I have this bitcoin curve:

y^2 = x^3 + 7

but the finite field Fp is modified to be:


1-What is the G point?

2-how to get the Y coordinate for any X value?

I'm using this C# code to get Y from X but it works with original bitcoin curve only.

    public BigInteger mod(BigInteger num, BigInteger by) {
        BigInteger res = num % by;
        if (res < 0) { res += by; }
        return res;

    public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
        BigInteger n_OVER_FOUR = (n + 1) / 4;
        BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
        BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
        BigInteger Y = beta;

        if (!modIt) { return Y; }
        Y = n - beta;
        return Y;

2 Answers 2


You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.

1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via Lagrange's Theorem).

2) Just use the curve equation. y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) (everything is mod P)

  • you did not understand my question, because N is already a prime number ,, y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,, i said that i did this but not work with my new N
    – remon78eg
    Nov 15, 2018 at 12:20
  • yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same.
    – remon78eg
    Nov 15, 2018 at 12:49
  • Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from?
    – Mike D
    Nov 15, 2018 at 20:36
  • @MikeD OP is using "N" to refer to the field size, not the curve order. Nov 16, 2018 at 1:41
  • @MikeD x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field. Nov 16, 2018 at 2:08

G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).

It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point.

E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.

  • The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes. Nov 16, 2018 at 1:27
  • For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking G. Maxwell's suggested point and multiplying it by (the curve order / its largest prime factor). Nov 16, 2018 at 1:33
  • @Maxwell , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929)
    – remon78eg
    Nov 16, 2018 at 11:07
  • now, what is the (N) order number, (used in division, and creating signature)? , where:(((( G*(N+1)=G )))): –
    – remon78eg
    Nov 16, 2018 at 11:22
  • 1
    Re: compression. You might want to consult this article before announcing your IPO.
    – G. Maxwell
    Dec 19, 2018 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.