Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Short Weierstrass curves EFD / Genus-1 large-characteristic / W12 coordinates with a6=0 for short Weierstrass curves

W12 coordinates with a6=0 for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a b and coordinates x y satisfying the following equations:

  y^²=x^³+a*x+b

W12 coordinates with a6=0 [database entry] make the additional assumptions

b=0

and represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z^²

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:

17M for addition: 10M+7S.
13M for addition with Z2=1: 8M+5S.
16M for readdition: 10M+6S after 10M+7S.
13M for readdition with Z2=1: 8M+5S after 8M+5S.
7M for doubling: 1M+6S.

Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:

15.6M for addition: 10M+7S.
12M for addition with Z2=1: 8M+5S.
14.8M for readdition: 10M+6S after 10M+7S.
12M for readdition with Z2=1: 8M+5S after 8M+5S.
5.8M for doubling: 1M+6S.

Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

14.69M for addition: 10M+7S.
11.35M for addition with Z2=1: 8M+5S.
14.02M for readdition: 10M+6S after 10M+7S.
11.35M for readdition with Z2=1: 8M+5S after 8M+5S.
5.02M for doubling: 1M+6S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z2=1	8M + 5S	8M + 5S
addition		10M + 7S	10M + 6S
doubling		1M + 6S + 1*a

Explicit formulas for addition

The "madd-2010-cln" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 8M + 5S + 9add + 3*2.
Source: 2010 Costello–Lange–Naehrig.

Explicit formulas:

      A = Z1^²
      E = X2*Z1
      G = Y2*A
      H = (X1-E)
      I = (Y1-G)
      II = I^²
      J = Z1*H
      K = 2*J*H
      X3 = 2*II-(X1+E)*K
      JJ = J^²
      Y3 = ((J+I)^²-JJ-II)*(X1*K-X3)-Y1*K^²
      Z3 = 2*JJ

The "add-2010-cln" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 10M + 7S + 12add + 3*2 + 1*4.
Cost: 10M + 6S + 12add + 3*2 + 1*4 dependent upon the first point.
Source: 2010 Costello–Lange–Naehrig.

Explicit formulas:

      A = Z1^²
      B = Z2^²
      C = (Z1+Z2)^²-A-B
      D = X1*Z2
      E = X2*Z1
      F = Y1*B
      G = Y2*A
      H = D-E
      I = 2*(F-G)
      II = I^²
      J = C*H
      K = 4*J*H
      X3 = 2*II-(D+E)*K
      JJ = J^²
      Y3 = ((J+I)^²-JJ-II)*(D*K-X3)-F*K^²
      Z3 = 2*JJ

Explicit formulas for doubling

The "dbl-2010-cln" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1M + 6S + 1*a + 7add + 1*2 + 1*4.
Source: 2010 Costello–Lange–Naehrig.

Explicit formulas:

      A = X1^²
      B = Y1^²
      C = Z1^²
      D = a*C
      X3 = (A-D)^²
      E = 2*(A+D)^²-X3
      F = ((A-D+Y1)^²-B-X3)
      Y3 = E*F
      Z3 = 4*B

W12 coordinates with a6=0 for short Weierstrass curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling