<p>The secp256k1 curve is defined by the equation <em>y<sup>2</sup> = x<sup>3</sup> + 7</em> with coordinates X and Y over the field <em>GF(p)</em> with <em>p=2<sup>256</sup> - 2<sup>32</sup> - 977</em>, not the field of real numbers. This field consists of the integers modulo <em>p</em>. In this field, there is no concept of &quot;smaller&quot; or &quot;larger&quot;, no concept of &quot;decimals&quot;, and no concept of &quot;positive&quot; or &quot;negative&quot;. For example, the numbers <em>-1</em> and <em>115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,908,834,671,662</em> represent the same field element. One is small, the other is large; one is negative, the other is positive.</p>
<p>Furthermore, the modulo effect applies for <em>all</em> arithmetic operations. For addition, subtraction, and multiplication, it just means reducing modulo <em>p</em> after performing normal addition, subtraction, or multiplication. But that's not all. Division is the reverse operation of multiplication, so <em>a/b mod p</em> is really asking &quot;what value of <em>x</em> in the field satisfies <em>a = bx mod p</em>?&quot; which is a very different thing from division in the reals. Similarly, a square root is the reverse operation of squaring, so <em>√a</em> is really asking &quot;what value of <em>x</em> in the field satisfies <em>a = x<sup>2</sup> mod p</em>?&quot;.</p>
<p><em>7</em> has no square roots in this field. That is, there exists no integer <em>x</em> such that <em>x<sup>2</sup> mod p = 7</em>. Thus, there is no point on the secp256k1 curve with X coordinate <em>0</em>. <em>1<sup>3</sup> + 7 = 8</em> does have a square root (namely, <em>29,896,722,852,569,046,015,560,700,294,576,055,776,214,335,159,245,303,116,488,692,907,525,646,231,534</em>) so in principle it would have been possible to choose G to have X coordinate 1. It's not known how the X and Y coordinate of G were chosen however, but presumably an X coordinate was picked for which <em>x<sup>3</sup> + 7</em> does have a square root <em>mod p</em>, and then one of these square roots was chosen as the Y coordinate.</p>
<p>More reading:</p>
<ul>
<li><a href="https://bitcoin.stackexchange.com/a/21911/208">What does the curve used in Bitcoin, secp256k1, look like?</a></li>
<li><a href="https://bitcoin.stackexchange.com/a/113122/208">How is the generator point G chosen in the secp256k1 curve used in Bitcoin?</a></li>
</ul>

CC BY-SA 4.0
2022-05-16T17:27:25.730Z
Thanks Pieter, I understand some parts of this but not others... when you say {1^3 + 7 = 8 [x^2]} does have a square root mod p, does it mean that there is an integer value x which, when squared then divided by p, gives a remainder of 8?
b0d
CC BY-SA 4.0
2022-05-16T17:28:48.443Z
@b0d That's exactly right.
Pieter Wuille
CC BY-SA 4.0
2022-05-16T16:55:09.777Z
2022-05-16T17:23:06.010Z
2022-05-16T17:23:06.010Z
Pieter Wuille
<p>Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an extremely large integer.</p>
<p>If it falls on the curve below the y-axis crossing it would have to have an x-coord of &lt; 2 and y-coord of &lt; 3 (or less than [2,3] above the %P). Is this the case or have I got something fundamentally wrong?</p>

CC BY-SA 4.0
2022-05-16T17:19:34.917Z
I don't know which "typically" you're talking about, but I've tried answering a misunderstanding you may have.
Pieter Wuille
<security><private-key><public-key><secp256k1>
Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?
b0d
# Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?

(Asked by: username_0 on 2022-05-16)

Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an extremely large integer.

If it falls on the curve below the y-axis crossing it would have to have an x-coord of < 2 and y-coord of < 3 (or less than [2,3] above the %P). Is this the case or have I got something fundamentally wrong?

**Tags:** security, private-key, public-key, secp256k1

> **Comments:**
> **username_1**: I don't know which "typically" you're talking about, but I've tried answering a misunderstanding you may have.  

---

## 1 answers

### Answer by username_1 on 2022-05-16. Score: 3 | Accepted answer

The secp256k1 curve is defined by the equation *y2 = x3 + 7* with coordinates X and Y over the field *GF(p)* with *p=2256 - 232 - 977*, not the field of real numbers. This field consists of the integers modulo *p*. In this field, there is no concept of "smaller" or "larger", no concept of "decimals", and no concept of "positive" or "negative". For example, the numbers *-1* and *115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,908,834,671,662* represent the same field element. One is small, the other is large; one is negative, the other is positive.

Furthermore, the modulo effect applies for *all* arithmetic operations. For addition, subtraction, and multiplication, it just means reducing modulo *p* after performing normal addition, subtraction, or multiplication. But that's not all. Division is the reverse operation of multiplication, so *a/b mod p* is really asking "what value of *x* in the field satisfies *a = bx mod p*?" which is a very different thing from division in the reals. Similarly, a square root is the reverse operation of squaring, so *√a* is really asking "what value of *x* in the field satisfies *a = x2 mod p*?".

*7* has no square roots in this field. That is, there exists no integer *x* such that *x2 mod p = 7*. Thus, there is no point on the secp256k1 curve with X coordinate *0*. *13 + 7 = 8* does have a square root (namely, *29,896,722,852,569,046,015,560,700,294,576,055,776,214,335,159,245,303,116,488,692,907,525,646,231,534*) so in principle it would have been possible to choose G to have X coordinate 1. It's not known how the X and Y coordinate of G were chosen however, but presumably an X coordinate was picked for which *x3 + 7* does have a square root *mod p*, and then one of these square roots was chosen as the Y coordinate.

More reading:

* [What does the curve used in Bitcoin, secp256k1, look like?](https://bitcoin.stackexchange.com/a/21911/208)
* [How is the generator point G chosen in the secp256k1 curve used in Bitcoin?](https://bitcoin.stackexchange.com/a/113122/208)

> **Comments:**
> **username_0**: Thanks Pieter, I understand some parts of this but not others... when you say {1^3 + 7 = 8 [x^2]} does have a square root mod p, does it mean that there is an integer value x which, when squared then divided by p, gives a remainder of 8?  
> **username_1**: @username_0 That's exactly right.  

---

