Elliptic Curves — Introduction and the Group Law

⚡ Key Takeaways

An elliptic curve over a field $K$ is a smooth projective cubic curve with a marked rational point, typically written $y^2 = x^3 + ax + b$ . Its defining feature is a natural abelian group law on its points, defined geometrically by the "chord-and-tangent" process: three collinear points sum to the identity. This structure underlies modern cryptography, number theory (including the proof of Fermat's Last Theorem), and the Birch–Swinnerton-Dyer conjecture. Developed from the study of elliptic integrals in the 19th century by Abel, Jacobi, Weierstrass, and Poincaré.

💡 The Core Insight

A cubic curve is "just right" for a group law. A line meets a cubic in exactly three points (counted with multiplicity, over an algebraically closed field, in projective space). Given two points $P$ and $Q$ , the line through them hits a unique third point $R$ . Declaring $P + Q + R$ to equal the identity $\mathcal{O}$ produces a group — and the geometry forces both commutativity (the line through $P,Q$ is the line through $Q,P$ ) and, with real effort, associativity. The marked point $\mathcal{O}$ serves as both the group identity and the geometric "vanishing point" of all vertical lines.

DefinitionWeierstrass Form of an Elliptic Curve

Let $K$ be a field with $\operatorname{char} K \neq 2, 3$ . An elliptic curve $E$ over $K$ is the set of points $(x,y) \in \bar{K}^2$ satisfying the short Weierstrass equation

1

\quad E:\; y^2 = x^3 + ax + b, \qquad a,b \in K,

together with the point at infinity $\mathcal{O}$ , subject to the nonsingularity (smoothness) condition that the discriminant is nonzero:

2

\quad \Delta = -16\,(4a^3 + 27b^2) \neq 0.

The set of points with coordinates in a field extension $L \supseteq K$ is denoted $E(L)$ . Here $\bar{K}$ is the algebraic closure of $K$ , $a,b$ are the curve parameters, and $\mathcal{O}$ is a single distinguished point not lying in the affine plane.

DefinitionProjective Setting and the Point at Infinity

The honest home of an elliptic curve is the projective plane $\mathbb{P}^2$ . Homogenizing [1] with $x = X/Z$ , $y = Y/Z$ gives

3

\quad Y^2 Z = X^3 + a\,X Z^2 + b\,Z^3.

Setting $Z = 0$ forces $X^3 = 0$ , so $X = 0$ , leaving the single projective point $\mathcal{O} = [0 : 1 : 0]$ . This is the point "at infinity in the vertical direction": every vertical line $x = c$ passes through it.

TheoremThe Group Law

Let $E$ be an elliptic curve over $K$ . The chord-and-tangent construction makes $E(K)$ into an abelian group with identity element $\mathcal{O}$ . Explicitly, for $P = (x_1, y_1)$ and $Q = (x_2, y_2)$ with $P, Q \neq \mathcal{O}$ and $P + Q \neq \mathcal{O}$ , the sum $P + Q = (x_3, y_3)$ is given by

4

\quad x_3 = \lambda^2 - x_1 - x_2, \qquad y_3 = \lambda(x_1 - x_3) - y_1,

where the slope $\lambda$ is

5

\quad \lambda = \begin{cases} \dfrac{y_2 - y_1}{x_2 - x_1}, & P \neq Q, \\[2ex] \dfrac{3x_1^2 + a}{2y_1}, & P = Q. \end{cases}

The inverse of $P=(x_1,y_1)$ is $-P = (x_1, -y_1)$ , and $\mathcal{O}$ is the identity: $P + \mathcal{O} = P$ .

ProofDeriving the Addition Formula

We derive [4]–[5] for distinct affine points $P=(x_1,y_1)$ , $Q=(x_2,y_2)$ with $x_1 \neq x_2$ .

Step 1 — The line through $P$ and $Q$ . Its slope is $\lambda = (y_2 - y_1)/(x_2 - x_1)$ and equation $y = \lambda(x - x_1) + y_1$ .

Step 2 — Intersect with the curve. Substitute into $y^2 = x^3 + ax + b$ :

\big(\lambda(x-x_1)+y_1\big)^2 = x^3 + ax + b.

Expanding and collecting terms gives a monic cubic

x^3 - \lambda^2 x^2 + (\cdots)x + (\cdots) = 0.

