Determining Formulas Related to Point Compression on Alternative Models of Elliptic Curves

Abstract

Let E be an elliptic curve given by any model over a field K. A rational function f : E → K of degree 2 such that f(P) = f(Q) ⇔ Q = ±P can be used as a point compression on E. Then there exists induced from E multiplication of values of f by integers given by [n]f(P) := f([n]P), which can be computed using the Montgomery ladder algorithm. For this algorithm one needs the generalized Montgomery formulas for differential addition and doubling that is rational functions A(X1, X2, X3) ∈ K(X1, X2, X3) and [2] ∈ K(X) such that f(P + Q) = A(f(P), f(Q), f(Q − P)) and [2]f(P) = f([2]P) for generic P,Q ∈ E. For most standard models of elliptic curves generalized Montgomery formulas are known. To use compression for scalar multiplication [n]P for P ∈ E, one can compute after compression [n]f(P), which is followed by [n + 1]f(P) in the Montgomery ladder algorithm, then one can recover [n]P on E, since there exists a rational map B such that [n]P = B(P, [n]f(P), [n + 1]f(P)) for generic P ∈ E and n ∈ Z. Such a map B is known for Weierstrass and Edwards curves, but to our knowledge it seems that it was not given for other models of elliptic curves. In this paper for an elliptic curve E and the above compression function f we give an algorithm to search for generalized Montgomery formulas, functions on K induced after compression by endomorphisms of E, and the above map B for point recovering. All these tasks require searching for solutions of similar type problems for which we describe an algorithm based on Gröbner bases. As applications we give formulas for differential addition, doubling and the above map B for Jacobi quartic, Huff curves, and twisted Hessian curves.

International Journal of Electronics and Telecommunications

“…Proof. Formula (35) can be mechanically obtained from (9) by substitutions (32). Similarly we can derive the doubling formula (36) from (10) and the point recovery formula (37) from (11).…”

“…Peter Montgomery [3] provided very efficient formulas for doubling and differential addition using x-coordinates for curves of the form By 2 = x 3 + Ax 2 + x called Montgomery's curves. Formulas (1) and ( 2) or (3) were also given for other standard models of elliptic curves: Weierstrass [4], Edwards [5], [6], Hessian [7], Jacobi quartic [8], [9], twisted Hessian and Huff's [9] curves. Formulas for point recovery (4) were given for Weierstrass [8], [10], Edwards [6], generalized and twisted Hessian, Huff's and Jacobi quartic [9] curves.…”

“…Formulas (1) and ( 2) or (3) were also given for other standard models of elliptic curves: Weierstrass [4], Edwards [5], [6], Hessian [7], Jacobi quartic [8], [9], twisted Hessian and Huff's [9] curves. Formulas for point recovery (4) were given for Weierstrass [8], [10], Edwards [6], generalized and twisted Hessian, Huff's and Jacobi quartic [9] curves.…”

“…In this paper for Huff's curves and general Huff's curves over a field K of char(K) = 2 using compression function f (x, y) = xy, we introduce new formulas for doubling and differential addition, which for Huff's curves are as efficient as Montgomery's formulas for the curves By 2 = x 3 +Ax 2 +x (note that in [9] we used compression function y/x on Huff's curves). These formulas and formulas for point recovery are provided in Theorems 1 and 2.…”

International Journal of Electronics and Telecommunications

“…We give a code in Magma for this verification. In the last section we also discuss (see also [25]) how one may use Gröbner bases to determine the space of addition formuas of given degree (if such formulas exist), which may be useful to study addtion laws on other models of elliptic curves, our method is similar to the method in [15] to determine formulas used in point compression. [17] introduced the following model of elliptic curves…”