Elliptic Curves — Introduction and the Group Law

An elliptic curve over a field $K$ is a smooth projective cubic curve with a marked rational point, typically written $y^2=x^3+ax+b$. Its defining feature is a natural abelian group law on its points, defined geometrically by the "chord-and-tangent" process: three collinear points sum to the identity. This structure underlies modern cryptography, number theory (including the proof of Fermat's Last Theorem), and the Birch–Swinnerton-Dyer conjecture. Developed from the study of elliptic integrals in the 19th century by Abel, Jacobi, Weierstrass, and Poincaré.

An elliptic curve is, concretely, the set of solutions $(x,y)$ to a Weierstrass equation $y^2=x^3+ax+b$ (with $4a^3+27b^2\ne 0$ to ensure smoothness), together with a single extra point at infinity $\mathcal{O}$. The remarkable fact — surprising even to specialists when first encountered — is that these points form an abelian group under a geometric addition that has nothing obviously to do with arithmetic: you draw a line through two points, find where it meets the curve a third time, and reflect. This turns a geometric object into an algebraic one, marrying geometry, algebra, and number theory. Elliptic curves matter because their group structure encodes deep arithmetic (how many rational points exist?) and powers real cryptographic systems used billions of times daily.

The Core Insight

A cubic curve is "just right" for a group law. A line meets a cubic in exactly three points (counted with multiplicity, over an algebraically closed field, in projective space). Given two points $P$ and $Q$, the line through them hits a unique third point $R$. Declaring $P+Q+R$ to equal the identity $\mathcal{O}$ produces a group — and the geometry forces both commutativity (the line through $P,Q$ is the line through $Q,P$) and, with real effort, associativity. The marked point $\mathcal{O}$ serves as both the group identity and the geometric "vanishing point" of all vertical lines.

Formal Statement

Weierstrass Form of an Elliptic Curve

Let $K$ be a field with $\mathrm{char}K\ne 2,3$. An elliptic curve $E$ over $K$ is the set of points $(x,y)\in {\bar{K}}^2$ satisfying the short Weierstrass equation

together with the point at infinity $\mathcal{O}$, subject to the nonsingularity (smoothness) condition that the discriminant is nonzero:

The set of points with coordinates in a field extension $L\supseteq K$ is denoted $E(L)$. Here $\bar{K}$ is the algebraic closure of $K$, $a,b$ are the curve parameters, and $\mathcal{O}$ is a single distinguished point not lying in the affine plane.

Projective Setting and the Point at Infinity

The honest home of an elliptic curve is the projective plane ${\mathbb{P}}^2$. Homogenizing [1] with $x=X/Z$, $y=Y/Z$ gives

Setting $Z=0$ forces $X^3=0$, so $X=0$, leaving the single projective point $\mathcal{O}=[0:1:0]$. This is the point "at infinity in the vertical direction": every vertical line $x=c$ passes through it.

The Group Law

Let $E$ be an elliptic curve over $K$. The chord-and-tangent construction makes $E(K)$ into an abelian group with identity element $\mathcal{O}$. Explicitly, for $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ with $P,Q\ne \mathcal{O}$ and $P+Q\ne \mathcal{O}$, the sum $P+Q=(x_3,y_3)$ is given by

where the slope $\lambda$ is

The inverse of $P=(x_1,y_1)$ is $-P=(x_1,-y_1)$, and $\mathcal{O}$ is the identity: $P+\mathcal{O}=P$.

Why It Holds / Derivation

Deriving the Addition Formula

We derive [4]–[5] for distinct affine points $P=(x_1,y_1)$, $Q=(x_2,y_2)$ with $x_1\ne x_2$.

Why should associativity hold? It is not obvious from the algebra (formula [4] is a mess to compose), but it is forced by geometry. The deep reason is a special case of the Cayley–Bacharach theorem: if two cubic curves meet in 9 points, any cubic through 8 of them passes through the 9th. Both $(P+Q)+R$ and $P+(Q+R)$ are constructed using configurations of lines (degenerate cubics) intersecting $E$; Cayley–Bacharach guarantees the constructions land on the same point. Alternatively, associativity is a free consequence of the deep fact that $E$ is isomorphic, as a group, to a quotient of the complex plane $\mathbb{C}/\Lambda$ (a torus) via the Weierstrass $\wp$-function — and addition on a torus is obviously associative.

