TY - GEN
T1 - Binary Edwards curves
AU - Bernstein, D.J.
AU - Lange, T.
AU - Rezaeian Farashahi, R.
PY - 2008
Y1 - 2008
N2 - This paper presents a new shape for ordinary elliptic curves
over fields of characteristic 2. Using the new shape, this paper presents
the first complete addition formulas for binary elliptic curves, i.e., addition
formulas that work for all pairs of input points, with no exceptional
cases. If n = 3 then the complete curves cover all isomorphism classes of
ordinary elliptic curves over F2n.
This paper also presents dedicated doubling formulas for these curves
using 2M+ 6S + 3D, where M is the cost of a field multiplication, S is
the cost of a field squaring, and D is the cost of multiplying by a curve
parameter. These doubling formulas are also the first complete doubling
formulas in the literature, with no exceptions for the neutral element,
points of order 2, etc.
Finally, this paper presents complete formulas for differential addition,
i.e., addition of points with known difference. A differential addition and
doubling, the basic step in a Montgomery ladder, uses 5M+ 4S + 2D
when the known difference is given in affine form.
AB - This paper presents a new shape for ordinary elliptic curves
over fields of characteristic 2. Using the new shape, this paper presents
the first complete addition formulas for binary elliptic curves, i.e., addition
formulas that work for all pairs of input points, with no exceptional
cases. If n = 3 then the complete curves cover all isomorphism classes of
ordinary elliptic curves over F2n.
This paper also presents dedicated doubling formulas for these curves
using 2M+ 6S + 3D, where M is the cost of a field multiplication, S is
the cost of a field squaring, and D is the cost of multiplying by a curve
parameter. These doubling formulas are also the first complete doubling
formulas in the literature, with no exceptions for the neutral element,
points of order 2, etc.
Finally, this paper presents complete formulas for differential addition,
i.e., addition of points with known difference. A differential addition and
doubling, the basic step in a Montgomery ladder, uses 5M+ 4S + 2D
when the known difference is given in affine form.
U2 - 10.1007/978-3-540-85053-3_16
DO - 10.1007/978-3-540-85053-3_16
M3 - Conference contribution
SN - 978-3-540-85052-6
T3 - Lecture Notes in Computer Science
SP - 244
EP - 265
BT - Cryptographic Hardware and Embedded Systems - CHES 2008 (10th International Workshop, Washington DC, USA, August 10-13, 2008, Proceedings)
A2 - Oswald, E.
A2 - Rohatgi, P.
PB - Springer
CY - Berlin
ER -