How to use the elliptic curve point addition calculator
- Enter the coefficients a and b of the curve y squared = x cubed + a x + b, and a prime p. The page checks that p is prime and the curve is not singular.
- Choose Add two points or Multiply a point.
- Enter the point P (and Q to add, or the multiplier k). The page checks that each point is on the curve.
- Read the result, which can be the point at infinity, and for small primes the number of points and the order of P.
Formula
Adding distinct points: slope = (y2 - y1) / (x2 - x1). Doubling: slope = (3 x1^2 + a) / (2 y1). All modulo p.
x3 = slope^2 - x1 - x2 and y3 = slope (x1 - x3) - y1
Opposite points (same x, y values adding to p) add to the point at infinity O
k x P is found by double-and-add, using the binary digits of k
The points of the curve with the point at infinity form a group under this addition. The page counts the points by testing every x for a square root, which works for primes up to 200,000.
The curve y squared = x cubed + 2x + 2 over the field with 17 elements
The point (5, 1) is on the curve because 1 = 125 + 10 + 2 = 137 mod 17. Doubling it gives 2P = (6, 3), and adding (5, 1) and (6, 3) gives 3P = (10, 6). The curve has 19 points in all, including infinity, and (5, 1) has order 19, so 19 x P is the point at infinity and 18 x P = (5, 16), the negative of P.
On y squared = x cubed + 2x + 3 over the field with 97 elements, the curve has 100 points. The point (3, 6) has order 5, so 7 x P = 2 x P = (80, 10).
Why elliptic curves matter
Elliptic curve cryptography uses the fact that computing k x P is easy by double-and-add, while finding k from P and k x P is believed to be very hard for well-chosen curves over large fields. It gives the same security as older systems with much shorter keys, which is why it is used in secure web connections, messaging and digital signatures. The curves and fields of real systems are far larger than the ones here.
Compare with group arithmetic on whole numbers in the modular arithmetic calculator, and test numbers for primality with the prime number calculator.
Check your work by hand
For small fields the calculation is easy to follow with a pencil. Compute the slope with a modular inverse, find x3 and y3, and check that the result satisfies the curve equation. The page confirms that every input point is on the curve and tells you how it fails if it is not. To solve systems of congruences, see the Chinese remainder theorem solver.
This tool is for learning with small and medium primes. Do not use it to create keys.
Assumptions and limits
- The curve is in short Weierstrass form over a prime field, with 4a^3 + 27b^2 not equal to 0 modulo p.
- Coordinates are whole numbers from 0 to p - 1, with numbers of up to 30 digits.
- The point count and the order are computed only for p up to 200,000.
- The page is for study and not for generating keys.
Frequently asked questions
How do you add two points on an elliptic curve?
Find the slope of the line through them, use it to find the third intersection with the curve and reflect that point across the x axis. Over a prime field every step is done modulo p.
What is the point at infinity?
It is the identity of the group, the result of adding a point and its negative. The page writes it as O.
What is the order of a point?
It is the smallest positive k for which k x P is the point at infinity.
Why must p be prime?
Over a prime field, every non-zero number has an inverse, which the slope formula needs. The page checks p and tells you if it is not prime.