← Back to Blog

ZK Journey Week 5 — Isomorphisms, Why Cubics, and Counting Points

Why do we need two groups that "look the same"? Why specifically cubic curves? And how many points does an elliptic curve actually have? This week connected the algebra to the cryptography.

✍ 0xTheBlackPanther 📅 Mar 2026 ⏱ 14 min read 🏷 ZK, Isomorphisms, Elliptic Curves, Cyclic Groups, Cryptography
🔐 ZK Journey — Week 5 of 14 A Move security researcher learning zero-knowledge proofs from scratch. Documenting the full journey.

The Big Picture: Two Groups, One Structure

João opened this session by stepping back from the formulas to motivate why we're studying elliptic curves at all. The answer comes down to a single idea: we need two groups that behave identically, but where going from one to the other is easy in one direction and hard in reverse.

On the left, we have a familiar group: numbers. ℤp — integers {0, 1, 2, ..., p−1} with addition mod p. We know how to add numbers. Simple.

On the right, we want a group of objects — something that isn't numbers — where every operation in the number group has an exact counterpart. If 5 + 4 ≡ 2 (mod 7) on the left, then the objects labeled 5G and 4G must combine to give the object labeled 2G on the right. Same structure, different elements.

The goal: Find a group of non-number objects that mirrors the number group perfectly — same operation table, same structure — but where the mapping from numbers to objects is easy and the reverse mapping is hard. That's the foundation of all public-key cryptography.


Isomorphism: "Same Table, Different Labels"

João introduced this with a beautiful example. Take ℤ6 — the numbers {0, 1, 2, 3, 4, 5} with addition mod 6. Now consider a completely different group: rotations of a circle in 60° increments.

The mapping: numbers ↔ rotations 0 → 0°    1 → 60°    2 → 120°    3 → 180°    4 → 240°    5 → 300°

The operation on rotations is composition: "rotate by A, then rotate by B."

Let's test it. In the number group: 4 + 3 = 7 ≡ 1 (mod 6). In the rotation group: 240° composed with 180° = 420° ≡ 60°. And 60° corresponds to 1. It works.

João built the full operation tables for both groups to make this undeniable. Here's a smaller example with ℤ3 and rotations by 120°:

ℤ₃ — Numbers (mod 3)
+012
0012
1120
2201
Rotations — Compose (mod 360°)
120°240°
120°240°
120°120°240°
240°240°120°

The two tables are structurally identical. Replace 0 with 0°, 1 with 120°, 2 with 240°, and the left table becomes the right table. Same structure, different labels. This is called an isomorphism — a bijective mapping between two groups that preserves the operation.

João's definition, distilled: Two groups are isomorphic when they have the same operation table — just with different labels for the elements. Every operation you can do in one group has an exact mirror in the other.


Why Rotations Don't Work for Cryptography

So we have two isomorphic groups — numbers and rotations. Can we use rotations to hide numbers?

Suppose I want to prove I know two numbers that add to 3 (mod 6), without revealing which numbers. Instead of sending the numbers (say, 1 and 2), I send their rotation equivalents: 60° and 120°. The verifier composes them: 60° + 120° = 180°. They check: does 180° correspond to 3? Yes. Proof accepted.

But there's a fatal problem.

The verifier can reverse the mapping trivially. If I give you 60°, you immediately know it's 1 (just divide by 60). The mapping number → rotation is easy, but rotation → number is equally easy. There's no trapdoor. The "hiding" is an illusion — the verifier sees right through it.

For cryptography, we need a mapping where going from number to object is easy, but going from object back to number is computationally infeasible. Rotations fail this requirement. Elliptic curve points satisfy it — that's why we use them.

The requirement for useful cryptographic isomorphism Number → Object: Easy (compute xG by repeated point addition)
Object → Number: Hard (given point P = xG, find x → elliptic curve discrete log problem)

Rotations: both directions easy → useless for crypto
Elliptic curves: forward easy, reverse hard → perfect for crypto

Where Elliptic Curves Fit in the Cryptographic Landscape

João stepped back to frame the bigger picture. Modern cryptography uses two fundamental types:

PUBLIC KEY (ASYMMETRIC) Two keys: private + public
Based on hard math problems
Used for: key exchange, signatures
Examples: ECDSA, Diffie-Hellman, RSA

Slower but enables trust between strangers
PRIVATE KEY (SYMMETRIC) One shared key
Based on "mixing bits" (no hard problem)
Used for: encrypting actual messages
Examples: AES, ChaCha20

Much faster but requires a shared secret

In practice, both are used together. You use public-key crypto (the slow one) to securely exchange a shared key, then switch to symmetric crypto (the fast one) to encrypt the actual data. This is how TLS/SSL works — every HTTPS connection you make does this handshake.