Step 3 — Use Vieta's formulas. The three roots are exactly the $x$ -coordinates of the three intersection points: $x_1$ , $x_2$ , and the new one $x_3'$ . The sum of the roots equals minus the coefficient of $x^2$ :

x_1 + x_2 + x_3' = \lambda^2 \implies x_3' = \lambda^2 - x_1 - x_2.

Step 4 — The third intersection point. Its coordinates are $R = (x_3', \, \lambda(x_3' - x_1) + y_1)$ . By definition $P + Q + R = \mathcal{O}$ , so $P + Q = -R$ .

Step 5 — Reflect. Since $-R$ negates the $y$ -coordinate, $P+Q = (x_3, y_3)$ with $x_3 = x_3'$ and

y_3 = -\big(\lambda(x_3 - x_1) + y_1\big) = \lambda(x_1 - x_3) - y_1,

matching [4].

Step 6 — Doubling. When $P = Q$ , the "chord" becomes the tangent. Differentiating $y^2 = x^3 + ax + b$ implicitly: $2y\,y' = 3x^2 + a$ , so $\lambda = y' = (3x_1^2 + a)/(2y_1)$ , giving the second case of [5]. The rest of the derivation is identical with $x_1 = x_2$ .

Closure, identity, inverses follow directly. Commutativity is immediate (the chord is symmetric in $P,Q$ ). Associativity is the deep part — see the remark below. $\blacksquare$

∎

🧠 Intuition

Why should associativity hold? It is not obvious from the algebra (formula [4] is a mess to compose), but it is forced by geometry. The deep reason is a special case of the Cayley–Bacharach theorem: if two cubic curves meet in 9 points, any cubic through 8 of them passes through the 9th. Both $(P+Q)+R$ and $P+(Q+R)$ are constructed using configurations of lines (degenerate cubics) intersecting $E$ ; Cayley–Bacharach guarantees the constructions land on the same point. Alternatively, associativity is a free consequence of the deep fact that $E$ is isomorphic, as a group, to a quotient of the complex plane $\mathbb{C}/\Lambda$ (a torus) via the Weierstrass $\wp$ -function — and addition on a torus is obviously associative.

Figure

The geometric group law: P + Q via chord, and 2P via tangent

```svg

```

mathematician · Karl Weierstrass | 1815–1897

Weierstrass systematized the theory of elliptic functions through his $\wp$ -function, satisfying the differential equation $(\wp')^2 = 4\wp^3 - g_2 \wp - g_3$ — the analytic origin of the cubic equation [1]. His parametrization $z \mapsto (\wp(z), \wp'(z))$ realizes any complex elliptic curve as a quotient torus $\mathbb{C}/\Lambda$ , making the group law transparent: it is just addition of complex numbers modulo the lattice $\Lambda$ . The "Weierstrass form" of an elliptic curve bears his name. His insistence on rigor (the $\varepsilon$ – $\delta$ era) shaped the analytic foundations on which this theory rests.

🧠 Intuition

Think of the three pictures that should live in your head simultaneously: 1. The real picture. Over $\mathbb{R}$ , the curve looks like one or two ovals/branches in the plane. Addition is "draw a line, find the third hit, flip vertically." The point at infinity $\mathcal{O}$ is where vertical lines "meet." 2. The complex picture. Over $\mathbb{C}$ , the curve is topologically a torus (doughnut). The group law is literally addition on the torus surface — a circle group $\times$ circle group. This is why associativity and commutativity are automatic. 3. The arithmetic picture. Over $\mathbb{Q}$ or a finite field $\mathbb{F}_p$ , you only have finitely many or countably many points, but the same algebraic formulas [4]–[5] still define a group. Over $\mathbb{F}_p$ this group is finite and is the engine of elliptic curve cryptography. The slogan: one cubic equation, three faces — geometric, analytic, arithmetic — all carrying the same group.

ExampleAdding two rational points

Given. The curve $E: y^2 = x^3 - 2x$ over $\mathbb{Q}$ (here $a = -2$ , $b=0$ ; check $\Delta = -16(4(-8)+0) = 512 \neq 0$ ). Take $P = (-1, 1)$ and $Q = (2, 2)$ . (Verify: $(-1)^3 - 2(-1) = -1+2 = 1 = 1^2$ ✓; $2^3 - 2\cdot 2 = 8 - 4 = 4 = 2^2$ ✓.)

Find $P + Q$ .

Step 1 — Slope. $P \neq Q$ , so

\lambda = \frac{y_2 - y_1}{x_2 - x_1} = \frac{2 - 1}{2 - (-1)} = \frac{1}{3}.

Step 2 — $x_3$ .

x_3 = \lambda^2 - x_1 - x_2 = \frac{1}{9} - (-1) - 2 = \frac{1}{9} - 1 = -\frac{8}{9}.

Step 3 — $y_3$ .

y_3 = \lambda(x_1 - x_3) - y_1 = \frac{1}{3}\left(-1 - \left(-\frac{8}{9}\right)\right) - 1 = \frac{1}{3}\cdot\left(-\frac{1}{9}\right) - 1 = -\frac{1}{27} - 1 = -\frac{28}{27}.

Answer.

\boxed{P + Q = \left(-\tfrac{8}{9},\ -\tfrac{28}{27}\right)} \quad\text{(a rational point on } E\text{; coordinates are pure numbers, dimensionless).}

Check: $x_3^3 - 2x_3 = -\tfrac{512}{729} + \tfrac{16}{9} = -\tfrac{512}{729} + \tfrac{1296}{729} = \tfrac{784}{729} = \left(\tfrac{28}{27}\right)^2 = y_3^2$ ✓.

ExampleDoubling a point over a finite field

Given. The curve $E: y^2 = x^3 + 2x + 2$ over $\mathbb{F}_{17}$ (so $a=2$ , $b=2$ ; arithmetic mod 17). Take $P = (5, 1)$ . (Verify: $5^3 + 2\cdot 5 + 2 = 125 + 10 + 2 = 137 \equiv 137 - 8\cdot17 = 137 - 136 = 1 \pmod{17}$ , and $1^2 = 1$ ✓.)

Find $2P = P + P$ .

Step 1 — Tangent slope. $\lambda = \dfrac{3x_1^2 + a}{2y_1} = \dfrac{3\cdot 25 + 2}{2\cdot 1} = \dfrac{77}{2} \pmod{17}$ . Reduce: $77 \equiv 77 - 4\cdot17 = 77 - 68 = 9$ . Need $2^{-1} \pmod{17}$ : since $2\cdot 9 = 18 \equiv 1$ , we have $2^{-1} = 9$ . So $\lambda = 9 \cdot 9 = 81 \equiv 81 - 4\cdot17 = 81 - 68 = 13$ .

Step 2 — $x_3$ .

x_3 = \lambda^2 - 2x_1 = 13^2 - 2\cdot 5 = 169 - 10 = 159 \equiv 159 - 9\cdot17 = 159 - 153 = 6 \pmod{17}.

Step 3 — $y_3$ .

y_3 = \lambda(x_1 - x_3) - y_1 = 13(5 - 6) - 1 = 13\cdot(-1) - 1 = -14 \equiv -14 + 17 = 3 \pmod{17}.

Answer.

\boxed{2P = (6,\ 3) \text{ on } E(\mathbb{F}_{17})}.

Check: $6^3 + 2\cdot6 + 2 = 216 + 12 + 2 = 230 \equiv 230 - 13\cdot17 = 230 - 221 = 9 \pmod{17}$ , and $3^2 = 9$ ✓.

⚠️ Common mistake

"Elliptic curves are ellipses." They are not. The name is historical baggage: elliptic curves arose from elliptic integrals, which compute the arc length of an ellipse. The curve itself is a cubic, topologically a torus over $\mathbb{C}$ — not an ellipse, which is a conic (genus 0).

⚠️ Common mistake

"The addition is coordinate-wise." $P + Q \neq (x_1 + x_2, \, y_1 + y_2)$ . The group operation is the geometric chord-and-tangent rule of formulas [4]–[5], which is highly nonlinear. Coordinate-wise addition does not even map the curve to itself.

CounterexampleA singular "curve" is not an elliptic curve

Consider $y^2 = x^3$ (a cuspidal cubic) or $y^2 = x^3 + x^2$ (a nodal cubic). Both have $\Delta = 0$ , violating [2]. At the singular point — the cusp $(0,0)$ for the first, the node $(0,0)$ for the second — the tangent is not well-defined, so the doubling formula [5] breaks (you divide by $2y_1 = 0$ in a way that has no geometric fix). The smooth points still form a group, but it is isomorphic to the additive group $\mathbb{G}_a$ (cusp) or the multiplicative group $\mathbb{G}_m$ (node) — not to a genuine elliptic curve. Smoothness is essential.

