Explicit-Formulas Database

Jacobian coordinates

Jacobian coordinates represent an affine point (x,y) on a Weierstrass-form elliptic curve y^2 = x^3 + ax + b as (X:Y:Z) satisfying Y^2 = X^3 + aXZ^4 + bZ^6. Here (X:Y:Z) = (s^2 X:s^3 Y:sZ) for all nonzero s.

Speed records:

The following commands for the Magma computer-algebra system check various addition formulas for Jacobian coordinates.

Jacobian scaling.

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     // here are the formulas:
     A:=1/Z1;
     AA:=A^2;
     X2:=X1*AA;
     Y2:=Y1*AA*A;
     Z2:=1;
     // check:
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     S!(Z2-1);
     S!(x2-x1); S!(y2-y1);

Jacobian addition (11M+5S+9add+4times2) matches affine addition. Multiplication counts stated in the literature: 17 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i). 16 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'). 16 in 1998 Cohen/Miyaji/Ono. 16 in 2004 Hankerson/Menezes/Vanstone page 92. 16 in 2005 Doche/Lange. 16 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 12M + 4S in 1998 Cohen/Miyaji/Ono, formula (5). 12M + 4S in 2004 Hankerson/Menezes/Vanstone page 92. 12M + 4S in 2005 Doche/Lange. 11M + 5S in 2001 Bernstein. 11M + 5S in 2007 Longa/Miri. 11M + 5S in 2007 Bernstein/Lange.

1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i):

     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     S!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     U1:=X1*Z2^2;
     U2:=X2*Z1^2;
     S1:=Y1*Z2^3;
     S2:=Y2*Z1^3;
     P:=U2-U1;
     R:=S2-S1;
     X3:=-(U1+U2)*P^2+R^2;
     Y3:=-S1*P^3+R*(U1*P^2-X3);
     Z3:=Z1*Z2*P;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'):
     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     U1:=X1*Z2^2;
     U2:=X2*Z1^2;
     S1:=Y1*Z2^3;
     S2:=Y2*Z1^3;
     P:=U2-U1;
     R:=S2-S1;
     X3:=-(U1+U2)*P^2+R^2;
     Y3:=(R*(-2*R^2+3*P^2*(U1+U2))-P^3*(S1+S2))/2;
     Z3:=Z1*Z2*P;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

1998 Cohen/Miyaji/Ono, formula (5):

     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     S!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     U1:=X1*Z2^2;
     U2:=X2*Z1^2;
     S1:=Y1*Z2^3;
     S2:=Y2*Z1^3;
     H:=U2-U1;
     r:=S2-S1;
     X3:=-H^3-2*U1*H^2+r^2;
     Y3:=-S1*H^3+r*(U1*H^2-X3);
     Z3:=Z1*Z2*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 12M + 4S + 6add + 1times2:

     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     Z1Z1:=Z1^2;
     Z2Z2:=Z2^2;
     U1:=X1*Z2Z2;
     U2:=X2*Z1Z1;
     S1:=Y1*Z2*Z2Z2;
     S2:=Y2*Z1*Z1Z1;
     H:=U2-U1;
     HH:=H^2;
     HHH:=H*HH;
     r:=S2-S1;
     V:=U1*HH;
     X3:=r^2-HHH-2*V;
     Y3:=r*(V-X3)-S1*HHH;
     Z3:=Z1*Z2*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
1998 Hasegawa/Nakajima/Matsui, page 188, 12M + 4S + 8adds + 2times2 + 1halving, 2 temporary registers:
     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     R1:=X1; R2:=Y1; R3:=Z1;
     R4:=X2; R5:=Y2; R6:=Z2;
     // here are the formulas:
     R7:=R6^2;
     R1:=R1*R7;
     R7:=R6*R7;
     R2:=R2*R7;
     R7:=R3^2;
     R8:=R4*R7;
     R7:=R3*R7;
     R7:=R5*R7;
     R2:=R2-R7;
     R7:=2*R7;
     R7:=R2+R7;
     R1:=R1-R8;
     R8:=2*R8;
     R8:=R1+R8;
     R3:=R3*R6;
     R3:=R3*R1;
     R7:=R7*R1;
     R1:=R1^2;
     R8:=R8*R1;
     R7:=R7*R1;
     R1:=R2^2;
     R1:=R1-R8;
     R8:=R8-R1;
     R8:=R8-R1;
     R8:=R8*R2;
     R2:=R8-R7;
     R2:=R2/2;
     X3:=R1; Y3:=R2; Z3:=R3;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
2007 Bernstein/Lange, 11M + 5S + 9add + 4times2:
     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     Z1Z1:=Z1^2;
     Z2Z2:=Z2^2;
     U1:=X1*Z2Z2;
     U2:=X2*Z1Z1;
     S1:=Y1*Z2*Z2Z2;
     S2:=Y2*Z1*Z1Z1;
     H:=U2-U1;
     I:=(2*H)^2;
     J:=H*I;
     r:=2*(S2-S1);
     V:=U1*I;
     X3:=r^2-J-2*V;
     Y3:=r*(V-X3)-2*S1*J;
     Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
2007 Bernstein/Lange, 10M + 4S + 9add + 4times2 after 1M + 1S for caching:
     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
     R<Z1,Z2>:=PolynomialRing(K,2);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     // cached:
     Z2Z2:=Z2^2;
     Z2Z2Z2:=Z2*Z2Z2;
     // uncached:
     Z1Z1:=Z1^2;
     U1:=X1*Z2Z2;
     U2:=X2*Z1Z1;
     S1:=Y1*Z2Z2Z2;
     S2:=Y2*Z1*Z1Z1;
     H:=U2-U1;
     I:=(2*H)^2;
     J:=H*I;
     r:=2*(S2-S1);
     V:=U1*I;
     X3:=r^2-J-2*V;
     Y3:=r*(V-X3)-2*S1*J;
     Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

Jacobian mixed addition (7M+4S+9add+3times2+1times4) matches affine addition. S,M counts stated in the literature: 8M+3S in 2004 Hankerson/Menezes/Vanstone page 89 ("three field squarings and eight field multiplications"). 8M+3S in 2005 Doche/Lange. 7M+4S in 2007 Longa/Miri. 7M+4S in 2007 Bernstein/Lange.

Substituting Z2=1 in the general addition formulas, 8M + 3S + 6add + 5times2:

     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
     R<Z1,Y2>:=PolynomialRing(K,2);
     Z2:=1;
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     Z1Z1:=Z1^2;
     U2:=X2*Z1Z1;
     S2:=Y2*Z1*Z1Z1;
     H:=U2-X1;
     I:=(2*H)^2;
     J:=H*I;
     r:=2*(S2-Y1);
     V:=X1*I;
     X3:=r^2-J-2*V;
     Y3:=r*(V-X3)-2*Y1*J;
     Z3:=2*Z1*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

2004 Hankerson/Menezes/Vanstone, page 91, 8M + 3S + 6add + 1times2, 4 temporary registers:

     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
     R<Z1,Y2>:=PolynomialRing(K,2);
     Z2:=1;
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     T1:=Z1^2;
     T2:=T1*Z1;
     T1:=T1*X2;
     T2:=T2*Y2;
     T1:=T1-X1;
     T2:=T2-Y1;
     Z3:=Z1*T1;
     T3:=T1^2;
     T4:=T3*T1;
     T3:=T3*X1;
     T1:=2*T3;
     X3:=T2^2;
     X3:=X3-T1;
     X3:=X3-T4;
     T3:=T3-X3;
     T3:=T3*T2;
     T4:=T4*Y1;
     Y3:=T3-T4;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

