The picture most people carry around of an elliptic curve — a smooth loop and a sweeping arm, drawn on graph paper — is a real object, but it is not the one cryptography uses. Real numbers have rounding, and rounding has no place in a system where a single wrong bit must invalidate a signature. So the coordinates are pulled back to a finite set: the integers 0 through p − 1 for some prime p, with every addition and multiplication reduced modulo p. Nothing is approximate, nothing is continuous, and the curve stops being a line at all.
What survives is the equation. A curve in short Weierstrass form isy² = x³ + ax + b, and a pair of numbers is on the curve when the two sides come out equal modulo p. That is the whole definition, and it is a test you can run with nothing but multiplication.
p = 17 the field: coordinates are 0..16, arithmetic wraps at 17
a = 2, b = 2 the curve: y^2 = x^3 + 2x + 2 (mod 17)
is (5, 1) on it?
left : 1^2 = 1
right : 5^3 + 2*5 + 2 = 137 = 8*17 + 1 = 1
equal -> yesBecause there are only 17 possible x values and 17 possible y values, there are 289 candidate pairs in total, and you could test every one of them by hand in an afternoon. Eighteen of them pass. Add one more element — the point at infinity, written O — and you have the complete curve: nineteen things.
Three facts that will keep coming back
- The set is symmetric. If (x, y) satisfies the equation then so does (x, p − y), because both have the same square. Points come in mirrored pairs straddling the middle of the plot, and that mirror is exactly the negation operation you will meet in the next lesson.
- Some x values carry nothing. For a given x, a point exists only if the right-hand side happens to be a perfect square modulo 17. Roughly half of the residues are, so roughly half the columns are empty. Eight of the seventeen are, on this curve.
- O is not decoration. It is the identity element — the thing P + (−P) has to equal, the way 0 is what n − n equals. Without it, addition on the curve would have holes in it and there would be no group to do cryptography in.
Two sanity checks apply to any curve like this. First, the equation must be non-degenerate:4a³ + 27b² ≠ 0 modulo p, or the shape has a cusp and the addition rule falls apart. Here 4·8 + 27·4 = 140 = 4 mod 17, comfortably non-zero. Second, Hasse’s theorem says the number of points always lands within 2√p of p + 1 — here, between 10 and 26. Nineteen fits, as it must.