Cryptography Reference
In-Depth Information
2.6.3
Edwards Coordinates
In [36], Harold Edwards describes a form for elliptic curves that has certain
computational advantages. The case with
c
=1
,d
=
1 occurs in work of
Euler and Gauss. Edwards restricts to the case
d
= 1. The more general form
has subsequently been discussed by Bernstein and Lange [11].
−
PROPOSITION 2.18
Let
K
be a fi eld of characteristic not 2. Let
c, d ∈ K
with
c, d
=0
and
d
not
asquarein
K
.Thecurve
u
2
+
v
2
=
c
2
(1 +
du
2
v
2
)
C
:
isisom orphictothe ellipticcurve
y
2
=(
x − c
4
d −
1)(
x
2
−
4
c
4
d
)
E
:
viathe change of variables
y
=
4
c
2
(
w
−
c
)+2
c
(
c
4
d
+1)
u
2
u
3
x
=
−
2
c
(
w
−
c
)
u
2
,
,
where
w
=(
c
2
du
2
1)
v
.
Thepoint
(0
,c
)
isthe identityfor the group law on
C
,and the addition law
−
is
(
u
1
,v
1
)+(
u
2
,v
2
)=
u
1
v
2
+
u
2
v
1
u
1
u
2
c
(1
− du
1
u
2
v
1
v
2
)
v
1
v
2
−
c
(1 +
du
1
u
2
v
1
v
2
)
,
for allpoints
(
u
i
,v
i
)
∈ C
(
K
)
.Thenegative of a pointis
−
(
u, v
)=(
−u, v
)
.
PROOF
Write the equation of the curve as
− c
2
=
c
2
du
2
−
1
v
2
=
w
2
c
2
du
2
u
2
1
.
−
This yields the curve
w
2
=
c
2
du
4
(
c
4
d
+1)
u
2
+
c
2
.
−
The formulas in Section 2.5.3 then change this curve to Weierstrass form. The
formula for the addition law can be obtained by a straightforward computa-
tion.
It remains to show that the addition law is defined for all points in
C
(
K
).
In other words, we need to show that the denominators are nonzero. Suppose
Search WWH ::
Custom Search