The curve is the real solution set of the Weierstrass equation y² = x³ + ax + b, drawn flat in the scene but orbitable in 3D so you can see it from any angle. Sliders a and b reshape it live: as long as the discriminant Δ = −16(4a³ + 27b²) stays nonzero, the curve is smooth and has a genuine group law — otherwise it develops a self-crossing node or a sharp cusp and the construction below breaks down.
Δ = -16(4a³ + 27b²)
j = -1728(4a)³ / Δ
P+Q: draw the line through P,Q → third intersection R with the curve
→ reflect R across the x-axis → that reflection is P+Q
- Random P / Random Q — samples a point on whichever branch of the curve currently exists.
- Compute P+Q — draws the secant line through P and Q, its third crossing point (amber), and the reflected sum (magenta) — the chord-and-tangent group law.
- Double P — same construction but with the line tangent to the curve at P, i.e. P+P.
- Trace nP — repeatedly adds P to the running total and stacks each multiple (P, 2P, 3P, …) at an increasing height, tracing a 3D "tower". If the tower ever reaches the point at infinity, that height is P's order — a torsion point; over the real numbers most points never close up, which is exactly the difference from the finite fields used in ECC cryptography.
This is the same group law that makes elliptic-curve cryptography possible (see the ECC/ECDH simulation for that side) — here the field is the real numbers, so the emphasis is the geometry of the curve itself rather than a hard discrete-log problem.