
David V. Chudnovsky, Gregory V. Chudnovsky.
"Sequences of numbers generated by addition in formal groups and new primality and factorization tests."
Advances in Applied Mathematics 7 (1986), 385434.
MR 88h:11094.
Contains formulas and operation counts for several representations of ellipticcurve points:
projective coordinates on short Weierstrass curves,
Jacobian coordinates on short Weierstrass curves,
projective coordinates on Jacobi intersections,
and
projective coordinates on Hessian curves.
Also contains formulas for
projective coordinates on Jacobi quartics with the neutral element at infinity.
For Jacobiintersection addition,
reports "17 multiplications, including one multiplication by a constant."
For Jacobiintersection doubling,
reports 8 multiplications.
For projective addition on short Weierstrass curves, reports "14 multiplications".
For projective doubling, reports "10 multiplications."
For Jacobian addition, reports 16 multiplications.
For Jacobian doubling, reports 10 multiplications
("9 multiplications ... and one multiplication by a").
For Jacobian doubling with a4=3, reports "8 multiplications."

Peter L. Montgomery,
"Speeding the Pollard and elliptic curve methods of factorization."
Mathematics of Computation 48 (1987), 243264.
URL: http://links.jstor.org/sici?sici=00255718(198701)48:177<243:STPAEC>2.0.CO;23.
ISSN 00255718.
MR 88e:11130.
Introduces Montgomery curves
and fast differential addition formulas for Montgomery curves.

Henri Cohen, Atsuko Miyaji, Takatoshi Ono.
"Efficient elliptic curve exponentiation using mixed coordinates."
MR 1726152.
URL: http://www.math.ubordeaux.fr/~cohen/asiacrypt98.dvi.
Pages 5165 in:
Kazuo Ohta, Dingyi Pei (editors).
Advances in cryptologyASIACRYPT '98.
Lecture Notes in Computer Science 1514,
Springer,
1998.
ISBN 3540651098.
MR 2000h:94002.
Chudnovsky and Chudnovsky had reported speeds for addition and doubling
in coordinates X:Y:Z:ZZ:ZZZ with x=X/ZZ, y=Y/ZZZ, ZZ=Z^2, ZZZ=Z^3.
Cohen, Miyaji, and Ono pointed out an important improvement:
if X:Y:Z is used only for a doubling and not for a general addition
then there is no need to compute Z^3.
Sometimes X:Y:Z:ZZ:ZZZ are called "Chudnovsky coordinates" or "ChudnovskyJacobian coordinates,"
and the idea of computing ZZ,ZZZ only when they are needed is called
"mixing Chudnovsky coordinates with Jacobian coordinates."
The EFD automatically obtains the same speedup using readditions in Jacobian coordinates.

Daniel J. Bernstein.
"A software implementation of NIST P224."
URL: http://cr.yp.to/talks.html#2001.10.29.
Introduces SM tradeoffs.
In particular:
for Jacobian doubling with a4=3, reports 3M+5S
(improving previous "4 squares, 4 mults, 8 reduces" to "5 squares, 3 mults, 7 reduces");
for Jacobian addition, reports 11M+5S
("could again trade mult for square").

Nigel P. Smart.
"The Hessian form of an elliptic curve."
Pages 118125 in:
Cetin Kaya Koc, David Naccache, Christof Paar (editors).
Cryptographic hardware and embedded systemsCHES 2001.
Lecture Notes in Computer Science 2162,
Springer,
2001.
ISBN 3540425217.
Points out that
the Hessian addition formulas (dating back to Sylvester)
are 3way vectorizable.

PierreYvan Liardet, Nigel P. Smart.
"Preventing SPA/DPA in ECC systems using the Jacobi form."
MR 2003k:94033.
Pages 391401 in:
Cetin Kaya Koc, David Naccache, Christof Paar (editors).
Cryptographic hardware and embedded systemsCHES 2001.
Lecture Notes in Computer Science 2162,
Springer,
2001.
ISBN 3540425217.
Introduces faster algorithms for Jacobi intersections.
For addition, reports "16 field multiplications."
For doubling, reports "seven field multiplications."

