<p>The points on an elliptic curve, combined with the point at infinity, and the point addition operation, define a <em>group</em>. I consider explaining why that is outside of the scope of this site, but it follows from a number of properies this set and operation has, such as associativity and every element having a negation.</p>
<p>The subset of a group of elements obtained by repeatedly adding a specific element (called the generator) to itself, also forms a group. This group is always cyclic (meaning that every element can be written as a multiple of some specific element - this is obviously true if the group itself is the subset of elements generated that way).</p>
<p>It is a standard result in group theory that every cyclic group is either infinite (in which case it behaves like addition over the integers) or finite (in which case it behaves like additions over the intergers modulo the size of the group).</p>
<p>Since we're working over a finite field, there can only be a finite number of elements our group has. Thus, inevitably, the group obtained by repeatedly adding a particular curve point to itself must be a finite cyclic group. In your example, the one of order 8. If we'd be working over the reals instead, then depending on the starting point it could be an infinite cyclic group too (but not necessarily; e.g. <em>(1,2)</em> on <em>y<sup>2</sup> = x<sup>3</sup> + x + 2</em> over the reals defines a cyclic group of order 4, consisting of <em>[(1,2), (-1,0), (1,-2), infinity]</em>).</p>
<p>Since our group is a finite cyclic group of order 8, it must behave identical to the integers modulo 8. In other words, <em>5G</em> is the same as <em>(-3)G</em>, which is <em>-(3G)</em>, which is the negation of <em>3G</em>, which has the same X coordinate as <em>3G</em>. This holds for all points, so <em>[1G, 2G, 3G, 4G, 5G, 6G, 7G, 8G] = [1G, 2G, 3G, 4G, -3G, -2G, -1G, 0G]</em>. But it's also equal to <em>[-7G, -6G, -5G, -4G, -3G, -2G, -1G, 0G]</em>, or anything else that is equal modulo 8. You can say that it &quot;reverses&quot; after 4G, but all that's happening is that <em>5G</em> and <em>-3G</em> necessarily have the same X coordinate.</p>
<p>Overall, the bottom line is that when working over a finite cyclic group, as this must be, the second half of group elements obtained are the same as the first half, but negated and in reverse order.</p>

CC BY-SA 4.0
2023-11-21T20:46:10.927Z
Literally everything is clear to me. I understand (and know from earlier) the concepts of groups, cyclic subgroups etc. I also understand that in context of integers mod n (let's say 8), for example: `... -3, -2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12`, it would correspond to the `... 5, 6, 7, 0, 1, 2, 3, 4, 5, 6, 7, 0, 1, 2, 3, 4 ...` and it is cyclic group since it repeats. In context of EC I also understand it all if we look at things in the following way.
LeaBit
CC BY-SA 4.0
2023-11-21T20:46:15.097Z
If we consider that this: `... -3*(2,1), -2*(2,1), -1*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1), 4*(2,1), 5*(2,1), 6*(2,1), 7*(2,1), 8*(2,1), 9*(2,1), 10*(2,1), 11*(2,1) ...` is equal to this (which it is): `... 5*(2,1), 6*(2,1), 7*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1), 4*(2,1), 5*(2,1), 6*(2,1), 7*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1) ...`. Thus, again cyclic group. However, what confuses me is that `-a*G` is also `a*(Gx, -Gy)`, so `-3*(2, 1)` is not just `5*(2, 1)` but also `3*(2, -1)`. Therefore, we are working (in some way) with a completely different point and that confuses me.
LeaBit
CC BY-SA 4.0
2023-11-21T20:46:53.730Z
I hope I have now explained what is confusing me. It seems completely ridiculous, but for some reason I can't understand it, even though it all seems completely logical... I don't know how to get it over my head.
LeaBit
CC BY-SA 4.0
2023-11-21T20:49:09.003Z
`-a*(Gx, Gy)` = `a*-(Gx, Gy)` = `a*(Gx, -Gy)`. This all follows from the fact that negating a point is multiplying the point with -1.
Pieter Wuille
CC BY-SA 4.0
2023-11-21T21:03:29.607Z
Yes, I know that too. However, the negation of integers means that you literally just add `-` (more accurate to say multiply with -1), so 5 is negated -5, i.e. according to mod8 it is 3. What confuses me is that in the context of integers -3mod8 represents literally 5, while in EC it can be -3* (2, 1) = 5*(2, 1) as with integers, but it can also be 3*(2, -1). So, we literally work with different point, multiplying it 3 times (instead of 5) and get the same thing. I just can't figure it out for some reason. I'm not sure how much you can help me at all, but anyway thanks for the effort :)
LeaBit
CC BY-SA 4.0
2023-11-21T21:06:53.020Z
If you have another "crazy" way for me to get it, I would appreciate it, otherwise, it doesn't matter, thanks for this too :)
LeaBit
CC BY-SA 4.0
2023-11-21T21:07:24.393Z
`-3 * P` = `(3 * -1) * P` = `3 * -1 * P` = `3 * (-1 * P)` = `3 * (-P)`. Multiplying P by -3 is the same as multiplying the negation of P (which means negating its Y coordinate) with 3.
Pieter Wuille
CC BY-SA 4.0
2023-11-21T21:27:33.620Z
Just to let you know that I finally got it
LeaBit
CC BY-SA 4.0
2023-11-21T19:33:12.933Z
2023-11-21T20:00:51.780Z
2023-11-21T20:00:51.780Z
Pieter Wuille
<p>Thank you all very much in advance!</p>
<p>I will explain best with an example what is not clear to me.</p>
<p>Consider the elliptic curve <code>a = 1</code>, <code>b = 2</code>, <code>p = 11</code> of order <code>16</code>.</p>
<p><a href="https://i.sstatic.net/Lng4U.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Lng4U.png" alt="enter image description here" /></a></p>
<p>Also let's consider the &quot;opposite&quot; (negations of each other) two points of this elliptic curve <code>(2, 1)</code> and <code>(2, 10)</code> = <code>(2, -1)</code> as starting points. These are the points for which we will do the multiplication.</p>
