Prime Numbers

332 Chapter 7 ELLIPTIC CURVE ARITHMETIC
2. [Begin Montgomery adding/doubling ladder]
[U : V ]=[X : Z]; // Copy coordinate.
[T : W ]=doubleh([X : Z]);
3. [Loop over bits of n, starting with next-to-highest]
for(B − 2 ≥ j ≥ 0) {
if(nj == 1) {
[U : V ]=addh([T : W ], [U : V ], [X : Z]);
[T : W ]=doubleh([T : W ]);
} else {
[T : W ]=addh([U : V ], [T : W ], [X : Z]);
[U : V ]=doubleh([U : V ]);
}
}
4. [Final calculation]
if(n0 == 1) return addh([U : V ], [T : W ], [X : Y ]);
return doubleh([U : V ]);
Montgomery’s rules when B = 0 make for an efficient algorithm, as can
be seen from the simplification of the addh() and doubleh() function forms.
In particular, the addh() and doubleh() functions can each be done in 9
multiplications. In the case B =0,A= 1, the operation count drops further.
We have noted that to get the affine x-coordinate of [n]P , one must
compute XZ −1 in the field. When n is very large, the single inversion is,
of course, not expensive in comparison. But such inversion can sometimes
be avoided entirely. For example, if, as in factoring studies covered later, we
wish to know whether [n]P =[m]P in the elliptic-curve group, it is enough
to check whether the cross product XnZm − XmZn vanishes, and this is yet
another inversion-free task. Similarly, there is a very convenient fact: If the
point at infinity has been attained by some multiple [n]P = O, then the Z
denominator will have vanished, and any further multiples [mn]P will also
have vanishing Z denominator. Because of this, one need not find the precise
multiple when O is attained; the fact of Z = 0 propagates nicely through
successive applications of the elliptic multiply functions.
We have observed that only x-coordinates of multiples [n]P are processed
in Algorithm 7.2.7, and that ignorance of y values is acceptable in certain
implementations. It is not easy to add two arbitrary points with the
homogeneous coordinate approach above, because of the suppression of y
coordinates. But all is not lost: There is a useful result that tells very quickly
whether the sum of two points can possibly be a given third point. That is,
given merely the x-coordinates of two points P1,P2 the following algorithm
can be used to determine the two x-coordinates for the pair P1 ± P2, although
which of the coordinates goes with the + and which with − will be unknown.