⚠️ Common mistake

" $\mathcal{O}$ is the origin $(0,0)$ ." No — $\mathcal{O}$ is the point at infinity $[0:1:0]$ , not the affine origin. The origin $(0,0)$ may or may not even lie on the curve (it does iff $b=0$ ). Confusing them corrupts every group computation.

connection

The group law sits at a crossroads of mathematics. Over $\mathbb{C}$ , the Weierstrass ℘-function gives an isomorphism $E(\mathbb{C}) \cong \mathbb{C}/\Lambda$ with a Lattice in the Complex Plane, so the theory connects to Complex Analysis and Modular Forms. Over $\mathbb{Q}$ , the Mordell–Weil Theorem states $E(\mathbb{Q})$ is a finitely generated abelian group, $E(\mathbb{Q}) \cong \mathbb{Z}^r \oplus T$ , linking to the structure theory in Abelian Groups. Over finite fields $\mathbb{F}_p$ , Hasse's Theorem bounds the point count, feeding Elliptic Curve Cryptography. The discriminant and $j$ -invariant connect to Algebraic Geometry and the classification of curves up to isomorphism. The Cayley–Bacharach mechanism behind associativity is part of Projective Geometry.

🔬 Where this appears

⏳ History

- 1750s–1780s — Euler and Lagrange study elliptic integrals

\int dx/\sqrt{\text{cubic}}

and discover addition theorems hinting at hidden structure.

- 1827–1829 — Abel and Jacobi independently develop the theory of elliptic functions by inverting elliptic integrals, finding doubly periodic functions and the algebraic addition law.

- 1830s — Jacobi's $\theta$ -functions and Abel's theorem give the first systematic group-theoretic content, though not yet phrased as groups.

- 1850s–1860s — Weierstrass introduces the

\wp

-function and the canonical form

y^2 = 4x^3 - g_2 x - g_3

, unifying the analytic picture and exhibiting

E(\mathbb{C}) \cong \mathbb{C}/\Lambda

.

- 1901 — Henri Poincaré explicitly studies the group of rational points on a cubic and conjectures finite generation, founding the arithmetic theory.

- 1922 — Louis Mordell proves

E(\mathbb{Q})

is finitely generated (the Mordell theorem), confirming Poincaré's conjecture.

- 1928 — André Weil generalizes to number fields and abelian varieties: the Mordell–Weil Theorem.

- 1933–1936 — Helmut Hasse proves the Riemann Hypothesis for elliptic curves over finite fields, giving the bound

|\#E(\mathbb{F}_p) - (p+1)| \le 2\sqrt{p}

.

- 1965 — Birch and Swinnerton-Dyer state their conjecture (a Clay Millennium Problem) relating the rank of

E(\mathbb{Q})

to the behavior of the

L

-function. 1985 — Koblitz and Miller independently propose elliptic curves for cryptography. 1995 — Wiles (with Taylor) proves the Modularity Theorem for semistable curves, settling Fermat's Last Theorem.

open-problem

The arithmetic of the group $E(\mathbb{Q})$ remains profoundly mysterious.

The Birch and Swinnerton-Dyer (BSD) Conjecture (a $1,000,000 Clay Millennium Problem) predicts that the rank $r$ of $E(\mathbb{Q}) \cong \mathbb{Z}^r \oplus T$ equals the order of vanishing of the Hasse–Weil $L$ -function $L(E,s)$ at $s = 1$ , with the leading coefficient given by an explicit formula involving the regulator, Tate–Shafarevich group, and local terms. It is known only in special cases (rank 0 and 1, via Gross–Zagier and Kolyvagin).
Ranks are unbounded? It is not known whether the rank of elliptic curves over $\mathbb{Q}$ can be arbitrarily large. The current record (Elkies) is rank $\geq 28$ ; heuristics now suggest ranks may in fact be bounded.
The Tate–Shafarevich group $\Sha(E)$ , measuring the failure of the local-global (Hasse) principle, is conjecturally finite but this is unproven in general.
Effective Mordell–Weil: there is no known algorithm guaranteed to compute generators of $E(\mathbb{Q})$ in all cases — its existence is essentially equivalent to BSD-type results.

Elliptic Curves — Introduction and the Group Law

Formal Statement

Why It Holds / Derivation

Building Intuition

Worked Examples

Common Misconceptions

Connections

Real-World Applications

Historical Development

Subtleties & Limits

See Also