ECC Comic Classroom: Curves, Finite Fields, and Point Keys

Why look for another public-key path?

Start in 1985

By 1985, public-key cryptography and RSA already existed. Cryptographers were still looking for other one-way roads: operations that are quick in the forward direction but impractical to reverse from the public result.

Victor Miller and Neal Koblitz independently proposed building cryptosystems from groups of points on elliptic curves. RSA uses the difficulty of recovering prime factors from a large product. ECC uses the difficulty of recovering the secret scalar k from a public starting point G and public point Q = kG. Their arithmetic and attack methods need separate analysis. ^[1][2]

What smaller keys really mean

In NIST's conventional security-strength comparison, roughly 128 bits of security correspond to a 3072-bit RSA-style modulus or an elliptic-curve key in the 256–383-bit range. These are parameter sizes for comparable strength under the stated attack model. Actual speed and cost still depend on the curve, implementation and protocol. ^[4]

Smaller parameters can matter in smart cards, mobile devices, networks, and embedded systems. They do not make every ECC design automatically faster or safer. Curve choice, implementation, protocol, and threat model still decide the real result.

Build the math before the protocol

Before discussing any protocol, we need to understand the mathematical stage. The first surprise is in the name: an elliptic curve is not an ellipse.

An elliptic curve is not an ellipse

Ignore the oval

The word elliptic invites the wrong sketch. An elliptic curve is commonly written y² = x³ + ax + b. Because the right side contains x³, its graph may look like two bending paths or take another cubic shape; it is not the familiar oval from geometry class.

The name comes from mathematical history. Work on ellipse arc lengths led to elliptic integrals, and those integrals later became deeply connected with this family of cubic curves. The historical name stayed even though the picture is not an ellipse.

Keep the curve nonsingular

Not every choice of a and b is acceptable. We require the curve to be nonsingular—no cusp and no self-intersection. For this short Weierstrass form, the condition is 4a³ + 27b² ≠ 0. If it fails, the tangent or addition rule breaks at troublesome points.

Our teaching curve is y² = x³ + 2x + 2. We first view it over the real numbers so the geometry is visible. Later we move the same equation into GF(17), where the continuous drawing turns into a finite set of points.

Which points belong to the curve?

Test a coordinate

A point P = (x, y) belongs to the curve only when its coordinates satisfy the equation. Substitute x and y, calculate both sides, and compare. A dot that merely looks close to the line is not a member.

Because the left side is y², changing y to −y leaves the square unchanged. When (x, y) lies on the curve, its reflected point (x, −y) normally lies there too. That vertical symmetry will soon become the rule for a negative point.

Give the group a zero

We also add one special member called the point at infinity, written 𝒪. It behaves like zero: P + 𝒪 = P. A point and its reflection add to 𝒪, so P + (−P) = 𝒪.

The extra point may feel invented, but it closes the arithmetic cleanly. Ordinary addition needs zero; elliptic-curve point addition needs its own identity element. After a complete trip around our small group, 𝒪 is exactly where we return.

Draw a line, find the third point, then reflect

Follow the geometry

Choose two different curve points P and Q. Draw the line through them. A nonsingular cubic gives one more intersection R′ when intersections are counted correctly. Reflect R′ across the x-axis and call the result R. By definition, P + Q = R.

Why include the reflection? It makes the rule work neatly with negative points and the identity 𝒪. The picture is more than decoration: it is a memory aid for the algebraic operation.

Translate the picture into algebra

Over the real numbers, calculate the chord slope λ = (y_Q − y_P)/(x_Q − x_P). Then x_R = λ² − x_P − x_Q and y_R = λ(x_P − x_R) − y_P. Each piece corresponds to something visible in the diagram: line, third intersection, and reflection.

We are still in the real-number world. Once the picture is familiar, the same formulas can be reinterpreted inside a finite field, where division means multiplying by an inverse rather than producing a floating-point number.

Point addition gives us a dependable group

Check the four group promises

A cryptographic operation must compose reliably, not merely produce an attractive result once. Curve-point addition is closed: adding two group members gives another group member. The point 𝒪 is an identity, and every P has an inverse −P that returns it to 𝒪.

Addition is associative, so (P + Q) + R = P + (Q + R). We can write P + Q + R without worrying about which pair is evaluated first. Elliptic-curve point addition is also commutative, producing an Abelian group.

A group is the stage, not the security claim

A group is not automatically secure. It supplies the stage on which one operation can be repeated. Security also depends on the group size, the order of the chosen base point, the curve structure, and the best known reverse algorithms.

This is why the group rules come before kG. When we later add G repeatedly, the notation is supported by a well-defined system rather than an unexplained trick.

When a point meets itself, use the tangent

Let the chord become a tangent

For P + P, two distinct points are no longer available to define a chord. Let Q approach P along the curve. In the limit, the chord becomes the tangent at P. Find the tangency line's third intersection, reflect it, and the result is 2P.

Over the reals, the doubling slope is λ = (3x_P² + a)/(2y_P). The remaining coordinate formulas are the same ones used for ordinary point addition. If y_P = 0, the tangent is vertical and 2P is defined as 𝒪.

Do not double the coordinates

The common mistake is to read 2P as (2x_P, 2y_P). The 2 counts how many copies of P participate in the group operation; it does not enlarge the coordinates.

Continuous real-number geometry has now done its teaching job. Computer ECC needs a finite world where coordinates and arithmetic can be represented exactly, so the next stop is a Galois field.

A Galois field is finite, yet division still works

Walk around a seventeen-position world

GF(17) contains only 0, 1, 2, …, 16. Values wrap after complete laps, so 15 + 5 = 20 becomes 15 + 5 ≡ 3 (mod 17). This is not rounding; it is division by 17 followed by keeping the remainder.

GF means Galois field, also called a finite field. The word field carries an important promise: addition, subtraction, multiplication, and division by a nonzero element all stay inside the same set.

Replace division with an inverse

Division is the surprising part. In GF(17), seven is the multiplicative inverse of five because 5 × 7 = 35 ≡ 1 (mod 17). Dividing by five therefore means multiplying by seven. No decimal approximation is involved.

Because 17 is prime, every nonzero element has a multiplicative inverse; zero still cannot divide. More general finite fields may contain pⁿ elements, but this lesson stays with the hand-checkable prime field GF(p).

Now the denominators in the point-addition formulas make sense in a finite setting. We replace each division with multiplication by the denominator's modular inverse.

Move the equation into GF(17), and the line becomes dots

Keep only the coordinates that pass

Restrict x and y in y² = x³ + 2x + 2 to the values 0 through 16, and reduce every operation modulo 17. The continuous curve disappears. What remains is a finite collection of coordinate pairs that pass the equation test.

Check G = (5, 1). The left side is 1² = 1. The right side is 5³ + 2 × 5 + 2 = 137, and 137 ≡ 1 (mod 17). The remainders match, so G belongs to the curve.

Trying every x produces eighteen ordinary coordinate points for this teaching curve. Add 𝒪 and the group contains nineteen elements. It is small enough for us to walk around the whole group and inspect every result.

Let geometry remind and arithmetic decide

The chord-and-reflection picture still helps us remember the rule, but it no longer measures a continuous drawing. Slopes use modular inverses, and every new coordinate returns to GF(17). Geometry supplies intuition; finite-field arithmetic supplies the exact answer.

Scalar multiplication means repeated point addition

Read kG as repeated addition

The notation kG means G + G + ⋯ + G with k copies of G. The ordinary integer k is a scalar and G is a curve point, hence the name scalar multiplication. Under the hood, we are still composing point additions.

Double G by hand

Let us double G = (5, 1). The slope is λ ≡ (3 × 5² + 2) × (2 × 1)⁻¹ (mod 17). Since 2⁻¹ ≡ 9 and 3 × 25 + 2 = 77 ≡ 9, the slope is λ ≡ 9 × 9 ≡ 13. Now x_(2G) ≡ 13² − 5 − 5 ≡ 6 and y_(2G) ≡ 13(5 − 6) − 1 ≡ 3, so 2G = (6, 3).

Take one ordinary addition step: add 2G = (6, 3) to G = (5, 1). The slope is λ ≡ (1 − 3)/(5 − 6) ≡ 2. Then x_(3G) ≡ 2² − 6 − 5 ≡ 10 and y_(3G) ≡ 2(6 − 10) − 3 ≡ 6, giving 3G = (10, 6). Continue to 4G = (3, 1) and 7G = (0, 6). At 19G we return to 𝒪, so G has order nineteen.

Let software use the shortcut

Real software does not add G one at a time when k is large. Double-and-add uses the binary form of k, much like fast exponentiation, so the forward computation remains efficient.

Keep the coordinate trap in view: kG is not (kx_G, ky_G). The curve's group law chooses the route.

ECC's one-way maze is the reverse question

Ask the easy question first

If k = 7, calculating Q = kG on our toy curve leads directly from G = (5, 1) to Q = (0, 6). Now reverse the question: given only G and Q, which k satisfies Q = kG? This is the elliptic-curve discrete-logarithm problem.

Our group contains only nineteen elements, so anyone can try one lap and discover k = 7. GF(17) is transparent teaching material and completely insecure.

Scale the maze carefully

Real systems use much larger, reviewed curves and subgroups so that the best known general attacks require impractical resources. Curve size is not the only check: point order, cofactor, validation rules, and implementation details also matter. This is why standards publish vetted domain parameters instead of inviting each project to invent a curve. ^[3]

'Hard' is an engineering judgment under known algorithms, resources, and threat models—not a timeless proof that reversal is impossible. Research can change that judgment.

RSA and ECC therefore create a similar public/private direction from different problems. RSA is linked to integer factorization; ECC is linked to the elliptic-curve discrete logarithm. They should not be described as the same mathematics with different key sizes.

The private key is a number; the public key is a point

Publish the stage

An ECC key pair begins with a public mathematical stage: the finite field, curve equation, base point G, and the order n of G's subgroup. These domain parameters may be visible to everyone. Knowing the stage does not reveal a user's private key.

Choose one secret number

Choose an integer d from 1 through n − 1 using reliable randomness. That integer is the private key. Our d = 7 merely continues the toy example; a predictable, repeated, or biased private value would defeat a real system even if the curve itself were excellent.

Turn the number into a point

Compute the public key as Q = dG. Here, Q = 7G = (0, 6). The private key and public key are intentionally different kinds of objects: d is a secret scalar, while Q is a publishable curve point.

Given d, computing Q is direct. Given only G and Q, recovering d asks for the discrete logarithm from the previous page.

Stop before the protocol layer

We stop here on purpose. A key pair is not yet a complete communication or signature procedure. Data formats, point validation, randomness or nonces, hashing, error handling, and identity trust belong to the next layer, where each deserves a careful lesson of its own.

Put the ECC skeleton together

Retell the origin

The story begins in 1985, when Miller and Koblitz independently saw that elliptic-curve point groups could support a forward operation with a difficult reverse direction. ECC is another public-key family, not a compact rewrite of RSA.

Retell the mathematics

Over the real numbers, y² = x³ + ax + b gives us a visible chord, third intersection, reflection, and tangent. Move the coordinates and operations into GF(p), and the continuous line becomes a finite group of discrete points. Division becomes multiplication by a modular inverse.

Repeatedly add the base point G to obtain G, 2G, 3G, …, kG. Double-and-add computes Q = kG efficiently, while recovering k from public G and Q is the hard elliptic-curve discrete-logarithm problem.

Retell the keys

In key language, the private key is a secret integer d and the public key is the point Q = dG. The toy values GF(17), G = (5, 1), and d = 7 expose every step but protect nothing.

Real systems need reviewed curves, parameters, libraries, and complete protocols. This unit has built the key pair and stops there. The next unit can ask how public points participate in cooperation and verification without mixing those applications into the foundation.

Five points to keep

1. An elliptic curve is not an ellipse; it is a nonsingular cubic curve whose points support a carefully defined addition rule.
2. A chord defines addition, a tangent defines doubling, and the point at infinity 𝒪 acts as the identity element.
3. GF(p) is a finite field, not merely a remainder trick: every nonzero element has a multiplicative inverse.
4. Scalar multiplication kG repeats point addition. The forward computation is efficient, while recovering k from G and Q is the elliptic-curve discrete-logarithm problem.
5. An ECC private key is a secret scalar d, and the public key is the curve point Q = dG. A key pair is the foundation, not yet a complete protocol.

The next unit can build on this foundation to show how public curve points participate in cooperation and verification.

References

1. Victor S. Miller, Use of Elliptic Curves in Cryptography, CRYPTO '85: One of the two independent 1985 proposals to build cryptosystems from elliptic-curve groups.
2. Neal Koblitz, Elliptic Curve Cryptosystems, Mathematics of Computation 48(177): The independently developed ECC proposal received in 1985 and published in 1987.
3. NIST SP 800-186, Elliptic Curve Domain Parameters: Official recommendations for reviewed elliptic curves, domain parameters, and use conditions.
4. NIST SP 800-57 Part 1 Rev. 5: Key-management guidance and comparable security-strength ranges for RSA-style and elliptic-curve keys.