Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Short Weierstrass curves EFD / Genus-1 large-characteristic / Projective coordinates with a4=-3 for short Weierstrass curves

Projective coordinates with a4=-3 for short Weierstrass curves

An elliptic curve in short Weierstrass form [more information] has parameters a b and coordinates x y satisfying the following equations:

  y^2=x^3+a*x+b

Projective coordinates with a4=-3 [database entry] make the additional assumptions

  a=-3

and represent x y as X Y Z satisfying the following equations:

  x=X/Z
  y=Y/Z

Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:

14M for addition: 12M+2S.
11M for addition with Z2=1: 9M+2S.
7M for addition with Z1=1 and Z2=1: 5M+2S.
14M for readdition: 12M+2S after 12M+2S.
11M for readdition with Z2=1: 9M+2S after 9M+2S.
7M for readdition with Z1=1 and Z2=1: 5M+2S after 5M+2S.
10M for doubling: 7M+3S.
8M for doubling with Z1=1: 3M+5S.
102M for scaling: 1I+2M.

Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:

13.6M for addition: 12M+2S.
10.6M for addition with Z2=1: 9M+2S.
6.6M for addition with Z1=1 and Z2=1: 5M+2S.
13.6M for readdition: 12M+2S after 12M+2S.
10.6M for readdition with Z2=1: 9M+2S after 9M+2S.
6.6M for readdition with Z1=1 and Z2=1: 5M+2S after 5M+2S.
9.4M for doubling: 7M+3S.
7M for doubling with Z1=1: 3M+5S.
102M for scaling: 1I+2M.

Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

13.34M for addition: 12M+2S.
10.34M for addition with Z2=1: 9M+2S.
6.34M for addition with Z1=1 and Z2=1: 5M+2S.
13.34M for readdition: 12M+2S after 12M+2S.
10.34M for readdition with Z2=1: 9M+2S after 9M+2S.
6.34M for readdition with Z1=1 and Z2=1: 5M+2S after 5M+2S.
9.01M for doubling: 7M+3S.
6.35M for doubling with Z1=1: 3M+5S.
102M for scaling: 1I+2M.

Summary of all explicit formulas

Operation	Assumptions	Cost	Readdition cost
addition	Z1=1 and Z2=1	5M + 2S	5M + 2S
addition	Z2=1	9M + 2S	9M + 2S
addition		12M + 2S	12M + 2S
addition		11M + 6S + 1*a	11M + 6S + 1*a
addition		12M + 5S + 1*a	12M + 5S + 1*a
addition		10M + 4S + 1^3	10M + 4S + 1^3
addition		16M + 3S + 3^3	16M + 3S + 3^3
doubling	Z1=1	3M + 5S
doubling		7M + 3S
doubling		5M + 6S + 1*a
doubling		6M + 5S + 1*a
doubling		6M + 5S + 1^3 + 1*a
scaling		1I + 2M

Explicit formulas for addition

The "mmadd-1998-cmo" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1 and Z2=1.
Cost: 5M + 2S + 6add + 1*2.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", plus Z1=1, plus Z2=1, plus common-subexpression elimination.

Explicit formulas:

      u = Y2-Y1
      uu = u^2
      v = X2-X1
      vv = v^2
      vvv = v*vv
      R = vv*X1
      A = uu-vvv-2*R
      X3 = v*A
      Y3 = u*(R-A)-vvv*Y1
      Z3 = vvv

The "madd-1998-cmo" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z2=1.
Cost: 9M + 2S + 6add + 1*2.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", formula (3), plus common-subexpression elimination, plus Z2=1.

Explicit formulas:

      u = Y2*Z1-Y1
      uu = u^2
      v = X2*Z1-X1
      vv = v^2
      vvv = v*vv
      R = vv*X1
      A = uu*Z1-vvv-2*R
      X3 = v*A
      Y3 = u*(R-A)-vvv*Y1
      Z3 = vvv*Z1

The "add-1998-cmo-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 12M + 2S + 6add + 1*2.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", formula (3), plus common-subexpression elimination.

Explicit formulas:

      Y1Z2 = Y1*Z2
      X1Z2 = X1*Z2
      Z1Z2 = Z1*Z2
      u = Y2*Z1-Y1Z2
      uu = u^2
      v = X2*Z1-X1Z2
      vv = v^2
      vvv = v*vv
      R = vv*X1Z2
      A = uu*Z1Z2-vvv-2*R
      X3 = v*A
      Y3 = u*(R-A)-vvv*Y1Z2
      Z3 = vvv*Z1Z2

The "add-2007-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 11M + 6S + 1*a + 10add + 4*2 + 1*4.
Source: 2007 Bernstein–Lange.
Strongly unified.

Explicit formulas:

      U1 = X1*Z2
      U2 = X2*Z1
      S1 = Y1*Z2
      S2 = Y2*Z1
      ZZ = Z1*Z2
      T = U1+U2
      TT = T^2
      M = S1+S2
      R = TT-U1*U2+a*ZZ^2
      F = ZZ*M
      L = M*F
      LL = L^2
      G = (T+L)^2-TT-LL
      W = 2*R^2-G
      X3 = 2*F*W
      Y3 = R*(G-2*W)-2*LL
      Z3 = 4*F*F^2

The "add-2002-bj" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 12M + 5S + 1*a + 7add + 3*2.
Source: 2002 Brier–Joye "Weierstrass elliptic curves and side-channel attacks", page 339.
Strongly unified.

Explicit formulas:

      U1 = X1*Z2
      U2 = X2*Z1
      S1 = Y1*Z2
      S2 = Y2*Z1
      ZZ = Z1*Z2
      T = U1+U2
      M = S1+S2
      R = T^2-U1*U2+a*ZZ^2
      F = ZZ*M
      L = M*F
      G = T*L
      W = R^2-G
      X3 = 2*F*W
      Y3 = R*(G-2*W)-L^2
      Z3 = 2*F*F^2

The "add-1986-cc" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 10M + 4S + 1^3 + 7add + 1*2 + 1*3.
Source: 1986 Chudnovsky–Chudnovsky "Sequences of numbers generated by addition in formal groups and new primality and factorization tests", page 415, formula (4.4i).

Explicit formulas:

      U1 = X1*Z2
      U2 = X2*Z1
      S1 = Y1*Z2
      S2 = Y2*Z1
      W = Z1*Z2
      P = U2-U1
      R = S2-S1
      X3 = P*(-(U1+U2)*P^2+W*R^2)
      Y3 = (R*(-2*W*R^2+3*(U1+U2)*P^2)-P^3*(S1+S2))/2
      Z3 = W*P^3

The "add-1998-cmo" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 16M + 3S + 3^3 + 6add + 1*2.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", formula (3).

Explicit formulas:

      u = Y2*Z1-Y1*Z2
      v = X2*Z1-X1*Z2
      A = u^2*Z1*Z2-v^3-2*v^2*X1*Z2
      X3 = v*A
      Y3 = u*(v^2*X1*Z2-A)-v^3*Y1*Z2
      Z3 = v^3*Z1*Z2

Explicit formulas for doubling

The "mdbl-2007-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Assumptions: Z1=1.
Cost: 3M + 5S + 7add + 4*2 + 1*3 + 1*4.
Source: 2007 Bernstein–Lange.

Explicit formulas:

      XX = X1^2
      w = a+3*XX
      Y1Y1 = Y1^2
      R = 2*Y1Y1
      sss = 4*Y1*R
      RR = R^2
      B = (X1+R)^2-XX-RR
      h = w^2-2*B
      X3 = 2*h*Y1
      Y3 = w*(B-h)-2*RR
      Z3 = sss

The "dbl-2007-bl-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 7M + 3S + 5add + 4*2 + 1*3.
Source: 2007 Bernstein–Lange.

Explicit formulas:

      w = 3*(X1-Z1)*(X1+Z1)
      s = 2*Y1*Z1
      ss = s^2
      sss = s*ss
      R = Y1*s
      RR = R^2
      B = 2*X1*R
      h = w^2-2*B
      X3 = h*s
      Y3 = w*(B-h)-2*RR
      Z3 = sss

The "dbl-2007-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 5M + 6S + 1*a + 7add + 3*2 + 1*3.
Source: 2007 Bernstein–Lange.

Explicit formulas:

      XX = X1^2
      ZZ = Z1^2
      w = a*ZZ+3*XX
      s = 2*Y1*Z1
      ss = s^2
      sss = s*ss
      R = Y1*s
      RR = R^2
      B = (X1+R)^2-XX-RR
      h = w^2-2*B
      X3 = h*s
      Y3 = w*(B-h)-2*RR
      Z3 = sss

The "dbl-1998-cmo-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 6M + 5S + 1*a + 4add + 1*2 + 1*3 + 1*4 + 3*8.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", formula (4), plus common-subexpression elimination.

Explicit formulas:

      w = a*Z1^2+3*X1^2
      s = Y1*Z1
      ss = s^2
      sss = s*ss
      R = Y1*s
      B = X1*R
      h = w^2-8*B
      X3 = 2*h*s
      Y3 = w*(4*B-h)-8*R^2
      Z3 = 8*sss

The "dbl-1998-cmo" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 6M + 5S + 1^3 + 1*a + 4add + 1*2 + 1*3 + 1*4 + 3*8.
Source: 1998 Cohen–Miyaji–Ono "Efficient elliptic curve exponentiation using mixed coordinates", formula (4).

Explicit formulas:

      w = a*Z1^2+3*X1^2
      s = Y1*Z1
      B = X1*Y1*s
      h = w^2-8*B
      X3 = 2*h*s
      Y3 = w*(4*B-h)-8*Y1^2*s^2
      Z3 = 8*s^3

Explicit formulas for tripling

Explicit formulas for differential addition

Explicit formulas for differential addition and doubling

Explicit formulas for scaling

The "z" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:

Cost: 1I + 2M + 0add.

Explicit formulas:

      A = 1/Z1
      X3 = A*X1
      Y3 = A*Y1
      Z3 = 1