0

Point addition on elliptic curves allows us to determine a point R given two distinct points P and Q so that P + Q = R. There are various ways to calculate point addition depending on the type of curve. A brief explanation of point addition is given here.

My question looks at the opposite path. Given a point R(x,y) on a curve, find two distinct points P(x,y) and Q(x,y) so that (a) P(x,y) + Q(x,y) = R(x,y) and (b) the y value is the same for each point P, Q and R.

Is it possible? If not, why not?

The answer can be exemplified using the Secp256k1 curve to limit the scope.

Thanks.

Robert
  • 117
  • For the common Weierstrass form affine Elliptic curve of the form $$ x^3+ax+b = y^2 $$ having a fixed $y$ means a solution to $$ x^3+ax+c = 0 $$ where $c=b-y^2$. This can have exactly $3$ different roots so the points can exist. However the addition condition can only be satisfied if $2y=0$. This forces $y=0$ unless the ground field has characteristic $2$ (I think some non-zero $y$ may be possible there for characteristic $2$). – Yong Hao Ng Dec 11 '19 at 02:34

2 Answers2

3

There are several examples listed in the LMFDB. For exmaple, the LMFDB curve $40.a2$ $\, y^2 = x^3 - 7x - 6\,$ has three integral points $\, P:= (-1, 0),\;\; Q := (3, 0),\;\; R := (-2,0),\;\; P\ + Q = R. \,$ All three points have the same $\,y\,$ value $0$. Thus, in answer to your question, for some curves and for some points it is possible.

Somos
  • 35,251
  • 3
  • 30
  • 76
  • Right. It seems to me that the only solutions have $y=0$, and thus all $2$-division points must be rational over the (unspecified) ground field. – Lubin Dec 11 '19 at 02:01
  • @Lubin That was my thoughts also which motivated my search of LMFDB. – Somos Dec 11 '19 at 02:30
  • Thanks for your answer. For some reason I did not see it so I apologize for not accepting it. – Robert Dec 11 '19 at 09:17
1

Found one example for non-zero $y$: Let the degree $3$ finite field $K$ of characteristic $2$ be $$ K:= \mathbb Z[a]/(2,a^3+a+1) $$ and consider the following Elliptic Curve $E$ over $K$ $$ E:y^2+xy+y=x^3+x+a $$ Then there are three points $$ \begin{align*} P&=(a,a^2+a),& Q&=(a+1,a^2+a), & R&=(1,a^2+a) \end{align*} $$ on $E$ and we may verify that $$ P+Q=R $$

The line $PQ$ is by definition $y=a^2+a$ with gradient $\lambda = 0$ and constant $v=a^2+a$. The $x$-coordinate of $R$ is given by $$ x_R=\lambda^2+a_1\lambda-a_2-x_P-x_Q = -x_P-x_Q= -(a)-(a+1) \equiv 1 \pmod 2 $$ The $y$-coordinates of $R$ is $$ y_R = -(\lambda+a_1)x_3-v-a_3=-(0+1)(1)-(a^2+a)-1\equiv a^2+a \pmod 2 $$ Hence we get $$ R = (x_R,y_R) = (1,a^2+a) $$

Yong Hao Ng
  • 4,795
  • 19
  • 26