Prime Numbers

7.2 Elliptic arithmetic 331
the “h” in the function name emphasizing the homogeneous nature of each
[X : Z] pair. The definition of addh can easily be extended to any case where
X−Z− = 0. That is, it is possible to allow one of [X1 : Z1], [X2 : Z2] tobe
[0 : 0]. In particular, if [X1 : Z1] = [0 : 0] and [X2 : Z2] is not [0 : 0], then we
may define addh([0 : 0], [X2 : Z2], [X2 : Z2]) as [X2 : Z2] (and so not use the
above equations). We may proceed similarly if [X2 : Z2] = [0 : 0] and [X1 : Z1]
is not [0 : 0]. In the case of P1 = P2, we have a doubling function
where
[X+ : Z+] =doubleh([X1 : Z1]),
X+ = X 2 1 − AZ 22 1 − 4B(2X1 + CZ1)Z 3 1,
3
Z+ =4Z1 X1 + CX 2 1 Z1 + AX1Z 2 1 + BZ 3 1 .
(7.7)
The function doubleh works in all cases, even [X1 : Z1] = [0 : 0]. Let us see,
for example, how we might compute [X : Z] for [13]P ,withP a point on an
elliptic curve. Say [k]P =[Xk : Yk]. We have
[13]P = ([2]([2]P ) + ([2]P + P )) + ([2]([2]P + P )),
which is computed as follows:
[X2 : Z2] =doubleh([X1 : Z1]),
[X3 : Z3] =addh([X2 : Z2], [X1 : Z1], [X1 : Z1]),
[X4 : Z4] =doubleh([X2 : Z2]),
[X6 : Z6] =doubleh([X3 : Z3]),
[X7 : Z7] =addh([X4 : Z4], [X3 : Z3], [X1 : Z1]),
[X13 : Z13] =addh([X7 : Z7], [X6 : Z6], [X1 : Z1]).
(For this to be accurate, we must assume that X1 = 0.) In general, we may
use the following algorithm, which essentially contains within it Algorithm
3.6.7 for computing a Lucas chain.
Algorithm 7.2.7 (Elliptic multiplication: Montgomery method). This algorithm
assumes functions addh() and doubleh() as described above and attempts
to perform the elliptic multiplication of nonnegative integer n by point
P =[X : any : Z], inE(F ), with XZ = 0, returning the [X : Z] coordinates of
[n]P . We assume a B-bit binary representation of n>0 as a sequence of bits
(nB−1,...,n0).
1. [Initialize]
if(n == 0) return O; //Pointatinfinity.
if(n == 1) return [X : Z]; // Return the original point P .
if(n == 2) return doubleh([X : Z]);