Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Lopez-Dahab coordinates with a2=1 for short Weierstrass curves

Lopez-Dahab coordinates with a2=1 for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Lopez-Dahab coordinates with a2=1 [database entry] make the additional assumptions

  a2=1

and represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z^²

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

13M for addition: 13M+4S.
8M for addition with Z2=1: 8M+5S.
5M for addition with Z1=1 and Z2=1: 5M+3S.
13M for readdition: 13M+3S after 13M+4S.
8M for readdition with Z2=1: 8M+5S after 8M+5S.
5M for readdition with Z1=1 and Z2=1: 5M+3S after 5M+3S.
3M for doubling: 3M+5S. 3M+5S.
1M for doubling with Z1=1: 1M+3S.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

13.8M for addition: 13M+4S.
9M for addition with Z2=1: 8M+5S.
5.6M for addition with Z1=1 and Z2=1: 5M+3S.
13.6M for readdition: 13M+3S after 13M+4S.
9M for readdition with Z2=1: 8M+5S after 8M+5S.
5.6M for readdition with Z1=1 and Z2=1: 5M+3S after 5M+3S.
4M for doubling: 3M+5S. 3M+5S.
1.6M for doubling with Z1=1: 1M+3S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z1=1 and Z2=1	5M + 3S + 1*a2	5M + 3S + 1*a2
addition	Z2=1	8M + 5S + 1*a2	8M + 5S + 1*a2
addition		13M + 4S	13M + 3S
doubling	Z1=1	1M + 3S + 1a2 + 1a6
doubling	sqrta6^²=a6	3M + 5S + 1*sqrta6
doubling		3M + 5S + 1a2 + 1a6
doubling		4M + 4S + 1*a2

Explicit formulas for addition

The "mmadd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and Z2=1.
Cost: 5M + 3S + 1*a2 + 9add.
Cost: 5M + 3S + 1*a2 + 8add dependent upon the first point.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = Y1+Y2
      B = X1+X2
      Z3 = B^²
      D = X2*Z3
      X3 = A^²+B*(A+Z3+a2*B)
      Y3 = (D+X3)*(A*B+Z3)+(Y2+X2)*Z3^²

The "madd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 8M + 5S + 1*a2 + 9add.
Cost: 8M + 5S + 1*a2 + 8add dependent upon the first point.
Source: 2005 Doche–Lange / Al-Daoud et al 2002.

Explicit formulas:

      A = Y1+Y2*Z1^²
      B = X1+X2*Z1
      C = B*Z1
      Z3 = C^²
      D = X2*Z3
      X3 = A^²+C*(A+B^²+a2*C)
      Y3 = (D+X3)*(A*C+Z3)+(Y2+X2)*Z3^²

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 13M + 4S + 9add.
Cost: 13M + 3S + 9add dependent upon the first point.
Source: 2005 Doche–Lange / Higuchi Takagi.

Explicit formulas:

      A = X1*Z2
      B = X2*Z1
      C = A^²
      D = B^²
      E = A+B
      F = C+D
      G = Y1*Z2^²
      H = Y2*Z1^²
      I = G+H
      J = I*E
      Z3 = F*Z1*Z2
      X3 = A*(H+D)+B*(C+G)
      Y3 = (A*J+F*G)*F+(J+Z3)*X3

Explicit formulas for doubling

The "mdbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 1M + 3S + 1*a2 + 1*a6 + 4add.
Source: 2005 Doche–Lange.

Explicit formulas:

      C = X1^²
      Z3 = C
      X3 = C^²+a6
      Y3 = (Y1^²+a2*Z3+a6)*X3+a6*Z3

The "dbl-2005-dl-a2-1" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: sqrta6^²=a6.
Cost: 3M + 5S + 1*sqrta6 + 4add.
Source: 2005 Doche–Lange, following Lopez-Dahab.

Explicit formulas:

      A = X1^²
      B = sqrta6*Z1^²
      C = X1*Z1
      Z3 = C^²
      X3 = (A+B)^²
      Y3 = (A*C+(Y1+B)*(A+B))^²

The "dbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 3M + 5S + 1*a2 + 1*a6 + 4add.
Source: 2005 Doche–Lange, following Lopez-Dahab 1998.

Explicit formulas:

      A = Z1^²
      B = a6*A^²
      C = X1^²
      Z3 = A*C
      X3 = C^²+B
      Y3 = (Y1^²+a2*Z3+B)*X3+Z3*B

The "dbl-2005-l" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 4M + 4S + 1*a2 + 5add.
Source: 2005 Lange.

Explicit formulas:

      A = X1*Z1
      B = X1^²
      C = B+Y1
      D = A*C
      Z3 = A^²
      X3 = C^²+D+a2*Z3
      Y3 = (Z3+D)*X3+B^²*Z3

Lopez-Dahab coordinates with a2=1 for short Weierstrass curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling