I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.

Let's take a point GP. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y G10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)

Let's take another point GQ for subtraction with GP. for Q=20 I get, G*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)

Now subtract GP - GQ, In normal math, it is 10-20= -10, but with EC math I get a point (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)

which has the same X value as 10 but Y is different. If I add G to the result the point is 9G but with a different value.

I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G

Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)

One valve is used for 10 and the other for a point which is a result of subtraction.

p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f x = 72488970228380509287422715226575535698893157273063074627791787432852706183111 ysquared = ((xxx+7) % p)
y = pow(ysquared, (p+1)/4, p) print "y1 = %s " % y print "y2 = %s " % (y * -1 % p)

So that question can also be, How to know which Y value to use if a value of X is given,


There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an elliptic curve over a finite field. It is a cyclic group of points composed of positive-integers. You might want to learn about modulo arithmetic and cyclic groups

  • Thanks, I understand the curve the point is on a cyclic group of points. I would have been more clear with my question. I have updated the main question. – Chegde Jan 9 at 10:28

As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined here so in your example to get the result for -10 * G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)


If the point (X,Y) is on the elliptic curve y2 = x3 + ax + b, then the point (X,-Y) is also on that curve. Substitution yields (-y)2 = x3 + ax + b, which is the same equation.

In fact, it is the case that if kG = (X,Y), then (-k)G = (N-k)G = (X,P-Y), where the multiplications with G are point multiplications, N is the curve order, and P is the field size (P = 2256 - 232 - 977 for secp256k1).

So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.

Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:

  • The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.
  • The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.
  • The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.

How subtraction works

P - Q = P + (-Q) where -Q is the negated Q. (- changes the sign, or in another words, subtracts from the modulus)

An example: On this website. For this example, set p = 523;

Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate 4P - P:

Set n = 4 to find 4P = (-236, 235)

For n = 1 to find P = (10, 22)

Now, we need to negate it, so set n = -1 to find -P = (10, -22)

Go to the addition tab to add -P to 4P, to find (22, -42)

Set n = 3 to see if we find the same value ... we do (22, -42)

But, the answer is not "negative", as pinhead explains.

  • I guess I should have been more clear with my question. The explanation of a point not being negative makes perfect sense. I will explain what I am trying to understand. I will edit the main post. – Chegde Jan 9 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.