Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / Projective coordinates with d1=d2 for binary Edwards curves

Projective coordinates with d1=d2 for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:

  d1*(x+y)+d2*(x^²+y^²)=(x+x^²)*(y+y^²)

Projective coordinates with d1=d2 [database entry] make the additional assumptions

  d1=d2

and represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

16M for addition: 16M+1S. 16M+2S.
13M for addition with Z2=1: 13M+3S.
16M for readdition: 16M+1S after 16M+1S. 16M+2S after 16M+2S.
13M for readdition with Z2=1: 13M+1S after 13M+3S.
2M for doubling: 2M+5S. 2M+6S.
12M for scaling: 1I+2M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

16.2M for addition: 16M+1S.
13.6M for addition with Z2=1: 13M+3S.
16.2M for readdition: 16M+1S after 16M+1S.
13.2M for readdition with Z2=1: 13M+1S after 13M+3S.
3M for doubling: 2M+5S.
12M for scaling: 1I+2M.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z2=1	13M + 3S + 2d1 + 1d2	13M + 1S + 2d1 + 1d2
addition	d1d1=d1^²	16M + 1S + 1d1d1 + 3d1	16M + 1S + 1d1d1 + 3d1
addition	d1d1=d1^²	16M + 2S + 3*d1	16M + 2S + 3*d1
addition	d2plusd1=d2+d1 and d1d1=d1^²	18M + 2S + 1d1d1 + 3d1 + 1d2 + 2d2plusd1	18M + 2S + 1d1d1 + 3d1 + 1d2 + 2d2plusd1
addition	d2plusd1=d2+d1 and d1d1=d1^²	18M + 3S + 3d1 + 1d2 + 2*d2plusd1	18M + 3S + 3d1 + 1d2 + 2*d2plusd1
addition		21M + 1S + 3d1 + 1d2	20M + 1S + 2*d1
doubling	sqrtd1^²=d1	2M + 5S + 1d1 + 1sqrtd1
doubling	d2d1=d2/d1	2M + 6S + 1d1 + 1d2 + 1*d2d1
scaling		1I + 2M

Explicit formulas for addition

The "madd-2008-blr" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 13M + 3S + 2*d1 + 1*d2 + 15add.
Cost: 13M + 1S + 2*d1 + 1*d2 + 12add dependent upon the first point.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      W1 = X1+Y1
      w2 = X2+Y2
      A = X2^²+X2
      B = Y2^²+Y2
      D = W1*Z1
      E = d1*Z1^²
      H = (E+d2*D)*w2
      I = d1*Z1
      U = E+A*D
      V = E+B*D
      Z3 = U*V
      X3 = Z3*Y2+(H+X1*(I+A*(Y1+Z1)))*V
      Y3 = Z3*X2+(H+Y1*(I+B*(X1+Z1)))*U

The "add-2008-blr-3" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d1d1=d1^².
Cost: 16M + 1S + 1*d1d1 + 3*d1 + 22add.
Cost: 16M + 1S + 1*d1d1 + 3*d1 + 19add dependent upon the first point.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      A = X1*X2
      B = Y1*Y2
      C = Z1*Z2
      D = d1*C
      E = C^²
      F = d1d1*E
      G = (X1+Z1)*(X2+Z2)
      H = (Y1+Z1)*(Y2+Z2)
      I = A+G
      J = B+H
      K = (X1+Y1)*(X2+Y2)
      L = d1*K
      U = C*(F+L*(K+I+J+C))
      V = U+D*F+L*(d1*E+G*H+A*B)
      X3 = V+D*(A+D)*(G+D)
      Y3 = V+D*(B+D)*(H+D)
      Z3 = U

The "add-2008-blr-5" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d1d1=d1^².
Cost: 16M + 2S + 3*d1 + 22add.
Cost: 16M + 2S + 3*d1 + 19add dependent upon the first point.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      A = X1*X2
      B = Y1*Y2
      C = Z1*Z2
      D = d1*C
      E = C^²
      F = D^²
      G = (X1+Z1)*(X2+Z2)
      H = (Y1+Z1)*(Y2+Z2)
      I = A+G
      J = B+H
      K = (X1+Y1)*(X2+Y2)
      L = d1*K
      U = C*(F+L*(K+I+J+C))
      V = U+D*F+L*(d1*E+G*H+A*B)
      X3 = V+D*(A+D)*(G+D)
      Y3 = V+D*(B+D)*(H+D)
      Z3 = U

The "add-2008-blr-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2plusd1=d2+d1 and d1d1=d1^².
Cost: 18M + 2S + 1*d1d1 + 3*d1 + 1*d2 + 2*d2plusd1 + 24add.
Cost: 18M + 2S + 1*d1d1 + 3*d1 + 1*d2 + 2*d2plusd1 + 21add dependent upon the first point.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      A = X1*X2
      B = Y1*Y2
      C = Z1*Z2
      D = d1*C
      E = C^²
      F = d1d1*E
      G = (X1+Z1)*(X2+Z2)
      H = (Y1+Z1)*(Y2+Z2)
      I = A+G
      J = B+H
      K = (X1+Y1)*(X2+Y2)
      U = C*(F+d1*K*(K+I+J+C))
      V = U+D*F+K*(d2*(d1*E+G*H+A*B)+d2plusd1*I*J)
      X3 = V+D*(A+D)*(G+D)
      Y3 = V+D*(B+D)*(H+D)
      Z3 = U+d2plusd1*C*K^²

The "add-2008-blr-4" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2plusd1=d2+d1 and d1d1=d1^².
Cost: 18M + 3S + 3*d1 + 1*d2 + 2*d2plusd1 + 24add.
Cost: 18M + 3S + 3*d1 + 1*d2 + 2*d2plusd1 + 21add dependent upon the first point.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      A = X1*X2
      B = Y1*Y2
      C = Z1*Z2
      D = d1*C
      E = C^²
      F = D^²
      G = (X1+Z1)*(X2+Z2)
      H = (Y1+Z1)*(Y2+Z2)
      I = A+G
      J = B+H
      K = (X1+Y1)*(X2+Y2)
      U = C*(F+d1*K*(K+I+J+C))
      V = U+D*F+K*(d2*(d1*E+G*H+A*B)+d2plusd1*I*J)
      X3 = V+D*(A+D)*(G+D)
      Y3 = V+D*(B+D)*(H+D)
      Z3 = U+d2plusd1*C*K^²

The "add-2008-blr-1" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 21M + 1S + 3*d1 + 1*d2 + 15add.
Cost: 20M + 1S + 2*d1 + 11add dependent upon the first point.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      W1 = X1+Y1
      W2 = X2+Y2
      A = X1*(X1+Z1)
      B = Y1*(Y1+Z1)
      C = Z1*Z2
      D = W2*Z2
      E = d1*C^²
      H = (d1*Z2+d2*W2)*W1*C
      I = d1*C*Z1
      U = E+A*D
      V = E+B*D
      S = U*V
      X3 = S*Y1+(H+X2*(I+A*(Y2+Z2)))*V*Z1
      Y3 = S*X1+(H+Y2*(I+B*(X2+Z2)))*U*Z1
      Z3 = S*Z1

Explicit formulas for doubling

The "dbl-2008-blr-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: sqrtd1^²=d1.
Cost: 2M + 5S + 1*d1 + 1*sqrtd1 + 6add.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.

Explicit formulas:

      W1 = X1+Y1
      E = (W1*(W1+Z1))^²
      X3 = ((sqrtd1*W1+X1)*Z1+X1^²)^²
      Y3 = X3+E
      Z3 = E+d1*(Z1^²)^²

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2d1=d2/d1.
Cost: 2M + 6S + 1*d1 + 1*d2 + 1*d2d1 + 9add.
Source: 2008 Bernstein-–Lange-–Rezaeian Farashahi.

Explicit formulas:

      A = X1^²
      B = A^²
      C = Y1^²
      D = C^²
      E = Z1^²
      F = d1*E^²
      G = d2d1*(B+D)
      H = A*E
      I = C*E
      J = H+I
      K = G+d2*J
      Z3 = F+J+G
      X3 = K+H+D
      Y3 = K+I+B

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 2M + 0add.

Explicit formulas:

      A = 1/Z1
      X3 = A*X1
      Y3 = A*Y1
      Z3 = 1