Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Extended Lopez-Dahab coordinates with a2=1 for short Weierstrass curves

# Extended Lopez-Dahab coordinates with a2=1 for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:
```  y^2+x*y=x^3+a2*x^2+a6
```

Extended Lopez-Dahab coordinates with a2=1 [database entry] make the additional assumptions

```  a2=1
```
and represent x y as X Y Z ZZ satisfying the following equations:
```  x=X/Z
y=Y/Z^2
ZZ=Z^2
```

## Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

## Summary of all explicit formulas

OperationAssumptionsCostReaddition cost
addition Z2=1 8M + 4S 8M + 4S
addition Z2=1 8M + 4S + 1*a2 8M + 4S + 1*a2
addition 13M + 3S 13M + 3S
doubling sqrta62=a6 2M + 4S + 1*a6 + 1*sqrta6
doubling 2M + 5S + 2*a6

## Explicit formulas for addition

The "madd-2007-kk" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 8M + 4S + 8add.
• Cost: 8M + 4S + 7add dependent upon the first point.
• Source: 2007(?) Kim–Kim "A New Method for Speeding Up Arithmetic on Elliptic Curves over Binary Fields".
• Explicit formulas:
```      A = X1+X2*Z1
B = Y1+Y2*ZZ1
C = A*Z1
D = C*(B+C)
Z3 = C^2
ZZ3 = Z3^2
X3 = B^2+C*A^2+D
Y3 = (X3+X2*Z3)*D+(X2+Y2)*ZZ3
```

The "madd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 8M + 4S + 1*a2 + 9add.
• Cost: 8M + 4S + 1*a2 + 8add dependent upon the first point.
• Source: 2005 Doche–Lange / Al-Daoud et al 2002; modified to compute and use Z2.
• Explicit formulas:
```      A = Y1+Y2*ZZ1
B = X1+X2*Z1
C = B*Z1
Z3 = C^2
ZZ3 = Z3^2
D = X2*Z3
X3 = A^2+C*(A+B^2+a2*C)
Y3 = (D+X3)*(A*C+Z3)+(Y2+X2)*ZZ3
```

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 13M + 3S + 9add.
• Source: 2005 Doche–Lange / Higuchi Takagi; modified to compute and use Z2.
• Explicit formulas:
```      A = X1*Z2
B = X2*Z1
C = A^2
D = B^2
E = A+B
F = C+D
G = Y1*ZZ2
H = Y2*ZZ1
I = G+H
J = I*E
Z3 = F*Z1*Z2
ZZ3 = Z3^2
X3 = A*(H+D)+B*(C+G)
Y3 = (A*J+F*G)*F+(J+Z3)*X3
```

## Explicit formulas for doubling

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: sqrta62=a6.
• Cost: 2M + 4S + 1*a6 + 1*sqrta6 + 5add.
• Source: 2008 Bernstein–Lange–Rezaeian-Farashahi "Binary Edwards Curves".
• Explicit formulas:
```      A = X1^2
B = Y1^2
Z3 = ZZ1*A
ZZ3 = Z3^2
X3 = (A+sqrta6*ZZ1)^2
Y3 = B*(B+X3+Z3)+a6*ZZ3+ZZ3
```

The "dbl-2007-kk" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 2M + 5S + 2*a6 + 5add.
• Source: 2007(?) Kim–Kim "A New Method for Speeding Up Arithmetic on Elliptic Curves over Binary Fields".
• Explicit formulas:
```      A = X1^2
B = Y1^2
Z3 = ZZ1*A
ZZ3 = Z3^2
X3 = A^2+a6*ZZ1^2
Y3 = B*(B+X3+Z3)+a6*ZZ3+ZZ3
```