ECDH on a small curve

This tool illustrates elliptic-curve Diffie–Hellman on the fixed curve y² = x³ + 2x + 3 over the finite field F₉₇. Coordinates are residues 0…96; arithmetic is performed modulo 97. The plot contains 99 finite, discrete points, not samples of a continuous real curve. Together with the point at infinity O, the curve has 100 points. O is the group identity and has no finite x/y coordinates: it is not (0,0) and is never drawn at a pixel position.

The fixed base point is G = (3,6). Its cycle is 0G = O, G = (3,6), 2G = (80,10), 3G = (80,87), 4G = (3,91), and 5G = O. Thus ord(G) = 5, while the whole curve has order #E = 100. The cofactor is #E/ord(G) = 20. These three quantities describe different things. Private scalars a and b must be whole numbers from 1 through 4, the nonzero scalars below the base-point order. They are never silently reduced modulo 97 or rounded.

Alice calculates her public point A = aG and Bob calculates B = bG. They exchange A and B. Alice then calculates S_A = aB and Bob calculates S_B = bA independently; both equal abG. The table shows all four scalar multiplications with the actual inputs and both final points. Multiplication here means repeated elliptic-curve group addition, not multiplication of each coordinate. In this teaching page private inputs and results are visible so the calculations can be followed.

Select Calculate to build the plot and exchange. The three examples use a/b = 2/3, 1/4 and 2/2; the second gives inverse public points and the third gives equal public points. Editing either private scalar or choosing another example clears the old result. Clear result keeps the inputs. Green marks G; Alice’s A, Bob’s B and the shared point have differently sized rings. Overlapping rings retain each role’s identity, with a text legend and numeric coordinates.

Open Multiples of G and move the integer slider from 0 to 5. The orange probe ring marks kG, and the corresponding table row is emphasized. At k = 0 or 5 the ring is absent and O is named outside the plot. Only the probe changes; the finite point set and exchange remain fixed. Valid settings can be stored locally. Returning within the app can retain the result, selected multiple and open details; reloading restores settings and waits for Calculate.

This very small curve is deliberately insecure and is not a recommended or secure set of ECDH parameters. The tool shows a shared point; it does not implement authentication, secure random scalar generation, a key-derivation function or a production encryption protocol. The example scalars may be stored in the app’s local settings. In a real ECDH primitive the point at infinity must be rejected as a shared result, and the standard then derives a field element from the point’s x coordinate. Do not use these examples as keys.

Source: SEC 1: Elliptic Curve Cryptography, Version 2.0, §2.2.1 for the curve group and identity; §3.1.1 for domain parameters, order and cofactor; §3.2.1 for private scalars and public points; §3.3.1 for the ECDH primitive and rejection of O.