user80710: In the answer to this question, it is stated that:

Rearranging this equation you get rP = sR - mG, or P = (s/r)R - (m/r)G. Thus, it seems we can just compute the public key from the message and the signature. Unfortunately, there can be up to 4 different points R for which R.x mod n = r (in practice, the number is almost always 2).

How is it possible that there could be up to 4 different points for R? And why would it most often be 2 different points?

user208: Negating an elliptic curve point means negating its Y coordinate (modulo the field size p), so -(x,y) = (x,-y). This implies that if you have a point R for which R.x mod n = k (where n is the curve order), then the same will be true for -R.
Furthermore, and with negligable probability, it is possible that both R.x and R.x + n are valid X coordinates (only when R.x < p-n). In that case, there are 4 possible points ((r, y1), (r,-y1),(r+n,y2),(r+n,-y2)).

80710: <p>In the answer to <a href="https://bitcoin.stackexchange.com/questions/81232/how-is-public-key-extracted-from-message-digital-signature-address">this question</a>, it is stated that:</p>

<blockquote>
  <p>Rearranging this equation you get <em>rP = sR - mG</em>, or <em>P = (s/r)R - (m/r)G</em>. Thus, it seems we can just compute the public key from the message and the signature. Unfortunately, there can be up to 4 different points <em>R</em> for which <em>R.x mod n = r</em> (in practice, the number is almost always 2).</p>
</blockquote>

<p>How is it possible that there could be up to 4 different points for <em>R</em>? And why would it most often be 2 different points?</p>
 208: <p>Negating an elliptic curve point means negating its Y coordinate (modulo the field size <em>p</em>), so <em>-(x,y) = (x,-y)</em>. This implies that if you have a point <em>R</em> for which <em>R.x mod n = k</em> (where <em>n</em> is the curve order), then the same will be true for <em>-R</em>.</p>

<p>Furthermore, and with negligable probability, it is possible that both <em>R.x</em> and <em>R.x + n</em> are valid X coordinates (only when <em>R.x</em> &lt; p-n). In that case, there are 4 possible points (<em>(r, y1)</em>, <em>(r,-y1)</em>,<em>(r+n,y2)</em>,<em>(r+n,-y2)</em>).</p>
