Having produced the curve with a rational procedure with rational inputs, the coefficients are rational. When we have two rational points on an EC with rational coefficients, the line thru those points will meet the curve again in a point with rational coordinates. A tangent at a rational point also meets the curve at a rational point. To make these two claims true, however, we must add a point at infinity as an honorary solution to the EC equation. Such calculations are at the root of EC crypto so we pursue them here.

Consider the line thru two points, p and q, on the curve.
Parameterize that line linearly so that the parameter, λ is 0 at p and 1 at q.
L(0) = p and L(1) = q and L(λ) = (X(λ), Y(λ)) where X and Y are both inhomogeneous linear functions of one real.
If f(x, y) is the 3rd degree polynomial whose roots are our curve, then g(λ) = f(X(λ), Y(λ)) is a 3rd degree polynomial in λ.

Alternatives:

- g is a 3rd degree polynomial. We find the coefficients from four values: g(0), g(1), g(½), g(−1).
- Further g(0) = g(1) = 0 which means that g(λ) = bλ(λ−1)(λ−z) for some b and z. We will compute b and z by evaluating g(½) = b½(−½)(½−z) = b(z/4 − ⅛) but also g(½) = f(X(½), Y(½)). Equating these two expressions for g(½) gives us g(½) = z/4 − ⅛ or z = 4g(½)+½. Then (X(z), Y(z)) is the other point on the curve that we sought. This is a slightly tedious calculation but trivial arithmetic.

Simplifying to the Wierstraß equation.

This is a modern book on elliptic curves: J.S. Milne: Elliptic Curves. It is more interested in Fermat’s last theorem but has good dense EC theory. It presents some 19th century math that is relevant to Fermat’s conjecture, but in 21st century form, along with much other relevant modern math.

On another tack: Elliptic Curve Digital Signature Algorithm

Math