Explicit-Formulas Database

# Jacobian coordinates

Jacobian coordinates represent an affine point (x,y) on a Weierstrass-form elliptic curve y^2 = x^3 + ax + b as (X:Y:Z) satisfying Y^2 = X^3 + aXZ^4 + bZ^6. Here (X:Y:Z) = (s^2 X:s^3 Y:sZ) for all nonzero s.

Speed records:

• Cached Jacobian addition: 10M+4S+9add+4times2 after 1M+1S for caching Z2^2 and Z2^3. Algorithm: 1986 Chudnovsky/Chudnovsky, plus S-M tradeoff. Sometimes (X:Y:Z:Z^2:Z^3) are called "Chudnovsky Jacobian coordinates" or "Jacobian Chudnovsky coordinates" or "Chudnovsky coordinates".
• Jacobian addition with Z1=1 and Z2=1: 4M + 2S + 6add + 4times2 + 1times4. Algorithm: 1986 Chudnovsky/Chudnovsky, plus S-M tradeoff.
• Jacobian doubling with Z1=1: 1M + 5S + 7add + 3times2 + 1times3 + 1times8. Algorithm: 1986 Chudnovsky/Chudnovsky, plus two S-M tradeoffs.
• Jacobian doubling with a=-3: 3M+5S+8add+1times3+1times4+2times8. Algorithm: 1986 Chudnovsky/Chudnovsky, plus S-M tradeoff introduced in 2001 Bernstein.
• Jacobian tripling with a=-3: 7M+7S+13add+1times3+2times4+1times8+1times12+1times16. Algorithm: 2005 Dimitrov/Imbert/Mishra, plus four S-M tradeoffs.

The following commands for the Magma computer-algebra system check various addition formulas for Jacobian coordinates.

Jacobian scaling.

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
// here are the formulas:
A:=1/Z1;
AA:=A^2;
X2:=X1*AA;
Y2:=Y1*AA*A;
Z2:=1;
// check:
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
S!(Z2-1);
S!(x2-x1); S!(y2-y1);
```

Jacobian addition (11M+5S+9add+4times2) matches affine addition. Multiplication counts stated in the literature: 17 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i). 16 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'). 16 in 1998 Cohen/Miyaji/Ono. 16 in 2004 Hankerson/Menezes/Vanstone page 92. 16 in 2005 Doche/Lange. 16 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 12M + 4S in 1998 Cohen/Miyaji/Ono, formula (5). 12M + 4S in 2004 Hankerson/Menezes/Vanstone page 92. 12M + 4S in 2005 Doche/Lange. 11M + 5S in 2001 Bernstein. 11M + 5S in 2007 Longa/Miri. 11M + 5S in 2007 Bernstein/Lange.

1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i):

```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
S!(y3^2-x3^3-a*x3-b);
// here are the formulas:
U1:=X1*Z2^2;
U2:=X2*Z1^2;
S1:=Y1*Z2^3;
S2:=Y2*Z1^3;
P:=U2-U1;
R:=S2-S1;
X3:=-(U1+U2)*P^2+R^2;
Y3:=-S1*P^3+R*(U1*P^2-X3);
Z3:=Z1*Z2*P;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```
1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'):
```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
x2:=X2/Z2^2; y2:=Y2/Z2^3;
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
U1:=X1*Z2^2;
U2:=X2*Z1^2;
S1:=Y1*Z2^3;
S2:=Y2*Z1^3;
P:=U2-U1;
R:=S2-S1;
X3:=-(U1+U2)*P^2+R^2;
Y3:=(R*(-2*R^2+3*P^2*(U1+U2))-P^3*(S1+S2))/2;
Z3:=Z1*Z2*P;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

1998 Cohen/Miyaji/Ono, formula (5):