Public-key crypto is based on hard problems. João outlined three of them, in increasing order of hardness:

  1. Prime factorization: Given Y = P₁ × P₂ (both prime), find P₁ and P₂. This powers RSA. It's hard, but there are sub-exponential algorithms (general number field sieve). Vulnerable to quantum computers (Shor's algorithm).
  2. Integer discrete log: Given qx ≡ Y (mod p), find x. This powers Diffie-Hellman and ElGamal. Also hard, also has sub-exponential attacks, also vulnerable to quantum. Needs 4000-5000 bit keys.
  3. Elliptic curve discrete log: Given xG = P (point multiplication on a curve), find x. This powers ECDSA, EC-Diffie-Hellman, and ZK proof systems. No known sub-exponential classical attacks. 256-bit keys are sufficient. Also vulnerable to quantum, but the hardest classical problem of the three.

Elliptic curves give us the hardest problem with the smallest keys. That's the practical reason they dominate modern cryptography. Not because they're proven unbreakable — because nobody has found an efficient way to break them.


Why Specifically Cubic? The Proof

In Week 4, João stated that elliptic curves (cubic) have a special property: a line through two points on the curve always hits a third point. This week, he proved why this only works for cubics.

The proof is elegant. Take the curve y² = x³ + ax + b and any non-vertical line y = mx + k. To find where they intersect, substitute the line equation into the curve equation:

# Substituting line into curve (mx + k)² = x³ + ax + b
m²x² + 2mkx + k² = x³ + ax + b

// Rearrange to standard form:
x³ − m²x² + (a − 2mk)x + (b − k²) = 0

// This is a CUBIC equation in x
// Cubic equations have exactly 3 roots (counting multiplicity)

A cubic equation always has exactly 3 roots (in the complex numbers). But roots come in two flavors: real and imaginary. The key insight is that imaginary roots always come in conjugate pairs — you can't have just one imaginary root. So the possibilities are:

Root count for a cubic equation Option 1: 3 real roots + 0 imaginary → line hits curve at 3 points
Option 2: 1 real root + 2 imaginary → line hits curve at 1 point

Can't have 2 real + 1 imaginary → imaginary roots come in pairs!

So a line either crosses the curve 1 time or 3 times — never 2.

When we draw a line through two known points on the curve, we already know two of the three roots (x₁ and x₂). Since those are real, the third root must also be real (can't have 1 imaginary root alone). So the line must hit a third point. Guaranteed.

What about tangent lines? When a line is tangent at a point, that point counts as a "double root" (multiplicity 2) — it's like two roots that happen to coincide. So tangent at point A gives roots {x₁, x₁, x₃} — still three roots, still guaranteed to hit one more point.

Why quadratic curves (circles, ellipses) don't work: Substituting a line into a degree-2 curve gives a quadratic equation — only 2 roots. A line through two points on a circle gives two intersections, period. No third point. No natural binary operation. No group.

Why quartic or higher don't work: A degree-4 curve would give 4 roots from a line intersection. You could get 2 or 4 real intersections — and a line through 2 known points might hit 0 or 2 more, with no guarantee of exactly 1 more. The "input two points, get exactly one output" structure is lost.

Cubic is the sweet spot: Exactly 3 roots means a line through 2 known points gives exactly 1 new point. That's a binary operation. That's a group.

Brandon connected this beautifully: "So it's these properties that allow us to satisfy all the properties of a group." Exactly. Cubics are special not because someone decided they should be — but because the root structure of degree-3 polynomials is the only one that naturally produces a well-defined binary operation on curve points.


Vertical Lines: The Special Case

João addressed one detail from the proof. The analysis above assumes a non-vertical line (y = mx + k). Vertical lines (x = constant) don't fit this form — their slope is infinite.

