Introduction
Elliptic curves are the backbone of modern public-key cryptography. ECDSA signs every Bitcoin transaction, EdDSA signs SSH keys and Signal messages, and ECDH exchanges keys in TLS, WhatsApp, and Apple iMessage. All of these rely on the same algebraic operation: adding points on a curve over a prime field. This elliptic curve calculator lets you do that arithmetic by hand in the browser. Pick a curve, enter points, and watch point addition, doubling, and scalar multiplication produce exact BigInt results. No data leaves your device.
What this tool does
- Computes point addition P + Q on the curve y^2 = x^3 + ax + b mod p using the chord-and-tangent rule.
- Computes point doubling 2P for the case P = Q using the tangent line.
- Computes scalar multiplication kP using double-and-add, the operation that underpins ECDSA and ECDH.
- Checks whether a point lies on a given curve, which is the first thing every ECDSA verifier does.
- Ships presets for the toy curve y^2 = x^3 + 2x + 2 mod 17, NIST P-192, secp192k1, and the Curve25519 field, with full a, b, p editing for custom curves.
- Uses BigInt arithmetic so results are exact even for 192-bit and larger primes.
How this tool works
Pick a preset or enter the curve parameters a, b, and the prime p. Enter a point P with coordinates P.x and P.y. The tool first checks that P satisfies y^2 = x^3 + ax + b mod p; if it does not, you get an error because the point is not on the curve.
For point addition, enter a second point Q and the tool computes the slope lambda = (Q.y - P.y) / (Q.x - P.x) mod p, then R = (lambda^2 - P.x - Q.x, lambda(P.x - R.x) - P.y) mod p. For doubling, the slope is lambda = (3 P.x^2 + a) / (2 P.y) mod p. For scalar multiplication, the tool uses double-and-add: it squares the point repeatedly and adds when the corresponding bit of k is set. All modular inverses are computed with the extended Euclidean algorithm. The point at infinity is returned when P + (-P) or when kP lands on the identity element.
How elliptic curve cryptography works
An elliptic curve over a prime field F_p is the set of points (x, y) satisfying y^2 = x^3 + ax + b mod p, plus a point at infinity O that acts as the identity. The discriminant 4a^3 + 27b^2 must be nonzero mod p so the curve is non-singular.
The group law is geometric: to add P and Q, draw the line through them (or the tangent if P = Q), find the third intersection with the curve, and reflect it across the x-axis. Over a finite field the geometry is replaced by modular arithmetic, but the formulas are the same. The result is an abelian group where computing kP from k and P is easy, but recovering k from P and kP is the elliptic curve discrete logarithm problem (ECDLP), which is believed to be hard.
NIST standardized curves like P-256, P-384, and P-521 in FIPS 186-5. Curve25519, designed by Daniel J. Bernstein, is specified in RFC 7748 and used for X25519 key exchange and Ed25519 signatures. secp256k1, the curve Bitcoin uses, is defined in SEC 2. The toy curve y^2 = x^3 + 2x + 2 mod 17 has 19 points and is small enough to enumerate by hand, which is why it shows up in textbooks like Lawrence Washington's *Elliptic Curves: Number Theory and Cryptography*.
The security of ECC comes from the ECDLP. For a curve over a 256-bit prime, the best known attack (Pollard's rho) takes roughly 2^128 operations, which matches the security of a 3072-bit RSA key. That is why ECC keys are so much smaller than RSA keys at equivalent strength.
How to use this tool
- Pick a preset curve or enter a, b, and the prime p manually. The toy curve is a good starting point.
- Enter a point P with coordinates P.x and P.y. The tool verifies it is on the curve.
- Choose an operation: point addition, doubling, scalar multiplication, or on-curve check.
- For addition, enter a second point Q. For scalar multiplication, enter the scalar k.
- The result appears instantly in the output field. The point at infinity is shown as O.
Real-world examples
Working the toy curve by hand
On y^2 = x^3 + 2x + 2 mod 17, the point (5, 1) is on the curve because 1 = 125 + 10 + 2 = 137 = 137 mod 17 = 1. Doubling it gives 2P = (6, 3). Adding P + 2P gives 3P = (10, 11). Walking through these steps by hand is the standard first exercise in any ECC textbook, and this tool lets you check each step.
Verifying an ECDSA public key
A developer receives an ECDSA public key as a point on secp256k1 and wants to confirm it is on the curve before trusting it. They select the secp192k1 preset (or enter the secp256k1 parameters a=0, b=7, p=2^256 - 2^32 - 977), paste the public key coordinates, and run the on-curve check. The tool confirms the point satisfies the curve equation, which is the first validation step every ECDSA verifier performs.
Exploring the discrete logarithm hardness
A student picks a generator P on the toy curve, computes kP for k = 1, 2, 3, ... and watches the points jump around the curve pseudorandomly. They then try to recover k from P and kP by inspection, which is infeasible even on a 19-point curve without enumerating all multiples. This builds intuition for why the ECDLP is hard on real curves with 2^256 points.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| ECC P-256 | ~128-bit security, 256-bit keys | TLS, ECDSA, ECDH |
| RSA 3072 | ~128-bit security, 3072-bit keys | Legacy TLS, code signing |
| Ed25519 | ~128-bit security, 256-bit keys | SSH, Signal, EdDSA |
| Curve25519 (X25519) | ~128-bit security, 256-bit keys | TLS 1.3 key exchange |
Limitations or considerations
This tool implements the group law over a prime field F_p. It does not support binary extension fields (GF(2^m)) or pairing-friendly curves. The scalar multiplication uses double-and-add, which is constant-time in the number of bits of k but not in the value of k, so it is not safe to use in side-channel-resistant implementations. Real ECC libraries use Montgomery ladders or Edwards-curve formulas for constant-time scalar multiplication. The presets include real curve parameters but this tool is for education and verification, not for generating production keys. Use the SSH Key Generator or PGP Key Generator tools for real key generation.
Frequently asked questions
What is the point at infinity?
It is the identity element of the elliptic curve group, written O. Adding O to any point P returns P. It is the result when you add P and -P (the point with the same x coordinate and negated y). In the formulas it is handled as a special case because there is no (x, y) pair that represents it.
Why does scalar multiplication use double-and-add?
Double-and-add is the elliptic curve analogue of square-and-multiply for modular exponentiation. It computes kP in O(log k) group operations by processing the bits of k from least to most significant. For a 256-bit scalar that is at most 256 doublings and 256 additions, which is why ECDSA signature verification is fast.
Why are ECC keys so much smaller than RSA keys?
The best known attack on RSA is the general number field sieve, which runs in sub-exponential time. The best known attack on the ECDLP is Pollard's rho, which runs in exponential time (square root of the group order). That means a 256-bit ECC key gives the same security as a 3072-bit RSA key, because the ECDLP is harder relative to the key size.
Can I use this tool to generate real cryptographic keys?
No. The scalar multiplication here is not constant-time, the random number generation is not used, and the tool does not produce keys in any standard format. Use the SSH Key Generator for Ed25519 SSH keys, the PGP Key Generator for OpenPGP keys, or the Key Pair Generator for RSA and ECDSA PEM keys.
Conclusion
This elliptic curve calculator makes the group law concrete: point addition, doubling, and scalar multiplication on y^2 = x^3 + ax + b mod p with exact BigInt arithmetic. Use it to work textbook examples by hand, verify that ECDSA public keys are on their curve, or build intuition for why the ECDLP is hard. For real key generation, use the SSH Key Generator or PGP Key Generator tools.