I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- 0000000000000000000000000000000000000000000000000000000000000001 is additive inverse and it's public key is 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798

The negative inverse of 0000000000000000000000000000000000000000000000000000000000000001 is 0379be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 and it's private key is fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140

what I understand is for the private :- 0000000000000000000000000000000000000000000000000000000000000001 it's public key is x, y but for its inverse it's x, -y is that right? I'm curious to know if there is a way to know if a public key is falling in additive inverse or negative inverse? If yes can someone show me how it can be done with a similar explanation with no much math involved


First let me tell you how I understand secp256k1 public keys (it's my own understand might seem a bit stupid) so how I see ecc is from private 1 all the way upto private key 7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0 is additive inverse

and from private key 7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a1 all the way upto


i see it as negative inverse

Now what I mean by -y is like the above example private key 1 has a public thats a positive y and the public key of the inverse of private key 1 is -y (private key :-fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140

  • $\begingroup$ @kelalaka the posts that you have shared still don't answer my question can you please help me understand the above EDIT better $\endgroup$
    – Melwyn
    Mar 31 at 23:20
  • 1
    $\begingroup$ Since you tagged this question with [finite-field], then one thing you should know is that, there's no negative elements in finite fields, only additive inverses (and multiplicative inverses). Another fellow had similar confusion but he failed to comprehend this fact. $\endgroup$
    – DannyNiu
    Apr 1 at 1:10
  • $\begingroup$ @DannyNiu is right, the $-y$ just stands for the element $t$ such that $t+y = identity$. Your confusion is not clear. In an Elliptic curve, the negative of a point is reflected on the X-axis so if $P(x,y)$ then $-P = P(x,-y)$. So, now, you know the $-y$. $\endgroup$
    – kelalaka
    Apr 1 at 11:48
  • $\begingroup$ You may see from the graph of this answer Graphically representing points on Elliptic Curve over finite field $\endgroup$
    – kelalaka
    Apr 1 at 14:52

1 Answer 1


Straightening the question's vocabulary: on secp256k1 every point $Q$ has an opposite point (or additive inverse point) noted $-Q$. For the $n-1$ points $Q$, the opposite $Q'=-Q$ of $Q$ has the following properties:

  • $Q+Q'=\mathcal O$ (the point at infinity); and (assuming from now on that $Q\ne\mathcal O$)
  • $Q$ and $Q'$ share the same X coordinate $x_Q=x_{Q'}$, but have different Y coordinate, such that $y_p+y_{Q'}\bmod p=0$
  • As a consequence of the above, when written in compressed format (see sec1v2 2.3.3#2), that is as a 33-byte bytestring (66-hex-chars), $Q$ and $Q'$ are differing in the first byte only: 02 for one ($Q$ or $Q'$), 03 for the other, according to parity of the Y coordinate (reduced modulo $p$): 02 for even, 03 for odd.
  • If $Q=d\,G$ and $Q'=d'\,G$ (in other words, if $d$ and $d'$ are private keys for $Q$ and $Q'$) then $d+d'\bmod n=0$.

Note: $n$ and $p$ are well-known 256-bit primes for secp256k1.

The question asks if there is a way to tell from a point $Q$ on the curve (given by it's coordinates as a public key) if $Q=d\,G$ for some $d\in[0,n/2)$, or not. In other words, if we can tell the "sign" of the private key from the public key.

No efficient method towards that is known for a random point. Argument: If such method existed, it would be possible to use it repeatedly (about 256 times) to find a private key $d$ for any point $Q$, by binary search.

Note: From a point $Q$ on the curve (given by it's coordinates as a public key) we can find if $y_Q\bmod p\in[0,p/2)$ or not; that is the "sign" of the Y coordinate of $Q$. And we can find the (already mentioned) parity of the Y coordinate. But that does not help towards getting the "sign" of the private key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.