addition on elliptic curves. - fields institute\addition on elliptic curves": p q p + q jjjjjj...
TRANSCRIPT
![Page 1: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/1.jpg)
Addition laws on elliptic curves
D. J. Bernstein
University of Illinois at Chicago
Joint work with:
Tanja Lange
Technische Universiteit Eindhoven
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
![Page 2: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/2.jpg)
Addition laws on elliptic curves
D. J. Bernstein
University of Illinois at Chicago
Joint work with:
Tanja Lange
Technische Universiteit Eindhoven
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
![Page 3: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/3.jpg)
Addition laws on elliptic curves
D. J. Bernstein
University of Illinois at Chicago
Joint work with:
Tanja Lange
Technische Universiteit Eindhoven
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
![Page 4: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/4.jpg)
Addition laws on elliptic curves
D. J. Bernstein
University of Illinois at Chicago
Joint work with:
Tanja Lange
Technische Universiteit Eindhoven
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
![Page 5: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/5.jpg)
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
![Page 6: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/6.jpg)
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
![Page 7: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/7.jpg)
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
![Page 8: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/8.jpg)
2007.01.10, 09:00 (yikes!),
Leiden University, part of
“Mathematics: Algorithms and
Proofs” week at Lorentz Center:
Harold Edwards speaks on
“Addition on elliptic curves.”
Edwards
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
![Page 9: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/9.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
![Page 10: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/10.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
![Page 11: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/11.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
![Page 12: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/12.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
![Page 13: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/13.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
![Page 14: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/14.jpg)
What we think when we hear
“addition on elliptic curves”:
�P�Q�
�P + Qjjjjjjjjjjjjjjjjjjj
y
x
OO
//
II
Addition on y2 � 5xy = x3 � 7.
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
![Page 15: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/15.jpg)
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
![Page 16: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/16.jpg)
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
![Page 17: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/17.jpg)
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
![Page 18: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/18.jpg)
� = (y2 � y1)=(x2 � x1),
x3 = �2 � 5�� x1 � x2,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x2; y2) = (x3; y3).
Oops, this requires x1 6= x2.
� = (5y1 + 3x21)=(2y1 � 5x1),
x3 = �2 � 5�� 2x1,
y3 = 5x3 � (y1 + �(x3 � x1))
) (x1; y1) + (x1; y1) = (x3; y3).
Oops, this requires 2y1 6= 5x1.
(x1; y1) + (x1; 5x1 � y1) = 1.
(x1; y1) +1 = (x1; y1).
1+ (x1; y1) = (x1; y1).
1+1 = 1.
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
![Page 19: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/19.jpg)
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
![Page 20: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/20.jpg)
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
![Page 21: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/21.jpg)
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
![Page 22: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/22.jpg)
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
![Page 23: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/23.jpg)
Despite 09:00,
despite Dutch trains,
we attend the talk.
Edwards says:
Euler–Gauss addition law
on x2 + y2 = 1� x2y2 is
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1� x1x2y1y2,
y3 =y1y2 � x1x2
1 + x1x2y1y2.
Euler Gauss
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
![Page 24: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/24.jpg)
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
![Page 25: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/25.jpg)
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
![Page 26: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/26.jpg)
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
![Page 27: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/27.jpg)
Edwards, continued:
Every elliptic curve over Q
is birationally equivalent to
x2 + y2 = a2(1 + x2y2)
for some a 2 Q� f0;�1;�ig.(Euler–Gauss curve � the
“lemniscatic elliptic curve.”)
x2 + y2 = a2(1 + x2y2) has
neutral element (0; a), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
a(1 + x1x2y1y2),
y3 =y1y2 � x1x2
a(1� x1x2y1y2).
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
![Page 28: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/28.jpg)
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
![Page 29: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/29.jpg)
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
![Page 30: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/30.jpg)
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
![Page 31: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/31.jpg)
Addition law is “unified”:
(x1; y1) + (x1; y1) = (x3; y3) with
x3 =x1y1 + y1x1
a(1 + x1x1y1y1),
y3 =y1y1 � x1x1
a(1� x1x1y1y1).
Have seen unification before.
e.g., 1986 Chudnovsky2:
17M unified addition formulas
for (S : C : D : Z) on Jacobi’s
S2 + C2 = Z2, k2S2 + D2 = Z2.