<p>For both of these two points, the order is 8 (we can only get 8 out of 16 points if we multiply them). I took this example arbitrarily just to make it as small as possible.</p>
<p>By multiplying <code>(2, 1)</code> we get the following points (next to the points are numbers that indicate the number by which (2, 1) must be multiplied to get it):</p>
<p><a href="https://i.sstatic.net/cQIWN.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/cQIWN.png" alt="enter image description here" /></a></p>
<p>By multiplying <code>(2, -1)</code> we get the following points (next to the points are numbers that indicate the number by which (2, -1) must be multiplied to get it):</p>
<p><a href="https://i.sstatic.net/fX5FE.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/fX5FE.png" alt="enter image description here" /></a></p>
<p>Until multiplying by 4 (in both cases) everything is as I expect. Multiplication just gives opposite points (the negation of each other) since we are working with the opposite points. For example, <code>2 * (2, 1)</code> gives <code>(8, 4)</code> and <code>2 * (2, -1)</code> gives <code>(8, -4)</code> = <code>(8, 7)</code> since it is the opposite (negation) of <code>(8, 4)</code>. Same for multiplying by 3. This works literally the same as in case of working with an elliptic curve over real numbers. <strong>So everything is clear.</strong></p>
<p>However, what confuses me is that after multiplying with 4 <strong>we're starting to sort of go backwards.</strong></p>
<p>For example, multiplying <code>(2, 1)</code> by <strong>5</strong>, we get <code>(5, 2)</code>, which is also the <strong>3rd</strong> point when multiplying <code>(2, -1)</code> (that is, <code>3 * (2, -1) = (5, 2)</code>). This also applies in the opposite way. Multiplying <code>(2, -1)</code> by <strong>5</strong>, we get <code>(5, -2)</code>, which is also <strong>3rd</strong> point when multiplying by <code>(2, 1)</code>.</p>
<p><strong>It turns out that we are actually going backwards, which is different from the case when we work with the real numbers where we would just keep going by the principle before multiplying by 4 forever, so that there would be no such &quot;repetition&quot; of points</strong></p>
<p><strong>Also, it looks like multiplying by 4, i.e. the point <code>(10, 0)</code> actually represents that TURNING POINT. Better said, up to that point everything goes like with real numbers, however, from there, we start going backwards.</strong></p>
<p>So it goes as expected until some points. After that points, it starts to go backwards until we reach the beginning, that is, <code>(2, 1)</code>/<code>(2, -1)</code> point in our example. In other words, until we make the whole circle, when everything starts from the beginning.</p>
<ol>
<li>Why is this happening? Why do we have this circular behavior?</li>
<li>What must be specific about a point (in this example <code>(10, 0)</code>) for it to be a turning point? I thought that, in this example, <code>4 * (2, 1)</code> and <code>4 * (2, -1)</code> <strong>must give the same lambda for the point to be a turning point</strong> (since that's the only difference between working on a finite field and on real numbers), but that's not the case , that is, the same lambda is not obtained.</li>
</ol>

CC BY-SA 4.0
2023-11-21T17:14:08.847Z
This elliptic curve is not a cyclic group, meaning it's not possible to write every point on it as some multiple of a generator. Things will work much more naturally when you do use a cyclic group (like a=1 b=3, over the same field), and even better when using a prime-ordered group (like a=1 b=5, over the same field). This explains why you're not reaching *all* points on the curve, though isn't really an answer to your question. I suggest retrying with a=1 b=5 and see if the result is still unexpected to you. However, I suspect there will not be much more to say than "it just is".
Pieter Wuille
CC BY-SA 4.0
2023-11-21T17:19:37.907Z
In this case, the order of the point you started with is 8 (as there are only 8 points reachable as multiples of your starting point). Multiplying with 3 and multiplying by 5 is not the same thing; they're each others negation. So you observe that 3*G = -(5*G). That is entirely expected, as 3 = -5 mod 8, so 3*G = (-5)*G = -(5*G). On a prime-ordered curve this will be modulo the curve order (as on such curves the order of every non-infinite element is equal to the curve order).
Pieter Wuille
CC BY-SA 4.0
2023-11-21T17:32:58.530Z
Perhaps the answer to your question is just that once you're past half the starting point's order, you'll start to see the same X coordinates (but opposite Y coordinates), as you're effectively going through their negations ([1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8). This is true for every cyclic group (not just elliptic curve groups). Even though the curve itself isn't cyclic in this case, the subgroup generated by the multiples of your starting point are.
Pieter Wuille
CC BY-SA 4.0
2023-11-21T17:35:21.560Z
In case the point order is even (as is the case here), it holds that 4 = -4 mod 8, so 4*G = -4*G. Thus, in such groups, it must hold that the halfway point (starting point times half its order) is its own negation. That implies its Y coordinate must be 0, as (X,Y) = (X,-Y) implies Y=-Y, or Y=0. And you can indeed see that is the case here!
Pieter Wuille
CC BY-SA 4.0
2023-11-21T17:44:32.753Z
@PieterWuille I think I did not explain (asked) it well. I do not want to reach all 16 points. 8 points was enough for me to show what's confusing me (even though it looks like I did not show it well). What confuses me is that after some point (in the example (10, 0)) we are starting to get points that we already got by multiplying the opposite one. For example, 2*(2,1) = (8,4); 3*(2,1) = (4,9); 4*(10,0); 2*(2,-1) = (8,7); 3*(2,-1) = (4,2); 4*(2,-1) = (10, 0). So, I am getting the opposite points (as expected).
LeaBit
CC BY-SA 4.0
2023-11-21T17:44:38.887Z
After multiplying with 4, I will still get the the opposite points, but not some "random" points (not like in case of multiplying before 4), **but the same points as its opposite has before multiplying with 4 in that direction**. For example, 5*(2,1) won't be some (randomX, randomY), but the 3rd point for (2, -1) and that's (4,2). Also, 5*(2,-1) won't be some (opposite_to_randomX, opposite_to_randomY), but the 3rd point for (2, 1) and that's (4,9). So I am still getting the opposite points, **but it looks like it goes backward**.
LeaBit
CC BY-SA 4.0
2023-11-21T17:44:45.147Z
I noticed the rule that the sum of the points (in the context of order/ point ordinal) must be equal to the order of point G. In the example 1+7 = 8, 2+6 = 8... 4+3 = 8.. . Where the first number in the equation represents the ordinal number of the point obtained when multiplied by the positive version of G, and the second represents the ordinal number of the point obtained when multiplied by the negative version of G.
LeaBit
CC BY-SA 4.0
2023-11-21T17:54:44.997Z
@PieterWuille If we were working with real numbers, this would not be the case. In the same way (like multiplying before 4 in the example) we would go to "infinity". By multiplying G and multiplying -G, we would always get mutually negative numbers, but we would never have this repetition of points, i.e. going backward like this.
LeaBit
CC BY-SA 4.0
2023-11-21T17:58:28.420Z
I think I gave the explanation above: *[1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8*. So multiply by G and you get *[1G, 2G, 3G, 4G, 5G, 6G, 7G] = [1G, 2G, 3G, 4G, -3G, -2G, -1G]*. This is a general property of any cyclic group, including the one formed by multiples of G. If considered over the real numbers the result doesn't have a finite order, so there is no "hapfway point" ever. As for why elliptic curves over finite fields form cyclic groups... I suggest taking a algebraic geometry course or so.
Pieter Wuille
CC BY-SA 4.0
2023-11-21T18:03:39.123Z
@PieterWuille Actually, you did. The problem was that it did not load all the comments (I did not refresh the page) before I post my comments. Just what does create in this case (EC over finite field) a cyclic group, since elliptic curve over R does not create cyclic group and only difference is that in calculating lambda we are using mod inverse?
LeaBit
CC BY-SA 4.0
2023-11-21T18:04:01.193Z
I do not think I can explain that. Actually it's a cyclic group too over R, just one with infinite order, so there is no halfway point.
Pieter Wuille
CC BY-SA 4.0
2023-11-21T18:06:34.407Z
@PieterWuille Okay, thanks anyway.
LeaBit
CC BY-SA 4.0
2023-11-21T18:19:48.393Z
@PieterWuille Just one question. You wrote above `Perhaps the answer to your question is just that once you're past half the starting point's order, you'll start to see the same X coordinates (but opposite Y coordinates), as you're effectively going through their negations ([1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8).` I have understood everything expect **why are we going through their negations after half**, that is why do we go -3,-2,-1 and not 5 6 7 8?
LeaBit
CC BY-SA 4.0
2023-11-21T18:43:00.033Z
You do both. 5 **equals** -3, 6 **equals** -2, 7 **equals** -1, when operating modulo 8 (as happens in a cyclic group of order 8). If you'd actually compute say 45*G you'll end up with the same point as 5*G or -3*G, because modulo 8, all these numbers are the same.
Pieter Wuille
<elliptic-curve>
Why do we have "circular behavior" when working with EC over finite field and what makes some point a "turning point"?
LeaBit
# Why do we have "circular behavior" when working with EC over finite field and what makes some point a "turning point"?

