The Deep Math of Elliptic Curve Cryptography: Deriving the Group Law from the Riemann-Roch Theorem

Defining an Elliptic Curve

An elliptic curve over a field K of characteristic other than 2 or 3 is a non-singular plane cubic curve defined by the Weierstrass normal form

E : y² = x³ + ax + b   (a, b ∈ K, discriminant Δ = -16(4a³ + 27b²) ≠ 0)

together with a single added point at infinity O. The condition that the discriminant be nonzero guarantees that the curve has no singular points (cusps or self-intersections). We write E(K) for the set of all points on E whose coordinates lie in K (including O).

What Is a Divisor?

A divisor on the curve E is a formal sum built by choosing finitely many points on E (points defined over the algebraic closure — so-called Weil points) and assigning an integer coefficient to each.

D = Σ n_P [P]   (P is a point on E, n_P ∈ ℤ, n_P = 0 for all but finitely many P)

The set of all divisors forms a free abelian group Div(E), and deg(D) = Σ n_P is called the degree. The divisors of degree 0 form a subgroup Div⁰(E).

For a rational function f on E (not identically zero), we define its principal divisor

div(f) = Σ_P ord_P(f) · [P]

where ord_P(f) is the order of the zero of f at the point P (or, if negative, the order of the pole). Because the number of zeros and the number of poles of a rational function always match (counted with multiplicity), a principal divisor always has degree 0.

Two divisors D₁, D₂ are said to be linearly equivalent (D₁ ∼ D₂) when there exists a rational function f such that D₁ - D₂ = div(f). The quotient group of degree-0 divisors modulo linear equivalence is written Pic⁰(E) (or Cl⁰(E)), and is called the divisor class group.

The Riemann-Roch Theorem

For a divisor D on a non-singular projective algebraic curve C of genus g, consider the K-vector space

L(D) = { f : rational function | div(f) + D ≥ 0 } ∪ {0}

and let l(D) = dim L(D). Intuitively, l(D) counts "how many rational functions exist whose pole orders fit within what the divisor D allows." The Riemann-Roch theorem states, in terms of the canonical divisor (the divisor of a canonical differential) K_C, the following equality.

l(D) - l(K_C - D) = deg(D) - g + 1

An elliptic curve has genus g = 1, and moreover its canonical divisor K_C has the special property that it is linearly equivalent to 0 (K_C ∼ 0, corresponding to the fact that an elliptic curve admits a regular differential form that is nowhere vanishing). Substituting this in simplifies the equation to

l(D) - l(-D) = deg(D)

When deg(D) > 0, the space corresponding to a divisor of negative degree satisfies l(-D) = 0 (no rational function has a divisor of negative degree), which gives us the following important corollary.

The Isomorphism Between E(K) and Pic⁰(E): The True Nature of the Addition Law

Here's where things get interesting. Fix a point at infinity O, and consider the map

φ : E(K) → Pic⁰(E),   P ↦ [P] - [O]

We can show that this is a bijection using the corollary of Riemann-Roch above.

Take any degree-0 divisor D ∈ Div⁰(E), and let D' = D + [O], so that deg(D') = 1. By the corollary above, l(D') = 1, so among the effective divisors (divisors with all coefficients ≥ 0) linearly equivalent to D', exactly one has degree 1 — that is, is of the form "a single point," [P]. Thus

D + [O] ∼ [P]  ⟺  D ∼ [P] - [O]

which means the linear equivalence class of D is uniquely represented by exactly one point P. This is precisely what it means for φ to be a bijection.

Pic⁰(E) is an abelian group with a natural group structure coming from the formal sum of divisors (the identity element is the class of 0, i.e. the class of principal divisors). Since φ is a bijection, we can "transplant" this group structure onto E(K) via φ. That is, by defining

P ⊕ Q := φ⁻¹( φ(P) + φ(Q) )

E(K) becomes an abelian group. This is precisely the algebraic-geometric definition of the additive group structure of an elliptic curve.

Why Do Three Collinear Points Sum to Zero?

Finally, let's confirm that the familiar geometric addition law from textbooks (a line and its three intersection points) matches the abstract definition above. Suppose three points P, Q, R on E lie on the same line L. Since a cubic curve and a line intersect in exactly three points (counted with multiplicity), if we take the linear equation l(x, y) defining L, and consider the rational function f = l / z (with the appropriate normalization in homogeneous coordinates), then

div(f) = [P] + [Q] + [R] - 3[O]

holds (the three zeros P, Q, R from the line L correspond to a pole of order 3 at the point at infinity O). Since div(f) is a principal divisor, it is linearly equivalent to 0, meaning

[P] + [Q] + [R] - 3[O] ∼ 0
⟺ ([P] - [O]) + ([Q] - [O]) + ([R] - [O]) ∼ 0
⟺ φ(P) + φ(Q) + φ(R) = 0 (in Pic⁰(E))
⟺ P ⊕ Q ⊕ R = O (in E(K))

This is the true nature of that familiar geometric addition law: "the sum of three collinear points is O (the identity element)." The addition formula actually used in ECC implementations — draw a line through two points, take the third intersection point, and reflect it across the x-axis (or another symmetry, depending on characteristic) — is nothing more than this relationship, div(f) ∼ 0, translated into concrete polynomial operations.

Summary

• The set of points on an elliptic curve admits a bijection φ: P ↦ [P]-[O] with the divisor class group Pic⁰(E)
• This bijection follows from the Riemann-Roch theorem, using properties specific to elliptic curves — genus 1, and a canonical divisor equivalent to 0
• The group structure is transplanted onto E(K) from Pic⁰(E) via φ
• The geometric addition law "the sum of three collinear points is zero" is simply a restatement of the fact that the principal divisor defined by the line's equation is equivalent to 0