<blockquote>
<p>given a private key Z that multiplied by the generator point G gives a public key P fulfills x^3 + 7 being a square, is it safe to say that either (x,y) is a valid point / pubkey, or (x, curve p - y) is a valid pubkey, and so recovering a pubkey with only the X coordinate can (given that x^3 + 7 is a square) be either Y coordinate?</p>
</blockquote>
<p>When <em>(x, y) ∈ E</em>, where <em>E = {(x,y) : x<sup>2</sup> = y<sup>3</sup> + 7 (mod p)}</em> (the secp256k1 curve), then indeed <em>(x,-y (mod p)) = (x,p-y) ∈ E</em> as well. This is easy to see by substituting <em>y' = p-y</em> in the equation.</p>
<p>This does however not say anything about the corresponding private key. In fact, if <em>P = (x,y) = qG</em> where <em>G</em> is the generator (or put otherwise, <em>q</em> is the private key corresponding to the public key point <em>P</em>), then it holds that <em>-P = (x,-y mod p) = ((-q) mod n)G</em>. In other words, negating the Y coordinate of a point corresponds with negating the private key (modulo <em>n</em>, the order of the curve, which is different from <em>p</em>, the size of coordinate field the curve is defined over).</p>
<p>Since <em>p</em> is odd, <em>(x,y)</em> and <em>(x,p-y)</em> have distinct parities for their Y coordinates; one will be odd, and the other will be even. Also, one will be in range <em>[0..(p-1)/2]</em> and the other will be in range <em>[(p+1)/2..p-1]</em>. There are more possible tie-breakers between these two; including one based on quadratic residuosity (which I won't go into here as it would take us too far).</p>
<p>As far as ECDSA is concerned, these are <em>distinct</em> public and private keys. Every private key has exactly one public key corresponding to it, as public keys are (typically) encoded as 1 byte (indicating whether Y is even or odd), plus 32 bytes (for the X coordinate in full).</p>
<p>In BIP340, the Elliptic-Curve Schnorr signature scheme that will be activated in the near future on Bitcoin, along with the Taproot softfork (BIP341), things are different. In BIP340, public keys consist of just the 32-byte X coordinate, where for computation purposes the implicitly-even Y coordinate is used. That implies that there are indeed two private keys corresponding to such an &quot;x-only&quot; public key; <em>q</em> and <em>n-q</em>.</p>

CC BY-SA 4.0
2021-08-06T18:32:21.853Z
Thanks. I think your last paragraph described the crux of the issue: a BIP340 implementation I found was forcing even Y coordinates while my other library didn't +  there was just a hex X-coordinate and no "is Y even" markers (eg 0x02 : 0x03) when encoded as you mentioned, causing some confusion about what exactly is considered the standard, though I should perhaps just have read the BIP.. Thank you anyway for your eleborate answer as well as @MCCCS (I can only mark one answer...)
user16318248
CC BY-SA 4.0
2021-08-06T17:18:49.987Z
2021-08-06T17:25:37.250Z
2021-08-06T17:25:37.250Z
Pieter Wuille
<p>Elliptic curve equations require that remainders of both sides must be equal for a point to be on the curve.</p>
<p><a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow noreferrer">https://en.bitcoin.it/wiki/Secp256k1</a> on this page, p denotes the divisor.</p>
<p>As a law of modular arithmetic, (a)^2 (mod p) is equivalent to (n*p + 2)^2</p>
<p>As a mathematical law, (a)^2 = (-a)^2</p>
<p>Combining these, you may prove that for (x,y) satisfying the equation, (x, p-y) would also satisfy</p>
<p>(you may replace 2 with any positive integer)</p>
<p>There is also the curve order, which is related to point addition more than it's related to the elliptic curve equation.</p>

CC BY-SA 4.0
2021-08-06T16:41:34.223Z
2021-08-06T16:41:34.223Z
MCCCS
<p>given a private key Z that multiplied by the generator point G gives a public key P fulfills x^3 + 7 being a square, is it safe to say that either (x,y) is a valid point / pubkey, or (x, curve p - y) is a valid pubkey, and so recovering a pubkey with only the X coordinate can (given that x^3 + 7 is a square) be either Y coordinate?</p>
<p>If so, what is given preference to for wallets to generate if x^3 + 7 is squared? even or odd?</p>
<p>I assume Y would be standard regardless of whether it is odd or not but I am looking through a couple implementations which assume Y is even and will (curve P - Y) if Y is initially odd?</p>
<p>Just wondering if I am understanding this correctly. Is there an obvious term for this that I'm missing, or am I completely misunderstanding this?</p>

CC BY-SA 4.0
2021-08-06T16:26:00.720Z
No one uses negative y? y^2 = x^3 + 7 makes this obvious. The smaller y is the positive which is to be used. Does this help? https://crypto.stackexchange.com/questions/54845/verify-points-on-curve-secp256k1
MCCCS
CC BY-SA 4.0
2021-08-06T16:32:32.823Z
Sorry, right, I mean that Y itself is subtracted by P, not that Y in itself is negative. I have to admit I have very little knowledge about this particular subject and it's actually a bit of an XY problem that I stumbled upon but I think the key lies herein that when Y is initially odd, it is correct to say that you can subtract it from curve P to get an even Y?
user16318248
CC BY-SA 4.0
2021-08-06T16:40:30.203Z
@MCCCS If I skimmed over that correctly it seems to confirm my suspicions. thanks!
user16318248
<public-key>
Does every private key have two public keys (ie Y and negated Y?) (secp256k1)
user16318248
# Does every private key have two public keys (ie Y and negated Y?) (secp256k1)

