Skip to main content

Two is the fastest prime: lambda coordinates for binary elliptic curves


In this work, we present new arithmetic formulas for a projective version of the affine point representation \((x,x+y/x),\) for \(x\ne 0,\) which leads to an efficient computation of the scalar multiplication operation over binary elliptic curves. A software implementation of our formulas applied to a binary Galbraith–Lin–Scott elliptic curve defined over the field \(\mathbb {F}_{2^{254}}\) allows us to achieve speed records for protected/unprotected single/multi-core random-point elliptic curve scalar multiplication at the 127-bit security level. When executed on a Sandy Bridge 3.4 GHz Intel Xeon processor, our software is able to compute a single/multi-core unprotected scalar multiplication in 69,500 and 47,900 clock cycles, respectively, and a protected single-core scalar multiplication in 114,800 cycles. These numbers are improved by around 2 and 46 % on the newer Ivy Bridge and Haswell platforms, respectively, achieving in the latter a protected random-point scalar multiplication in 60,000 clock cycles.

This is a preview of subscription content, access via your institution.


  1. The benchmarking was run on Intel platforms Xeon E31270 3.4 GHz (Sandy Bridge), Core i5 3570 3.4 GHz (Ivy Bridge), and Core i7 4770K (Haswell). In addition, our library was submitted to the ECRYPT Benchmarking of Asymmetric Systems (eBATS) where it is publicly available.

  2. See Sect. 2.5 for a definition of the trace function \(\mathrm{Tr}(c).\)

  3. Notice that the atomic doubling and addition operation are exclusive of the \(\lambda \)-projective coordinate system. For the sake of a fair comparison, in the second row and fifth column of Table 3, the cost of performing a non-atomic point doubling plus a mixed point addition using LD coordinates is reported.

  4. We stress that \(k\) can be recovered at a very low computational effort. From our experiments, the scalar \(k\) could be reconstructed with cost lower than \(5\tilde{m}\).

  5. For \(w = 4\), the method is described as follows. \(Q_5 = Q_5 + Q_7\), \(Q_3 = Q_3 + Q_5\), \(Q_1 = Q_1 + Q_3\), \(Q_7 = Q_7 + Q_5 + Q_3\), \(Q = 2Q_7 + Q_1\), which requires six point additions and one point doubling.

  6. The pseudo-instruction Barrier refers to an OpenMP synchronization clause that forces each thread to wait until all the other threads have completed their assigned tasks.


  1. Agnew, G.B., Mullin, R.C., Vanstone, S.A.: An implementation of elliptic curve cryptosystems over \(F_{2^{155}}\). IEEE J. Sel. Areas Commun. 11(5), 804–813 (1993)

    Article  Google Scholar 

  2. Ahmadi, O., Hankerson, D., Rodríguez-Henríquez, F.: Parallel formulations of scalar multiplication on Koblitz curves. J. UCS 14(3), 481–504 (2008)

    MATH  MathSciNet  Google Scholar 

  3. Al-Daoud, E., Mahmod, R., Rushdan, M., Kilicman, A.: A new addition formula for elliptic curves over \(GF(2^n)\). IEEE Trans. Comput. 51(8), 972–975 (2002)

    Article  MathSciNet  Google Scholar 

  4. Aranha, D.F., Faz-Hernández, A., López, J., Rodríguez-Henríquez, F.: Faster implementation of scalar multiplication on Koblitz curves. In: Hevia, A., Neven, G. (eds.) LATINCRYPT 2012, LNCS, vol. 7533, pp. 177–193. Springer, New York (2012)

    Chapter  Google Scholar 

  5. Aranha, D.F., López, J., Hankerson, D.: Efficient software implementation of binary field arithmetic using vector instruction sets. In: Abdalla, M., Barreto, P.S.L.M. (eds.) LATINCRYPT 2010, LNCS, vol. 6212, pp. 144–161. Springer, New York (2010)

