user114274: Public keys in the form of 04[x,y] can be compressed since the x axis is symmetrical. Hence we only need the x-coordinate with the 02/03 prefix which states if Y is odd or even. I don't understand the latter, are odd/even on an elliptic curve the same as pos/neg on a Cartesian plain? This makes sense since negative integers can't be expressed in keys. So would the 'negative' Y-coordinate correspond to an 'odd' (03 prefix). If so, how are these coordinates differ in odd/even if the x axis is symmetrical?

user208: Yes and no.
The X and Y coordinates of points on the secp256k1 curve are integers modulo p = 2256 - 232 - 977. Positive/negative don't exist there, as modulo p it holds for every a that -a = p-a.
So, we need another criterion to distinguish the two solutions for y for the equation y2 = x3 + 7.
There are a number of possibilities:

High/low: we could simply distinguish them based on whether they are below/above p/2. If *a < p/2, then its "negation" p-a will be > p/2. As p is odd, no point is equal to p/2 itself.
Even/odd: what the standard picked is looking at the parity of a when brough to range [0, p). Because p is odd, negating any number except 0 will change its parity. And it can be shown that no solutions for y=0 exist.
A third possibility is using quadratic residuosity as a tie-breaker. It turns out that of the two solutions for y, one will always be a square modulo p, and the other won't be. This is perhaps most similar to solutions in the real numbers and their sign: the postive numbers in R, just like the quadratic residues mod p, have a square root - and their negations don't.

So yes, it is somewhat like positive/negative for real solutions, but that "somewhat" is just a property that is true for half the domain, and which is complemented when negating the coordinate.

114274: <p>Public keys in the form of 04[x,y] can be compressed since the x axis is symmetrical. Hence we only need the x-coordinate with the 02/03 prefix which states if Y is odd or even. I don't understand the latter, are odd/even on an elliptic curve the same as pos/neg on a Cartesian plain? This makes sense since negative integers can't be expressed in keys. So would the 'negative' Y-coordinate correspond to an 'odd' (03 prefix). If so, how are these coordinates differ in odd/even if the x axis is symmetrical?</p>
 208: <p>Yes and no.</p>
<p>The X and Y coordinates of points on the secp256k1 curve are integers modulo <em>p = 2<sup>256</sup> - 2<sup>32</sup> - 977</em>. Positive/negative don't exist there, as modulo <em>p</em> it holds for every <em>a</em> that <em>-a = p-a</em>.</p>
<p>So, we need another criterion to distinguish the two solutions for <em>y</em> for the equation <em>y<sup>2</sup> = x<sup>3</sup> + 7</em>.</p>
<p>There are a number of possibilities:</p>
<ul>
<li><strong>High/low</strong>: we could simply distinguish them based on whether they are below/above <em>p/2</em>. If *a &lt; p/2, then its &quot;negation&quot; <em>p-a</em> will be <em>&gt; p/2</em>. As <em>p</em> is odd, no point is equal to <em>p/2</em> itself.</li>
<li><strong>Even/odd</strong>: what the standard picked is looking at the parity of <em>a</em> when brough to range <em>[0, p)</em>. Because <em>p</em> is odd, negating any number except <em>0</em> will change its parity. And it can be shown that no solutions for <em>y=0</em> exist.</li>
<li>A third possibility is using <strong>quadratic residuosity</strong> as a tie-breaker. It turns out that of the two solutions for <em>y</em>, one will always be a square modulo <em>p</em>, and the other won't be. This is perhaps most similar to solutions in the real numbers and their sign: the postive numbers in R, just like the quadratic residues mod <em>p</em>, have a square root - and their negations don't.</li>
</ul>
<p>So yes, it is somewhat like positive/negative for real solutions, but that &quot;somewhat&quot; is just a property that is true for half the domain, and which is complemented when negating the coordinate.</p>
