Algebraic Geometry
The Elliptic Curve Group Law: Adding Points on a Cubic
Here is a small miracle: draw a line through two points on a cubic curve, and the third point where it hits the curve is completely determined — reflect it, and you have added the two original points. This "chord-and-tangent" recipe turns the set of points on an elliptic curve into an abelian group, with an identity element sitting at infinity, and it does so purely algebraically over any field you like.
Precisely: let E be a nonsingular projective cubic over a field K, written in Weierstrass form y² = x³ + ax + b with discriminant Δ = −16(4a³ + 27b²) ≠ 0. Then the set E(K) of K-rational points, together with the point at infinity O = [0:1:0], forms an abelian group under the chord-and-tangent law, with O as identity. Associativity is the deep and surprising part.
- FieldAlgebraic geometry / number theory
- StatementPoints on a nonsingular cubic form an abelian group under chord-and-tangent
- Identity elementThe point at infinity O = [0:1:0]
- Key hypothesisNonsingularity: discriminant Δ ≠ 0 (char ≠ 2,3)
- Hardest axiomAssociativity (Bezout / Riemann–Roch / Cayley–Bacharach)
- Deep consequenceMordell–Weil: E(ℚ) is finitely generated (Mordell 1922)
Interactive visualization
Press play, or step through manually. The visualization is yours to drive — try it before reading on.
Watch the 60-second explainer
A condensed visual walkthrough — narrated, captioned, under a minute.
1. The precise statement
Let K be a field with char K ≠ 2, 3, and let E be the projective plane curve defined by the affine equation y² = x³ + ax + b, together with the single point at infinity O = [0:1:0] where the curve meets the line at infinity. Assume E is nonsingular, equivalently the discriminant Δ = −16(4a³ + 27b²) is nonzero, equivalently the cubic x³ + ax + b has no repeated root in K̄.
Let E(K) = {(x,y) ∈ K² : y² = x³ + ax + b} ∪ {O}. Define addition by the chord-and-tangent rule: to add P and Q, draw the line through them (the tangent if P = Q), take the third intersection point R with E, and set P + Q = the reflection of R across the x-axis. Then:
- (E(K), +) is an abelian group;
- O is the identity, and −(x,y) = (x,−y);
- the group law is given by rational functions in the coordinates with coefficients in K.
The last point makes E an algebraic group — a group object in the category of varieties.
2. The geometric picture
A line in the projective plane meets a cubic in exactly three points, counted with multiplicity (this is Bézout's theorem, 3·1 = 3). So two points P, Q on E name a third point R = P ∗ Q. If we naively set P + Q = R we do not get a group: there is no identity, because the ∗ operation has no neutral element among ordinary points.
The fix is to reflect. Choose O = [0:1:0] as the base point and define P + Q = O ∗ (P ∗ Q), i.e. flip R over the x-axis. Now O behaves as identity: the line through P and O is vertical, meeting E again at (x₁, −y₁), and reflecting that returns P. The inverse of P is its mirror image (x, −y). Commutativity is obvious — the line through P and Q does not care about order. What is not obvious, and looks almost accidental in the picture, is that (P + Q) + S = P + (Q + S).
3. Why associativity is true — the mechanism
Associativity is the crux. The cleanest proof identifies E(K) with a quotient of its divisor class group. Consider the group Div⁰(E) of degree-0 divisors and the subgroup of principal divisors div(f) of rational functions. The Picard group Pic⁰(E) = Div⁰(E)/principal is where the magic lives: it is a group by construction, inheriting associativity from addition of divisors.
The Riemann–Roch theorem for a genus-1 curve shows the map P ↦ [(P) − (O)] is a bijection E(K) → Pic⁰(E). One then checks that three collinear points P, Q, R satisfy (P) + (Q) + (R) − 3(O) = div(ℓ/z) for the line ℓ, so their classes sum to zero — which is exactly the geometric addition rule. Transporting the group structure of Pic⁰(E) back through this bijection gives associativity for free.
Alternatively, one proves it directly via the Cayley–Bacharach theorem: two cubics through eight of nine intersection points pass through the ninth, yielding (P+Q)+S = P+(Q+S) as a purely projective incidence fact.
4. A worked example over ℚ
Take E: y² = x³ − 2, an elliptic curve of rank 1 over ℚ. The obvious point is P = (3, 5), since 5² = 25 = 27 − 2. Let us compute 2P by the tangent formula. With a = 0, the slope is λ = 3x₁²/(2y₁) = 3·9/(2·5) = 27/10.
Then x₃ = λ² − 2x₁ = (729/100) − 6 = 129/100, and y₃ = λ(x₁ − x₃) − y₁ = (27/10)(3 − 129/100) − 5 = (27/10)(171/100) − 5 = 4617/1000 − 5 = −383/1000. So 2P = (129/100, −383/1000). Check: (129/100)³ − 2 versus (383/1000)² — both equal 146689/1000000. The point 2P has denominators growing fast, a hallmark of infinite order: P generates a copy of ℤ inside E(ℚ). Fermat used essentially this descent to show y² = x³ − 2 has (3, ±5) as its only integer solutions.
