Explicit-Formulas Database
Genus-1 curves over large-characteristic fields
Doubling-oriented Doche–Icart–Kohel curves EFD / Genus-1 large-characteristic / Standard coordinates for doubling-oriented Doche–Icart–Kohel curves

# Standard coordinates for doubling-oriented Doche–Icart–Kohel curves

An elliptic curve in doubling-oriented Doche–Icart–Kohel form [more information] has parameters a and coordinates x y satisfying the following equations:
```  y^2=x^3+a*x^2+16*a*x
```

Standard coordinates [database entry] represent x y as X Y Z ZZ satisfying the following equations:

```  x=X/Z
y=Y/ZZ
ZZ=Z^2
```

## Best operation counts

Smallest multiplication counts assuming I=100M, S=1M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=100M, S=0.8M, *param=0M, add=0M, *const=0M:
Smallest multiplication counts assuming I=100M, S=0.67M, *param=0M, add=0M, *const=0M:

## Summary of all explicit formulas

addition Z1=1 and Z2=1 4M + 4S + 1*a 4M + 4S + 1*a
addition Z1=1 and Z2=1 4M + 4S + 1*a 4M + 4S + 1*a
addition Z1=1 and Z2=1 6M + 3S + 1*a 6M + 3S + 1*a
addition Z2=1 8M + 4S + 1*a 8M + 4S + 1*a
addition Z2=1 9M + 3S + 1*a 9M + 3S + 1*a
addition 12M + 5S + 1*a 12M + 5S + 1*a
addition 21M + 15S + 24 + 1*a 21M + 11S + 14 + 1*a
addition 7I + 12M + 9S + 14 + 1*a 4I + 9M + 8S + 14 + 1*a
doubling a2=2*a and a16=16*a and Z1=1 1M + 5S + 1*a2 + 1*a
doubling a2=2*a 2M + 5S + 1*a2 + 1*a
doubling a4=4*a 3M + 4S + 1*a + 1*a4
doubling a16=16*a 3M + 8S + 1*a16 + 2*a
scaling 1I + 2M + 1S

The "mmadd-20080313-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1 and Z2=1.
• Cost: 4M + 4S + 1*a + 10add + 2*2.
• Explicit formulas:
```      A = Y2-Y1
AA = A^2
B = X2-X1
CC = B^2
F = X1*CC
Z3 = 2*CC
D = X2*Z3
ZZ3 = Z3^2
X3 = 2*(AA-F)-a*Z3-D
Y3 = ((A+B)^2-AA-CC)*(D-X3)-Y2*ZZ3
```

The "mmadd-20080308-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1 and Z2=1.
• Cost: 4M + 4S + 1*a + 10add + 3*2.
• Explicit formulas:
```      A = Y2-Y1
AA = A^2
B = X2-X1
CC = B^2
D = 2*X2*CC
F = X1*CC
Z3 = 2*CC
ZZ3 = Z3^2
X3 = 2*(AA-F)-a*Z3-D
Y3 = ((A+B)^2-AA-CC)*(D-X3)-Y2*ZZ3
```

The "mmadd-2006-dik" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z1=1 and Z2=1.
• Cost: 6M + 3S + 1*a + 7add.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 197, middle display, plus substitution Z2=1.
• Explicit formulas:
```      A = Y1-Y2
B = X1-X2
C = B
Z3 = C^2
D = X1*Z3
E = A^2
F = X2*B*C
X3 = E-a*Z3-D-F
G = Z3^2
H = A*C
Y3 = H*(D-X3)-Y1*G
ZZ3 = G
```

The "madd-2007-bl" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 8M + 4S + 1*a + 10add + 3*2.
• Source: 2007 Bernstein–Lange.
• Explicit formulas:
```      A = Y2*ZZ1-Y1
AA = A^2
B = X2*Z1-X1
C = B*Z1
CC = C^2
D = 2*X2*CC
F = X1*B*C
Z3 = 2*CC
ZZ3 = Z3^2
X3 = 2*(AA-F)-a*Z3-D
Y3 = ((A+C)^2-AA-CC)*(D-X3)-Y2*ZZ3
```

The "madd-2006-dik" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: Z2=1.
• Cost: 9M + 3S + 1*a + 7add.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 197, middle display, plus reversal of roles of 1 and 2.
• Explicit formulas:
```      A = Y2*ZZ1-Y1
B = X2*Z1-X1
C = B*Z1
Z3 = C^2
D = X2*Z3
E = A^2
F = X1*B*C
X3 = E-a*Z3-D-F
G = Z3^2
H = A*C
Y3 = H*(D-X3)-Y2*G
ZZ3 = G
```

