This paper presents fast explicit formulas (and register allocations) for group operations on an Edwards curve. The algorithm for doubling uses only 3M+4S, i.e., 3 field multiplications and 4 field squarings.
If curve parameters are chosen to be small then the algorithm for mixed addition uses only 9M+1S and the algorithm for non-mixed addition uses only 10M+1S Arbitrary Edwards curves can be handled at the cost of just one extra multiplication by a curve parameter.
For comparison, the fastest algorithms known for the popular ``a_4=-3 Jacobian'' form use 3M+5S for doubling; use 7M+4S for mixed addition; use 11M+5S for non-mixed addition; and use 10M+4S for non-mixed addition when one input has been added before.
The explicit formulas for non-mixed addition on an Edwards curve can be used for doublings at no extra cost, simplifying protection against side-channel attacks. Even better, many elliptic curves (approximately 1/4 of all isomorphism classes of elliptic curves over a non-binary finite field) are birationally equivalent---over the original field---to Edwards curves where this addition algorithm works for all pairs of curve points, including inverses, the neutral element, etc.
This paper contains an extensive comparison of different forms of elliptic curves and different coordinate systems for the basic group operations (doubling, mixed addition, non-mixed addition, and unified addition) as well as higher-level operations such as multi-scalar multiplication.
Category / Keywords: public-key cryptography / elliptic curves, addition, doubling, explicit formulas, register allocation, scalar multiplication, multi-scalar multiplication, side-channel countermeasures, unified addition formulas, complete addition formulas, efficient implementation, performance evaluation Publication Info: preprint Date: received 26 Jul 2007, last revised 13 Sep 2007 Contact author: tanja at hyperelliptic org Available format(s): PDF | BibTeX Citation Note: Update. Version: 20070913:084329 (All versions of this report) Short URL: ia.cr/2007/286 Discussion forum: Show discussion | Start new discussion