How to get the generator G point for any new curve?

I have this bitcoin curve:

``````y^2 = x^3 + 7
``````

but the finite field Fp is modified to be:

``````n=115792089237316195423570985008687907853269984665640564039457584007908834675927
``````

1-What is the G point?

2-how to get the Y coordinate for any X value?

I'm using this C# code to get Y from X but it works with original bitcoin curve only.

``````    public BigInteger mod(BigInteger num, BigInteger by) {
BigInteger res = num % by;
if (res < 0) { res += by; }
return res;
}

public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
BigInteger n_OVER_FOUR = (n + 1) / 4;
BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
BigInteger Y = beta;

if (!modIt) { return Y; }
Y = n - beta;
return Y;
}
``````

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.

1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via Lagrange's Theorem).

2) Just use the curve equation. `y^2 = x^3 + 7` => `y = modsqrt(x^3 + 7)` (everything is mod P)

• you did not understand my question, because N is already a prime number ,, y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,, i said that i did this but not work with my new N Commented Nov 15, 2018 at 12:20
• yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same. Commented Nov 15, 2018 at 12:49
• Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from? Commented Nov 15, 2018 at 20:36
• @MikeD OP is using "N" to refer to the field size, not the curve order. Commented Nov 16, 2018 at 1:41
• @MikeD x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field. Commented Nov 16, 2018 at 2:08

G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).

It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point.

E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.

• The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes. Commented Nov 16, 2018 at 1:27
• For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking G. Maxwell's suggested point and multiplying it by (the curve order / its largest prime factor). Commented Nov 16, 2018 at 1:33
• @Maxwell , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929) Commented Nov 16, 2018 at 11:07
• now, what is the (N) order number, (used in division, and creating signature)? , where:(((( G*(N+1)=G )))): – Commented Nov 16, 2018 at 11:22
• Re: compression. You might want to consult this article before announcing your IPO. Commented Dec 19, 2018 at 4:25