source 2003 Stam "On Montgomery-like representations for elliptic curves over GF(2^k)", Section 3.2, plus a1 = 1, plus b8 = a6, plus a6 = sqrta6^2, plus common-subexpression elimination, plus Z1 = 1 assume Z1 = 1 parameter sqrta6 assume sqrta6^2 = a6 compute A = X2 X3 compute B = Z2 Z3 compute XX2 = X2^2 compute ZZ2 = Z2^2 compute X4 = (XX2 + sqrta6 ZZ2)^2 compute Z4 = XX2 ZZ2 compute X5 = (A + sqrta6 B)^2 compute Z5 = X1((X2+Z2)(X3+Z3)-A-B)^2