**Inverted Edwards coordinates**

*Daniel J. Bernstein and Tanja Lange*

**Abstract: **Edwards curves have attracted great interest for several reasons.
When curve parameters are chosen properly, the addition formulas use
only $10M+1S$. The formulas are {\it strongly unified}, i.e., work
without change for doublings; even better, they are {\it complete},
i.e., work without change for all inputs. Dedicated doubling formulas
use only $3M+4S$, and dedicated tripling formulas use only $9M+4S$.

This paper introduces {\it inverted Edwards coordinates}. Inverted Edwards coordinates $(X_1:Y_1:Z_1)$ represent the affine point $(Z_1/X_1,Z_1/Y_1)$ on an Edwards curve; for comparison, standard Edwards coordinates $(X_1:Y_1:Z_1)$ represent the affine point $(X_1/Z_1,Y_1/Z_1)$.

This paper presents addition formulas for inverted Edwards coordinates using only $9M+1S$. The formulas are not complete but still are strongly unified. Dedicated doubling formulas use only $3M+4S$, and dedicated tripling formulas use only $9M+4S$. Inverted Edwards coordinates thus save $1M$ for each addition, without slowing down doubling or tripling.

**Category / Keywords: **public-key cryptography / Elliptic curves, addition, doubling, explicit formulas, Edwards coordinates, inverted Edwards coordinates, side-channel countermeasures, unified addition formulas, strongly unified addition formulas.

**Date: **received 25 Oct 2007

**Contact author: **tanja at hyperelliptic org

**Available format(s): **PDF | BibTeX Citation

**Version: **20071026:095603 (All versions of this report)

**Short URL: **ia.cr/2007/410

[ Cryptology ePrint archive ]