Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / WZ coordinates for binary Edwards curves

# WZ coordinates for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:
```  d1*(x+y)+d2*(x^2+y^2)=(x+x^2)*(y+y^2)
```

WZ coordinates [database entry] represent x y as W Z satisfying the following equations:

```  x+y=W/Z
```

## Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:
• 1M for doubling: 1M+3S.
• 6M for differential addition: 6M+2S.
• 6M for differential addition with Z1=1: 6M+1S. 6M+2S.
• 8M for differential addition and doubling: 8M+4S.
• 6M for differential addition and doubling with Z1=1: 6M+4S.
• 11M for scaling: 1I+1M.
Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:
• 1.6M for doubling: 1M+3S.
• 6.4M for differential addition: 6M+2S.
• 6.2M for differential addition with Z1=1: 6M+1S.
• 8.8M for differential addition and doubling: 8M+4S.
• 6.8M for differential addition and doubling with Z1=1: 6M+4S.
• 11M for scaling: 1I+1M.

## Summary of all explicit formulas

doubling e4=d1 and f4=d2/d1+1 1M + 3S + 1*e + 1*f
diffadd e2=d1 and f2=d2/d1+1 and Z1=1 6M + 1S + 1*e + 1*f
diffadd e2=d1 and f2=d2/d1+1 6M + 2S + 1*d1 + 1*e + 1*f
diffadd e2=d1 and f2=d2/d1+1 8M + 1S + 1*e + 1*f
ladder Z1=1 and e4=d1 and f4=d2/d1+1 and ee=e*e and ff=f*f 6M + 4S + 1*ee + 1*ff + 1*e + 1*f
ladder e4=d1 and f4=d2/d1+1 and ee=e*e and ff=f*f 8M + 4S + 1*ee + 1*ff + 1*e + 1*f
scaling 1I + 1M

## Explicit formulas for doubling

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: e4=d1 and f4=d2/d1+1.
• Cost: 1M + 3S + 1*e + 1*f + 3add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      C = W1*(Z1+W1)
W3 = C^2
Z3 = W3+((e*Z1+f*W1)^2)^2
```

## Explicit formulas for differential addition

The "mdadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: e2=d1 and f2=d2/d1+1 and Z1=1.
• Cost: 6M + 1S + 1*e + 1*f + 5add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      C = W2*(Z2+W2)
D = W3*(Z3+W3)
E = Z2*Z3
F = W2*W3
V = C*D
U = V+(e*E+f*F)^2
W5 = V+W1*U
Z5 = U
```

The "dadd-2008-blr-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: e2=d1 and f2=d2/d1+1.
• Cost: 6M + 2S + 1*d1 + 1*e + 1*f + 6add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      A = W2*W3
B = Z2*Z3
C = (W2+Z2)*(W3+Z3)
W5 = Z1*(d1*(C+A+B)^2)
Z5 = W1*(A*C+(e*B+f*A)^2)
```

The "dadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: e2=d1 and f2=d2/d1+1.
• Cost: 8M + 1S + 1*e + 1*f + 5add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      C = W2*(Z2+W2)
D = W3*(Z3+W3)
E = Z2*Z3
F = W2*W3
V = C*D
U = V+(e*E+f*F)^2
W5 = V*Z1+U*W1
Z5 = U*Z1
```

## Explicit formulas for differential addition and doubling

The "mladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1 and e4=d1 and f4=d2/d1+1 and ee=e*e and ff=f*f.
• Cost: 6M + 4S + 1*ee + 1*ff + 1*e + 1*f + 7add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      C = W2*(Z2+W2)
D = W3*(Z3+W3)
W4 = C^2
Z4 = W4+((e*Z2+f*W2)^2)^2
E = Z2*Z3
F = W2*W3
V = C*D
U = V+(ee*E+ff*F)^2
W5 = V+U*W1
Z5 = U
```

The "ladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: e4=d1 and f4=d2/d1+1 and ee=e*e and ff=f*f.
• Cost: 8M + 4S + 1*ee + 1*ff + 1*e + 1*f + 7add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      C = W2*(Z2+W2)
D = W3*(Z3+W3)
W4 = C^2
Z4 = W4+((e*Z2+f*W2)^2)^2
E = Z2*Z3
F = W2*W3
V = C*D
U = V+(ee*E+ff*F)^2
W5 = V*Z1+U*W1
Z5 = U*Z1
```

## Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 1I + 1M + 0add.
• Explicit formulas:
```      W3 = W1/Z1
Z3 = 1
```