I have this bitcoin curve:

y^2 = x^3 + 7

but the finite field Fp is modified to be:


1-What is the G point?

2-how to get the Y coordinate for any X value?

I'm using this C# code to get Y from X but it works with original bitcoin curve only.

    public BigInteger mod(BigInteger num, BigInteger by) {
        BigInteger res = num % by;
        if (res < 0) { res += by; }
        return res;

    public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
        BigInteger n_OVER_FOUR = (n + 1) / 4;
        BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
        BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
        BigInteger Y = beta;

        if (!modIt) { return Y; }
        Y = n - beta;
        return Y;

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.

1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via Lagrange's Theorem).

2) Just use the curve equation. y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) (everything is mod P)

  • you did not understand my question, because N is already a prime number ,, y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,, i said that i did this but not work with my new N – remon78eg Nov 15 '18 at 12:20
  • yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same. – remon78eg Nov 15 '18 at 12:49
  • Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from? – Mike D Nov 15 '18 at 20:36
  • @MikeD OP is using "N" to refer to the field size, not the curve order. – Pieter Wuille Nov 16 '18 at 1:41
  • @MikeD x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field. – Pieter Wuille Nov 16 '18 at 2:08

G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).

It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point.

E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.

  • The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes. – Pieter Wuille Nov 16 '18 at 1:27
  • For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking G. Maxwell's suggested point and multiplying it by (the curve order / its largest prime factor). – Pieter Wuille Nov 16 '18 at 1:33
  • @Maxwell , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929) – remon78eg Nov 16 '18 at 11:07
  • now, what is the (N) order number, (used in division, and creating signature)? , where:(((( G*(N+1)=G )))): – – remon78eg Nov 16 '18 at 11:22
  • 1
    Re: compression. You might want to consult this article before announcing your IPO. – G. Maxwell Dec 19 '18 at 4:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.