Complete addition laws for all elliptic curves over finite fields - PDF document

Complete addition laws for all elliptic curves over finite fields D. J. Bernstein University of Illinois at Chicago NSF ITR–0716498 Joint work with: Tanja Lange Technische Universiteit Eindhoven

Memories of graduate school Early 1990s, Berkeley: Hendrik Lenstra teaches a rather strange course on algebraic number theory.

Memories of graduate school Early 1990s, Berkeley: Hendrik Lenstra teaches a rather strange course on algebraic number theory. His central objects of study: orders in number fields. Primes, class groups, etc.

Memories of graduate school Early 1990s, Berkeley: Hendrik Lenstra teaches a rather strange course on algebraic number theory. His central objects of study: orders in number fields. Primes, class groups, etc. Normal textbooks and courses focus on maximal orders, i.e., orders without singularities: “Have a non-maximal Z [ x ] =f ? Yikes! Blow it up!”

Edwards curves 2007 Edwards: Every elliptic curve over Q is birationally equivalent to x 2 + y 2 = a 2 (1 + x 2 y 2 ) a 2 Q � f 0 ; � 1 ; � i g . for some x 2 + y 2 = a 2 (1 + x 2 y 2 ) has neutral element (0 ; a ), addition x 1 ; y 1 ) + ( x 2 ; y 2 ) = ( x 3 ; y 3 ) with ( x 1 y 2 + y 1 x 2 x 3 = a (1 + x 1 x 2 y 1 y 2 ), y 1 y 2 � x 1 x 2 y 3 = a (1 � x 1 x 2 y 1 y 2 ).

2007 Bernstein–Lange: k , Over a non-binary finite field x 2 + y 2 = 2 (1 + dx 2 y 2 ) covers more elliptic curves. � with ; d 2 k d 4 Here 6 = 1. x 1 y 2 + y 1 x 2 x 3 = (1 + dx 1 x 2 y 1 y 2 ), y 1 y 2 � x 1 x 2 y 3 = (1 � dx 1 x 2 y 1 y 2 ). = 1. Then Can always take 10 M + 1 S + 1 D for addition, 3 M + 4 S for doubling. Latest news, comparisons: hyperelliptic.org/EFD

Completeness 2007 Bernstein–Lange: d is not a square in k then If f ( x; y ) 2 k � k : x 2 + y 2 = 2 (1 + dx 2 y 2 ) g is a commutative group under this addition law. The denominators (1 + dx 1 x 2 y 1 y 2 ), (1 � dx 1 x 2 y 1 y 2 ) are never zero. No exceptional cases!

Compare to Weierstrass form y 2 = x 3 + a 4 x + a 6 . Standard explicit formulas for Weierstrass addition have several different cases: “chord”; “tangent”; vertical chord; etc. Conventional wisdom: Beyond genus 0, explicit formulas for multiplication in class group always need case distinctions.

1995 Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” on

1995 Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” : : : meaning: on Any addition formula E for a Weierstrass curve in projective coordinates must have exceptional cases E ( k ) � E ( k ), where in k = algebraic closure of k .

1995 Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” : : : meaning: on Any addition formula E for a Weierstrass curve in projective coordinates must have exceptional cases E ( k ) � E ( k ), where in k = algebraic closure of k . Edwards addition formula has E ( k ) exceptional cases for : : : but not for E ( k ). E ( k ). We do computations in

Completeness eases implementations, avoids some cryptographic problems. What about elliptic curves without points of order 4? What about elliptic curves over binary fields? Continuing project (B.–L.): E , For every elliptic curve E find complete addition law for with best possible speeds. Complete laws are useful even if slower than Edwards!

Some Newton polygons � � � � � � � � � � � � � � � � � � � � � � � � � Short Weierstrass � � � � � � � � � � � � � � � � � � � � � � � � � � Jacobi quartic � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � Hessian � � � � � � � � � � � � � � � � � � � � Edwards 1893 Baker: genus is generically number of interior points. 2000 Poonen–Rodriguez-Villegas classified genus-1 polygons.

How to generalize Edwards? Design decision: want x and in y . quadratic in Design decision: want x $ y symmetry. d 20 d 21 d 22 d 10 d 11 d 21 d 00 d 10 d 20 d 00 + d 10 ( x + y ) + Curve shape d 11 xy + d 20 ( x 2 + y 2 ) + d 21 xy ( x + y ) + d 22 x 2 y 2 = 0.

d 22 = 0: Suppose that � d 20 d 21 d 10 d 11 d 21 d 00 d 10 d 20 ) (1 ; 1) is an Genus 1 ) d 21 interior point 6 = 0. Homogenize: d 00 Z 3 + d 10 ( X + Y ) Z 2 + d 11 X Y Z + d 20 ( X 2 + Y 2 ) Z + d 21 X Y ( X + Y ) = 0.

1 are ( X : Y : 0) Points at d 21 X Y ( X + Y ) = 0: i.e., with � 1 : 0). (1 : 0 : 0), (0 : 1 : 0), (1 : Study (1 : 0 : 0) by setting y = Y =X , z = Z =X in homogeneous curve equation: d 00 z 3 + d 10 (1 + y ) z 2 + d 11 y z + d 20 (1 + y 2 ) z + d 21 y (1 + y ) = 0. y Nonzero coefficient of so (1 : 0 : 0) is nonsingular. Addition law cannot be complete k is tiny). (unless

d 22 So we require 6 = 0. 1 are ( X : Y : 0) Points at d 22 X 2 Y 2 = 0: i.e., with (1 : 0 : 0), (0 : 1 : 0). Study (1 : 0 : 0) again: d 00 z 4 + d 10 (1 + y ) z 3 + d 11 y z 2 + d 20 (1 + y 2 ) z 2 + d 21 y (1 + y ) z + d 22 y 2 = 0. ; y ; z are 0 Coefficients of 1 so (1 : 0 : 0) is singular.

y = uz , divide by z 2 Put to blow up singularity: d 00 z 2 + d 10 (1 + uz ) z + d 11 uz + d 20 (1 + u 2 z 2 ) + d 21 u (1 + uz ) + d 22 u 2 = 0. z = 0 to find Substitute points above singularity: d 20 + d 21 u + d 22 u 2 = 0. We require the quadratic d 20 + d 21 u + d 22 u 2 k . to be irreducible in Special case: complete Edwards, � du 2 irreducible in k . 1

d 20 In particular 6 = 0: d 20 d 21 d 22 d 10 d 11 d 21 d 00 d 10 d 20 Design decision: Explore a deviation from Edwards. ; 0). Choose neutral element (0 d 00 = 0; d 10 6 = 0. Can vary neutral element. Warning: bad choice can produce surprisingly expensive negation.

Now have a Newton polygon for generalized Edwards curves: d 20 d 21 d 22 d 10 d 11 d 21 � � � � � d 10 d 20 � � � � x; y By scaling and scaling curve equation d 10 ; d 11 ; d 20 ; d 21 ; d 22 can limit to three degrees of freedom.

2008 B.–L.–Rezaeian Farashahi: complete addition law for “binary Edwards curves” d 1 ( x + y ) + d 2 ( x 2 + y 2 ) = x + x 2 )( y + y 2 ). ( Covers all ordinary elliptic curves n for n � 3. over F 2 Also surprisingly fast, d 1 = d 2 . especially if

2008 B.–L.–Rezaeian Farashahi: complete addition law for “binary Edwards curves” d 1 ( x + y ) + d 2 ( x 2 + y 2 ) = x + x 2 )( y + y 2 ). ( Covers all ordinary elliptic curves n for n � 3. over F 2 Also surprisingly fast, d 1 = d 2 . especially if 2009 B.–L.: complete addition law for another specialization covering all the “NIST curves” over non-binary fields.

78751018041117 25 2 54 5 42 0 99 9 9 54 76717646453854 50 6 08 1 46 3 02 0 2 84 139565117585920 1 7 99 Consider, e.g., the curve x 2 + y 2 = x + y + txy + dx 2 y 2 d = � 1 and with t = 410583637251521 4 21 2 93 2 61 2 97 8 0 047268409114441 0 15 9 93 7 25 5 54 8 3 p = 2 256 � 2 224 + p where 525631403946740 12 9 1 over F � 1. 2 192 + 2 96 d is non-square in F p . Note: Birationally equivalent to standard “NIST P-256” curve v 2 = u 3 � 3 u + a 6 where a 6 = .

An addition law for x 2 + y 2 = x + y + txy + dx 2 y 2 , d is not a square: complete if x 1 + x 2 + ( t � 2) x 1 x 2 + x 1 � y 1 )( x 2 � y 2 ) + ( dx 2 x 2 y 1 + x 2 y 2 � y 1 y 2 ) x 3 = 1 ( � 2 dx 1 x 2 y 2 � ; 1 dx 2 x 2 + y 2 + ( t � 2) x 2 y 2 ) 1 ( y 1 + y 2 + ( t � 2) y 1 y 2 + y 1 � x 1 )( y 2 � x 2 ) + ( dy 2 y 2 x 1 + y 2 x 2 � x 1 x 2 ) y 3 = 1 ( � 2 dy 1 y 2 x 2 � . 1 dy 2 y 2 + x 2 + ( t � 2) y 2 x 2 ) 1 (

Note on computing addition laws: An easy Magma script uses Riemann–Roch to find addition law given a curve shape. Are those laws nice? No! Find lower-degree laws by Monagan–Pearce algorithm, ISSAC 2006; or by evaluation at random points on random curves. Are those laws complete? No! But always seems easy to find complete addition laws among low-degree laws where denominator constant term 6 = 0.

Birational equivalence from x 2 + y 2 = x + y + txy + dx 2 y 2 to v 2 � ( t + 2) uv + dv = u 3 � ( t +2) u 2 � du +( t +2) d v 2 � ( t + 2) uv + dv = i.e. u 2 � d )( u � ( t + 2)): ( u = ( dxy + t + 2) = ( x + y ); t + 2) 2 � d ) x v = (( t + 2) xy + x + y . ( t + 2 square, d not: Assuming only exceptional point is (0 ; 0), mapping to 1 . x = v = ( u 2 � d ); Inverse: y = (( t + 2) u � v � d ) = ( u 2 � d ).

Completeness x 1 + x 2 + ( t � 2) x 1 x 2 + x 1 � y 1 )( x 2 � y 2 ) + ( dx 2 x 2 y 1 + x 2 y 2 � y 1 y 2 ) x 3 = 1 ( � 2 dx 1 x 2 y 2 � ; 1 dx 2 x 2 + y 2 + ( t � 2) x 2 y 2 ) 1 ( y 1 + y 2 + ( t � 2) y 1 y 2 + y 1 � x 1 )( y 2 � x 2 ) + ( dy 2 y 2 x 1 + y 2 x 2 � x 1 x 2 ) y 3 = 1 ( � 2 dy 1 y 2 x 2 � . 1 dy 2 y 2 + x 2 + ( t � 2) y 2 x 2 ) 1 ( Can denominators be 0?