Explicit-Formulas Database
Ordinary genus-1 curves over binary fields
Binary Edwards curves EFD / Ordinary genus-1 binary / W coordinates with d1=d2 for binary Edwards curves

# W coordinates with d1=d2 for binary Edwards curves

An elliptic curve in binary Edwards form [more information] has parameters d1 d2 and coordinates x y satisfying the following equations:
```  d1*(x+y)+d2*(x^2+y^2)=(x+x^2)*(y+y^2)
```

W coordinates with d1=d2 [database entry] make the additional assumptions

```  d1=d2
```
and represent x y as w satisfying the following equations:
```  x+y=w
```

## Best operation counts

Smallest multiplication counts assuming I=10M, S=0M, *param=0M, add=0M, *const=0M:
• 10M for doubling: 1I+2S.
• 11M for differential addition: 1I+1M+2S.
• 21M for differential addition and doubling: 2I+1M+3S.
• 0M for scaling: 0M.
Smallest multiplication counts assuming I=10M, S=0.2M, *param=0M, add=0M, *const=0M:
• 10.4M for doubling: 1I+2S.
• 11.4M for differential addition: 1I+1M+2S.
• 21.6M for differential addition and doubling: 2I+1M+3S.
• 0M for scaling: 0M.

## Summary of all explicit formulas

doubling 1I + 2S + 1*d1
doubling d2overd1plus1=d2/d1+1 1I + 1M + 2S + 1*d2overd1plus1
diffadd 1I + 1M + 2S + 1*d1
diffadd d2overd1plus1=d2/d1+1 1I + 3M + 1S + 1*d2overd1plus1
ladder 2I + 1M + 3S + 2*d1
ladder d2overd1plus1=d2/d1+1 2I + 4M + 3S + 2*d2overd1plus1
scaling 0M

## Explicit formulas for doubling

The "dbl-2008-blr-1" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 1I + 2S + 1*d1 + 3add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      A = w1^2
B = A+w1
w3 = 1+d1/(d1+B^2)
```

The "dbl-2008-blr" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: d2overd1plus1=d2/d1+1.
• Cost: 1I + 1M + 2S + 1*d2overd1plus1 + 3add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      A = w1^2
J = A^2
K = A+J
w3 = K/(d1+K+d2overd1plus1*J)
```

## Explicit formulas for differential addition

The "dadd-2008-blr-1" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 1I + 1M + 2S + 1*d1 + 5add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      A = w2^2
B = A+w2
C = w3^2
D = C+w3
w5 = 1+d1/(d1+B*D)+w1
```

The "dadd-2008-blr" differential-addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: d2overd1plus1=d2/d1+1.
• Cost: 1I + 3M + 1S + 1*d2overd1plus1 + 6add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      R = w2*w3
S = R^2
T = R*(1+w2+w3)+S
w5 = T/(d1+T+d2overd1plus1*S)+w1
```

## Explicit formulas for differential addition and doubling

The "ladd-2008-blr-1" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 2I + 1M + 3S + 2*d1 + 7add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      A = w2^2
B = A+w2
C = w3^2
D = C+w3
w4 = 1+d1/(d1+B^2)
w5 = 1+d1/(d1+B*D)+w1
```

The "ladd-2008-blr" differential-addition-and-doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: d2overd1plus1=d2/d1+1.
• Cost: 2I + 4M + 3S + 2*d2overd1plus1 + 9add.
• Source: 2008 Bernstein–Lange–Rezaeian Farashahi.
• Explicit formulas:
```      R = w2*w3
S = R^2
T = R*(1+w2+w3)+S
w5 = T/(d1+T+d2overd1plus1*S)+w1
A = w2^2
J = A^2
K = A+J
w4 = K/(d1+K+d2overd1plus1*J)
```

## Explicit formulas for scaling

The "copy" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:
```      w3 = w1