For a vertical line, you substitute a constant x into y² = x³ + ax + b, giving y² = C for some constant. This is a quadratic equation in y, not cubic. So the possibilities are:

# Vertical line intersections with the curve x = constant → y² = C

// Quadratic in y → 0 or 2 real roots
C < 0 → 0 intersections (line misses curve)
C > 0 → 2 intersections at (x, √C) and (x, −√C)
C = 0 → 1 intersection at (x, 0) — tangent at the x-axis

Vertical lines give 0 or 2 intersections, not 3. That's why we handle them separately in the group definition — Rule 3 from Week 4 says "if the line is vertical, the result is the point at infinity." The point at infinity patches the one case where the cubic property doesn't apply.


Vieta's Formulas: Finding the Third Point

Once you know why a third intersection exists, how do you actually find it? João showed the technique using Vieta's formulas — a classic result that relates the roots of a polynomial to its coefficients.

For a cubic equation x³ + cx² + ... = 0 with roots x₁, x₂, x₃, Vieta's formulas say:

# Vieta's formula for cubic polynomials x₁ + x₂ + x₃ = −(coefficient of x²) / (coefficient of x³)

// For our intersection equation: x³ − m²x² + ... = 0
// Coefficient of x³ is 1, coefficient of x² is −m²

x₁ + x₂ + x₃ = −(−m²) / 1 = m²

// We know x₁ and x₂ (the two input points), so:
x₃ = m² − x₁ − x₂

// Then plug x₃ back into the line equation to get y₃
// Then flip: final y = −y₃ (the negation step)

This is exactly the point addition formula from Week 4. Vieta's formulas give a shortcut: instead of solving a full cubic equation, you use the relationship between roots and coefficients to jump straight to x₃. Since you already know two of the three roots, you only need one subtraction.

Brandon's observation: "Vieta's formulas work for nth-degree polynomials generally. But does it still work when the original equation is y² = x³... not y = x³...?" Yes — because you substitute the line equation to eliminate y, reducing everything to a single polynomial in x. The substitution is what converts the system into a standard polynomial that Vieta's applies to.


Counting Points: How Many Points Does a Curve Have?

Over the reals, an elliptic curve has infinitely many points. Over a finite field 𝔽p, the curve has a finite number of points — but how many?

João walked through the counting argument. For each x value in {0, 1, ..., p−1}, you compute the right side of y² = x³ + ax + b. Call it C. Then you ask: is C a quadratic residue mod p? (i.e., does some y exist where y² ≡ C?)

Point counting heuristic For each x value, compute C = x³ + ax + b (mod p)

~Half of all values in 𝔽p are quadratic residues (they have a square root)
~Half are not (no square root exists)

If C is a quadratic residue → 2 points at this x (both y and −y)
If C is not → 0 points at this x

So on average: half of the p values of x contribute 2 points each
Total ≈ p/2 × 2 = p points, plus the point at infinity ≈ p + 1 points

This isn't exact — the actual count fluctuates around p + 1. But the order of magnitude is always close to p. A curve over 𝔽13 has roughly 13–14 points. A curve over 𝔽101 has roughly 100 points. A curve over a 256-bit prime has roughly 2256 points.

This gives us two important numbers for any elliptic curve over a finite field:

Two numbers that matter Characteristic of the field (p): The prime that defines 𝔽p. Determines the size of the field that coordinates live in.

Order of the group (n): The actual number of points on the curve (including 𝒪). This is how many elements are in our group. Always close to p, but not exactly p.

In Tornado Cash's Groth16 verification contract, both of these are stored as large constants. João tried to show us on GitHub but it was down — homework: go look at the verifier contract yourself!

Why both numbers matter: The characteristic p determines what field the coordinates live in (all arithmetic is mod p). The order n determines the size of the cyclic group — which is the number of possible private keys, the number of distinct points the generator can reach, and the security parameter of the system. They're approximately equal but not identical, and both are critical for the math to work.


