λ = (y₂ − y₁) / (x₂ − x₁) for a chord,   λ = (3x₁² + a) / (2y₁) for the tangent when P = Q

x₃ = λ² − x₁ − x₂,   y₃ = λ(x₁ − x₃) − y₁,   P + Q = (x₃, y₃)

Why x₃ is λ² − x₁ − x₂. Put the line y = λx + c into the curve's equation and you get a cubic, x³ − λ²x² + … = 0, whose three roots are the three places the line meets the curve. The roots of a cubic add up to minus its x² coefficient, here λ². Two of them are x₁ and x₂, so the third is what's left. The tangent slope comes from differentiating: 2y dy = (3x² + a) dx.

Why the reflection. Declare that three points on a line add up to O and the law becomes a group. O is the identity, −P is P's mirror image, and the order of the points never matters. Associativity, (P + Q) + R = P + (Q + R), is a theorem about cubics, and no picture makes it obvious. The tests behind this page check it on every toy curve.

Why singular curves are excluded. When 4a³ + 27b² = 0 the cubic has a repeated root. There both partial derivatives of y² − x³ − ax − b vanish, so there's no single tangent and P + P is undefined. The other points still add, but it's only the field's own arithmetic in disguise, which hides nothing. Standards require 4a³ + 27b² ≠ 0.

#E = p + 1 + ∑_x χ(x³ + ax + b),   χ(v) = v^(p−1)/2 mod p ∈ {1, −1, 0}

|#E − (p + 1)| ≤ 2√p   (Hasse),   r_i+1 = r_i−1 − q_ir_i,   t_i+1 = t_i−1 − q_it_i

Why the count works. For each x the curve needs y² = v. A nonzero square v has exactly two square roots mod p, zero has one, and a non-square has none, which is 1 + χ(v) points. Add that up over every x, then add O. Why Euler's criterion. By Fermat's little theorem v^p−1 = 1, so v^(p−1)/2 is a square root of 1, which means it's 1 or −1. It's 1 exactly when v is itself a square.

Why the inverse table works. Start with r = p (t = 0) and r = d (t = 1). Every row keeps r ≡ t × d (mod p), because each new row is the row two above minus q times the row above. The remainders shrink to gcd(d, p) = 1, and the row where r = 1 says 1 ≡ t × d, so that t is d⁻¹. Hasse proved in the 1930s that the count never strays more than 2√p from p + 1. The difference is called the trace.

⟨G⟩ = {O, G, 2G, …, (n − 1)G},   n | #E   (Lagrange),   h = #E / q for the largest prime q dividing #E

q × (hP) = (#E)P = O   for every point P,   so hP lies in the subgroup of order q

Why n divides #E. The multiples of G form a subgroup, and Lagrange's theorem says a subgroup's size divides the group's. Every coset of ⟨G⟩ has exactly n points, and the cosets split the whole curve. That's also how the page finds an order quickly: start from #E and divide out each prime while the multiple is still O.

Why prime order matters for key agreement. If q is prime, every point of the subgroup except O has order q. Each one generates the whole group, and every secret from 1 to q − 1 gives a different public key. With a composite order, some points live in small subgroups, and there a secret has only a few possible values. Cofactor clearing multiplies by h to push any point into the prime-order part, and X25519 does it by making every secret a multiple of 8.

double-and-add: L − 1 doublings + popcount(k) − 1 additions,   repeated addition: k − 1 additions,   ladder: L additions + L doublings

bit 0: (R₀, R₁) ← (2R₀, R₀ + R₁),   bit 1: (R₀, R₁) ← (R₀ + R₁, 2R₁),   starting from (O, G)

Why double-and-add works. Reading k from its top bit, doubling shifts the bits read so far one place left and adding G sets the new bottom bit. After every step R is the prefix of k read so far, times G. With L the bit length of k, the cost is about 1.5 L operations instead of k: for a 256-bit key, 384 operations instead of 2²⁵⁶.

Why the ladder's invariant holds. It starts with R₁ − R₀ = G − O = G. After a 0 bit the difference is (R₀ + R₁) − 2R₀ = R₁ − R₀. After a 1 bit it is 2R₁ − (R₀ + R₁) = R₁ − R₀. Either way it stays G, and R₀ ends as kG. Only which register gets which result depends on the bit, and real code does that with a constant-time conditional swap, as RFC 7748 does for X25519's 255 steps.

a(bG) = (ab)G = (ba)G = b(aG),   computed as (ab mod q)G

X25519 clamping: k[0] &= 248,   k[31] &= 127,   k[31] |= 64   (a little-endian 255-bit scalar: 2²⁵⁴ + 8 × a number below 2²⁵¹)

Why both sides agree. bG is G added to itself b times, and adding that a times adds G to itself ab times. The group is commutative, so the order of the two multiplications can't matter. Because qG = O, only ab mod q counts.

Why clamping. Clearing the three low bits makes every secret a multiple of 8, Curve25519's cofactor, so any small-order part of a received point is multiplied away. Clearing bit 255 and setting bit 254 gives every secret the same length, so the ladder always runs 255 steps. Why a KDF. A shared secret is a curve coordinate, so its values aren't equally likely and it carries no context. HKDF extracts a uniform key and binds in what the key is for, so one agreement never serves two purposes.

generic cost ≈ √(πq / 4) group operations,   security ≈ log₂ √(πq / 4) = ½ log₂ q − 0.17 bits

The square-root law. Pollard's rho method (1978) needs about √(πq/4) steps in a group of prime order q. Shoup (1997) proved that no generic method, one that only adds and compares points, does much better than √q. So a b-bit prime order gives about b/2 bits of security. The page states this bound and runs no solver.

Why RSA needs so much more. Factoring has sub-exponential methods (the number field sieve), so RSA keys must grow much faster than the security they buy. Well-chosen curves have no known method better than the generic one. That's the gap in the table: 128 bits of security takes a 256-bit curve or a 3,072-bit modulus.