← Hall of Foundations Hall of Foundations · Exhibit 141
The Number Theory Beneath ECC

The ground beneath
the curve

Elliptic-curve cryptography rests on objects far older and stranger than any key exchange. This exhibit walks from a cubic equation to the deepest theorem it touches — and is honest about where the mathematics stops being useful to a cryptographer.

A note on honesty. Fermat's Last Theorem — the 100-page proof this exhibit builds toward — has no direct use in cryptography. What ECC actually stands on is the world that proof revealed: the deep link between elliptic curves and modular forms. We'll show you that world without overselling the theorem itself.
§1

A curve is a cubic

For this exhibit an elliptic curve is a nonsingular Weierstrass cubic together with a point at infinity. Its equation has rational coefficients, while this smooth plot shows its real solutions. Rational, real and finite-field points are different sets. The name comes from the history of elliptic integrals.

y² = x³ + ax + b

Fix a and b so the curve is smooth — no cusps, no self-crossings — and you get the graceful looping shape below. What makes it cryptographically interesting is not the shape but a hidden operation living on it: you can add two points and land on a third.

§2

The group law, drawn by hand

Here is the whole secret. To add points P and Q: draw the line through them, find the third place it meets the curve, and reflect that point across the x-axis. That reflection is P + Q. Tap two points and watch the construction draw itself.

y² = x³ + x + 1  ·  tap the curve
tap once for P, again for Q — the chord, the third intersection, and the reflection to P+Q all draw in vermilion.
Keyboard alternative: choose two points on the curve to add.

Continue into the working mathematics: Elliptic Curves over ℝ takes this same group law and draws it by hand, and Finite Fields shows the smooth curve shattering into the scatter cryptography actually uses. Teaching model using floating-point approximations: point coordinates are computed from the actual group law over the reals and projected onto the display; no cryptographic protocol is implemented.

§3

Why the addition is a fortress

Over a finite field instead of a smooth drawing, that same addition scatters unpredictably. Add a point to itself k times and you reach a new point Q = kP. Recovering k from P and Q is the elliptic-curve discrete logarithm problem — easy to compute forward, believed infeasible to reverse.

P, Q known  →  find k such that Q = kP   ✗ hard

Suitable finite-field elliptic-curve groups support hard discrete-log and related assumptions used by protocols such as ECDH and ECDSA. Not every curve or prime is secure, and visual scattering does not prove hardness. The modularity story below is mathematical context rather than a prerequisite for that security claim.

§4

The second face: modular forms

An elliptic curve over ℚ has an L-function built from arithmetic data, including point counts at primes of good reduction. Modular forms are highly symmetric functions on the complex upper half-plane. Their connection is deep number theory, not an extra encryption operation.

The Modularity Theorem associates every elliptic curve over ℚ with a weight-two cuspidal newform whose L-function matches that of the curve. Wiles and Taylor–Wiles established the semistable case in work published in 1995; the general case was completed by 2001. This is an equality of L-functions, not a claim that a zeta function literally is a modular form.

Two traditions that never spoke — point-counting and the analysis of symmetric functions — turned out to be the same language.
§5

The rungs to Fermat

Modularity is where Fermat's Last Theorem falls. Not by attacking aⁿ + bⁿ = cⁿ directly, but by showing a hypothetical counterexample would build an elliptic curve too strange to exist.

  • Frey · 1985the trap A counterexample to Fermat yields a curve y² = x(x + aⁿ)(x − bⁿ) with impossible properties.
  • Serre · Ribetthe tightening Made precise: such a curve, if modular, forces a modular form that plainly cannot exist.
  • Wiles · 1994the keystone Proved semistable curves are modular — so the Frey curve would be modular — so it cannot exist — so Fermat holds.

The proof runs 109 pages plus a 20-page companion. Its engine is an equality between a deformation ring and a Hecke ring — "R = T" — reached through commutative algebra, not through the curves themselves.

Where this touches your keys

Mathematical context, not a security assumption

ECC does not require the Modularity Theorem or Fermat's Last Theorem for its group law, correctness or security assumption. The theorem is valuable mathematical context. Practical ECC depends on finite-field arithmetic, suitable group parameters and protocol-specific computational assumptions; modularity does not prove that those assumptions are hard.

This exhibit is reference and education. For the deployable primitives — ECDH, ECDSA, and post-quantum successors — see Modern Cryptography.