Elliptic Curve Cryptography: Point Ops & ECDH

Curve y² = x³ + ax + b

a -1.0

b 1.0

Points

P.x -1.00

Q.x 1.20

Result R

–

Slope λ

–

Operation

–

How point addition works

Two points P and Q on the curve are joined by a straight line (a secant, or a tangent when doubling). That line crosses the curve at exactly one more point, since a line meets a cubic in three points total. Reflecting that third point across the x-axis gives P + Q — the reflection is what makes this operation associative and turns the curve's points into a group.

λ = (y2-y1)/(x2-x1)      [addition, P≠Q]
λ = (3x1²+a)/(2y1)       [doubling, P=Q]
x3 = λ² - x1 - x2
y3 = λ(x1-x3) - y1

If P and Q share an x but opposite y (a vertical secant), the "third point" is the point at infinity O — the group's identity element.
Doubling a point whose y = 0 also yields O (the tangent there is vertical).
This exact group law, run billions of times with huge finite-field coordinates instead of small real numbers, is the entire arithmetic engine behind ECDSA and ECDH.

Finite field 𝔽p, curve y²≡x³+2x+2

Generator G

–

Private keys

Alice d_A 3

Bob d_B 5

Alice public A

–

Bob public B

–

Shared secret x (d_A·B = d_B·A)

–

Step 0 / 0

How ECDH works

Both parties agree on a curve and a public base point G on it. Alice picks a secret integer d_A and publishes A = d_A·G (G added to itself d_A times, using the same group law as the left tab — but now with coordinates reduced modulo a prime p). Bob does the same with d_B and B. Each then multiplies the other's public point by their own private scalar: d_A·B = d_Ad_B·G = d_B·A. Both land on the identical point without either ever exposing d_A or d_B — an eavesdropper who sees only G, A and B cannot feasibly recover the scalar (the elliptic-curve discrete-log problem).

double-and-add: k·G, processing bits of k right-to-left
 for each bit:  if set → accumulate; always double the addend
 real ECC uses p with hundreds of bits — here p is tiny so
 the intermediate points can be plotted and read off directly

The grid shows every (x, y) pair in 𝔽p × 𝔽p; the highlighted dots satisfy y² ≡ x³ + 2x + 2 (mod p) — the actual curve, tiny enough here to draw in full.
The "Animate" buttons replay the double-and-add steps that compute each public key, with a trail marking every intermediate point.
Real ECDH (e.g. Curve25519) uses a ~256-bit prime — the same algorithm shown here, just with a field far too large to enumerate or brute-force.

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.

Elliptic Curve Cryptography: Point Operations & ECDH