# How to get Y from X

Ok, so I get address generation now, and I understand that X is hashed, however for verification of a signature, we need the public point, (x,y)

How would one get Y from X?

Lets take an example, im gonna use my generator (0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8) and use private "10" (using a = 0, b = 7, p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f) to get:

(0xa0434d9e47f3c86235477c7b1ae6ae5d3442d49b1943c2b752a68e2a47e247c7,0x893aba425419bc27a3b6c7e693a24c696f794c2ed877a1593cbee53b037368d7)

Now we remove Y, to only have: 0xa0434d9e47f3c86235477c7b1ae6ae5d3442d49b1943c2b752a68e2a47e247c7

Meaning that we need to get Y from X, how would I do this? I never seen this explained really and everything I tried doesn't result in the correct Y value

The secp256k1 curve equation is:

• Points (x,y) for which y2 = x3 + 7 mod p, where p = 2256-232-977

If we solve this for y, we get y = ±√(x3 +7) mod p.

Of course, this is not a normal square root, but a square root for the field of integers modulo p, but otherwise this equation is correct. To compute such a modular square root, the Tonelli-Shanks algorithm is used. It can deal with many cases, depending on the structure of the modulus, but for our p modulus it simplifies to just:

• √a mod p = a(p+1)/4 mod p (for any prime p for which p+1 is a multiple of 4).
• Tad confused what A is supposed to be, I assumed it was (x^3)+7 but after doing the equation for x = 72488970228380509287422715226575535698893157273063074627791787432852706183111, I got 5945770897828140901859913642993887309423255879987770157450768201525288715151 for y, which is incorrect, any chance you could help me out? Sep 12 at 2:01
• Yes, a is x^3 + 7 here. Given x=72488970228380509287422715226575535698893157273063074627791787432852706183111, you get a=x^3+7=4037741034981857009060200306242622473933214174234453045209672395016311171624 (mod p). y = a^((p+1)/4) = 62070622898698443831883535403436258712770888294397026493185421712108624767191 (again mod p). Its negation -y = 53721466338617751591687449605251649140499096371243537546272162295800209904472 is also a valid corresponding Y coordinate. Sep 12 at 2:15
• Theres mutible Y cords @W@ How would I get the one I need for my private for example without using my private? Thats kinda what im looking for to understand how bitcoin works, because im a bit confused how your supposed to get the "y" that was generated with the private Sep 12 at 2:54
• That information is normally part of the public key. In SEC encoded compressed public keys you have (0x02 or 0x03) + (32-byte X coord), with the 0x02/0x03 indicating whether Y is even or odd. In BIP340 Schnorr public keys, the Y coordinate is implicitly even, and the private key is negated at signing time if the Y coordinate would otherwise be odd. Sep 12 at 3:03
• Ok, so basically, lets say im looking for Y, but it doesn't come up when I do your function, what do I do then exactly to get the Y I need? Sep 12 at 3:14