Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Short Weierstrass curves EFD / Ordinary genus-1 binary / Projective coordinates for short Weierstrass curves

Projective coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a2 a6 and coordinates x y satisfying the following equations:

  y^²+x*y=x^³+a2*x^²+a6

Projective coordinates [database entry] represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

14M for addition: 14M+1S.
11M for addition with Z2=1: 11M+1S. 11M+2S.
7M for addition with Z1=1 and Z2=1: 7M+1S.
14M for readdition: 14M+1S after 14M+1S.
11M for readdition with Z2=1: 11M+1S after 11M+1S. 11M+2S after 11M+2S.
7M for readdition with Z1=1 and Z2=1: 7M+1S after 7M+1S.
7M for doubling: 7M+3S. 7M+4S.
5M for doubling with Z1=1: 5M+3S.
12M for scaling: 1I+2M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

14.2M for addition: 14M+1S.
11.2M for addition with Z2=1: 11M+1S.
7.2M for addition with Z1=1 and Z2=1: 7M+1S.
14.2M for readdition: 14M+1S after 14M+1S.
11.2M for readdition with Z2=1: 11M+1S after 11M+1S.
7.2M for readdition with Z1=1 and Z2=1: 7M+1S after 7M+1S.
7.6M for doubling: 7M+3S.
5.6M for doubling with Z1=1: 5M+3S.
12M for scaling: 1I+2M.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z1=1 and Z2=1	7M + 1S + 1*a2	7M + 1S + 1*a2
addition	Z2=1	11M + 1S + 1*a2	11M + 1S + 1*a2
addition	Z2=1	11M + 2S + 1*a2	11M + 2S + 1*a2
addition		14M + 1S + 1*a2	14M + 1S + 1*a2
addition		15M + 2S + 1*a2	15M + 2S + 1*a2
addition		15M + 2S + 1^³ + 1*a2	15M + 2S + 1^³ + 1*a2
doubling	Z1=1	5M + 3S + 1*a2
doubling		7M + 3S + 1*a2
doubling		7M + 4S + 1*a2
scaling		1I + 2M

Explicit formulas for addition

The "mmadd-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and Z2=1.
Cost: 7M + 1S + 1*a2 + 7add.
Source: 2008 Bernstein–Lange.

Explicit formulas:

      A = Y1+Y2
      B = X1+X2
      AB = A+B
      C = B^²
      Z3 = B*C
      F = A*AB+a2*C+Z3
      X3 = B*F
      Y3 = C*(A*X1+B*Y1)+AB*F

The "madd-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 11M + 1S + 1*a2 + 7add.
Source: 2008 Bernstein–Lange.

Explicit formulas:

      A = Y1+Z1*Y2
      B = X1+Z1*X2
      AB = A+B
      C = B^²
      E = B*C
      F = (A*AB+a2*C)*Z1+E
      X3 = B*F
      Y3 = C*(A*X1+B*Y1)+AB*F
      Z3 = E*Z1

The "madd-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 11M + 2S + 1*a2 + 8add.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = Y1+Z1*Y2
      B = X1+Z1*X2
      C = B^²
      E = B*C
      F = (A^²+A*B+a2*C)*Z1+E
      X3 = B*F
      Y3 = C*(A*X1+Y1*B)+(A+B)*F
      Z3 = E*Z1

The "add-2008-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 14M + 1S + 1*a2 + 7add.
Source: 2008 Bernstein–Lange.

Explicit formulas:

      Y1Z2 = Y1*Z2
      X1Z2 = X1*Z2
      A = Y1Z2+Z1*Y2
      B = X1Z2+Z1*X2
      AB = A+B
      C = B^²
      D = Z1*Z2
      E = B*C
      F = (A*AB+a2*C)*D+E
      X3 = B*F
      Y3 = C*(A*X1Z2+B*Y1Z2)+AB*F
      Z3 = E*D

The "add-2005-dl-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 15M + 2S + 1*a2 + 8add.
Source: 2005 Doche–Lange, plus common-subexpression elimination.

Explicit formulas:

      A = Y1*Z2+Z1*Y2
      B = X1*Z2+Z1*X2
      C = B^²
      D = Z1*Z2
      E = B*C
      F = (A^²+A*B+a2*C)*D+E
      X3 = B*F
      Y3 = C*(A*X1+Y1*B)*Z2+(A+B)*F
      Z3 = E*D

The "add-2005-dl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 15M + 2S + 1^³ + 1*a2 + 8add.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = Y1*Z2+Z1*Y2
      B = X1*Z2+Z1*X2
      C = B^²
      D = Z1*Z2
      E = (A^²+A*B+a2*C)*D+B*C
      X3 = B*E
      Y3 = C*(A*X1+Y1*B)*Z2+(A+B)*E
      Z3 = B^³*D

Explicit formulas for doubling

The "mdbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 5M + 3S + 1*a2 + 5add.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = X1^²
      B = A+Y1
      E = (B^²+B*X1+a2*A)
      X3 = X1*E
      Y3 = (B+X1)*E+A^²*X1
      Z3 = X1*A

The "dbl-2008-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 3S + 1*a2 + 4add.
Source: 2008 Bernstein–Lange.

Explicit formulas:

      A = X1^²
      B = A+Y1*Z1
      C = X1*Z1
      BC = B+C
      D = C^²
      E = B*BC+a2*D
      X3 = C*E
      Y3 = BC*E+A^²*C
      Z3 = C*D

The "dbl-2005-dl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 4S + 1*a2 + 5add.
Source: 2005 Doche–Lange.

Explicit formulas:

      A = X1^²
      B = A+Y1*Z1
      C = X1*Z1
      D = C^²
      E = (B^²+B*C+a2*D)
      X3 = C*E
      Y3 = (B+C)*E+A^²*C
      Z3 = C*D

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "scale" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 2M + 0add.

Explicit formulas:

      A = 1/Z1
      X3 = A*X1
      Y3 = A*Y1
      Z3 = 1