Is it possible to know if the result of 2 point subtraction is before or after G

Question

I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.

Let's take a point GP. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y G10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)

Let's take another point GQ for subtraction with GP. for Q=20 I get, G*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)

Now subtract GP - GQ, In normal math, it is 10-20= -10, but with EC math I get a point (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)

which has the same X value as 10 but Y is different. If I add G to the result the point is 9G but with a different value.

I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G

Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)

One valve is used for 10 and the other for a point which is a result of subtraction.

p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f x = 72488970228380509287422715226575535698893157273063074627791787432852706183111 ysquared = ((xxx+7) % p)
y = pow(ysquared, (p+1)/4, p) print "y1 = %s " % y print "y2 = %s " % (y * -1 % p)

So that question can also be, How to know which Y value to use if a value of X is given,

Answer 1

There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an elliptic curve over a finite field. It is a cyclic group of points composed of positive-integers. You might want to learn about modulo arithmetic and cyclic groups

Answer 2

As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined here so in your example to get the result for -10 * G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)

Answer 3

If the point (X,Y) is on the elliptic curve y² = x³ + ax + b, then the point (X,-Y) is also on that curve. Substitution yields (-y)² = x³ + ax + b, which is the same equation.

In fact, it is the case that if kG = (X,Y), then (-k)G = (N-k)G = (X,P-Y), where the multiplications with G are point multiplications, N is the curve order, and P is the field size (P = 2²⁵⁶ - 2³² - 977 for secp256k1).

So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.

Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:

• The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.
• The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.
• The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.

Answer 4

How subtraction works

P - Q = P + (-Q) where -Q is the negated Q. (- changes the sign, or in another words, subtracts from the modulus)

An example: On this website. For this example, set p = 523;

Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate 4P - P:

Set n = 4 to find 4P = (-236, 235)

For n = 1 to find P = (10, 22)

Now, we need to negate it, so set n = -1 to find -P = (10, -22)

Go to the addition tab to add -P to 4P, to find (22, -42)

Set n = 3 to see if we find the same value ... we do (22, -42)

---

But, the answer is not "negative", as pinhead explains.