Prime Numbers

324 Chapter 7 ELLIPTIC CURVE ARITHMETIC
Either square root of the residue may be returned, since (x, y) ∈ E(Fp) implies
(x, −y) ∈ E(Fp). Though the algorithm is probabilistic, the method can be
expected to require just a few iterations of the do-loop. There is another
important issue here: For certain problems where the y-coordinate is not
needed, one can always check that some point (x, ?) exists—i.e., that x is
a valid x-coordinate—simply by checking whether the Jacobi symbol
t
p is
not −1.
These means of finding a point on a given curve are useful in primality
proving and cryptography. But there is an interesting modified question: How
can one find both a random curve and a point on said curve? This question
is important in factorization. We defer this algorithm to Section 7.4, where
“pseudocurves” with arithmetic modulo composite n are indicated.
But given a point P , or some collection of points, on a curve E, howdo
we add them pairwise, and most importantly, how do we calculate elliptic
multiples [n]P ? For these operations, there are several ways to proceed:
Option (1): Affine coordinates. Use the fundamental group operations of
Definition 7.1.2 in a straightforward manner, this approach generally involving
an inversion for a curve operation.
Option (2): Projective coordinates. Use the group operations, but for
projective coordinates [X, Y, Z] to avoid inversions. When Z = 0,[X, Y, Z]
corresponds to the affine point (X/Z, Y/Z) on the curve. The point [0, 1, 0] is
O, the point at infinity.
Option (3): Modified projective coordinates. Use triples 〈X, Y, Z〉, whereif
Z = 0, this corresponds to the affine point (X/Z 2 ,Y/Z 3 ) on the curve, plus
the point 〈0, 1, 0〉 corresponding to O, the point at infinity. This system also
avoids inversions, and has a lower operation count than projective coordinates.
Option (4): X, Z coordinates, sometimes called Montgomery coordinates. Use
coordinates [X : Z],whicharethesameastheprojectivecoordinates[X, Y, Z],
but with “Y ” dropped. One can recover the x coordinate of the affine point
when Z = 0asx = X/Z. There are generally two possibilities for y, and
this is left ambiguous. This option tends to work well in elliptic multiplication
and when y-coordinates are not needed at any stage, as sometimes happens
in certain factorization and cryptography work, or when the elliptic algebra
must be carried out in higher domains where coordinates themselves can be
polynomials.
Which of these algorithmic approaches is best depends on various side issues.
For example, assuming an underlying field Fp, if one has a fast inverse (mod p),
one might elect option (1) above. On the other hand, if one has already
implemented option (1) and wishes to reduce the expensive time for a (slow)
inverse, one might move to (2) or (3) with, as we shall see, minor changes in
the algorithm flow. If one wishes to build an implementation from scratch,
option (4) may be indicated, especially in factorization of very large numbers