An example of adding points on an elliptic curve in Elliptic Curves, Number Theory and Cryptography by Lawrence Washington.

This question addresses an example that appears in Lawrence Washington's book, Elliptic Curves, Number Theory and Cryptography on page 16. Example 2.1. The author asserts that the following statements are true on the elliptic curve $$y^2 ={\frac{x(x+1)(2x+1)}{6}}.$$ $$(0,0)+(1,1)=({\frac{1}{2}},-{\frac{1}{2}}),$$ and $$({\frac{1}{2}},-{\frac{1}{2}})+(1,1)=(24,-70).$$ I understand how to work these calculations out by using the chord and tangent process on this elliptic curve-as we worked out when we studied Chapter 1. And while I get the observation that $(x,y)$ is a rational point on this curve if and only if $(x,-y)$ is as well (as the left hand side is $y^2$), I am not clear why these formulae hold as a consequence of the addition laws given on page 14 of the book because this curve (which arises in the context of the Lucas Pyramid Problem) is not in short Weierstrass form. In fact, we write it as $$6y^2=x(x+1)(2x+1),$$ wouldn't we have to multiply both sides by $(6^3)(2^2)$ and change variables to convert it to generalized Weierstrass form? Wouldn't this then affect the formulae for and the addition laws that we derive? They may not be the formulae we use when we apply the chord and tangent process-the points themselves will be transformed by the change in variables. I guess I don't feel that these calculations are applications of the group law-as they clearly are for the congruent number elliptic curves in the book-these curves ($y^2=x^3-n^2x$) are in short Weierstrass form. Is there something obvious that I am missing? Sorry if I am nit picking! Just trying to understand what is happening.

Solution 1:

Let us explicitly add $P_1=(0,0)$ and $P_2=(1,1)$ which are ($\Bbb Q$-rational) points in $E(\Bbb Q)$ for the elliptic curve $E$ with affine equation: $$ E\ :\qquad y^2 =\frac 16x(x+1)(2x+1) $$ that appears on page 16 in the cited book. Strictly speaking, the above equation is not in the shape considered in the the previous pages of the book, where the most general equation considered so far was $(2.1)$: $$ y^2 +a_1xy + a_3y = x^3+a_2x^2+a_4x+a_6\ . $$ (And there is no definition of an elliptic curve in the previous 15 pages, so take $(2.1)$ as a "working definition".)

But there is a simple change of variables $y=3Y$, $x=3X$, to put the equation in such a shape, for instance by dividing both sides with $3^2$to get: $$ \begin{aligned} \left(\frac y3\right)^2 &=\frac x3\left(\frac x3+\frac 13\right)\left(\frac x3+\frac 16\right)\ ,\text{ i.e.}\\ Y^2 &= X\left(X+\frac 13\right)\left(X+\frac 16\right)\ . \end{aligned} $$ We tacitly pass from the curve $E$ with equation "in the $(x,y)$-world" to the equation "in the $(X,Y)$-world" as needed, and let $E'$ be the latter corresponding curve. For $E'$ we are in the setting of $(2.1)$, so we proceed as there. The corresponding points are $P_1'=(0,0)$, $P'_2=\left(\frac 13,\frac 13\right)$.

To compute $P_1'+P_2'$ we have to solve a system of equations (given by the equation of the line $P_1'P_2'$ and by the equation of $E'$). But with the given substitution, we may want to solve the corresponding system in the $(x,y)$-world, since there are no denominators. (I hate denominators when typing.) Then we proceed as follows. The line through these points is the line $y=x$ (with slope $1$) and in order to get the intersection point, we solve the system with the two equations: $$ \left\{ \begin{aligned} y &= x\ ,\\ y^2 &=\frac 16x(x+1)(2x+1)\ . \end{aligned} \right. $$ We expect two solutions to correspond to the given points $P_1$, $P_2$, and the third solution is a point $R_3$, $$ R_3 =\left(\frac 12,\frac 12\right)\ , $$ as seen by verifying it. (Bezout insures there are (at most) three solutions.)

Now, in order to get the sum $P_1+P_2$ in $(E(\Bbb Q),+)$ we have to build $P_3:=-R_3$, so we draw the line through $R_3$ and the infinity point, its equation is $x=\frac 12$, and intersect it again with the elliptic curve. We obtain the claimed point $$ P_3:=P_1+P_2:=-R_3=\left(\frac 12,-\frac 12\right)\ . $$ Note that on page 15, some lines above, the author mentions the formula for computing the opposite of a point $P=(x,y)$ on the curve $(2.1)$, which is: $$ -P=(x,\ -y-a_1x-a_3)\ . $$ Our curve $E'$ is in the form $(2.1)$, and for it $a_1=a_3=0$, so the formula for the opposite of a point $(X,Y)$ is $(X,-Y)$. Now pass to the $(x,y)$-world to see that it is also valid inside it.

At a later point, an elliptic curve $(E,O)$ is a "good" cubic curve $E$ together with a specified rational point $O$ on it, and the addition of two rational points $P_1,P_2$ is defined as follows. Draw the line $P_1P_2$ and intersect it with $E$. There is a third point in the intersection (possibly needing to count multiplicities for this), denote it by $R_3$. The draw the line $OR_3$ and intersect it with $E$, the third point is the point $P_3:=P_1+P_2$. It turns out after these definitions were done that this operation is indeed a group operation, and then $P_3=-R_3$. $P_3=-R_3$.

Since cryptography is the final target, it may be useful to have code reproducing the given situation. We add on $E'$:

EE = EllipticCurve([0, 1/3 + 1/6, 0, 1/3/6, 0])
P1 = EE.point((0, 0))
P2 = EE.point((1/3, 1/3))

print(f'P1 +   P2 = {P1 +   P2}')
print(f'P1 + 2*P2 = {P1 + 2*P2}')

And we obtain:

P1 +   P2 = (1/6 : -1/6 : 1)
P1 + 2*P2 = (8 : -70/3 : 1)

This is the projective version of the points. They are $(1/6, -1/6)$ and $(8, -70/3)$. Now multiply each component with $3$ to get the points from the example 2.1, page 16 in the book, which are $(1/2, 1/2)$ and $(24, -70)$.