Take a curve like y²=x³+ax+b and invent a way to ‘add’ two points on it: draw a line through them, find where it hits the curve again, reflect. That reflection is their SUM — and it obeys real group laws. Multiplying a point by a big secret number is easy forward but practically impossible to reverse, which is why elliptic curves give the same security as RSA with far smaller keys. It guards your phone and every modern TLS handshake. Slide to add the generator to itself.
An elliptic curve over a finite field Fₚ (y²=x³+ax+b) with its point-addition law forms an abelian GROUP: to add P and Q, take the chord (or tangent if P=Q), find the third intersection, and reflect over the x-axis; a point at infinity is the identity. Repeated addition gives scalar multiplication kG, which is easy forward but whose inverse — the elliptic-curve DISCRETE LOGARITHM (recover k from kG) — is believed exponentially hard, and harder per bit than integer factoring, so ECC matches [[the-rsa|RSA]] security with much smaller keys (256-bit ECC ≈ 3072-bit RSA). It underlies ECDH, ECDSA, and modern TLS. A fail-loud self-check throws unless the group law keeps points on the curve and G+(−G)=O. ◆ real cryptography, node-verified.
Illustrated over a tiny field F₉₇ for visibility (real curves use ~256-bit primes); security rests on the UNPROVEN hardness of the EC discrete log, and Shor’s quantum algorithm would break it. The group law and on-curve arithmetic are exact.