Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / WZ coordinates with d1=d2 for binary Edwards curves

WZ coordinates with d1=d2 for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:

  d1*(x+y)+d2*(x^²+y^²)=(x+x^²)*(y+y^²)

WZ coordinates with d1=d2 [database entry] make the additional assumptions

  d1=d2

and represent x y as W Z satisfying the following equations:

  x+y=W/Z

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

1M for doubling: 1M+3S. 1M+3S.
6M for differential addition: 6M+2S. 6M+2S.
5M for differential addition with Z1=1: 5M+1S.
7M for differential addition and doubling: 7M+4S.
5M for differential addition and doubling with Z1=1: 5M+4S.
11M for scaling: 1I+1M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

1.6M for doubling: 1M+3S. 1M+3S.
6.4M for differential addition: 6M+2S. 6M+2S.
5.2M for differential addition with Z1=1: 5M+1S.
7.8M for differential addition and doubling: 7M+4S.
5.8M for differential addition and doubling with Z1=1: 5M+4S.
11M for scaling: 1I+1M.

Summary of all explicit formulas

Operation	Assumptions	Cost
doubling		1M + 3S + 1*d1
doubling	e^⁴=d1 and f^⁴=d2/d1+1	1M + 3S + 1e + 1f
diffadd	Z1=1	5M + 1S + 1*d1
diffadd	e^²=d1 and f^²=d2/d1+1 and Z1=1	6M + 1S + 1e + 1f
diffadd		6M + 2S + 2*d1
diffadd	e^²=d1 and f^²=d2/d1+1	6M + 2S + 1d1 + 1e + 1*f
diffadd		7M + 1S + 1*d1
diffadd	e^²=d1 and f^²=d2/d1+1	8M + 1S + 1e + 1f
ladder	Z1=1	5M + 4S + 2*d1
ladder	Z1=1 and e^⁴=d1 and f^⁴=d2/d1+1 and ee=ee and ff=ff	6M + 4S + 1ee + 1ff + 1e + 1f
ladder		7M + 4S + 2*d1
ladder	e^⁴=d1 and f^⁴=d2/d1+1 and ee=ee and ff=ff	8M + 4S + 1ee + 1ff + 1e + 1f
scaling		1I + 1M

Explicit formulas for addition

Explicit formulas for doubling

The "dbl-2008-blr-1" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1M + 3S + 1*d1 + 2add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W1*(Z1+W1)
      W3 = C^²
      Z3 = d1*(Z1^²)^²+W3

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: e^⁴=d1 and f^⁴=d2/d1+1.
Cost: 1M + 3S + 1*e + 1*f + 3add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W1*(Z1+W1)
      W3 = C^²
      Z3 = W3+((e*Z1+f*W1)^²)^²

Explicit formulas for tripling

Explicit formulas for differential addition

The "mdadd-2008-blr-1" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 5M + 1S + 1*d1 + 4add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      E = Z2*Z3
      V = C*D
      U = V+d1*E^²
      W5 = V+W1*U
      Z5 = U

The "mdadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: e^²=d1 and f^²=d2/d1+1 and Z1=1.
Cost: 6M + 1S + 1*e + 1*f + 5add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      E = Z2*Z3
      F = W2*W3
      V = C*D
      U = V+(e*E+f*F)^²
      W5 = V+W1*U
      Z5 = U

The "dadd-2008-blr-3" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 6M + 2S + 2*d1 + 5add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      A = W2*W3
      B = Z2*Z3
      C = (W2+Z2)*(W3+Z3)
      W5 = Z1*(d1*(C+A+B)^²)
      Z5 = W1*(A*C+d1*B^²)

The "dadd-2008-blr-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: e^²=d1 and f^²=d2/d1+1.
Cost: 6M + 2S + 1*d1 + 1*e + 1*f + 6add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      A = W2*W3
      B = Z2*Z3
      C = (W2+Z2)*(W3+Z3)
      W5 = Z1*(d1*(C+A+B)^²)
      Z5 = W1*(A*C+(e*B+f*A)^²)

The "dadd-2008-blr-1" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 1S + 1*d1 + 4add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      E = Z2*Z3
      V = C*D
      U = V+d1*E^²
      W5 = V*Z1+U*W1
      Z5 = U*Z1

The "dadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: e^²=d1 and f^²=d2/d1+1.
Cost: 8M + 1S + 1*e + 1*f + 5add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      E = Z2*Z3
      F = W2*W3
      V = C*D
      U = V+(e*E+f*F)^²
      W5 = V*Z1+U*W1
      Z5 = U*Z1

Explicit formulas for differential addition and doubling

The "mladd-2008-blr-1" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 5M + 4S + 2*d1 + 5add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      V = C*W3*(Z3+W3)
      U = V+d1*(Z2*Z3)^²
      W4 = C^²
      Z4 = d1*(Z2^²)^²+W4
      W5 = V+U*W1
      Z5 = U

The "mladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and e^⁴=d1 and f^⁴=d2/d1+1 and ee=e*e and ff=f*f.
Cost: 6M + 4S + 1*ee + 1*ff + 1*e + 1*f + 7add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      W4 = C^²
      Z4 = W4+((e*Z2+f*W2)^²)^²
      E = Z2*Z3
      F = W2*W3
      V = C*D
      U = V+(ee*E+ff*F)^²
      W5 = V+U*W1
      Z5 = U

The "ladd-2008-blr-1" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 4S + 2*d1 + 5add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      V = C*W3*(Z3+W3)
      U = V+d1*(Z2*Z3)^²
      W4 = C^²
      Z4 = d1*(Z2^²)^²+W4
      W5 = V*Z1+U*W1
      Z5 = U*Z1

The "ladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: e^⁴=d1 and f^⁴=d2/d1+1 and ee=e*e and ff=f*f.
Cost: 8M + 4S + 1*ee + 1*ff + 1*e + 1*f + 7add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      C = W2*(Z2+W2)
      D = W3*(Z3+W3)
      W4 = C^²
      Z4 = W4+((e*Z2+f*W2)^²)^²
      E = Z2*Z3
      F = W2*W3
      V = C*D
      U = V+(ee*E+ff*F)^²
      W5 = V*Z1+U*W1
      Z5 = U*Z1

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 1M + 0add.
Explicit formulas:
```
      W3 = W1/Z1
      Z3 = 1
```