(Asked by: username_0 on 2023-11-21)

Thank you all very much in advance!

I will explain best with an example what is not clear to me.

Consider the elliptic curve `a = 1`, `b = 2`, `p = 11` of order `16`.

[![enter image description here](https://i.sstatic.net/Lng4U.png)](https://i.sstatic.net/Lng4U.png)

Also let's consider the "opposite" (negations of each other) two points of this elliptic curve `(2, 1)` and `(2, 10)` = `(2, -1)` as starting points. These are the points for which we will do the multiplication.

For both of these two points, the order is 8 (we can only get 8 out of 16 points if we multiply them). I took this example arbitrarily just to make it as small as possible.

By multiplying `(2, 1)` we get the following points (next to the points are numbers that indicate the number by which (2, 1) must be multiplied to get it):

[![enter image description here](https://i.sstatic.net/cQIWN.png)](https://i.sstatic.net/cQIWN.png)

By multiplying `(2, -1)` we get the following points (next to the points are numbers that indicate the number by which (2, -1) must be multiplied to get it):

[![enter image description here](https://i.sstatic.net/fX5FE.png)](https://i.sstatic.net/fX5FE.png)

Until multiplying by 4 (in both cases) everything is as I expect. Multiplication just gives opposite points (the negation of each other) since we are working with the opposite points. For example, `2 * (2, 1)` gives `(8, 4)` and `2 * (2, -1)` gives `(8, -4)` = `(8, 7)` since it is the opposite (negation) of `(8, 4)`. Same for multiplying by 3. This works literally the same as in case of working with an elliptic curve over real numbers. **So everything is clear.**

However, what confuses me is that after multiplying with 4 **we're starting to sort of go backwards.**

For example, multiplying `(2, 1)` by **5**, we get `(5, 2)`, which is also the **3rd** point when multiplying `(2, -1)` (that is, `3 * (2, -1) = (5, 2)`). This also applies in the opposite way. Multiplying `(2, -1)` by **5**, we get `(5, -2)`, which is also **3rd** point when multiplying by `(2, 1)`.

**It turns out that we are actually going backwards, which is different from the case when we work with the real numbers where we would just keep going by the principle before multiplying by 4 forever, so that there would be no such "repetition" of points**

**Also, it looks like multiplying by 4, i.e. the point `(10, 0)` actually represents that TURNING POINT. Better said, up to that point everything goes like with real numbers, however, from there, we start going backwards.**

So it goes as expected until some points. After that points, it starts to go backwards until we reach the beginning, that is, `(2, 1)`/`(2, -1)` point in our example. In other words, until we make the whole circle, when everything starts from the beginning.

1. Why is this happening? Why do we have this circular behavior?
2. What must be specific about a point (in this example `(10, 0)`) for it to be a turning point? I thought that, in this example, `4 * (2, 1)` and `4 * (2, -1)` **must give the same lambda for the point to be a turning point** (since that's the only difference between working on a finite field and on real numbers), but that's not the case , that is, the same lambda is not obtained.

**Tags:** elliptic-curve

> **Comments:**
> **username_1**: This elliptic curve is not a cyclic group, meaning it's not possible to write every point on it as some multiple of a generator. Things will work much more naturally when you do use a cyclic group (like a=1 b=3, over the same field), and even better when using a prime-ordered group (like a=1 b=5, over the same field). This explains why you're not reaching *all* points on the curve, though isn't really an answer to your question. I suggest retrying with a=1 b=5 and see if the result is still unexpected to you. However, I suspect there will not be much more to say than "it just is".  
> **username_1**: In this case, the order of the point you started with is 8 (as there are only 8 points reachable as multiples of your starting point). Multiplying with 3 and multiplying by 5 is not the same thing; they're each others negation. So you observe that 3*G = -(5*G). That is entirely expected, as 3 = -5 mod 8, so 3*G = (-5)*G = -(5*G). On a prime-ordered curve this will be modulo the curve order (as on such curves the order of every non-infinite element is equal to the curve order).  
> **username_1**: Perhaps the answer to your question is just that once you're past half the starting point's order, you'll start to see the same X coordinates (but opposite Y coordinates), as you're effectively going through their negations ([1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8). This is true for every cyclic group (not just elliptic curve groups). Even though the curve itself isn't cyclic in this case, the subgroup generated by the multiples of your starting point are.  
> **username_1**: In case the point order is even (as is the case here), it holds that 4 = -4 mod 8, so 4*G = -4*G. Thus, in such groups, it must hold that the halfway point (starting point times half its order) is its own negation. That implies its Y coordinate must be 0, as (X,Y) = (X,-Y) implies Y=-Y, or Y=0. And you can indeed see that is the case here!  
> **username_0**: @username_1 I think I did not explain (asked) it well. I do not want to reach all 16 points. 8 points was enough for me to show what's confusing me (even though it looks like I did not show it well). What confuses me is that after some point (in the example (10, 0)) we are starting to get points that we already got by multiplying the opposite one. For example, 2*(2,1) = (8,4); 3*(2,1) = (4,9); 4*(10,0); 2*(2,-1) = (8,7); 3*(2,-1) = (4,2); 4*(2,-1) = (10, 0). So, I am getting the opposite points (as expected).  
> **username_0**: After multiplying with 4, I will still get the the opposite points, but not some "random" points (not like in case of multiplying before 4), **but the same points as its opposite has before multiplying with 4 in that direction**. For example, 5*(2,1) won't be some (randomX, randomY), but the 3rd point for (2, -1) and that's (4,2). Also, 5*(2,-1) won't be some (opposite_to_randomX, opposite_to_randomY), but the 3rd point for (2, 1) and that's (4,9). So I am still getting the opposite points, **but it looks like it goes backward**.  
> **username_0**: I noticed the rule that the sum of the points (in the context of order/ point ordinal) must be equal to the order of point G. In the example 1+7 = 8, 2+6 = 8... 4+3 = 8.. . Where the first number in the equation represents the ordinal number of the point obtained when multiplied by the positive version of G, and the second represents the ordinal number of the point obtained when multiplied by the negative version of G.  
> **username_0**: @username_1 If we were working with real numbers, this would not be the case. In the same way (like multiplying before 4 in the example) we would go to "infinity". By multiplying G and multiplying -G, we would always get mutually negative numbers, but we would never have this repetition of points, i.e. going backward like this.  
> **username_1**: I think I gave the explanation above: *[1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8*. So multiply by G and you get *[1G, 2G, 3G, 4G, 5G, 6G, 7G] = [1G, 2G, 3G, 4G, -3G, -2G, -1G]*. This is a general property of any cyclic group, including the one formed by multiples of G. If considered over the real numbers the result doesn't have a finite order, so there is no "hapfway point" ever. As for why elliptic curves over finite fields form cyclic groups... I suggest taking a algebraic geometry course or so.  
> **username_0**: @username_1 Actually, you did. The problem was that it did not load all the comments (I did not refresh the page) before I post my comments. Just what does create in this case (EC over finite field) a cyclic group, since elliptic curve over R does not create cyclic group and only difference is that in calculating lambda we are using mod inverse?  
> **username_1**: I do not think I can explain that. Actually it's a cyclic group too over R, just one with infinite order, so there is no halfway point.  
> **username_0**: @username_1 Okay, thanks anyway.  
> **username_0**: @username_1 Just one question. You wrote above `Perhaps the answer to your question is just that once you're past half the starting point's order, you'll start to see the same X coordinates (but opposite Y coordinates), as you're effectively going through their negations ([1,2,3,4,5,6,7] mod 8 = [1,2,3,4,-3,-2,-1] mod 8).` I have understood everything expect **why are we going through their negations after half**, that is why do we go -3,-2,-1 and not 5 6 7 8?  
> **username_1**: You do both. 5 **equals** -3, 6 **equals** -2, 7 **equals** -1, when operating modulo 8 (as happens in a cyclic group of order 8). If you'd actually compute say 45*G you'll end up with the same point as 5*G or -3*G, because modulo 8, all these numbers are the same.  

---

## 1 answers

### Answer by username_1 on 2023-11-21. Score: 1 | Accepted answer

The points on an elliptic curve, combined with the point at infinity, and the point addition operation, define a *group*. I consider explaining why that is outside of the scope of this site, but it follows from a number of properies this set and operation has, such as associativity and every element having a negation.

The subset of a group of elements obtained by repeatedly adding a specific element (called the generator) to itself, also forms a group. This group is always cyclic (meaning that every element can be written as a multiple of some specific element - this is obviously true if the group itself is the subset of elements generated that way).

It is a standard result in group theory that every cyclic group is either infinite (in which case it behaves like addition over the integers) or finite (in which case it behaves like additions over the intergers modulo the size of the group).