5. Why nonsingularity is essential — and connections
Drop nonsingularity and the group law collapses. If Δ = 0 the cubic has a singular point — a node (double root) or a cusp (triple root). The smooth points of a singular cubic still form a group, but a degenerate one: for a node it is isomorphic to the multiplicative group K* (or a twisted form), and for a cusp it is the additive group (K, +). The singular point itself cannot be added — the tangent-line construction fails there because there is no well-defined tangent. These degenerations are not a nuisance; they are the fibers of bad reduction in the theory of elliptic curves over ℚₚ, governing the local factors of L-functions.
The construction connects to Pic⁰ and Jacobians of higher-genus curves, to modular arithmetic (reduction mod p makes E(𝔽ₚ) a finite abelian group with |E(𝔽ₚ)| ≈ p, Hasse's bound), and to Galois theory via the action on torsion points.
6. Applications and significance
The group law is the engine of modern number theory and cryptography. Mordell (1922), extended by Weil (1929), proved E(ℚ) ≅ ℤ^r ⊕ T with T finite: the Mordell–Weil theorem, whose proof runs entirely through the group structure via heights and descent. The rank r is the subject of the Birch and Swinnerton-Dyer conjecture, a Clay Millennium Problem linking r to the order of vanishing of L(E,s) at s = 1.
Over finite fields, the difficulty of the discrete logarithm problem in E(𝔽ₚ) underpins elliptic curve cryptography (Koblitz and Miller, 1985): 256-bit ECC matches the security of 3072-bit RSA, which is why it secures TLS, Bitcoin, and Signal. Torsion points and their Galois representations were the arena of Wiles's proof of Fermat's Last Theorem (1995), which established the modularity of elliptic curves. Every one of these rests on the innocent-looking chord-and-tangent addition.
| Case | Slope λ | Result x₃, y₃ |
|---|---|---|
| P ≠ ±Q (chord) | λ = (y₂ − y₁)/(x₂ − x₁) | x₃ = λ² − x₁ − x₂; y₃ = λ(x₁ − x₃) − y₁ |
| P = Q, y₁ ≠ 0 (tangent, doubling) | λ = (3x₁² + a)/(2y₁) | x₃ = λ² − 2x₁; y₃ = λ(x₁ − x₃) − y₁ |
| Q = −P (x₁ = x₂, y₂ = −y₁) | vertical line | P + Q = O (point at infinity) |
| Q = O | — | P + O = P (identity) |
| Inverse of P = (x₁,y₁) | — | −P = (x₁, −y₁) |
Frequently asked questions
Why do we need the point at infinity O?
Because the chord-and-tangent operation P ∗ Q (third intersection point) has no identity element among the affine points. Adding O = [0:1:0] gives a base point to reflect through, turning ∗ into a genuine group law with O as identity. Geometrically O is where all vertical lines meet, so it makes −P = (x,−y) the natural inverse. It is also the unique point of E on the line at infinity in Weierstrass form.
Why is associativity so much harder than the other axioms?
Commutativity, identity, and inverses are all immediate from the geometry. Associativity is a nontrivial coincidence of nine points lying on two cubics — it is genuinely a theorem, not a definition. The slick proofs go through Pic⁰(E) via Riemann–Roch (where associativity is automatic because you are quotienting an abelian group of divisors) or through the Cayley–Bacharach theorem. A brute-force verification with the rational addition formulas also works but is a mess of algebra.
What exactly breaks if the curve is singular (Δ = 0)?
At a singular point the tangent line is not well-defined, so you cannot double there, and the chord construction can fail to give a unique third point. The set of smooth points still forms a group, but a degenerate one: 𝔾ₘ ≅ K* for a node, 𝔾ₐ ≅ (K,+) for a cusp. You lose the rich arithmetic — no rank, no torsion structure of an elliptic curve. Nonsingularity (Δ ≠ 0) is exactly the condition that E has genus 1 rather than a rational parametrization.
Does the group law depend on the choice of Weierstrass equation?
The group is intrinsic to the curve E together with the base point O; it does not depend on coordinates. Any two Weierstrass models of the same elliptic curve are related by an admissible change of variables (x,y) ↦ (u²x + r, u³y + su²x + t), and this induces a group isomorphism fixing O. Different base points give isomorphic groups (translation is an automorphism of the variety), which is why 'elliptic curve' means a genus-1 curve with a chosen rational point.
Why the restriction char K ≠ 2, 3, and what changes otherwise?
The short form y² = x³ + ax + b requires dividing by 2 and 3 to complete the square and cube. In characteristic 2 or 3 you must use the general Weierstrass form y² + a₁xy + a₃y = x³ + a₂x² + a₄x + a₆. The group law still holds — the chord-and-tangent geometry is characteristic-free — but the explicit slope formulas and the discriminant expression differ. The Picard-group proof of associativity works over any field, including char 2 and 3.
How is E(K) related to the Picard group, and does that help compute?
The map P ↦ [(P) − (O)] is a group isomorphism E(K) ≅ Pic⁰(E), by Riemann–Roch for genus 1. This is not just a proof device: it means adding points is the same as adding divisor classes, which generalizes to Jacobians of higher-genus curves, where 'chord-and-tangent' has no analogue but the Picard group still gives a group law. For computation on E itself, the explicit rational formulas are far faster than manipulating divisors.