Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Twisted Hessian curves EFD / Genus-1 large-characteristic / Projective coordinates for twisted Hessian curves

# Projective coordinates for twisted Hessian curves

An elliptic curve in twisted Hessian form [more information] has parameters a d and coordinates x y satisfying the following equations:
```  a*x^3+y^3+1=d*x*y
```

Projective coordinates [database entry] represent x y as X Y Z satisfying the following equations:

```  x=X/Z
y=Y/Z
```

## Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

## Summary of all explicit formulas

addition 11M + 1*a 11M + 1*a
addition 12M + 1*a 12M + 1*a
doubling minustwo=-2 6M + 2S + 1*minustwo + 1*d
doubling minustwo=-2 7M + 1S + 1*minustwo + 1*d
doubling i2=-1 and minustwo=-2 and 2d=2*d 8M + 1*i + 1*minustwo + 1*2d
doubling 6M + 3S + 1*a
doubling 3M + 33 + 1*a
tripling w2+w+1=0 and f*d3=27*a and d*3overd=3 6M + 6S + 4*w + 1*a + 1*3overd + 1*f
tripling w2+w+1=0 and f*d3=27*a and d*3overd=3 6M + 6S + 12*w + 1*a + 1*3overd + 1*f
tripling 2overd*d=2 and aoverddd*d3=a 8M + 4S + 1*aoverddd + 1*a + 1*2overd
tripling d*recipd=1 8M + 6S + 1*a + 1*recipd

The "add-2010-h" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 11M + 1*a + 16add + 1*2.
• Source: 2010 Hisil (thesis).
• Strongly unified.
• Explicit formulas:
```      A = X1*Z2
B = Z1*Z2
C = Y1*X2
D = Y1*Y2
E = Z1*Y2
F = a*X1*X2
G = (D+B)*(A-C)
H = (D-B)*(A+C)
J = (D+F)*(A-E)
K = (D-F)*(A+E)
X3 = G-H
Y3 = K-J
Z3 = J+K-G-H-2*(B-F)*(C+E)
```

The "add-2009-bkl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 12M + 1*a + 3add.
• Source: 2009 Bernstein–Kohel–Lange.
• Strongly unified.
• Explicit formulas:
```      A = X1*Z2
B = Z1*Z2
C = Y1*X2
D = Y1*Y2
E = Z1*Y2
F = a*X1*X2
X3 = A*B-C*D
Y3 = D*E-F*A
Z3 = F*C-B*E
```

## Explicit formulas for doubling

The "dbl-2015-bckl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: minustwo=-2.
• Cost: 6M + 2S + 1*minustwo + 1*d + 8add + 3*3.
• Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange.
• Explicit formulas:
```      R = Y1+Z1
S = Y1-Z1
T = R^2
U = S^2
V = T+3*U
W = 3*T+U
C = R*V
D = S*W
E = 3*C-d*X1*(W-V)
X3 = minustwo*X1*D
Y3 = (D+E)*Z1
Z3 = (D-E)*Y1
```

The "dbl-2012-c" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: minustwo=-2.
• Cost: 7M + 1S + 1*minustwo + 1*d + 7add + 1*2 + 1*3.
• Source: 2012 Chuengsatiansup.
• Explicit formulas:
```      P = Y1*Z1
2P = 2*P
S = Y1+Z1
A = S^2-P
C = (A-2P)*S
D = A*(Z1-Y1)
E = 3*C-d*X1*2P
X3 = minustwo*X1*D
Y3 = (D-E)*Z1
Z3 = (D+E)*Y1
```

The "dbl-2009-bkl-3" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: i2=-1 and minustwo=-2 and 2d=2*d.
• Cost: 8M + 1*i + 1*minustwo + 1*2d + 9add + 1*3.
• Source: 2009 Bernstein–Kohel–Lange.
• Explicit formulas:
```      iZ = i*Z1
A = (Y1-iZ)*(Y1+iZ)
B = Y1*Z1
C = (A-B)*(Y1+Z1)
D = (A+B)*(Z1-Y1)
E = 3*C-2d*X1*B
X3 = minustwo*X1*D
Y3 = (D-E)*Z1
Z3 = (D+E)*Y1
```

