1

Ok, so I get address generation now, and I understand that X is hashed, however for verification of a signature, we need the public point, (x,y)

How would one get Y from X?

Lets take an example, im gonna use my generator (0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8) and use private "10" (using a = 0, b = 7, p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f) to get:

(0xa0434d9e47f3c86235477c7b1ae6ae5d3442d49b1943c2b752a68e2a47e247c7,0x893aba425419bc27a3b6c7e693a24c696f794c2ed877a1593cbee53b037368d7)

Now we remove Y, to only have: 0xa0434d9e47f3c86235477c7b1ae6ae5d3442d49b1943c2b752a68e2a47e247c7

Meaning that we need to get Y from X, how would I do this? I never seen this explained really and everything I tried doesn't result in the correct Y value

Improve this question

1 Answer 1

Reset to default
2

The secp256k1 curve equation is:

  • Points (x,y) for which y2 = x3 + 7 mod p, where p = 2256-232-977

If we solve this for y, we get y = ±√(x3 +7) mod p.

Of course, this is not a normal square root, but a square root for the field of integers modulo p, but otherwise this equation is correct. To compute such a modular square root, the Tonelli-Shanks algorithm is used. It can deal with many cases, depending on the structure of the modulus, but for our p modulus it simplifies to just:

  • √a mod p = a(p+1)/4 mod p (for any prime p for which p+1 is a multiple of 4).
Improve this answer
9
  • Tad confused what A is supposed to be, I assumed it was (x^3)+7 but after doing the equation for x = 72488970228380509287422715226575535698893157273063074627791787432852706183111, I got 5945770897828140901859913642993887309423255879987770157450768201525288715151 for y, which is incorrect, any chance you could help me out?
    – Raccoondude
    Sep 12, 2021 at 2:01
  • Yes, a is x^3 + 7 here. Given x=72488970228380509287422715226575535698893157273063074627791787432852706183111, you get a=x^3+7=4037741034981857009060200306242622473933214174234453045209672395016311171624 (mod p). y = a^((p+1)/4) = 62070622898698443831883535403436258712770888294397026493185421712108624767191 (again mod p). Its negation -y = 53721466338617751591687449605251649140499096371243537546272162295800209904472 is also a valid corresponding Y coordinate.
    – Pieter Wuille
    Sep 12, 2021 at 2:15
  • Theres mutible Y cords @W@ How would I get the one I need for my private for example without using my private? Thats kinda what im looking for to understand how bitcoin works, because im a bit confused how your supposed to get the "y" that was generated with the private
    – Raccoondude
    Sep 12, 2021 at 2:54
  • That information is normally part of the public key. In SEC encoded compressed public keys you have (0x02 or 0x03) + (32-byte X coord), with the 0x02/0x03 indicating whether Y is even or odd. In BIP340 Schnorr public keys, the Y coordinate is implicitly even, and the private key is negated at signing time if the Y coordinate would otherwise be odd.
    – Pieter Wuille
    Sep 12, 2021 at 3:03
  • Ok, so basically, lets say im looking for Y, but it doesn't come up when I do your function, what do I do then exactly to get the Y I need?
    – Raccoondude
    Sep 12, 2021 at 3:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.