View source for Point group operation

:'' '''Caveat emptor:''' This article is incomplete, and more critical than others at this site. See any of various theses on the topic <ref>Noraldeen Alyounes. ''Elliptiska kurvor och kryptografi.'' Examensarbete i matematik, Uppsala Universitet, Februari 2020. https://uu.diva-portal.org/smash/get/diva2:1395121/FULLTEXT01.pdf</ref><ref>Gunendra Bikram Bidari. ''An algorithmic approach to elliptic curve cryptography.'' Thesis, ME in Computer Engineering, Kathmandu University, 2014. Lambert Academic Publishing, 2015.</ref>. This is proof that the unlearned and obstinate men, who have so far purported to implement “elliptic curve cryptography” and put their patented cryptographic schemes to widespread use under that name, had already been served with adequate instructions and examples, when they insisted on calling the law and getting all the details wrong in their official implementations and protocols.

== Geometric derivation ==

A '''point group operation''' on an elliptic curve is derived by geometric considerations on the curve in [[Weierstraß normal form]] <math>y^2 = x^3 + ax + b</math> over the real numbers.

Because it is defined by an algebraic equation in the third degree, a straight line can intersect such a curve at at most three points in the Euclidean <math>(x,y)</math> plane.

=== Point addition ===

The basic point group operation <math>\oplus</math> consists in finding the reflection across the ''x''-axis of the third point of intersection of the curve with a line through two given points on the curve.

[[Image:Pgo-1.svg]]

Some or all of the points on the elliptic curve, together with the point group operation <math>\oplus</math>, make out an [[Abelian group]].

An additional [[point at infinity]] is adjoined to the <math>(x,y)</math> plane, and considered to lie on the curve, although it is not given coördinates in the real numbers. This point is the [[group identity]]. The [[group inverse]] consists in taking the reflection of a point across the ''x''-axis.

=== Point-doubling ===

The special case of the addition operation of a point with itself, called '''point-doubling''', is defined similarly, but by considering the line tangent to the curve at that point rather than through two distinct points.

[[Image:Pgo-2.svg|right]]
[[Image:Point-doubling.R.svg]]

== Algebraic derivation ==

Let <math>y=mx+c</math> be the '''resolvent equation''' of the line passing through two given points ''P'' and ''Q'' of an elliptic curve <math>y^2=x^3+ax+b</math>. Square the resolvent on both sides, place it over the equation for the elliptic curve, (here the [[Weierstraß normal form]],) and subtract to find the '''resultant equation'''.

:<math>\begin{array}{rrrrrl}
y^2=&&m^2x^2&{}+2mcx&{}+c^2\\
y^2=&x^3&&{}+ax&+{}b \\ \hline
&-x^3&{}+m^2x^2&{}+(2mc-a)x&{}+c^2-b&{}=0
\end{array}</math>


'''[[long division|Divide]]''' the factors for the two given points ''P'' and ''Q'' together with the leading coefficient

:<math>-(x-x_P)(x-x_Q)=-x^2+(x_P+x_Q)x-x_Px_Q</math>

into the resultant to find the ''x''-coördinate of the third point ''R'' on the elliptic curve through which the same line passes. 

<math>\begin{array}{r|rrrrl} 
&&&x&{}-{m^2-x_P\choose -x_Q}\\ \hline
-x^2+(x_P+x_Q)x-x_Px_Q & -x^3&{}+m^2x^2&{}+(2mc-a)x&{}+c^2-b \\
&-x^3&{}+(x_P+x_Q)x^2&{}-x_Px_Qx\\ \hline
&&{m^2-x_P\choose -x_Q}x^2 &{}+{2mc-a\choose {}+x_Px_Q}x&{}+c^2-b\\
&&{m^2-x_P\choose -x_Q}x^2&{}-{x_Pm^2+x_Qm^2\choose -x_P^2-2x_Px_Q-x_Q^2}x&{}+{x_Px_Qm^2\choose -x_P^2x_Q-x_Px_Q^2} \\ \hline
R=&&&{(x_P+x_Q)m^2 +2mc -a \choose -x_P^2-x_Px_Q-x_Q^2}x&{}+{-x_Px_Qm^2+c^2-b\choose -x_P^2x_Q-x_Px_Q^2}
\end{array}</math>

The '''remainder''' might be set equal to zero term by term (as we know it is having obtained three linear factors of a cubic equation) and then (with the variable ''x'' eliminated) a system of two quadratic equations <ref>Adelaide Denis. “A Discussion of the Cases when Two Quadratic Equations Involving Two Variables can be Solved by the Method of Quadratics.” ''The American Mathematical Monthly,''
vol. 10, no. 8/9, Aug. - Sep., 1903. [[File:Denis-DiscussionCasesTwo-1903-9-jam8-join.pdf]] https://www.jstor.org/stable/2971350</ref> is left to sort out and solve for ''m'' and ''c'', the coefficients of the resolvent equation for the line passing through ''P'' and ''Q''.

:<math>\begin{array}{rcl}
(x_P+x_Q)m^2 +2mc -a -x_P^2-x_Px_Q-x_Q^2 &=& 0\\
-x_Px_Qm^2+c^2-b -x_P^2x_Q-x_Px_Q^2 &=& 0
\end{array}</math>

However, we already know the slope ''m'' of the resolvent line equation, up to four choices of sign for ''y''<sub>''P''</sub> and ''y''<sub>''Q''</sub> respectively, and we have the ''x''-coördinate of the third point <math>R=(x,y)</math> in terms of it, from the '''quotient''' already calculated. The special case of point-doubling (when ''Q''=''P'') is addressed by taking the derivative of the elliptic curve through that point to calculate the slope of the tangent line.

:<math>m=\left\{\begin{array}{lr}
\dfrac{\pm\sqrt{x_Q^3+ax_Q+b}
\mp\sqrt{x_P^3+ax_P+b}}{x_Q-x_P},&
x_Q\ne x_P;\\
\pm\dfrac{3x_P^2+a}{2\sqrt{x_P^3+ax_P+b}},&
x_Q=x_P,\;y_Q=y_P;\\
\infty,&
x_Q=x_P,\;y_Q=-y_P.
\end{array}\right.
</math>

:<math></math>

:<math>x=m^2-x_P-x_Q</math>

:<math>y=\pm\sqrt{x^3+ax+b}</math>

Now

:<math>(x_P,y_P)\oplus(x_Q,y_Q) = (x,-y)</math>

or

:<math>P\oplus Q=-R</math>

reflecting across the ''x''-axis to find the “sum” point opposite ''R''.