Connecting Legendre with Kummer and Edwards

Abstract

Scalar multiplication on suitable Legendre form elliptic curves can be speeded up in two ways. One can perform the bulk of the computation either on the associated Kummer line or on an appropriate twisted Edwards form elliptic curve. This paper provides details of moving to and from between Legendre form elliptic curves and associated Kummer line and moving to and from between Legendre form elliptic curves and related twisted Edwards form elliptic curves. Further, concrete twisted Edwards form elliptic curves are identified which correspond to known Kummer lines at the 128-bit security level which provide very fast scalar multiplication on modern architectures supporting SIMD operations.

Kummer versus Montgomery Face-off over Prime Order Fields

“…The derivations for the identities involving the theta functions have a good reduction [15,16] and so the Lefschetz principle [1,14] can be used to carry over the identities which hold over the complex ield to those over a large characteristic ield. In view of this, Kummer lines over F p , where p is a large prime, have been considered in [15,16,19,20] and we also do the same.…”

“…The conditions µ 0, 1 requires ab 0 mod p. Scalar multiplication on E L, µ can be performed by moving to its associated Kummer line, performing the scalar multiplication there and then moving back. We refer to [19] for details.…”

“…In efect, simply substituting the diferential addition and the doubling algorithms of the Montgomery curve with those of the Kummer line provides the scalar multiplication algorithm over the Kummer line. For further details on Kummer lines we refer to [15,16,19,20].…”

“…For Montgomery curves proposed in the literature, birationally equivalent Montgomery curves are known [5,22,26,30]. In the case of Kummer lines, for p ≡ 3 mod 4, it is possible to use Theorems 3.3 and 3.4 of [4] to obtain an Edwards form curve which is birationally equivalent to E L, µ , while for p ≡ 1 mod 4, it is possible to use the methods of [19] to obtain a desired twisted Edwards form curve. For both Montgomery curves and Kummer lines, the associated (twisted) Edwards form curve can be used to build an eicient signature scheme based on the suggestion in [5].…”

“…Proof. The proof uses some results from [19]. First note that E L, µ (F p ) has three points of order 2 which along with the identity forms a subgroup of order 4.…”