A slow, beginner-friendly walkthrough on one tiny curve. Every number is worked out by hand, and every formula shows where it comes from. For the full guide, see the Elliptic Curve README. To try each step yourself, open the Elliptic Curve Lab.
Elliptic curve cryptography begins with an equation of this form:
y² = x³ + ax + b
Here a and b are just fixed numbers. For our example we take a = 2 and b = 2:
y² = x³ + 2x + 2
Where does this equation come from? Mathematicians studied it long before computers existed. It has one special property, explained in Step 3, that makes cryptography possible. You don’t invent your own curve. In real systems the curve is fixed and published, so everyone in the world uses the same one. Bitcoin, for example, uses the published curve y² = x³ + 7.
If we draw the equation normally, the points have decimals like 1.732…, and computers can’t store those exactly. So we do all the math mod a prime number. We’ll use p = 17.
“Mod 17” means you keep only the remainder after dividing by 17. For example, 20 mod 17 = 3, and 35 mod 17 = 1.
So our curve is now:
y² = x³ + 2x + 2 (mod 17)
A point on the curve is any pair of whole numbers (x, y), each between 0 and 16, that makes both sides equal.
Let’s check that (5, 1) is a point:
We’ll call this starting point G = (5, 1). G is just a point that was chosen once and published. It was found by trying values of x until the right side came out as a perfect square.
Here’s the special property: if you draw a straight line through two points on the curve, it always hits the curve at exactly one more point.
Where does that come from? A line has the equation y = λx + c, where λ is the slope. If you substitute it into the curve equation, you get an equation with x³ in it, called a cubic equation. A cubic equation has 3 answers for x. We already know two of them (our two points), so the third one is forced to exist.
Using this, we define “point addition”:
Why flip? Without the flip, the “addition” wouldn’t follow normal addition rules. The flip is what makes it behave like real addition.
We need formulas so a computer can calculate this without drawing anything.
Formula 1, the slope λ. This is the same slope formula from school:
λ = (y₂ − y₁) ÷ (x₂ − x₁)
Formula 2, the new x. When you substitute the line into the curve, you get:
x³ − λ²x² + (other terms) = 0
There’s a rule from school algebra: in a cubic x³ − Sx² + …, the three answers always add up to S. Here S = λ², so:
x₁ + x₂ + x₃ = λ², which gives x₃ = λ² − x₁ − x₂
Formula 3, the new y. The third point is on the line, so its y is λ(x₃ − x₁) + y₁. Then we flip it (multiply by −1):
y₃ = λ(x₁ − x₃) − y₁
Special case: adding a point to itself (P + P). You can’t draw a line through just one point, so you use the tangent line, the line that just touches the curve at that point. Its slope comes from calculus (differentiating y² = x³ + ax + b):
λ = (3x² + a) ÷ (2y)
You don’t need to memorize the calculus. Just remember: two different points use the normal slope, and the same point twice uses the tangent slope.
The slope formula has a division, but in mod math we can’t use fractions. Instead:
“÷ 2” means “multiply by the number that turns 2 into 1.”
Mod 17: 2 × 9 = 18, and 18 mod 17 = 1. So in mod 17, dividing by 2 is the same as multiplying by 9. This number is called the inverse of 2 (mod 17). For big numbers, computers find inverses quickly with the Extended Euclidean Algorithm.
G = (5, 1), and a = 2. It’s the same point twice, so we use the tangent slope.
Slope:
New x:
New y:
So 2G = (6, 3).
Check it’s on the curve: 3² = 9. And 6³ + 2×6 + 2 = 230, with 230 mod 17 = 230 − 221 = 9 ✓
Now we add two different points, (6, 3) and (5, 1), so we use the normal slope.
Slope:
New x:
New y:
So 3G = (10, 6).
Check: 6² = 36, and 36 mod 17 = 2. Also 10³ + 20 + 2 = 1022, with 1022 mod 17 = 1022 − 1020 = 2 ✓
If you keep adding G the same way, you get a chain:
G = (5, 1) → 2G = (6, 3) → 3G = (10, 6) → 4G = (3, 1) → 5G = (9, 16) → … → 9G = (7, 6) → … → 18G = (5, 16) → 19G = ?
The full chain:
| k | k·G | k | k·G | k | k·G |
|---|---|---|---|---|---|
| 1 | (5, 1) | 8 | (13, 7) | 15 | (3, 16) |
| 2 | (6, 3) | 9 | (7, 6) | 16 | (10, 11) |
| 3 | (10, 6) | 10 | (7, 11) | 17 | (6, 14) |
| 4 | (3, 1) | 11 | (13, 10) | 18 | (5, 16) |
| 5 | (9, 16) | 12 | (0, 11) | 19 | O |
| 6 | (16, 13) | 13 | (16, 4) | 20 | (5, 1) again |
| 7 | (0, 6) | 14 | (9, 1) |
Look at 18G = (5, 16). Since −1 mod 17 = 16, this is G flipped upside down. When you add a point and its flipped twin, the line between them is vertical, and a vertical line never hits the curve a third time. Mathematicians call this result the “point at infinity”, written O. It acts like zero.
So 19G = O, and then 20G = G again. The chain is a circle of 19 steps.
You publish (7, 6) and keep 9 secret.
In our toy example there are only 19 points, so trying them all is easy. But real curves use a prime about 77 digits long, so the circle has about 10⁷⁷ points. Even the fastest known method would take far longer than the age of the universe. This backward problem is called the Elliptic-Curve Discrete Logarithm Problem (ECDLP), and it’s what keeps the private key safe.
Alice and Bob both know the curve and G.
Both get the same point, because 3 × 9 = 9 × 3. Since the circle has 19 steps, 27G = (27 − 19)G = 8G = (13, 7).
An attacker only saw (10, 6) and (7, 6). To get (13, 7), they’d need to know 3 or 9, and that’s the hard problem from Step 10. Alice and Bob then use (13, 7) as a key to encrypt their messages with AES.
This method is called Elliptic-Curve Diffie–Hellman (ECDH). It’s how HTTPS, Signal and WhatsApp set up encryption keys.
| Step | What happens | Where it comes from |
|---|---|---|
| Curve | y² = x³ + 2x + 2 | Fixed and published |
| mod 17 | Whole numbers only | Computers need exact numbers |
| G | (5, 1) | Fixed and published starting point |
| Adding points | Line, third point, flip | A cubic has 3 answers |
| Division | Multiply by the inverse | Mod math has no fractions |
| Private key | Secret number (9) | Picked at random |
| Public key | 9G = (7, 6) | Add G nine times |
| Shared secret | 3 × 9G = 9 × 3G = (13, 7) | Multiplication order doesn’t matter |
| Security | Can’t find 9 from (7, 6) | Too many points to try |
Open the Elliptic Curve Lab and go to section 2 (finite field):
Read next: ECC in Real Life: what happens when you open a website