Elliptic Curve Cryptography

What is an Elliptic Curve?

An elliptic curve is defined by a deceptively simple equation. Bitcoin uses secp256k1, which is:

y² = x³ + 7 (over a prime finite field 𝔽p)

In reality the curve lives over a finite field modulo a huge prime p — so all coordinates are integers and the "curve" looks like scattered dots. But we visualize it over the real numbers to understand the geometry.

a = 0 b = 7

The equation

y² = x³ + ax + b

For this to be a valid elliptic curve, the discriminant must be non-zero:

4a³ + 27b² ≠ 0

This prevents the curve from having cusps or self-intersections.

Key properties

• The curve is symmetric about the x-axis (because y² means ±y are both solutions)

• Any non-vertical line intersects the curve in at most 3 points

• These two properties enable point addition — the foundation of ECC

secp256k1 (Bitcoin/Ethereum)

y² = x³ + 7 (mod p)

p = 2²⁵⁶ − 2³² − 977
That's a 78-digit number. The curve has ~2²⁵⁶ points.

Point Addition — The Core Operation

You can "add" two points on an elliptic curve using a geometric rule. This operation is the only building block of all ECC operations.

Step 1 of 3

Step 1: Draw the line through P and Q

Given two points P and Q on the curve, draw the line that passes through both.

This line will always intersect the curve at exactly one more point (let's call it −R).

The formula (over real numbers)

slope λ = (y₂ - y₁) / (x₂ - x₁)

x₃ = λ² - x₁ - x₂

y₃ = λ(x₁ - x₃) - y₁

Then P + Q = (x₃, y₃) — the reflected point.

Point Doubling (P + P)

When adding a point to itself, use the tangent line at P:

λ = (3x₁² + a) / (2y₁)

Then apply the same x₃, y₃ formulas. This is called 2P.

Key Generation — Private → Public

ECC key generation has just two ingredients: a private key (a random number) and a generator point G baked into the curve specification.

Choose a Generator Point G — a specific point on the curve defined in the standard (e.g. secp256k1). Everyone using the same curve uses the same G. It's public knowledge. G = (x, y) — public, standardised

Generate a Private Key k — pick a random integer between 1 and the curve's order n (≈ 2²⁵⁶ for secp256k1). This is your secret. Never share it. k = random integer (256 bits)

Compute Public Key Q = k × G — this means: start at G, and perform point addition k times. k × G = G + G + G + … (k times) Q = k × G — your public key

🔑 Private Key

Just a random 256-bit integer. That's it. Example (simplified):

k = 42

In reality: a 77-digit random number like
0x9f3d...a7b2

📜 Public Key

The result of scalar multiplication Q = k × G. It's a point on the curve (x, y) — two 256-bit numbers.

Q = k × G = 42 × G = (x, y)

Share this freely — it's your identity.

🔒 The One-Way Trap

Given Q and G, finding k requires solving the Elliptic Curve Discrete Logarithm Problem (ECDLP).

With 2²⁵⁶ possible values, no known algorithm can do this in feasible time — not even with all computers on Earth running for billions of years.

Interactive Demo (small curve)

k =

Result

Click to compute…

ECDSA Signing — Proving You Own the Private Key

Elliptic Curve Digital Signature Algorithm (ECDSA) lets you sign a message using your private key. Anyone with your public key can verify it — but only you (with the private key) can create it.

Hash the message — compute H = hash(message). This gives a fixed-size number representing the message. Even a 1-character change produces a completely different hash. H = SHA-256(message)

Pick a random nonce k — choose a fresh random integer k (different for every signature!). This is critical: reusing k leaks your private key. (Sony PS3 was hacked this way.) k = random (per-signature secret)

Compute R = k × G — perform scalar multiplication with the nonce. Take the x-coordinate: r = R.x mod n. r = (k × G).x

Compute s = k⁻¹ (H + r × privateKey) mod n — combine the hash, the nonce commitment r, and your private key. k⁻¹ is the modular inverse of the nonce. s uses private key 🔑

The signature is the pair (r, s) — send this with the message. r is a commitment to the nonce point, s is the proof of private key ownership. Signature = (r, s)

Sign a message (demo with small numbers)

Message Hash H

—

Nonce k (random, secret)

—

Signature r

—

Signature s

—

Signature Verification — Using Only the Public Key

Anyone with your public key Q can verify a signature (r, s) — without knowing the private key. This is the magic.

Recompute the message hash H — hash the received message exactly as the signer did.

Compute u₁ = H × s⁻¹ mod n and u₂ = r × s⁻¹ mod n — these are two scalar values derived from the hash, the signature, and the curve order.

Compute the check point: X = u₁ × G + u₂ × Q — this combines the generator G and the signer's public key Q. No private key needed! Uses public key only 📜

Verify: X.x mod n == r ? — if the x-coordinate of the reconstructed point matches r, the signature is valid. The math guarantees this only works if the signer knew the private key. ✅ Valid if X.x = r

Why does this work? (intuition)

When signing, we computed: s = k⁻¹(H + r·privateKey)

Rearranging: k = s⁻¹·H + s⁻¹·r·privateKey = u₁ + u₂·privateKey

Multiplying both sides by G: k·G = u₁·G + u₂·(privateKey·G) = u₁·G + u₂·Q

And k·G is exactly the point whose x-coordinate is r — so the check X.x = r reconstructs the nonce point without knowing k or the private key.

⚡ The equation balances only if the private key used to sign matches the public key used to verify.

Verify the signature from Step 4

—

Why Is It Hard to Break?

The entire security of ECC rests on one problem: the Elliptic Curve Discrete Logarithm Problem (ECDLP).

Given Q and G, find k such that Q = k × G

The phone book analogy

Imagine a phone book with 2²⁵⁶ entries (more than the number of atoms in the observable universe). You know the address (Q) and the starting address (G). You need to figure out how many steps it took to walk from G to Q.

Going forward (k × G) is fast — it takes only ~256 steps using double-and-add. Going backwards (finding k from Q) requires essentially brute force through 2¹²⁸ operations at minimum — utterly infeasible.

ECC vs RSA comparison

Security level	RSA key size	ECC key size	Ratio
80-bit	1,024 bits	160 bits	6× smaller
128-bit	3,072 bits	256 bits	12× smaller
192-bit	7,680 bits	384 bits	20× smaller
256-bit	15,360 bits	521 bits	30× smaller

Advantages of ECC

• Smaller keys — 256-bit ECC ≈ 3072-bit RSA in security

• Faster operations — less computation, better for IoT/mobile

• Smaller certificates — important for TLS handshake speed

• Used everywhere — TLS 1.3, Bitcoin, Signal, Apple Secure Enclave, SSH keys

⚠️ Quantum threat

Shor's algorithm on a sufficiently powerful quantum computer could break ECDLP — same as RSA. Both rely on mathematical hardness problems solvable by quantum algorithms.

This is why NIST is standardising post-quantum cryptography (lattice-based, hash-based) as the next generation — independent of elliptic curves.

Famous ECC curves in use today

Curve	Used in	Key size	Equation
secp256k1	Bitcoin, Ethereum	256-bit	y² = x³ + 7
P-256 (secp256r1)	TLS, FIDO2, Apple	256-bit	y² = x³ − 3x + b
P-384	NSA Suite B, TLS	384-bit	y² = x³ − 3x + b
Curve25519	Signal, WireGuard, SSH	255-bit	y² = x³ + 486662x² + x
Ed25519	SSH keys, TLS 1.3	255-bit	Edwards form