Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Lambda coordinates for short Weierstrass curves

Lambda coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Lambda coordinates [database entry] represent x y as X L Z satisfying the following equations:

  x=X/Z
  y/x=(L-X)/Z

Source: 2013 Oliveira–López–Aranha–Rodríguez-Henríquez "Lambda coordinates for binary elliptic curves".

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

11M for addition: 11M+2S.
11M for readdition: 11M+2S after 11M+2S.
3M for doubling: 3M+4S.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

11.4M for addition: 11M+2S.
11.4M for readdition: 11M+2S after 11M+2S.
3.8M for doubling: 3M+4S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition		11M + 2S	11M + 2S
doubling	a21=a2+1 and a226=a2^²+a6	3M + 4S + 1a2 + 1a226 + 1*a21
doubling		4M + 4S + 1*a2

Explicit formulas for addition

The "add-2013-olar" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 11M + 2S + 5add.
Source: 2013 Oliveira–López–Aranha–Rodríguez-Henríquez "Lambda coordinates for binary elliptic curves"; database entry contributed by Chitchanok Chuengsatiansup.

Explicit formulas:

      A = L1*Z2
      B = L2*Z1
      C = A+B
      D = X1*Z2
      E = X2*Z1
      F = D+E
      G = F^²
      H = C*D
      I = C*E
      J = C*G
      K = J*Z2
      X3 = H*I
      L3 = (I+G)^²+K*(L1+Z1)
      Z3 = K*Z1

Explicit formulas for doubling

The "dbl-2013-olar-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: a21=a2+1 and a226=a2^²+a6.
Cost: 3M + 4S + 1*a2 + 1*a226 + 1*a21 + 8add.
Source: 2013 Oliveira–López–Aranha–Rodríguez-Henríquez "Lambda coordinates for binary elliptic curves"; database entry contributed by Chitchanok Chuengsatiansup.

Explicit formulas:

      A = Z1^²
      B = L1+Z1
      C = L1*B
      D = a2*A
      E = C+D
      F = L1+X1
      G = F^²
      H = A^²
      X3 = E^²
      Z3 = E*A
      L3 = G*(G+E+A)+a226*H+X3+a21*Z3

The "dbl-2013-olar" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 4M + 4S + 1*a2 + 5add.
Source: 2013 Oliveira–López–Aranha–Rodríguez-Henríquez "Lambda coordinates for binary elliptic curves"; database entry contributed by Chitchanok Chuengsatiansup.

Explicit formulas:

      A = Z1^²
      B = L1^²
      C = L1*Z1
      D = a2*A
      E = B+C+D
      F = X1*Z1
      X3 = E^²
      Z3 = E*A
      L3 = F^²+X3+E*C+Z3

Lambda coordinates for short Weierstrass curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling