This paper also presents dedicated doubling formulas for these curves using 2M + 6S + 3D, where M is the cost of a field multiplication, S is the cost of a field squaring, and D is the cost of multiplying by a curve parameter. These doubling formulas are also the first complete doubling formulas in the literature, with no exceptions for the neutral element, points of order 2, etc. Finally, this paper presents complete formulas for differential addition, i.e., addition of points with known difference. A differential addition and doubling, the basic step in a Montgomery ladder, uses 5M + 4S + 2D when the known difference is given in affine form.
Category / Keywords: public-key cryptography / Elliptic curves, Edwards curves, binary fields, complete addition law, Montgomery ladder, countermeasures against side-channel attacks Date: received 15 Apr 2008, last revised 11 Jun 2008 Contact author: tanja at hyperelliptic org Available formats: PDF | BibTeX Citation Note: Improved explicit formulas. See also the Explicit-Formulas Database, http://hyperelliptic.org/EFD. Version: 20080611:104806 (All versions of this report) Discussion forum: Show discussion | Start new discussion