    Chapter  Google Scholar 

  6. Avanzi, R.M., Ciet, M., Sica, F.: Faster scalar multiplication on Koblitz curves combining point halving with the Frobenius endomorphism. In: Bao, F., Deng, R.H., Zhou, J. (eds.) PKC 2004, LNCS, vol. 2947, pp. 28–40. Springer, New York (2004)

    Google Scholar 

  7. Bernstein, D.J.: Curve25519: new Diffie–Hellman speed records. In: Yung, M., Dodis, Y., Kiayias, A., Malkin, T. (eds.) PKC 2006, LNCS, vol. 3958, pp. 207–228. Springer, New York (2006)

    Google Scholar 

  8. Bernstein, D.J., Lange, T. (eds.): eBACS: ECRYPT Benchmarking of Cryptographic Systems. Accessed 6 June 2013

  9. Bernstein, D.J., Lange, T., Farashahi, R.: Binary Edwards curves. In: Oswald, E., Rohatgi, P. (eds.) CHES 2008, LNCS, vol. 5154, pp. 244–265. Springer, New York (2008)

    Google Scholar 

  10. Bos, J.W., Kleinjung, T., Niederhagen, R., Schwabe, P.: ECC2K-130 on cell CPUs. In: Bernstein, D.J., Lange, T. (eds.) AFRICACRYPT 2010, LNCS, vol. 6055, pp. 225–242. Springer, New York (2010)

    Chapter  Google Scholar 

  11. Bos, J.W., Costello, C., Hisil, H., Lauter, K.: Fast cryptography in genus 2. In: Johansson, T., Nguyen, P.Q. (eds.) EUROCRYPT 2013, LNCS, vol. 7881, pp. 194–210. Springer, New York (2013)

    Chapter  Google Scholar 

  12. Chatterjee, S., Karabina, K., Menezes, A.: A new protocol for the nearby friend problem. In: Parker, M.G. (ed.) IMACC 2009, LNCS, vol. 5921, pp. 236–251. Springer, New York (2009)

    Google Scholar 

  13. Chudnovsky, D.V., Chudnovsky, G.V.: Sequences of numbers generated by addition in formal groups and new primality and factorization tests. Adv. Appl. Math. 7(4), 385–434 (1986)

    Article  MATH  MathSciNet  Google Scholar 

  14. Fog, A.: Instruction tables: list of instruction latencies, throughputs and micro-operation breakdowns for Intel, AMD and VIA CPUs. Accessed 18 Dec 2013

  15. Faz-Hernández, A., Longa, P., Sanchez, A.H.: Efficient and secure algorithms for GLV-based scalar multiplication and their implementation on GLV–GLS curves, In: Benaloh, J. (ed.) CT-RSA 2014. To appear (2014)

  16. Firasta, M., Buxton, M., Jinbo, P., Nasri, K., Kuo, S.: Intel AVX: New Frontiers in Performance Improvements and Energy Efficiency. White paper, Intel Corporation. (2008)

  17. Fong, K., Hankerson, D., López, J., Menezes, A.: Field inversion and point halving revisited. IEEE Trans. Comput. 53(8), 1047–1059 (2004)

    Article  Google Scholar 

  18. Galbraith, S., Lin, X., Scott, M.: Endomorphisms for faster elliptic curve cryptography on a large class of curves. J. Cryptol. 24, 446–469 (2011)

    Article  MATH  MathSciNet  Google Scholar 

  19. Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster point multiplication on elliptic curves with efficient endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001, LNCS, vol. 2139, pp. 190–200. Springer, New York (2001)

    Chapter  Google Scholar 

  20. Gaudry, P., Hess, F., Smart, N.P.: Constructive and destructive facets of Weil descent on elliptic curves. J. Cryptol. 15, 19–46 (2002)

    Article  MathSciNet  Google Scholar 

  21. Hamburg, M.: Fast and Compact Elliptic-Curve Cryptography. Cryptology ePrint Archive, Report 2012/309. (2012)

  22. Hankerson, D., Karabina, K., Menezes, A.: Analyzing the Galbraith–Lin–Scott point multiplication method for elliptic curves over binary fields. IEEE Trans. Comput. 58(10), 1411–1420 (2009)

    Article  MathSciNet  Google Scholar 

  23. Hankerson, D., Menezes, A., Vanstone, S.: Guide to Elliptic Curve Cryptography. Springer, New York (2003)

    Google Scholar 

  24. Hankerson, D., Hernandez, J., Menezes, A.: Software implementation of elliptic curve cryptography over binary fields. In: Koç, Ç.K., Paar, C. (eds.) CHES 2000, LNCS, vol. 1965, pp. 1–24. Springer, New York (2000)

    Google Scholar 

  25. Hess, F.: Generalising the GHS attack on the elliptic curve discrete logarithm problem. LMS J. Comput. Math. 7, 167–192 (2004)

    Article  MATH  MathSciNet  Google Scholar 

  26. Intel Corporation: Intel Architecture Instruction Set Extensions Programming Reference, Reference Number: 319433-014. (2012)

  27. Itoh, T., Tsujii, S.: A fast algorithm for computing multiplicative inverses in GF(\(2^m\)) using normal bases. Inf. Comput. 78(3), 171–177 (1988)

    Article  MATH  MathSciNet  Google Scholar 

  28. Joye, M., Tunstall, M.: Exponent recoding and regular exponentiation algorithms. In: Preneel, B. (ed.) AFRICACRYPT 2009, LNCS, vol. 5580, pp. 334–349. Springer, New York (2009)

    Chapter  Google Scholar 

  29. Kim, D., Lim, S.: Integer decomposition for fast scalar multiplication on elliptic curves. In: Nyberg, K., Heys, H. (eds.) SAC 2003, LNCS, vol. 2595, pp. 13–20. Springer, New York (2003)

    Google Scholar 

  30. Kim, K.H., Kim, S.I.: A New Method for Speeding Up Arithmetic on Elliptic Curves over Binary Fields. Cryptology ePrint Archive, Report 2007/181. (2007)

  31. King, B.: An improved implementation of elliptic curves over \(GF(2^n)\) when using projective point arithmetic. In: Vaudenay, S., Youssef, A. (eds.) SAC 2001, LNCS, vol. 2259, pp. 134–150. Springer, New York (2001)

  32. Knudsen, E.: Elliptic scalar multiplication using point halving. In: Lam, K.Y., Okamoto, E., Xing, C. (eds.) ASIACRYPT99, LNCS, vol. 1716, pp. 135–149. Springer, New York (1999)

  33. Knuth, D.E.: The Art of Computer Programming: Seminumerical Algorithms, vol. 2. Addison-Wesley, Boston (1997)

  34. Lange, T.: A Note on López–Dahab Coordinates. Cryptology ePrint Archive, Report 2004/323. (2006)

  35. Lim, C.H., Hwang, H.S.: Speeding up elliptic scalar multiplication with precomputation. In: Song, J. (ed.) ICISC 1999, LNCS, vol. 1787, pp. 102–119. Springer, New York (2000)

    Google Scholar 

  36. Longa, P., Sica, F.: Four-dimensional Gallant–Lambert–Vanstone scalar multiplication. In: Wang, X., Sako, K. (eds.) ASIACRYPT 2012, LNCS, vol. 7658, pp. 718–739. Springer, New York (2012)

    Chapter  Google Scholar 

  37. Longa, P., Sica, F.: Four-dimensional Gallant–Lambert–Vanstone scalar multiplication. J. Cryptol. (2014)

  38. López, J., Dahab, R.: Improved algorithms for elliptic curve arithmetic in GF(\(2^n\)). In: Tavares, S.E., Meijer, H. (eds.) SAC 1998, LNCS, vol. 1556, pp. 201–212. Springer, New York (1998)

    Google Scholar 

  39. López, J., Dahab, R.: An Overview of Elliptic Curve Cryptography. Tech. Rep. IC-00-10, Institute of computing, University of Campinas. (2000)

  40. López, J., Dahab, R.: New point compression algorithms for binary curves. In: IEEE Information Theory Workshop (ITW 2006), pp. 126–130. IEEE Press, New York (2006)

  41. Park, Y.H., Jeong, S., Kim, C., Lim, J.: An alternate decomposition of an integer for faster point multiplication on certain elliptic curves. In: Naccache, D., Paillier, P. (eds.) PKC 2002, LNCS, vol. 2274, pp. 323–334. Springer, New York (2002)

    Google Scholar 

  42. Rodríguez-Henríquez, F., Morales-Luna, G., López, J.: Low-complexity bit-parallel square root computation over GF(\(2^{m}\)) for all trinomials. IEEE Trans. Comput. 57(4), 472–480 (2008)

    Article  MathSciNet  Google Scholar 

  43. Schroeppel, R.: Cryptographic elliptic curve apparatus and method. US Patent 2002/6490352 B1, 2000

  44. Schroeppel, R.: Elliptic curve point halving wins big. In: Proceedings of 2nd Midwest Arithmetical Geometry in Cryptography Workshop (2000)

  45. Schroeppel, R.: Automatically solving equations in finite fields. US Patent 2002/0055962 A1, 2002

  46. Taverne, J., Faz-Hernández, A., Aranha, D.F., Rodríguez-Henríquez, F., Hankerson, D., López, J.: Speeding scalar multiplication over binary elliptic curves using the new carry-less multiplication instruction. J. Cryptogr. Eng. 1, 187–199 (2011)

    Article  Google Scholar 

Download references


We wish to thank Sanjit Chatterjee, Patrick Longa and Alfred Menezes for their useful discussions.

Author information

Authors and Affiliations


Corresponding author

Correspondence to Diego F. Aranha.

Additional information

T. Oliveira and F. Rodríguez-Henríquez: A portion of this work was performed while the authors were visiting the University of Waterloo. The authors acknowledge partial support from the CONACyT project 132073. J. López: The author was supported in part by the Intel Labs University Research Office.


Appendix A: Proofs

Proof of Theorem 1

Let \(P=(x_{P}, \lambda _{P})\) be an elliptic point in \(E_{a,b}(\mathbb {F}_{2^m})\). Then, a formula for \(2P = (x_{2P}, \lambda _{2P})\) is given by

$$\begin{aligned} x_{2P}&= \lambda ^2_{P} + \lambda _{P} + a\\ \lambda _{2P}&= \frac{x^2_{P}}{x_{2P}} + \lambda ^2_{P} + a + 1. \end{aligned}$$

From [23], page 81, we have the formulas: \(x_{2P} = \lambda ^2_{P} + \lambda _{P} + a\) and \(y_{2P} = x^2_{P} + \lambda _{P}x_{2P} + x_{2P}\). Then, a formula for \(\lambda _{2P}\) can be obtained as follows:

$$\begin{aligned} \lambda _{2P}&= \frac{y_{2P} + x^2_{2P}}{x_{2P}} = \frac{\left( x^2_{P} + \lambda _{P} \cdot x_{2P} + x_{2P}\right) + x^2_{2P}}{x_{2P}}\\&= \frac{x^2_{P}}{x_{2P}} + \lambda _{P} + 1 + x_{2P} = \frac{x^2_{P}}{x_{2P}} + \lambda _{P} + 1\\&+ \left( \lambda ^2_{P} + \lambda _{P} + a\right) \\&= \frac{x^2_{P}}{x_{2P}} + \lambda ^2_{P} + a + 1. \end{aligned}$$

In affine coordinates, the doubling formula requires one division and two squarings. Given the point \(P = (X_{P}, L_{P}, Z_{P})\) in the \(\lambda \)-projective representation, an efficient projective doubling algorithm can be derived by applying the doubling formula to the affine point \((\frac{X_P}{Z_P},\frac{L_P}{Z_P})\). For \(x_{2P}\) we have

$$\begin{aligned} x_{2P}&= \frac{L^2_{P}}{Z^2_{P}} + \frac{L_{P}}{Z_{P}} + a = \frac{L^2_{P} + L_{P} \cdot Z_{P} + a \cdot Z^2_{P}}{Z^2_{P}}\\&= \frac{T}{Z^2_{P}} = \frac{T^2}{T \cdot Z^2_{P}}. \end{aligned}$$

