# ¶ Point Group Operation

The point group operation for an elliptic curve is derived by geometric considerations on the curve in Weierstraß normal form ${y}^{2}={x}^{3}+ax+by^2 = x^3 + ax + b$ over the real numbers.

Because it is defined by an algebraic equation in the third degree, a straight line can intersect such a curve at at most three points in the $\left(x,y\right)\left(x,y\right)$ plane.

The basic point group operation $\oplus \oplus$ consists in finding the reflection across the x-axis of the third point of intersection of the curve with a line through two given points on the curve.

A few “fixes” are applied to make a mathematical group out of the basic point operation.

group n. a set $GG$ together with an operation $\oplus \oplus$ with the following properties:

• closure: $\left(\mathrm{\forall }g,h\in G\right)\text{\hspace{0.17em}}g\oplus h\in G\left(\forall g,h\in G\right)\,g\oplus h\in G$;
• associativity: $\left(\mathrm{\forall }f,g,h\in G\right)\text{\hspace{0.17em}}\left(f\oplus g\right)\oplus h=f\oplus \left(g\oplus h\right)\left(\forall f,g,h\in G\right)\,\left(f\oplus g\right)\oplus h = f\oplus \left(g\oplus h\right)$;
• identity with inverses:

\left(\mathrm{\exists }\mathbf{0}\in G\right)\left(\mathrm{\forall }g\in G\right)\left\{\begin{array}{cc}g\oplus \mathbf{0}& =g;\\ \mathbf{0}\oplus g& =g;\\ \left(\mathrm{\exists }{\text{\hspace{0.17em}}}^{\ominus }\text{\hspace{0.17em}⁣}g\in G\right)& \left\{\begin{array}{c}g\oplus {\text{\hspace{0.17em}}}^{\ominus }\text{\hspace{0.17em}⁣}g=\mathbf{0};\\ {\text{\hspace{0.17em}}}^{\ominus }\text{\hspace{0.17em}⁣}g\oplus g=\mathbf{0.}\end{array}\end{array}\left(\exists \mathbf 0\in G\right) \left(\forall g\in G\right) \left\\left\{\begin\left\{aligned\right\} g\oplus \mathbf 0 & =g; \\ \mathbf 0\oplus g & = g; \\ \left(\exists \left\{\,\right\}^\left\{\ominus\right\}\!g\in G\right) & \left\\left\{ \begin\left\{matrix\right\} g\oplus \left\{\,\right\}^\left\{\ominus\right\}\!g = \mathbf 0; \\ \left\{\,\right\}^\left\{\ominus\right\}\!g\oplus g=\mathbf 0. \end\left\{matrix\right\}\right. \end\left\{aligned\right\}\right.

A group is said to be Abelian (after Niels Henrik Abel) if its group operation is commutative:

$\left(\mathrm{\forall }g,h\in G\right)g\oplus h=h\oplus g\mathrm{.}\left(\forall g,h\in G\right)g\oplus h=h\oplus g.$

An additional “point at infinity” is adjoined to the $\left(x,y\right)\left(x,y\right)$ plane, and considered to lie on the curve, although it is not given coördinates in the real numbers. This point is the identity for the group operation. (The inverse consists in taking the reflection of a point across the x-axis.)

The operation of a point with itself, called point-doubling, is defined similarly, but by considering the line tangent to the curve at that point rather than through two distinct points.

## ¶ Algebraic derivation

Given two points that lie on a given elliptic curve,

${P}_{1}=\left({x}_{1},{y}_{1}\right),\phantom{\rule{2em}{0ex}}{P}_{2}=\left({x}_{2},{y}_{2}\right),P_1 = \left(x_1,y_1\right),\qquad P_2 = \left(x_2,y_2\right),$

the objective is to find the “third point” and calculate the “group sum” of the first two points:

${P}_{3}=\left(x,y\right),\phantom{\rule{2em}{0ex}}{P}_{1}\oplus {P}_{2}=\left(x,-y\right)\mathrm{.}P_3=\left(x,y\right),\qquad P_1\oplus P_2=\left(x,-y\right).$

Once we have defined a suitably consistent algebraic definition for the so-called point group operation on an elliptic curve, we are freed from geometric considerations and able to consider the operation on the elliptic curve over other algebraic fields that have no geometric analogue.

Let

be the slope of the line, either through $\left({x}_{1},{y}_{1}\right)\left(x_1,y_1\right)$ and $\left({x}_{2},{y}_{2}\right)\left(x_2,y_2\right)$ or tangent to the curve (in Weierstraß normal form) at $\left({x}_{1},{y}_{1}\right)\left(x_1,y_1\right)$ if ${x}_{2}={x}_{1}x_2=x_1$ and ${y}_{2}={y}_{1}y_2=y_1$.

Substitute the equation for the line into that for the elliptic curve to find the “third point:”

\begin{array}{cc}y-{y}_{1}& =m\left(x-{x}_{1}\right)\\ y& =mx+{y}_{1}-m{x}_{1}\\ {y}^{2}& ={m}^{2}{x}^{2}+2m\left({y}_{1}-m{x}_{1}\right)x+\left({y}_{1}^{2}-2m{x}_{1}{y}_{1}+{m}^{2}{x}_{1}^{2}\right)\\ {y}^{2}& ={x}^{3}+ax+b\\ & \phantom{=}{x}^{3}-{m}^{2}{x}^{2}+\left[a+2m\left(m{x}_{1}-{y}_{1}\right)\right]x+\left(b-{y}_{1}^{2}+2m{x}_{1}{y}_{1}-{m}^{2}{x}_{1}^{2}\right)=0\end{array}\begin\left\{aligned\right\} y - y_1 &= m\left(x-x_1\right) \\ y &= mx + y_1 - mx_1 \\ y^2 &= m^2x^2 + 2m\left(y_1-mx_1\right)x + \left(y_1^2 - 2mx_1y_1 + m^2x_1^2\right) \\ y^2 &= x^3 + ax + b \\ &\phantom\left\{=\right\} x^3 - m^2x^2 + \left[a+2m\left(mx_1-y_1\right)\right]x + \left(b - y_1^2 + 2mx_1y_1 - m^2x_1^2\right) =0 \end\left\{aligned\right\}

Factor out the first two points $\left(x-{x}_{1}\right)\left(x-{x}_{2}\right)={x}^{2}-\left({x}_{1}+{x}_{2}\right)x+{x}_{1}{x}_{2}\left(x-x_1\right)\left(x-x_2\right)=x^2-\left(x_1+x_2\right)x+x_1x_2$ from ${x}^{3}+ax+bx^3+ax+b$ and find the remainder by long division.

$\begin{array}{ccc}& x& +\left({x}_{1}+{x}_{2}\right)\\ {x}^{2}-\left({x}_{1}+{x}_{2}\right)x+{x}_{1}{x}_{2}\phantom{\rule{21em}{0em}}\phantom{\rule{-21em}{0ex}}\right)& {x}^{3}& & +ax& +b\phantom{\rule{2em}{0ex}}\\ & {x}^{3}& -\left({x}_{1}+{x}_{2}\right){x}^{2}& +{x}_{1}{x}_{2}x\phantom{\rule{-14em}{0ex}}\phantom{\rule{14em}{0em}}\\ & & \left({x}_{1}+{x}_{2}\right){x}^{2}& +\left(a-{x}_{1}{x}_{2}\right)x& +b\phantom{\rule{2em}{0ex}}\\ & & \left({x}_{1}+{x}_{2}\right){x}^{2}& -\left({x}_{1}+{x}_{2}{\right)}^{2}x& +\left({x}_{1}+{x}_{2}\right){x}_{1}{x}_{2}\phantom{\rule{-18.5em}{0ex}}\phantom{\rule{18.5em}{0em}}\\ & & & & \phantom{\rule{-15em}{0ex}}R=\left(a+{x}_{1}^{2}+{x}_{1}{x}_{2}+{x}_{2}^{2}\right)x+b-{x}_{1}^{2}{x}_{2}-{x}_{1}{x}_{2}^{2}\end{array}\begin\left\{array\right\}\left\{rrrrr\right\} &x&+\left(x_1\left\{+\right\}x_2\right)\\ x^2-\left(x_1\left\{+\right\}x_2\right)x+x_1x_2\rule\left[2ex\right]\left\{21em\right\}\left\{\right\}\hspace\left\{-21em\right\}\right) & x^3 & & +ax & +b\qquad\\ &x^3&-\left(x_1\left\{+\right\}x_2\right)x^2&+x_1x_2x\hspace\left\{-14em\right\}\rule\left[-0.5ex\right]\left\{14em\right\}\left\{\right\}\\ &&\left(x_1\left\{+\right\}x_2\right)x^2&+\left(a\left\{-\right\}x_1x_2\right)x&+b\qquad\\ &&\left(x_1\left\{+\right\}x_2\right)x^2&-\left(x_1\left\{+\right\}x_2\right)^2x& +\left(x_1\left\{+\right\}x_2\right)x_1x_2\hspace\left\{-18.5em\right\}\rule\left[-0.5ex\right]\left\{18.5em\right\}\left\{\right\}\\ &&&&\hspace\left\{-15em\right\}R= \left(a\left\{+\right\}x_1^2\left\{+\right\}x_1x_2\left\{+\right\}x_2^2\right)x+b-x_1^2x_2-x_1x_2^2 \end\left\{array\right\}$

\begin{array}{cc}{y}^{2}& =\left(x-{x}_{1}\right)\left(x-{x}_{2}\right)\left({x}_{1}+{x}_{2}+x\right)+{x}_{1}^{2}x+{x}_{1}{x}_{2}x+{x}_{2}^{2}x-{x}_{1}^{2}{x}_{2}-{x}_{1}{x}_{2}^{2}+ax+b\\ {x}^{3}& =\left(x-{x}_{1}\right)\left(x-{x}_{2}\right)\left({x}_{1}+{x}_{2}+x\right)+{x}_{1}^{2}x+{x}_{1}{x}_{2}x+{x}_{2}^{2}x-{x}_{1}^{2}{x}_{2}-{x}_{1}{x}_{2}^{2}\end{array}\begin\left\{aligned\right\} y^2 &= \left(x-x_1\right)\left(x-x_2\right)\left(x_1+x_2+x\right) + x_1^2x + x_1x_2x + x_2^2x -x_1^2x_2-x_1x_2^2 + ax + b \\ x^3 &= \left(x-x_1\right)\left(x-x_2\right)\left(x_1+x_2+x\right) + x_1^2x + x_1x_2x + x_2^2x -x_1^2x_2-x_1x_2^2 \end\left\{aligned\right\}