← Hall of Foundations Exhibit 142 · 𝔽ₚ
The Arithmetic World Everything Happens In

When the curve
shatters

The elliptic curve you saw drawn as a smooth loop doesn't live on paper when it does real work. It lives over a finite field — a world with only finitely many numbers, where the curve becomes a scatter of dots. This is where the discrete logarithm becomes hard.

Arithmetic, not a security test. The real and finite-field pictures use related formulas, but apparent visual disorder does not prove discrete-log hardness. Curve choice, subgroup order, validation and implementation all matter.
§1

A field with no infinity

A finite field 𝔽ₚ is arithmetic modulo a prime p: the only numbers are 0, 1, …, p−1, and everything wraps around. Add, subtract, multiply, and — crucially — divide, all staying inside that finite set. Every nonzero element has an inverse, which is what makes it a field rather than just a ring.

𝔽ₚ = { 0, 1, 2, …, p−1 }  with arithmetic mod p

The same elliptic-curve equation, y² = x³ + ax + b, now asks which pairs (x, y) satisfy it modulo the prime. The group also includes an identity called the point at infinity; that identity is not an extra field element.

§2

The curve, over 𝔽ₚ

Below is y² = x³ + 2x + 2 over 𝔽ₚ. Change p and watch the point set redraw. Notice the vertical symmetry — for every point (x, y) there's a mirror (x, p−y) — the finite-field ghost of the real curve's reflection.

—
Every dot is a genuine solution of y² ≡ x³ + 2x + 2 (mod p), computed exactly. The count is the order of the curve — the size of the group your key lives in.
§3

Adding points in the dark

The chord-and-tangent rule still works — but algebraically, not geometrically. Pick a starting point G and repeatedly add it to itself. Over the reals you could watch it slide along the curve. Here it jumps. Press step and follow G, 2G, 3G… as they scatter with no visible pattern.

k = 0
You can see k and where kG landed. The discrete log problem is the reverse: given only the landing spot, recover k. This tiny group is easy to search; the plot alone tells us nothing about cryptographic hardness.
Forward is a walk. Backward is a search of the whole field. That gap is one algebraic ingredient in a secure protocol.
Where this touches your keys

This is the ground floor of ECC

Real elliptic-curve cryptography uses carefully selected large fields, curves and prime-order subgroups. For common 256-bit prime-order groups, generic discrete-log attacks take roughly the square root of the group order, not a search through every field element. These tiny plots are readily enumerable and demonstrate arithmetic, not security.

AES uses a finite field too, but a different kind of one, and the distinction is worth drawing. This exhibit builds GF(p) — arithmetic modulo a prime. The AES S-box lives in GF(2⁸), an extension field of 256 elements whose members are polynomials, added bitwise and multiplied modulo a fixed irreducible polynomial. Same guarantee — every nonzero element has an inverse — reached by different construction, and the S-box takes that inverse and then applies an affine map on top. The polynomial machinery is next door in Polynomial Rings.

Companion: The Ground Beneath the Curve shows the smooth real-number version and the deep theory of why these curves are so well-behaved.

Sources and scope: NIST SP 800-186 (2023) specifies recommended elliptic-curve domain parameters; the small groups here are teaching examples.