What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Question

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^K " (where G is a combination of GeneratorPoint_X and GeneratorPoint_Y and k is order value of n).

My question is, if we have only the Y coordinate belonging to a given publicKey, can we get the X coordinate?

or Is it only possible to derive Y from X and not the other way around?

If so how can this be achieved?

Answer 1

It isn't an encryption protocol as nothing is being encrypted. A public key is calculated from a private key and then the private key is used to generate digital signatures proving ownership of the private key associated with that public key without leaking the private key.

But yes with an elliptic curve the Y coordinate can be calculated from the X coordinate and vice versa. Just substitute x into

y^2 = x^3 + 7 (mod p)

where p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1

or rearrange to get:

x^3 = y^2 - 7 (mod p)

There is a complication in that every valid X coordinate has two possible Y coordinates (as detailed in BIP340) but BIP340 also instructs you on which Y coordinate to pick for Schnorr public keys.

Pieter added in the comments that it is also the case (only for y^2 = x^3 + B curves like secp256k1) that every valid Y coordinate has three corresponding X coordinates.