The Basic Theory - Elliptic Curves: Number Theory and Cryptography - page 49

The proof that this addition law is associative is the same as that given in
Section 2.4. The points on E , including , therefore form an abelian group.

Since we will need it later, let's look at the formula for doubling a point in
characteristic 2. To keep the formulas from becoming too lengthy, we'll treat
separately the two cases obtained above.

∞

1. y 2 + xy = x 3 + a 2 x 2 + a 6 . Rewrite this as y 2 + xy + x 3 + a 2 x 2 + a 6 =0
(remember, we are in characteristic 2). Implicit differentiation yields

xy +( y + x 2 )=0

(since 2 = 0 and 3 = 1). Therefore the slope of the line L through
P =( x 0 ,y 0 )is m =( y 0 + x 0 ) /x 0 . The line is

y = m ( x − x 0 )+ y 0 = mx + b

for some b . Substitute to find the intersection ( x 1 ,y 1 )of L and E :

0=( mx + b ) 2 + x ( mx + b )+ x 3 + a 2 x 2 + a 6 = x 3 +( m 2 + m + a 2 ) x 2 + ··· .

The sum x 0 + x 0 + x 1 of the roots is ( m 2 + m + a 2 ), so we obtain

x 1 = m 2 + m + a 2 = y 0 + x 0 + x 0 y 0 + x 0 + a 2 x 0

= x 0 + a 6

x 0 x 0

(since y 0 = x 0 y 0 + x 0 + a 2 x 0 + a 6 ). The y -coordinate of the intersection
is y 1 = m ( x 1 − x 0 )+ y 0 .Thepoint( x 1 ,y 1 )equals − 2 P . Therefore
2 P =( x 2 ,y 2 ), with

x 2 =( x 0 + a 6 ) /x 0 , 2 = − x 1 − y 1 = x 1 + y 1 .

2. y 2 + a 3 y = x 3 + a 4 x + a 6 . Rewrite this as y 2 + a 3 y + x 3 + a 4 x + a 6 =0.
Implicit differentiation yields

a 3 y +( x 2 + a 4 )=0 .

Therefore the tangent line L is

m = x 0 + a 4
a 3

y = m ( x − x 0 )+ y 0 , .

with

Substituting and solving, as before, finds the point of intersection ( x 1 ,y 1 )
of L and E ,where

x 1 = m 2 = x 0 + a 4

a 3

and y 1 = m ( x 1 − x 0 )+ y 0 . Therefore, 2 P =( x 2 ,y 2 ) with

x 2 =( x 0 + a 4 ) /a 3 , 2 = a 3 + y 1 .