Cyclic Groups: A Preview

João previewed the next major topic: cyclic groups. An elliptic curve group is always cyclic (or contains a large cyclic subgroup), which means there exists a generator G where repeated addition hits every point:

# Generator G reaches every point in the group G, 2G, 3G, 4G, 5G, 6G, ... , nG = 𝒪 (back to identity)

// After n additions, you cycle back to the start
// Every point in the group appears exactly once in this sequence
// n is the order of the group

A student asked: "What happens when you hit the point at infinity? Can you not generate anymore?" João clarified: the point at infinity is where the cycle completes. After nG = 𝒪, the next addition (n+1)G = 𝒪 + G = G — you're back at the start. You can keep going forever; you just loop. And the sequence 1G, 2G, ..., nG covers every point exactly once before cycling.

Not all groups are cyclic. But for elliptic curve cryptography, we specifically choose curves that produce cyclic groups (or we work within a cyclic subgroup). Cyclic is important because it gives us the clean number-to-point mapping we need for the discrete log problem.


Choosing Curves: Standards and Pairings

Brandon asked about curve selection: "Are there standard elliptic curves? Is it hard to pick a good one?"

Yes, there are standards. The most well-known:

Standard curves in practice secp256k1 — Used by Bitcoin and Ethereum for ECDSA signatures. Chosen by Satoshi (nobody knows exactly why this one). Cannot do pairings → not useful for SNARKs.

BN254 — Used in Groth16 (the proof system we're building toward). Supports pairings → essential for SNARKs.

BLS12-381 — Newer pairing-friendly curve with better security margins. Used in Ethereum 2.0 BLS signatures.

Choosing a good curve requires proving that the discrete log problem is hard for that specific curve. There are methods for this, but it's specialized cryptographer work.

The mention of pairings was a preview. Not all curves support pairings — a special bilinear map between groups that enables SNARKs. secp256k1 doesn't support pairings, which is why it works for signatures but not for ZK proofs. BN254 and BLS12-381 are specifically constructed to be pairing-friendly. We'll learn about pairings in a few weeks.

Everything vulnerable to quantum: João reiterated that all these curves — secp256k1, BN254, BLS12-381 — are vulnerable to Shor's algorithm on quantum computers. The discrete log problem (both integer and elliptic curve versions) and prime factorization are all theoretically broken by quantum. What survives: hash functions (no mathematical structure to exploit) and lattice-based cryptography (different hard problem). His personal take on quantum computing: "Science is crazy, but I don't believe they will be able to do it. They're not even close."


The Chain So Far

  1. Week 1 — Modular arithmetic: The numbers. Computing in 𝔽p.
  2. Week 2 — Abstract algebra: The rules. Groups, rings, fields.
  3. Week 3 — Why primes matter: The proofs. Inverses, closure, the foundation.
  4. Week 4 — Elliptic curves over reals: The geometry. Chord-and-tangent rule, point at infinity, why we flip.
  5. Week 5 — Isomorphisms and why cubics: The connections. Groups that mirror each other, the proof that only cubics give a natural group operation, counting points, and the two numbers (characteristic and order) that define everything.

What's Next

Next week: cyclic groups formalized. We'll learn what makes a group cyclic, what a generator is, what the order of an element means, and why Lagrange's theorem constrains everything. João also hinted at subgroups — even if a full group isn't cyclic, we can always find cyclic subgroups within it. This is the last piece of algebra before pairings, which are the final mathematical ingredient for Groth16.

Week 5 done. We know why cubics are the only curves that give us groups, why rotations fail at cryptography, and why two nearly-equal large numbers — the field characteristic and the group order — define the security of every elliptic curve system. Next week: cyclic groups and generators. 🔄

📝 ZK and cryptography evolve fast — if any tip here is outdated, incorrect, or no longer applies, please reach out on X so I can update this article accordingly.

Course: Rare Skills ZK Bootcamp
Instructor: João Paulo Morais (PhD Physics, 12+ years in ZK)
Duration: ~13-14 weeks
Goal: Code Groth16 from scratch
Week: 5 / 14
Topics: Isomorphisms, number ↔ rotation mapping, cryptographic asymmetry, why cubics (root counting proof), Vieta's formulas, quadratic residues, point counting, characteristic vs order, cyclic group preview, curve standards
Key moment: "Rotations fail because the reverse mapping is trivial. Elliptic curves succeed because it's not."
Rare Skills: rareskills.io
Follow my journey: @thepantherplus