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
![Page 32: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/32.jpg)
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
![Page 33: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/33.jpg)
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
![Page 34: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/34.jpg)
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
![Page 35: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/35.jpg)
2007.01.10, � 09:30,
Bernstein–Lange:
Edwards addition law with
standard projective (X : Y : Z),
standard Karatsuba optimization,
common-subexp elimination:
10M + 1S + 1A.
Faster than anything seen before!
M: field multiplication.
S: field squaring.
A: multiplication by a.
Karatsuba
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
![Page 36: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/36.jpg)
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
![Page 37: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/37.jpg)
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
![Page 38: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/38.jpg)
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
![Page 39: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/39.jpg)
Edwards paper: Bulletin AMS
44 (2007), 393–422.
Many papers in 2007, 2008, 2009
have now used Edwards curves
to set speed records
for critical computations
in elliptic-curve cryptography.
Also new speed records
for ECM factorization: see
Lange’s talk here on Saturday.
Also expect speedups in verifying
elliptic-curve primality proofs.
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
![Page 40: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/40.jpg)
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
![Page 41: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/41.jpg)
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
![Page 42: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/42.jpg)
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
![Page 43: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/43.jpg)
Back to B.–L., early 2007.
Edwards x2 + y2 = a2(1 + x2y2)
doesn’t rationally include
Euler–Gauss x2 + y2 = 1� x2y2.
Common generalization,
presumably more curves over Q,
presumably more curves over Fq:x2 + y2 = 2(1 + dx2y2) has
neutral element (0; ), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
(1 + dx1x2y1y2),
y3 =y1y2 � x1x2
(1� dx1x2y1y2).
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
![Page 44: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/44.jpg)
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
![Page 45: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/45.jpg)
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
![Page 46: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/46.jpg)
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
![Page 47: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/47.jpg)
Convenient to take = 1
for speed, simplicity.
Covers same set of curves
up to birational equivalence:
( ; d) � (1; d 4).x2 + y2 = 1 + dx2y2 has
neutral element (0; 1), addition
(x1; y1) + (x2; y2) = (x3; y3) with
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
![Page 48: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/48.jpg)
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
![Page 49: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/49.jpg)
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
![Page 50: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/50.jpg)
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
![Page 51: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/51.jpg)
Hmmm, does this really work?
Easiest way to check
the generalized addition law:
pull out the computer!
Pick a prime p; e.g. 47.
Pick curve param d 2 Fp.Enumerate all affine points
(x; y) 2 Fp � Fp satisfying
x2 + y2 = 1 + dx2y2.
Use generalized addition law
to make an addition table
for all pairs of points.
Check associativity etc.
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
![Page 52: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/52.jpg)
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
![Page 53: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/53.jpg)
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
![Page 54: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/54.jpg)
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
![Page 55: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/55.jpg)
Warning: Don’t expect
complete addition table.
Addition law works generically
but can fail for some
exceptional pairs of points.
Unified addition law
works for generic additions
and for generic doublings
but can fail for some
exceptional pairs of points.
Basic problem: Denominators
1� dx1x2y1y2 can be zero.
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
![Page 56: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/56.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
![Page 57: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/57.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
![Page 58: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/58.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
![Page 59: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/59.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
![Page 60: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/60.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
![Page 61: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/61.jpg)
Even if we switched to
projective coordinates,
would expect addition law
to fail for some points,
producing (0 : 0 : 0).
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
Bosma Lenstra
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
![Page 62: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/62.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
![Page 63: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/63.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
![Page 64: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/64.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
![Page 65: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/65.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
![Page 66: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/66.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
![Page 67: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/67.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
![Page 68: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/68.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
![Page 69: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/69.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
![Page 70: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/70.jpg)
Try p = 47, d = 25:
denominator 1� dx1x2y1y2
is nonzero for most points
(x1; y1), (x2; y2) on curve.
Edwards addition law is
associative whenever defined.
Try p = 47, d = �1:
denominator 1� dx1x2y1y2
is nonzero for all points
(x1; y1), (x2; y2) on curve.
Addition law is a group law!
vs.
Z60T
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
![Page 71: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/71.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.”
