<p>The size of secp256k1's coordinate field is 2<sup>256</sup> - 2<sup>32</sup> - 977.</p>

<p>That means there are only 2<sup>32</sup> + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate.</p>

<p>Only slightly less than half (around 2<sup>255</sup> - 1.17 * 2<sup>127</sup>) of those are the X coordinate of a point on the curve (in fact, for every valid X coordinate, there are either exactly 0 or exactly 2 points on the curve).</p>

CC BY-SA 4.0
2022-05-06T10:19:10.837Z
Could you elaborate how you arrived at "around 2^255 - 1.17 * 2^127"?
drogos86
CC BY-SA 4.0
2022-05-06T13:00:59.293Z
I divided the curve order by two. You can find the curve order in the secp256k1 specification, or you can compute it using mathematical software like Sage.
Pieter Wuille
CC BY-SA 4.0
2022-05-06T13:27:59.817Z
FWIW, that order (=equal to the number of points on the curve, including infinity) is 115792089237316195423570985008687907852837564279074904382605163141518161494337.
Pieter Wuille
CC BY-SA 3.0
2017-07-03T18:27:00.947Z
2017-07-10T16:41:14.473Z
2017-07-10T16:41:14.473Z
Pieter Wuille
<p>There function in libsecp256k1 that allows you to directly set the field element to 32 bytes of your choice. Does secp256k1 <em>always</em> return a valid group element for any 32 byte value?</p>
<blockquote>
<p>secp256k1_fe_set_b32(&amp;xpoint, bytes)</p>
<p>secp256k1_ge_set_xo_var(ge, &amp;xpoint, 0)</p>
</blockquote>

<cryptography><secp256k1>
Is there a point on the secp256k1 curve for any given X coordinate?
Penquin
# Is there a point on the secp256k1 curve for any given X coordinate?

(Asked by: username_0 on 2017-07-03)

There function in libsecp256k1 that allows you to directly set the field element to 32 bytes of your choice. Does secp256k1 *always* return a valid group element for any 32 byte value?

> secp256k1\_fe\_set\_b32(&xpoint, bytes)
>
> secp256k1\_ge\_set\_xo\_var(ge, &xpoint, 0)

**Tags:** cryptography, secp256k1


---

## 1 answers

### Answer by username_1 on 2017-07-03. Score: 9 | Accepted answer

The size of secp256k1's coordinate field is 2256 - 232 - 977.

That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate.

Only slightly less than half (around 2255 - 1.17 \* 2127) of those are the X coordinate of a point on the curve (in fact, for every valid X coordinate, there are either exactly 0 or exactly 2 points on the curve).

> **Comments:**
> **username_2**: Could you elaborate how you arrived at "around 2^255 - 1.17 * 2^127"?  
> **username_1**: I divided the curve order by two. You can find the curve order in the secp256k1 specification, or you can compute it using mathematical software like Sage.  
> **username_1**: FWIW, that order (=equal to the number of points on the curve, including infinity) is 115792089237316195423570985008687907852837564279074904382605163141518161494337.  

---

