Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Affine coordinates for short Weierstrass curves

Affine coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Affine coordinates [database entry] represent x y as X Y satisfying the following equations:

  x=X
  y=Y

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

12M for addition: 1I+2M+1S.
12M for readdition: 1I+2M+1S after 1I+2M+1S.
12M for doubling: 1I+2M+1S.
0M for scaling: 0M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

12.2M for addition: 1I+2M+1S.
12.2M for readdition: 1I+2M+1S after 1I+2M+1S.
12.2M for doubling: 1I+2M+1S.
0M for scaling: 0M.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition		1I + 2M + 1S	1I + 2M + 1S
doubling		1I + 2M + 1S
scaling		0M

Explicit formulas for addition

The "add" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 2M + 1S + 9add.

Explicit formulas:

      lambda = (Y1+Y2)/(X1+X2)
      X3 = lambda^²+lambda+X1+X2+a2
      Y3 = lambda*(X1+X3)+X3+Y1

Explicit formulas for doubling

The "dbl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 2M + 1S + 6add.

Explicit formulas:

      lambda = X1+Y1/X1
      X3 = lambda^²+lambda+a2
      Y3 = lambda*(X1+X3)+X3+Y1

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "copy" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 0add.
Explicit formulas:
```
      X3 = X1
      Y3 = Y1
```