← Atlas·Elliptic curve group law

The Elliptic Curve Group Law

A smooth cubic curve y² = x³ + ax + b hides a secret algebraic structure: you can add two points on it and get a third point on it. Draw the line through P and Q, find where it hits the curve a third time, reflect across the x-axis — that's P + Q. This bizarre "addition" obeys all the laws of arithmetic, and its difficulty to reverse secures most of the internet. Drag P and Q.

a -1.00
b 1.20
how drawing a line becomes arithmetic — and cryptography
On the curve y² = x³ + ax + b, define addition geometrically: to compute P + Q, draw the straight line through P and Q. Because the curve is a cubic, that line meets it in exactly one more point R. Reflect R across the x-axis — that reflection is P + Q. To double a point (P + P), use the tangent line at P instead.

The miracle: this operation is a genuine abelian group. It's associative ((P+Q)+S = P+(Q+S) — not at all obvious from the geometry!), commutative, has an identity (the "point at infinity," where vertical lines meet), and every point has an inverse (its mirror image). A curve full of points becomes an algebraic structure you can compute in.

Why cryptography loves it: pick a base point G and add it to itself k times to get kG (the "multiples" button traces this). Going forward — given k, compute kG — is fast (repeated doubling). Going backward — given G and kG, recover k — is the elliptic-curve discrete logarithm problem, and over a finite field it is brutally hard. That asymmetry is a trapdoor: it underlies ECDSA signatures (Bitcoin, Ethereum), the X25519 key exchange in TLS 1.3 and Signal, and Apple/Android secure enclaves. Elliptic-curve keys give the same security as RSA with a quarter the bits.

Why mathematicians love it even more: the set of rational points on an elliptic curve is finitely generated (Mordell's theorem) — its rank is a deep mystery, the subject of the Birch–Swinnerton-Dyer conjecture, one of the million-dollar Millennium Prize Problems. And elliptic curves were the keystone of Andrew Wiles's 1994 proof of Fermat's Last Theorem: he proved the Modularity Theorem (every rational elliptic curve is "modular"), which a chain of results had shown would make aⁿ + bⁿ = cⁿ impossible for n > 2. A 358-year-old problem fell because of the arithmetic of drawing lines through cubic curves.

One caution: real cryptography uses curves over finite fields (points are a discrete scatter, not a smooth arc), but the group law — chord, third point, reflect — is letter-for-letter the same. This continuous picture is the intuition; the security comes from doing it modulo a 256-bit prime.