Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Projective coordinates for short Weierstrass curves

# Projective coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:
```  y^2+x*y=x^3+a2*x^2+a6
```

Projective coordinates [database entry] represent x y as X Y Z satisfying the following equations:

```  x=X/Z
y=Y/Z
```

## Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

## Summary of all explicit formulas

addition Z1=1 and Z2=1 7M + 1S + 1*a2 7M + 1S + 1*a2
addition Z2=1 11M + 1S + 1*a2 11M + 1S + 1*a2
addition Z2=1 11M + 2S + 1*a2 11M + 2S + 1*a2
addition 14M + 1S + 1*a2 14M + 1S + 1*a2
addition 15M + 2S + 1*a2 15M + 2S + 1*a2
addition 15M + 2S + 13 + 1*a2 15M + 2S + 13 + 1*a2
doubling Z1=1 5M + 3S + 1*a2
doubling 7M + 3S + 1*a2
doubling 7M + 4S + 1*a2
scaling 1I + 2M

The "mmadd-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1 and Z2=1.
• Cost: 7M + 1S + 1*a2 + 7add.
• Source: 2008 Bernstein–Lange.
• Explicit formulas:
```      A = Y1+Y2
B = X1+X2
AB = A+B
C = B^2
Z3 = B*C
F = A*AB+a2*C+Z3
X3 = B*F
Y3 = C*(A*X1+B*Y1)+AB*F
```

The "madd-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 11M + 1S + 1*a2 + 7add.
• Source: 2008 Bernstein–Lange.
• Explicit formulas:
```      A = Y1+Z1*Y2
B = X1+Z1*X2
AB = A+B
C = B^2
E = B*C
F = (A*AB+a2*C)*Z1+E
X3 = B*F
Y3 = C*(A*X1+B*Y1)+AB*F
Z3 = E*Z1
```

The "madd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 11M + 2S + 1*a2 + 8add.
• Source: 2005 Doche–Lange.
• Explicit formulas:
```      A = Y1+Z1*Y2
B = X1+Z1*X2
C = B^2
E = B*C
F = (A^2+A*B+a2*C)*Z1+E
X3 = B*F
Y3 = C*(A*X1+Y1*B)+(A+B)*F
Z3 = E*Z1
```

The "add-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 14M + 1S + 1*a2 + 7add.
• Source: 2008 Bernstein–Lange.
• Explicit formulas:
```      Y1Z2 = Y1*Z2
X1Z2 = X1*Z2
A = Y1Z2+Z1*Y2
B = X1Z2+Z1*X2
AB = A+B
C = B^2
D = Z1*Z2
E = B*C
F = (A*AB+a2*C)*D+E
X3 = B*F
Y3 = C*(A*X1Z2+B*Y1Z2)+AB*F
Z3 = E*D
```

The "add-2005-dl-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 15M + 2S + 1*a2 + 8add.
• Source: 2005 Doche–Lange, plus common-subexpression elimination.
• Explicit formulas:
```      A = Y1*Z2+Z1*Y2
B = X1*Z2+Z1*X2
C = B^2
D = Z1*Z2
E = B*C
F = (A^2+A*B+a2*C)*D+E
X3 = B*F
Y3 = C*(A*X1+Y1*B)*Z2+(A+B)*F
Z3 = E*D
```

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 15M + 2S + 13 + 1*a2 + 8add.
• Source: 2005 Doche–Lange.
• Explicit formulas:
```      A = Y1*Z2+Z1*Y2
B = X1*Z2+Z1*X2
C = B^2
D = Z1*Z2
E = (A^2+A*B+a2*C)*D+B*C
X3 = B*E
Y3 = C*(A*X1+Y1*B)*Z2+(A+B)*E
Z3 = B^3*D
```

## Explicit formulas for doubling

The "mdbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1.
• Cost: 5M + 3S + 1*a2 + 5add.
• Source: 2005 Doche–Lange.
• Explicit formulas:
```      A = X1^2
B = A+Y1
E = (B^2+B*X1+a2*A)
X3 = X1*E
Y3 = (B+X1)*E+A^2*X1
Z3 = X1*A
```

The "dbl-2008-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 7M + 3S + 1*a2 + 4add.
• Source: 2008 Bernstein–Lange.
• Explicit formulas:
```      A = X1^2
B = A+Y1*Z1
C = X1*Z1
BC = B+C
D = C^2
E = B*BC+a2*D
X3 = C*E
Y3 = BC*E+A^2*C
Z3 = C*D
```

The "dbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 7M + 4S + 1*a2 + 5add.
• Source: 2005 Doche–Lange.
• Explicit formulas:
```      A = X1^2
B = A+Y1*Z1
C = X1*Z1
D = C^2
E = (B^2+B*C+a2*D)
X3 = C*E
Y3 = (B+C)*E+A^2*C
Z3 = C*D
```

## Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 1I + 2M + 0add.
• Explicit formulas:
```      A = 1/Z1
X3 = A*X1
Y3 = A*Y1
Z3 = 1
```