Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Twisted Hessian curves EFD / Genus-1 large-characteristic / Projective coordinates for twisted Hessian curves

Projective coordinates for twisted Hessian curves

An elliptic curve in twisted Hessian form [more information] has parameters a d and coordinates x y satisfying the following equations:

  a*x^³+y^³+1=d*x*y

Projective coordinates [database entry] represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:

11M for addition: 11M.
11M for readdition: 11M after 11M.
8M for doubling: 6M+2S. 7M+1S. 8M.
12M for tripling: 6M+6S. 6M+6S. 8M+4S.

Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:

11M for addition: 11M.
11M for readdition: 11M after 11M.
7.6M for doubling: 6M+2S.
10.8M for tripling: 6M+6S. 6M+6S.

Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

11M for addition: 11M.
11M for readdition: 11M after 11M.
7.34M for doubling: 6M+2S.
10.02M for tripling: 6M+6S. 6M+6S.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition		11M + 1*a	11M + 1*a
addition		12M + 1*a	12M + 1*a
doubling	minustwo=-2	6M + 2S + 1minustwo + 1d
doubling	minustwo=-2	7M + 1S + 1minustwo + 1d
doubling	i^²=-1 and minustwo=-2 and 2d=2*d	8M + 1i + 1minustwo + 1*2d
doubling		6M + 3S + 1*a
doubling		3M + 3^³ + 1*a
tripling	w^²+w+1=0 and fd^³=27a and d*3overd=3	6M + 6S + 4w + 1a + 13overd + 1f
tripling	w^²+w+1=0 and fd^³=27a and d*3overd=3	6M + 6S + 12w + 1a + 13overd + 1f
tripling	2overdd=2 and aoverdddd^³=a	8M + 4S + 1aoverddd + 1a + 1*2overd
tripling	d*recipd=1	8M + 6S + 1a + 1recipd

Explicit formulas for addition

The "add-2010-h" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 11M + 1*a + 16add + 1*2.
Source: 2010 Hisil (thesis).
Strongly unified.

Explicit formulas:

      A = X1*Z2
      B = Z1*Z2
      C = Y1*X2
      D = Y1*Y2
      E = Z1*Y2
      F = a*X1*X2
      G = (D+B)*(A-C)
      H = (D-B)*(A+C)
      J = (D+F)*(A-E)
      K = (D-F)*(A+E)
      X3 = G-H
      Y3 = K-J
      Z3 = J+K-G-H-2*(B-F)*(C+E)

The "add-2009-bkl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 12M + 1*a + 3add.
Source: 2009 Bernstein–Kohel–Lange.
Strongly unified.

Explicit formulas:

      A = X1*Z2
      B = Z1*Z2
      C = Y1*X2
      D = Y1*Y2
      E = Z1*Y2
      F = a*X1*X2
      X3 = A*B-C*D
      Y3 = D*E-F*A
      Z3 = F*C-B*E

Explicit formulas for doubling

The "dbl-2015-bckl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: minustwo=-2.
Cost: 6M + 2S + 1*minustwo + 1*d + 8add + 3*3.
Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange.

Explicit formulas:

      R = Y1+Z1
      S = Y1-Z1
      T = R^²
      U = S^²
      V = T+3*U
      W = 3*T+U
      C = R*V
      D = S*W
      E = 3*C-d*X1*(W-V)
      X3 = minustwo*X1*D
      Y3 = (D+E)*Z1
      Z3 = (D-E)*Y1

The "dbl-2012-c" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: minustwo=-2.
Cost: 7M + 1S + 1*minustwo + 1*d + 7add + 1*2 + 1*3.
Source: 2012 Chuengsatiansup.

Explicit formulas:

      P = Y1*Z1
      2P = 2*P
      S = Y1+Z1
      A = S^²-P
      C = (A-2P)*S
      D = A*(Z1-Y1)
      E = 3*C-d*X1*2P
      X3 = minustwo*X1*D
      Y3 = (D-E)*Z1
      Z3 = (D+E)*Y1

The "dbl-2009-bkl-3" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: i^²=-1 and minustwo=-2 and 2d=2*d.
Cost: 8M + 1*i + 1*minustwo + 1*2d + 9add + 1*3.
Source: 2009 Bernstein–Kohel–Lange.