Since we're working over a finite field, there can only be a finite number of elements our group has. Thus, inevitably, the group obtained by repeatedly adding a particular curve point to itself must be a finite cyclic group. In your example, the one of order 8. If we'd be working over the reals instead, then depending on the starting point it could be an infinite cyclic group too (but not necessarily; e.g. *(1,2)* on *y2 = x3 + x + 2* over the reals defines a cyclic group of order 4, consisting of *[(1,2), (-1,0), (1,-2), infinity]*).

Since our group is a finite cyclic group of order 8, it must behave identical to the integers modulo 8. In other words, *5G* is the same as *(-3)G*, which is *-(3G)*, which is the negation of *3G*, which has the same X coordinate as *3G*. This holds for all points, so *[1G, 2G, 3G, 4G, 5G, 6G, 7G, 8G] = [1G, 2G, 3G, 4G, -3G, -2G, -1G, 0G]*. But it's also equal to *[-7G, -6G, -5G, -4G, -3G, -2G, -1G, 0G]*, or anything else that is equal modulo 8. You can say that it "reverses" after 4G, but all that's happening is that *5G* and *-3G* necessarily have the same X coordinate.

Overall, the bottom line is that when working over a finite cyclic group, as this must be, the second half of group elements obtained are the same as the first half, but negated and in reverse order.

> **Comments:**
> **username_0**: Literally everything is clear to me. I understand (and know from earlier) the concepts of groups, cyclic subgroups etc. I also understand that in context of integers mod n (let's say 8), for example: `... -3, -2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12`, it would correspond to the `... 5, 6, 7, 0, 1, 2, 3, 4, 5, 6, 7, 0, 1, 2, 3, 4 ...` and it is cyclic group since it repeats. In context of EC I also understand it all if we look at things in the following way.  
> **username_0**: If we consider that this: `... -3*(2,1), -2*(2,1), -1*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1), 4*(2,1), 5*(2,1), 6*(2,1), 7*(2,1), 8*(2,1), 9*(2,1), 10*(2,1), 11*(2,1) ...` is equal to this (which it is): `... 5*(2,1), 6*(2,1), 7*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1), 4*(2,1), 5*(2,1), 6*(2,1), 7*(2,1), 0*(2,1), 1*(2,1), 2*(2,1), 3*(2,1) ...`. Thus, again cyclic group. However, what confuses me is that `-a*G` is also `a*(Gx, -Gy)`, so `-3*(2, 1)` is not just `5*(2, 1)` but also `3*(2, -1)`. Therefore, we are working (in some way) with a completely different point and that confuses me.  
> **username_0**: I hope I have now explained what is confusing me. It seems completely ridiculous, but for some reason I can't understand it, even though it all seems completely logical... I don't know how to get it over my head.  
> **username_1**: `-a*(Gx, Gy)` = `a*-(Gx, Gy)` = `a*(Gx, -Gy)`. This all follows from the fact that negating a point is multiplying the point with -1.  
> **username_0**: Yes, I know that too. However, the negation of integers means that you literally just add `-` (more accurate to say multiply with -1), so 5 is negated -5, i.e. according to mod8 it is 3. What confuses me is that in the context of integers -3mod8 represents literally 5, while in EC it can be -3* (2, 1) = 5*(2, 1) as with integers, but it can also be 3*(2, -1). So, we literally work with different point, multiplying it 3 times (instead of 5) and get the same thing. I just can't figure it out for some reason. I'm not sure how much you can help me at all, but anyway thanks for the effort :)  
> **username_0**: If you have another "crazy" way for me to get it, I would appreciate it, otherwise, it doesn't matter, thanks for this too :)  
> **username_1**: `-3 * P` = `(3 * -1) * P` = `3 * -1 * P` = `3 * (-1 * P)` = `3 * (-P)`. Multiplying P by -3 is the same as multiplying the negation of P (which means negating its Y coordinate) with 3.  
> **username_0**: Just to let you know that I finally got it  

---

