ec-curve-symmetry-finite-field

Wed Apr 01 2026

In secp256k1 over $\mathbb{R}^2$, the curve $y^2 = x^3 + 7$ forms an abelian group where point addition is defined as "draw a straight line through both points and take the inverse of the intersection (the third point)." The graph is symmetric along $y = 0$. There exists a point $P \in \mathbb{R}^2$ such that $P = P^{-1}$, namely $P = (\sqrt[3]{-7}, 0)$. This point won't lie on secp256k1 if it is taken over $(\mathbb{F}_p)^2$, so every point will have a distinct inverse in that case.

Plotting the curve over $(\mathbb{F}_p)^2$

We vary $x = 0, 1, 2, 3, \ldots, p-1$ and substitute each into $y^2 = x^3 + 7 \mod p$. So for each $x$ we get $y^2 = q_x \mod p$, where $q_x = x^3 + 7$.

If $q_x$ is a quadratic residue of $p$, then the point lies on the curve. We get two solutions: $(x, y)$ and $(x, p - y)$. If $y$ is even, then $p - y$ is odd. Similarly, if $y$ is a QR then $p - y$ is a QNR. If $q_x$ is a quadratic non-residue of $p$, then there is no solution.

The symmetry axis

The graph is symmetric along $y = p/2$ because $y$ and $p - y$ belong to the same $x$, since $y^2 \equiv (p - y)^2 \mod p$.

But wait. $p$ is odd, so $p/2$ does not belong to $\mathbb{Z}_p$. Should we compute $p \cdot 2^{-1} \mod p$ instead? That is always zero. But the EC curve is not symmetric over $y = 0 \mod p$.

Also, since $p$ is odd, the number of quadratic residues and non-residues are not equal. But the $y$-coordinate points on the EC curve seem to be symmetric over $y = p/2$ anyway.

So the symmetry is visual, not algebraic in $\mathbb{Z}_p$. When we plot the points on a standard integer grid, $y$ and $p - y$ are equidistant from $p/2$ by construction. The axis $y = p/2$ is a property of how we draw the graph, not a meaningful element of the field.

Quadratic residues in $\mathbb{Z}_p^*$

Exactly half of $\mathbb{Z}_p^*$ are quadratic residues, and they are the even powers of a generator $g$. A group can have different generator points, but the set of QRs can't be different. So the even powers of any $g$ result in the same set QR?