Despite the name, an elliptic curve doesn't look anything like an ellipse (a squashed circle). This curve is drawn by the equation y² = x³ + ax + b, and its name comes from the fact that this curve's equation shows up in "the calculation for finding an ellipse's circumference (elliptic integrals)." The curve itself is just a smooth curve, symmetric above and below the x-axis. But a very particular "addition" can be defined on this curve, and that addition has become the core of the cryptography we use every day.
Here's how adding two points P and Q on the curve works. First, draw a single line through P and Q. This line is guaranteed to meet the curve at one more point. Flip that third intersection point above and below across the x-axis, and that's exactly P+Q. When you want to add a point to itself (finding 2P), instead of the line connecting two points, you use the tangent line touching the curve at that one point. It sounds strange, but this rule is very well constructed mathematically, satisfying properties like the associative law, just like ordinary addition of real numbers.
Repeat this addition over and over — P added to itself k times — and it's written kP. Give a computer P and k, and computing kP is extremely fast — even for an enormous k, it uses clever methods to calculate it in an instant. But flip it around: from just P and kP, how would you figure out what k was? On a toy example with only a few points, you could find it by trying each one. But the curves used in real cryptography live in a staggeringly vast world, with a number of points close to 2²⁵⁶, so checking them one at a time is effectively impossible. This is called the "elliptic curve discrete logarithm problem" (ECDLP).
In real cryptography, coordinates aren't real numbers — they're expressed as "remainders after dividing by a prime." For example, doing remainder arithmetic with the prime 17 creates a small world where only a finite number of points exist on the curve. The calculation rule (drawing a line and flipping) stays exactly the same, but the coordinates only ever move among integers. Calculating in a finite world like this lets computers handle it precisely and quickly, while also letting you make the number of points large enough to make the discrete logarithm problem extremely hard.
This asymmetry — computing kP is easy, but working backward to find k is hard — is the very core of the cipher. It's similar to how anyone can lock a padlock, but no one can open it without the key. Two people each pick a secret number (a private key), exchange only the result of adding their own secret number's worth of the public point P (their public key), and an eavesdropper can never figure out the private key from the public information alone. Where RSA uses "the difficulty of factoring," elliptic curve cryptography (ECC) uses "the difficulty of this discrete logarithm problem."
In practice, cryptocurrencies like Bitcoin and Ethereum use elliptic curve cryptography (ECDSA) for wallet signatures, and the HTTPS websites we connect to every day create secure connections using elliptic-curve-based key exchange (ECDH). It can achieve similar security with a much shorter key than RSA needs, letting devices maintain strong security while conserving smartphone battery life.
On the activity page, you can change the a and b values with sliders and watch the curve's shape change, add points to each other yourself, and check the multiples of P one by one over a small finite field built from the prime 17. At the end, you can take on the discrete logarithm problem yourself, and feel firsthand that even on a toy curve with only 18 possible cases, there's no method besides "checking them one at a time."