Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Extended Lopez-Dahab coordinates with a2=0 for short Weierstrass curves

Extended Lopez-Dahab coordinates with a2=0 for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Extended Lopez-Dahab coordinates with a2=0 [database entry] make the additional assumptions

  a2=0

and represent x y as X Y Z ZZ XZ satisfying the following equations:

  x=X/Z
  y=Y/ZZ
  ZZ=Z^²
  XZ=X*Z

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

14M for addition: 14M+3S.
9M for addition with Z2=1: 9M+4S.
14M for readdition: 14M+3S after 14M+3S.
9M for readdition with Z2=1: 9M+4S after 9M+4S.
2M for doubling: 2M+5S.
2M for doubling with Z1=1: 2M+3S. 2M+5S.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

14.6M for addition: 14M+3S.
9.8M for addition with Z2=1: 9M+4S.
14.6M for readdition: 14M+3S after 14M+3S.
9.8M for readdition with Z2=1: 9M+4S after 9M+4S.
3M for doubling: 2M+5S.
2.6M for doubling with Z1=1: 2M+3S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z2=1	9M + 4S + 1*a2	9M + 4S + 1*a2
addition		14M + 3S	14M + 3S
doubling	Z1=1	2M + 3S + 1*a6
doubling	sqrta6^²=a6	2M + 5S + 1a6 + 1sqrta6

Explicit formulas for addition

The "madd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 9M + 4S + 1*a2 + 9add.
Cost: 9M + 4S + 1*a2 + 8add dependent upon the first point.
Source: 2005 Doche–Lange / Al-Daoud et al 2002; modified to compute and use ZZ,XZ.

Explicit formulas:

      A = Y1+Y2*ZZ1
      B = X1+X2*Z1
      C = B*Z1
      Z3 = C^²
      ZZ3 = Z3^²
      D = X2*Z3
      X3 = A^²+C*(A+B^²+a2*C)
      Y3 = (D+X3)*(A*C+Z3)+(Y2+X2)*ZZ3
      XZ3 = X3*Z3

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 14M + 3S + 9add.
Source: 2005 Doche–Lange / Higuchi Takagi; modified to compute and use ZZ,XZ.

Explicit formulas:

      A = X1*Z2
      B = X2*Z1
      C = A^²
      D = B^²
      E = A+B
      F = C+D
      G = Y1*ZZ2
      H = Y2*ZZ1
      I = G+H
      J = I*E
      Z3 = F*Z1*Z2
      X3 = A*(H+D)+B*(C+G)
      Y3 = (A*J+F*G)*F+(J+Z3)*X3
      ZZ3 = Z3^²
      XZ3 = X3*Z3

Explicit formulas for doubling

The "mdbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 2M + 3S + 1*a6 + 5add.
Source: 2008 Bernstein–Lange–Rezaeian-Farashahi "Binary Edwards Curves", plus specialization to Z1=1, plus simplification.

Explicit formulas:

      A = X1^²
      B = Y1^²
      Z3 = A
      ZZ3 = A^²
      X3 = ZZ3+a6
      XZ3 = X3*Z3
      Y3 = B*(B+X3+Z3)+a6*ZZ3+XZ3

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: sqrta6^²=a6.
Cost: 2M + 5S + 1*a6 + 1*sqrta6 + 5add.
Source: 2008 Bernstein–Lange–Rezaeian-Farashahi "Binary Edwards Curves".

Explicit formulas:

      A = X1^²
      B = Y1^²
      Z3 = XZ1^²
      X3 = (A+sqrta6*ZZ1)^²
      ZZ3 = Z3^²
      XZ3 = X3*Z3
      Y3 = B*(B+X3+Z3)+a6*ZZ3+XZ3

Extended Lopez-Dahab coordinates with a2=0 for short Weierstrass curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling