ABC Tools

Elliptic Curves, Explained

After reading this you can add two points on an elliptic curve by hand, compute a scalar multiple with double-and-add, and follow a toy Diffie-Hellman exchange over a finite field where both parties land on the same shared secret.

What an elliptic curve is, and one picture to hold onto

An elliptic curve over the real numbers is the set of points satisfying y^2 = x^3 + ax + b, together with one extra point "at infinity" that acts as a zero. For most choices of a and b the graph is a smooth curve, symmetric about the x-axis because y appears squared.

The one picture worth memorizing is the chord rule. Draw a straight line through two points P and Q on the curve. Because the curve is cubic, that line hits the curve in exactly one more place. Reflect that third point across the x-axis and you get P + Q. That reflection is the whole trick. Everything else, including the security of a 256-bit key, is that operation repeated.

The real-number plot in the tool is for intuition. Real cryptography runs the identical formulas over a finite field, where the smooth curve becomes a scatter of dots. Same algebra, no geometry to lean on.

The point at infinity, written \mathcal{O}, is not a dodge. It is the identity element: P + \mathcal{O} = P for every P. Geometrically it sits "vertically at infinity", which is why a vertical line through P and its reflection -P is said to meet the curve there.

When this model is the right one

Use the elliptic-curve picture when you want to understand how ECDH key exchange and ECDSA signatures actually compute. The group law here is the exact operation inside ECDSA keys, sign and verify and inside every TLS handshake that uses X25519.

Do not use the real-number plot to reason about security. Over the reals there is a notion of "near" and a smooth slope, so you could estimate a scalar by eye. Over a finite field none of that survives: multiples of a point scatter with no pattern, and that scattering is the security. Also do not confuse this with RSA. RSA rests on integer factoring, not on the discrete logarithm on a curve. If you came for RSA, see the RSA key pair generator instead.

The addition formula and why it works

To add P = (x_1, y_1) and Q = (x_2, y_2) with P \ne \pm Q, first take the slope of the line through them.

\lambda = \frac{y_2 - y_1}{x_2 - x_1}

Here \lambda is the ordinary slope: rise over run. Then the third intersection and its reflection give the sum P + Q = (x_3, y_3).

x_3 = \lambda^2 - x_1 - x_2, \quad y_3 = \lambda(x_1 - x_3) - y_1

The x_3 formula comes from matching the line y = \lambda(x - x_1) + y_1 against the cubic and using the fact that the three roots sum to \lambda^2. The sign flip in y_3 is the reflection.

Doubling a point (P = Q) uses the tangent line instead of a chord, so the slope comes from calculus:

\lambda = \frac{3x_1^2 + a}{2y_1}

The same x_3 and y_3 formulas then apply with x_2 = x_1. Over a finite field \mathbb{F}_p, replace every division by multiplication with the modular inverse mod p. Nothing else changes.

A worked example over F_p (the demo defaults)

The demo uses the curve y^2 = x^3 + 2x + 2 over \mathbb{F}_{17} with base point G = (5, 1). Check that G is on the curve: 1^2 = 1 and 5^3 + 2\cdot 5 + 2 = 125 + 12 = 137 = 8\cdot 17 + 1 \equiv 1 \pmod{17}. Both sides equal 1.

Computing 2G by doubling

  1. Slope numerator: 3x_1^2 + a = 3\cdot 25 + 2 = 77 \equiv 9 \pmod{17}.
  2. Slope denominator: 2y_1 = 2. Its inverse mod 17 is 9, because 2\cdot 9 = 18 \equiv 1.
  3. Slope: \lambda = 9\cdot 9 = 81 \equiv 13 \pmod{17}.
  4. x_3 = 13^2 - 5 - 5 = 169 - 10 = 159 \equiv 6 \pmod{17}, since 159 = 9\cdot 17 + 6.
  5. y_3 = 13(5 - 6) - 1 = -13 - 1 = -14 \equiv 3 \pmod{17}.

So 2G = (6, 3). Verify: 3^2 = 9 and 6^3 + 2\cdot 6 + 2 = 216 + 14 = 230 = 13\cdot 17 + 9 \equiv 9. Both sides equal 9. The point is on the curve.

Continuing with chord additions gives the full cycle of multiples. This curve over \mathbb{F}_{17} has 19 points, and G generates all of them, so its order is 19. Because 19 is prime, every non-identity point generates the whole group, an illustration of Lagrange's theorem: the order of any point divides the group order.

Multiples of G = (5, 1) on y² = x³ + 2x + 2 over F_17
nnG (x)nG (y)nnG (x)nG (y)
15161613
263706
3106876
4319711
591610011

Reading the scatter, and why order matters

Plot those multiples and the lesson is immediate: consecutive multiples do not sit near each other. Going from 4G = (3,1) to 5G = (9,16) to 6G = (16,13), the x-coordinate jumps 3, 9, 16 with no trend. That unpredictability is what makes recovering n from nG hard.