```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
S!(y3^2-x3^3-a*x3-b);
// here are the formulas:
U1:=X1*Z2^2;
U2:=X2*Z1^2;
S1:=Y1*Z2^3;
S2:=Y2*Z1^3;
H:=U2-U1;
r:=S2-S1;
X3:=-H^3-2*U1*H^2+r^2;
Y3:=-S1*H^3+r*(U1*H^2-X3);
Z3:=Z1*Z2*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 12M + 4S + 6add + 1times2:

```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
Z1Z1:=Z1^2;
Z2Z2:=Z2^2;
U1:=X1*Z2Z2;
U2:=X2*Z1Z1;
S1:=Y1*Z2*Z2Z2;
S2:=Y2*Z1*Z1Z1;
H:=U2-U1;
HH:=H^2;
HHH:=H*HH;
r:=S2-S1;
V:=U1*HH;
X3:=r^2-HHH-2*V;
Y3:=r*(V-X3)-S1*HHH;
Z3:=Z1*Z2*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```
1998 Hasegawa/Nakajima/Matsui, page 188, 12M + 4S + 8adds + 2times2 + 1halving, 2 temporary registers:
```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
x2:=X2/Z2^2; y2:=Y2/Z2^3;
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
R1:=X1; R2:=Y1; R3:=Z1;
R4:=X2; R5:=Y2; R6:=Z2;
// here are the formulas:
R7:=R6^2;
R1:=R1*R7;
R7:=R6*R7;
R2:=R2*R7;
R7:=R3^2;
R8:=R4*R7;
R7:=R3*R7;
R7:=R5*R7;
R2:=R2-R7;
R7:=2*R7;
R7:=R2+R7;
R1:=R1-R8;
R8:=2*R8;
R8:=R1+R8;
R3:=R3*R6;
R3:=R3*R1;
R7:=R7*R1;
R1:=R1^2;
R8:=R8*R1;
R7:=R7*R1;
R1:=R2^2;
R1:=R1-R8;
R8:=R8-R1;
R8:=R8-R1;
R8:=R8*R2;
R2:=R8-R7;
R2:=R2/2;
X3:=R1; Y3:=R2; Z3:=R3;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```
2007 Bernstein/Lange, 11M + 5S + 9add + 4times2:
```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
Z1Z1:=Z1^2;
Z2Z2:=Z2^2;
U1:=X1*Z2Z2;
U2:=X2*Z1Z1;
S1:=Y1*Z2*Z2Z2;
S2:=Y2*Z1*Z1Z1;
H:=U2-U1;
I:=(2*H)^2;
J:=H*I;
r:=2*(S2-S1);
V:=U1*I;
X3:=r^2-J-2*V;
Y3:=r*(V-X3)-2*S1*J;
Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```
2007 Bernstein/Lange, 10M + 4S + 9add + 4times2 after 1M + 1S for caching:
```     K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6));
R<Z1,Z2>:=PolynomialRing(K,2);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
// cached:
Z2Z2:=Z2^2;
Z2Z2Z2:=Z2*Z2Z2;
// uncached:
Z1Z1:=Z1^2;
U1:=X1*Z2Z2;
U2:=X2*Z1Z1;
S1:=Y1*Z2Z2Z2;
S2:=Y2*Z1*Z1Z1;
H:=U2-U1;
I:=(2*H)^2;
J:=H*I;
r:=2*(S2-S1);
V:=U1*I;
X3:=r^2-J-2*V;
Y3:=r*(V-X3)-2*S1*J;
Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

Jacobian mixed addition (7M+4S+9add+3times2+1times4) matches affine addition. S,M counts stated in the literature: 8M+3S in 2004 Hankerson/Menezes/Vanstone page 89 ("three field squarings and eight field multiplications"). 8M+3S in 2005 Doche/Lange. 7M+4S in 2007 Longa/Miri. 7M+4S in 2007 Bernstein/Lange.

Substituting Z2=1 in the general addition formulas, 8M + 3S + 6add + 5times2:

```     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
R<Z1,Y2>:=PolynomialRing(K,2);
Z2:=1;
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
Z1Z1:=Z1^2;
U2:=X2*Z1Z1;
S2:=Y2*Z1*Z1Z1;
H:=U2-X1;
I:=(2*H)^2;
J:=H*I;
r:=2*(S2-Y1);
V:=X1*I;
X3:=r^2-J-2*V;
Y3:=r*(V-X3)-2*Y1*J;
Z3:=2*Z1*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

2004 Hankerson/Menezes/Vanstone, page 91, 8M + 3S + 6add + 1times2, 4 temporary registers:

```     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
R<Z1,Y2>:=PolynomialRing(K,2);
Z2:=1;
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
T1:=Z1^2;
T2:=T1*Z1;
T1:=T1*X2;
T2:=T2*Y2;
T1:=T1-X1;
T2:=T2-Y1;
Z3:=Z1*T1;
T3:=T1^2;
T4:=T3*T1;
T3:=T3*X1;
T1:=2*T3;
X3:=T2^2;
X3:=X3-T1;
X3:=X3-T4;
T3:=T3-X3;
T3:=T3*T2;
T4:=T4*Y1;
Y3:=T3-T4;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

2007 Bernstein/Lange, 7M + 4S + 9add + 3times2 + 1times4:

```     K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5));
R<Z1,Y2>:=PolynomialRing(K,2);
Z2:=1;
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
Z1Z1:=Z1^2;
U2:=X2*Z1Z1;
S2:=Y2*Z1*Z1Z1;
H:=U2-X1;
HH:=H^2;
I:=4*HH;
J:=H*I;
r:=2*(S2-Y1);
V:=X1*I;
X3:=r^2-J-2*V;
Y3:=r*(V-X3)-2*Y1*J;
Z3:=(Z1+H)^2-Z1Z1-HH;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

Jacobian addition with Z1=1 and Z2=1. 2007 Bernstein/Lange, 4M + 2S + 6add + 4times2 + 1times4:

```     K<a,b,X1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Y1,Y2>:=PolynomialRing(K,2);
Z1:=1; Z2:=1;
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
// here are the formulas:
H:=X2-X1;
HH:=H^2;
I:=4*HH;
J:=H*I;
r:=2*(Y2-Y1);
V:=X1*I;
X3:=r^2-J-2*V;
Y3:=r*(V-X3)-2*Y1*J;
Z3:=2*H;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

Jacobian doubling (1M+8S+1D+10add+2times2+1times3+1times8) matches affine doubling. Multiplication counts stated in the literature: 10 in 1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) ("9 multiplications ... and one multiplication by a"). 10 in 2007 Longa/Miri. 10 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 4M+6S in 1998 Cohen/Miyaji/Ono, formula (6). 4M+6S in 2004 Hankerson/Menezes/Vanstone page 88 ("six field squarings and four field multiplications"). 4M+6S in 2005 Doche/Lange. 2M+8S in 2007 Longa/Miri. 2M+8S in 2007 Bernstein/Lange.

1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii):

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
S:=4*X1*Y1^2;
M:=3*X1^2+a*Z1^4;
T:=-2*S+M^2;
X3:=T;
Y3:=-8*Y1^4+M*(S-T);
Z3:=2*Y1*Z1;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```
1998 Cohen/Miyaji/Ono, formula (6):
```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
S:=4*X1*Y1^2;
M:=3*X1^2+a*Z1^4;
T:=M^2-2*S;
X3:=T;
Y3:=-8*Y1^4+M*(S-T);
Z3:=2*Y1*Z1;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```
Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 3M + 6S + 1D + 4add + 2times2 + 1times3 + 1times4 + 1times8:
```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
XX:=X1^2;
YY:=Y1^2;
ZZ:=Z1^2;
S:=4*X1*YY;
M:=3*XX+a*ZZ^2;
T:=M^2-2*S;
X3:=T;
Y3:=M*(S-T)-8*YY^2;
Z3:=2*Y1*Z1;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```
1998 Hasegawa/Nakajima/Matsui, page 188, 3M + 6S + 1D + 6add + 3times2 + 1halving, 2 temporary registers:
```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
R1:=X1; R2:=Y1; R3:=Z1;
// here are the formulas:
R4:=R3^2;
R3:=R2*R3;
R3:=2*R3;
R4:=R4^2;
R4:=a*R4;
R5:=R1^2;
R4:=R4+R5;
R5:=2*R5;
R4:=R4+R5;
R2:=2*R2;
R2:=R2^2;
R5:=R2^2;
R5:=R5/2;
R2:=R2*R1;
R1:=R4^2;
R1:=R1-R2;
R1:=R1-R2;
R2:=R2-R1;
R2:=R2*R4;
R2:=R2-R5;
X3:=R1; Y3:=R2; Z3:=R3;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

2007 Bernstein/Lange, 1M + 8S + 1D + 10add + 2times2 + 1times3 + 1times8:

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
XX:=X1^2;
YY:=Y1^2;
YYYY:=YY^2;
ZZ:=Z1^2;
S:=2*((X1+YY)^2-XX-YYYY);
M:=3*XX+a*ZZ^2;
T:=M^2-2*S;
X3:=T;
Y3:=M*(S-T)-8*YYYY;
Z3:=(Y1+Z1)^2-YY-ZZ;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

Jacobian doubling for a=-3 (3M+5S+8add+1times3+1times4+2times8) matches affine doubling. Multiplication counts stated in the literature: 8 in 1986 Chudnovksy/Chudnovsky, page 414 ("8 multiplications"). 8 in 2004 Hankerson/Menezes/Vanstone page 92. 8 in 2005 Doche/Lange. 8 in 2007 Longa/Miri. 8 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 4M+4S in 2004 Hankerson/Menezes/Vanstone page 92. 3M+5S in 2001 Bernstein. 3M+5S in 2007 Longa/Miri. 3M+5S in 2007 Bernstein/Lange.

1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) modified as indicated after "It is even smarter ..." for the special case a = -3:

```     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
a:=-3;
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
S:=4*X1*Y1^2;
M:=3*(X1-Z1^2)*(X1+Z1^2);
T:=-2*S+M^2;
X3:=T;
Y3:=-8*Y1^4+M*(S-T);
Z3:=2*Y1*Z1;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

1998 Hasegawa/Nakajima/Matsui, page 188, 4M + 4S + 7add + 3times2 + 1halving, 2 temporary registers, in the special case a = -3:

```     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
a:=-3;
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
R1:=X1; R2:=Y1; R3:=Z1;
// here are the formulas:
R4:=R3^2;
R3:=R2*R3;
R3:=2*R3;
R5:=R1-R4;
R4:=R1+R4;
R5:=R4*R5;
R4:=2*R5;
R4:=R4+R5;
R2:=2*R2;
R2:=R2^2;
R5:=R2^2;
R5:=R5/2;
R2:=R2*R1;
R1:=R4^2;
R1:=R1-R2;
R1:=R1-R2;
R2:=R2-R1;
R2:=R2*R4;
R2:=R2-R5;
X3:=R1; Y3:=R2; Z3:=R3;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

2004 Hankerson/Menezes/Vanstone, page 91, 4M + 4S + 5add + 2times2 + 1times3 + 1halving, 3 temporary registers, in the special case a = -3:

```     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
a:=-3;
R<Z1>:=PolynomialRing(K,1);
S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
S!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
S!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
S!(y3^2-x3^3-a*x3-b);
// here are the formulas:
T1:=Z1^2;
T2:=X1-T1;
T1:=X1+T1;
T2:=T2*T1;
T2:=3*T2;
Y3:=2*Y1;
Z3:=Y3*Z1;
Y3:=Y3^2;
T3:=Y3*X1;
Y3:=Y3^2;
Y3:=Y3/2;
X3:=T2^2;
T1:=2*T3;
X3:=X3-T1;
T1:=T3-X3;
T1:=T1*T2;
Y3:=T1-Y3;
S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
```

2001 Bernstein, 3M + 5S + 8add + 1times3 + 1times4 + 2times8, in the special case a = -3:

```     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
a:=-3;
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
delta:=Z1^2;
gamma:=Y1^2;
beta:=X1*gamma;
alpha:=3*(X1-delta)*(X1+delta);
X3:=alpha^2-8*beta;
Z3:=(Y1+Z1)^2-gamma-delta;
Y3:=alpha*(4*beta-X3)-8*gamma^2;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

Jacobian doubling with Z1=1. 2007 Bernstein/Lange, 1M + 5S + 7add + 3times2 + 1times3 + 1times8:

```     K<a,b,X1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
R<Y1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
Z1:=1; X2:=X1; Y2:=Y1; Z2:=Z1;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
x2:=X2/Z2^2; y2:=Y2/Z2^3;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(3*x1^2+a)/(2*y1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
XX:=X1^2;
YY:=Y1^2;
YYYY:=YY^2;
S:=2*((X1+YY)^2-XX-YYYY);
M:=3*XX+a;
T:=M^2-2*S;
X3:=T;
Y3:=M*(S-T)-8*YYYY;
Z3:=2*Y1;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

Jacobian tripling (5M+10S+1D+15add+1times3+2times4+1times6+1times8+1times16) matches doubling and addition. Multiplication counts stated in the literature: 16 in 2005 Dimitrov/Imbert/Mishra, page 69 ("6[s]+10[m]"). 16 in 2007 Longa/Miri. 16 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 10M+6S in 2005 Dimitrov/Imbert/Mishra, page 69. 6M+10S in 2007 Longa/Miri. 6M+10S in 2007 Bernstein/Lange.

2005 Dimitrov/Imbert/Mishra:

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
lambda:=(3*x1^2+a)/(2*y1);
x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
M:=3*X1^2+a*Z1^4;
E:=12*X1*Y1^2-M^2;
T:=8*Y1^4;
X3:=8*Y1^2*(T-M*E)+X1*E^2;
Y3:=Y1*(4*(M*E-T)*(2*T-M*E)-E^3);
Z3:=Z1*E;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

Eliminating common subexpressions from 2005 Dimitrov/Imbert/Mishra, 8M + 7S + 1D + 6add + 2times2 + 1times3 + 1times4 + 1times6:

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
lambda:=(3*x1^2+a)/(2*y1);
x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
ZZ:=Z1^2;
YY:=Y1^2;
C:=2*YY;
M:=3*X1^2+a*ZZ^2;
E:=6*X1*C-M^2;
EE:=E^2;
T:=2*C^2;
U:=M*E-T;
U4:=4*U;
X3:=X1*EE-C*U4;
Y3:=Y1*(U4*(T-U)-E*EE);
Z3:=Z1*E;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

2007 Bernstein/Lange, 5M + 10S + 1D + 15add + 1times3 + 2times4 + 1times6 + 1times8 + 1times16:

```     K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4));
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
lambda:=(3*x1^2+a)/(2*y1);
x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
XX:=X1^2;
YY:=Y1^2;
ZZ:=Z1^2;
YYYY:=YY^2;
M:=3*XX+a*ZZ^2;
MM:=M^2;
E:=6*((X1+YY)^2-XX-YYYY)-MM;
EE:=E^2;
T:=16*YYYY;
U:=(M+E)^2-MM-EE-T;
X3:=4*(X1*EE-4*YY*U);
Y3:=8*Y1*(U*(T-U)-E*EE);
Z3:=(Z1+E)^2-ZZ-EE;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```

Jacobian tripling with a=-3 (7M+7S+13add+1times3+2times4+1times8+1times12+1times16) matches doubling and addition. Multiplication counts stated in the literature: 14 in 2007 Longa/Miri. 14 in 2007 Bernstein/Lange.

S,M counts stated in the literature: 7M+7S in 2007 Longa/Miri. 7M+7S in 2007 Bernstein/Lange.

2007 Bernstein/Lange, 7M + 7S + 13add + 1times3 + 2times4 + 1times8 + 1times12 + 1times16:

```     K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3));
a:=-3;
R<Z1>:=PolynomialRing(K,1);
SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>;
x1:=X1/Z1^2; y1:=Y1/Z1^3;
SS!(y1^2-x1^3-a*x1-b);
lambda:=(3*x1^2+a)/(2*y1);
x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1;
SS!(y2^2-x2^3-a*x2-b);
lambda:=(y2-y1)/(x2-x1);
x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1;
SS!(y3^2-x3^3-a*x3-b);
// here are the formulas:
YY:=Y1^2;
ZZ:=Z1^2;
YYYY:=YY^2;
M:=3*(X1-ZZ)*(X1+ZZ);
MM:=M^2;
E:=12*X1*YY-MM;
EE:=E^2;
T:=16*YYYY;
U:=(M+E)^2-MM-EE-T;
X3:=4*(X1*EE-4*YY*U);
Y3:=8*Y1*(U*(T-U)-E*EE);
Z3:=(Z1+E)^2-ZZ-EE;
SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
```