0Pricing
Cryptology Academy · Lesson

Elliptic Curve Group Law

Visualize point addition and doubling on Weierstrass curves.

Elliptic Curve Group Law is a free Cryptology Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

Elliptic curves provide a mathematical group where the 'discrete log' problem is harder than in finite fields. This allows smaller keys with equivalent security.

Short Weierstrass Form

A Weierstrass elliptic curve: y² = x³ + ax + b (mod p) Condition: 4a³ + 27b² ≠ 0 (non-singular) The set of all (x,y) satisfying this equation + a 'point at infinity' forms a group.

P-256 Curve Parameters

NIST P-256 (secp256r1): p = 2^256 - 2^224 + 2^192 + 2^96 - 1 (prime) a = p-3 b = 41058363725152142129326129780047268409114441015993725554835256314039467401291 Base point G with order n ≈ 2^256

Point Addition: Two Different Points

P + Q (P ≠ Q): 1. slope λ = (Qy - Py) / (Qx - Px) mod p 2. x3 = λ² - Px - Qx mod p 3. y3 = λ(Px - x3) - Py mod p 4. Result: R = (x3, y3)

Point Doubling: P + P

P + P = 2P: 1. λ = (3Px² + a) / (2Py) mod p 2. x3 = λ² - 2Px mod p 3. y3 = λ(Px - x3) - Py mod p 4. Division = multiplication by modular inverse

Point at Infinity (Identity)

The 'point at infinity' O is the identity element: P + O = P for all P. Adding P to its inverse -P = (x, -y) gives O. Every point has an inverse on the curve.

Geometric Interpretation

Point addition: draw a line through P and Q; it intersects the curve at a third point; reflect over x-axis = P+Q. Point doubling: draw the tangent at P; find the intersection; reflect.

Group Order

The group order |E| is the number of points on the curve including O. Hasse's theorem: |p+1-2√p| ≤ |E| ≤ p+1+2√p. For P-256, n ≈ 2^256 — a massive group with subgroup structure.

Cofactor

Cofactor h = |E| / n. For P-256: h=1 (the base point generates the full group). For Curve25519: h=8. Small cofactor means small subgroup attacks are possible — handled by cofactor multiplication in X25519.

Why EC Groups Are Special

In Z*p groups, index calculus algorithms break DLP sub-exponentially. For EC groups over prime fields, no sub-exponential algorithm is known for generic curves. This is why 256-bit EC ≈ 3072-bit RSA.

Point Compression

An EC point (x,y) can be stored as just x + 1 parity bit. Recovering y: y² = x³+ax+b mod p → y = √(x³+ax+b) mod p. Two solutions — parity bit selects the correct one. Halves transmission size.

Quick Check

What is the identity element of the elliptic curve group?

Recap

The EC group law is clear. Next we study scalar multiplication and the ECDLP — the hard problem that secures ECDH and ECDSA.

Frequently asked questions

Is the “Elliptic Curve Group Law” lesson free?

Yes — the full text of “Elliptic Curve Group Law” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Elliptic Curve Group Law”?

Visualize point addition and doubling on Weierstrass curves. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Elliptic Curve Group Law” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Elliptic Curve Group Law
  2. Scalar Multiplication & the ECDLP
  3. Standard Curves: P-256, Curve25519, secp256k1
  4. ECC vs RSA: Security & Performance Trade-offs
← Back to Cryptology Academy