Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / Affine coordinates with d1=d2 for binary Edwards curves

Affine coordinates with d1=d2 for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:

  d1*(x+y)+d2*(x^²+y^²)=(x+x^²)*(y+y^²)

Affine coordinates with d1=d2 [database entry] make the additional assumptions

  d1=d2

and represent x y as X Y satisfying the following equations:

  x=X
  y=Y

Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:

28M for addition: 2I+8M+2S.
27M for readdition: 2I+7M+2S after 2I+8M+2S.
11M for doubling: 1I+1M+4S.
0M for scaling: 0M.

Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:

28.4M for addition: 2I+8M+2S.
27.4M for readdition: 2I+7M+2S after 2I+8M+2S.
11.8M for doubling: 1I+1M+4S.
0M for scaling: 0M.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition		2I + 8M + 2S + 2d1 + 1d2	2I + 7M + 2S + 2d1 + 1d2
doubling		1I + 1M + 4S + 2*d1
doubling	d2d1=d2/d1	1I + 2M + 4S + 1d2 + 1d2d1
doubling		4I + 4M + 10S + 6^⁴ + 4*d2
scaling		0M

Explicit formulas for addition

The "add-2008-blr" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 2I + 8M + 2S + 2*d1 + 1*d2 + 16add.
Cost: 2I + 7M + 2S + 2*d1 + 1*d2 + 13add dependent upon the first point.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
Strongly unified.

Explicit formulas:

      w1 = X1+Y1
      w2 = X2+Y2
      A = X1^²+X1
      B = Y1^²+Y1
      C = d2*w1*w2
      D = X2*Y2
      X3 = Y1+(C+d1*(w1+X2)+A*(D+X2))/(d1+A*w2)
      Y3 = X1+(C+d1*(w1+Y2)+B*(D+Y2))/(d1+B*w2)

Explicit formulas for doubling

The "dbl-2008-blr+1" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 1M + 4S + 2*d1 + 8add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      A = X1^²
      B = A^²
      C = Y1^²
      D = C^²
      E = A+C
      F = 1/(d1+E+B+D)
      X3 = (d1*E+A+B)*F
      Y3 = X3+1+d1*F

The "dbl-2008-blr+cse" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: d2d1=d2/d1.
Cost: 1I + 2M + 4S + 1*d2 + 1*d2d1 + 10add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      A = X1^²
      B = A^²
      C = Y1^²
      D = C^²
      E = A+C
      F = B+D
      G = 1/(d1+E+d2d1*F)
      X3 = 1+(d1+d2*E+C+D)*G
      Y3 = X3+(E+F)*G

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 4I + 4M + 10S + 6^⁴ + 4*d2 + 18add.
Source: 2008 Bernstein–Lange–Rezaeian Farashahi.

Explicit formulas:

      X3 = 1+(d1+d2*(X1^²+Y1^²)+Y1^²+Y1^⁴)/(d1+X1^²+Y1^²+(d2/d1)*(X1^⁴+Y1^⁴))
      Y3 = 1+(d1+d2*(X1^²+Y1^²)+X1^²+X1^⁴)/(d1+X1^²+Y1^²+(d2/d1)*(X1^⁴+Y1^⁴))

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "copy" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 0add.
Explicit formulas:
```
      X3 = X1
      Y3 = Y1
```