup>256</sup>-2<sup>32</sup>-977</em>, by simply trying numbers from high to low until you hit a solution.</p>
<p>The highest possible X coordinate is <em>p-3</em>, in point <em>(115792089237316195423570985008687907853269984665640564039457584007908834671660, 109188863561374057667848968960504138135859662956057034999983532397866404169138)</em>.</p>
<p>The highest possible Y coordinate is <em>p-1</em>, in point <em>(92132010145575487545665274145875605628664750442204984300260952401046764123763, 115792089237316195423570985008687907853269984665640564039457584007908834671662)</em>.</p>
<p>We cannot possibly compute what the corresponding private keys for these points are. Doing so would amount to breaking the discrete logarithm problem.</p>

CC BY-SA 4.0
2023-10-10T06:50:37.347Z
Glad to see you're still up and running. Thanks as always for your insightful & easy to understand responses.
AncientTides
CC BY-SA 4.0
2023-10-10T06:53:16.443Z
And what if the Discrete Logarithm Problem is broken... Would it be such a bad thing? I mean I know a lot of digital security & financial data (if not all) rely on these yet to be broken algorithms, but still I'm sure the algorithm to break our standard would open new doors into advanced technologies.
AncientTides
CC BY-SA 4.0
2023-10-10T11:49:20.357Z
The security assumption that underlies Bitcoin's transaction signing scheme is that the discrete logarithm for the secp256k1 curve is computationally infeasible. In theory, of course developments or breakthroughs can happen that break it, but since that would let whoever has access to such an algorithm take any BTC they want, I'd say that yes, that would be a bad thing.
Pieter Wuille
CC BY-SA 4.0
2023-10-10T11:52:34.530Z
But my comment above wasn't about whether that would be good or bad, just that it is extremely unlikely to have already happened. There is an extremely large incentive to break the DL for secp256k1 (taking any BTC). If someone could break it, with today's technology and computation power, they would.
Pieter Wuille
CC BY-SA 4.0
2023-10-11T17:12:44.057Z
True, I guess it would be bad.. But what if they limited what they took to the btc's most likely owned by the assumed Satoshi? Or perhaps even Satoshi himself (on demon time) having a back door decides to have a go at some btc's.. I know the latter would be devastating but the former doesn't seem that bad
AncientTides
CC BY-SA 4.0
2023-10-12T22:56:48.650Z
Looking more closely, it doesn't look like those X and Y coordinates are p-2 and p-7 respectively. Specifically, the first X coordinate looks like p-2^32+3533. Are you sure it's correct?
Vojtěch Strnad
CC BY-SA 4.0
2023-10-13T01:05:05.293Z
@VojtěchStrnad Ehh, you're right. I must have made a typo when computing these. Fixed, I hope?
Pieter Wuille
CC BY-SA 4.0
2023-10-13T01:52:46.520Z
@AncientTides Even a credible *possibility* that someone can break the secp256k1 discrete logarithm problem would be devasting to Bitcoin. How could whomever holds this knowledge be trusted to only use it in some subjectively-defined "good" way? The whole point of Bitcoin was not to have to trust anyone to make the right decisions like this.
Pieter Wuille
CC BY-SA 4.0
2023-10-13T02:06:57.393Z
@PieterWuille Looks good now, thanks.
Vojtěch Strnad
CC BY-SA 4.0
2023-10-09T01:47:33.927Z
2023-10-13T01:04:36.453Z
2023-10-13T01:04:36.453Z
Pieter Wuille
<p>We are all familiar with the x &amp; y coordinates of the curve parameters used in bitcoin (or at least we should be).</p>
<p>In terms of being a collective point on graph, we know that the starting point G is also used as a limiting point when carrying out ADDITION &amp; DOUBLING operations... We also know that our graph is a finite curve with it's limits set to G as well.</p>
<p>My Question is, Is there a maximum point X and Y can individually reach?</p>
<p>And if there is, What is the highest point that the X &amp; Y coordinates can reach?</p>

<secp256k1><math>
What is the largest value that the x & y coordinates respectively can be/reach
AncientTides
# What is the largest value that the x & y coordinates respectively can be/reach

(Asked by: username_0 on 2023-10-09)

We are all familiar with the x & y coordinates of the curve parameters used in bitcoin (or at least we should be).

In terms of being a collective point on graph, we know that the starting point G is also used as a limiting point when carrying out ADDITION & DOUBLING operations... We also know that our graph is a finite curve with it's limits set to G as well.

My Question is, Is there a maximum point X and Y can individually reach?

And if there is, What is the highest point that the X & Y coordinates can reach?

**Tags:** secp256k1, math


---

## 1 answers

### Answer by username_1 on 2023-10-09. Score: 5 | Accepted answer

It is easy to find the largest integer solutions to the curve equation *y2 = x3 + 7 mod p*, where *p = 2256-232-977*, by simply trying numbers from high to low until you hit a solution.

The highest possible X coordinate is *p-3*, in point *(115792089237316195423570985008687907853269984665640564039457584007908834671660, 109188863561374057667848968960504138135859662956057034999983532397866404169138)*.

The highest possible Y coordinate is *p-1*, in point *(92132010145575487545665274145875605628664750442204984300260952401046764123763, 115792089237316195423570985008687907853269984665640564039457584007908834671662)*.

We cannot possibly compute what the corresponding private keys for these points are. Doing so would amount to breaking the discrete logarithm problem.

> **Comments:**
> **username_0**: Glad to see you're still up and running. Thanks as always for your insightful & easy to understand responses.  
> **username_0**: And what if the Discrete Logarithm Problem is broken... Would it be such a bad thing? I mean I know a lot of digital security & financial data (if not all) rely on these yet to be broken algorithms, but still I'm sure the algorithm to break our standard would open new doors into advanced technologies.  
> **username_1**: The security assumption that underlies Bitcoin's transaction signing scheme is that the discrete logarithm for the secp256k1 curve is computationally infeasible. In theory, of course developments or breakthroughs can happen that break it, but since that would let whoever has access to such an algorithm take any BTC they want, I'd say that yes, that would be a bad thing.  
> **username_1**: But my comment above wasn't about whether that would be good or bad, just that it is extremely unlikely to have already happened. There is an extremely large incentive to break the DL for secp256k1 (taking any BTC). If someone could break it, with today's technology and computation power, they would.  
> **username_0**: True, I guess it would be bad.. But what if they limited what they took to the btc's most likely owned by the assumed Satoshi? Or perhaps even Satoshi himself (on demon time) having a back door decides to have a go at some btc's.. I know the latter would be devastating but the former doesn't seem that bad  
> **username_2**: Looking more closely, it doesn't look like those X and Y coordinates are p-2 and p-7 respectively. Specifically, the first X coordinate looks like p-2^32+3533. Are you sure it's correct?  
> **username_1**: @username_2 Ehh, you're right. I must have made a typo when computing these. Fixed, I hope?  
> **username_1**: @username_0 Even a credible *possibility* that someone can break the secp256k1 discrete logarithm problem would be devasting to Bitcoin. How could whomever holds this knowledge be trusted to only use it in some subjectively-defined "good" way? The whole point of Bitcoin was not to have to trust anyone to make the right decisions like this.  
> **username_2**: @username_1 Looks good now, thanks.  

---