![Page 72: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/72.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
![Page 73: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/73.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
![Page 74: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/74.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
![Page 75: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/75.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
![Page 76: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/76.jpg)
2007 Bernstein–Lange
completeness proof
for all non-square d:If x2
1 + y21 = 1 + dx2
1y21
and x22 + y2
2 = 1 + dx22y2
2
and dx1x2y1y2 = �1
then dx21y2
1(x2 + y2)2
= dx21y2
1(x22 + y2
2 + 2x2y2)
= dx21y2
1(dx22y2
2 + 1 + 2x2y2)
= d2x21y2
1x22y2
2+dx21y2
1+2dx21y2
1x2y2
= 1 + dx21y2
1 � 2x1y1
= x21 + y2
1 � 2x1y1 = (x1 � y1)2.
Have x2 + y2 6= 0 or x2 � y2 6= 0;
either way d is a square. Q.E.D.
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
![Page 77: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/77.jpg)
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
![Page 78: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/78.jpg)
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
![Page 79: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/79.jpg)
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
![Page 80: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/80.jpg)
1995 Bosma–Lenstra theorem:
“The smallest cardinality of a
complete system of addition laws
on E equals two.” : : : meaning:
Any addition formula
for a Weierstrass curve Ein projective coordinates
must have exceptional cases
in E(k)� E(k), where
k = algebraic closure of k.
Edwards addition formula has
exceptional cases for E(k)
: : : but not for E(k).
We do computations in E(k).
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
![Page 81: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/81.jpg)
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
![Page 82: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/82.jpg)
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
![Page 83: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/83.jpg)
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
![Page 84: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/84.jpg)
Summary: Assume k field;
2 6= 0 in k; non-square d 2 k.
Then f(x; y) 2 k� k :
x2 + y2 = 1 + dx2y2gis a commutative group with
(x1; y1) + (x2; y2) = (x3; y3)
defined by Edwards addition law:
x3 =x1y2 + y1x2
1 + dx1x2y1y2,
y3 =y1y2 � x1x2
1� dx1x2y1y2.
Terminology: “Edwards curves”
allow arbitrary d 2 k�; d = 4are “original Edwards curves”;
non-square d are “complete.”
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
![Page 85: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/85.jpg)
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
![Page 86: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/86.jpg)
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
![Page 87: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/87.jpg)
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
![Page 88: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/88.jpg)
d = 0: “the clock group.”
x2 + y2 = 1, parametrized
by (x; y) = (sin; cos).
Gauss parametrized
x2 + y2 = 1� x2y2 by
(x; y) = (“lemn sin”; “lemn cos”).
Abel, Jacobi “sn, cn, dn”
cover all elliptic curves,
but (sn; cn) does not
specialize to (sin; cos)
or to (lemn sin; lemn cos).
Edwards x is sn;
Edwards y is cn/dn.
Theta view: see Edwards paper.
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
![Page 89: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/89.jpg)
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
![Page 90: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/90.jpg)
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
![Page 91: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/91.jpg)
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
![Page 92: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/92.jpg)
Every elliptic curve over kwith a point of order 4
is birationally equivalent
to an Edwards curve.
Unique order-2 point ) complete.
Convenient for implementors:
no need to worry about
accidentally bumping into
exceptional inputs.
Particularly nice for cryptography:
no need to worry about
attackers manufacturing
exceptional inputs,
hearing case distinctions, etc.
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
![Page 93: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/93.jpg)
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
![Page 94: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/94.jpg)
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
![Page 95: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/95.jpg)
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
![Page 96: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/96.jpg)
What about elliptic curves
without points of order 4?
What about elliptic curves
over binary fields?
Continuing project (B.–L.):
For every elliptic curve E,
find complete addition law for Ewith best possible speeds.
Complete laws are useful
even if slower than Edwards!
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
![Page 97: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/97.jpg)
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
![Page 98: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/98.jpg)
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
![Page 99: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/99.jpg)
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
![Page 100: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/100.jpg)
2008 B.–Birkner–L.–Peters:
“twisted Edwards curves”
ax2 + y2 = 1 + dx2y2
cover all Montgomery curves.
Almost as fast as a = 1;
brings Edwards speed
to larger class of curves.
2008 B.–B.–Joye–L.–P.:
every elliptic curve over Fpwhere 4 divides group order
is (1 or 2)-isogenous
to a twisted Edwards curve.
