Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / W coordinates for binary Edwards curves

W coordinates for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:

  d1*(x+y)+d2*(x^²+y^²)=(x+x^²)*(y+y^²)

W coordinates [database entry] represent x y as w satisfying the following equations:

  x+y=w

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

11M for doubling: 1I+1M+2S.
13M for differential addition: 1I+3M+1S.
24M for differential addition and doubling: 2I+4M+3S.
0M for scaling: 0M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

11.4M for doubling: 1I+1M+2S.
13.2M for differential addition: 1I+3M+1S.
24.6M for differential addition and doubling: 2I+4M+3S.
0M for scaling: 0M.

Summary of all explicit formulas

Operation	Assumptions	Cost
doubling	d2overd1plus1=d2/d1+1	1I + 1M + 2S + 1*d2overd1plus1
diffadd	d2overd1plus1=d2/d1+1	1I + 3M + 1S + 1*d2overd1plus1
ladder	d2overd1plus1=d2/d1+1	2I + 4M + 3S + 2*d2overd1plus1
scaling		0M

Explicit formulas for addition

Explicit formulas for doubling

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2overd1plus1=d2/d1+1.
Cost: 1I + 1M + 2S + 1*d2overd1plus1 + 3add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      A = w1^²
      J = A^²
      K = A+J
      w3 = K/(d1+K+d2overd1plus1*J)

Explicit formulas for tripling

Explicit formulas for differential addition

The "dadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2overd1plus1=d2/d1+1.
Cost: 1I + 3M + 1S + 1*d2overd1plus1 + 6add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      R = w2*w3
      S = R^²
      T = R*(1+w2+w3)+S
      w5 = T/(d1+T+d2overd1plus1*S)+w1

Explicit formulas for differential addition and doubling

The "ladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2overd1plus1=d2/d1+1.
Cost: 2I + 4M + 3S + 2*d2overd1plus1 + 9add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      R = w2*w3
      S = R^²
      T = R*(1+w2+w3)+S
      w5 = T/(d1+T+d2overd1plus1*S)+w1
      A = w2^²
      J = A^²
      K = A+J
      w4 = K/(d1+K+d2overd1plus1*J)

Explicit formulas for scaling

The "copy" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 0add.
Explicit formulas:
```
      w3 = w1
```