The "dbl-2009-bkl-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 6M + 3S + 1*a + 3add.
• Source: 2009 Bernstein–Kohel–Lange.
• Explicit formulas:
```      A = X1^2
B = Y1^2
C = Z1^2
D = A*X1
E = B*Y1
F = C*Z1
G = a*D
X3 = X1*(E-F)
Y3 = Z1*(G-E)
Z3 = Y1*(F-G)
```

The "dbl-2009-bkl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 3M + 33 + 1*a + 3add.
• Source: 2009 Bernstein–Kohel–Lange.
• Explicit formulas:
```      D = X1^3
E = Y1^3
F = Z1^3
G = a*D
X3 = X1*(E-F)
Y3 = Z1*(G-E)
Z3 = Y1*(F-G)
```

## Explicit formulas for tripling

The "tpl-2015-bckl-2" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: w2+w+1=0 and f*d3=27*a and d*3overd=3.
• Cost: 6M + 6S + 4*w + 1*a + 1*3overd + 1*f + 15add.
• Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange "Twisted Hessian curves".
• Explicit formulas:
```      R = a*X1*X1^2
V = Y1*Y1^2
S = Z1*Z1^2
wS = w*S
wV = w*V
wSV = wS-wV
F = R+S+V
G = R+wSV-V
H = R-S-wSV
A = F*F^2
B = A-f*A
C = G*G^2
D = H*H^2
wC = w*C
wD = w*D
wCD = wC-wD
X3 = 3overd*(B+C+D)
Y3 = B+wCD-D
Z3 = B-C-wCD
```

The "tpl-2015-bckl" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: w2+w+1=0 and f*d3=27*a and d*3overd=3.
• Cost: 6M + 6S + 12*w + 1*a + 1*3overd + 1*f + 13add.
• Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange "Twisted Hessian curves".
• Explicit formulas:
```      R = a*X1*X1^2
V = Y1*Y1^2
S = Z1*Z1^2
F = R+S+V
G = R+w*S+w*w*V
H = R+w*w*S+w*V
A = F*F^2
B = A-f*A
C = G*G^2
D = H*H^2
X3 = 3overd*(B+C+D)
Y3 = B+w*C+w*w*D
Z3 = B+w*w*C+w*D
```

The "tpl-2015-k" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: 2overd*d=2 and aoverddd*d3=a.
• Cost: 8M + 4S + 1*aoverddd + 1*a + 1*2overd + 13add + 1*3 + 1*8.
• Source: 2015 Kohel "The geometry of efficient arithmetic on elliptic curves".
• Explicit formulas:
```      R = a*X1*X1^2
V = Y1*Y1^2
S = Z1*Z1^2
T = R+S
N = T*(S+V)*(V+R)
M = (R-S)*(S-V)*(V-R)
C = (T+V)*(T+V)^2
D = aoverddd*C
E = N-8*D
X3 = 2overd*(C-3*(D+N))
Y3 = E+M
Z3 = E-M
```

The "tpl-2009-bkl" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: d*recipd=1.
• Cost: 8M + 6S + 1*a + 1*recipd + 12add + 2*2.
• Source: 2009 Bernstein–Kohel–Lange.
• Explicit formulas:
```      U = a*X1*X1^2
V = Y1*Y1^2
W = Z1*Z1^2
A = (U-V)^2
B = (U-W)^2
C = (V-W)^2
D = A+C
E = A+B
X3 = recipd*(U+V+W)*(B+D)
Y3 = 2*U*C-V*(C-E)
Z3 = 2*V*B-U*(B-D)
```