The geometric group law: P + Q via chord, and 2P via tangent

<svg viewBox="0 0 640 440" xmlns="http://www.w3.org/2000/svg">
<rect width="640" height="440" fill="#0a0e17"/>
<!-- axes -->
<line x1="40" y1="220" x2="600" y2="220" stroke="#94a3b8" stroke-width="1"/>
<line x1="320" y1="30" x2="320" y2="410" stroke="#94a3b8" stroke-width="1"/>
<text x="605" y="224" fill="#e2e8f0" font-size="13">x</text>
<text x="326" y="40" fill="#e2e8f0" font-size="13">y</text>
<!-- elliptic curve y^2 = x^3 - x + 1 (sketched) two branches -->
<path d="M 150 220 C 200 120, 280 70, 320 60 C 360 70, 440 120, 560 30"
      fill="none" stroke="#d4a853" stroke-width="2.5"/>
<path d="M 150 220 C 200 320, 280 370, 320 380 C 360 370, 440 320, 560 410"
      fill="none" stroke="#d4a853" stroke-width="2.5"/>
<!-- chord line through P and Q -->
<line x1="190" y1="120" x2="500" y2="335" stroke="#60a5fa" stroke-width="1.5" stroke-dasharray="5 4"/>
<!-- P, Q on upper/lower -->
<circle cx="230" cy="148" r="4" fill="#e2e8f0"/>
<text x="210" y="140" fill="#e2e8f0" font-size="13">P</text>
<circle cx="390" cy="258" r="4" fill="#e2e8f0"/>
<text x="398" y="252" fill="#e2e8f0" font-size="13">Q</text>
<!-- third intersection R' -->
<circle cx="470" cy="320" r="4" fill="#f87171"/>
<text x="478" y="316" fill="#f87171" font-size="12">R'</text>
<!-- reflect to P+Q -->
<line x1="470" y1="320" x2="470" y2="120" stroke="#94a3b8" stroke-width="1" stroke-dasharray="2 3"/>
<circle cx="470" cy="120" r="4" fill="#34d399"/>
<text x="478" y="116" fill="#34d399" font-size="12">P+Q</text>
<!-- point at infinity label -->
<text x="430" y="55" fill="#94a3b8" font-size="11">O = [0:1:0] (vertical direction)</text>
<text x="150" y="430" fill="#94a3b8" font-size="12">Chord through P, Q meets curve at R'; reflect across x-axis to get P+Q.</text>
</svg>

Karl Weierstrass | 1815–1897

Weierstrass systematized the theory of elliptic functions through his $\wp$-function, satisfying the differential equation $({\wp }^{\prime }{)}^2=4{\wp }^3-g_2\wp -g_3$ — the analytic origin of the cubic equation [1]. His parametrization $z\mapsto (\wp (z),{\wp }^{\prime }(z))$ realizes any complex elliptic curve as a quotient torus $\mathbb{C}/\Lambda$, making the group law transparent: it is just addition of complex numbers modulo the lattice $\Lambda$. The "Weierstrass form" of an elliptic curve bears his name. His insistence on rigor (the $\epsilon$–$\delta$ era) shaped the analytic foundations on which this theory rests.

Building Intuition

Think of the three pictures that should live in your head simultaneously:

1. The real picture. Over $\mathbb{R}$, the curve looks like one or two ovals/branches in the plane. Addition is "draw a line, find the third hit, flip vertically." The point at infinity $\mathcal{O}$ is where vertical lines "meet."

1. The complex picture. Over $\mathbb{C}$, the curve is topologically a torus (doughnut). The group law is literally addition on the torus surface — a circle group $\times$ circle group. This is why associativity and commutativity are automatic.

1. The arithmetic picture. Over $\mathbb{Q}$ or a finite field ${\mathbb{F}}_p$, you only have finitely many or countably many points, but the same algebraic formulas [4]–[5] still define a group. Over ${\mathbb{F}}_p$ this group is finite and is the engine of elliptic curve cryptography.

The slogan: one cubic equation, three faces — geometric, analytic, arithmetic — all carrying the same group.

Worked Examples

Adding two rational points

Doubling a point over a finite field

Common Misconceptions

A singular "curve" is not an elliptic curve

Consider $y^2=x^3$ (a cuspidal cubic) or $y^2=x^3+x^2$ (a nodal cubic). Both have $\Delta =0$, violating [2]. At the singular point — the cusp $(0,0)$ for the first, the node $(0,0)$ for the second — the tangent is not well-defined, so the doubling formula [5] breaks (you divide by $2y_1=0$ in a way that has no geometric fix). The smooth points still form a group, but it is isomorphic to the additive group ${\mathbb{G}}_a$ (cusp) or the multiplicative group ${\mathbb{G}}_m$ (node) — not to a genuine elliptic curve. Smoothness is essential.

Connections

The group law sits at a crossroads of mathematics. Over $\mathbb{C}$, the Weierstrass ℘-function gives an isomorphism $E(\mathbb{C})\cong \mathbb{C}/\Lambda$ with a Lattice in the Complex Plane, so the theory connects to Complex Analysis and Modular Forms. Over $\mathbb{Q}$, the Mordell–Weil Theorem states $E(\mathbb{Q})$ is a finitely generated abelian group, $E(\mathbb{Q})\cong {\mathbb{Z}}^r\oplus T$, linking to the structure theory in Abelian Groups. Over finite fields ${\mathbb{F}}_p$, Hasse's Theorem bounds the point count, feeding Elliptic Curve Cryptography. The discriminant and $j$-invariant connect to Algebraic Geometry and the classification of curves up to isomorphism. The Cayley–Bacharach mechanism behind associativity is part of Projective Geometry.