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
![Page 101: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/101.jpg)
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
![Page 102: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/102.jpg)
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
![Page 103: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/103.jpg)
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
![Page 104: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/104.jpg)
Statistics for many p 2 1 + 4Z,
� number of pairs (j(E);#E):
Curves total odd 2odd 4odd 8odd
orig 124p 0 0 0 0
compl 12p 0 0 1
4p 18p
Ed 23p 0 0 1
4p 316p
twist 56p 0 0 5
12p 316p
4Z 56p 0 0 5
12p 316p
all 2p 23p 1
2p 512p 3
16pDifferent statistics for 3 + 4Z.
Bad news:
complete twisted Edwards
� complete Edwards!
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
![Page 105: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/105.jpg)
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
![Page 106: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/106.jpg)
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
![Page 107: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/107.jpg)
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
![Page 108: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/108.jpg)
Some Newton polygons
���������������
��
�� JJJJJJ
J
Short Weierstrass
���������������
��
�� OOOOOOOO
Jacobi quartic
����
����
����
����
����
�
�
�� ??
????
??
Hessian
���������������
���
�Edwards
1893 Baker: genus is generically
number of interior points.
2000 Poonen–Rodriguez-Villegas
classified genus-1 polygons.
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
![Page 109: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/109.jpg)
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
![Page 110: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/110.jpg)
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
![Page 111: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/111.jpg)
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
![Page 112: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/112.jpg)
How to generalize Edwards?
Design decision: want
quadratic in x and in y.
Design decision: want
x$ y symmetry.
d00
d10
d20
d10
d11
d21
d20
d21
d22
Curve shape d00 + d10(x + y) +
d11xy + d20(x2 + y2) +
d21xy(x + y) + d22x2y2 = 0.
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
![Page 113: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/113.jpg)
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
![Page 114: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/114.jpg)
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
![Page 115: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/115.jpg)
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
![Page 116: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/116.jpg)
Suppose that d22 = 0:
d00
d10
d20
d10
d11
d21
d20
d21
�
Genus 1 ) (1; 1) is an
interior point ) d21 6= 0.
Homogenize:
d00Z3 + d10(X + Y )Z2 +
d11XY Z + d20(X2 + Y 2)Z +
d21XY (X + Y ) = 0.
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
![Page 117: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/117.jpg)
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
![Page 118: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/118.jpg)
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
![Page 119: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/119.jpg)
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
![Page 120: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/120.jpg)
Points at 1 are (X : Y : 0)
with d21XY (X + Y ) = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0), (1 : �1 : 0).
Study (1 : 0 : 0) by setting
y = Y=X, z = Z=Xin homogeneous curve equation:
d00z3 + d10(1 + y)z2 +
d11yz + d20(1 + y2)z +
d21y(1 + y) = 0.
Nonzero coefficient of yso (1 : 0 : 0) is nonsingular.
Addition law cannot be complete
(unless k is tiny).
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
![Page 121: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/121.jpg)
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
![Page 122: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/122.jpg)
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
![Page 123: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/123.jpg)
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
![Page 124: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/124.jpg)
So we require d22 6= 0.
Points at 1 are (X : Y : 0)
with d22X2Y 2 = 0: i.e.,
(1 : 0 : 0), (0 : 1 : 0).
Study (1 : 0 : 0) again:
d00z4 + d10(1 + y)z3 +
d11yz2 + d20(1 + y2)z2 +
d21y(1 + y)z + d22y2 = 0.
Coefficients of 1; y; z are 0
so (1 : 0 : 0) is singular.
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
![Page 125: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/125.jpg)
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
![Page 126: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/126.jpg)
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
![Page 127: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/127.jpg)
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
![Page 128: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/128.jpg)
Put y = uz, divide by z2
to blow up singularity:
d00z2 + d10(1 + uz)z +
d11uz + d20(1 + u2z2) +
d21u(1 + uz) + d22u2 = 0.
Substitute z = 0 to find
points above singularity:
d20 + d21u + d22u2 = 0.
We require the quadratic
d20 + d21u + d22u2
to be irreducible in k.
Special case: complete Edwards,
1� du2 irreducible in k.
