I am familiar with group theory and have encountered many different groups. I understand that the group operation can be defined many different ways and if it follows the group axioms, we are fine.

However, I cannot wrap my head around why we define the addition of two points on elliptic curve such that we connect them with a line, find the third intersection of that line with the curve and then make reflection around the x axis. The result is the addition.

Why does it make sense to add two points like this on the curve? What is the intuition behind this?

Source: For example this Wikipedia article, in particular, the section about the group law.

Thank you.

  • 5
    $\begingroup$ If you think of an elliptic curve as a torus, that is, the quotient of $\mathbb C$ by a lattice, then you recover the group law from the natural addition in $\mathbb C$. See, e.g., this. $\endgroup$
    – lulu
    Commented Aug 8, 2022 at 12:28
  • 3
    $\begingroup$ I think it's a little more natural if you think about it as follows: Take any line that intersects the curve at three points. Then the sum of those three points is 0. This way doesn't require you to pull any reflections out of thin air, and it has the added benefit of being entirely symmetrical in its treatment of the three points. It does require some reasoning to conclude from there that the "point at infinity" (which lies on the line if the line is vertical) is $0$, and the negative of a point is its reflection across the x-axis. $\endgroup$
    – Arthur
    Commented Aug 8, 2022 at 12:30
  • 3
    $\begingroup$ @Arthur It's not obvious why this should be associative, however... $\endgroup$
    – Zhen Lin
    Commented Aug 8, 2022 at 13:47
  • 5
    $\begingroup$ This is a long story. There is a second much more natural way to think about the group law in terms of what is called the divisor class group (in particular all the group axioms are easy to verify here). Then there is a big surprise that the divisor class group of an elliptic curve can be put in one-to-one correspondence with the curve itself, which transfers the group structure over. $\endgroup$ Commented Aug 8, 2022 at 14:04
  • $\begingroup$ @Arthur But why is the sum of such three points 0? $\endgroup$ Commented Aug 8, 2022 at 15:42

1 Answer 1


The group law on elliptic curves comes from looking at the functions of geometric surfaces, and trying to understand the behaviour of intersections.

When we look at the coordinate ring of an elliptic curve, we have: $$C = y^2 - x^3 - Ax - B$$ $$I = \langle C \rangle$$ $$K[V] = K[x, y] / I$$ As you can see, all polynomials that are multiple of the curve equation will also be equivalent to the $\bar{0}$ class in this ring.

We can also look at the points which disappear in this ring by taking the variety denoted $V(I) = \{ (a, b) \in K[x, y]: C(a, b) = 0 \}$. We also can look at the function field $K(V) = \{ f / g: f, g \in K[V] \}$, and begin to ask questions about where functions in this field disappear. That is for what points do they either become zero when $f(P) = 0$ or infinity when $g(P) = 0$.

By bezout's theorem, the sum of all these zeros (you can think of this as an intersection multiplicity) and infinities is the same as the curves degree, which in our case $\textrm{deg}(C) = 3$. For example given $P = (a, b)$, then the line $f = x - a$, will intersect $C$ at $P$ with a valuation of 1. Whereas when $f$ is a line tangent to the curve at $P$, then it can have a valuation of either 2 or even 3.

I won't go more into discrete valuation rings, but if you're interested to understand more then consult this sage file.

We can represent information about these curves using a divisor. $$\textrm{div}(x - a) = [(x - a, b)] + [(x - a, -b)] + [\infty] - 3[\infty]$$ Let $C = y^2 - x^3 + 4x$ on $\mathbb{F}_{11}$. Then $$\textrm{div}(y - 2x) = [(0, 0)] + 2[(2, 4)] - 3[\infty]$$ Which means $y - 2x$ intersects $C$ at the 3 points of $(0, 0), (2, 4), (2, 4)$. Since it is tangent, we count $(2, 4)$ twice. You could imagine slightly moving the line (or modify the curve roots slightly what we call perturbing), and you'd see that the single intersection will turn into 2 intersections.

As you can see when we take the zeros and infinities, the total sum of coefficients (what is called the divisor degree) becomes 0. Likewise the divisor of a function has a sum $\infty$. $$\textrm{deg}(y - 2x) = 1 + 2 - 3 = 0$$ $$\textrm{sum}(y - 2x) = 1\cdot(0, 0) + 2\cdot(2, 4) - 3\cdot \infty = \infty$$

It is an interesting property of divisors of functions that their degree is always 0, and sum is always $\infty$.

Divisors of functions (called principal divisors) belong to a group called $\textrm{Prin}(E)$.

Zero degree divisors (which includes principal divisors) make up a group denoted by $\textrm{Div}^0(E)$.

The quotient of these is a group called the Picard group $\textrm{Pic}^0(E)$, and there is an isomorphic map $$J : E(K) \rightarrow \textrm{Pic}^0(E)$$ $$J(P) = [P] - [\infty]$$ This is for elliptic curves, and it can be shown that the operation on the right inside the Picard group corresponds to a geometric interpretation (what you know as the elliptic curve group law).

Given ideal classes $\bar{D_1}, \bar{D_2} \in \textrm{Pic}^0(E)$, then we define equivalence $\bar{D_1} \sim \bar{D_2} \iff D_1 - D_2 \in \textrm{Prin}^0(E)$.

But actually with higher degree surfaces, this group law operation involving lines no longer works because any curve will intersect at n places on the curve.

It can be shown that every curve has a reduced divisor representation which corresponds to $$[P_1] + \cdots + [P_g] - g[\infty]$$

It just so happens that elliptic curves have $g = 1$, and so we get the simple isomorphic map between the Picard group using the mapping $J$ above. In fact all genus 1 curves are isogenous to elliptic curves (hence their usefulness).

My aim with this isn't a rigorous treatment of the topic, but an intuitive introduction and some leads where to look. Lmk if that helps.

  • $\begingroup$ Does anyone know why my curly braces for set notation do not appear? $\endgroup$ Commented Aug 13, 2022 at 12:57
  • 1
    $\begingroup$ hi Ignatio. to obtain curly braces in latex you want to write \{ and \} instead of { and } $\endgroup$ Commented Aug 13, 2022 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .