Elliptic Curves: Definitions and the Group Law

Executive summary

A cubic curve whose points form a group

An elliptic curve is a non-singular cubic with a distinguished point at infinity. Its points form an abelian group under the chord-and-tangent construction, with the point at infinity as identity. Over a finite field the group is finite with order constrained by Hasse's bound to within 2√q of q + 1 — and that near-freedom in the group order is precisely what the elliptic curve factoring and primality methods exploit.

Learning objectives

Write a curve in Weierstrass form and compute its discriminant and j-invariant.
Apply the group law formulas including the special cases.
State Hasse's theorem and its significance.
Explain why varying the curve varies the group order.
Choose coordinates that avoid modular inversions.

Section 01Weierstrass form

The general Weierstrass equation is

y² + a₁xy + a₃y = x³ + a₂x² + a₄x + a₆

Away from characteristic 2 and 3 this simplifies by completing the square and the cube to the short form y² = x³ + ax + b, with

Δ = −16(4a³ + 27b²), j = −1728 (4a)³ / Δ

The curve is non-singular exactly when Δ ≠ 0. The j-invariant classifies curves up to isomorphism over an algebraically closed field; over a smaller field, curves with the same j may still be non-isomorphic twists.

Small characteristic needs the general form

The reduction to short Weierstrass form divides by 2 and 3. In characteristic 2 or 3 the general five-coefficient equation must be retained, and the group law formulas differ. Code that assumes the short form will silently fail on these fields.

Section 02The group law

Three collinear points on the curve sum to the identity. Turning that into formulas:

AlgorithmAddition on y² = x³ + ax + bin: points P, Q on E → out: P + Q

If P = O, return Q; if Q = O, return P.
If x₁ = x₂ and y₁ = −y₂, return O. The points are inverse to one another.
If P ≠ Q, set λ ← (y₂ − y₁) / (x₂ − x₁).
If P = Q, set λ ← (3x₁² + a) / (2y₁) — the tangent slope.
Set x₃ ← λ² − x₁ − x₂ and y₃ ← λ(x₁ − x₃) − y₁.
Return (x₃, y₃).

Inversion-free coordinates

Projective and Jacobian coordinates represent a point with an extra coordinate so that addition uses no inversion, deferring a single inversion to the end of a long computation. For scalar multiplication with hundreds of doublings this is a large saving — but note that it also suppresses the inversion failures that ECM depends on, so factoring implementations must handle this deliberately.

Section 03Groups over finite fields

Over F_q the group of points is finite, and Hasse's theorem bounds its order:

|#E(F_q) − (q + 1)| ≤ 2√q

The structure is cyclic or a product of two cyclic groups, the second factor's order dividing the first and dividing q − 1.

2√qwidth of the Hasse interval

O(log⁸ q)Schoof's algorithm for point counting

SEAthe practical improvement, used to this day

Why the freedom in group order matters

For a fixed field, different curves give different group orders spread across the Hasse interval. The p−1 method works only when p−1 happens to be smooth; ECM replaces that fixed group with a curve group that can be resampled until a smooth order appears. That resampling is the entire advantage of ECM over p−1.

Section 04Points over ℚ and torsion

The Mordell–Weil theorem states that E(ℚ) is finitely generated:

E(ℚ) ≅ E(ℚ)_tors ⊕ ℤ^r

The torsion subgroup is easy to compute — by Mazur's theorem it is one of fifteen possibilities, all small — and the Nagell–Lutz criterion bounds candidate torsion points by requiring integral coordinates with y² dividing the discriminant. The rank r is by contrast genuinely difficult, and no algorithm is known that provably computes it in all cases.

Torsion is easy, rank is not

The asymmetry is stark: torsion is decided by a short finite search, while rank computation relies on descent, may fail to terminate conclusively, and is entangled with the unproven finiteness of the Tate–Shafarevich group.

ReferenceFrequently asked questions

Why is the point at infinity needed?

Because the group law requires an identity, and two points with the same x-coordinate have no third intersection in the affine plane. The projective point at infinity supplies both, making the group law total.

Is the group law associative, and is that obvious?

It is associative, but it is not obvious — a direct verification from the formulas is lengthy. The conceptual proof identifies the group with the divisor class group of degree zero, where associativity is inherited from addition of divisors.

How is the group order computed in practice?

By Schoof's algorithm and its SEA refinement, which determine the order modulo many small primes using the action of Frobenius on torsion points, then combine by the Chinese remainder theorem within the Hasse interval.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Elliptic Curves: Definitions and the Group Law. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Elliptic Curves: Definitions and the Group Law as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—group, section, elliptic, weierstrass, points—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Elliptic Curves: Definitions and the Group Law?