Twisted Hessian curves 1986 ChudnovskyChudnovsky, Sequences of - PowerPoint PPT Presentation

“Our experience shows that the 1990s: ECC standards instead expression of the law of addition use short Weierstrass curves on the cubic Hessian form in Jacobian coordinates (d) of an elliptic curve is for “the fastest arithmetic”. by far the best and the prettiest.” 15 : 2 M for ADD, X 3 = Y 1 X 2 · Y 1 Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. Y 3 = X 1 Z 2 · X 1 Y 2 − Y 1 X 2 · Z 1 X 2 ; Why is this a good idea? Z 3 = Z 1 Y 2 · Z 1 X 2 − X 1 Z 2 · Y 1 Z 2 : 12 M for ADD, where M is the cost of multiplication in the field. 8 : 4 M for DBL, assuming 0 : 8 M for the cost of squaring in the field.

“Our experience shows that the 1990s: ECC standards instead expression of the law of addition use short Weierstrass curves on the cubic Hessian form in Jacobian coordinates (d) of an elliptic curve is for “the fastest arithmetic”. by far the best and the prettiest.” 15 : 2 M for ADD, X 3 = Y 1 X 2 · Y 1 Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. Y 3 = X 1 Z 2 · X 1 Y 2 − Y 1 X 2 · Z 1 X 2 ; Why is this a good idea? Z 3 = Z 1 Y 2 · Z 1 X 2 − X 1 Z 2 · Y 1 Z 2 : Answer: Only 7 : 2 M for DBL with 12 M for ADD, Chudnovsky–Chudnovsky formula. where M is the cost of multiplication in the field. 8 : 4 M for DBL, assuming 0 : 8 M for the cost of squaring in the field.

“Our experience shows that the 1990s: ECC standards instead expression of the law of addition use short Weierstrass curves on the cubic Hessian form in Jacobian coordinates (d) of an elliptic curve is for “the fastest arithmetic”. by far the best and the prettiest.” 15 : 2 M for ADD, X 3 = Y 1 X 2 · Y 1 Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. Y 3 = X 1 Z 2 · X 1 Y 2 − Y 1 X 2 · Z 1 X 2 ; Why is this a good idea? Z 3 = Z 1 Y 2 · Z 1 X 2 − X 1 Z 2 · Y 1 Z 2 : Answer: Only 7 : 2 M for DBL with 12 M for ADD, Chudnovsky–Chudnovsky formula. where M is the cost 2001 Bernstein: 15 M , 7 M . of multiplication in the field. 8 : 4 M for DBL, assuming 0 : 8 M for the cost of squaring in the field.

“Our experience shows that the 1990s: ECC standards instead expression of the law of addition use short Weierstrass curves on the cubic Hessian form in Jacobian coordinates (d) of an elliptic curve is for “the fastest arithmetic”. by far the best and the prettiest.” 15 : 2 M for ADD, X 3 = Y 1 X 2 · Y 1 Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. Y 3 = X 1 Z 2 · X 1 Y 2 − Y 1 X 2 · Z 1 X 2 ; Why is this a good idea? Z 3 = Z 1 Y 2 · Z 1 X 2 − X 1 Z 2 · Y 1 Z 2 : Answer: Only 7 : 2 M for DBL with 12 M for ADD, Chudnovsky–Chudnovsky formula. where M is the cost 2001 Bernstein: 15 M , 7 M . of multiplication in the field. Compared to Hessian, 8 : 4 M for DBL, Weierstrass saves 4 M in typical assuming 0 : 8 M for the cost DBL-DBL-DBL-DBL-DBL-ADD. of squaring in the field.

experience shows that the 1990s: ECC standards instead 2007 Edw ression of the law of addition use short Weierstrass curves 2007 Bernstein–Lange: cubic Hessian form in Jacobian coordinates analyze sp an elliptic curve is for “the fastest arithmetic”. the best and the prettiest.” 15 : 2 M for ADD, Y 1 X 2 · Y 1 Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. X 1 Z 2 · X 1 Y 2 − Y 1 X 2 · Z 1 X 2 ; Why is this a good idea? Z 1 Y 2 · Z 1 X 2 − X 1 Z 2 · Y 1 Z 2 : Answer: Only 7 : 2 M for DBL with for ADD, Chudnovsky–Chudnovsky formula. M is the cost 2001 Bernstein: 15 M , 7 M . Example: multiplication in the field. Compared to Hessian, Sum of ( for DBL, Weierstrass saves 4 M in typical (( x 1 y 2 + assuming 0 : 8 M for the cost DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x squaring in the field.

� shows that the 1990s: ECC standards instead 2007 Edwards: new law of addition use short Weierstrass curves 2007 Bernstein–Lange: Hessian form in Jacobian coordinates analyze speed, com curve is for “the fastest arithmetic”. y and the prettiest.” 15 : 2 M for ADD, neutral • Z 2 − Z 1 Y 2 · X 1 Y 2 ; much slower than Hessian. P • Y 2 − Y 1 X 2 · Z 1 X 2 ; ☞ Why is this a good idea? ☞ ☞ ❢ ❢ X 2 − X 1 Z 2 · Y 1 Z 2 : ❢ ❢ ☞ ❬ ❬ ❬ ❬ Answer: Only 7 : 2 M for DBL with Chudnovsky–Chudnovsky formula. cost 2001 Bernstein: 15 M , 7 M . Example: x 2 + y 2 in the field. Compared to Hessian, Sum of ( x 1 ; y 1 ) and Weierstrass saves 4 M in typical (( x 1 y 2 + y 1 x 2 ) = (1 − for the cost DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 the field.

� � that the 1990s: ECC standards instead 2007 Edwards: new curve shap addition use short Weierstrass curves 2007 Bernstein–Lange: generalize, in Jacobian coordinates analyze speed, completeness. for “the fastest arithmetic”. y rettiest.” 15 : 2 M for ADD, neutral = (0 ; • · X 1 Y 2 ; much slower than Hessian. P 1 = ( x 1 ; y • · Z 1 X 2 ; ☞ Why is this a good idea? P 2 = ( x ☞ • ❢ ☞ ❢ ❢ · Y 1 Z 2 : ❢ x ❢ ☞ ❬ ❬ ❬ ❬ ❬ ❬ • Answer: Only 7 : 2 M for DBL with P 3 = ( Chudnovsky–Chudnovsky formula. 2001 Bernstein: 15 M , 7 M . Example: x 2 + y 2 = 1 − 30 x field. Compared to Hessian, Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) Weierstrass saves 4 M in typical (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 cost DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1

� � 1990s: ECC standards instead 2007 Edwards: new curve shape. use short Weierstrass curves 2007 Bernstein–Lange: generalize, in Jacobian coordinates analyze speed, completeness. for “the fastest arithmetic”. y 15 : 2 M for ADD, neutral = (0 ; 1) • much slower than Hessian. P 1 = ( x 1 ; y 1 ) • ☞ Why is this a good idea? P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ❢ ❬ ☞ ❬ ❬ ❬ ❬ ❬ • Answer: Only 7 : 2 M for DBL with P 3 = ( x 3 ; y 3 ) Chudnovsky–Chudnovsky formula. 2001 Bernstein: 15 M , 7 M . Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Compared to Hessian, Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is Weierstrass saves 4 M in typical (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � ECC standards instead 2007 Edwards: new curve shape. 2007 Bernstein–Lange: short Weierstrass curves 2007 Bernstein–Lange: generalize, 10 : 8 M fo Jacobian coordinates analyze speed, completeness. e fastest arithmetic”. y for ADD, neutral = (0 ; 1) • slower than Hessian. P 1 = ( x 1 ; y 1 ) • ☞ is this a good idea? P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ☞ ❬ ❢ ❬ ❬ ❬ ❬ ❬ • er: Only 7 : 2 M for DBL with P 3 = ( x 3 ; y 3 ) Chudnovsky–Chudnovsky formula. Bernstein: 15 M , 7 M . Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Compared to Hessian, Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is eierstrass saves 4 M in typical (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � standards instead 2007 Edwards: new curve shape. 2007 Bernstein–Lange: eierstrass curves 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 rdinates analyze speed, completeness. arithmetic”. y ADD, neutral = (0 ; 1) • than Hessian. P 1 = ( x 1 ; y 1 ) • ☞ od idea? P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ☞ ❬ ❢ ❬ ❬ ❬ ❬ ❬ • 2 M for DBL with P 3 = ( x 3 ; y 3 ) Chudnovsky–Chudnovsky formula. 15 M , 7 M . Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Hessian, Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is saves 4 M in typical (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � instead 2007 Edwards: new curve shape. 2007 Bernstein–Lange: rves 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. analyze speed, completeness. rithmetic”. y neutral = (0 ; 1) • n. P 1 = ( x 1 ; y 1 ) • ☞ P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ❬ ❢ ☞ ❬ ❬ ❬ ❬ ❬ • BL with P 3 = ( x 3 ; y 3 ) formula. . Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is ypical (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), DBL-DBL-DBL-DBL-DBL-ADD. ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � 2007 Edwards: new curve shape. 2007 Bernstein–Lange: 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. analyze speed, completeness. y neutral = (0 ; 1) • P 1 = ( x 1 ; y 1 ) • ☞ P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ☞ ❬ ❢ ❬ ❬ ❬ ❬ ❬ • P 3 = ( x 3 ; y 3 ) Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � 2007 Edwards: new curve shape. 2007 Bernstein–Lange: 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. analyze speed, completeness. 2008 Hisil–Wong–Carter–Dawson: y just 8 M for ADD. neutral = (0 ; 1) • P 1 = ( x 1 ; y 1 ) • ☞ P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ❢ ❬ ☞ ❬ ❬ ❬ ❬ ❬ • P 3 = ( x 3 ; y 3 ) Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � 2007 Edwards: new curve shape. 2007 Bernstein–Lange: 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. analyze speed, completeness. 2008 Hisil–Wong–Carter–Dawson: y just 8 M for ADD. neutral = (0 ; 1) • P 1 = ( x 1 ; y 1 ) • ☞ P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ❢ ❬ ☞ ❬ ❬ ❬ ❬ ❬ • P 3 = ( x 3 ; y 3 ) Example: x 2 + y 2 = 1 − 30 x 2 y 2 . Sum of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is (( x 1 y 2 + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), ( y 1 y 2 − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� � Edwards: new curve shape. 2007 Bernstein–Lange: Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. analyze speed, completeness. 2008 Hisil–Wong–Carter–Dawson: y just 8 M for ADD. neutral = (0 ; 1) • P 1 = ( x 1 ; y 1 ) • ☞ P 2 = ( x 2 ; y 2 ) ☞ • ❢ ☞ ❢ ❢ ❢ x ❢ ❬ ☞ ❬ ❬ ❬ ❬ ❬ • P 3 = ( x 3 ; y 3 ) y 2 = x 3 Example: x 2 + y 2 = 1 − 30 x 2 y 2 . of ( x 1 ; y 1 ) and ( x 2 ; y 2 ) is + y 1 x 2 ) = (1 − 30 x 1 x 2 y 1 y 2 ), − x 1 x 2 ) = (1+30 x 1 x 2 y 1 y 2 )).

� new curve shape. 2007 Bernstein–Lange: Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. completeness. 2008 Hisil–Wong–Carter–Dawson: just 8 M for ADD. neutral = (0 ; 1) P 1 = ( x 1 ; y 1 ) • P 2 = ( x 2 ; y 2 ) • ❢ ❢ x ❬ ❬ ❬ • P 3 = ( x 3 ; y 3 ) y 2 = x 3 − 0 : 4 x + 2 = 1 − 30 x 2 y 2 . and ( x 2 ; y 2 ) is (1 − 30 x 1 x 2 y 1 y 2 ), (1+30 x 1 x 2 y 1 y 2 )).

shape. 2007 Bernstein–Lange: generalize, 10 : 8 M for ADD, 6 : 2 M for DBL. teness. 2008 Hisil–Wong–Carter–Dawson: just 8 M for ADD. (0 ; 1) ; y 1 ) ( x 2 ; y 2 ) x ( x 3 ; y 3 ) y 2 = x 3 − 0 : 4 x + 0 : 7 30 x 2 y 2 . 2 ) is y 1 y 2 ), y 1 y 2 )).

2007 Bernstein–Lange: 10 : 8 M for ADD, 6 : 2 M for DBL. 2008 Hisil–Wong–Carter–Dawson: just 8 M for ADD. y 2 = x 3 − 0 : 4 x + 0 : 7

Bernstein–Lange: for ADD, 6 : 2 M for DBL. Hisil–Wong–Carter–Dawson: M for ADD. y 2 = x 3 − 0 : 4 x + 0 : 7

Bernstein–Lange: ADD, 6 : 2 M for DBL. ong–Carter–Dawson: ADD. y 2 = x 3 − 0 : 4 x + 0 : 7

DBL. rter–Dawson: y 2 = x 3 − 0 : 4 x + 0 : 7

y 2 = x 3 − 0 : 4 x + 0 : 7

x 2 + y 2 3 − 0 : 4 x + 0 : 7

x 2 + y 2 = 1 − 300 + 0 : 7

x 2 + y 2 = 1 − 300 x 2 y 2

x 2 + y 2 = 1 − 300 x 2 y 2

x 2 + y 2 = 1 − 300 x 2 y 2

x 2 + y 2 = 1 − 300 x 2 y 2

x 2 + y 2 = 1 − 300 x 2 y 2

x 2 + y 2 = 1 − 300 x 2 y 2

2 = 1 − 300 x 2 y 2 x 2 = y 4

x 2 = y 4 − 1 : 9 y 2 + 300 x 2 y 2

x 2 = y 4 − 1 : 9 y 2 + 1

x 2 = y 4 − 1 : 9 y 2 + 1

x 2 = y 4 − 1 : 9 y 2 + 1

x 2 = y 4 − 1 : 9 y 2 + 1

x 2 = y 4 − 1 : 9 y 2 + 1

x 2 = y 4 − 1 : 9 y 2 + 1

4 − 1 : 9 y 2 + 1 x 3 − y 3 +

x 3 − y 3 + 1 = 0 : 3 xy + 1

x 3 − y 3 + 1 = 0 : 3 xy

x 3 − y 3 + 1 = 0 : 3 xy

x 3 − y 3 + 1 = 0 : 3 xy

x 3 − y 3 + 1 = 0 : 3 xy

x 3 − y 3 + 1 = 0 : 3 xy

x 3 − y 3 + 1 = 0 : 3 xy

3 + 1 = 0 : 3 xy

: 3 xy

Faster Hessian 2007 Hisil–Ca 7 : 8 M for

Faster Hessian arithmetic 2007 Hisil–Carter–Da 7 : 8 M for DBL.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL. 2010 Hisil: 11 M for ADD.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL. 2010 Hisil: 11 M for ADD. Hessian tied with Weierstrass for DBL-DBL-DBL-DBL-DBL-ADD. Need to zoom in closer: analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL. 2010 Hisil: 11 M for ADD. Hessian tied with Weierstrass for DBL-DBL-DBL-DBL-DBL-ADD. Need to zoom in closer: analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more.

Faster Hessian arithmetic 2007 Hisil–Carter–Dawson: 7 : 8 M for DBL. 2010 Hisil: 11 M for ADD. Hessian tied with Weierstrass for DBL-DBL-DBL-DBL-DBL-ADD. Need to zoom in closer: analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more. New: 7 : 6 M for DBL.

Faster Hessian arithmetic New (announced 2007 Hisil–Carter–Dawson: Generalize 7 : 8 M for DBL. twisted aX 3 + Y 2010 Hisil: 11 M for ADD. with a (27 Hessian tied with Weierstrass for 2007 7 : 8 DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M Need to zoom in closer: new 7 : 6 M analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more. New: 7 : 6 M for DBL.

Faster Hessian arithmetic New (announced July 2007 Hisil–Carter–Dawson: Generalize to more 7 : 8 M for DBL. twisted Hessian curves aX 3 + Y 3 + Z 3 = 2010 Hisil: 11 M for ADD. with a (27 a − d 3 ) � = Hessian tied with Weierstrass for 2007 7 : 8 M DBL idea DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, Need to zoom in closer: new 7 : 6 M DBL generalizes. analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more. New: 7 : 6 M for DBL.

Faster Hessian arithmetic New (announced July 2009): 2007 Hisil–Carter–Dawson: Generalize to more curves: 7 : 8 M for DBL. twisted Hessian curves aX 3 + Y 3 + Z 3 = dXY Z 2010 Hisil: 11 M for ADD. with a (27 a − d 3 ) � = 0. Hessian tied with Weierstrass for 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, Need to zoom in closer: new 7 : 6 M DBL generalizes. analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more. New: 7 : 6 M for DBL.

Faster Hessian arithmetic New (announced July 2009): 2007 Hisil–Carter–Dawson: Generalize to more curves: 7 : 8 M for DBL. twisted Hessian curves aX 3 + Y 3 + Z 3 = dXY Z 2010 Hisil: 11 M for ADD. with a (27 a − d 3 ) � = 0. Hessian tied with Weierstrass for 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, Need to zoom in closer: new 7 : 6 M DBL generalizes. analyze exact S = M , overhead for checking for special cases, extra DBL, extra ADD, etc. Or speed up Hessian more. New: 7 : 6 M for DBL.

Faster Hessian arithmetic New (announced July 2009): 2007 Hisil–Carter–Dawson: Generalize to more curves: 7 : 8 M for DBL. twisted Hessian curves aX 3 + Y 3 + Z 3 = dXY Z 2010 Hisil: 11 M for ADD. with a (27 a − d 3 ) � = 0. Hessian tied with Weierstrass for 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, Need to zoom in closer: new 7 : 6 M DBL generalizes. analyze exact S = M , overhead Rotate addition law for checking for special cases, so that it also works for DBL; extra DBL, extra ADD, etc. complete if a is not a cube. Or speed up Hessian more. Eliminates special-case overhead, helps stop side-channel attacks. New: 7 : 6 M for DBL.

Hessian arithmetic New (announced July 2009): Triplings Hisil–Carter–Dawson: Generalize to more curves: TPL is P for DBL. twisted Hessian curves 2007 Hisil–Ca aX 3 + Y 3 + Z 3 = dXY Z Hisil: 11 M for ADD. 12 : 8 M fo with a (27 a − d 3 ) � = 0. Hessian tied with Weierstrass for Generalizes 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, to zoom in closer: new 7 : 6 M DBL generalizes. analyze exact S = M , overhead Rotate addition law hecking for special cases, so that it also works for DBL; DBL, extra ADD, etc. complete if a is not a cube. eed up Hessian more. Eliminates special-case overhead, helps stop side-channel attacks. 7 : 6 M for DBL.

rithmetic New (announced July 2009): Triplings (assuming rter–Dawson: Generalize to more curves: TPL is P �→ 3 P . twisted Hessian curves 2007 Hisil–Carter–Da aX 3 + Y 3 + Z 3 = dXY Z for ADD. 12 : 8 M for Hessian with a (27 a − d 3 ) � = 0. with Weierstrass for Generalizes to twisted 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, closer: new 7 : 6 M DBL generalizes. M , overhead Rotate addition law special cases, so that it also works for DBL; ADD, etc. complete if a is not a cube. Hessian more. Eliminates special-case overhead, helps stop side-channel attacks. DBL.

New (announced July 2009): Triplings (assuming d � = 0) wson: Generalize to more curves: TPL is P �→ 3 P . twisted Hessian curves 2007 Hisil–Carter–Dawson: aX 3 + Y 3 + Z 3 = dXY Z . 12 : 8 M for Hessian TPL. with a (27 a − d 3 ) � = 0. eierstrass for Generalizes to twisted Hessian. 2007 7 : 8 M DBL idea fails, but DBL-DBL-DBL-DBL-DBL-ADD. 2010 11 M ADD generalizes, new 7 : 6 M DBL generalizes. overhead Rotate addition law cases, so that it also works for DBL; etc. complete if a is not a cube. re. Eliminates special-case overhead, helps stop side-channel attacks.

New (announced July 2009): Triplings (assuming d � = 0) Generalize to more curves: TPL is P �→ 3 P . twisted Hessian curves 2007 Hisil–Carter–Dawson: aX 3 + Y 3 + Z 3 = dXY Z 12 : 8 M for Hessian TPL. with a (27 a − d 3 ) � = 0. Generalizes to twisted Hessian. 2007 7 : 8 M DBL idea fails, but 2010 11 M ADD generalizes, new 7 : 6 M DBL generalizes. Rotate addition law so that it also works for DBL; complete if a is not a cube. Eliminates special-case overhead, helps stop side-channel attacks.

New (announced July 2009): Triplings (assuming d � = 0) Generalize to more curves: TPL is P �→ 3 P . twisted Hessian curves 2007 Hisil–Carter–Dawson: aX 3 + Y 3 + Z 3 = dXY Z 12 : 8 M for Hessian TPL. with a (27 a − d 3 ) � = 0. Generalizes to twisted Hessian. 2007 7 : 8 M DBL idea fails, but 2015 Kohel: 11 : 2 M . 2010 11 M ADD generalizes, new 7 : 6 M DBL generalizes. Rotate addition law so that it also works for DBL; complete if a is not a cube. Eliminates special-case overhead, helps stop side-channel attacks.