# substract points on secp256k - result as moved to N-1

I must perform calculate of substract two points:

Let $$G$$ be the generator point and;

$$P_1 =[1]G = (x_1,y_1)$$

$$P_2 = [2]G = (x_2,y_2)$$,

When I will subtract $$P_1 - P_2$$ -> I will move Point to N-1 with negative $$y_1$$ of $$P_1$$

second: Let $$G$$ be the generator point and;

$$P_5 =[5]G = (x_1,y_1)$$

$$P_2 = [2]G = (x_2,y_2)$$,

$$P_3 = [3]G = (x_3,y_3)$$,

When I will subtract $$P_2 - P_5$$ -> I will take result $$P_3$$ with negative $$y_3$$ of $$P_3$$

it looks like $$P_2 - P_5$$ it "similiar" to integer 2 minus integer 5 = we get minus 3 - and in this example -3 it is N-3 .

How to check that substract points cross the order of curve n? without checking y is negative?
how to check that substract point is crossed by Point of Infinity and order of the curve?

Ps. N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 order of curve -> maximum points.

• Welcome to Cryptography.SE. do you mean $P_1 = [1]G$ and $P_2=[2]G$? We have $\LaTeX$/MathJax enabled our site. Currently, you question is not clear. Note that, the point doesn't have floating points. $1/5$ probably means that $5^{-1}$ on the defined field. Apr 27, 2021 at 14:58
• P1=[1]G and P2=[2]G? Yes but 1/5 = 0.2 of P it is halfing_point by 5 it is like 0.2 of P. and we have P_1.2[G] it is equals P + halfing P by 5 . and how to check that substract is moved N-1 curve order? Apr 27, 2021 at 15:00
• "0.2 of P it is halfing_point by 5"; I am not familiar with that terminology (and I suspect others may be in the same boat); what operation are you performing on $P$? Is it 'find the point $Q$ with $5Q = P$, and return $Q$?' Apr 27, 2021 at 18:43
• @poncho point halving possible, however, the Q is not clear to me. Apr 27, 2021 at 19:07
• @kelalaka: I know there is a well defined operation "point halving", however I'm not certain what he means by "point halving by 5" Apr 27, 2021 at 19:09

How to check that substract points cross the order of curve n?

You cant'; or at least, we hope you can't.

If you could, you could use that method to compute discrete logs.

Here is one approach; suppose you had a method that, given the points $$[a]G$$ and $$[b]G$$, would return you $$[a-b]G$$ and also informed you whether it "crossed the order of curve n", that is, if $$a < b$$. Then, what you could do, given the point $$[x]G$$, you could use this method on the points $$[x]G$$ and $$[\lfloor n/2 \rfloor]G$$; that method would tell you if $$x < \lfloor n/2 \rfloor$$. If it turned out (for example) if $$x$$ happened to be larger, you could repeat this with $$[x]G$$ and $$[\lfloor 3n/5 \rfloor]G$$; and continue to do binary searching until you have recovered the value of $$x$$.

That means that you've just recovered the discrete log of $$xG$$ with only circa $$\log_2(n)$$ calls to your method; we certainly hope that we can't do that.

BTW: why do you care if "the points cross the order of curve n"?

• If I know that point of substracted -> crossed the order , then I can make "application" for curve. If its not possible, maybe "how to check" that substract point moved by Point Infinity is possibility? Apr 27, 2021 at 20:39
• @Ironic: 'then I can make "application" for curve' - I have no idea what that means Apr 27, 2021 at 20:51
• imagine calculator like in Windows system. you can add, substract, multiply, and divide. but designed for curves. Apr 27, 2021 at 20:57
• @Ironic: if your EC calculator has things entered as $(x, y)$ coordinates, you can compute point subtraction using the standard algorithm without knowing/caring whether the result "crossed the order" (which, btw, makes sense only in terms of a specific generator). And, if it has things entered as discrete logs (e.g. 3 for [3]G), then its even easier... Apr 27, 2021 at 21:29