Prime Numbers

330 Chapter 7 ELLIPTIC CURVE ARITHMETIC
whereas if x1 = x2 and 2P1 = O, we have
x+ = (x2 1 − A) 2 − 4B(2x1 + C)
4(x 3 1 + Cx2 1 + Ax1 + B) .
Note that g is irrelevant in the theorem, in the sense that the algebra for
combining x-coordinates is independent of g; in fact, one would only use g if a
particular starting y-coordinate were involved, but of course the main thrust of
Montgomery parameterization is to ignore y-coordinates. We remind ourselves
that the case C = 0 reduces to the ordinary Weierstrass form given by (7.4).
However, as Montgomery noted, the case B = 0 is especially pleasant: For
example, we have the simple relation
x+x− = (x1x2 − A) 2
.
(x1 − x2) 2
We shall see in what follows how this sort of relation leads to computationally
efficient elliptic algebra.
The idea is to use an addition chain to arrive at [n]P , where whenever
we are to add two unequal points P1,P2, we happen to know already what
P1 − P2 is. This magic is accomplished via the Lucas chain already discussed
in Section 3.6.3. In the current notation, we will have at intermediate steps a
pair [k]P, [k +1]P , and from this we shall form either the pair [2k]P, [2k +1]P
or the pair [2k +1]P, [2k +2]P , depending on the bits of n. In either case,
we perform one doubling and one addition. And for the addition, we already
know the difference of the two points added, namely P itself.
To avoid inversions, we adopt the homogeneous coordinates of option (2),
but we drop the “Y ” coordinate. Since the coordinates are homogeneous, when
we have the pair [X : Z], it is only the ratio X/Z that is determined (when
Z = 0). The point at infinity is recognized as the pair [0 : 0]. Suppose we
have points P1,P2 in homogeneous coordinates on an elliptic curve given by
equation (7.5), and P1,P2 are not O, P1 = P2. If
P1 =[X1,Y1,Z1], P2 =[X2,Y2,Z2],
P1 + P2 =[X+,Y+,Z+], P1 − P2 =[X−,Y−,Z−],
then on the basis of Theorem 7.2.6 it is straightforward to establish, in the
case that X− = 0, that we may take
X+ = Z− (X1X2 − AZ1Z2) 2
− 4B(X1Z2 + X2Z1 + CZ1Z2)Z1Z2 ,
(7.6)
Z+ = X−(X1Z2 − X2Z1) 2 .
These equations define the pair X+,Z+ as a function of the six quantities
X1,Z1,X2, Z2,X−,Z−, withY1,Y2 being completely irrelevant. We denote
this function by
[X+ : Z+] =addh([X1 : Z1], [X2 : Z2], [X− : Z−]),