Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Edwards curves EFD / Genus-1 large-characteristic / Squared YZ coordinates with square d for Edwards curves

Squared YZ coordinates with square d for Edwards curves

An elliptic curve in Edwards form [more information] has parameters c d and coordinates x y satisfying the following equations:
  x2+y2=c2*(1+d*x2*y2)

Squared YZ coordinates with square d [database entry] make the additional assumptions

  c=1
  d=r2
and represent x y as Y Z satisfying the following equations:
  r*y2=Y/Z

The following formulas are the outcome of a discussion in 2009 among Daniel J. Bernstein, David Kohel, and Tanja Lange. The core ideas were published by Pierrick Gaudry in 2006.

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

Summary of all explicit formulas

OperationAssumptionsCostReaddition cost
doubling Z1=1 and s=(1+r)/(1-r) 3S + 1*r + 1*s
doubling s=(1+r)/(1-r) 4S + 1*r + 1*s
diffadd Z1=1 and s=(1+r)/(1-r) 3M + 2S + 1*s
diffadd s=(1+r)/(1-r) 4M + 2S + 1*s
ladder Z1=1 and s=(1+r)/(1-r) 3M + 6S + 1*r + 2*s
ladder Z1=1 and s=(1+r)/(1-r) 3M + 6S + 1*r + 2*s
ladder s=(1+r)/(1-r) 4M + 6S + 1*r + 2*s
ladder s=(1+r)/(1-r) 4M + 6S + 1*r + 2*s
scaling 1I + 1M

Explicit formulas for addition

Explicit formulas for doubling

The "mdbl-2006-g" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dbl-2006-g" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for tripling

Explicit formulas for differential addition

The "mdadd-2006-g" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dadd-2006-g" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for differential addition and doubling

The "mladd-2006-g-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "mladd-2006-g" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "ladd-2006-g-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "ladd-2006-g" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]: