# EC scalar multiplication with zero scalar

Is the elliptic curve scalar multiplication $$[n]G$$ defined if $$n=0$$?

I saw multiple software implementations with multiple results such that, $$G=0$$ or $$G=G$$.

This made me wonder, how can i compute $$G$$ on 25519 curve, where G is the base point. $$G=(9,14781619447589544791020593568409986887264606134616475288964881837755586237401).$$

Also, is [n]$$\mathcal{O}$$ defined?

• I think this covers your answers ; Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity? Apr 17, 2021 at 12:25
• Also, where you see that $G=0$ or $G=G$, the later one is not correct. Apr 17, 2021 at 12:28
• $[n]\mathcal O$ is $\mathcal O$ for all $n$. Apr 17, 2021 at 12:34
• Use $P = \mathcal{O}$ and multipl by $n$, $[0*n]P = P = \mathcal{O}= [n]\mathcal{O}$ Apr 17, 2021 at 12:36
• File a bug on their site. Apr 17, 2021 at 14:20

I saw multiple software implementations with multiple results such that, $$G=0$$ or $$G=G$$.

As stated in the comments, we define $$G = 0$$, anything else is incorrect

I thought I'd outline why we define things we did.

What we want is to have $$[a+b]G = [a]G + [b]G$$ be true for all integers $$a, b$$, and all points $$G$$.

If it is true for all integers $$b$$, it must be true for $$b=0$$, hence we must have:

$$[a+0]G = [a]G + G$$

This obviously simplifies to $$[a]G = [a]G + G$$, and this is true only if $$G$$ is the group identity, that is, only if $$G = 0$$

• Addition: in $G = 0$, the left $0$ is an integer (or integer modulo $n$), But the right $0$ is not, and sometime is noted $\mathcal O$ to make the distinction. It's the neutral for point multiplication. It's called the point at infinity, and thus sometime is noted $\infty$. On Curve25519 [update: sorry Ed25519, which is not the question's curve], the point at infinity has coordinates $(x,y)=(0,1)$.
– fgrieu
Apr 17, 2021 at 13:40
• @fgrieu why does the point at infinity has coordinates (𝑥,𝑦)=(0,1)? Apr 17, 2021 at 13:56
• @AshrafYassin: it doesn't; the point at infinity doesn't have any coordinates at all. Now, some representations (that is, ways of writing down elliptic curve points as sequences of bits) may decide to denote the point-at-infinity as $(0, 1)$, however that's just a design decision (and is certainly is not universal) Apr 17, 2021 at 14:01
• There's some confusion here between Curve25519 which is a curve in Weierstrass form and Ed25519 which is a curve in Edwards form. On Ed25519 the identity point is $(0,1)$, but the base point is different from the one quoted in the question. On Curve22519 the point at infinity does not have an $(x,y)$ representation. It is important not to denote it with an actual $(x,y)$ value as some Weierstrass implementations will take these numbers and start doing computations on a related, but different curve. Apr 17, 2021 at 15:08
• @Daniel Shiu: thanks for the correction!
– fgrieu
Apr 17, 2021 at 18:37