← Hall of Foundations Exhibit 142 · 𝔽ₚ
The Arithmetic World Everything Happens In

When the curve
shatters

The elliptic curve you saw drawn as a smooth loop doesn't live on paper when it does real work. It lives over a finite field — a world with only finitely many numbers, where the curve becomes a scatter of dots. This is where the discrete logarithm becomes hard.

The whole point. Over the real numbers, addition on a curve is smooth and geometric — you can see where a point is going. Over 𝔽ₚ, the same rule sends points leaping around unpredictably. That unpredictability is the security.
§1

A field with no infinity

A finite field 𝔽ₚ is arithmetic modulo a prime p: the only numbers are 0, 1, …, p−1, and everything wraps around. Add, subtract, multiply, and — crucially — divide, all staying inside that finite set. Every nonzero element has an inverse, which is what makes it a field rather than just a ring.

𝔽ₚ = { 0, 1, 2, …, p−1 }  with arithmetic mod p

The same elliptic-curve equation, y² = x³ + ax + b, now asks: for which pairs (x, y) in this finite world does the equation hold? The answer is a finite set of points — no smooth curve, just dots.

§2

The curve, over 𝔽ₚ

Below is y² = x³ + 2x + 2 over 𝔽ₚ. Change p and watch the point set redraw. Notice the vertical symmetry — for every point (x, y) there's a mirror (x, p−y) — the finite-field ghost of the real curve's reflection.

—
Every dot is a genuine solution of y² ≡ x³ + 2x + 2 (mod p), computed exactly. The count is the order of the curve — the size of the group your key lives in.
§3

Adding points in the dark

The chord-and-tangent rule still works — but algebraically, not geometrically. Pick a starting point G and repeatedly add it to itself. Over the reals you could watch it slide along the curve. Here it jumps. Press step and follow G, 2G, 3G… as they scatter with no visible pattern.

k = 0
You can see k and where kG landed. The discrete log problem is the reverse: given only the landing spot, recover k. With thousands of points and no pattern, there's nothing to do but search.
Forward is a walk. Backward is a search of the whole field. That gap is the entire fortress.
Where this touches your keys

This is the ground floor of ECC

Real elliptic-curve cryptography uses this exact machinery over a prime with 256 bits — a field with more elements than there are atoms in the observable universe. Your ECDH shared secret is some kG; your ECDSA signature proves you know a k without revealing it. This exhibit is why it all works.

AES uses a finite field too, but a different kind of one, and the distinction is worth drawing. This exhibit builds GF(p) — arithmetic modulo a prime. The AES S-box lives in GF(2⁸), an extension field of 256 elements whose members are polynomials, added bitwise and multiplied modulo a fixed irreducible polynomial. Same guarantee — every nonzero element has an inverse — reached by different construction, and the S-box takes that inverse and then applies an affine map on top. The polynomial machinery is next door in Polynomial Rings.

Companion: The Ground Beneath the Curve shows the smooth real-number version and the deep theory of why these curves are so well-behaved.