Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Jacobian coordinates for short Weierstrass curves

Jacobian coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Jacobian coordinates [database entry] represent x y as X Y Z satisfying the following equations:

  x=X/Z^²
  y=Y/Z^³

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

14M for addition: 14M+5S.
10M for addition with Z2=1: 10M+3S.
13M for readdition: 13M+4S after 14M+5S.
10M for readdition with Z2=1: 10M+3S after 10M+3S.
4M for doubling: 4M+5S.
1M for doubling with Z1=1: 1M+2S.
13M for scaling: 1I+3M+1S.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

15M for addition: 14M+5S.
10.6M for addition with Z2=1: 10M+3S.
13.8M for readdition: 13M+4S after 14M+5S.
10.6M for readdition with Z2=1: 10M+3S after 10M+3S.
5M for doubling: 4M+5S.
1.4M for doubling with Z1=1: 1M+2S.
13.2M for scaling: 1I+3M+1S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z2=1	10M + 3S + 1*a2	10M + 3S + 1*a2
addition		14M + 5S + 1*a2	13M + 4S + 1*a2
doubling	Z1=1	1M + 2S + 1*a6
doubling		4M + 5S + 1*a6
scaling		1I + 3M + 1S

Explicit formulas for addition

The "madd-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 10M + 3S + 1*a2 + 7add.
Source: 2005 Doche–Lange.

Explicit formulas:

      O1 = Z1^²
      B = X2*O1
      D = Y2*O1*Z1
      E = X1+B
      F = Y1+D
      Z3 = E*Z1
      H = F*X2+Z3*Y2
      I = F+Z3
      G = Z3^²
      X3 = a2*G+F*I+E*E^²
      Y3 = I*X3+G*H

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 14M + 5S + 1*a2 + 7add.
Cost: 13M + 4S + 1*a2 + 7add dependent upon the first point.
Source: 2005 Doche–Lange.

Explicit formulas:

      O1 = Z1^²
      O2 = Z2^²
      A = X1*O2
      B = X2*O1
      C = Y1*O2*Z2
      D = Y2*O1*Z1
      E = A+B
      F = C+D
      G = E*Z1
      H = F*X2+G*Y2
      Z3 = G*Z2
      I = F+Z3
      X3 = a2*Z3^²+F*I+E*E^²
      Y3 = I*X3+G^²*H

Explicit formulas for doubling

The "mdbl-2008-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 1M + 2S + 1*a6 + 5add.
Source: 2008 Bernstein–Lange.

Explicit formulas:

      A = X1^²
      B = A^²
      X3 = B+a6
      Z3 = X1
      Y3 = a6*(A+Y1+Z3)+(A+Y1)*B

The "dbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 4M + 5S + 1*a6 + 4add.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = X1^²
      B = A^²
      C = Z1^²
      D = C^²
      X3 = B+a6*D^²
      Z3 = X1*C
      Y3 = B*Z3+(A+Y1*Z1+Z3)*X3

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 3M + 1S + 0add.

Explicit formulas:

      A = 1/Z1
      B = A^²
      X3 = B*X1
      Y3 = A*B*Y1
      Z3 = 1