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
![Page 129: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/129.jpg)
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
![Page 130: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/130.jpg)
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
![Page 131: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/131.jpg)
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
![Page 132: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/132.jpg)
In particular d20 6= 0:
d00
d10
d20
d10
d11
d21
d20
d21
d22
Design decision: Explore
a deviation from Edwards.
Choose neutral element (0; 0).
d00 = 0; d10 6= 0.
Can vary neutral element.
Warning: bad choice can produce
surprisingly expensive negation.
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
![Page 133: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/133.jpg)
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
![Page 134: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/134.jpg)
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
![Page 135: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/135.jpg)
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
![Page 136: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/136.jpg)
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
![Page 137: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/137.jpg)
Now have a Newton polygon
for generalized Edwards curves:
�
d10
d20
d10
d11
d21
d20
d21
d22
????????
By scaling x; yand scaling curve equation
can limit d10; d11; d20; d21; d22
to three degrees of freedom.
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
![Page 138: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/138.jpg)
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
![Page 139: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/139.jpg)
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
![Page 140: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/140.jpg)
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
![Page 141: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/141.jpg)
2008 B.–L.–Rezaeian Farashahi:
complete addition law for
“binary Edwards curves”
d1(x + y) + d2(x2 + y2) =
(x + x2)(y + y2).
Covers all ordinary elliptic curves
over F2n for n � 3.
Also surprisingly fast,
especially if d1 = d2.
2009 B.–L.:
complete addition law for
another specialization
covering all the “NIST curves”
over non-binary fields.
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
![Page 142: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/142.jpg)
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
![Page 143: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/143.jpg)
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
![Page 144: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/144.jpg)
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
![Page 145: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/145.jpg)
Consider, e.g., the curve
x2 + y2 = x + y + txy + dx2y2
with d = �1 and
t =78751018041117252545420999954767176464538545060814630202841395651175859201799
over Fp where p = 2256 � 2224 +
2192 + 296 � 1.
Note: d is non-square in Fp.Birationally equivalent to
standard “NIST P-256” curve
v2 = u3 � 3u + a6 where
a6 =41058363725152142129326129780047268409114441015993725554835256314039467401291.
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
![Page 146: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/146.jpg)
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
![Page 147: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/147.jpg)
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
![Page 148: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/148.jpg)
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
![Page 149: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/149.jpg)
An addition law for
x2 + y2 = x + y + txy + dx2y2,
complete if d is not a square:
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
![Page 150: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/150.jpg)
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
![Page 151: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/151.jpg)
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
![Page 152: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/152.jpg)
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
![Page 153: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/153.jpg)
Note on computing addition laws:
An easy Magma script uses
Riemann–Roch to find addition
law given a curve shape.
Are those laws nice? No!
Find lower-degree laws by
Monagan–Pearce algorithm,
ISSAC 2006; or by evaluation at
random points on random curves.
Are those laws complete? No!
But always seems easy to
find complete addition laws
among low-degree laws where
denominator constant term 6= 0.
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
![Page 154: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/154.jpg)
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
![Page 155: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/155.jpg)
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
![Page 156: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/156.jpg)
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
![Page 157: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/157.jpg)
Birational equivalence from
x2 + y2 = x+ y + txy + dx2y2 to
v2 � (t + 2)uv + dv =
u3� (t+2)u2�du+(t+2)di.e. v2 � (t + 2)uv + dv =
(u2 � d)(u� (t + 2)):
u = (dxy + t + 2)=(x + y);
v =((t + 2)2 � d)x
(t + 2)xy + x + y .
Assuming t + 2 square, d not:
only exceptional point is
(0; 0), mapping to 1.
Inverse: x = v=(u2 � d);y = ((t + 2)u� v � d)=(u2 � d).
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
![Page 158: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/158.jpg)
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
![Page 159: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/159.jpg)
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
![Page 160: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/160.jpg)
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
![Page 161: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/161.jpg)
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
![Page 162: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/162.jpg)
Completeness
x3 =
x1 + x2 + (t� 2)x1x2 +
(x1 � y1)(x2 � y2) +
dx21(x2y1 + x2y2 � y1y2)
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2)
;
y3 =
y1 + y2 + (t� 2)y1y2 +
(y1 � x1)(y2 � x2) +
dy21(y2x1 + y2x2 � x1x2)
1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2)
.
Can denominators be 0?