Real-World Applications

1. Elliptic Curve Cryptography (ECC). Protocols like ECDH (key exchange) and ECDSA (digital signatures) rely on the hardness of the elliptic curve discrete logarithm problem: given $P$ and $nP$, recover $n$. Used in TLS/HTTPS, SSH, and Bitcoin/Ethereum (which use the curve secp256k1: $y^2=x^3+7$ over a 256-bit prime field).

1. Apple iMessage, Signal, WhatsApp. End-to-end encryption uses Curve25519 (Bernstein's curve) for the X25519 key agreement — chosen for speed and resistance to implementation pitfalls.

1. Integer factorization — Lenstra's ECM. The Elliptic Curve Method factors large integers by exploiting the group law modulo a composite $N$; a failed inversion reveals a factor of $N$.

1. Primality proving — ECPP. The Elliptic Curve Primality Proving algorithm certifies that very large numbers are prime, used to verify record primes.

1. Fermat's Last Theorem. Wiles's 1995 proof proceeded by attaching an elliptic curve (the Frey curve) to a hypothetical solution and showing it could not be modular, contradicting the Modularity Theorem.

1. Pairing-based cryptography. The Weil and Tate pairings on elliptic curves enable identity-based encryption and BLS signatures (used in Ethereum 2.0 consensus and zk-SNARK systems).

1. Random number / hash-to-curve schemes. Modern standards (e.g. RFC 9380) map data onto elliptic curves for verifiable random functions and anonymous credentials.

Historical Development

• 1750s–1780s — Euler and Lagrange study elliptic integrals $\int dx/\sqrt{\text{cubic}}$ and discover addition theorems hinting at hidden structure.
• 1827–1829 — Abel and Jacobi independently develop the theory of elliptic functions by inverting elliptic integrals, finding doubly periodic functions and the algebraic addition law.
• 1830s — Jacobi's $\theta$-functions and Abel's theorem give the first systematic group-theoretic content, though not yet phrased as groups.
• 1850s–1860s — Weierstrass introduces the $\wp$-function and the canonical form $y^2=4x^3-g_{2}x-g_3$, unifying the analytic picture and exhibiting $E(\mathbb{C})\cong \mathbb{C}/\Lambda$.
• 1901 — Henri Poincaré explicitly studies the group of rational points on a cubic and conjectures finite generation, founding the arithmetic theory.
• 1922 — Louis Mordell proves $E(\mathbb{Q})$ is finitely generated (the Mordell theorem), confirming Poincaré's conjecture.
• 1928 — André Weil generalizes to number fields and abelian varieties: the Mordell–Weil Theorem.
• 1933–1936 — Helmut Hasse proves the Riemann Hypothesis for elliptic curves over finite fields, giving the bound $|\#E({\mathbb{F}}_p)-(p+1)|\le 2\sqrt{p}$.
• 1965 — Birch and Swinnerton-Dyer state their conjecture (a Clay Millennium Problem) relating the rank of $E(\mathbb{Q})$ to the behavior of the $L$-function. 1985 — Koblitz and Miller independently propose elliptic curves for cryptography. 1995 — Wiles (with Taylor) proves the Modularity Theorem for semistable curves, settling Fermat's Last Theorem.

Subtleties & Limits

The arithmetic of the group $E(\mathbb{Q})$ remains profoundly mysterious.

• The Birch and Swinnerton-Dyer (BSD) Conjecture (a \$1,000,000ClayMillenniumProblem)predictsthatthe\ast \ast rank\ast \ast$r$of$E(\mathbb{Q}) \cong \mathbb{Z}^r \oplus T$equalstheorderofvanishingoftheHasse–Weil$L$-function$L(E,s)$at$s = 1$, with the leading coefficient given by an explicit formula involving the regulator, Tate–Shafarevich group, and local terms. It is known only in special cases (rank 0 and 1, via Gross–Zagier and Kolyvagin).
• Ranks are unbounded? It is not known whether the rank of elliptic curves over $\mathbb{Q}$ can be arbitrarily large. The current record (Elkies) is rank $\ge 28$; heuristics now suggest ranks may in fact be bounded.
• The Tate–Shafarevich group $\text{Sha}(E)$, measuring the failure of the local-global (Hasse) principle, is conjecturally finite but this is unproven in general.
• Effective Mordell–Weil: there is no known algorithm guaranteed to compute generators of $E(\mathbb{Q})$ in all cases — its existence is essentially equivalent to BSD-type results.

See Also