The definition of an [elliptic curve](https://en.wikipedia.org/wiki/Elliptic_curve) doesn't seem very promising at first. Why would we care specifically about the solutions to an equation of the form Y^2 = X^3 + aX + b whose coefficients satisfy the bizarre looking condition 4a^3 + 27b^2 \neq 0? However, an elliptic curve is in fact a very canonical and natural object from many different perspectives.

For current cryptographic applications, what matters is that the points on an elliptic curve have the structure of an abelian group, meaning that there is a way to define an "addition" operation on the points of an elliptic curve which has the usual properties we expect from addition. In general it's an easy problem to multiply an element x of an abelian group by a natural number n, in other words, to compute n \cdot x = x + x + \ldots + x where the sum has n copies of x, but it's a hard problem to recover the value of n given x and n \cdot x. Much of public-key and asymmetric cryptography is based on this fundamental asymmetry, and elliptic curves provide a nice environment in which to build concrete algorithms out of this observation.

On the other hand, from the point of view of algebraic geometry, an elliptic curve is a natural object to study because they turn out to be on the frontier of our understanding of plane curves in many ways: curves simpler than elliptic curves are easy to understand (in some sense that will be clearer later on), elliptic curves are rather hard but still possible to understand, and anything more complicated than an elliptic curve is in general impossible to understand.

## Diophantine equations

One way to look at elliptic curves is through the lens of [linear Diophantine equations](https://en.wikipedia.org/wiki/Diophantine_equation), which are polynomial equations with integer coefficients which we wish to solve over the integers. A polynomial in several variables is an expression in which the only terms that appear are products of the variables multiplied by some constants. As an example, X^2 + Y^2 = Z^2 is a Diophantine equation, while \sin(X) = \cos(2Y) is not. 

We can classify these equations in terms of their *degree*, which is the largest number of variables that appears in any single term, counting powers of the same variable with multiplicity. For instance, the equation 5XY^2 = 7Z^2 + Z has degree 3: the largest number of variables multiplied together occurs in the term 5XY^2 with 1 copy of X and 2 copies of Y, hence the degree is 1+2 = 3. Generally speaking, Diophantine equations of lower degree are easier to solve than ones of higher degree.

Diophantine equations of degree 1 in n variables are of the form a\_0 + a\_1 X\_1 + a\_2 X\_2 + \ldots + a\_n X\_n = 0 for some n with the a\_i all integers. It turns out these equations can be completely solved using the [Extended Euclidean algorithm](https://en.wikipedia.org/wiki/Extended_Euclidean_algorithm), so we understand this particular case very well.

Diophantine equations of degree 2 are considerably more difficult. The most famous example is possibly X^2 + Y^2 = Z^2. If you know about the Pythagorean identity, then finding integer solutions to this equation is equivalent to finding right triangles all of whose side lengths are integers. A clever strategy for solving this particular equation is to first notice that it's equivalent to looking for *rational* solutions to X^2 + Y^2 = 1 after we divide through by Z, so in essence we're looking for rational points on the unit circle.

Now we can perform the following trick: Take the point (0, 1) and draw rays from this point that intersect the circle at some other unique point. This line will also intersect the x-axis somewhere. In fact, since a line is uniquely determined by two points on it, each point on the x-axis will correspond uniquely to a point on the circle, and since linear equations can be solved over the rational numbers, this will also be the case for *rational points*. Therefore we have a strategy for generating all possible solutions to X^2 + Y^2 = 1: We simply draw a line from N = (0, 1) to s(P) = (q, 0) for some rational q and we check where else this line intersects the unit circle, which gives us the rational point P in the illustration [available here](https://quantum.lvc.edu/lyons/algeom_text/algeom_text_files/images/stereoproj.png).

As it happens, this strategy or some variant of it can be made to work for general Diophantine equations of degree two, though I won't go into much further detail than that here. When we use it for the circle or the sphere, this strategy is called the [stereographic projection](https://en.wikipedia.org/wiki/Stereographic_projection), and in the language of algebraic geometry we say that the circle is *birationally equivalent* to a line. 

When we go up to degree three we're on much more difficult ground, and from here on I'll focus exclusively on the problem of finding rational points on plane curves. We could try the above projection strategy, but now it doesn't work because generically a line intersects a plane curve of degree three (also called cubic curves) at three points instead of two. Nevertheless, the strategy can be made to work for a special class of cubic curves: the singular ones. A singular cubic curve has a cusp (which appears as a pointy end if you plot it) or a self-intersection, and we find that such a singular point has the property that any line must intersect it with a multiplicity of two or greater. This allows us to use the exact same strategy we used for the circle to parameterize its points: Singular cubic curves are also birationally equivalent to the line. You can find a picture of a singular plane cubic curve [here](https://www.math.purdue.edu/~arapura/graph/node.gif)—the self-intersection point at the origin is what makes it singular.

