Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Short Weierstrass curves EFD / Genus-1 large-characteristic / XZ coordinates for short Weierstrass curves

XZ coordinates for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a b and coordinates x y satisfying the following equations:

  y^²=x^³+a*x+b

XZ coordinates [database entry] represent x y as X Z satisfying the following equations:

  x=X/Z

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:

7M for doubling: 2M+5S. 3M+4S. 4M+3S.
9M for differential addition: 7M+2S.
8M for differential addition with Z1=1: 6M+2S. 6M+2S. 6M+2S.
16M for differential addition and doubling: 9M+7S.
15M for differential addition and doubling with Z1=1: 8M+7S. 8M+7S. 8M+7S. 8M+7S. 9M+6S.

Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:

6M for doubling: 2M+5S.
8.6M for differential addition: 7M+2S.
7.6M for differential addition with Z1=1: 6M+2S. 6M+2S. 6M+2S.
14.6M for differential addition and doubling: 9M+7S.
13.6M for differential addition and doubling with Z1=1: 8M+7S. 8M+7S. 8M+7S. 8M+7S.

Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

5.35M for doubling: 2M+5S.
8.34M for differential addition: 7M+2S.
7.34M for differential addition with Z1=1: 6M+2S. 6M+2S. 6M+2S.
13.69M for differential addition and doubling: 9M+7S.
12.69M for differential addition and doubling with Z1=1: 8M+7S. 8M+7S. 8M+7S. 8M+7S.

Summary of all explicit formulas

Operation	Assumptions	Cost
doubling	b2=2b and b4=4b	2M + 5S + 1b2 + 1a + 1*b4
doubling	b2=2*b	3M + 4S + 1b2 + 1a
doubling		4M + 3S + 1a + 1b
doubling		3M + 5S + 1^³ + 1^⁴ + 2a + 2b
doubling		3M + 4S + 3^³ + 2a + 2b
diffadd	Z1=1 and b4=4*b	6M + 2S + 1a + 1b4
diffadd	Z1=1	6M + 2S + 1a + 1b
diffadd	Z1=1	6M + 2S + 1a + 1b
diffadd		7M + 2S + 1a + 1b
diffadd		8M + 2S + 1a + 1b
diffadd	Z1=1	9M + 2S + 1a + 1b
diffadd	Z1=1	9M + 2S + 1a + 1b
diffadd	Z1=1	9M + 3S + 1a + 1b
diffadd		10M + 2S + 1a + 1b
diffadd		11M + 3S + 1a + 1b
ladder	Z1=1 and b2=2b and b4=4b	8M + 7S + 1b2 + 2a + 2*b4
ladder	Z1=1 and b4=4*b	8M + 7S + 2a + 3b4
ladder	Z1=1 and b4=4*b	8M + 7S + 2a + 3b4
ladder	Z1=1 and b4=4*b	8M + 7S + 2a + 3b4
ladder	Z1=1 and b2=2b and b4=4b	9M + 6S + 1b2 + 2a + 1*b4
ladder	b4=4*b	9M + 7S + 2a + 3b4
ladder	b4=4*b	10M + 7S + 2a + 3b4
ladder	Z1=1	12M + 7S + 1^³ + 1^⁴ + 3a + 3b
ladder	Z1=1	12M + 8S + 1^³ + 1^⁴ + 3a + 3b
ladder		13M + 7S + 1^³ + 1^⁴ + 3a + 3b
ladder		14M + 8S + 1^³ + 1^⁴ + 3a + 3b
ladder	Z1=1	12M + 6S + 3^³ + 3a + 3b

Explicit formulas for addition

Explicit formulas for doubling

The "dbl-2002-bj-3" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: b2=2*b and b4=4*b.
Cost: 2M + 5S + 1*b2 + 1*a + 1*b4 + 7add + 1*2.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formula (10) accompanied by note "7 multiplications plus 2 multiplications by a constant", plus common-subexpression elimination emphasizing squaring.

Explicit formulas:

      XX = X1^²
      ZZ = Z1^²
      A = 2*((X1+Z1)^²-XX-ZZ)
      aZZ = a*ZZ
      X3 = (XX-aZZ)^²-b2*A*ZZ
      Z3 = A*(XX+aZZ)+b4*ZZ^²

The "dbl-2002-bj-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: b2=2*b.
Cost: 3M + 4S + 1*b2 + 1*a + 7add + 2*2.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formula (10) accompanied by note "7 multiplications plus 2 multiplications by a constant", plus common-subexpression elimination.

Explicit formulas:

      XX = X1^²
      ZZ = Z1^²
      A = 2*((X1+Z1)^²-XX-ZZ)
      aZZ = a*ZZ
      b2ZZ = b2*ZZ
      X3 = (XX-aZZ)^²-A*b2ZZ
      Z3 = A*(XX+aZZ)+2*b2ZZ*ZZ

The "dbl-2002-it-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 4M + 3S + 1*a + 1*b + 4add + 1*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", page 296, Formula 3.

Explicit formulas:

      T1 = X1^²
      T2 = Z1^²
      T3 = a*T2
      T4 = T1-T3
      T5 = T4^²
      T6 = b*T2
      T7 = X1*Z1
      T8 = T6*T7
      T9 = 8*T8
      X3 = T5-T9
      T10 = T1+T3
      T11 = T7*T10
      T12 = T6*T2
      T13 = T11+T12
      Z3 = 4*T13

The "dbl-2002-it" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 3M + 5S + 1^³ + 1^⁴ + 2*a + 2*b + 4add + 1*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formula (10).

Explicit formulas:

      X3 = (X1^²-a*Z1^²)^²-8*b*X1*Z1^³
      Z3 = 4*(X1*Z1*(X1^²+a*Z1^²)+b*Z1^⁴)

The "dbl-2002-bj" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 3M + 4S + 3^³ + 2*a + 2*b + 4add + 1*4 + 1*8.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formula (10) accompanied by note "7 multiplications plus 2 multiplications by a constant".

Explicit formulas:

      X3 = (X1^²-a*Z1^²)^²-8*b*X1*Z1^³
      Z3 = 4*Z1*(X1^³+a*X1*Z1^²+b*Z1^³)

Explicit formulas for tripling

Explicit formulas for differential addition

The "mdadd-2002-bj-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b4=4*b.
Cost: 6M + 2S + 1*a + 1*b4 + 4add.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formula (9) accompanied by note "7 multiplications plus 3 multiplications by a constant", plus common-subexpression elimination.

Explicit formulas:

      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = Z2*X3
      X5 = (A-a*B)^²-b4*B*(C+D)
      Z5 = X1*(C-D)^²

The "mdadd-2002-it-3" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 6M + 2S + 1*a + 1*b + 4add + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", page 295, Formula 1, plus assumption Z1 = 1.

Explicit formulas:

      T1 = X2*X3
      T2 = Z2*Z3
      T3 = X2*Z3
      T4 = Z2*X3
      T5 = a*T2
      T6 = T1-T5
      T7 = T6^²
      T8 = b*T2
      T9 = 4*T8
      T10 = T3+T4
      T11 = T9*T10
      T12 = T7-T11
      X5 = T12
      T13 = T3-T4
      T14 = T13^²
      Z5 = X1*T14

The "mdadd-2002-it-4" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 6M + 2S + 1*a + 1*b + 5add + 1*2 + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", page 296, Formula 2, plus assumption Z1 = 1.

Explicit formulas:

      T1 = X2*X3
      T2 = Z2*Z3
      T3 = X2*Z3
      T4 = X3*Z2
      T5 = T3+T4
      T6 = a*T2
      T7 = T1+T6
      T8 = T5*T7
      T9 = 2*T8
      T10 = T2^²
      T11 = b*T10
      T12 = 4*T11
      T13 = T9+T12
      T14 = T3-T4
      T15 = T14^²
      T16 = T13
      T17 = X1*T15
      X5 = T16-T17
      Z5 = T15

The "dadd-2002-it-3" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 2S + 1*a + 1*b + 4add + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", page 295, Formula 1.

Explicit formulas:

      T1 = X2*X3
      T2 = Z2*Z3
      T3 = X2*Z3
      T4 = Z2*X3
      T5 = a*T2
      T6 = T1-T5
      T7 = T6^²
      T8 = b*T2
      T9 = 4*T8
      T10 = T3+T4
      T11 = T9*T10
      T12 = T7-T11
      X5 = Z1*T12
      T13 = T3-T4
      T14 = T13^²
      Z5 = X1*T14

The "dadd-2002-it-4" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 8M + 2S + 1*a + 1*b + 5add + 1*2 + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", page 296, Formula 2.

