Scalar multiplication repeatedly adds an elliptic-curve point to itself. Starting with G, adding it x times produces P, written P = G + ··· + G or [x]G; x is the scalar. section 5.3.1
In elliptic-curve cryptography, scalar multiplication matters because:
- Computing [x]G is feasible with efficient point-addition algorithms, while recovering x from P and G is the elliptic curve discrete logarithm problem. section 5.3.1
- Montgomery’s ladder alternates point addition and point doubling, performing both operations rather than branching on secret input to reduce timing leakage. section 13.4.1
- Public points must be validated, because invalid-curve attacks can make scalar multiplication operate on a curve with small subgroups. section 5.4
From a base point to a public point
Choose a point G and a secret scalar x. Repeatedly add G to obtain P = [x]G. The operation is the elliptic-curve analogue of exponentiation in a Diffie–Hellman group, while reversing it requires solving the elliptic curve discrete logarithm problem. section 5.3.1
Figure 5.10 Building on figure 5.9, addition on an elliptic curve is also defined when adding a point to itself or when two points cancel each other to result in the point at infinity (O).
Visualizes point doubling and cancellation to the point at infinity, the geometric operations underlying repeated point addition. section 5.3.1
