We are all familiar with the x & y coordinates of the curve parameters used in bitcoin (or at least we should be).

In terms of being a collective point on graph, we know that the starting point G is also used as a limiting point when carrying out ADDITION & DOUBLING operations... We also know that our graph is a finite curve with it's limits set to G as well.

My Question is, Is there a maximum point X and Y can individually reach?

And if there is, What is the highest point that the X & Y coordinates can reach?

1 Answer 1


It is easy to find the largest integer solutions to the curve equation y2 = x3 + 7 mod p, where p = 2256-232-977, by simply trying numbers from high to low until you hit a solution.

The highest possible X coordinate is p-3, in point (115792089237316195423570985008687907853269984665640564039457584007908834671660, 109188863561374057667848968960504138135859662956057034999983532397866404169138).

The highest possible Y coordinate is p-1, in point (92132010145575487545665274145875605628664750442204984300260952401046764123763, 115792089237316195423570985008687907853269984665640564039457584007908834671662).

We cannot possibly compute what the corresponding private keys for these points are. Doing so would amount to breaking the discrete logarithm problem.

  • Glad to see you're still up and running. Thanks as always for your insightful & easy to understand responses. Oct 10, 2023 at 6:50
  • And what if the Discrete Logarithm Problem is broken... Would it be such a bad thing? I mean I know a lot of digital security & financial data (if not all) rely on these yet to be broken algorithms, but still I'm sure the algorithm to break our standard would open new doors into advanced technologies. Oct 10, 2023 at 6:53
  • The security assumption that underlies Bitcoin's transaction signing scheme is that the discrete logarithm for the secp256k1 curve is computationally infeasible. In theory, of course developments or breakthroughs can happen that break it, but since that would let whoever has access to such an algorithm take any BTC they want, I'd say that yes, that would be a bad thing. Oct 10, 2023 at 11:49
  • But my comment above wasn't about whether that would be good or bad, just that it is extremely unlikely to have already happened. There is an extremely large incentive to break the DL for secp256k1 (taking any BTC). If someone could break it, with today's technology and computation power, they would. Oct 10, 2023 at 11:52
  • True, I guess it would be bad.. But what if they limited what they took to the btc's most likely owned by the assumed Satoshi? Or perhaps even Satoshi himself (on demon time) having a back door decides to have a go at some btc's.. I know the latter would be devastating but the former doesn't seem that bad Oct 11, 2023 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.