Explicit formulas:

      T1 = X2*X3
      T2 = Z2*Z3
      T3 = X2*Z3
      T4 = X3*Z2
      T5 = T3+T4
      T6 = a*T2
      T7 = T1+T6
      T8 = T5*T7
      T9 = 2*T8
      T10 = T2^²
      T11 = b*T10
      T12 = 4*T11
      T13 = T9+T12
      T14 = T3-T4
      T15 = T14^²
      T16 = Z1*T13
      T17 = X1*T15
      X5 = T16-T17
      Z5 = Z1*T15

The "mdadd-2002-bj" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 9M + 2S + 1*a + 1*b + 4add + 1*4.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formula (9) accompanied by note "7 multiplications plus 3 multiplications by a constant".

Explicit formulas:

      X5 = (X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2)
      Z5 = X1*(X2*Z3-X3*Z2)^²

The "mdadd-2002-it" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 9M + 2S + 1*a + 1*b + 4add + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formula (8), plus assumption Z1 = 1.

Explicit formulas:

      X5 = (X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2)
      Z5 = X1*(X2*Z3-X3*Z2)^²

The "mdadd-2002-it-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 9M + 3S + 1*a + 1*b + 5add + 1*2 + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formula (9), plus assumption Z1 = 1.

Explicit formulas:

      R = 2*(X2*Z3+X3*Z2)*(X2*X3+a*Z2*Z3)+4*b*Z2^²*Z3^²
      S = (X2*Z3-X3*Z2)^²
      X5 = R-S*X1
      Z5 = S

The "dadd-2002-it" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 10M + 2S + 1*a + 1*b + 4add + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formula (8).

Explicit formulas:

      X5 = Z1*((X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2))
      Z5 = X1*(X2*Z3-X3*Z2)^²

The "dadd-2002-it-2" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 11M + 3S + 1*a + 1*b + 5add + 1*2 + 1*4.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formula (9).

Explicit formulas:

      R = 2*(X2*Z3+X3*Z2)*(X2*X3+a*Z2*Z3)+4*b*Z2^²*Z3^²
      S = (X2*Z3-X3*Z2)^²
      X5 = R*Z1-S*X1
      Z5 = S*Z1

Explicit formulas for differential addition and doubling

The "mladd-2002-bj-3" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b2=2*b and b4=4*b.
Cost: 8M + 7S + 1*b2 + 2*a + 2*b4 + 11add + 1*2.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formulas (9) and (10), plus common-subexpression elimination emphasizing squarings.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      E = 2*((X2+Z2)^²-XX-ZZ)
      aZZ = a*ZZ
      X4 = (XX-aZZ)^²-b2*E*ZZ
      Z4 = E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = Z2*X3
      X5 = (A-a*B)^²-b4*B*(C+D)
      Z5 = X1*(C-D)^²

The "mladd-2002-it-3" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b4=4*b.
Cost: 8M + 7S + 2*a + 3*b4 + 11add + 1*2.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (8) and (10), plus common-subexpression elimination, plus assumption Z1=1.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      aZZ = a*ZZ
      E = (X2+Z2)^²-XX-ZZ
      X4 = (XX-aZZ)^²-b4*E*ZZ
      Z4 = 2*E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = X3*Z2
      X5 = (A-a*B)^²-b4*B*(C+D)
      Z5 = X1*(C-D)^²

The "mladd-2002-it-4" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b4=4*b.
Cost: 8M + 7S + 2*a + 3*b4 + 12add + 2*2.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (9) and (10), plus common-subexpression elimination, plus assumption Z1=1.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      aZZ = a*ZZ
      E = (X2+Z2)^²-XX-ZZ
      X4 = (XX-aZZ)^²-b4*E*ZZ
      Z4 = 2*E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = X3*Z2
      R = 2*(C+D)*(A+a*B)+b4*B^²
      S = (C-D)^²
      X5 = R-S*X1
      Z5 = S

The "mladd-2002-it-5" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b4=4*b.
Cost: 8M + 7S + 2*a + 3*b4 + 12add + 2*2.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (9) and (10), plus common-subexpression elimination, plus assumption Z1=1.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      aZZ = a*ZZ
      E = (X2+Z2)^²-XX-ZZ
      X4 = (XX-aZZ)^²-b4*E*ZZ
      Z4 = 2*E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = X3*Z2
      R = 2*(C+D)*(A+a*B)+b4*B^²
      S = (C-D)^²
      X5 = R-S*X1
      Z5 = S

The "mladd-2002-bj-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and b2=2*b and b4=4*b.
Cost: 9M + 6S + 1*b2 + 2*a + 1*b4 + 11add + 2*2.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formulas (9) and (10), plus common-subexpression elimination.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      E = 2*((X2+Z2)^²-XX-ZZ)
      aZZ = a*ZZ
      b2ZZ = b2*ZZ
      X4 = (XX-aZZ)^²-E*b2ZZ
      Z4 = E*(XX+aZZ)+2*b2ZZ*ZZ
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = Z2*X3
      X5 = (A-a*B)^²-b4*B*(C+D)
      Z5 = X1*(C-D)^²

