Elliptic Curves: A Geometry in Service of Cryptography

A curve drawn on a plane seems far removed from a private key.

Yet elliptic curves support many modern systems for:

• key agreement;
• digital signatures;
• server authentication;
• secure messaging;
• software signing;
• distributed ledgers.

Their power comes from an asymmetry.

Given a public point G and a secret integer k, computing:

$Q=kG$

is efficient.

Recovering k from G and Q is believed to be hard for carefully selected curves and groups.

The direct operation is fast.

The inverse problem resists the best known large-scale classical attacks.

Elliptic curves are generally not ellipses.

The name comes from elliptic integrals.

A short Weierstrass equation is:

$y^2=x^3+ax+b$

with non-singularity condition:

4a³ + 27b² ≠ 0

The real curve provides geometric intuition.

Cryptographic arithmetic usually occurs over finite fields.

The discriminant is:

$\Delta=-16(4a^3+27b^2)$

A zero discriminant produces a singular curve.

At a singular point, tangent behavior breaks and the desired elliptic group structure is lost.

An interactive slider should show how the curve changes as the discriminant approaches zero.

For points P and Q:

• draw the line through them;
• find the third intersection R;
• reflect R across the x-axis;
• obtain P + Q.

For P = Q, use the tangent.

The point at infinity O acts as the identity.

The inverse of (x,y) is (x,-y).

For distinct P and Q:

$\lambda=\frac{y_2-y_1}{x_2-x_1}$

$x_3=\lambda^2-x_1-x_2$

$y_3=\lambda(x_1-x_3)-y_1$

For doubling:

$\lambda=\frac{3x_1^2+a}{2y_1}$

Special cases must handle vertical lines and zero denominators.

Choose a prime p.

Coordinates belong to:

$F_p=\{0,\ldots,p-1\}$

The equation becomes:

$y^{2}$ ≡ $x^{3}$+ax+b mod p

The continuous curve becomes a finite set of points.

Division means multiplication by a modular inverse.

The number of points satisfies:

$\left|\#E(F_p)-(p+1)\right|\le2\sqrt p$

Cryptographic parameters select a point G of large prime order n.

The complete group order is often:

$\#E(F_p)=hn$

where h is the cofactor.

The distinction between field size, group order and subgroup order is essential.

A public key has the form:

$Q=dG$

where d is private.

Double-and-add computes dG in logarithmic time using the bits of d.

Practical methods include:

• windowing;
• wNAF;
• comb methods;
• fixed-base tables;
• Montgomery ladders.

Performance techniques must also be evaluated for side-channel behavior.

Affine addition requires modular inversion.

Projective or Jacobian coordinates replace most inversions with multiplications and squarings.

They improve performance but do not automatically guarantee constant-time execution.

Given G and $Q=kG$, recover k.

Generic attacks such as Pollard rho require about:

$O(\sqrt n)$

group operations.

For a roughly 256-bit prime-order subgroup, this motivates an estimated 128-bit classical security level.

This is a security assumption, not a proof that inversion is impossible.

Alice publishes:

$A=aG$

Bob publishes:

$B=bG$

Both compute:

abG

ECDH establishes shared material.

It does not by itself authenticate the peer or directly produce encryption keys.

A KDF must bind the shared point to protocol context, identities and transcript.

To sign a message hash e:

• choose a secret nonce k;
• compute R = kG;
• set r to the x-coordinate modulo n;
• compute:

$s=k^{-1}(e+rd)\bmod n$

The signature is (r,s).

ECDSA signs.

It does not encrypt.

Reusing k for two messages reveals k and then the private key. ^{[1] [2]}

The article should demonstrate this only with a tiny deterministic toy group.

Never accept real keys or arbitrary production signatures.

RFC 6979 specifies deterministic nonce generation for DSA and ECDSA.

FIPS 186-5 approves deterministic ECDSA.

EdDSA uses Edwards curves, deterministic nonce derivation and standardized encodings. ^[3]

Ed25519 and Ed448 are defined by RFC 8032.

They offer strong performance and implementation advantages in many systems.

They do not eliminate the need for safe libraries, side-channel resistance and correct domain separation.

X25519 is a scalar multiplication function used for key agreement. ^[4]

It operates with a Montgomery form related to Curve25519 and uses a ladder on the u-coordinate.

X25519 is not Ed25519.

The former is key agreement.

The latter is a signature system.

Short Weierstrass

Used by P-256, P-384 and secp256k1.

Montgomery

Efficient x-coordinate or u-coordinate ladders.

Used by X25519 and X448.

Edwards

Uniform and efficient addition formulas.

Used by Ed25519 and Ed448.

Birational equivalence may connect models, but protocol encodings are not interchangeable.

A Weierstrass point may be encoded by x plus one bit selecting y.

SEC 1 compressed encodings use a prefix and the x-coordinate.

Decoding must validate:

• canonical form;
• field range;
• curve equation;
• sign branch;
• subgroup requirements.

Depending on the protocol, implementations must check:

• valid encoding;
• point on curve;
• point not infinity;
• subgroup membership;
• correct order;
• cofactor handling.

Failure may enable invalid-curve or small-subgroup attacks.

Ristretto255 and decaf448 expose prime-order groups over cofactored elliptic-curve constructions. ^[5]

They provide canonical encodings and remove several protocol hazards.

RFC 9496 standardizes these abstractions.

Some protocols need a deterministic map from bytes to a curve point. ^[6]

RFC 9380 standardizes complete suites that include:

• hash_to_field;
• map_to_curve;
• cofactor clearing;
• domain separation;
• named ciphersuites.

Ad hoc try-and-increment methods can introduce bias or timing problems.

Bitcoin historically uses ECDSA over secp256k1.

Taproot introduces Schnorr signatures specified by BIP 340.

ECC authorizes spending through signatures.

Bitcoin transactions are not generally encrypted by elliptic curves.

ECC in TLS may support:

• ephemeral ECDH key agreement;
• ECDSA certificate signatures;
• X25519 groups.

TLS 1.3 combines key agreement with HKDF, transcript binding and authentication.

A curve is only one component of the security proof.

RFC 8709 specifies Ed25519 and Ed448 public-key algorithms for SSH. ^[7]

Operational security still requires protected private keys, revocation and lifecycle management.

Signal’s X3DH uses elliptic-curve Diffie-Hellman operations to establish asynchronous shared secrets.

The Double Ratchet then evolves keys.

The protocol combines ECC with signatures, hashes, KDFs and ratchets.

Bilinear pairings satisfy:

$e(aP,bQ)=e(P,Q)^{ab}$

They enable:

• BLS signatures;
• signature aggregation;
• identity-based systems;
• zero-knowledge systems.

Pairing-friendly curves use specialized parameters.

Ordinary ECDH curves are not automatically suitable.

A mathematically correct scalar multiplication can leak through:

• timing;
• cache;
• power;
• electromagnetic radiation;
• branches;
• memory access;
• faults.

Countermeasures include:

• constant-time execution;
• regular ladders;
• secret-independent memory access;
• blinding;
• audited libraries.

Faults can corrupt intermediate points or nonces.

Invalid-curve attacks exploit insufficient point validation.

The implementation must enforce the assumptions made by the protocol and group model.

At comparable classical security levels, ECC generally uses smaller keys and signatures.

A common approximate comparison is:

• 256-bit elliptic-curve subgroup;
• 3072-bit RSA modulus;

both targeting roughly 128-bit classical security.

Performance still depends on the operation, platform and library.

Both are vulnerable to Shor’s algorithm on a sufficiently powerful fault-tolerant quantum computer.

Shor’s algorithm solves elliptic-curve discrete logarithms in polynomial time on a cryptographically relevant quantum computer.

Current public quantum machines do not break deployed ECC at scale.

Long-term systems must nevertheless plan migration and protect against harvest-now-decrypt-later strategies.

NIST finalized in 2024: ^[8]

• FIPS 203, ML-KEM;
• FIPS 204, ML-DSA;
• FIPS 205, SLH-DSA.

These are designed for resistance against known quantum attacks.

They are not ordinary elliptic-curve systems.

A hybrid key establishment may combine X25519 and ML-KEM, then derive keys from both shared secrets.

Correct composition must address:

• downgrade resistance;
• transcript binding;
• algorithm negotiation;
• message size;
• inventories;
• certificate and device lifetimes.

Cryptographic migration is an architecture program.

The page should include at least:

• real curve and discriminant;
• chord-and-tangent addition;
• finite-field point explorer;
• scalar multiplication visualizer;
• toy ECDH;
• toy ECDSA and nonce-reuse warning;
• curve-model comparison;
• post-quantum migration timeline.

An elliptic curve is not a spiral.

The sequence G, 2G, 3G, ... is a discrete orbit in a finite group.

A chosen visualization may look rotational, but that appearance is not intrinsic.

The genuine convergence is between fields:

geometry, number theory, algorithms, protocols and systems engineering.

Elliptic curves turn an equation into a group, a group into efficient arithmetic and arithmetic into public-key security.

Real protection requires more than the curve:

• correct parameters;
• subgroup handling;
• canonical encoding;
• point validation;
• nonce discipline;
• constant-time code;
• KDFs;
• authenticated protocols;
• post-quantum migration planning.

ECC is one of the clearest examples of abstract mathematics becoming global infrastructure.