How do you verify whether a given point $P(x_0, y_0)$ lies on an elliptic curve $y^2 \equiv x^3 + ax + b \mod p$?

Simply plug the coordinates into both sides of the equation and check if they're equal mod p: compute $y_0^2 \mod p$ and $x_0^3 + ax_0 + b \mod p$. If they match, the point is on the curve.

Procedure:

1. Compute the left side: $y_0^2 \mod p$
2. Compute the right side: $x_0^3 + a \cdot x_0 + b \mod p$
3. If left = right → point IS on the curve. Otherwise → NOT on the curve.

Example: Is $P(3, 1)$ on $y^2 = x^3 + 3x + 2 \mod 7$?

• Left: $1^2 \mod 7 = 1$
• Right: $3^3 + 3 \cdot 3 + 2 \mod 7 = 27 + 9 + 2 = 38 \mod 7 = 3$
• $1 \neq 3$ → NOT on the curve

Example: Is $P(4, 1)$ on the same curve?

• Left: $1^2 \mod 7 = 1$
• Right: $4^3 + 3 \cdot 4 + 2 \mod 7 = 64 + 12 + 2 = 78 \mod 7 = 1$
• $1 = 1$ → YES, on the curve ✓

Why this matters beyond just verifying:

• Security: In ECDH, a received point must be verified to lie on the curve. An attacker could send an "invalid curve point" to trick the victim into leaking key bits (invalid curve attack)
• Parameter validation: When using standardized curves, implementations should verify that the base point $G$ satisfies the curve equation

Go deeper:

• Corbellini — ECC part 1 (curves and the group law) — the curve equation a point must satisfy, explained visually.