Perform point addition, doubling, and scalar multiplication on real elliptic curves. Visualize the curve and points with interactive graph. Essential tool for ECC learning, cryptographic prototyping, and geometric exploration.
An elliptic curve over the reals is defined by the equation y² = x³ + ax + b with discriminant Δ = 4a³+27b² ≠ 0 (to avoid singularities). The set of points on the curve together with a point at infinity O forms an abelian group under the chord‑tangent process. This group law is the basis of elliptic curve cryptography (ECC), which provides smaller key sizes compared to RSA while maintaining equivalent security. This calculator performs geometric addition and scalar multiplication in the real continuum, helping visualize the underlying group structure.
Group law formulas (Weierstrass form):
For P = (x₁, y₁), Q = (x₂, y₂) with P, Q ≠ O:
If x₁ ≠ x₂: λ = (y₂ - y₁)/(x₂ - x₁), x₃ = λ² - x₁ - x₂, y₃ = λ(x₁ - x₃) - y₁.
If P = Q and y₁ ≠ 0: λ = (3x₁² + a)/(2y₁), then x₃ = λ² - 2x₁, y₃ = λ(x₁ - x₃) - y₁.
If x₁ = x₂ and y₁ = -y₂, then P + Q = O (point at infinity).
Our calculator implements the following steps: (1) Verify that points P and Q lie on the curve (or are the point at infinity). (2) Apply the appropriate case: if P = O then R = Q; if Q = O then R = P; else if P = -Q (same x, opposite y) then R = O. (3) For standard addition with distinct points, compute slope λ and new coordinates. (4) For doubling, compute tangent slope using derivative. (5) Scalar multiplication uses efficient double‑and‑add (binary expansion) which is the foundation of ECC key exchange (ECDH) and digital signatures (ECDSA). The graph dynamically renders the curve, the input points, and the resulting point in real time, respecting axis scaling and visual clarity.
The discriminant Δ determines if the curve is non‑singular (Δ≠0). Curves with Δ=0 have cusps or self-intersections and are not suitable for cryptography. The calculator warns when discriminant is zero or near zero.
Use the following test cases to validate the tool against known results. All calculations are performed with double-precision floating point; small rounding errors may occur.
| Curve (a,b) | P | Q | Expected P+Q | Notes |
|---|---|---|---|---|
| a=-2, b=3 | (0, √3 ≈1.73205) | (2, √12≈3.46410) | (1.73205, 0) | Addition yields x≈√3, y=0 |
| a=-2, b=3 | (0, 1.73205) | Same P | (1.73205, 0) | Doubling produces same as above |
| a=0, b=7 | (1, √8≈2.82843) | (2, √15≈3.87298) | ≈( -0.618, 2.750 ) | secp256k1‑like; verify with independent tool |
| a=-2, b=3 | (1, √2≈1.41421) | (1, -1.41421) | O (point at infinity) | P = -Q |
Elliptic curves are used in modern protocols: Bitcoin/ Ethereum utilize secp256k1 (a=0, b=7), TLS/SSL uses NIST curves (P-256, P-384), and Signal Protocol relies on X25519 (Curve25519). While these operate over finite fields, the real‑valued visualization provides intuitive understanding of the underlying group axioms. Our calculator includes a secp256k1‑like preset (a=0, b=7) so you can experiment with the same parameters used in cryptocurrency. For finite‑field arithmetic, refer to dedicated tools (e.g., SageMath, OpenSSL).
Given a private key k (scalar), public key is computed as k·G where G is a base point. This tool demonstrates scalar multiplication by repeated addition: for k=3, we compute 3P = P+P (doubling) + P (addition). Try with a point on a non‑singular curve: e.g., a=-2,b=3, P=(0,√3). The computed result should be (1.732, 0.0) approximately. This visual demonstration is crucial for grasping why ECC is computationally efficient yet hard to invert (discrete logarithm problem).