Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Twisted Edwards curves EFD / Genus-1 large-characteristic / Extended coordinates with a=-1 for twisted Edwards curves

Extended coordinates with a=-1 for twisted Edwards curves

An elliptic curve in twisted Edwards form [more information] has parameters a d and coordinates x y satisfying the following equations:
  a*x2+y2=1+d*x2*y2

Extended coordinates with a=-1 [database entry] make the additional assumptions

  a=-1
and represent x y as X Y Z T satisfying the following equations:
  x=X/Z
  y=Y/Z
  x*y=T/Z

This representation was introduced in the Hisil–Wong–Carter–Dawson paper "Twisted Edwards curves revisited" (Asiacrypt 2008).

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M: Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

Summary of all explicit formulas

OperationAssumptionsCostReaddition cost
addition Z1=1 and Z2=1 6M 6M
addition Z1=1 and Z2=1 and k=2*d 6M + 1S + 1*k 6M + 1S
addition Z1=1 and Z2=1 7M + 1*a 7M + 1*a
addition Z2=1 and k=2*d 7M + 1*k 7M
addition Z2=1 7M 7M
addition Z1=1 and Z2=1 7M + 1S + 1*a + 1*d 7M + 1S + 1*a
addition Z2=1 8M + 1*a 8M + 1*a
addition Z2=1 8M + 1*a + 1*d 8M + 1*a
addition k=2*d 8M + 1*k 8M
addition 8M 8M
addition 9M + 1*a 9M + 1*a
addition 9M + 1*a + 1*d 9M + 1*a
doubling Z1=1 3M + 4S + 1*a
doubling 4M + 4S + 1*a
tripling 11M + 3S + 1*a

Explicit formulas for addition

The "mmadd-2008-hwcd-4" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "mmadd-2008-hwcd-3" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "mmadd-2008-hwcd-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "madd-2008-hwcd-3" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "madd-2008-hwcd-4" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "mmadd-2008-hwcd" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "madd-2008-hwcd-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "madd-2008-hwcd" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "add-2008-hwcd-3" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "add-2008-hwcd-4" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "add-2008-hwcd-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "add-2008-hwcd" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for doubling

The "mdbl-2008-hwcd" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

The "dbl-2008-hwcd" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for tripling

The "tpl-2015-c" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling