Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an extremely large integer.

If it falls on the curve below the y-axis crossing it would have to have an x-coord of < 2 and y-coord of < 3 (or less than [2,3] above the %P). Is this the case or have I got something fundamentally wrong?

  • I don't know which "typically" you're talking about, but I've tried answering a misunderstanding you may have. Commented May 16, 2022 at 17:19

1 Answer 1


The secp256k1 curve is defined by the equation y2 = x3 + 7 with coordinates X and Y over the field GF(p) with p=2256 - 232 - 977, not the field of real numbers. This field consists of the integers modulo p. In this field, there is no concept of "smaller" or "larger", no concept of "decimals", and no concept of "positive" or "negative". For example, the numbers -1 and 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,908,834,671,662 represent the same field element. One is small, the other is large; one is negative, the other is positive.

Furthermore, the modulo effect applies for all arithmetic operations. For addition, subtraction, and multiplication, it just means reducing modulo p after performing normal addition, subtraction, or multiplication. But that's not all. Division is the reverse operation of multiplication, so a/b mod p is really asking "what value of x in the field satisfies a = bx mod p?" which is a very different thing from division in the reals. Similarly, a square root is the reverse operation of squaring, so √a is really asking "what value of x in the field satisfies a = x2 mod p?".

7 has no square roots in this field. That is, there exists no integer x such that x2 mod p = 7. Thus, there is no point on the secp256k1 curve with X coordinate 0. 13 + 7 = 8 does have a square root (namely, 29,896,722,852,569,046,015,560,700,294,576,055,776,214,335,159,245,303,116,488,692,907,525,646,231,534) so in principle it would have been possible to choose G to have X coordinate 1. It's not known how the X and Y coordinate of G were chosen however, but presumably an X coordinate was picked for which x3 + 7 does have a square root mod p, and then one of these square roots was chosen as the Y coordinate.

More reading:

  • Thanks Pieter, I understand some parts of this but not others... when you say {1^3 + 7 = 8 [x^2]} does have a square root mod p, does it mean that there is an integer value x which, when squared then divided by p, gives a remainder of 8?
    – b0d
    Commented May 16, 2022 at 17:27
  • 1
    @b0d That's exactly right. Commented May 16, 2022 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.