Prime Numbers

7.2 Elliptic arithmetic 325
with ECM, in which case inversion (mod n) for the composite n can be avoided
altogether.
As for explicit elliptic-curve arithmetic, we shall start for completeness
with option (1), though the operations for this option are easy to infer directly
from Definition 7.1.2. An important note: The operations are given here and
in subsequent algorithms for underlying field F , although further work with
“pseudocurves” as in factorization of composite n involves using the ring Zn
with operations mod n instead of mod p, while extension to fields F p k involves
straightforward polynomial or equivalent arithmetic, and so on.
Algorithm 7.2.2 (Elliptic addition: Affine coordinates). We assume an elliptic
curve E(F ) (see note preceding this algorithm), given by the affine equation
Y 2 = X 3 + aX + b, where a, b ∈ F and the characteristic of the field F is not
equal to 2 or 3. We represent points P as triples (x, y, z), where for an affine point,
z =1and (x, y) lies on the affine curve, and for O, the point at infinity, z =0
(the triples (0, 1, 0), (0, −1, 0), both standing for the same point). This algorithm
provides functions for point negation, doubling, addition, and subtraction.
1. [Elliptic negate function]
neg(P ) return (x, −y, z);
2. [Elliptic double function]
double(P ) return add(P, P);
3. [Elliptic add function]
add(P1,P2){
if(z1 == 0) return P2; // Point P1 = O.
if(z2 == 0) return P1; // Point P2 = O.
if(x1 == x2) {
if(y1 + y2 == 0) return (0, 1, 0); // i.e., return O.
m =(3x 2 1 + a)(2y1) −1 ; // Inversion in the field F .
} else {
m =(y2 − y1)(x2 − x1) −1 ; // Inversion in the field F .
}
x3 = m 2 − x1 − x2;
return (x3,m(x1 − x3) − y1, 1);
}
4. [Elliptic subtract function]
sub(P1,P2) return add(P1,neg(P2));
In the case of option (2) using ordinary projective coordinates, consider
the curve Y 2 Z = X 3 + aXZ 2 + bZ 3 and points Pi =[Xi,Yi,Zi] fori =1, 2.
Rule (5) of Definition 7.1.2, for P1 + P2 when P1 = ±P2 and neither P1,P2 is
O, becomes
P3 = P1 + P2 =[X3,Y3,Z3],
where
X3 = α γ 2 ζ − α 2 β ,