Inverted Edwards Coordinates

Abstract. Edwards curves have attracted great interest for several reasons. When curve parameters are chosen properly, the addition formulas use only 10M + 1S. The formulas are strongly unified, i.e., work without change for doublings; even better, they are complete, i.e., work without change for all inputs. Dedicated doubling formulas use only 3M + 4S, and dedicated tripling formulas use only 9M + 4S. This paper introduces inverted Edwards coordinates. Inverted Edwards coordinates (X1 : Y1 : Z1) represent the affine point (Z1/X1, Z1/Y1) on an Edwards curve; for comparison, standard Edwards coordinates (X1 : Y1 : Z1) represent the affine point (X1/Z1, Y1/Z1). This paper presents addition formulas for inverted Edwards coordinates using only 9M+1S. The formulas are not complete but still are strongly unified. Dedicated doubling formulas use only 3M + 4S, and dedicated tripling formulas use only 9M + 4S. Inverted Edwards coordinates thus save 1M for each addition, without slowing down d...

• Type: Conference
• Year: 2007
• Where: AAECC
• Authors: Daniel J. Bernstein, Tanja Lange
• Keywords: AAECC 2007, Addition Formulas, Algorithms, Edwards Curve, Formulas