Most cubic curves, however, are *nonsingular*; meaning they have no cusps or self-intersections which exhibit the aforementioned behavior vis-a-vis their intersections with lines. Remember that funny condition 4a^3 + 27b^2 \neq 0? The quantity \Delta = 4a^3 + 27b^2 is called the discriminant of a cubic curve, and it's equal to zero precisely when the curve is singular. This leads us to the definition of an elliptic curve which works in most situations, and in particular works over the rational numbers: An elliptic curve is a nonsingular cubic plane curve. We can actually put any such curve in a special algebraic form Y^2 = X^3 + aX + b by changing variables a few times, and this form is called the Weierstrass normal form of the elliptic curve.

At first, it seems hopeless to try to understand the structure of rational points on this curve. However, these curves turn out to have a very special property which makes our lives much easier than we might have expected.

## The group law

While our previous strategy of parametrizing rational points by stereographic projection doesn't work on an elliptic curve, we can still do something by looking at the curve's intersections with various lines. Suppose we make the following bizarre definition: Say that three points on the elliptic curve "add up to zero" if there is a line which goes through all three of them at once, counting with intersection multiplicities. So for instance we count a tangent to the curve somewhere as intersecting the curve twice rather than once. If a line intersects only two points on the curve both with a multiplicity of one, we say that they are additive inverses. 

It's obvious that this definition gives us some operation, say +, on the points of an elliptic curve. Now the magic: It turns out that this operation is *associative*! In other words, if we take three points P, Q, R, then we have that (P+Q)+R = P+(Q+R). This is apparently a bizarre coincidence since the geometric construction we're doing really has no business having this property, but the explanation of why this coincidence happens is unfortunately beyond the scope of this essay. Once we do some fiddling around with adding a point at infinity to the curve to serve as the zero element of this addition operation, we're then able to turn our elliptic curve into an *abelian group:* roughly mathematical structures in which we can do addition and subtraction, and that have the usual properties we expect from those operations.

We now have a procedure for generating rational points on an elliptic curve that is quite similar to what we did with the circle earlier. We start with some rational point P on our elliptic curve. Now we can simply use the group law we've defined to compute 2P = P+P, 3P = 2P + P and so forth; and unless this sequence loops back around to the zero point such that for some n we have nP = 0, we'll obtain infinitely many rational points on the curve this way. If this iteration loops around back to P then we say that P is torsion. If we're lucky and the initial point we picked is not a torsion point, this procedure allows us to generate infinitely many rational points on the elliptic curve starting from only one.

While one point P is not sufficient to get all the rational points on the elliptic curve through the process outlined above in general, it's not too far off. The Mordell-Weil theorem for elliptic curves states that the group of rational points on an elliptic curve is finitely generated, which means that we can pick finitely many points on the elliptic curve and get all of the rational points from linear combinations of those. In other words, instead of looking at cP for P a single point and c an integer, we can instead find some n such that there are points P\_1, P\_2, \ldots, P\_n such that every rational point on the elliptic curve is of the form c\_1 P\_1 + \ldots + c\_n P\_n for some integers c\_1, c\_2, \ldots, c\_n. The rank of an elliptic curve is the maximum n we can choose such that we'll be able to find points P\_1, \ldots, P\_n on the elliptic curve which are linearly independent over the integers, in other words, for which c\_1 P\_1 + c\_2 P\_2 + \ldots + c\_n P\_n = 0 only holds if c\_1 = c\_2 = \ldots = c\_n = 0. Therefore the rank roughly measures the "size" of the elliptic curve as seen over the rational numbers.

It's an open problem if there are elliptic curves of arbitrarily high rank over the rational numbers or if the rank is always bounded from above by some finite number. The largest rank achieved so far is at least 28 for which an example was found by Noam Elkies in 2006, but it's conjectured that while the average rank of elliptic curves is low (it has been proven to be no greater than 7/6 in 2015 and is conjectured to be equal to 1/2), the maximum rank should be infinite. There has been progress on both of these questions (average and maximum) recently and they are connected to one of the Millennium Prize Problems, the Birch and Swinnerton-Dyer conjecture, whose resolution might also be on the horizon.

Here are two questions about the rank problem which are of theoretical interest:

In general, plane curves of degree higher than three are extremely difficult to deal with, so I won't say anything about them here. We can prove that only a special class of curves (those of [genus](https://en.wikipedia.org/wiki/Genus_(mathematics)#Algebraic_geometry) 1) have the group structure mentioned above, and unfortunately the only such curves are elliptic curves, so this group law approach doesn't generalize to plane curves of higher degree. In many ways elliptic curves represent the limits of our general understanding of linear Diophantine equations, which means they occupy a particularly special position in algebraic geometry and number theory.

