Prime Numbers

328 Chapter 7 ELLIPTIC CURVE ARITHMETIC
for the elliptic add function, the value W 2 used for X3 is recalled in the
calculation of W 3 needed for Y3, asisthevalueofTW 2 .Ifsuchcareis
taken, the function double() consumes 10 field multiplications. (However, for
small a or the special case a = −3 in the field, this count of 10 can be
reduced further; see Exercise 7.10.) The general addition function add(), on
the other hand, requires 16 field multiplications, but there is an important
modification of this estimate: When Z1 = 1 only 11 multiplies are required.
And this side condition is very common; in fact, it is forced to hold within
certain classes of multiplication ladders. (In the case of ordinary projective
coordinates discussed before Algorithm 7.2.3 assuming Z1 = 1 reduces the 14
multiplies necessary for general addition also to 11.)
Having discussed options (1), (2), (3) for elliptic arithmetic, we are now
at an appropriate juncture to discuss elliptic multiplication, the problem of
evaluating [n]P for integer n acting on points P ∈ E. One can, of course, use
Algorithm 2.1.5 for this purpose. However, since doubling is so much cheaper
than adding two unequal points, and since subtracting has the same cost
as adding, the method of choice is a modified binary ladder, the so-called
addition–subtraction ladder. For most numbers n the ratio of doublings to
addition–subtraction operations is higher than for standard binary ladders
as in Algorithm 2.1.5, and the overall number of calls to elliptic arithmetic
is lower. Such a method is good whenever the group inverse (i.e., negation)
is easy—for elliptic curves one just flips the sign of the y-coordinate. (Note
that a yet different ladder approach to elliptic multiplication will be exhibited
later, as Algorithm 7.2.7.)
Algorithm 7.2.4 (Elliptic multiplication: Addition–subtraction ladder).
This algorithm assumes functions double(),add(),sub() from either Algorithm
7.2.2 or 7.2.3, and performs the elliptic multiplication [n]P for nonnegative integer
n and point P ∈ E. We assume a B-bit binary representation of m =3n as a
sequence of bits (mB−1,...,m0), and a corresponding B-bit representation (nj)
for n (which representation is zero-padded on the left to B bits), with B =0for
n =0understood.
1. [Initialize]
if(n == 0) return O; //Pointatinfinity.
Q = P ;
2. [Compare bits of 3n, n]
for(B − 2 ≥ j ≥ 1) {
Q = double(Q);
if((mj,nj) ==(1, 0)) Q = add(Q, P );
if((mj,nj) ==(0, 1)) Q = sub(Q, P );
}
return Q;
The proof that this algorithm works is encountered later as Exercise 9.30.
There is a fascinating open research area concerning the best way to construct
a ladder. See Exercise 9.77 in this regard.