The "ladd-2002-it-3" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: b4=4*b.
Cost: 9M + 7S + 2*a + 3*b4 + 11add + 1*2.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (8) and (10), plus common-subexpression elimination.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      aZZ = a*ZZ
      E = (X2+Z2)^²-XX-ZZ
      X4 = (XX-aZZ)^²-b4*E*ZZ
      Z4 = 2*E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = X3*Z2
      X5 = Z1*((A-a*B)^²-b4*B*(C+D))
      Z5 = X1*(C-D)^²

The "ladd-2002-it-4" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: b4=4*b.
Cost: 10M + 7S + 2*a + 3*b4 + 12add + 2*2.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (9) and (10), plus common-subexpression elimination.

Explicit formulas:

      XX = X2^²
      ZZ = Z2^²
      aZZ = a*ZZ
      E = (X2+Z2)^²-XX-ZZ
      X4 = (XX-aZZ)^²-b4*E*ZZ
      Z4 = 2*E*(XX+aZZ)+b4*ZZ^²
      A = X2*X3
      B = Z2*Z3
      C = X2*Z3
      D = X3*Z2
      R = 2*(C+D)*(A+a*B)+b4*B^²
      S = (C-D)^²
      X5 = R*Z1-S*X1
      Z5 = S*Z1

The "mladd-2002-it" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 12M + 7S + 1^³ + 1^⁴ + 3*a + 3*b + 8add + 2*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (8) and (10), plus assumption Z1 = 1.

Explicit formulas:

      X4 = (X2^²-a*Z2^²)^²-8*b*X2*Z2^³
      Z4 = 4*(X2*Z2*(X2^²+a*Z2^²)+b*Z2^⁴)
      X5 = ((X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2))
      Z5 = X1*(X2*Z3-X3*Z2)^²

The "mladd-2002-it-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 12M + 8S + 1^³ + 1^⁴ + 3*a + 3*b + 9add + 1*2 + 2*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (9) and (10), plus assumption Z1 = 1.

Explicit formulas:

      X4 = (X2^²-a*Z2^²)^²-8*b*X2*Z2^³
      Z4 = 4*(X2*Z2*(X2^²+a*Z2^²)+b*Z2^⁴)
      R = 2*(X2*Z3+X3*Z2)*(X2*X3+a*Z2*Z3)+4*b*Z2^²*Z3^²
      S = (X2*Z3-X3*Z2)^²
      X5 = R-S*X1
      Z5 = S

The "ladd-2002-it" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 13M + 7S + 1^³ + 1^⁴ + 3*a + 3*b + 8add + 2*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (8) and (10).

Explicit formulas:

      X4 = (X2^²-a*Z2^²)^²-8*b*X2*Z2^³
      Z4 = 4*(X2*Z2*(X2^²+a*Z2^²)+b*Z2^⁴)
      X5 = Z1*((X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2))
      Z5 = X1*(X2*Z3-X3*Z2)^²

The "ladd-2002-it-2" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 14M + 8S + 1^³ + 1^⁴ + 3*a + 3*b + 9add + 1*2 + 2*4 + 1*8.
Source: 2002 Izu–Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", formulas (9) and (10).

Explicit formulas:

      X4 = (X2^²-a*Z2^²)^²-8*b*X2*Z2^³
      Z4 = 4*(X2*Z2*(X2^²+a*Z2^²)+b*Z2^⁴)
      R = 2*(X2*Z3+X3*Z2)*(X2*X3+a*Z2*Z3)+4*b*Z2^²*Z3^²
      S = (X2*Z3-X3*Z2)^²
      X5 = R*Z1-S*X1
      Z5 = S*Z1

The "mladd-2002-bj" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 12M + 6S + 3^³ + 3*a + 3*b + 8add + 2*4 + 1*8.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", formulas (9) and (10).

Explicit formulas:

      X4 = (X2^²-a*Z2^²)^²-8*b*X2*Z2^³
      Z4 = 4*Z2*(X2^³+a*X2*Z2^²+b*Z2^³)
      X5 = (X2*X3-a*Z2*Z3)^²-4*b*Z2*Z3*(X2*Z3+X3*Z2)
      Z5 = X1*(X2*Z3-X3*Z2)^²

XZ coordinates for short Weierstrass curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling