The idea: points you can add, but not divide
An elliptic curve is the set of points (x, y) with y² = x³ + ax + b. There is a way to add two points of the curve and get a third one. Adding a point to itself k times is fast. Going back, from the result to k, is very hard. That one-way step is the whole basis of elliptic curve cryptography (ECC): ECDHE key exchange in TLS 1.3, ECDSA and Ed25519 signatures, passkeys and Bitcoin keys all use it.
The canvas has four regions. On the left are the 18 points of a small curve, drawn on a 17 × 17 grid. Top right, the steps panel writes out the arithmetic. Below it Alice and Bob run a key exchange. The bottom row lists the multiples k·G that are known so far.
A toy curve over the field of 17 numbers
Cryptography does not use real numbers. It works mod a prime p, so x and y are whole numbers 0 … p − 1 and every result is reduced mod p. This page uses y² = x³ + 2x + 2 (mod 17). Exactly 18 pairs (x, y) satisfy it. Add one extra point O, the point at infinity, and you get a group of n = 19 elements. The points no longer lie on a smooth curve. They are scattered, but the same addition formulas still work.
Each point has a mirror image: −(x, y) = (x, 17 − y). The base point is G = (5, 1). Because 19 is prime, the multiples G, 2G, … 18G visit every point once, and 19G = O.
Adding and doubling
For P = (x₁, y₁) and Q = (x₂, y₂), first find the slope λ, then the new point:
| Case | Slope λ | Result |
|---|---|---|
| P + Q, P ≠ ±Q (chord) | (y₂ − y₁) / (x₂ − x₁) | x₃ = λ² − x₁ − x₂y₃ = λ(x₁ − x₃) − y₁ |
| P + P = 2P (tangent) | (3x₁² + a) / (2y₁) | |
| P + (−P) | vertical line | O |
Division mod 17 means multiplying by an inverse: 1/2 = 9 because 2 · 9 = 18 ≡ 1. Example: (5,1) + (6,3) has λ = 2/1 = 2, x₃ = 4 − 5 − 6 = −7 ≡ 10, y₃ = 2·(5 − 10) − 1 = −11 ≡ 6, so the sum is (10, 6) (Demo: add two points). On the grid, the line y = 2x + 8 mod 17 wraps around the edges, but it still meets the curve at exactly one more point, −R = (10, 11). Doubling (5,1) gives λ = 77/2 ≡ 9 · 9 ≡ 13 and 2G = (6, 3) (Demo: double a point). (5,1) + (5,16) is a vertical line, so the sum is O (Demo: P + (−P) = O).
Scalar multiplication: double-and-add
k·G means G + G + … + G, k times. Nobody does k − 1 additions. Read k in binary from the left. Start at G. For each further bit, double, and if the bit is 1, also add G. For 13 = 1101₂ that is G → 2G → 3G → 6G → 12G → 13G = (16, 4): 3 doublings and 2 additions instead of 12 additions (Demo: 13·G by double-and-add). It is the same idea as square-and-multiply for powers, on Modular Exponentiation.
ECDH: the key exchange
Elliptic curve Diffie-Hellman is Diffie-Hellman with point multiplication in place of powers. Alice picks a private a = 5 and sends A = 5·G = (9, 16). Bob picks b = 7 and sends B = 7·G = (0, 6). Alice computes 5·B, Bob computes 7·A. Both get S = 35·G = 16·G = (10, 11), because 35 mod 19 = 16 (Demo: ECDH key agreement). In TLS the x-coordinate of S goes into HKDF to make the session keys.
| Value | Alice | Bob | Eve |
|---|---|---|---|
| curve, G = (5,1), n = 19 | ✓ | ✓ | ✓ |
| a = 5 | ✓ | ✗ | ✗ |
| b = 7 | ✗ | ✓ | ✗ |
| A = (9,16), B = (0,6) | ✓ | ✓ | ✓ |
| S = (10,11) | ✓ | ✓ | ✗ unless she finds a or b |
Plain ECDH, like plain DH, does not say who is on the other end. TLS signs the exchange with the server's certificate key (see How a Digital Signature Works and How an HTTPS Connection Is Established).
Why it is hard to undo
To read S, Eve needs a: the number with a·G = A. This is the elliptic curve discrete logarithm problem (ECDLP). On the toy curve she just adds G again and again and hits A = (9, 16) at the 5th try (Demo: Eve walks G, 2G, 3G …). Real curves have about 2²⁵⁶ points. The best known attack, Pollard's rho, needs about √n ≈ 2¹²⁸ additions, far beyond any computer. Unlike for RSA and plain DH, no faster general method (like the number field sieve) is known. That is why keys are short:
| Security level | RSA / DH modulus | Elliptic curve |
|---|---|---|
| 128 bits | 3072 bits | 256 bits |
| 192 bits | 7680 bits | 384 bits |
Real curves: P-256 and Curve25519
P-256 (secp256r1, NIST) has the same short Weierstrass form y² = x³ − 3x + b over a 256-bit prime. It is used by ECDSA in most web certificates and by passkeys (WebAuthn). Curve25519 uses p = 2²⁵⁵ − 19 and the Montgomery form y² = x³ + 486662x² + x. Its key exchange X25519 is the default in TLS 1.3, SSH and Signal, and its twisted Edwards twin gives Ed25519 signatures. Both use the same group law as the toy curve, only with 77-digit numbers.
What the page leaves out
Projective and Jacobian coordinates, which avoid an inverse per step. Constant-time ladders (the Montgomery ladder) that stop timing side channels. Checking that a received point is on the curve (invalid-curve attacks). Cofactors, point compression, and how the curve parameters are chosen. ECDSA and EdDSA signing. Post-quantum key exchange (ML-KEM), since Shor's algorithm would break ECC on a large quantum computer.