**Double point compression for elliptic curves of $j$-invariant $0$**

*Dmitrii Koshelev*

**Abstract: **The article provides a new double point compression method (to $2\log_2(q) + 4$ bits) for an elliptic $\mathbb{F}_{\!q}$-curve $E\!: y^2 = x^3 + b$ of $j$-invariant $0$ over a finite field $\mathbb{F}_{\!q}$ such that $q \equiv 1 \ (\mathrm{mod} \ 3)$. More precisely, we obtain explicit simple formulas transforming the coordinates $x_0,y_0,x_1,y_1$ of two points $P_0, P_1 \in E(\mathbb{F}_{\!q})$ to some two elements $t, s \in \mathbb{F}_{\!q}$ with four auxiliary bits. To recover (in the decompression stage) the points $P_0, P_1$ it is proposed to extract a sixth root $\sqrt[6]{w} \in \mathbb{F}_{\!q}$ of some element $w \in \mathbb{F}_{\!q}$. It is easily seen that for $q \equiv 3 \ (\mathrm{mod} \ 4)$, $q \not\equiv 1 \ (\mathrm{mod} \ 27)$ this can be implemented by means of just one exponentiation in $\mathbb{F}_{\!q}$. Therefore the new compression method seems to be much faster than the classical one with the coordinates $x_0, x_1$, whose decompression stage requires two exponentiations in $\mathbb{F}_{\!q}$.

**Category / Keywords: **implementation / finite fields, pairing-based cryptography, elliptic curves of $j$-invariant $0$, double point compression

**Date: **received 4 Jan 2020

**Contact author: **dishport at ya ru

**Available format(s): **PDF | BibTeX Citation

**Version: **20200106:083352 (All versions of this report)

**Short URL: **ia.cr/2020/010

[ Cryptology ePrint archive ]