Mathematics Stack Exchange is a question and answer site for people studying math at any level and professionals in related fields. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I'm trying to understand the group of points of $y^2=x^3+1$ over $\mathbb{F}_5$ and for some reason I seem to be getting nonsense answers and I'm not sure what I'm doing wrong.

So basically my formulas for this particular elliptic curve are:

$\lambda=\frac{y_1-y_2}{x_1-x_2}$, or $\frac{3x^2}{2y}$ if we're doubling the point.

$x_3=\lambda^2 -x_1-x_2$

$y_3=\lambda x_3+y_1-\lambda x_1$

My points are: $O,(0,1),(0,4),(4,0),(2,3),(2,2)$. Now maybe someone could just clue me in right away as to whether any of these points can be the identity element in disguise, because $(0,1)$ and $(0,4)$ definitely seem to be. But upon adding some of the other points to each other I'm getting that the other three points all have order two, so I was thinking the Klein-4 Group, but then for instance $(4,0)+(2,2)=(2,2)$ which means that $(4,0)$ must be the identity, and I'm just thoroughly confused.

It would seem to me that the only points which could be the identity would be the $(0,1)$ and $(0,4)$ since those have zero in the x-coordinate, but the only way all my computation makes sense is if they're all the identity. However I'm not sure how much of this reasoning carries over to finite fields.

share|cite|improve this question
Have you double checked your calculations? Anyways, the identity of an elliptic curve (in Weierstrass form) is always the point at infinity; none of the points that can be expressed in $(x,y)$ coordinates can be the identity. – Hurkyl Feb 15 '13 at 22:33
Well I just checked again that $2(0,1)=(0,1)$. – esproff Feb 15 '13 at 22:35
Yah Wikipedia's is a bit different. Mine's coming from Rational Points on Elliptic Curves by Silverman. But no matter what $(4,0)+(2,2)$ equals, the fact that $(0,1)+(0,1)=(0,1)$ is already nonsense. – esproff Feb 15 '13 at 22:45
up vote 1 down vote accepted

The point $(x_3, y_3)$ is the third points of intersection of your curve with the line through $(x_1, y_1)$ and $(x_2, y_2)$; it is not their sum, but rather minus their sum (three co-linear points $P,Q,R$ satisfy $P+Q+R=O$). With the formulae you have written down, the sum of $(x_1, y_1)$ and $(x_2, y_2)$ is in fact $(x_3, -y_3)$.

As Hurkyl remarks, the identity is the point at infinity on your curve. None of your points could be "the identity in disguise".

share|cite|improve this answer
oh CHrist! I forgot about that, thanks. – esproff Feb 15 '13 at 23:29
@cat No worries, it happens. All the best! – Bruno Joyal Feb 15 '13 at 23:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.