Elliptic curve cryptography, explained

1. What is an elliptic curve?

Despite the name, an elliptic curve isn't an ellipse. It's the set of points satisfying a deceptively simple equation:

Plotted over the real numbers it makes a smooth, symmetric curve — often a single sweeping arc, sometimes with a separate closed loop. The shape matters less than one remarkable property: you can "add" two points on the curve and always land on another point of the curve. That closure turns a piece of geometry into an algebraic system you can compute with.

2. Point addition: the strange arithmetic

"Adding" two points has nothing to do with adding coordinates. It's a geometric rule:

1. Draw a straight line through points P and Q.
2. That line will cross the curve at exactly one more point.
3. Reflect that third point across the x-axis. That reflection is P + Q.

To add a point to itself (called doubling), use the tangent line at that point instead. Repeat the doubling and you can reach enormous multiples very quickly — 2P, 4P, 8P, and so on.

In real cryptography we don't use smooth curves over the real numbers. We use curves over a finite field — the points become a scattered cloud of integer coordinates mod a prime — but the same addition rule applies algebraically. Here's an example on y² = x³ + 2x + 2 (mod 17):

Nothing about that sequence looks predictable — and that unpredictability is precisely the point.

3. The trapdoor — why it's one-way

Pick a starting point G (the generator) and a secret number k. Computing k × G — adding G to itself k times — is fast, even for astronomically large k, because you can double your way there in a few hundred steps.

That reverse problem is the elliptic curve discrete logarithm problem (ECDLP), and no efficient classical algorithm is known. Your private key is k; your public key is the point K. You can publish K freely and nobody can walk backwards to k.

4. ECC vs RSA: why smaller keys win

RSA's security depends on factoring being hard, and factoring algorithms have improved steadily — so RSA keys must keep growing. Attacks on the elliptic curve discrete log have improved far less, so ECC keys stay small.

Smaller keys mean less bandwidth, less storage, less battery and faster handshakes — which is why ECC dominates mobile, IoT and modern TLS.

5. ECDSA and how Bitcoin signs

ECDSA — the Elliptic Curve Digital Signature Algorithm — is how you prove you hold a private key without ever revealing it. Bitcoin and Ethereum both use the curve secp256k1.

Your Bitcoin address is derived from your public key point K. When you spend coins, your wallet produces a signature using the private key k. Every node on the network verifies that signature against K — confirming you authorised the transaction, without any node ever learning your key.

One critical caveat: every signature needs a fresh random number (the nonce). Reuse it, and anyone can compute your private key with simple algebra. That exact bug drained real wallets in 2013 when an Android RNG flaw produced repeated nonces.

6. Frequently asked questions

Is elliptic curve cryptography better than RSA?

For most new systems, yes — equivalent security with far smaller keys, faster operations and lower bandwidth. RSA remains common because of enormous existing deployment and simpler implementation.

What curve does Bitcoin use?

secp256k1, defined by y² = x³ + 7 over a 256-bit prime field. Ethereum uses the same curve.

Can quantum computers break ECC?

Yes — Shor's algorithm solves the elliptic curve discrete log just as it factors integers. ECC is actually more vulnerable than RSA per bit, which is why post-quantum migration matters for both.

What's the difference between ECC and ECDSA?

ECC is the underlying mathematics. ECDSA is one specific algorithm built on it (for signatures). ECDH, for key exchange, is another.

Why do people distrust some NIST curves?

Curves like P-256 use unexplained constants, prompting speculation after the Dual_EC_DRBG backdoor revelations. Alternatives such as Curve25519 use transparently derived parameters — "nothing up my sleeve" numbers.

Keep going