Interactive course
Signatures by Hand
Seven short lessons that end with you building an ECDSA signature yourself — on paper first, then on a real 256-bit curve. Not a survey of what ECDSA is. A course where you do the arithmetic, and the page tells you which step went wrong when it does.
- Points on a curve8 minAn elliptic curve over a finite field is a short list of coordinate pairs. Learn to test whether a pair is on the list, and count the whole thing.task · Decide which of six candidate points satisfy y² = x³ + 2x + 2 over F₁₇, then count the group.
- Adding points10 minThe chord-and-tangent rule turns two points into a third. It is the only operation elliptic-curve cryptography ever performs.task · Compute P + Q by hand for P = (5, 1) and Q = (6, 3) over F₁₇.
- Scalar multiplication9 minAdding a point to itself k times is written kG. Doing it in the obvious way takes k steps; doing it in binary takes about log₂ k.task · Walk the double-and-add ladder for 13G and count the operations it saved.
- Keys8 minA private key is a number. A public key is that number times the generator. Everything else in ECDSA is bookkeeping around those two facts.task · Turn the private key d = 7 into a public key on F₁₇, then size up a real 256-bit key space.
- Signing10 minr comes from a throwaway point, s ties the message hash and the private key together. Two lines of algebra, one fatal requirement.task · Produce a complete ECDSA signature by hand from k = 3, d = 7 and z = 11.
- Verifying10 minThe verifier recombines the signature into a point and checks one coordinate. Get it wrong and forgeries walk straight through.task · Verify a signature by hand, then find the single valid one among three candidates.
- The real thing12 minSame six formulas, 256-bit numbers, real code in your browser. Sign, verify — and then work out why a genuine-looking signature refuses to pass.task · Sign and verify on P-256 with real cryptography, then diagnose a signature that fails.
Where your progress lives
In this browser, under the key ecdsa.course.v1, and nowhere else. There is no account to create and no server-side record: a different browser, a different device or a cleared cache means starting over, and clearing it yourself is a button away. Every calculation in every lesson — including the real P-256 signing in lesson 7 — runs locally; the pages make no network requests while you work.
How it works
Lessons one through six run on a curve small enough to draw: y² = x³ + 2x + 2 over the integers modulo 17, with 19 points in total. Numbers that size fit in your head, so you can do the same operations a signing library does — modular inverses, point additions, a double-and-add ladder — with nothing but the arithmetic you learned at school. Lesson seven repeats them on P-256, where the numbers are 78 digits long and the procedure is identical.
Every lesson has a task, and every task is checked. A wrong answer does not get a red cross: it gets the specific diagnosis — you found the third intersection but skipped the reflection, you multiplied by s where the formula wants its inverse, you used the tangent slope on two distinct points. Those are the mistakes people actually make, and naming them is the fastest way past them.
Read at your own pace; the whole thing is about 67 minutes of work and splits naturally over a few sittings. If you would rather poke at the arithmetic without a syllabus, the Elliptic Curve Playground is the same math with the lessons removed.
What you need
Arithmetic and patience. No calculus, no abstract algebra, no programming. If you can compute remainders — what 137 leaves when divided by 17 — you have everything the first six lessons ask for. Paper helps; several tasks are more pleasant worked out on it than in your head.
You do not need to know what a group is, what a finite field is, or what a nonce is. Those arrive as they become useful, and each is introduced by doing something with it rather than by defining it first.
At the end
Finishing all seven unlocks a certificate page you can put your name on and share. It is a souvenir, not a credential — nobody accredits it and nobody verifies it — but the thing it marks is real enough: you will have signed and verified a message with your own hands, which is more than most people who ship ECDSA code have done.