Differential Addition in Generalized Edwards Coordinates

  • Benjamin Justus
  • Daniel Loebenberger
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6434)


We use two parametrizations of points on elliptic curves in generalized Edwards form x 2 + y 2 = c 2 (1 + d x 2 y 2) that omit the x-coordinate. The first parametrization leads to a differential addition formula that can be computed using 6M + 4S, a doubling formula using 1M + 4S and a tripling formula using 4M + 7S. The second one yields a differential addition formula that can be computed using 5M + 2S and a doubling formula using 5S. All formulas apply also for the case c ≠ 1 and arbitrary curve parameter d. This generalizes formulas from the literature for the special case c = 1 or d being a square in the ground field.

For both parametrizations the formula for recovering the missing X-coordinate is also provided.


Elliptic curve Edwards form addition formula differential addition 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bernstein, D.J., Birkner, P., Joye, M., Lange, T., Peters, C.: Twisted Edwards Curves. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 389–405. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  2. 2.
    Bernstein, D.J., Birkner, P., Lange, T., Peters, C.: ECM using Edwards curves (2008)Google Scholar
  3. 3.
    Bernstein, D.J., Lange, T.: Faster addition and doubling on elliptic curves. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 29–50. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  4. 4.
    Bernstein, D.J., Lange, T.: Inverted Edwards coordinates. In: Boztas, S., Lu, H.-F. (eds.) AAECC 2007. LNCS, vol. 4851, pp. 20–27. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  5. 5.
    Brier, É., Joye, M.: Weierstraß elliptic curves and side-channel attacks. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274, pp. 183–194. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  6. 6.
    Castryck, W., Galbraith, S., Farashahi, R.R.: Efficient arithmetic on elliptic curves using a mixed Edwards-Montgomery representation. Cryptology ePrint Archive, Report 2008/218 (2008)Google Scholar
  7. 7.
    Cohen, H., Frey, G.: Handbook of Elliptic and Hyperelliptic Curve Cryptography; written with Roberto M. Avanzi, Christophe Doche, Tanja Lange, Kim Nguyen and Frederik Vercauteren. Discrete Mathematics and its Applications. Chapman & Hall/CRC (2006)Google Scholar
  8. 8.
    Edwards, H.M.: A normal form for elliptic curves. Bulletin of the American Mathematical Society 44(3), 393–422 (July 2007)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Gaudry, P., Lubicz, D.: The arithmetic of characteristic 2 Kummer surfaces and of elliptic Kummer lines. Finite Fields and Their Applications 15(2), 246–260 (2009)MathSciNetCrossRefzbMATHGoogle Scholar
  10. 10.
    Information Technology Laboratory. FIPS 186-3: Digital Signature Standard (DSS). Technical report, National Institute of Standards and Technology (June 2009)Google Scholar
  11. 11.
    Lenstra Jr., H.W.: Factoring integers with elliptic curves. Annals of Mathematics 126, 649–673 (1987)MathSciNetCrossRefzbMATHGoogle Scholar
  12. 12.
    Montgomery, P.L.: Speeding the Pollard and elliptic curve methods of factorization. Mathematics of Computation 48(177), 243–264 (1987)MathSciNetCrossRefzbMATHGoogle Scholar
  13. 13.
    Okeya, K., Sakurai, K.: Efficient elliptic curve cryptosystem from a scalar multiplication algorithm with recovery of the y-coordinate on a Montgomery-form elliptic curve. In: Koç, Ç.K., Naccache, D., Paar, C. (eds.) CHES 2001. LNCS, vol. 2162, pp. 126–141. Springer, Heidelberg (2001)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Benjamin Justus
    • 1
  • Daniel Loebenberger
    • 1
  1. 1.Bonn-Aachen International Center for Information TechnologyUniversität BonnBonnGermany

Personalised recommendations