Sketch · 2026-09-25
Elliptic curves, the group law.
A curve of the form y squared equals x cubed plus a x plus b carries a group operation drawn with a ruler. Pick two points P and Q on the curve, draw the straight line through them, and it meets the curve at exactly one other point. Reflect that third point across the x-axis and you have P plus Q. The rule extends to a tangent line when P and Q coincide, and to the point at infinity when the line runs vertical.
Drag the two hollow markers along the curve. The chord through them is drawn, and its third crossing R is picked out. The reflection of R across the x-axis is the sum P plus Q. Move Q close to P and the chord becomes the tangent at P, which is how the group law defines 2P. Line them up with equal x and opposite y, and the sum runs off to the point at infinity.
Note
The construction feels arbitrary until you check it is a group. Addition is commutative because a line does not care which of its two named points came first. The identity is a placeholder called the point at infinity, sitting at the top and bottom of every vertical line at once. The inverse of a point is its reflection in the x-axis, so a vertical chord sums to the identity. What takes real work is associativity: proving that (P + Q) + R lands at the same point as P + (Q + R) reduces to a claim about how many times two cubic curves can meet, which is Bezout's theorem in disguise.
Over the real numbers the picture is smooth as long as the curve is not singular. The condition is that the discriminant −16(4a³ + 27b²) stays non-zero. When it vanishes the cubic in x acquires a repeated root and the curve grows a node or a cusp, and the addition law breaks down at that bad point. The two presets below the sliders sit exactly on that boundary so you can watch the geometry collapse.
Replace the real numbers with a finite field and the same equations still define a group, one whose order is close to the size of the field by Hasse's theorem. Bitcoin's signing curve, secp256k1, is y² = x³ + 7 read modulo a 256-bit prime. The picture you are dragging around here is not what happens in a signature, but the algebra behind the two is the same algebra, and the shape of a proof about it is the shape of a proof about the other.
Sources
- Silverman, J. H. (2009). The Arithmetic of Elliptic Curves, 2nd ed. Graduate Texts in Mathematics 106. Springer, chapter III.
- Washington, L. C. (2008). Elliptic Curves: Number Theory and Cryptography, 2nd ed. Chapman & Hall, sections 2.2 and 2.4.
- Certicom Research (2010). SEC 2: Recommended Elliptic Curve Domain Parameters, version 2.0. Parameters for secp256k1 in section 2.4.1.