Prime Numbers

7.2 Elliptic arithmetic 329
Before we discuss option (4) for elliptic arithmetic, we bring in an
extraordinarily useful idea, one that has repercussions far beyond option (4).
Definition 7.2.5. If E(F ) is an elliptic curve over a field F ,governedby
the equation y 2 = x 3 + Cx 2 + Ax + B, andg isanonzeroelementofF ,
then the quadratic twist of E by g is the elliptic curve over F governed by the
equation gy 2 = x 3 +Cx 2 +Ax+B. By a change of variables X = gx, Y = g 2 y,
the Weierstrass form for this twist curve is Y 2 = X 3 + gCX 2 + g 2 AX + g 3 B.
We shall find that in some contexts it will be useful to leave the curve in the
form gy 2 = x 3 + Cx 2 + Ax + B, and in other contexts, we shall wish to use
the equivalent Weierstrass form.
An immediate observation is that if g, h are nonzero elements of the field
F , then the quadratic twist of an elliptic curve by g gives a group isomorphic
to the quadratic twist of the curve by gh 2 . (Indeed, just let a new variable Y
be hy. To see that the groups are isomorphic, a simple check of the formulae
involved suffices.) Thus, if Fq is a finite field, there is really only one quadratic
twist of an elliptic curve E(Fq) that is different from the curve itself. This
follows, since if g is not a square in Fq, thenash runs over the nonzero
elements of Fq, gh 2 runs over all of the nonsquares. This unique nontrivial
quadratic twist of E(Fq) is sometimes denoted by E ′ (Fq), especially when we
are not particularly interested in which nonsquare is involved in the twist.
Now for option (4), homogeneous coordinates with “Y ” dropped. We shall
discuss this for a twist curve gy 2 = x 3 +Cx 2 +Ax+B; see Definition 7.2.5. We
first develop the idea using affine coordinates. Suppose P1,P2 are affine points
on an elliptic curve E(F )withP1 = ±P2. One can write down via Definition
7.1.2 (generalized for the presence of “g”) expressions for x+,x−, namely,
the x-coordinates of P1 + P2 and P1 − P2, respectively. If these expressions
are multiplied, one sees that the y-coordinates of P1,P2 appear only to even
powers, and so may be replaced by x-expressions, using the defining curve
gy 2 = x 3 + Cx 2 + Ax + B. Somewhat miraculously the resulting expression
is subject to much cancellation, including the disappearance of the parameter
g. The equations are stated in the following result from [Montgomery 1987,
1992a], though we generalize them here to a quadratic twist of any curve that
is given by equation (7.5).
Theorem 7.2.6 (Generalized Montgomery identities). Given an elliptic
curve E determined by the cubic
gy 2 = x 3 + Cx 2 + Ax + B,
and two points P1 =(x1,y1), P2 =(x2,y2), neither being O, denote by x±
respectively the x-coordinates of P1 ± P2. Then if x1 = x2, we have
x+x− = (x1x2 − A) 2 − 4B(x1 + x2 + C)
(x1 − x2) 2 ,