Efficient arithmetic on elliptic curves using a mixed Edwards-Montgomery representation
Wouter Castryck, Steven D. Galbraith⋆, Reza Rezaeian Farashahi · IACR Cryptology ePrint Archive · 2008
From the viewpoint of x-coordinate-only arithmetic on elliptic curves, switching between the Edwards model and the Montgomery model is quasi cost-free. We use this observation to speed up Montgomery’s algorithm, reducing the complexity of a doubling step from 2M + 2S to 1M + 3S for suitably chosen curve parameters. 1 Montgomery’s algorithm Aiming for an improved performance of Lenstra’s elliptic curve factorization method [6], Montgomery developed a very efficient algorithm to compute in the group associated to an elliptic curve over a non-binary finite field Fq, in which only x-coordinates are involved [8]. The algorithm also proves useful for point compression in elliptic curve cryptography. More precisely, instead of sending a point as part of some cryptographic protocol, one can reduce the communication cost by sending just its x-coordinate. From this, the receiver can compute the x-coordinate of any scalar multiple using Montgomery’s method. This idea was first mentioned in [7]. The type of curves Montgomery considered are of the following non-standard Weierstrass type MA,B : By = x +Ax + x, A ∈ Fq {±2}, B ∈ Fq {0}, which is now generally referred to as a Montgomery form. His method works as follows. Let P = (x1, y1, z1) be a point on MA,B , the projective closure of MA,B , and for any n ∈ N write n · P = (xn, yn, zn), where the multiple is taken in the algebraic group MA,B ,⊕ with neutral element O = (0, 1, 0). Then the following recursive relations hold: for any m,n ∈ N such that m 6= n we have xm+n = zm−n ((xm − zm)(xn + zn) + (xm + zm)(xn − zn)) , zm+n = xm−n ((xm − zm)(xn + zn)− (xm + zm)(xn − zn)) . (ADD)