elliptic curve point O*P (zero * point P)

Question

I am having confusion regarding the point 0*P on an elliptic curve which I am told it is not the point (0,0). Is it the point at infinity? What does 0*P means actually?

Answer 1

Let $E$ be an elliptic curve; i.e., a ``nice enough" cubic equation $y^2 = x^3 + ax + b$, where $a$ and $b$ are elements of a field [of characteristic not $2$ or $3$]. The naïve definition of the group structure on [the $K$-valued points of] an elliptic curve is given by the following. Let $P$ and $Q$ be two [$K$-valued] points on your curve (i.e., solutions in $K^2$ to the equation defining $E$). Then $P + Q$ is the reflection about the $x$-axis of the third intersection point of the elliptic curve and the line through $P$ and $Q$ (note: you need to take care in the case when you add $P$ to itself, and with the multiplicity of the intersection of the line with the curve). With this structure, the points on your elliptic curve almost form a group. What's the identity? To define the identity, we need to actually extend $E$ to a projective curve. To do this, we homogenize: we add another variable $z$ to the equation such that all terms have the same total degree. That is, $y^2 = x^3 + ax + b$ becomes $y^2 z = x^3 + axz^2 + bz^3$. We now consider solutions to this equation in $K^3$, subject to a few restrictions:

1. $(0,0,0)$ is not considered a valid solution. (We only consider solutions $(a,b,c)$ where at least one of $a,b,c$ is nonzero.)
2. $(a,b,c)$ and $(a',b',c')$ are considered to be the same point if there exists $k\in K^\times$ such that $a = ka'$, $b = kb'$, $c = kc'$.

Call an equivalence class of solutions (under the equivalence of $2$.) a projective point on $E$. a Every naïve $K$-valued point $(x_0,y_0)$ of our curve is a projective point: $(x_0,y_0)$ corresponds to the equivalence class of $(x_0,y_0,1)$. However, we now obtain a new point on the curve that we didn't have before: $(0,1,0)$. You can think of this new point as being ``at infinity" on the curve. Now, it can happen that a line through $E$ intersects $E$ only twice (even with multiplicity) in $K^2$. The last intersection point is considered to be the point at infinity. In particular, a vertical line that passes through $E$ at at least one point passes through $E$ at exactly two points (with multiplicity), and the third point is the point $\infty$ at infinity. With our group interpretation, this would tell us that if $P = (x_0,y_0)$, $-P = (x_0,-y_0)$, then $P + (-P) = \infty$. We also have in a similar way $P + \infty = \infty + P = P$. Hence, the point at infinity is the identity for our elliptic curve.

We can see easily that $(0,0)$ cannot be the identity for $E$ in general: $(0,0)$ might not even be a point on the curve! Take $E$ defined by $y^2 = x^3 + 2$, for example. ($0\neq 0 + 2$.)