Question

In Elliptic Curves, when computing A⨁B = C , we take the line through A and B and find the point it intersects the curve. We then reflect through the x-axis. Why do we reflect at the x-axis?

Answer 1

Solution :

Cryptographic operations on elliptic curves typically deal with scalar multiplication of points. That is, we pick a generator point P and a random, secret integer d, and we add P to itself d times. This is easy to calculate, but it is very difficult to find out the value of d given the points P and dP.

Now consider a variant where we don't flip over the x-axis. First we calculate 2P by drawing a line tangent to the curve at point P, and call this Q. To calculate 3P, we add P+Q, so we draw a new line that goes through P and Q -- but this is the exact same line, so the "third point" on the curve is P itself. (There are only two intersecting points because the line is still tangent to the curve, so we consider the tangent point as two points.)

So to get a meaningful definition of scalar multiplication that is useful in cryptography, we need the flip across the x-axis to get a non-trivial cyclic group with an order larger than 2.