An elliptic curve is a curve defined by $y^2 = x^3 + ax + b$ (over a finite field). ECC provides the same security as RSA with much smaller key sizes — 256-bit ECC ≈ 3072-bit RSA.

* A non-singular elliptic curve is smooth and mirror-symmetric across the x-axis; a point P and its reflection −P are additive inverses. *

Mathematical definition: An elliptic curve over a field $\mathbb{F}$ is the set of points $(x, y)$ satisfying: $$y^2 = x^3 + ax + b$$ plus a special "point at infinity" $\mathcal{O}$ (the neutral element).

The discriminant $4a^3 + 27b^2 \neq 0$ must hold (ensures no singularities).

Why ECC for cryptography:

• Much shorter keys: 256-bit ECC ≈ 3072-bit RSA security
• Faster operations: Especially important for constrained devices (smart cards, IoT)
• No subexponential attacks known: Unlike RSA (where number field sieve exists), the best attack on ECC is still exponential (Pollard's rho)
• Used everywhere: TLS 1.3, Signal, Bitcoin, SSH, mobile devices

The group operation: Points on the curve form a group under "point addition" — geometrically, draw a line through two points, find the third intersection, and reflect over the x-axis. This replaces multiplication in RSA with addition on the curve.

Go deeper:

• Elliptic-curve cryptography — Wikipedia — curve equation, group law, and the RSA key-size parity in one place.
• Corbellini — ECC: a gentle introduction (part 1) — the clearest visual walk-through of curves and the group operation.

To add points P and Q: draw a line through them, find where it intersects the curve at a third point R, then reflect R over the x-axis. This is the group operation. "Double-and-add" is the ECC equivalent of square-and-multiply.

* The line through P and Q hits the curve at a third point R′; reflecting R′ over the x-axis gives R = P + Q. Adding coordinates directly would land off the curve. *

Point addition (P + Q where P ≠ Q):

1. Draw a line through P and Q
2. The line intersects the curve at a third point $R'$
3. Reflect $R'$ over the x-axis → $R = P + Q$

Point doubling (P + P = 2P):

1. Draw the tangent line to the curve at P
2. The tangent intersects the curve at $R'$
3. Reflect → $R = 2P$

Special cases:

• $P + \mathcal{O} = P$ (point at infinity is the identity)
• $P + (-P) = \mathcal{O}$ (a point plus its reflection = infinity)

Double-and-add (analogous to square-and-multiply):

• To compute $k \cdot P$ (scalar multiplication): express $k$ in binary, scan left to right
• For each "0" bit: double the accumulator
• For each "1" bit: double then add P
• This computes $k \cdot P$ in $O(\log k)$ operations instead of $O(k)$

Tip: In ECC, "addition" replaces "multiplication" and "scalar multiplication" ($k \cdot P$) replaces "exponentiation" ($g^k$). The notation changes but the structure is identical to DH/ElGamal.

Go deeper:

• Corbellini — ECC part 2: finite fields and discrete logarithms — point addition over $\mathbb{F}_p$ and scalar multiplication, with runnable code.
• Elliptic curve point multiplication — Wikipedia — the add/double formulas and the double-and-add algorithm.