For \(\lambda _{2P}\), we have

$$\begin{aligned} \lambda _{2P}&= \frac{\frac{X^2_{P}}{Z^2_{P}}}{\frac{T}{Z^2_{P}}} + \frac{L^2_{P}}{Z^2_{P}} + a + 1\\&= \frac{X^2_{P} \cdot Z^2_{P} + T \cdot \left( L^2_{P} + (a + 1) \cdot Z^2_{P}\right) }{T \cdot Z^2_{P}}. \end{aligned}$$

From the \(\lambda \)-projective equation, we have the relation \(T \cdot X^2_{P} = X^4_{P} + b \cdot Z^4_{P}\). Then, the numerator \(w\) of \(\lambda _{2P}\) can also be written as follows,

$$\begin{aligned} w&= X^2_{P} \cdot Z^2_{P} + T \cdot \left( L^2_{P} + (a + 1) \cdot Z^2_{P}\right) \\&= X^2_{P} \cdot Z^2_{P} + T \cdot L^2_{P} + T^2 + T^2 + (a + 1) \cdot Z_{2P}\\&= X^2_{P} \cdot Z^2_{P} + T \cdot L^2_{P} + L^4_{P} + L^2_{P} \cdot Z^2_{P} + a^2 \cdot Z^4_{P} + T^2\\&\quad \,\,+ (a + 1) \cdot Z_{2P}\\&= X^2_{P} \cdot Z^2_{P} + T \cdot \left( L^2_{P} + X^2_{P}\right) + X^4_{P} + b \cdot Z^4_{P} + L^4_{P}\\&\quad \,\,+ L^2_{P} \cdot Z^2_{P} + a^2 \cdot Z^4_{P} + T^2 + (a + 1) \cdot Z_{2P}\\&= \left( L^2_{P} + X^2_{P}\right) \cdot \left( \left( L^2_{P} + X^2_{P}\right) + T + Z^2_{P}\right) + T^2\\&\quad \,\,+ (a^2 + b) \cdot Z^4_{P} + (a + 1) \cdot Z_{2P}. \end{aligned}$$

This completes the proof. \(\square \)

Proof of Theorem 2

Let \(P=(x_{P}, \lambda _{P})\) and \(Q=(x_{Q}, \lambda _{Q})\) be elliptic points in \(E_{a,b}(\mathbb {F}_{2^m})\). Then, a formula for \(P+Q = (x_{P+Q}, \lambda _{P+Q})\) is given by

$$\begin{aligned} x_{P+Q}&= \frac{x_{P} \cdot x_{Q}}{(x_{P} + x_{Q})^2}(\lambda _{P} + \lambda _{Q})\\ \lambda _{P+Q}&= \frac{x_{Q} \cdot (x_{P+Q} + x_{P})^2}{x_{P+Q} \cdot x_{P}} + \lambda _{P} + 1. \end{aligned}$$

Since \(P\) and \(Q\) are elliptic points on a non-supersingular curve, we have the following relation: \(y^2_{P} + x_{P} \cdot y_{P} + x^3_{P} + a \cdot x^2_{P} = b = y^2_{Q} + x_{Q} \cdot y_{Q} + x^3_{Q} + a \cdot x^2_{Q}\). The known formula for computing the \(x\)-coordinate of \(P + Q\) is given by \(x_{P+Q} = s^2 + s + x_{P} + x_{Q} + a\), where \(s = \frac{y_{P} + y_{Q}}{x_{P} + x_{Q}}\). Then, one can derive the new formula as follows,

$$\begin{aligned} x_{P+Q}&= \frac{(y_{P} + y_{Q})^2 + (y_{P} + y_{Q}) \cdot (x_{P} + y_{Q})}{(x_{P} + x_{Q})^2}\\&\quad + \frac{(x_{P} + x_{Q})^3 + a \cdot (x_{P} + x_{Q})^2}{(x_{P} + x_{Q})^2}\\&= \frac{b + b + x_{Q} \cdot \left( x^2_{P} + y_{P}\right) + x_{P} \cdot \left( x^2_{Q} + y_{Q}\right) }{(x_{P} + x_{Q})^2}\\&= \frac{x_{P} \cdot x_{Q} \cdot (\lambda _{P} + \lambda _{Q})}{(x_{P} + x_{Q})^2}. \end{aligned}$$