Marc Joye, JeanJacques Quisquater.
"Hessian elliptic curves and sidechannel attacks."
URL: http://www.geocities.com/MarcJoye/publications.html.
MR 2003k:94032.
Pages 402410 in:
Cetin Kaya Koc, David Naccache, Christof Paar (editors).
Cryptographic hardware and embedded systemsCHES 2001.
Lecture Notes in Computer Science 2162,
Springer,
2001.
ISBN 3540425217.
Points out
that the Hessian addition formulas
can also be used for doublings after a permutation of input coordinates,
providing a weak form of unification:
specifically, 2(X1:Y1:Z1)=(Z1:X1:Y1)+(Y1:Z1:X1).

Eric Brier, Marc Joye.
"Weierstrass elliptic curves and sidechannel attacks."
URL: http://www.geocities.com/MarcJoye/publications.html.
Pages 335345 in:
David Naccache, Pascal Paillier.
Public key cryptography.
Lecture Notes in Computer Science 2274,
Springer,
2002.
ISBN 3540431683.
MR 2005b:94044.
Introduces strongly unified addition formulas for projective (and affine) coordinates
on short Weierstrass curves.

Olivier Billet, Marc Joye.
"The Jacobi model of an elliptic curve and sidechannel analysis."
URL: http://eprint.iacr.org/2002/125 (2002.08.22).
MR 2005c:94045.
Pages 3442 in:
Marc Fossorier, Tom Hoeholdt, Alain Poli (editors).
Applied algebra, algebraic algorithms and errorcorrecting codes
Lecture Notes in Computer Science 2643,
Springer,
2003.
ISBN 3540401113.
MR 2004j:94001.
Introduces algorithms for Jacobi quartics with the neutral element at (0,1),
generally faster than the Chudnovsky formulas with the neutral element at infinity.
In particular, 10M+3S+1D for addition in projective coordinates.

Christophe Doche, Thomas Icart, David R. Kohel.
"Efficient scalar multiplication by isogeny decompositions."
Pages 191206 in:
Moti Yung, Yevgeniy Dodis, Aggelos Kiayias, Tal Malkin.
9th international conference on theory and practice in publickey cryptography, New York, NY, USA, April 2426, 2006, proceedings.
Lecture Notes in Computer Science 3958,
Springer,
2006.
ISBN 9783540338512.
Introduces doublingoriented DocheIcartKohel curves.
Reports 3M+4S+2D for doubling.
Reports 9M+3S+1D for mixed addition
("9M+3S if a multiplication by u is negligible").
Also introduces triplingoriented DocheIcartKohel curves.
Reports 4M+5S+2D for doubling
("4M+5S as long as we neglect multiplications by u, otherwise a doubling can be obtained with 6M+4S";
no explanation of the 4S).
Reports 8M+3S+1D for mixed addition
("8M+3S to compute an addition. If u is a random element in the field,
then an extra multiplication is required").
Reports 6M+6S+2D for tripling
("6M+6S ... a multiplication by u is negligible. Otherwise, 8M+6S are necessary").

Daniel J. Bernstein, Tanja Lange.
"Faster addition and doubling on elliptic curves."
URL:
http://cr.yp.to/papers.html#newelliptic (2007.04.10);
http://cr.yp.to/papers.html#newelliptic (2007.05.22);
http://cr.yp.to/papers.html#newelliptic (2007.07.16);
http://cr.yp.to/papers.html#newelliptic (2007.09.06);
http://eprint.iacr.org/2007/286.
Pages 2950 in:
Kaoru Kurosawa (editor).
Advances in Cryptology: ASIACRYPT 2007.
Lecture Notes in Computer Science 4833,
Springer,
2007.
Presents fast addition and doubling formulas for projective Edwards coordinates.
Reports 3M+4S for doubling.
Reports 10M+1S+1D for addition.
Also reports initial construction of the EFD,
with several speedups for previous coordinate systems.
For doublingoriented DocheIcartKohel coordinates:
reports 12M+5S+1D for addition, 8M+4S+1D for mixed addition, 2M+5S+2D for doubling.
For triplingoriented DocheIcartKohel coordinates:
reports 11M+6S+1D for addition, 10M+6S+1D for readdition, 7M+4S+1D for mixed addition,
2M+7S+2D for doubling.
For Jacobi intersections:
reports 3M+4S for doubling.

