# Z-coordinate in Jacobian coordinates

secp256k1 Generator:(G_X, G_Y, 0x1),

secp256k1 any public key using affine coordinates : B=(X, Y)

secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z)

(B's private key)==(BB's private key)

I consider projective Jacobian coordinates for secp256k1.

Given any public key B, if the z-coordinate after converting the generator of secp256k1 to Jacobian coordinates is set to 0x1, how should I calculate P_Z(the z-coordinate of any public key) without using scalar(private key) and a middle point?

• If you just decoded a point, just set $Z$ to 1. If you're operating on a point, treat divisions on $X$ and $Y$ as multiplication on $Z$. Afterwards, if you encode a point, divide $Z$ from $X$ and $Y$ to get the encoded values. Is anything still unclear? or is it enough to make a formal answer? Dec 6, 2023 at 8:48
• @DannyNiu Careful! With Jacobian coordinates conversion to affine needs $X$ to be divided by $Z^2$ and $Y$ to be divided by $Z^3$. Dec 6, 2023 at 9:07
• For example, the final public key's Z-coordinate obtained from the generator point using jacobian-coordinates and the adding operator was different from the final public key's Z-coordinate obtained from the middle point using jacobian-coordinates and the adding operator. So, Setting the Z-coordinate of the generator point to 0x1 and setting the Z-coordinate of the middle point to 0x1 leads to different results....Z-coordinate Dec 6, 2023 at 9:23
• Note: I do not know "projective Jacobian coordinates", only Jacobian coordinates and the (different) projective coordinates.
– fgrieu
Dec 6, 2023 at 10:05
• hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html Dec 6, 2023 at 10:08

Recall that a point (other than the point at infinity) on the secp256k1 curve (or any curve in Weierstrass form over a prime field $$\mathbb F_p$$) having Cartesian coordinates $$(X,Y)$$ matches point with Jacobian coordinates $$(x,y,z)$$ if and only if $$z^2\,X\equiv x\pmod p$$ and $$z^3\,Y\equiv y\pmod p$$ and $$z\not\equiv0\pmod p$$. Notice that $$z=0$$ can be used to represent the point at infinity (otherwise said, the group's identity).
It follow that to convert $$B=(X,Y)$$ to Jacobian coordinates, we can use $$BB=(X,Y,1)$$.
Or, if we want some blinding for side-channel resistance, we can pick a random integer $$z$$ in $$[1,p)$$ and set $$BB=\bigl((z^2\,X\bmod p),(z^3\,Y\bmod p),z\bigr)$$.