For computing \(\lambda _{P+Q}\), we use the observation that the \(x\)-coordinate of \((P + Q) - P\) is \(x_{Q}\). We also know that for \(-P\) we have \(\lambda _{-P} = \lambda _{P} + 1\) and \(x_{-P} = x_{P}\). By applying the formula for the \(x\)-coordinate of \((P + Q) + (-P)\) we have

$$\begin{aligned} x_{Q}&= x_{(P+Q)+(-P)} = \frac{x_{P+Q} \cdot x_{-P}}{(x_{P+Q} + x_{-P})^2} \cdot (\lambda _{P+Q} + \lambda _{-P})\\&= \frac{x_{P+Q} \cdot x_{P}}{(x_{P+Q} + x_{P})^2} \cdot (\lambda _{P+Q} + \lambda _{P} + 1). \end{aligned}$$

Then \(\lambda _{P+Q} = \frac{x_{Q} \cdot (x_{P+Q} + x_{P})^2}{x_{P+Q} \cdot x_{P}} + \lambda _{P} + 1\).

To obtain a \(\lambda \)-projective addition formula, we apply the formulas above to the affine points \((\frac{X_{P}}{Z_{P}}, \frac{L_{P}}{Z_{P}})\) and \((\frac{X_{Q}}{Z_{Q}}, \frac{L_{Q}}{Z_{Q}})\). Then, the \(x_{P+Q}\) coordinate of \(P + Q\) can be computed as:

$$\begin{aligned} x_{P+Q}&= \frac{\frac{X_{P}}{Z_{P}} \cdot \frac{X_{Q}}{Z_{Q}} \cdot \left( \frac{L_{P}}{Z_{P}} + \frac{L_{Q}}{Z_{Q}}\right) }{\left( \frac{X_{P}}{Z_{P}} + \frac{X_{Q}}{Z_{Q}}\right) ^2}\\&= \frac{X_{P} \cdot X_{Q} \cdot (L_{P} \cdot Z_{Q} + L_{Q} \cdot Z_{P})}{(X_{P} \cdot Z_{Q} + X_{Q} \cdot Z_{P})^2} = X_{P} \cdot X_{Q} \cdot \frac{A}{B}. \end{aligned}$$

For the \(\lambda _{P+Q}\) coordinate of \(P + Q\), we have

$$\begin{aligned} \lambda _{P+Q}&= \frac{\frac{X_{Q}}{Z_{Q}} \cdot \left( \frac{X_{P} \cdot X_{Q} \cdot A}{B} + \frac{X_{P}}{Z_{P}}\right) ^2}{\frac{X_{P} \cdot X_{Q} \cdot A}{B} \cdot \frac{X_{P}}{Z_{P}}} + \frac{L_{P} + Z_{P}}{Z_{P}}\\&= \frac{(A \cdot X_{Q} \cdot Z_{P} + B)^2 + (A \cdot B \cdot Z_{Q})(L_{P} + Z_{P})}{A \cdot B \cdot Z_{P} \cdot Z_{Q}}. \end{aligned}$$

In order that both \(x_{P+Q}\) and \(\lambda _{P+Q}\) have the same denominator, the formula for \(x_{P+Q}\) can be written as

$$\begin{aligned} X_{P+Q} = \frac{X_{P} \cdot X_{Q} \cdot A}{B} = \frac{A \cdot (X_{P} \cdot Z_{Q}) \cdot (X_{Q} \cdot Z_{P}) \cdot A}{A \cdot B \cdot Z_{P} \cdot Z_{Q}}. \end{aligned}$$

Therefore, \(x_{P+Q} = \frac{X_{P+Q}}{Z_{P+Q}}\) and \(\lambda _{P+Q} = \frac{L_{P+Q}}{Z_{P+Q}}\). This completes the proof. \(\square \)

Proof of Theorem 3

The \(\lambda \)-projective formula is obtained by adding the \(\lambda \)-affine points \(2Q = (\frac{X_{2Q}}{Z_{2Q}}, \frac{L_{2Q}}{Z_{2Q}})\) and \(P = (x_{P}, \lambda _{P})\) with the formula of Theorem 2. Then, the \(x\) coordinate of \(2Q + P\) is given by

$$\begin{aligned} x_{2Q+P}&= \frac{x_{2Q} \cdot x_{P}}{(x_{2Q} + x_{P})^2}(\lambda _{2Q} + \lambda _{P})\\&= \frac{X_{2Q} \cdot x_{P}(L_{2Q} + \lambda _{P} \cdot Z_{2Q})}{(X_{2Q} + x_{P} \cdot Z_{2Q})^2}\\&= \frac{x_{P} \cdot \left( X^2_{Q} \cdot Z^2_{Q} {+} T \cdot \left( L^2_{Q} {+} (a {+} 1 {+} \lambda _{P}) \cdot Z^2_{Q}\right) \right) }{\left( T {+} x_{P} \cdot Z^2_{Q}\right) ^2}\\&= x_{P} \cdot \frac{A}{B}. \end{aligned}$$

The \(\lambda _{2Q+P}\) coordinate of \(2Q + P\) is computed as

$$\begin{aligned} \lambda _{2Q+P}&= \frac{\frac{X_{2Q}}{Z_{2Q}} \cdot \left( x_{P} \cdot \frac{A}{B} + x_{P}\right) ^2}{x_{P} \cdot \frac{A}{B} \cdot x_{P}} + \lambda _{P} + 1\\&= \frac{T \cdot (A + B)^2 + (\lambda _{P} + 1) \cdot (A \cdot B \cdot Z^2_{Q})}{A \cdot B \cdot Z^2_{Q}}. \end{aligned}$$

The formula for \(x_{2Q+P}\) can be written with denominator \(Z_{2Q+P}\) as follows:

$$\begin{aligned} x_{2Q+P} = \frac{x_{P} \cdot A}{B} = \frac{x_{P} \cdot Z^2_{Q} \cdot A^2}{A \cdot B \cdot Z^2_{Q}}. \end{aligned}$$

Therefore, \(x_{2Q+P} = \frac{X_{2Q+P}}{Z_{2Q+P}}\) and \(\lambda _{2Q+P} = \frac{L_{2Q+P}}{Z_{2Q+P}}\). This completes the proof. \(\square \)

Appendix B: Operation count for 2-GLV double-and-add using \(\lambda \)-coordinates

Basically, three cases can occur in the 2-GLV double-and-add main loop. The first one, when the digits of both scalars \(k_1, k_2\) equal zero, we just perform a point doubling (\(D\)) in the accumulator. The second one, when both scalar digits are different from zero, we have to double the accumulator and sum two points. In this case, we perform one doubling and addition (\(DA\)) followed by a mixed addition (\(A\)). Finally, it is possible that just one scalar has its digit different from zero. Here, we double the accumulator and add a point, which can be done with only one doubling and addition operation.

