<p>Negating an elliptic curve point means negating its Y coordinate (modulo the field size <em>p</em>), so <em>-(x,y) = (x,-y)</em>. This implies that if you have a point <em>R</em> for which <em>R.x mod n = k</em> (where <em>n</em> is the curve order), then the same will be true for <em>-R</em>.</p>

<p>Furthermore, and with negligable probability, it is possible that both <em>R.x</em> and <em>R.x + n</em> are valid X coordinates (only when <em>R.x</em> &lt; p-n). In that case, there are 4 possible points (<em>(r, y1)</em>, <em>(r,-y1)</em>,<em>(r+n,y2)</em>,<em>(r+n,-y2)</em>).</p>

CC BY-SA 4.0
2019-07-11T03:14:07.897Z
Then, is the reason that _R.x + 2n, R.x + 3n_, etc. are not possible X coordinates because of a size constraint (I'm guessing they would be larger than 256 bits)? Perhaps this is also the reason for why R.x < p-n?
Shaun
CC BY-SA 4.0
2019-07-11T03:49:29.967Z
Yes, p and n are both very close to 2^256, but n is slightly smaller.
Pieter Wuille
CC BY-SA 4.0
2019-07-10T15:33:26.577Z
2019-07-10T16:31:05.380Z
2019-07-10T16:31:05.380Z
Pieter Wuille
<p>In the answer to <a href="https://bitcoin.stackexchange.com/questions/81232/how-is-public-key-extracted-from-message-digital-signature-address">this question</a>, it is stated that:</p>

<blockquote>
  <p>Rearranging this equation you get <em>rP = sR - mG</em>, or <em>P = (s/r)R - (m/r)G</em>. Thus, it seems we can just compute the public key from the message and the signature. Unfortunately, there can be up to 4 different points <em>R</em> for which <em>R.x mod n = r</em> (in practice, the number is almost always 2).</p>
</blockquote>

<p>How is it possible that there could be up to 4 different points for <em>R</em>? And why would it most often be 2 different points?</p>

<public-key><ecdsa><message-signing>
Up to 4 Different Points within ECDSA/Public Key Recovery technique
Shaun
# Up to 4 Different Points within ECDSA/Public Key Recovery technique

(Asked by: username_0 on 2019-07-10)

In the answer to [this question](https://bitcoin.stackexchange.com/questions/81232/how-is-public-key-extracted-from-message-digital-signature-address), it is stated that:

> Rearranging this equation you get *rP = sR - mG*, or *P = (s/r)R - (m/r)G*. Thus, it seems we can just compute the public key from the message and the signature. Unfortunately, there can be up to 4 different points *R* for which *R.x mod n = r* (in practice, the number is almost always 2).

How is it possible that there could be up to 4 different points for *R*? And why would it most often be 2 different points?

**Tags:** public-key, ecdsa, message-signing


---

## 1 answers

### Answer by username_1 on 2019-07-10. Score: 2 | Accepted answer

Negating an elliptic curve point means negating its Y coordinate (modulo the field size *p*), so *-(x,y) = (x,-y)*. This implies that if you have a point *R* for which *R.x mod n = k* (where *n* is the curve order), then the same will be true for *-R*.

Furthermore, and with negligable probability, it is possible that both *R.x* and *R.x + n* are valid X coordinates (only when *R.x* < p-n). In that case, there are 4 possible points (*(r, y1)*, *(r,-y1)*,*(r+n,y2)*,*(r+n,-y2)*).

> **Comments:**
> **username_0**: Then, is the reason that _R.x + 2n, R.x + 3n_, etc. are not possible X coordinates because of a size constraint (I'm guessing they would be larger than 256 bits)? Perhaps this is also the reason for why R.x < p-n?  
> **username_1**: Yes, p and n are both very close to 2^256, but n is slightly smaller.  

---