(Asked by: username_0 on 2021-08-06)

given a private key Z that multiplied by the generator point G gives a public key P fulfills x^3 + 7 being a square, is it safe to say that either (x,y) is a valid point / pubkey, or (x, curve p - y) is a valid pubkey, and so recovering a pubkey with only the X coordinate can (given that x^3 + 7 is a square) be either Y coordinate?

If so, what is given preference to for wallets to generate if x^3 + 7 is squared? even or odd?

I assume Y would be standard regardless of whether it is odd or not but I am looking through a couple implementations which assume Y is even and will (curve P - Y) if Y is initially odd?

Just wondering if I am understanding this correctly. Is there an obvious term for this that I'm missing, or am I completely misunderstanding this?

**Tags:** public-key

> **Comments:**
> **username_1**: No one uses negative y? y^2 = x^3 + 7 makes this obvious. The smaller y is the positive which is to be used. Does this help? https://crypto.stackexchange.com/questions/54845/verify-points-on-curve-secp256k1  
> **username_0**: Sorry, right, I mean that Y itself is subtracted by P, not that Y in itself is negative. I have to admit I have very little knowledge about this particular subject and it's actually a bit of an XY problem that I stumbled upon but I think the key lies herein that when Y is initially odd, it is correct to say that you can subtract it from curve P to get an even Y?  
> **username_0**: @username_1 If I skimmed over that correctly it seems to confirm my suspicions. thanks!  

---

## 2 answers

### Answer by username_2 on 2021-08-06. Score: 3 | Accepted answer

> given a private key Z that multiplied by the generator point G gives a public key P fulfills x^3 + 7 being a square, is it safe to say that either (x,y) is a valid point / pubkey, or (x, curve p - y) is a valid pubkey, and so recovering a pubkey with only the X coordinate can (given that x^3 + 7 is a square) be either Y coordinate?

When *(x, y) ∈ E*, where *E = {(x,y) : x2 = y3 + 7 (mod p)}* (the secp256k1 curve), then indeed *(x,-y (mod p)) = (x,p-y) ∈ E* as well. This is easy to see by substituting *y' = p-y* in the equation.

This does however not say anything about the corresponding private key. In fact, if *P = (x,y) = qG* where *G* is the generator (or put otherwise, *q* is the private key corresponding to the public key point *P*), then it holds that *-P = (x,-y mod p) = ((-q) mod n)G*. In other words, negating the Y coordinate of a point corresponds with negating the private key (modulo *n*, the order of the curve, which is different from *p*, the size of coordinate field the curve is defined over).

Since *p* is odd, *(x,y)* and *(x,p-y)* have distinct parities for their Y coordinates; one will be odd, and the other will be even. Also, one will be in range *[0..(p-1)/2]* and the other will be in range *[(p+1)/2..p-1]*. There are more possible tie-breakers between these two; including one based on quadratic residuosity (which I won't go into here as it would take us too far).

As far as ECDSA is concerned, these are *distinct* public and private keys. Every private key has exactly one public key corresponding to it, as public keys are (typically) encoded as 1 byte (indicating whether Y is even or odd), plus 32 bytes (for the X coordinate in full).

In BIP340, the Elliptic-Curve Schnorr signature scheme that will be activated in the near future on Bitcoin, along with the Taproot softfork (BIP341), things are different. In BIP340, public keys consist of just the 32-byte X coordinate, where for computation purposes the implicitly-even Y coordinate is used. That implies that there are indeed two private keys corresponding to such an "x-only" public key; *q* and *n-q*.

> **Comments:**
> **username_0**: Thanks. I think your last paragraph described the crux of the issue: a BIP340 implementation I found was forcing even Y coordinates while my other library didn't +  there was just a hex X-coordinate and no "is Y even" markers (eg 0x02 : 0x03) when encoded as you mentioned, causing some confusion about what exactly is considered the standard, though I should perhaps just have read the BIP.. Thank you anyway for your eleborate answer as well as @username_1 (I can only mark one answer...)  

---

### Answer by username_1 on 2021-08-06. Score: 0

Elliptic curve equations require that remainders of both sides must be equal for a point to be on the curve.

<https://en.bitcoin.it/wiki/Secp256k1> on this page, p denotes the divisor.

As a law of modular arithmetic, (a)^2 (mod p) is equivalent to (n\*p + 2)^2

As a mathematical law, (a)^2 = (-a)^2

Combining these, you may prove that for (x,y) satisfying the equation, (x, p-y) would also satisfy

(you may replace 2 with any positive integer)

There is also the curve order, which is related to point addition more than it's related to the elliptic curve equation.


---