2007 Bernstein/Lange, 7M + 4S + 9add + 3times2 + 1times4:

     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
     R<Z1,Y2>:=PolynomialRing(K,2);
     Z2:=1;
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     Z1Z1:=Z1^2;
     U2:=X2*Z1Z1;
     S2:=Y2*Z1*Z1Z1;
     H:=U2-X1;
     HH:=H^2;
     I:=4*HH;
     J:=H*I;
     r:=2*(S2-Y1);
     V:=X1*I;
     X3:=r^2-J-2*V;
     Y3:=r*(V-X3)-2*Y1*J;
     Z3:=(Z1+H)^2-Z1Z1-HH;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

Jacobian addition with Z1=1 and Z2=1. 2007 Bernstein/Lange, 4M + 2S + 6add + 4times2 + 1times4:

     K<a,b,X1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Y1,Y2>:=PolynomialRing(K,2);
     Z1:=1; Z2:=1;
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     // here are the formulas:
     H:=X2-X1;
     HH:=H^2;
     I:=4*HH;
     J:=H*I;
     r:=2*(Y2-Y1);
     V:=X1*I;
     X3:=r^2-J-2*V;
     Y3:=r*(V-X3)-2*Y1*J;
     Z3:=2*H;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

Jacobian doubling (1M+8S+1D+10add+2times2+1times3+1times8) matches affine doubling. Multiplication counts stated in the literature: 10 in 1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) ("9 multiplications ... and one multiplication by a"). 10 in 2007 Longa/Miri. 10 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 4M+6S in 1998 Cohen/Miyaji/Ono, formula (6). 4M+6S in 2004 Hankerson/Menezes/Vanstone page 88 ("six field squarings and four field multiplications"). 4M+6S in 2005 Doche/Lange. 2M+8S in 2007 Longa/Miri. 2M+8S in 2007 Bernstein/Lange.

1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii):

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     S:=4*X1*Y1^2;
     M:=3*X1^2+a*Z1^4;
     T:=-2*S+M^2;
     X3:=T;
     Y3:=-8*Y1^4+M*(S-T);
     Z3:=2*Y1*Z1;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
1998 Cohen/Miyaji/Ono, formula (6):
     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     S:=4*X1*Y1^2;
     M:=3*X1^2+a*Z1^4;
     T:=M^2-2*S;
     X3:=T;
     Y3:=-8*Y1^4+M*(S-T);
     Z3:=2*Y1*Z1;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 3M + 6S + 1D + 4add + 2times2 + 1times3 + 1times4 + 1times8:
     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     XX:=X1^2;
     YY:=Y1^2;
     ZZ:=Z1^2;
     S:=4*X1*YY;
     M:=3*XX+a*ZZ^2;
     T:=M^2-2*S;
     X3:=T;
     Y3:=M*(S-T)-8*YY^2;
     Z3:=2*Y1*Z1;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
1998 Hasegawa/Nakajima/Matsui, page 188, 3M + 6S + 1D + 6add + 3times2 + 1halving, 2 temporary registers:
     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     R1:=X1; R2:=Y1; R3:=Z1;
     // here are the formulas:
     R4:=R3^2;
     R3:=R2*R3;
     R3:=2*R3;
     R4:=R4^2;
     R4:=a*R4;
     R5:=R1^2;
     R4:=R4+R5;
     R5:=2*R5;
     R4:=R4+R5;
     R2:=2*R2;
     R2:=R2^2;
     R5:=R2^2;
     R5:=R5/2;
     R2:=R2*R1;
     R1:=R4^2;
     R1:=R1-R2;
     R1:=R1-R2;
     R2:=R2-R1;
     R2:=R2*R4;
     R2:=R2-R5;
     X3:=R1; Y3:=R2; Z3:=R3;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

2007 Bernstein/Lange, 1M + 8S + 1D + 10add + 2times2 + 1times3 + 1times8:

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     XX:=X1^2;
     YY:=Y1^2;
     YYYY:=YY^2;
     ZZ:=Z1^2;
     S:=2*((X1+YY)^2-XX-YYYY);
     M:=3*XX+a*ZZ^2;
     T:=M^2-2*S;
     X3:=T;
     Y3:=M*(S-T)-8*YYYY;
     Z3:=(Y1+Z1)^2-YY-ZZ;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

Jacobian doubling for a=-3 (3M+5S+8add+1times3+1times4+2times8) matches affine doubling. Multiplication counts stated in the literature: 8 in 1986 Chudnovksy/Chudnovsky, page 414 ("8 multiplications"). 8 in 2004 Hankerson/Menezes/Vanstone page 92. 8 in 2005 Doche/Lange. 8 in 2007 Longa/Miri. 8 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 4M+4S in 2004 Hankerson/Menezes/Vanstone page 92. 3M+5S in 2001 Bernstein. 3M+5S in 2007 Longa/Miri. 3M+5S in 2007 Bernstein/Lange.

1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) modified as indicated after "It is even smarter ..." for the special case a = -3:

     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     a:=-3;
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     S:=4*X1*Y1^2;
     M:=3*(X1-Z1^2)*(X1+Z1^2);
     T:=-2*S+M^2;
     X3:=T;
     Y3:=-8*Y1^4+M*(S-T);
     Z3:=2*Y1*Z1;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

1998 Hasegawa/Nakajima/Matsui, page 188, 4M + 4S + 7add + 3times2 + 1halving, 2 temporary registers, in the special case a = -3:

     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     a:=-3;
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     R1:=X1; R2:=Y1; R3:=Z1;
     // here are the formulas:
     R4:=R3^2;
     R3:=R2*R3;
     R3:=2*R3;
     R5:=R1-R4;
     R4:=R1+R4;
     R5:=R4*R5;
     R4:=2*R5;
     R4:=R4+R5;
     R2:=2*R2;
     R2:=R2^2;
     R5:=R2^2;
     R5:=R5/2;
     R2:=R2*R1;
     R1:=R4^2;
     R1:=R1-R2;
     R1:=R1-R2;
     R2:=R2-R1;
     R2:=R2*R4;
     R2:=R2-R5;
     X3:=R1; Y3:=R2; Z3:=R3;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

2004 Hankerson/Menezes/Vanstone, page 91, 4M + 4S + 5add + 2times2 + 1times3 + 1halving, 3 temporary registers, in the special case a = -3:

     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     a:=-3;
     R<Z1>:=PolynomialRing(K,1);
     S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     S!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     S!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     S!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     T1:=Z1^2;
     T2:=X1-T1;
     T1:=X1+T1;
     T2:=T2*T1;
     T2:=3*T2;
     Y3:=2*Y1;
     Z3:=Y3*Z1;
     Y3:=Y3^2;
     T3:=Y3*X1;
     Y3:=Y3^2;
     Y3:=Y3/2;
     X3:=T2^2;
     T1:=2*T3;
     X3:=X3-T1;
     T1:=T3-X3;
     T1:=T1*T2;
     Y3:=T1-Y3;
     S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);

2001 Bernstein, 3M + 5S + 8add + 1times3 + 1times4 + 2times8, in the special case a = -3:

     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     a:=-3;
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     delta:=Z1^2;
     gamma:=Y1^2;
     beta:=X1*gamma;
     alpha:=3*(X1-delta)*(X1+delta);
     X3:=alpha^2-8*beta;
     Z3:=(Y1+Z1)^2-gamma-delta;
     Y3:=alpha*(4*beta-X3)-8*gamma^2;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

Jacobian doubling with Z1=1. 2007 Bernstein/Lange, 1M + 5S + 7add + 3times2 + 1times3 + 1times8:

     K<a,b,X1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     R<Y1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     Z1:=1; X2:=X1; Y2:=Y1; Z2:=Z1;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     x2:=X2/Z2^2; y2:=Y2/Z2^3;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     XX:=X1^2;
     YY:=Y1^2;
     YYYY:=YY^2;
     S:=2*((X1+YY)^2-XX-YYYY);
     M:=3*XX+a;
     T:=M^2-2*S;
     X3:=T;
     Y3:=M*(S-T)-8*YYYY;
     Z3:=2*Y1;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

