Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out.

Suppose that `n` is the order of the cyclic group. It `n - 1` is the number of all private keys possible

``````n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
``````

We also know that every private and public key has its modular inverse. To get a modular inverse of a private key, we need to subtract the private key from `n`.

`n - privKey`

To get a modular inverse of a public key, we'll have to multiply its `y` coordinate by `-1` and modulo by the `p` - order of the finite field.

``````x,y = x, -y % p
``````

A modular inversed public key has the same `x` coordinate as original public key, but different `y` coordinate, and the `y` coordinate is always different in its polarity. If the original `y` was odd, in a modular inversed key it will be even, and vice versa.

If a compressed public key has `"02"` index at the biggining then it has even `y`. If it is `"03"` then it is odd.

The question is, if the `y` coordinate of a public key is even, does it mean that the corresponding private key is less than `n/2` by its value? If the `y` is odd, the private key is more than `n/2` ?

Is there any relationship between the eveness/oddness of the `y` (or `x`) coordinate and the value of the corresponding private key?

Is there any way to know that the private key is more or less than `n/2` while not knowing the private key itself?

Is there a way to find out the public key of an address that never sent Bitcoin but only received it?

• It took me 2 tries to find a counter example to your claim: privatekey = 0d6a35eec96a4526450edf6cf0acbedcfec82133d6086efe5a1a8a0d9897d1e5 < N/2, compressedpub = 031ce10ff151c1f0ea39b8cdd49cce5d386a69a7d4af139feba4ea1086de71abc4. Sep 18, 2022 at 13:30

We also know that every private and public key has its modular inverse. To get a modular inverse of a private key, we need to subtract the private key from `n`.

Just a terminology note: that's a modular negation, not a modular inverse. The modular inverse of `v` mod `n` would be the number `a` such that `a*v = 1 mod n`. Modular inverses aren't relevant to your question I believe, just wanted to clarify this.

A modular inversed public key has the same x coordinate as original public key, but different `y` coordinate, and the `y` coordinate is always different in its polarity. If the original `y` was odd, in a modular inversed key it will be even, and vice versa.

That's all correct. Negating the private key (in the finite field modulo `n`) corresponds to negating the point, and negating the point negates the Y coordinate, and given that the coordinate field size is odd, negation modulo it changes the parity.

The question is, if the y coordinate of a public key is even, does it mean that the corresponding private key is less than `n/2` by its value? If the `y` is odd, the private key is more than `n/2` ?

No, there is no such relation.

Is there any relationship between the eveness/oddness of the `y` (or `x`) coordinate and the value of the corresponding private key?

No, seeing the public key should not let you infer anything about the corresponding private key. If there was a way to learn anything, the ECDLP (elliptic curve discrete logarithm problem) assumption would be broken (that assumption roughly says that a computationally-bounded attacker who sees a public key cannot guess the private key meaningfully better than random).

Is there any way to know that the private key is more or less than `n/2` while not knowing the private key itself?

No.

Is there a way to find out the public key of an address that never sent Bitcoin but only received it?

That's an unrelated question, but in short: no. It does depend on the type of address you're talking about. For P2PKH, P2SH, or P2WPKH addresses clearly not, as a hash function is involved. For P2TR (taproot) addresses an X coordinate of a (tweaked) public key is encoded directly (unhashed), but without Y coordinate.

• Thanks. Clears things out Sep 18, 2022 at 14:14
• I got a few more questions. Suppose that we have a Public Key that is generated by an "odd" private key like113*G. What will happen if we try to "half" this public key using these methods? crypto.stackexchange.com/questions/59972/… bitcointalk.org/index.php?topic=4455904.0 Does "halving" an even Public Key makes any difference? Sep 18, 2022 at 18:31
• Then you obtain the public key corresponding to the private key (113/2 mod n)*G. Halving is just multiplying by (1/2 mod n) = 57896044618658097711785492504343953926418782139537452191302581570759080747169 (both the private and public key). Whether the resulting private key is odd or even depends on how many times that multiplication wraps around n. Sep 18, 2022 at 20:48