---
# System prepended metadata

title: Eliptic Curve Point Addition

---

# Eliptic Curve Point Addition

An elliptic curve is just a special kind of curve defined by an equation of the form $$
y^2 = x^3 + ax + b
$$ where $a$ and $b$ are fixed numbers. Different values of $a$ and $b$ give different shapes, but all of them follow this same pattern. One important thing to notice is that the curve is symmetric about the $x$-axis, because if $(x,y)$ satisfies the equation, then $(x,−y)$ also satisfies it.

![Screenshot From 2026-03-23 10-19-37](https://hackmd.io/_uploads/HkXqLBA5Wg.png)

#### Points on the Curve

Instead of thinking of this as just a graph, think of it as a **set of points**. A point $(x,y)$ belongs to the curve if it satisfies the equation.

For example, consider the curve $$ y^2 = x^3 + 9$$ Check the point $(3,6)$: $$ 6^2 = 36 \quad \text{and} \quad 3^3 + 9 = 27 + 9 = 36 $$ Since both sides match, $(3,6)$ lies on the curve. So this point is part of our set. Because we are using real numbers, there are infinitely many such points.

#### Thinking in Terms of Sets

So now, instead of a drawing, imagine this as a **collection (set) of all valid points**. A point is in the set if and only if it satisfies $$
y^2 = x^3 + ax + b 
$$This way of thinking is important because it lets us apply ideas from abstract algebra (like groups).

#### Turning Points into a Group
Here’s the powerful idea: we can take **two points on the curve** and combine them using a special rule (called *point addition*), and we will get **another point on the same curve**.

So we define a binary operation (like addition, but for points). If we call it $+$, then for two points $P$ and $Q$: $$
P + Q = R
$$ where $R$ is also on the curve.

#### What Makes It a Group?

For the set of points on the elliptic curve to form a **group**, a few conditions must be satisfied:

First, **closure and associativity**: if you take any two points $P$ and $Q$, then $𝑃+𝑄$ is also a point on the curve (closure), and the way you group additions doesn’t matter: $$ (P+Q)+R = P+(Q+R)$$ Second, there must be an identity element, usually denoted $I$. This is a special point such that: $$ P + I = P$$ For elliptic curves, this identity is a special point called the **point at infinity**.  Third, every point must have an inverse. For a point $P=(x,y)$, its inverse is $$-P = (x, -y)$$because adding them gives the identity: $$P + (-P) = I$$	

## Elliptic Curves Form an Abelian Group

#### What Does "Abelian Group" Mean Here?
An elliptic curve (given by $y^2=x^3+ax+b)$ is not just a curve, it is a  **set of points with a special rule to combine them**. This rule is written as $\oplus$, and it takes two points on the curve and gives another point on the same curve. Even if we don’t yet know how this rule works internally, we do know some important properties about it. Because the operation always gives another valid point on the curve, it is closed, meaning if $A$ and $B$ are on the curve, then $𝐴 \oplus 𝐵$ is also on the curve.

#### Associative and Commutative Behavior
The operation $\oplus$ behaves nicely, just like normal addition in many ways. If we take three points $A, B,$ and $C$ on the curve, then the grouping does not matter: $$ (A \oplus B) \oplus C = A \oplus (B \oplus C)$$ This is called **associativity**. Also, the order does not matter: $$ B \oplus A = A \oplus B$$ This is called **commutativity**, and because of this property, the group is called an **abelian group**. So even though this is not "normal addition,"" it behaves in a very predictable and clean way.

### Identity Element
In any group, there must be a special element called the **identity**, usually written as $I$. This element has the property that combining it with any point does nothing: $$P \oplus I = P$$ At first, we might guess simple points like $(0,0)$ or $(1,1)$ could be the identity, because that happens in other systems. But here’s the problem: those points usually **do not satisfy the equation** $y^2 = x^3 + ax + b$, so they are not even part of the set. That means they cannot be the identity.

#### Point at Infinity

To solve this, mathematicians define a special point called the **identity element**, also known as the **point at infinity**. You can think of it as a "point that is nowhere." It is not a normal $(x,y)$ pair, but we include it in the set **by definition**.

So now, the full set of the eliptic curve is: 
- all points $(x,y)$ that satisfy $y^2=x^3+ax+b$, and
- one extra special point $I$ (the point at infinity)

This point behaves exactly how we want: $$P \oplus I = P$$ so it acts like "adding zero" in normal arithmetic.

#### Inverses (Undoing a Point)

Because this is a group (not just a monoid), every point must have an inverse. That means for every point $P$, there exists another point $P^{-1}$ such that: $$P \oplus P^{-1} = I$$ For elliptic curves, if $P=(x,y)$, then its inverse is: $$-P = (x, -y)$$ This works because elliptic curves are symmetric about the $x$-axis. So if you flip a point vertically, you get its inverse.

#### Why We Can "Define" These Things

One important idea from set theory is that we are allowed to define sets and operations however we want, as long as they follow the rules. A binary operator is just a rule that takes two elements from a set and returns another element of the same set. It doesn’t matter how it does it internally.

This means we can include special cases (like the point at infinity) and define rules like:
- “If one of the inputs is $I$, return the other point”

Even if this feels a bit artificial, it is completely valid mathematically. In fact, this flexibility is what allows elliptic curves to form such a clean algebraic structure.

## Addition is closed.

To understand why elliptic curve addition is closed, let’s take a simple example curve: $$y^2 = x^3 + 10$$ Now imagine drawing a straight line, for example $$ y = 10x$$

![Screenshot From 2026-03-23 11-05-20](https://hackmd.io/_uploads/SksQ-UAqZl.png)

This line is very steep (almost vertical). Even though it may look like the line increases faster than the curve, something interesting happens: **they will always intersect** if we zoom out far enough. This is not just a coincidence for this example, but a general property of elliptic curves.

#### Lines Intersect the Curve in Three Points

The key idea is this: if a straight line intersects an elliptic curve at two points, then it will **always intersect a third point as well**, unless we are in a special case. So if we take two points $A$ and $B$ on the curve and draw a line through them, that same line will hit the curve at a third point $C$.

Sometimes, the line just touches the curve at one point and turns (this is called a **tangent**). In that case, we count that point twice, so we still end up with “three intersections” in total.

This is the geometric reason why the operation is closed: $$A \oplus B = C$$ and $C$ is still on the curve.

#### Important Exception: Vertical Lines

There is one special case: **vertical lines**. If a line is perfectly vertical, it may intersect the curve in only one visible point (or two symmetric ones). This happens when we take a point and its inverse.

![Screenshot From 2026-03-23 11-14-19](https://hackmd.io/_uploads/HkLHmIRqZe.png)

For example, if we have a point $P=(x,y)$, then its inverse is: $$-P = (x, -y)$$ These two points lie directly above and below each other, so the line through them is vertical.

#### Inverse Comes Naturally
Because of this symmetry, inverses are very natural on elliptic curves. If you draw a vertical line through $(x,y)$, it will also pass through $(x,−y)$. So: $$ P \oplus (-P) = I$$ where $I$ is the identity element. This matches perfectly with the idea of inverses in a group.

#### Identity as the Point at Infinity

Now here’s the clever part. When we draw a vertical line, it doesn’t meet the curve at a “third visible point.” So where is the third intersection?

Mathematically, we say that the third point is the **point at infinity**, denoted $I$. You can think of it as a point “very far up” that completes the rule. So vertical lines naturally lead us to define the identity element.

Thus: $$P \oplus (-P) = I$$

#### Another Way to Understand the Rule
We can also say it like this:
- If a line intersects the curve at exactly two distinct points and is **not vertical**, then it must intersect a third point
- If it only seems to intersect once, it is either a tangent (counted twice) or a vertical line (leading to the identity)

This rule ensures that our “addition” always produces a valid result.

### Why This Makes the Group Abelian

Now comes a very nice observation. Suppose we take two points $A$ and $B$. The line through them will intersect the curve at exactly one more point $C$. There is no way to get a different third point by changing the order.

So: $$A \oplus B = B \oplus A$$ because the same line is drawn in both cases, and it produces the same third intersection point. 

Since there is only **one possible result**, the operation must be **commutative**, which makes the group **abelian**.

## Why elliptic curve addition flips over the x axis

![Screenshot From 2026-03-23 12-43-35](https://hackmd.io/_uploads/H1zN_PAq-l.png)

Earlier, we said that if a line intersects an elliptic curve at three points $A, B,$ and $C$, then we might try to define addition as: $$A \oplus B = C$$
and similarly: $$A \oplus C = B, \quad B \oplus C = A$$ At first glance, this looks reasonable. But if we try to use this definition and apply group rules, we run into a serious problem.

### The Contradiction (Why This Fails)

Let’s use the group idea that every element has an inverse. Start from: $$A \oplus B = C$$ 

1. **Substitute $C$**
From $A \oplus B = C$, put into $B \oplus C = A$: $$B \oplus (A \oplus B) = A$$
2. **Use Associativity** $$ (B \oplus A) \oplus B = A$$
3. **Use Commutativity** $$ (A \oplus B) \oplus B = A$$
4. **Replace Again $A \oplus B = C$** $$ C \oplus B = A$$ (consistent, still fine)
5. **Expand Fully** $$(A \oplus B) \oplus B = A$$ Group it: $$A \oplus (B \oplus B) = A$$
6. **Cancel $A$ (use inverse of $A$)**
Apply $A^{-1}$ to both sides: $$ B \oplus B = I$$
7. **Meaning of This** $$B \oplus B = I \Rightarrow B = B^{-1} \quad (\text{From Defination: } B\oplus B^{−1}=I)$$ $B$ is its own inverse
8. **Contradiction**
In elliptic curves:
	Inverse of $(x,y)$ is $(x,−y)$ 
So: $$(x,y) = (x, -y) \Rightarrow y = 0$$ This only happens in special cases, not for all points
- We started with: 
$B$ is any normal point.
- But we proved: 
$B = B^{-1}$
- That would mean: 
$B \oplus B = I$
So every point cancels itself which is not true. and normal points don't equal their inverse. so our assumption is wrong

Defining: $A \oplus B = C$ directly **breaks the group rules**.

### The Fix: Flip Over the $x$-Axis 
Earlier, the problem came from defining: $$A
\oplus B = C$$ This led to: $$B \oplus B = I$$ which forced: $$ B = B^{-1}$$ meaning every point becomes its own inverse which is wrong

#### Now the Fix: Add Reflection
Instead of: $$A \oplus B = C$$ we define $$A \oplus B = -C$$ (where $-C$ means reflection of $C = (x,y) \text{ to } (x,-y)$)

#### Step-by-Step Why This Works

1. **Start Same Way**
Line through $A$ and $B$ gives third point: $$C$$ But now: $$A \oplus B = -C$$
2. **Try Same Logic as Before**
Earlier contradiction used: $$(A \oplus B) \oplus B$$ Now substitute: $$A \oplus B = -C$$ So: $$(-C) \oplus B$$
3. **Use Inverse Property**
We know: $$
C \oplus (-C) = I
$$ so $-C$ is the inverse of $C$
4. **Key Change (This Breaks the Old Problem)**
Earlier we had: $$
C \oplus B = A
$$ Now things change because we are using $-C$, not $C$
So we **no longer get:** $$ B \oplus B = I$$ That dangerous step disappears

#### Why Reflection is Natural

Elliptic curve property: $$
(x,y) \text{ is on curve } \Rightarrow (x,-y) \text{ is also on curve}
$$ So reflection:
- stays on the curve $\checkmark$
- gives inverse $\checkmark$
- fixes algebra $\checkmark$

If we define $A \oplus B=C$, it breaks group rules by forcing wrong results like $B \oplus B=I$. Instead, defining $A \oplus B=−C$ (reflection over the $x$-axis) fixes this and makes elliptic curves follow all group properties correctly.

#### Why Reflection Makes Sense

Elliptic curves are symmetric about the $x$-axis. So if $(x,y)$ is on the curve, then $(x,−y)$ is also on the curve. This makes reflection a natural and valid operation.

Also, recall: $$(x,y)^{-1} = (x, -y)$$ So reflection is directly connected to the idea of inverses. This is why flipping fixes the earlier contradiction.

#### Final Addition Formula (Algebraic Form)
Now let's see how this world algebraically. Suppose we have two points: $$
P_1=(x_1, y_1), \quad P_2=(x_2, y_2)
$$ We define their sum: $$
P_3 = P_1 \oplus P_2 = (x_3, y_3)
$$ First we compute the slope: $$
\lambda = \frac{y_2 - y_1}{x_2 - x_1}
$$ Then compute: $$
x_3 = \lambda^{2} - x_1 - x_2
$$ $$ y_3 = \lambda(x_1-x_3)-y_1$$ These formulas already include the reflection step implicitly.

#### Why Addition is Commutative (Abelian)

Using these formulas, we can check: $$
T \oplus U = U \oplus T
$$ If you swap the points, the slope becomes: $$
\lambda = \frac{y_u-y_t}{x_u-x_t} \quad \text{vs} \quad \frac{y_t-y_u}{x_t-x_u}
$$ These are actually the same value, so you get the same $x_3$ and $y_3$. Hence: $$P = Q$$ So addition is **commutative**, making the group abelian.

There is one small edge case: if $x_1=x_2$, the formula breaks (division by zero). But this just means we are either doubling a point or dealing with a vertical line, which is handled separately and still respects commutativity.

#### Associativity (Why It’s Harder)
We can also prove: $$
(P \oplus Q) \oplus R = P \oplus (Q \oplus R)
$$ but this proof is very long and messy algebraically. It is a known and well-established result in mathematics, so most explanations do not derive it fully.

## Elliptic Curves Satisfy the Abelian Group Properties
Elliptic curves defined by $$y^2 = x^3 + ax + b$$ form a group under point addition $\oplus$, and more specifically an abelian group. This means several important rules are satisfied. First, the operation is closed, which means if we take two points $A$ and $B$ on the curve, then $A \oplus B$ will also be a point on the curve. Geometrically, this happens because a line through two points on the curve will always intersect the curve at a third point (or lead to the point at infinity $I$, which we include as part of the set). Second, the operation is associative, meaning $$ (A \oplus B) \oplus C = A \oplus (B \oplus C)$$ (this is mathematically proven, though the proof is complex). Third, there is an **identity element** $I$ (the point at infinity), such that $$A \oplus I = A$$ Fourth, every point has an inverse, where for a point $(x,y)$, the inverse is (x, -y), and $$A \oplus (-A) = I$$Finally, the operation is commutative, meaning $$A \oplus B = B \oplus A$$ which makes the group abelian.

### What About Adding a Point to Itself? ($A \oplus A$)
A binary operator must work for **every pair of elements**, including when both elements are the same. So we must define: $$
A \oplus A $$ This is called point doubling, and we write it as: $$
2A = A \oplus A$$ ![A](https://hackmd.io/_uploads/Hy1yWC1sbe.png) To understand this, imagine taking two points that are extremely close together on the curve. As they move closer and closer, the line through them becomes a **tangent line** to the curve at point $A$. So instead of drawing a line between two different points, we draw the **tangent at** $A$. This tangent will intersect the curve at another point, and then we reflect that point over the $x$-axis to get the result $2A$.

#### Formula for Point Doubling

If $A=(x_1, y_1), then the slope of the tangent is: $$
\lambda = \frac{3x_1^{2}+a}{2y_1}$$ Then we compute: $$x_3 = \lambda^{2}-2x_1$$ $$y_3 = \lambda(x_1-x_3)-y_1$$ So: $$2A = (x_3, y_3)$$

#### Point Multiplication (Repeated Addition)
Now suppose we want to compute: $$
1000A = A \oplus A \oplus A \oplus \ldots (1000 \text{ times})
$$ Doing this directly would take 1000 steps, which is slow.

#### Smart Trick: Use Associativity (Fast Computation)

Because addition is associative, we can break this into powers of $2$: $$
1000A = 512A \oplus 256A \oplus 128A \oplus 64A \oplus 32A \oplus 8A
$$ Each of these terms can be computed by repeated doubling:
- $2A, 4A, 8A, 16A, \ldots$
- For example, $512A$ is just doubling $A$ $9 \text{ times}$

So instead of $1000$ operations, we do:
- $9$ doublings to get $512A$
- reuse intermediate results
- only a few additions after that

Total $\approx$ **14 operations instead of 1000**

#### Why This Matters?
This idea is called **efficient scalar multiplication**, and it is extremely important in cryptography.