Jacobian tripling (5M+10S+1D+15add+1times3+2times4+1times6+1times8+1times16) matches doubling and addition. Multiplication counts stated in the literature: 16 in 2005 Dimitrov/Imbert/Mishra, page 69 ("6[s]+10[m]"). 16 in 2007 Longa/Miri. 16 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 10M+6S in 2005 Dimitrov/Imbert/Mishra, page 69. 6M+10S in 2007 Longa/Miri. 6M+10S in 2007 Bernstein/Lange.

2005 Dimitrov/Imbert/Mishra:

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     M:=3*X1^2+a*Z1^4;
     E:=12*X1*Y1^2-M^2;
     T:=8*Y1^4;
     X3:=8*Y1^2*(T-M*E)+X1*E^2;
     Y3:=Y1*(4*(M*E-T)*(2*T-M*E)-E^3);
     Z3:=Z1*E;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

Eliminating common subexpressions from 2005 Dimitrov/Imbert/Mishra, 8M + 7S + 1D + 6add + 2times2 + 1times3 + 1times4 + 1times6:

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     ZZ:=Z1^2;
     YY:=Y1^2;
     C:=2*YY;
     M:=3*X1^2+a*ZZ^2;
     E:=6*X1*C-M^2;
     EE:=E^2;
     T:=2*C^2;
     U:=M*E-T;
     U4:=4*U;
     X3:=X1*EE-C*U4;
     Y3:=Y1*(U4*(T-U)-E*EE);
     Z3:=Z1*E;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

2007 Bernstein/Lange, 5M + 10S + 1D + 15add + 1times3 + 2times4 + 1times6 + 1times8 + 1times16:

     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     XX:=X1^2;
     YY:=Y1^2;
     ZZ:=Z1^2;
     YYYY:=YY^2;
     M:=3*XX+a*ZZ^2;
     MM:=M^2;
     E:=6*((X1+YY)^2-XX-YYYY)-MM;
     EE:=E^2;
     T:=16*YYYY;
     U:=(M+E)^2-MM-EE-T;
     X3:=4*(X1*EE-4*YY*U);
     Y3:=8*Y1*(U*(T-U)-E*EE);
     Z3:=(Z1+E)^2-ZZ-EE;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);

Jacobian tripling with a=-3 (7M+7S+13add+1times3+2times4+1times8+1times12+1times16) matches doubling and addition. Multiplication counts stated in the literature: 14 in 2007 Longa/Miri. 14 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 7M+7S in 2007 Longa/Miri. 7M+7S in 2007 Bernstein/Lange.

2007 Bernstein/Lange, 7M + 7S + 13add + 1times3 + 2times4 + 1times8 + 1times12 + 1times16:

     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
     a:=-3;
     R<Z1>:=PolynomialRing(K,1);
     SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
     x1:=X1/Z1^2; y1:=Y1/Z1^3;
     SS!(y1^2-x1^3-a*x1-b);
     lambda:=(3*x1^2+a)/(2*y1);
     x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
     SS!(y2^2-x2^3-a*x2-b);
     lambda:=(y2-y1)/(x2-x1);
     x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
     SS!(y3^2-x3^3-a*x3-b);
     // here are the formulas:
     YY:=Y1^2;
     ZZ:=Z1^2;
     YYYY:=YY^2;
     M:=3*(X1-ZZ)*(X1+ZZ);
     MM:=M^2;
     E:=12*X1*YY-MM;
     EE:=E^2;
     T:=16*YYYY;
     U:=(M+E)^2-MM-EE-T;
     X3:=4*(X1*EE-4*YY*U);
     Y3:=8*Y1*(U*(T-U)-E*EE);
     Z3:=(Z1+E)^2-ZZ-EE;
     SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);