Prime Numbers

326 Chapter 7 ELLIPTIC CURVE ARITHMETIC
and
Y3 = 1 2 2 3
γ 3α β − γ ζ − α δ ,
2
Z3 = α 3 ζ,
α = X2Z1 − X1Z2, β = X2Z1 + X1Z2,
γ = Y2Z1 − Y1Z2, δ = Y2Z1 + Y1Z2, ζ = Z1Z2.
By holding on to the intermediate calculations of α 2 ,α 3 ,α 2 β,γ 2 ζ, the
coordinates of P1 +P2 may be computed in 14 field multiplications and 8 field
additions (multiplication by 1/2 can generally be accomplished by a shift or
an add and a shift). In the case of doubling a point by rule (5), if [2]P = O,
the projective equations for
are
where
[2]P = [2][X, Y, Z] =[X ′ ,Y ′ ,Z ′ ]
X ′ = ν(µ 2 − 2λν),
Y ′ = µ 3λν − µ 2 − 2Y 2
1 ν 2 ,
Z ′ = ν 3 ,
λ =2XY, µ =3X 2 + aZ 2 , ν =2YZ.
So doubling can be accomplished in 13 field multiplications and 4 field
additions. In both adding and doubling, no field inversions of variables are
necessary.
When using projective coordinates and starting from a given affine point
(u, v), one easily creates projective coordinates by tacking on a 1 at the end,
namely, creating the projective point [u, v, 1]. If one wishes to recover an
affine point from [X, Y, Z] at the end of a long calculation, and if this is not
the point at infinity, one computes Z −1 in the field, and has the affine point
(XZ −1 ,YZ −1 ).
We shall see that option (3) also avoids field inversions. In comparison with
option (2), the addition for option (3) is more expensive, but the doubling for
option (3) is cheaper. Since in a typical elliptic multiplication [n]P we would
expect about twice as many doublings as additions, one can see that option (3)
could well be preferable to option (2). Recalling the notation, we understand
〈X, Y, Z〉 to be the affine point (X/Z 2 ,Y/Z 3 )ony 2 = x 3 + ax + b if Z = 0,
and we understand 〈0, 1, 0〉 to be the point at infinity. Again, if we start with
an affine point (u, v) on the curve and wish to convert to modified projective
coordinates, we just tack on a 1 at the end, creating the point 〈u, v, 1〉. Andif
one has a modified projective point 〈X, Y, Z〉 that is not the point at infinity,
and one wishes to find the affine point corresponding to it, one computes
Z −1 ,Z −2 ,Z −3 and the affine point (XZ −2 ,YZ −3 ). The following algorithm
performs the algebra for modified projective coordinates, option (3).