We can compute: $$kA$$very quickly even when $k$ is very large (like 256-bit numbers).

But the reverse problem - given $A$ and $kA$, finding $k$ - is extremely hard.

This is known as the **Elliptic Curve Discrete Logarithm Problem (ECDLP)**, and it is the reason elliptic curves are used in modern cryptography (like Bitcoin, Ethereum, and secure communication).

## Implementation Details of Elliptic Curve Addition

The exact formulas for elliptic curve addition come from algebra (using slope and intersection of a line with the curve), but the most important idea is this: **we don’t actually need to focus on the messy algebra to understand what’s going on**. From group theory, we already know that if we take two points $P$ and $Q$ on the curve and apply the operation $P \oplus Q$, we will get another point on the same curve. That’s enough to reason about elliptic curves at a high level. The formulas are just the “implementation details,” not the main concept.

### Why Group Theory Makes This Easier
Instead of studying elliptic curves from scratch, it’s much easier to think of them as just another example of a **group**, like ones you may already know. For example, rational numbers under addition form a group, integers modulo a prime form a group under multiplication, and matrices with non-zero determinant form a group under multiplication. In all these cases, the pattern is the same: you take two elements, apply an operation, and you stay inside the set; there is an identity element; every element has an inverse; and associativity holds. Elliptic curves follow exactly the same pattern. So instead of worrying about what $oplus$ is doing internally, we trust that it behaves like a proper group operation.

### Understanding Scalar Multiplication (What Does $aP$ Mean?)
When you see something like $$aP$$ it may look like normal multiplication, but it is **not**. It simply means adding the point $P$ to itself $a$ times: $$aP = \underbrace{P \oplus P \oplus \cdots \oplus P}_{a \text{ times}}$$ So this is just repeated addition, nothing more.

### Why Expressions Like $(a+b)P+cP$ Work
Now consider this expression: $$(a+b)P \oplus cP$$ At first, it may feel like we are mixing addition and multiplication in a strange way. But if we expand what it really means: $$(a+b)P = P \text{ added } (a+b) \text{ times}$$ and $$cP = P \text{ added } c \text{ times}$$So together: $$(a+b)P \oplus cP = (a+b+c)P$$ Similarly: $$aP \oplus (b+c)P = (a+b+c)P$$ So we get: $$(a+b)P \oplus cP = aP\oplus(b+c)P$$ This works because of **associativity**. We are just adding $P$ to itself a total of $(a+b+c)$ times, and the order of grouping does not matter.

#### Important Insight: This Is NOT Real Multiplication
It is very important to understand that this “scalar multiplication” is **not true multiplication** like in normal algebra. There is no new multiplication operation here. It is just a **shortcut notation** for repeated addition.

So when you see algebra-like expressions, nothing magical is happening. Under the hood, everything reduces to: $$
P \oplus P \oplus P \oplus \ldots$$

#### Why This Matters for Understanding
If you try to visualize every step geometrically (drawing lines, finding intersections, flipping points), things quickly become confusing. But if you think in terms of group theory, everything becomes simple:
- You are just combining elements
- The rules always work
- The structure guarantees consistency

So elliptic curves become easier when you think of them as **just another group**, not as a complicated geometric object.

## Elliptic Curves Over Finite Fields (Real-World Use)
So far, we have been thinking about elliptic curves over real numbers, which helps with visualization. But in real-world applications (like cryptography), we do not use real numbers. Instead, we use **finite fields**, meaning all calculations are done modulo a prime number $p$.

So the equation becomes: $$y^2 = x^3+ax+b \pmod p$$ This avoids problems with decimals and numerical instability. Every calculation becomes exact and stays within a finite set of numbers.

#### Why We Don’t Lose Intuition
Even though we switch from real numbers to modular arithmetic, the same ideas still apply:
- Points still form a group
- Addition still works the same way conceptually
- Identity and inverses still exist
- Scalar multiplication still means repeated addition'

So the real-number version is just a **visual tool**, while the finite field version is what we actually use in practice.