Complete addition laws for elliptic curves D. J. Bernstein - PDF document

Complete addition laws for elliptic curves D. J. Bernstein University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven

Weierstrass coordinates k with 2 Fix a field 6 = 0. a; b 2 k with 4 a 3 + 27 b 2 Fix 6 = 0. Well-known fact: The points of the “elliptic curve” E : y 2 = x 3 + ax + b over k E ( k ). form a commutative group f ( x; y ) 2 k � k : “So the group is y 2 = x 3 + ax + b g ?” f ( x; y ) 2 k � k : Not exactly! It’s y 2 = x 3 + ax + b g [ f1g .

x 1 ; y 1 ) ; ( x 2 ; y 2 ) 2 E ( k ): To add ( x 3 = � 2 � x 1 � x 2 Define y 3 = � ( x 1 � x 3 ) � y 1 and � = ( y 2 � y 1 ) = ( x 2 � x 1 ). where x 3 ; y 3 ) 2 E ( k ). Then ( Geometric interpretation: x 1 ; y 1 ) ; ( x 2 ; y 2 ) ; ( x 3 ; � y 3 ) are ( y 2 = x 3 + ax + b on the curve and on a line; x 3 ; y 3 ) ; ( x 3 ; � y 3 ) are ( on a vertical line. “So that’s the group law? x 1 ; y 1 ) + ( x 2 ; y 2 ) = ( x 3 ; y 3 )?” (

� Not exactly! Definition of x 2 x 1 . assumes that 6 = x 1 ; y 1 ) ; ( x 1 ; y 1 ) 2 E ( k ): To add ( x 3 = � 2 � x 1 � x 2 Define y 3 = � ( x 1 � x 3 ) � y 1 and � = (3 x 2 a ) = 2 y 1 . where 1 + x 3 ; y 3 ) 2 E ( k ). Then ( Geometric interpretation: The curve’s tangent line at x 1 ; y 1 ) passes through ( x 3 ; � y 3 ). ( “So that’s the group law? One special case for doubling?”

Not exactly! More exceptions: y 1 could be 0. e.g., 1 + 1 = 1 ; Six cases overall: 1 + ( x 2 ; y 2 ) = ( x 2 ; y 2 ); x 1 ; y 1 ) + 1 = ( x 1 ; y 1 ); ( x 1 ; y 1 ) + ( x 1 ; � y 1 ) = 1 ; ( y 1 x 1 ; y 1 ) + ( x 1 ; y 1 ) = for 6 = 0, ( x 3 ; y 3 ) with x 3 = � 2 � x 1 � x 2 , ( y 3 = � ( x 1 � x 3 ) � y 1 , � = (3 x 2 a ) = 2 y 1 ; 1 + x 1 x 2 , ( x 1 ; y 1 ) + ( x 2 ; y 2 ) = for 6 = x 3 ; y 3 ) with x 3 = � 2 � x 1 � x 2 , ( y 3 = � ( x 1 � x 3 ) � y 1 , � = ( y 2 � y 1 ) = ( x 2 � x 1 ).

E ( k ) is a commutative group: 1 , and � : Has neutral element �1 = 1 ; � ( x; y ) = ( x; � y ). P + Q = Q + P . Commutativity: Associativity: P + Q ) + R = P + ( Q + R ). ( Straightforward but tedious: use a computer-algebra system to check each possible case. P + Q case Or relate each to “ideal-class product.” Many other proofs, but can’t escape case analysis.

Projective coordinates Can eliminate some exceptions. Define ( X : Y : Z ), for X ; Y ; Z ) 2 k � k � k � f (0 ; 0 ; 0) g , ( f ( r X ; r Y ; r Z ) : r 2 k � f 0 g g . as Could split into cases: X : Y : Z ) = ( X = Z : Y = Z : 1) if Z ( 6 = 0; X : Y : 0) = ( X = Y : 1 : 0) if Y ( 6 = 0; X : 0 : 0) = (1 : 0 : 0). ( But scaling unifies all cases.

k ) = f ( X : Y : Z ) g . Write P 2 ( E ( k ) = Revised definition: f ( X : Y : Z ) 2 P 2 ( k ) : Y 2 Z = X 3 + aX Z 2 + bZ 3 g . Could split into cases: X : Y : Z ) 2 E ( k ) and Z If ( 6 = 0: X : Y : Z ) = ( x : y : 1) ( x = X = Z , y = Y = Z . where y 2 = x 3 + ax + b . Note that x; y ). Corresponds to previous ( X : Y : Z ) 2 E ( k ) and Z = 0: If ( X 3 = 0 so X = 0 so Y 6 = 0 so ( X : Y : Z ) = (0 : 1 : 0). 1 . Corresponds to previous

X 1 : Y 1 : Z 1 ) + ( X 2 : Y 2 : Z 2 ) ( X 3 : Y 3 : Z 3 ) where = ( U = Y 2 Z 1 � Y 1 Z 2 , V = X 2 Z 1 � X 1 Z 2 , W = U 2 Z 1 Z 2 � V 3 � 2 V 2 X 1 Z 2 , X 3 = V W , Y 3 = U ( V 2 X 1 Z 2 � W ) � V 3 Y 1 Z 2 , Z 3 = V 3 Z 1 Z 2 . “Aha! No more divisions by 0.” Compare to previous formulas: x 3 = � 2 � x 1 � x 2 y 3 = � ( x 1 � x 3 ) � y 1 and � = ( y 2 � y 1 ) = ( x 2 � x 1 ). where

Oops, still have exceptions! Formulas give bogus X 3 ; Y 3 ; Z 3 ) = (0 ; 0 ; 0) ( X 1 : Y 1 : Z 1 ) = (0 : 1 : 0). if ( Same problem for doubling. Formulas produce (0 : 1 : 0) for X 1 : Y 1 : Z 1 ) + ( X 1 : � Y 1 : Z 1 ) ( Y 1 Z 1 if 6 = 0 and 6 = 0 Y 1 = 0. but not if To define complete group law, use six cases as before.

Jacobian coordinates “Weighted projective coordinates using weights 2 ; 3 ; 1”: Redefine ( X : Y : Z ) as � � r 2 X ; r 3 Y ; r Z ) : r 2 k � f 0 g ( . E ( k ) Redefine Y 2 = X 3 + aX Z 4 + bZ 6 . using Could again split into cases X : Y : Z ) 2 E ( k ): for ( Z X : Y : Z ) = if 6 = 0 then ( X = Z 2 : Y = Z 3 : 1); if Z = 0 ( X : Y : Z ) = (1 : 1 : 0). then (

X 1 : Y 1 : Z 1 ) + ( X 2 : Y 2 : Z 2 ) ( X 3 : Y 3 : Z 3 ) where = ( U 1 = X 1 Z 2 U 2 = X 2 Z 2 2 , 1 , S 1 = Y 1 Z 3 S 2 = Y 2 Z 3 2 , 1 , H = U 2 � U 1 , J = S 2 � S 1 , X 3 = � H 3 � 2 U 1 H 2 + J 2 , Y 3 = � S 1 H 3 + J ( U 1 H 2 � X 3 ), Z 3 = Z 1 Z 2 H . Streamlined algorithm uses 12 M + 4 S , where k and S is squaring in k . M is general multiplication in (1986 Chudnovsky–Chudnovsky) 11 M + 5 S . (2001 Bernstein)

Still need all six cases. Why use Jacobian coordinates? Answer: Only 3 M + 5 S for Jacobian-coordinate doubling a = � 3 (e.g. NIST curves). if Y 1 Formulas: If 6 = 0 then X 1 : Y 1 : Z 1 ) + ( X 1 : Y 1 : Z 1 ) ( X 3 ; Y 3 ; Z 3 ) where = ( T = Z 2 U = Y 2 V = X 1 U , 1 , 1 , W = 3( X 1 � T )( X 1 + T ), X 3 = W 2 � 8 V , Z 3 = ( Y 1 + Z 1 ) 2 � U � T , Y 3 = W (4 V � X 3 ) � 8 U 2 .

Unified addition laws Do addition laws have to fail for doublings? Not necessarily! Example: “Jacobi intersection” s 2 + 2 = 1, as 2 + d 2 = 1 has 17 M addition formula that works for doublings. (1986 Chudnovsky–Chudnovsky) 16 M . (2001 Liardet–Smart) Many more “unified formulas.” But always find exceptions: points not added by formulas.

“Is this Jacobi intersection y 2 = x 3 + � � � ?” related to s 2 + 2 = 1, as 2 + d 2 = 1 Yes: is birationally equivalent to y 2 = x 3 + (2 � a ) x 2 + (1 � a ) x . s; ; d ) 7! ( x; y ): ( x = ( d � 1)(1 � a ) = ( a � d +1 � a ); y = s (1 � a ) a= ( a � d + 1 � a ). x; y ) 7! ( s; ; d ): ( s = � 2 y = (( y 2 =x 2 + a ) x ); = 1 � 2 = ( y 2 =x 2 + a ) � � a ) = (( y 2 =x 2 + a ) x ); 2(1 d = 1 � 2 a= ( y 2 =x 2 + a ).

Do we need 6 cases? No! E ( k ) � E ( k ) Can cover using 3 addition laws. (1985 H. Lange–Ruppert) How about just one law E ( k ) � E ( k )? that covers One complete addition law? Bad news: “Theorem 1. The smallest cardinality of a complete system of addition laws E equals two.” on (1995 Bosma–H. Lenstra)

Edwards curves 2007 Edwards: Every elliptic curve over Q is birationally equivalent to x 2 + y 2 = 2 (1 + x 2 y 2 ) 2 Q � f 0 ; � 1 ; � i g . for some x 2 + y 2 = 2 (1 + x 2 y 2 ) has neutral element (0 ; ), addition x 1 ; y 1 ) + ( x 2 ; y 2 ) = ( x 3 ; y 3 ) with ( x 1 y 2 + y 1 x 2 x 3 = (1 + x 1 x 2 y 1 y 2 ), y 1 y 2 � x 1 x 2 y 3 = (1 � x 1 x 2 y 1 y 2 ).

2007 Bernstein–Lange: k , Over a non-binary finite field x 2 + y 2 = 2 (1 + dx 2 y 2 ) covers more elliptic curves. � with ; d 2 k d 4 Here 6 = 1. x 1 y 2 + y 1 x 2 x 3 = (1 + dx 1 x 2 y 1 y 2 ), y 1 y 2 � x 1 x 2 y 3 = (1 � dx 1 x 2 y 1 y 2 ). = 1. Then Can always take 10 M + 1 S + 1 D for addition, 3 M + 4 S for doubling. Latest news, comparisons: hyperelliptic.org/EFD

Completeness 2007 Bernstein–Lange: d is not a square in k then If f ( x; y ) 2 k � k : x 2 + y 2 = 2 (1 + dx 2 y 2 ) g is a commutative group under this addition law. The denominators (1 + dx 1 x 2 y 1 y 2 ), (1 � dx 1 x 2 y 1 y 2 ) are never zero. No exceptional cases!

Recall Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” on

Recall Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” : : : meaning: on Any addition formula E for a Weierstrass curve in projective coordinates must have exceptional cases E ( k ) � E ( k ), where in k = algebraic closure of k .

Recall Bosma–Lenstra theorem: “The smallest cardinality of a complete system of addition laws E equals two.” : : : meaning: on Any addition formula E for a Weierstrass curve in projective coordinates must have exceptional cases E ( k ) � E ( k ), where in k = algebraic closure of k . Edwards addition formula has E ( k ) exceptional cases for : : : but not for E ( k ). E ( k ). We do computations in

Cryptographic impact Advantages for cryptography of choosing Edwards curves: Very high speed. Completeness eases implementations, avoids simple side-channel attacks.

Cryptographic impact Advantages for cryptography of choosing Edwards curves: Very high speed. Completeness eases implementations, avoids simple side-channel attacks. Oops, hardware people want binary fields! 2008 B.–L.–Rezaeian Farashahi: binary analogue to Edwards curves; complete, very fast.

Still one reason for complaint. Edwards curves always have point of order 4. Standard NIST curves were chosen to have prime order.

Still one reason for complaint. Edwards curves always have point of order 4. Standard NIST curves were chosen to have prime order. NIST curves can’t take advantage of Edwards speed and don’t have complete addition formulas.

Still one reason for complaint. Edwards curves always have point of order 4. Standard NIST curves were chosen to have prime order. NIST curves can’t take advantage of Edwards speed and don’t have complete addition formulas. 2009 Bernstein–Lange, this talk: Have a complete addition law for all of these curves.