Twisted Edwards Curves Revisited

Abstract

This paper introduces fast algorithms for performing group operations on twisted Edwards curves, pushing the recent speed limits of Elliptic Curve Cryptography (ECC) forward in a wide range of applications. Notably, the new addition algorithm uses 1 8M for suitably selected curve constants. In comparison, the fastest point addition algorithms for (twisted) Edwards curves stated in the literature use 9M + 1S. It is also shown that the new addition algorithm can be implemented with four processors dropping the effective cost to 2M. This implies an effective speed increase by the full factor of 4 over the sequential case. Our results allow faster implementation of elliptic curve scalar multiplication. In addition, the new point addition algorithm can be used to provide a natural protection from side channel attacks based on simple power analysis (SPA).

Parametrizations for Families of ECM-Friendly Curves

“…Indeed, we rely on the same improvement from [7] that is exploited in [4] and use the same software that was used in [4]. Table 2.…”

“…On the other hand, the fastest scalar multiplication is obtained in [7] for a = −1 twisted Edward curves; as shown in [5], however, this limits the possibilities for interesting torsion groups (i.e., with cardinality greater than four) to Z/6Z, Z/8Z or Z/2Z × Z/4Z, thereby in particular excluding the two most profitable ones. For ECM the issue was settled in [4] where a = −1 twisted Edwards curves were compared to curves with E tors isomorphic to Z/12Z and Z/2Z × Z/8Z: it was found that the disadvantage of the formers' smaller torsion groups is outweighed by their faster scalar multiplication.…”

“…With the introduction of Edwards curves [6], a number of follow-up papers by Bernstein et al [3,5] ultimately led to "a = −1 twisted Edwards" curves by Hisil et al [7] with torsion group isomorphic to Z/2Z×Z/4Z as one of the current most efficient ways to implement ECM, as shown by Bernstein et al in [4]. For these curves, Barbulescu et al in [2] identify three families that all have the same larger smoothness probability and an even better fourth family.…”

Jacobi Quartic Curves Revisited

“…If a = −1/2 then the dedicated addition costs 7M + 3S + 2D with the use of (18). For justifications and more on operation counts see ADD-Qe-x in Appendix B.…”

“…This formula is independent of a and d. There are several other ways to derive (5). For instance, one may use the strategy applied in [18] for the derivation of dedicated addition formulae on twisted Edwards curves. Formula (5) is of minimal total degree.…”