The image everyone has seen — that smooth, symmetrical curve gently rising to the right — is not the Bitcoin curve. It is the drawing of the same equation over real numbers, used for explanation. Over the finite field from the previous lesson, what exists is a cloud of scattered points, with no curve at all, yet all the rules still apply.
The equation is y² = x³ + 7. In the general terms in which these curves are written, the coefficient a is zero and b is seven — and that zero is not a minor detail: it shortens the formulas that follow and is one of the reasons secp256k1 is fast.
A pair of numbers is a point on the curve if, when calculated modulo p, both sides of the equation yield the same remainder. Since each working x produces two roots of y, one even and one odd, the cloud is symmetrical: for every point, there is its mirror, which is called its negative.
The sum of two points has a geometric definition that originated from real numbers and survived the change of terrain. Draw a line through the two points, find where it intersects the curve for the third time, and mirror that intersection. The result is the sum. In the finite field, there is no line to draw, but there is the formula that the line produces, and it works the same.
It's worth writing the formula because it is short. For two different points, calculate the slope s as the difference of the y's divided by the difference of the x's — and remember that dividing here means multiplying by the inverse, exactly as the previous lesson showed. Then the x of the result is s squared minus the two original x's, and the y of the result is s times the difference between the old x and the new one, minus the original y. Three lines, and none of them leave the field.
Adding a point to itself is a separate case because there is no line that passes through just one point. The tangent is used, and the slope becomes three times the x squared divided by two times the y. This is where a equals zero appears: in the general formula, there would be one more term, which in secp256k1 simply does not exist.
One case remains, and it requires inventing something. Add a point to its mirror. The line passing through both is vertical, and a vertical line does not intersect the curve a third time. There is no answer within the cloud. The solution was to declare that there is a point there, in the place where the vertical points: the point at infinity.
It is not a patch. With this additional element, the set satisfies the four properties that define a group: adding two points always results in a point within the set, the order of parentheses doesn't matter, there is a neutral element that, when added to any point, leaves it unchanged, and every point has an opposite that cancels it out. The point at infinity is this neutral element — the zero of this arithmetic. It is because it exists that it makes sense to talk about multiplying a point by a number.
The exact parameters of secp256k1 have been published since 2000 and do not change: the prime p, the zero, the seven, the two coordinates of the generator G written with sixty-four characters each, and the number n, which is how many points G reaches before returning to the point at infinity.
Regarding n, there is a practical consequence. It is prime, and the total number of points on the curve is exactly n — which mathematicians express by saying the cofactor is one. In curves where this does not happen, there are small hidden subgroups, and with them an entire family of attacks that trick an implementation into working in a tiny part of the space. In secp256k1, this type of attack has nowhere to start.
You already know how to add points and double points. Multiplying a point by a 256-bit number is repeating these two operations, and the next lesson shows how this is done in less than three hundred steps — and why undoing it still costs 2^128.