Visualise point addition and scalar multiplication on an elliptic curve y² = x³ + ax + b. See how multiplying a generator point by a large scalar creates a keypair — and why reversing it is computationally infeasible.
Point addition on an elliptic curve: a line through two points P and Q intersects the curve at a third point, which is reflected to give P+Q. Scalar multiplication k·P repeats this operation k times. The discrete log problem on elliptic curves is believed to require exponential time.
Click two points on the curve to add them. Use scalar mode to multiply the generator point by increasing k. Watch the resulting point jump unpredictably around the curve — illustrating the one-way trapdoor.
Elliptic curve cryptography achieves the same security as RSA-3072 with only 256-bit keys — a 12× reduction in key size. Bitcoin's secp256k1 curve processes millions of transactions daily using this exact mathematics.
This simulation visualises the group law on an elliptic curve of the form y² = x³ + ax + b over the real numbers. When you add two points P and Q, a straight chord is drawn through them; it meets the curve at a third point, which is then reflected across the x-axis to give P+Q. Doubling a point (P+P) uses the tangent line instead. Scalar multiplication k·P chains this operation k times, and you watch the resulting point hop unpredictably around the curve.
That unpredictability is the heart of elliptic curve cryptography. While computing k·P from k and P is fast, recovering k from P and k·P — the elliptic curve discrete logarithm problem — is believed to require exponential time, making it a one-way trapdoor. ECC underlies TLS/HTTPS, SSH, Signal, and the secp256k1 curve that secures Bitcoin and Ethereum, delivering RSA-grade security with far smaller keys.
What is point addition on an elliptic curve?
Given two points P and Q on the curve, you draw the line through them, find the third point where that line meets the curve, and reflect it over the x-axis. The reflected point is defined as P+Q. This geometric rule turns the curve's points into a mathematical group.
What is scalar multiplication k·P and why does it matter?
Scalar multiplication adds a point P to itself k times. It is the core operation of ECC: a private key is the scalar k and the public key is the point k·P. It is easy to compute forward but extremely hard to reverse.
Why is elliptic curve cryptography considered secure?
Its security rests on the elliptic curve discrete logarithm problem: recovering the scalar k from the points P and k·P. No efficient classical algorithm is known, so for well-chosen curves the best attacks take time exponential in the key size.
Doubling is adding a point to itself, P+P. Since you can't draw a chord through a single point, you use the tangent line to the curve at P, find where it intersects the curve again, and reflect that point over the x-axis.
It is the identity element of the curve's group, acting like zero in ordinary addition. When you add a point P to its mirror image −P, the chord is vertical and meets the curve "at infinity," giving the identity. The simulation reports this as "Point at ∞".
The group law only works if the curve has no cusps or self-intersections. This requires the discriminant −16(4a³ + 27b²) to be non-zero, guaranteeing smooth, well-defined tangents and chords everywhere.
Both are public-key systems, but ECC achieves equivalent security with much smaller keys. A 256-bit elliptic curve key offers roughly the same strength as a 3072-bit RSA key, giving faster operations and lower bandwidth.
Bitcoin and Ethereum use secp256k1, defined by y² = x³ + 7 over a 256-bit prime field. Every wallet address derives from a public key that is a scalar multiple of that curve's fixed generator point.
Real numbers let the curve be drawn as a smooth, intuitive picture so you can see the chord-and-tangent geometry. Production cryptography uses the same algebra over a large finite field, where the points form a discrete set that can't be plotted as a continuous curve.
In principle yes — Shor's algorithm could solve the elliptic curve discrete logarithm problem on a sufficiently large fault-tolerant quantum computer. That risk is driving the development of post-quantum cryptographic schemes, though no such machine exists today.