user113769: I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.
Let's take a point GP. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y
G10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)
Let's take another point GQ for subtraction with GP. for Q=20 I get,
G*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)
Now subtract GP - GQ, In normal math, it is 10-20= -10, but with EC math I get a point  (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)
which has the same X value as 10 but Y is different.  If I add G to the result the point is 9G but with a different value.
I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G
Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)
One valve is used for 10 and the other for a point which is a result of subtraction.
p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 72488970228380509287422715226575535698893157273063074627791787432852706183111
ysquared = ((xxx+7) % p)
y = pow(ysquared, (p+1)/4, p)
print "y1 = %s " % y
print "y2 = %s " % (y * -1 % p)
So that question can also be, How to know which Y value to use if a value of X is given,

user38618: How subtraction works
P - Q = P + (-Q) where -Q is the negated Q. (- changes the sign, or in another words, subtracts from the modulus)
An example: On this website. For this example, set p = 523;
Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate 4P - P:
Set n = 4 to find 4P = (-236, 235)
For n = 1 to find P = (10, 22)
Now, we need to negate it, so set n = -1 to find -P = (10, -22)
Go to the addition tab to add -P to 4P, to find (22, -42)
Set n = 3 to see if we find the same value ... we do (22, -42)

But, the answer is not "negative", as pinhead explains.

user3667: There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an elliptic curve over a finite field. It is a cyclic group of points composed of positive-integers. You might want to learn about modulo arithmetic and cyclic groups

user76567: As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined here so in your example to get the result for -10 * G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)

user208: If the point (X,Y) is on the elliptic curve y2 = x3 + ax + b, then the point (X,-Y) is also on that curve. Substitution yields (-y)2 = x3 + ax + b, which is the same equation.
In fact, it is the case that if kG = (X,Y), then (-k)G = (N-k)G = (X,P-Y), where the multiplications with G are point multiplications, N is the curve order, and P is the field size (P = 2256 - 232 - 977 for secp256k1).
So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.
Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:

The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.
The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.
The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.


113769: <p>I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it.</p>
<p>Let's take a point G<em>P. Using the Bitcoin curve equation, for a value of P=10 I get below X and Y
G</em>10 =(72488970228380509287422715226575535698893157273063074627791787432852706183111,62070622898698443831883535403436258712770888294397026493185421712108624767191)</p>
<p>Let's take another point G<em>Q for subtraction with G</em>P. for Q=20 I get,
G*20 = 34773495056115281091786765947597603724784643419904767525769502836017890139287,8470533044743364938367028725608288731153024648869546164814808839694950063162)</p>
<p>Now subtract G<em>P - G</em>Q, In normal math, it is 10-20= -10, but with EC math I get a point  (72488970228380509287422715226575535698893157273063074627791787432852706183111,53721466338617751591687449605251649140499096371243537546272162295800209904472)</p>
<p>which has the same X value as 10 but Y is different.  If I add G to the result the point is 9G but with a different value.</p>
<p>I am not sure how it is called (Y inverse ?) but I see it's like a point before G and if I add G it comes closer to G. 9G,8G,7G.... 1G</p>
<p>Another way of seeing this is that Y can have 2 possible values (below is the python code which I used to calculate)</p>
<p>One valve is used for 10 and the other for a point which is a result of subtraction.</p>
<p>p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 72488970228380509287422715226575535698893157273063074627791787432852706183111
ysquared = ((x<em>x</em>x+7) % p)<br />
y = pow(ysquared, (p+1)/4, p)
print &quot;y1 = %s &quot; % y
print &quot;y2 = %s &quot; % (y * -1 % p)</p>
<p>So that question can also be, How to know which Y value to use if a value of X is given,</p>
 38618: <h3>How subtraction works</h3>
<p><code>P - Q = P + (-Q)</code> where <code>-Q</code> is the negated <code>Q</code>. (<code>-</code> changes the sign, or in another words, subtracts from the modulus)</p>
<p>An example: On <a href="https://enriquesl-git.github.io/ecc/interactive/modk-mul.html" rel="nofollow noreferrer">this website</a>. For this example, set p = 523;</p>
<p>Let the generator (P) be (10, 22). I have 4P and I need 3P. I do the following to calculate <code>4P - P</code>:</p>
<p>Set n = 4 to find 4P = (-236, 235)</p>
<p>For n = 1 to find P = (10, 22)</p>
<p>Now, we need to negate it, so set n = -1 to find -P = (10, -22)</p>
<p>Go to the addition tab to add -P to 4P, to find (22, -42)</p>
<p>Set n = 3 to see if we find the same value ... we do (22, -42)</p>
<hr />
<p>But, the answer is not &quot;negative&quot;, as pinhead explains.</p>
 3667: <p>There is no such thing as negative numbers on the elliptic curve used by Bitcoin because it is an <a href="https://en.wikipedia.org/wiki/Elliptic_curve#Elliptic_curves_over_finite_fields" rel="nofollow noreferrer">elliptic curve over a finite field</a>. It is a cyclic group of points composed of positive-integers. You might want to learn about <a href="https://en.wikipedia.org/wiki/Modular_arithmetic" rel="nofollow noreferrer">modulo arithmetic</a> and <a href="https://en.wikipedia.org/wiki/Cyclic_group" rel="nofollow noreferrer">cyclic groups</a></p>
 76567: <p>As mentioned in other replies, the y^2 = x^3 + 7 equation has two roots (two valid y values for every x). EC point multiplication with scalar is defined <a href="https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Point_multiplication" rel="nofollow noreferrer">here</a> so in your example to get the result for -10 * G pick one of the algorithms in the link and substitute P = G and d = -10 mod (curve order)</p>
 208: <p>If the point (X,Y) is on the elliptic curve <em>y<sup>2</sup> = x<sup>3</sup> + ax + b</em>, then the point (X,-Y) is also on that curve. Substitution yields <em>(-y)<sup>2</sup> = x<sup>3</sup> + ax + b</em>, which is the same equation.</p>
<p>In fact, it is the case that if <em>kG = (X,Y)</em>, then <em>(-k)G = (N-k)G = (X,P-Y)</em>, where the multiplications with <em>G</em> are point multiplications, <em>N</em> is the curve order, and <em>P</em> is the field size (<em>P = 2<sup>256</sup> - 2<sup>32</sup> - 977</em> for <code>secp256k1</code>).</p>
<p>So if your question is how you find the correct Y coordinate given just X, the answer is you don't. There will always be two solutions.</p>
<p>Typical point encoding standards avoid that by either encoding the Y coordinate explicitly, disambiguating, or only permitting one:</p>
<ul>
<li>The SEC2 uncompressed public key encoding is 0x04 + (X coordinate) + (Y coordinate); 65 bytes for 256-bit curves.</li>
<li>The SEC2 compressed public key encoding is 0x02 + (X coordinate) if Y is even, and 0x03 + (X coordinate) if Y is odd.</li>
<li>The proposed BIP340 Schnorr signatures (which I'm a co-author of) just store the X coordinate (32 bytes), but with an implicit Y-is-even.</li>
</ul>