The "add-2006-dik-3" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 12M + 5S + 1*a + 10add + 4*2.
• Source: 2007 Bernstein–Lange; derived from 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 197, middle display, by substitution Z2=1, simplification, projectification, clearing denominators, common-subexpression elimination.
• Explicit formulas:
```      A = Y1*ZZ2-Y2*ZZ1
AA = A^2
X2Z1 = X2*Z1
B = X1*Z2-X2Z1
C = B*Z2
E = C*Z1
EE = E^2
F = E*C
D = F*X1
U = AA-a*EE-D-X2Z1*E*B
X3 = 2*U
Y3 = 2*((E+A)^2-EE-AA)*(D-U)-Y1*(2*F)^2
Z3 = 2*EE
ZZ3 = Z3^2
```

The "add-2006-dik-2" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 21M + 15S + 24 + 1*a + 7add.
• Cost: 21M + 11S + 14 + 1*a + 7add dependent upon the first point.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 197, middle display, plus substitution Z2=1, plus simplification, plus projectification, plus clearing denominators.
• Explicit formulas:
```      A = Y1*Z2^2-Y2*Z1^2
B = X1*Z2-X2*Z1
D = Z1*Z2^2*B^2*X1
U = A^2-a*B^2*Z1^2*Z2^2-D-X2*B^2*Z1^2*Z2
X3 = U
Y3 = Z1*Z2*A*B*(D-U)-Z1^2*Z2^4*Y1*B^4
Z3 = Z1^2*Z2^2*B^2
ZZ3 = Z3^2
```

The "add-2006-dik" addition formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 7I + 12M + 9S + 14 + 1*a + 7add.
• Cost: 4I + 9M + 8S + 14 + 1*a + 7add dependent upon the first point.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 197, middle display, plus substitution Z2=1, plus simplification, plus projectification.
• Explicit formulas:
```      A = Y1/Z1^2-Y2/Z2^2
B = (X1/Z1)-(X2/Z2)
D = (X1/Z1)*B^2
X3 = A^2-a*B^2-D-(X2/Z2)*B^2
Y3 = A*B*(D-X3)-(Y1/Z1^2)*B^4
Z3 = B^2
ZZ3 = Z3^2
```

## Explicit formulas for doubling

The "mdbl-2007-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: a2=2*a and a16=16*a and Z1=1.
• Cost: 1M + 5S + 1*a2 + 1*a + 7add + 2*2 + 1*64.
• Source: 2007 Bernstein–Lange.
• Explicit formulas:
```      A = X1^2
B = A-a16
C = a2*A
YY = Y1^2
YY2 = 2*YY
Z3 = 2*YY2
X3 = B^2
V = (Y1+B)^2-YY-X3
Y3 = V*(X3+64*C+a*(YY2-C))
ZZ3 = Z3^2
```

The "dbl-2007-bl" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: a2=2*a.
• Cost: 2M + 5S + 1*a2 + 1*a + 7add + 2*2 + 1*8 + 1*64.
• Source: 2007 Bernstein–Lange.
• Explicit formulas:
```      A = X1^2
U = a2*ZZ1
B = A-8*U
C = A*U
YY = Y1^2
YY2 = 2*YY
Z3 = 2*YY2
X3 = B^2
V = (Y1+B)^2-YY-X3
Y3 = V*(X3+64*C+a*(YY2-C))
ZZ3 = Z3^2
```

The "dbl-2006-dik-2" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: a4=4*a.
• Cost: 3M + 4S + 1*a + 1*a4 + 4add + 2*2 + 1*4 + 1*32.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 196, bottom display, plus elimination of common subexpressions.
• Explicit formulas:
```      A = X1^2
U = a4*ZZ1
B = A-4*U
C = A*U
Z3 = (2*Y1)^2
X3 = B^2
Y3 = Y1*B*(2*(X3+32*C)+a*(Z3-C))
ZZ3 = Z3^2
```

The "dbl-2006-dik" doubling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Assumptions: a16=16*a.
• Cost: 3M + 8S + 1*a16 + 2*a + 4add + 1*2 + 2*4 + 1*256.
• Source: 2006 Doche–Icart–Kohel "Efficient scalar multiplication by isogeny decompositions", page 196, bottom display.
• Explicit formulas:
```      A = X1^2
B = X1^2-a16*Z1^2
YT = Y1*B
X3 = B^2
Z3 = 4*Y1^2
C = X1^2*a*Z1^2
D = Z3^2
E = a*(Z3-4*C)
Y3 = YT*(2*X3+E+256*C)
ZZ3 = D
```

## Explicit formulas for scaling

The "z" scaling formulas [database entry; Sage verification script; Sage output; three-operand code]:
• Cost: 1I + 2M + 1S + 0add.
• Explicit formulas:
```      A = 1/Z1
X3 = X1*A
Y3 = Y1*A^2
Z3 = 1
ZZ3 = 1
```