Blog

# Elliptic curve point addition revisited

The usual way to add points on an elliptic curve uses the cord-and-tangent method. To add two points P and Q we draw the line through P and Q and find the third point where this line intersects the curve. We then reflect this point across the x-axis to get R = P + Q. This is shown in this picture, where we find that (-1,0) + (0,1) = (2,-3).

In this case, the point at infinity O acts like zero: P + O = P. It turns out that we don’t really need to use the point at infinity for zero, but if we don’t, the way that we add points changes slightly.

The picture above shows the elliptic curve

y = x3 + 1

The point Z = (0,-1) is on this curve, and we can define a way to add points on the curve in a way that this point acts like the zero element. Here’s how we do this. To add two points P and Q we draw the line through P and Q and find the third point where this line intersects the curve. We then draw the line through this point and Z and find the third point where this (second) line crosses the curve. We call this point R = P + Q. This is shown in this picture, where we find that (-1,0) + (0,1) = (2,3).

This picture is actually a bit tricky to follow. The line through (2,3) and Z actually touches the curve twice at (2,3), so the third point of intersection is also (2,3). (You even get this problem when you try to visualize the addition of points on this curve using the usual definition of addition, but I couldn’t think of an example that’s obviously better to use.)

In this case, the point at infinity doesn’t act like the zero element. If we add (2,3) to the point at infinity, for example, we find that the line between the two points intersects the curve at (2,-3). We then draw the line through (2,-3) and (0,-1) and find that it meets the curve at (-1,0), so we have that (2,3) + ∞ = (-1,0).

Showing that point addition with an arbitrary point acting as the zero element works out like we want to (associative and commutative) is actually fairly tedious, but it turns out to define a way that’s just as valid as the usual way, where we use the point at infinity for the zero element. (Come to think of it, showing that the usual version of point addition is associative and commutative is also fairly tedious, so this shouldn't really come as a surprise.)

It should also be clear that the usual form of point addition is really just a special case of the more general version. When we reflect a point across the x-axis, that's really the same as drawing a line through the finite point and the point at infinity and finding the third place where the line intersects the elliptic curve. This might be a case where it's useful to think of the point at infinity as the projective point (0,1,0), so that a line through the point at infinity is one that's parallel to the line x = 0.