Given a point R on an Elliptic curve find two distinct points P and Q so that (a) P+Q=R and (b) the y coordinate is the same for P, Q and R

Question

Point addition on elliptic curves allows us to determine a point R given two distinct points P and Q so that P + Q = R. There are various ways to calculate point addition depending on the type of curve. A brief explanation of point addition is given here.

My question looks at the opposite path. Given a point R(x,y) on a curve, find two distinct points P(x,y) and Q(x,y) so that (a) P(x,y) + Q(x,y) = R(x,y) and (b) the y value is the same for each point P, Q and R.

Is it possible? If not, why not?

The answer can be exemplified using the Secp256k1 curve to limit the scope.

Thanks.

Answer 1

Found one example for non-zero $y$: Let the degree $3$ finite field $K$ of characteristic $2$ be $$ K:= \mathbb Z[a]/(2,a^3+a+1) $$ and consider the following Elliptic Curve $E$ over $K$ $$ E:y^2+xy+y=x^3+x+a $$ Then there are three points $$ \begin{align*} P&=(a,a^2+a),& Q&=(a+1,a^2+a), & R&=(1,a^2+a) \end{align*} $$ on $E$ and we may verify that $$ P+Q=R $$

---

The line $PQ$ is by definition $y=a^2+a$ with gradient $\lambda = 0$ and constant $v=a^2+a$. The $x$-coordinate of $R$ is given by $$ x_R=\lambda^2+a_1\lambda-a_2-x_P-x_Q = -x_P-x_Q= -(a)-(a+1) \equiv 1 \pmod 2 $$ The $y$-coordinates of $R$ is $$ y_R = -(\lambda+a_1)x_3-v-a_3=-(0+1)(1)-(a^2+a)-1\equiv a^2+a \pmod 2 $$ Hence we get $$ R = (x_R,y_R) = (1,a^2+a) $$

Answer 2

There are several examples listed in the LMFDB. For exmaple, the LMFDB curve $40.a2$ $\, y^2 = x^3 - 7x - 6\,$ has three integral points $\, P:= (-1, 0),\;\; Q := (3, 0),\;\; R := (-2,0),\;\; P\ + Q = R. \,$ All three points have the same $\,y\,$ value $0$. Thus, in answer to your question, for some curves and for some points it is possible.