Sylvain Duquesne.
"Improving the arithmetic of elliptic curves in the Jacobi model."
Submitted 2007.04.25.
Information Processing Letters 104 (2007.10),
101105.
Introduces X,Y,Z,X^2,Z^2,X*Z coordinates for Jacobi quartics.
Reports 9M+2S+1D for addition.

Huseyin Hisil, Gary Carter, Ed Dawson.
"New formulae for efficient elliptic curve arithmetic."
Submitted 2007.08.20.
Pages 138151 in:
Kannan Srinathan, Chandrasekaran Pandu Rangan, Moti Yung (editors).
Progress in Cryptology: INDOCRYPT 2007.
Lecture Notes in Computer Science 4859,
Springer,
2007.
ISBN 9783540770251.
Various speedups.

Daniel J. Bernstein, Peter Birkner, Tanja Lange, Christiane Peters.
"Optimizing doublebase ellipticcurve singlescalar multiplication."
Submitted 2007.08.20.
URL:
http://eprint.iacr.org/2007/410 (2007.10.25);
http://cr.yp.to/papers.html#doublebase (2007.10.28).
Pages 167182 in:
Kannan Srinathan, Chandrasekaran Pandu Rangan, Moti Yung (editors).
Progress in Cryptology: INDOCRYPT 2007.
Lecture Notes in Computer Science 4859,
Springer,
2007.
ISBN 9783540770251.
Includes, among other things,
a 9M+4S tripling formula for Edwards curves,
and a 7M+7S tripling formula for Edwards curves.
Hisil, Carter, and Dawson
independently found a 9M+4S tripling formula for Edwards curves.

Daniel J. Bernstein, Tanja Lange.
"Inverted Edwards coordinates."
URL:
http://cr.yp.to/papers.html#inverted (2007.10.09);
http://eprint.iacr.org/2007/410 (2007.10.26).
Pages 2027 in:
Serdar Boztas, Hsiaofeng Lu (editors).
Applied algebra, algebraic algorithms and errorcorrecting codes, 17th international symposium, AAECC17, Bangalore, India, December 1620, 2007, proceedings.
Lecture Notes in Computer Science 4851,
Springer,
2007.
ISBN 9783540772231.
Introduces inverted coordinates for Edwards curves.
Reports 3M+4S+1D for doubling.
Reports 9M+1S+1D for addition.

Daniel J. Bernstein, Tanja Lange.
"Analysis and optimization of ellipticcurve singlescalar multiplication."
URL:
http://cr.yp.to/papers.html#efd (2007.12.04);
http://eprint.iacr.org/2007/455 (2007.12.07).
To appear in the proceedings of Fq8,
Contemporary Mathematics,
American Mathematical Society.
Various speedups.

Huseyin Hisil, Kenneth Wong, Gary Carter, Ed Dawson.
"Faster group operations on elliptic curves."
URL: http://eprint.iacr.org/2007/441 (2008.02.25).
Various speedups.

Huseyin Hisil, Kenneth Wong, Gary Carter, Ed Dawson.
"Twisted Edwards curves revisited."
URL: http://eprint.iacr.org/2008/522.
Various speedups.
The EFD also contains some corrections and speedups
that cannot be found in the previous literature.
Sources are indicated in the corresponding database entries.