While I hope some readers will be interested in solving Diophantine equations, others may be wondering if elliptic curves are good for anything in the real world. It happens that unlike most other areas of pure mathematics, elliptic curves do happen to be important for a particular kind of application, and I will discuss this in the rest of this essay.

## Cryptography

Suppose A wants to send a secret message to B, but there is no secure channel of communication between them: Any of their communications can be intercepted by a third party in the middle and examined. If A and B had agreed on a shared secret key to use at some earlier point, they could use this channel to communicate using their shared secret coupled with a symmetric key encryption algorithm such as [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard). Given such a symmetric algorithm, therefore, the problem of secure communication reduces to the problem of establishing a shared secret between A and B which cannot be inferred by a third party through examination of the content of the communication between them.

It turns out there's a clever solution to this problem which may be more intuitively understood if we think of A trying to send B some physical object inside a bag. A first puts the object in a bag, locks it with his own key and sends the bag to B. B can't open the lock A has placed on the bag since he doesn't have A's key, so he puts his own lock on the bag and sends it back to A. Now A undoes his own lock and once again sends the bag to B, and since now the only lock on the bag is the one placed by B he can safely open the bag and retrieve the object inside. Since the bag is always locked while in transit, no third party who intercepts the bag in the middle can see what's inside the bag or retrieve it before B is able to.

This is the essential idea behind [Diffie-Hellman key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange). To make it work, we need some procedure by which people can "lock" a piece of information in a way that only they can undo later, and we want this process to be commutative; in other words we want A to be able to undo his own lock after B has locked the bag on his end. The common setting to implement this protocol is, therefore, an abelian (usually a cyclic) group. One version of the protocol which is slightly different than the one outlined above is that both A and B agree in public to use a cyclic group and a particular generator x of it. Both of them pick some large numbers to multiply the element by, say n\_A, n\_B for A, B respectively, and these numbers are kept private. A sends n\_A x to B while B sends n\_B x to A, and from there they are both able to use their private information to compute the shared secret n\_A n\_B x. A third party in the middle sees only x, n\_A x and n\_B x, and in fact there's no efficient classical algorithm for figuring out n\_A n\_B x from this information in general - this is the [discrete logarithm](https://en.wikipedia.org/wiki/Discrete_logarithm) problem. If the abelian group and the specific element x are chosen well, then the best the third party can do is the [baby-step giant-step algorithm](https://en.wikipedia.org/wiki/Baby-step_giant-step), which runs in exponential time.

A popular setting in which to implement this protocol is to choose the cyclic group to be some subgroup of an elliptic curve modulo some prime number p over which all of our discussion of the group law still applies. There's no easy, known classical algorithm for computing discrete logarithms in elliptic curves, and they are commutative groups, so both of the essential requirements of Diffie-Hellman key exchange are satisfied for elliptic curves. Just to give one example, this variant of Diffie-Hellman is an ingredient in the [Signal protocol](https://en.wikipedia.org/wiki/Signal_Protocol), a cryptographic protocol used in many messaging apps including WhatsApp, Facebook Messenger, and Skype.

There is, however, an efficient quantum algorithm for finding discrete logarithms in finite cyclic groups in general due to Peter Shor. It works in a very similar way in any such group and means that in principle all variants of Diffie-Hellman may become insecure if quantum computers become capable enough. There have been proposals to deal with this possibility by new cryptographic algorithms based on supersingular elliptic curves, but I won't go into that here.

A question of great practical significance is when elliptic curve cryptography will become insecure, either due to the advent of large-scale quantum computing or due to the discovery of an efficient classical algorithm for finding discrete logarithms in elliptic curves. I think the discovery of an efficient classical algorithm is unlikely, but since Shor's algorithm is quite efficient we wouldn't need a big quantum computer to be able to break, say, 256 bit elliptic curve cryptography—around 2000 qubits would be sufficient. The Metaculus community currently thinks that quantum computers will factor the first previously unfactored RSA number in around 2046:

Breaking 256 bit ECC is a problem that would require roughly the same amount of quantum computing technology and hardware, so the forecast on the following question should not be too different unless we "price in" a possibility of a classical breakthrough in computing discrete logarithms over elliptic curves:

## Conclusion

I'll end the essay here since it's already quite long. The moral of the essay is that elliptic curves are both interesting mathematical objects and they have found significant application in the niche of public-key cryptography. As usual, however, the questions about them that mathematicians tend to be interested in are not the same as the problems that are most important for their practical applications.