The first ten multiples of G. Note there is no left-to-right progression: the point index and its position are unrelated, which is the visual form of the discrete logarithm problem.

The order of the base point is the count of steps until you return to \mathcal{O}. On this curve that is 19. In real systems the order is a prime hundreds of bits long. For P-256 the group order is about 2^{256}, and the best known attack (Pollard's rho) needs roughly \sqrt{n} \approx 2^{128} steps. At a billion billion (10^{18} \approx 2^{60}) operations per second, 2^{128} steps take about 10^{20} years.

The toy ECDH exchange, step by step

Diffie-Hellman on this curve works like this. Alice picks a secret a, Bob picks a secret b. Each publishes a point.

Alice and Bob agree on 15G without sending it

  1. Alice's secret a = 3. She sends aG = 3G = (10, 6).
  2. Bob's secret b = 5. He sends bG = 5G = (9, 16).
  3. Alice computes a(bG) = 3\cdot(9,16) = 15G.
  4. Bob computes b(aG) = 5\cdot(10,6) = 15G.
  5. Both reach 15G because 3\cdot 5 = 5\cdot 3 = 15. Scalar multiplication commutes.

The shared secret is 15G. Working the additions through gives 15G = (13, 10) on this curve. An eavesdropper sees G, (10,6) and (9,16) but not a or b, and cannot compute 15G without solving a discrete logarithm.

On this toy curve the eavesdropper wins in microseconds by trying all 19 multiples. The construction is identical on Curve25519, where the same brute-force search would need about 2^{126} tries.

On the curve y² = x³ + 2x + 2 over F_17 with G = (5,1), the multiples nG for n = 1..19 are: (5,1), (6,3), (10,6), (3,1), (9,16), (16,13), (0,6), (7,6), (7,11), (0,11), (16,4), (9,1), (3,16), (10,11), (6,14), (5,16), and then n=17,18,19 return toward the identity at n=19. Pick a secret n and read off nG; the point jumps unpredictably as n increases by 1.

Common mistakes

Do not treat the finite-field scatter as if points near each other were "close" in value. There is no distance on \mathbb{F}_p. Two adjacent dots on screen can be 7G and 12G, unrelated in scalar terms.

Three errors show up repeatedly.

Forgetting the modular inverse
Over \mathbb{F}_p the slope needs a modular inverse, not real division. To divide by 2 mod 17 you multiply by 9, not by 0.5. Get this wrong and every point leaves the curve.
Reusing an ECDH secret across sessions
The math is sound, but a static private scalar loses forward secrecy. Real protocols pick a fresh ephemeral a per handshake.
Choosing a singular curve
If 4a^3 + 27b^2 \equiv 0 \pmod p the curve has a cusp or self-intersection and the group law breaks. For the demo, 4\cdot 8 + 27\cdot 4 = 32 + 108 = 140 \equiv 4 \pmod{17}, which is nonzero, so the curve is safe to use.

Related tools

Once the group law makes sense, put it to work. The ECDSA tool uses the same scalar multiplication over P-256, P-384 and P-521 to sign and verify. For the factoring-based counterpart, the RSA encrypt and decrypt tool and the RSA sign and verify tool show the alternative public-key family, and the key generator linked earlier produces the PEM files they consume.

Frequently asked questions

Why are elliptic curve keys so much shorter than RSA keys?

The best attack on a well-chosen curve of order 2^{256} costs about 2^{128} steps, while breaking RSA can use index calculus, which is subexponential. Matching 2^{128} security needs a 3072-bit RSA modulus but only a 256-bit curve.

What does the point at infinity actually store in code?

Usually a sentinel value, since it has no finite coordinates. Implementations often use projective coordinates where infinity is (0:1:0), both to represent it cleanly and to avoid the modular inverse in every addition.

Is computing nG really fast?

Yes. Double-and-add computes nG in about \log_2 n doublings plus a few additions. For a 256-bit n that is roughly 256 doublings and 128 additions, well under a millisecond, while reversing it needs about 2^{128} operations.

Can I pick any a and b?

Mathematically almost any pair works as long as 4a^3 + 27b^2 \ne 0 \pmod p. For security you also want a large prime group order and resistance to known structural attacks, which is why standardized curves like P-256 and Curve25519 are used rather than random ones.

Try it yourself in the tool

Related tools

RSA Key Pair Generator

Generate 2048/3072/4096-bit RSA keys in PEM format.

ECDSA Keys, Sign & Verify

Elliptic-curve key pairs and signatures (P-256/384/521).

RSA Encrypt & Decrypt

Encrypt with a public key, decrypt with the private key.

RSA Sign & Verify

Sign a message with RSA-PSS and verify the signature.

AES Encryption

Encrypt and decrypt text with AES-GCM or AES-CBC.

Cryptographic Key Generator

Random keys, IVs, salts and API tokens from a CSPRNG.