ECC Billiards — Elliptic Curve Puzzle Game
Reach the target point on a real elliptic curve using only doubling and addition. A puzzle game that teaches the double-and-add algorithm behind crypto keys.
Reach the target point. Two shots only: double, or add the generator.
- Generator G (0, 10)
- Target (88, 56)
- You (0, 10)
How to play
- Every dot is a point on a real elliptic curve — the same kind of curve that secures Bitcoin keys.
- DOUBLE draws the tangent at your point; ADD draws the chord through your point and the green generator. Either way you land on a third point and reflect it.
- Get to the orange target in as few shots as possible. The best route is exactly what your wallet does when it multiplies a key — you are playing double-and-add.
Shots still needed from here: 3
How it works
Each level shows a real elliptic curve over a small prime field. You start at the green generator G and must reach the orange target using just two shots: DOUBLE (the tangent at your point) and ADD (the chord through your point and G). Both are the genuine group law — a line meets the curve at a third point, which is reflected. Finding the shortest route is exactly the double-and-add ladder a wallet runs when it multiplies a private key, so playing well means you have discovered the algorithm yourself.
An educational puzzle over a deliberately tiny prime field. Real curves like secp256k1 use the same rules with astronomically larger numbers.
Frequently asked questions
How does the game relate to real cryptography?
Exactly. Doubling and adding points is how every wallet computes a public key from a private one. The only difference is scale: here the field has under 200 points so you can see them all, while secp256k1 has around 2^256.
What do DOUBLE and ADD actually do?
DOUBLE draws the tangent line at your current point, finds where it meets the curve again, and reflects it. ADD draws the chord through your point and the generator G and does the same. That is the elliptic-curve group law, unchanged.
Is the "best possible" number really the minimum?
Yes. It is computed by breadth-first search over every reachable point, not estimated, so if it says 6 then no five-shot route exists.