# Points on elliptic curves

I am learning elliptic curves theorem and I have read in more papers that for two distinct points $P$ and $Q$ there is always point $R$ such that $P+Q+R = \infty$. I know that this point should be unique according to all possible shapes of the curve and intersections (http://en.wikipedia.org/wiki/Elliptic_curve). But is there a simple way how to prove uniqueness of such a point $R$?

• The points on an elliptic curve form an abelian group...and everything in a group has an inverse. – fretty Nov 17 '13 at 12:38
• @fretty The question likely being asked in the context of trying to prove exactly this. Maybe the OP can clarify what the context is (in particular, how "$+$" is defined in this context)? – Jan Ladislav Dussek Nov 18 '13 at 19:44
• What is true is that as divisors on the elliptic curve $E$, for all $P,Q$, there exists $R$ such that $P+Q \sim \infty + R$ (linear equivalence). This results from Riemann-Roch theorem for $E$. Moreover $R$ is unique because if another $R'$ satisfies the same relation, then $R\sim R'$. This can happen with $R\ne R'$ if and only if we are in a curve of genus $0$, but $E$ has genus $1$. So $R=R'$. – Cantlog Nov 18 '13 at 22:22
• I just had a look at the wikipedia page you linked to. The $R$ is such that $P+Q+R \sim 3 \infty$. It is given by the intersection of the cubic (elliptic curve) with the line in $\mathbb P^2$ passing through $P, Q$. By Bezout, this intersection consists in general in three points $P, Q, R$. But $R$ could coincide with $P$ or $Q$. – Cantlog Nov 18 '13 at 22:26

As what was said in the comments, it is obvious that $P+Q\in E$. So let's just say that $S=P+Q$. Now, since points on an elliptic curve form a group (abelian group), there is an inverse for $S$. Notice that $S$ must satisfy the equation of $E$ to lie on $E$.
So say $E$ is given by the equation $y^2=x^3+ax+b$. Now, since $\mathcal{O}$ is the point of infinity, the inverse of our point $S$ must lie on the line $$x=\text{x-coordinate of S}.$$
Note that plugging the line into the equation of $E$ will give us at most two solutions, so one solution belongs to $S$, while the other gives us the unique inverse.