Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Montgomery curves EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves

XZ coordinates for Montgomery curves

An elliptic curve in Montgomery form [more information] has parameters a b and coordinates x y satisfying the following equations:
  b*y2=x3+a*x2+x

XZ coordinates [database entry] represent x y as X Z satisfying the following equations:

  x=X/Z

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

Summary of all explicit formulas

OperationAssumptionsCostReaddition cost
doubling Z1=1 1M + 2S + 1*a
doubling 4*a24=a+2 2M + 2S + 1*a24
doubling 4*a24=a+2 4M + 3S + 1*a24
doubling 3M + 5S + 1*a
diffadd Z1=1 3M + 2S
diffadd 4M + 2S
diffadd 6M + 2S
diffadd 6M + 2S
ladder Z1=1 and 4*a24=a+2 5M + 4S + 1*a24
ladder 4*a24=a+2 6M + 4S + 1*a24
ladder 4*a24=a+2 10M + 5S + 1*a24
ladder 9M + 7S + 1*a
scaling 1I + 1M

Explicit formulas for addition

Explicit formulas for doubling

The "mdbl-1987-m" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dbl-1987-m-3" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dbl-1987-m-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dbl-1987-m" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for tripling

Explicit formulas for differential addition

The "mdadd-1987-m" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dadd-1987-m-3" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dadd-1987-m" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dadd-1987-m-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for differential addition and doubling

The "mladd-1987-m" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "ladd-1987-m-3" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "ladd-1987-m-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "ladd-1987-m" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]: