I'm not fit with elliptic curves from a mathematicians point of view, so I hope, that this beginners-question is not too silly:

I use a library which permits certain operations on elliptic curves over $GF(p)$. I recogniced, that all elementary operations (point doubling - $2P$, adding - $P_1+P_2$ , exponentiation with a scalar number - $kP$ are not using the parameter $"b"$ of the underlying equation


Only the check, whether a given Point is on the curve needs this parameter. This is understandable for me, because both sides of the equation above must be compared.

But why do the mentioned elementary operations NOT need b at all.

During writing this, I found from a white paper, that the mapping

$(x_1,y_1), (x_2, y_2) \rightarrow (x_3, y_3)$

indeed doesn't include $b$.

Is this just a mathematical coincidence or is there some deeper reason for this?


My personal explanation is, that, taken for granted that a given point (x,y) is part of a certain curve $(A, a, b, p)$, $b$ can (of course) be calculated from the defining equation and the knowledge of x,y,a, so additional specification of b would be redundant. Is this right? Then it would answer my question, and it was "silly" ;-)



  • $\begingroup$ One reason why you wouldn't want to calculate $b$ from the other parameters to save storage is that you want to verify a point is on the curve, because if it's not some attacks may be possible and point input usually should be considered untrusted. Also see SafeCurves. $\endgroup$
    – SEJPM
    Oct 2 '16 at 19:43

Adding two points $(x_1, y_1)$ and $(x_2, y_2)$ with $x_1 \neq x_2$ gives point $(x_3, y_3)$ with

$$x_3 = (\frac{y_2 - y_1}{x_2 -x_1})^2- x_1 - x_2$$

$$y_3 = (\frac{y_2 - y_1}{x_2 -x_1}) (x_1 - x_3) - y_1$$

The case $x_1 = x_2$ is either adding the inverse or point doubling.

Doubling point $(x_1, y_1)$ with $y_1 \neq 0$ gives point $(x_2, y_2)$ with

$$x_2 = (\frac{3 x_1 + a}{2 y_1})^2 - 2 x_1$$

$$y_2 = -(\frac{3 x_1 + a}{2 y_1}) (x_1 - x_2) - y_1$$

So addition does require neither $a$ nor $b$, whereas point doubling and exponentiation with a scalar number requires only $a$. Checking if both points belong to the same curve also only requires $a$.


I think a just answered my own question... Clearly, b can be calculated from x,y and a, taken that the point is on the curve...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.