Explicit formulas:

      iZ = i*Z1
      A = (Y1-iZ)*(Y1+iZ)
      B = Y1*Z1
      C = (A-B)*(Y1+Z1)
      D = (A+B)*(Z1-Y1)
      E = 3*C-2d*X1*B
      X3 = minustwo*X1*D
      Y3 = (D-E)*Z1
      Z3 = (D+E)*Y1

The "dbl-2009-bkl-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 6M + 3S + 1*a + 3add.
Source: 2009 Bernstein–Kohel–Lange.

Explicit formulas:

      A = X1^²
      B = Y1^²
      C = Z1^²
      D = A*X1
      E = B*Y1
      F = C*Z1
      G = a*D
      X3 = X1*(E-F)
      Y3 = Z1*(G-E)
      Z3 = Y1*(F-G)

The "dbl-2009-bkl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 3M + 3^³ + 1*a + 3add.
Source: 2009 Bernstein–Kohel–Lange.

Explicit formulas:

      D = X1^³
      E = Y1^³
      F = Z1^³
      G = a*D
      X3 = X1*(E-F)
      Y3 = Z1*(G-E)
      Z3 = Y1*(F-G)

Explicit formulas for tripling

The "tpl-2015-bckl-2" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: w^²+w+1=0 and f*d^³=27*a and d*3overd=3.
Cost: 6M + 6S + 4*w + 1*a + 1*3overd + 1*f + 15add.
Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange "Twisted Hessian curves".

Explicit formulas:

      R = a*X1*X1^²
      V = Y1*Y1^²
      S = Z1*Z1^²
      wS = w*S
      wV = w*V
      wSV = wS-wV
      F = R+S+V
      G = R+wSV-V
      H = R-S-wSV
      A = F*F^²
      B = A-f*A
      C = G*G^²
      D = H*H^²
      wC = w*C
      wD = w*D
      wCD = wC-wD
      X3 = 3overd*(B+C+D)
      Y3 = B+wCD-D
      Z3 = B-C-wCD

The "tpl-2015-bckl" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: w^²+w+1=0 and f*d^³=27*a and d*3overd=3.
Cost: 6M + 6S + 12*w + 1*a + 1*3overd + 1*f + 13add.
Source: 2015 Bernstein–Chuengsatiansup–Kohel–Lange "Twisted Hessian curves".

Explicit formulas:

      R = a*X1*X1^²
      V = Y1*Y1^²
      S = Z1*Z1^²
      F = R+S+V
      G = R+w*S+w*w*V
      H = R+w*w*S+w*V
      A = F*F^²
      B = A-f*A
      C = G*G^²
      D = H*H^²
      X3 = 3overd*(B+C+D)
      Y3 = B+w*C+w*w*D
      Z3 = B+w*w*C+w*D

The "tpl-2015-k" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: 2overd*d=2 and aoverddd*d^³=a.
Cost: 8M + 4S + 1*aoverddd + 1*a + 1*2overd + 13add + 1*3 + 1*8.
Source: 2015 Kohel "The geometry of efficient arithmetic on elliptic curves".

Explicit formulas:

      R = a*X1*X1^²
      V = Y1*Y1^²
      S = Z1*Z1^²
      T = R+S
      N = T*(S+V)*(V+R)
      M = (R-S)*(S-V)*(V-R)
      C = (T+V)*(T+V)^²
      D = aoverddd*C
      E = N-8*D
      X3 = 2overd*(C-3*(D+N))
      Y3 = E+M
      Z3 = E-M

The "tpl-2009-bkl" tripling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d*recipd=1.
Cost: 8M + 6S + 1*a + 1*recipd + 12add + 2*2.
Source: 2009 Bernstein–Kohel–Lange.

Explicit formulas:

      U = a*X1*X1^²
      V = Y1*Y1^²
      W = Z1*Z1^²
      A = (U-V)^²
      B = (U-W)^²
      C = (V-W)^²
      D = A+C
      E = A+B
      X3 = recipd*(U+V+W)*(B+D)
      Y3 = 2*U*C-V*(C-E)
      Z3 = 2*V*B-U*(B-D)

Projective coordinates for twisted Hessian curves

Best operation counts

Summary of all explicit formulas

Explicit formulas for addition

Explicit formulas for doubling

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling