2007 | OriginalPaper | Chapter
Inverted Edwards Coordinates
Authors : Daniel J. Bernstein, Tanja Lange
Published in: Applied Algebra, Algebraic Algorithms and Error-Correcting Codes
Publisher: Springer Berlin Heidelberg
Activate our intelligent search to find suitable subject content or patents.
Select sections of text to find matching patents with Artificial Intelligence. powered by
Select sections of text to find additional relevant content using AI-assisted search. powered by
Edwards curves have attracted great interest for several reasons. When curve parameters are chosen properly, the addition formulas use only 10
M
+ 1
S
. The formulas are
strongly unified
, i.e., work without change for doublings; even better, they are
complete
, i.e., work without change for all inputs. Dedicated doubling formulas use only 3
M
+ 4
S
, and dedicated tripling formulas use only 9
M
+ 4
S
.
This paper introduces
inverted Edwards coordinates
. Inverted Edwards coordinates (
X
1
:
Y
1
:
Z
1
) represent the affine point (
Z
1
/
X
1
,
Z
1
/
Y
1
) on an Edwards curve; for comparison, standard Edwards coordinates (
X
1
:
Y
1
:
Z
1
) represent the affine point (
X
1
/
Z
1
,
Y
1
/
Z
1
).
This paper presents addition formulas for inverted Edwards coordinates using only 9
M
+ 1
S
. The formulas are not complete but still are strongly unified. Dedicated doubling formulas use only 3
M
+ 4
S
, and dedicated tripling formulas use only 9
M
+ 4
S
. Inverted Edwards coordinates thus save 1
M
for each addition, without slowing down doubling or tripling.