Paper 2007/286

Faster addition and doubling on elliptic curves

Daniel J. Bernstein and Tanja Lange


Edwards recently introduced a new normal form for elliptic curves. Every elliptic curve over a non-binary field is birationally equivalent to a curve in Edwards form over an extension of the field, and in many cases over the original field. This paper presents fast explicit formulas (and register allocations) for group operations on an Edwards curve. The algorithm for doubling uses only 3M+4S, i.e., 3 field multiplications and 4 field squarings. If curve parameters are chosen to be small then the algorithm for mixed addition uses only 9M+1S and the algorithm for non-mixed addition uses only 10M+1S Arbitrary Edwards curves can be handled at the cost of just one extra multiplication by a curve parameter. For comparison, the fastest algorithms known for the popular ``a_4=-3 Jacobian'' form use 3M+5S for doubling; use 7M+4S for mixed addition; use 11M+5S for non-mixed addition; and use 10M+4S for non-mixed addition when one input has been added before. The explicit formulas for non-mixed addition on an Edwards curve can be used for doublings at no extra cost, simplifying protection against side-channel attacks. Even better, many elliptic curves (approximately 1/4 of all isomorphism classes of elliptic curves over a non-binary finite field) are birationally equivalent---over the original field---to Edwards curves where this addition algorithm works for all pairs of curve points, including inverses, the neutral element, etc. This paper contains an extensive comparison of different forms of elliptic curves and different coordinate systems for the basic group operations (doubling, mixed addition, non-mixed addition, and unified addition) as well as higher-level operations such as multi-scalar multiplication.

Note: Update.

Available format(s)
Public-key cryptography
Publication info
Published elsewhere. preprint
elliptic curvesadditiondoublingexplicit formulasregister allocationscalar multiplicationmulti-scalar multiplicationside-channel countermeasuresunified addition formulascomplete addition formulasefficient implementationperformance evaluation
Contact author(s)
tanja @ hyperelliptic org
2007-09-13: revised
2007-08-07: received
See all versions
Short URL
Creative Commons Attribution


      author = {Daniel J.  Bernstein and Tanja Lange},
      title = {Faster addition and doubling on elliptic curves},
      howpublished = {Cryptology ePrint Archive, Paper 2007/286},
      year = {2007},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.