<blockquote>
<p>We also know that every private and public key has its modular inverse. To get a modular inverse of a private key, we need to subtract the private key from <code>n</code>.</p>
</blockquote>
<p>Just a terminology note: that's a modular negation, not a modular inverse. The modular inverse of <code>v</code> mod <code>n</code> would be the number <code>a</code> such that <code>a*v = 1 mod n</code>. Modular inverses aren't relevant to your question I believe, just wanted to clarify this.</p>
<blockquote>
<p>A modular inversed public key has the same x coordinate as original public key, but different <code>y</code> coordinate, and the <code>y</code> coordinate is always different in its polarity. If the original <code>y</code> was odd, in a modular inversed key it will be even, and vice versa.</p>
</blockquote>
<p>That's all correct. Negating the private key (in the finite field modulo <code>n</code>) corresponds to negating the point, and negating the point negates the Y coordinate, and given that the coordinate field size is odd, negation modulo it changes the parity.</p>
<blockquote>
<p>The question is, if the y coordinate of a public key is even, does it mean that the corresponding private key is less than <code>n/2</code> by its value? If the <code>y</code> is odd, the private key is more than <code>n/2</code> ?</p>
</blockquote>
<p>No, there is no such relation.</p>
<blockquote>
<p>Is there any relationship between the eveness/oddness of the <code>y</code> (or <code>x</code>) coordinate and the value of the corresponding private key?</p>
</blockquote>
<p>No, seeing the public key should not let you infer <em>anything</em> about the corresponding private key. If there was a way to learn anything, the ECDLP (elliptic curve discrete logarithm problem) assumption would be broken (that assumption roughly says that a computationally-bounded attacker who sees a public key cannot guess the private key meaningfully better than random).</p>
<blockquote>
<p>Is there any way to know that the private key is more or less than <code>n/2</code> while not knowing the private key itself?</p>
</blockquote>
<p>No.</p>
<blockquote>
<p>Is there a way to find out the public key of an address that never sent Bitcoin but only received it?</p>
</blockquote>
<p>That's an unrelated question, but in short: no. It does depend on the type of address you're talking about. For P2PKH, P2SH, or P2WPKH addresses clearly not, as a hash function is involved. For P2TR (taproot) addresses an X coordinate of a (tweaked) public key is encoded directly (unhashed), but without Y coordinate.</p>

CC BY-SA 4.0
2022-09-18T14:14:06.790Z
Thanks. Clears things out
Emma Lincoln
CC BY-SA 4.0
2022-09-18T18:31:45.800Z
I got a few more questions. Suppose that we have a Public Key that is generated by an "odd" private key like113*G.
What will happen if we try to "half" this public key using these methods?

https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible

https://bitcointalk.org/index.php?topic=4455904.0

Does "halving" an even Public Key makes any difference?
Emma Lincoln
CC BY-SA 4.0
2022-09-18T20:48:59.260Z
Then you obtain the public key corresponding to the private key (113/2 mod n)*G. Halving is just multiplying by (1/2 mod n) = 57896044618658097711785492504343953926418782139537452191302581570759080747169 (both the private and public key). Whether the resulting private key is odd or even depends on how many times that multiplication wraps around n.
Pieter Wuille
CC BY-SA 4.0
2022-09-18T13:28:09.777Z
2022-09-18T13:43:20.180Z
2022-09-18T13:43:20.180Z
Pieter Wuille
<p>The question is somewhat complex and directed to clearing thing out.</p>
<p>Suppose that <code>n</code> is the order of the cyclic group. It <code>n - 1</code> is the number of all private keys possible</p>
<pre><code>n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
</code></pre>
<p>We also know that every private and public key has its modular inverse.
To get a modular inverse of a private key, we need to subtract the private key from <code>n</code>.</p>
<p><code>n - privKey</code></p>
<p>To get a modular inverse of a public key, we'll have to multiply its <code>y</code> coordinate by <code>-1</code> and modulo by the <code>p</code> - order of the finite field.</p>
<pre><code>x,y = x, -y % p
</code></pre>
<p>A modular inversed public key has the same <code>x</code> coordinate as original public key, but different <code>y</code> coordinate, and the <code>y</code> coordinate is always different in its polarity.
If the original <code>y</code> was odd, in a modular inversed key it will be even, and vice versa.</p>
<p>If a compressed public key has <code>&quot;02&quot;</code> index at the biggining then it has even <code>y</code>. If it is <code>&quot;03&quot;</code> then it is odd.</p>
<p>The question is, if the <code>y</code> coordinate of a public key is even, does it mean that the corresponding private key is less than <code>n/2</code> by its value? If the <code>y</code> is odd, the private key is more than <code>n/2</code> ?</p>
<p>Is there any relationship between the eveness/oddness of the <code>y</code> (or <code>x</code>) coordinate and the value of the corresponding private key?</p>
<p>Is there any way to know that the private key is more or less than <code>n/2</code> while not knowing the private key itself?</p>
<p>Is there a way to find out the public key of an address that never sent Bitcoin but only received it?</p>

CC BY-SA 4.0
2022-09-18T13:30:57.237Z
It took me 2 tries to find a counter example to your claim: privatekey = 0d6a35eec96a4526450edf6cf0acbedcfec82133d6086efe5a1a8a0d9897d1e5 < N/2, compressedpub = 031ce10ff151c1f0ea39b8cdd49cce5d386a69a7d4af139feba4ea1086de71abc4.
Mike D
<wallet><private-key><public-key><ecdsa><secp256k1>
Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)
Emma Lincoln
# Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

(Asked by: username_0 on 2022-09-18)

The question is somewhat complex and directed to clearing thing out.
Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible
n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141

We also know that every private and public key has its modular inverse.
To get a modular inverse of a private key, we need to subtract the private key from n.
n - privKey
To get a modular inverse of a public key, we'll have to multiply its y coordinate by -1 and modulo by the p - order of the finite field.
x,y = x, -y % p

A modular inversed public key has the same x coordinate as original public key, but different y coordinate, and the y coordinate is always different in its polarity.
If the original y was odd, in a modular inversed key it will be even, and vice versa.
If a compressed public key has "02" index at the biggining then it has even y. If it is "03" then it is odd.
The question is, if the y coordinate of a public key is even, does it mean that the corresponding private key is less than n/2 by its value? If the y is odd, the private key is more than n/2 ?
Is there any relationship between the eveness/oddness of the y (or x) coordinate and the value of the corresponding private key?
Is there any way to know that the private key is more or less than n/2 while not knowing the private key itself?
Is there a way to find out the public key of an address that never sent Bitcoin but only received it?

**Tags:** wallet, private-key, public-key, ecdsa, secp256k1

> **Comments:**
> **username_1**: It took me 2 tries to find a counter example to your claim: privatekey = 0d6a35eec96a4526450edf6cf0acbedcfec82133d6086efe5a1a8a0d9897d1e5 < N/2, compressedpub = 031ce10ff151c1f0ea39b8cdd49cce5d386a69a7d4af139feba4ea1086de71abc4.  

---

## 1 answers

### Answer by username_2 on 2022-09-18. Score: 1 | Accepted answer

> We also know that every private and public key has its modular inverse. To get a modular inverse of a private key, we need to subtract the private key from `n`.

Just a terminology note: that's a modular negation, not a modular inverse. The modular inverse of `v` mod `n` would be the number `a` such that `a*v = 1 mod n`. Modular inverses aren't relevant to your question I believe, just wanted to clarify this.

> A modular inversed public key has the same x coordinate as original public key, but different `y` coordinate, and the `y` coordinate is always different in its polarity. If the original `y` was odd, in a modular inversed key it will be even, and vice versa.

That's all correct. Negating the private key (in the finite field modulo `n`) corresponds to negating the point, and negating the point negates the Y coordinate, and given that the coordinate field size is odd, negation modulo it changes the parity.

> The question is, if the y coordinate of a public key is even, does it mean that the corresponding private key is less than `n/2` by its value? If the `y` is odd, the private key is more than `n/2` ?

No, there is no such relation.

> Is there any relationship between the eveness/oddness of the `y` (or `x`) coordinate and the value of the corresponding private key?

No, seeing the public key should not let you infer *anything* about the corresponding private key. If there was a way to learn anything, the ECDLP (elliptic curve discrete logarithm problem) assumption would be broken (that assumption roughly says that a computationally-bounded attacker who sees a public key cannot guess the private key meaningfully better than random).

> Is there any way to know that the private key is more or less than `n/2` while not knowing the private key itself?

No.

> Is there a way to find out the public key of an address that never sent Bitcoin but only received it?

That's an unrelated question, but in short: no. It does depend on the type of address you're talking about. For P2PKH, P2SH, or P2WPKH addresses clearly not, as a hash function is involved. For P2TR (taproot) addresses an X coordinate of a (tweaked) public key is encoded directly (unhashed), but without Y coordinate.

> **Comments:**
> **username_0**: Thanks. Clears things out  
> **username_0**: I got a few more questions. Suppose that we have a Public Key that is generated by an "odd" private key like113*G. What will happen if we try to "half" this public key using these methods?  https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible  https://bitcointalk.org/index.php?topic=4455904.0  Does "halving" an even Public Key makes any difference?  
> **username_2**: Then you obtain the public key corresponding to the private key (113/2 mod n)*G. Halving is just multiplying by (1/2 mod n) = 57896044618658097711785492504343953926418782139537452191302581570759080747169 (both the private and public key). Whether the resulting private key is odd or even depends on how many times that multiplication wraps around n.  

---