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
![Page 163: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/163.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
![Page 164: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/164.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
![Page 165: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/165.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
![Page 166: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/166.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
![Page 167: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/167.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
![Page 168: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/168.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
![Page 169: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/169.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
![Page 170: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/170.jpg)
Only if d is a square!
Theorem: Assume that
k is a field with 2 6= 0;
d; t; x1; y1; x2; y2 2 k;
d is not a square in k;
27d 6= (2� t)3;x2
1 +y21 = x1 +y1 +tx1y1 +dx2
1y21 ;
x22 +y2
2 = x2 +y2 +tx2y2 +dx22y2
2 .
Then 1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) 6= 0.
By x$ y symmetry
also 1� 2dy1y2x2 �dy2
1(y2 + x2 + (t� 2)y2x2) 6= 0.
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
![Page 171: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/171.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
![Page 172: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/172.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
![Page 173: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/173.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
![Page 174: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/174.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
![Page 175: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/175.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
Now 2x22 = 2x2 + tx2
2 + x2
so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.
![Page 176: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/176.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
Now 2x22 = 2x2 + tx2
2 + x2
so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.
What’s next?
Make the mathematicians happy:
Prove that all curves
are covered; should be easy
using Weil and rational param.
Make the computer happy:
Find faster complete laws.
Latest news, B.–Kohel–L.:
Have complete addition law
for twisted Hessian curves
ax3 + y3 + 1 = 3dxywhen a is non-cube.
Close in speed to Edwards
and covers different curves.
![Page 177: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/177.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
Now 2x22 = 2x2 + tx2
2 + x2
so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.
What’s next?
Make the mathematicians happy:
Prove that all curves
are covered; should be easy
using Weil and rational param.
Make the computer happy:
Find faster complete laws.
Latest news, B.–Kohel–L.:
Have complete addition law
for twisted Hessian curves
ax3 + y3 + 1 = 3dxywhen a is non-cube.
Close in speed to Edwards
and covers different curves.
![Page 178: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/178.jpg)
Proof: Suppose that
1� 2dx1x2y2 �dx2
1(x2 + y2 + (t� 2)x2y2) = 0.
Note that x1 6= 0.
Use curve equation2 to see that
(1� dx1x2y2)2 = dx2
1(x2 � y2)2.
By hypothesis d is non-square
so x21(x2 � y2)
2 = 0
and (1� dx1x2y2)2 = 0.
Hence x2 = y2 and 1 = dx1x2y2.
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
Now 2x22 = 2x2 + tx2
2 + x2
so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.
What’s next?
Make the mathematicians happy:
Prove that all curves
are covered; should be easy
using Weil and rational param.
Make the computer happy:
Find faster complete laws.
Latest news, B.–Kohel–L.:
Have complete addition law
for twisted Hessian curves
ax3 + y3 + 1 = 3dxywhen a is non-cube.
Close in speed to Edwards
and covers different curves.
![Page 179: Addition on elliptic curves. - Fields Institute\addition on elliptic curves": P Q P + Q jjjjjj jjjjjj jjjjjj j y x OO // II Addition on y 2 5 xy = x 3 7. Addition laws on elliptic](https://reader034.vdocuments.net/reader034/viewer/2022050716/5e249720d710164dce28c87c/html5/thumbnails/179.jpg)
Curve equation1 times 1=x21:
1 + y21=x2
1 =
1=x1 + y1(1=x21 + t=x1) + dy2
1 .
Substitute 1=x1 = dx22:
1 + d2y21x4
2 =
dx22 + dy1(dx4
2 + x22t) + dy2
1 .
Substitute 2x22 = 2x2 + tx2
2 + dx42:
(1� dy1x22)
2 = d(x2 � y1)2.
Thus x2 = y1 and 1 = dy1x22.
Hence 1 = dx32.
Now 2x22 = 2x2 + tx2
2 + x2
so 3 = (2�t)x2 so 27d = (2�t)3.Contradiction.
What’s next?
Make the mathematicians happy:
Prove that all curves
are covered; should be easy
using Weil and rational param.
Make the computer happy:
Find faster complete laws.
Latest news, B.–Kohel–L.:
Have complete addition law
for twisted Hessian curves
ax3 + y3 + 1 = 3dxywhen a is non-cube.
Close in speed to Edwards
and covers different curves.