Lecture 27: The Math of Elliptic Curve Cryptography (ECC): “Adding” Points on a Curve

Sequentia Explores: The Mathematics of Crypto

Part III: Historical Ciphers & the Dawn of Cryptanalysis

Lecture 27: The Math of Elliptic Curve Cryptography (ECC): “Adding” Points on a Curve

In Lecture 16, we had a purely visual introduction to the strange, sinuous shapes of elliptic curves. We saw their characteristic equation, y^2 = x^3 + ax + b, and learned that they are not ellipses. We framed the curve as a unique “game board” for cryptographic operations.

Today, we define the rules of that game. We’re moving from the visual shape to the underlying mathematics. How do we actually “add” points on an elliptic curve, and how does this operation provide the foundation for the most efficient public-key cryptography in use today, including the systems that secure Bitcoin and modern messaging apps?

From a Continuous Curve to a Finite Field

First, a crucial shift in thinking. The smooth curves we saw on the infinite (x, y) coordinate plane are great for building intuition. However, real-world cryptography needs the predictability and finite nature of modular arithmetic.

Therefore, an elliptic curve used in cryptography is not a continuous line. It’s a set of discrete points whose x and y coordinates are integers that satisfy the curve’s equation modulo a prime number p.

The equation becomes:
y^2 ≡ x^3 + ax + b (mod p)

This means the “curve” is actually a scatter plot of specific, valid points within a finite grid (our finite field GF(p)). This finite set of points, along with a special “point at infinity” which acts as our identity element, forms the set for our cryptographic Group.

The Core Operation: Elliptic Curve Point Addition

The “game” we play on this finite collection of points is called point addition. It’s a geometric rule that allows us to take two points on the curve, P and Q, and find a third point, R, that is also on the curve. This is our Group operation.

The geometric rule we saw visually still holds, but now it’s defined by algebraic formulas mod p.

1. If P ≠ Q (Adding two different points):
   • You find the slope m of the line connecting P(x_p, y_p) and Q(x_q, y_q). The formula for this, in modular arithmetic, is:
     m = (y_p – y_q) × (x_p – x_q)^-1 (mod p)
     (Note: That (x_p – x_q)^-1 is the modular multiplicative inverse we learned how to find using the Extended Euclidean Algorithm!)
   • The coordinates of the resulting point R(x_r, y_r) are then calculated using this slope:
     x_r = (m^2 – x_p – x_q) (mod p)
     y_r = (m(x_p – x_r) – y_p) (mod p)
2. If P = Q (Adding a point to itself, or “point doubling”):
   • This is the equivalent of finding the tangent line. The slope m is calculated differently, using calculus adapted for a finite field:
     m = (3x_p^2 + a) × (2y_p)^-1 (mod p)
     (a is the constant from our original curve equation)
   • The formulas for the resulting point R(x_r, y_r) are then:
     x_r = (m^2 – 2x_p) (mod p)
     y_r = (m(x_p – x_r) – y_p) (mod p)

Don’t Panic! You don’t need to memorize these formulas. The crucial takeaway is that there is a well-defined, algebraic process to “add” points, and the result is always another point on the same curve. This satisfies the Closure property for our Group. The math also ensures associativity, identity, and inverses, confirming that the points on an elliptic curve over a finite field form a proper mathematical Group.

Point Multiplication: The ECC Equivalent of Exponentiation

Now, we get to the heart of the matter. Just as we could perform repeated multiplication in RSA to get modular exponentiation (g^k), we can perform repeated point addition on an elliptic curve to get point multiplication (also called scalar multiplication).

kP = P + P + P + … + P (k times)

This is the ECC equivalent of g^k. It is the “easy forward” part of our one-way function.

For example, to calculate 3P:

1. First, calculate 2P = P + P using the point doubling formulas.
2. Then, calculate 3P = 2P + P using the point addition formulas.

Like with modular exponentiation, computers can use an efficient “double-and-add” algorithm (the elliptic curve version of exponentiation by squaring) to calculate kP very quickly, even if k is an enormous number.

The Elliptic Curve Discrete Logarithm Problem (ECDLP)

And here we arrive at our “hard problem,” the trapdoor that provides the security.

• Easy Task (Point Multiplication): Given a starting point P (called a base point or generator) and an integer k, it is computationally easy to calculate the final point Q = kP.
• Hard Task (ECDLP): Given the base point P and the final point Q, it is computationally infeasible to find the original integer k.

This Elliptic Curve Discrete Logarithm Problem (ECDLP) is the foundation of ECC’s security. It’s the same kind of problem as the traditional DLP, but it’s believed to be significantly harder to solve for the same size numbers.

The “points” on the curve don’t have a predictable order like integers. “Adding” a point P to itself repeatedly makes it “hop” around the curve in a way that appears random. Knowing it landed on point Q gives you no easy way to figure out how many “hops” (k) it took to get there.

Why This Matters: Security per Bit

The superior difficulty of the ECDLP is ECC’s superpower. It means we can achieve the same level of security as RSA or Diffie-Hellman but with much smaller keys.

Security Level	RSA/DLP Key Size (bits)	ECC Key Size (bits)
~128 bits	3072	256
~192 bits	7680	384
~256 bits	15360	512

A 256-bit ECC key (the size used by Bitcoin) provides a level of security that would require a much larger 3072-bit RSA key. Smaller keys mean less data to store and transmit, and faster calculations. This efficiency is critical for devices with limited processing power, like mobile phones and smart cards, and for systems that need to process many transactions quickly, like blockchains.

We have now defined the rules of the game. We have a set of points, a way to “add” them, and a resulting “hard problem” that gives us our one-way function.

In our next lecture, we’ll see how this is put into practice with the Elliptic Curve Diffie-Hellman (ECDH) key exchange, the modern, efficient way that Alice and Bob can agree on a shared secret.