Then, as the nonzero bit distributions in the scalars represented by the \(w\)-NAF are independent, we have for the first case

$$\begin{aligned} \mathrm{Pr}[k_{1,i} = 0 \wedge k_{2,i} = 0] = \frac{w^2}{(w + 1)^2},\quad \text {for }i \in [0, n-1]. \end{aligned}$$

For the second case

$$\begin{aligned} \mathrm{Pr[}k_{1,i} \ne 0 \wedge k_{2,i} \ne 0] = \frac{1}{(w + 1)^2},\quad \text {for }i \in [0, n-1]. \end{aligned}$$

And for the third case

$$\begin{aligned} \mathrm{Pr}[(k_{1,i} \,{\ne }\, 0 \wedge k_{2,i} \,{=}\, 0) \vee (k_{1,i} \,{=}\, 0 \wedge k_{2,i} \ne 0)] \,{=}\, \frac{2w}{(w {+} 1)^2}. \end{aligned}$$

Consequently, the operation count can be written as

$$\begin{aligned}&\frac{n}{2}\left( \frac{w^2}{(w + 1)^2}D + \frac{1}{(w + 1)^2}(\textit{DA} + A) + \frac{2w}{(w + 1)^2}\textit{DA}\right) \\&\quad = \frac{(2w + 1)n}{2(w+1)^2}\textit{DA} + \frac{w^2n}{2(w+1)^2}D + \frac{n}{2(w+1)^2}A. \end{aligned}$$

Appendix C: Parameters used for the Galbraith–Lin–Scott elliptic curve

Using the notation given in Sect. 4, let \(q=2^m,\) with \(m=127.\) The towering of the fields \(\mathbb {F}_{q}\) and its quadratic extension \(\mathbb {F}_{q^{2}}\cong \mathbb {F}_{q}[u]/(g(u))\) are constructed by means of the irreducible trinomials \(f(x) = x^{127} + x^{63} + 1\) and \(g(u) = u^2 + u +1\), respectively. Let \(E/\mathbb {F}_{q} : y^2 + xy = x^3 + ax^2 + b\), with \(a, b \in \mathbb {F}_{q}\), be a binary elliptic curve and define the quadratic twist of \(E\) as the Galbraith–Lin–Scott elliptic curve

$$\begin{aligned} \tilde{E}/\mathbb {F}_{q^{2}} : y^2 + xy = x^3 +a'x^2 + b, \end{aligned}$$

with \(a' \in \mathbb {F}_{q^{2}}\) such that \(\mathrm{Tr}(a') = 1\). Given \(\#E(\mathbb {F}_q)=q+1-t,\) it follows that \(\#\tilde{E}_{a', b}(\mathbb {F}_{q^2}) = (q-1)^2+t^2=h\cdot r,\) where \(t\) is the trace of Frobenius of the curve \(E\), \(h=2\) and \(r\) is \(253\)-bit prime number.

In this work, the binary GLS elliptic curve \(\tilde{E}_{a',b}(\mathbb {F}_{q^2})\) was defined with the following parameters

  • \(a' = u\)

  • \(b\in \mathbb {F}_q\) is a degree \(126\) binary polynomial that can be represented in hexadecimal format as, \(b = 0x59C8202CB9E6E0AE2E6D944FA54DE7E5\)

  • The \(253\)-bit prime order \(r\) of the main subgroup of \(\tilde{E}_{a',b}(\mathbb {F}_{q^2})\) is

    $$\begin{aligned} r&= 0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFF\\&FFDAC40D1195270779877DABA2A44750A5; \end{aligned}$$
  • The base point \(P=(x_p, \lambda _p)\) of order \(r\) specified in \(\lambda \)-affine coordinates is,

    $$\begin{aligned} x_p&= 0x203B6A93395E0432344038B63FBA32DE\\&\quad + 0x78E51FD0C310696D5396E0681AA10E0D\cdot u\\ \lambda _p&= 0x5BD7653482085F55DEB59C6137074B50\\&\quad + 0x7F90D98B1589A17F24568FA5A1033946\cdot u. \end{aligned}$$

Rights and permissions

Reprints and Permissions

About this article

Cite this article

Oliveira, T., López, J., Aranha, D.F. et al. Two is the fastest prime: lambda coordinates for binary elliptic curves. J Cryptogr Eng 4, 3–17 (2014).

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI:


  • Elliptic curve cryptography
  • Finite field arithmetic
  • Coordinate system
  • Explicit formulas
  • Efficient software implementation