Skip to main content
Cryptography

Return to Question

Tweeted twitter.com/StackCrypto/status/1572510961109450753
Became Hot Network Question
little typos.
Source Link
kelalaka
kelalaka
  • 49.5k
  • 12
  • 118
  • 205

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick way they perform twisted Edwards curve addition with lessfewer inversions.

I am reading through the paper and it makes sense until I get to the statement in section 3.1 under figure (5), which saysays that the unified addition formulae for extended coordinates are somehow derived from the affine addition formulae in figure (1). I cannot for the life of me understand how the formula $$ X_3\:=\:\left(X_1Y_2\:+\:Y_1X_2\right)\left(Z_1Z_2-dT_1T_2\right)$$

can be derived from the formula $$X_3\:=\:\frac{\left(X_1Y_2\:+\:Y_1X_2\right)}{\left(1+dT_1T_2\right)}$$ even with the extended coordinates, and dividing every X1 or Y1 by Z1. Can anyone explain their derivation to me?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick way they perform twisted Edwards curve addition with less inversions.

I am reading through the paper and it makes sense until I get to the statement in section 3.1 under figure (5), which say that the unified addition formulae for extended coordinates are somehow derived from the affine addition formulae in figure (1). I cannot for the life of me understand how the formula $$ X_3\:=\:\left(X_1Y_2\:+\:Y_1X_2\right)\left(Z_1Z_2-dT_1T_2\right)$$

can be derived from the formula $$X_3\:=\:\frac{\left(X_1Y_2\:+\:Y_1X_2\right)}{\left(1+dT_1T_2\right)}$$ even with the extended coordinates, and dividing every X1 or Y1 by Z1. Can anyone explain their derivation to me?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick way they perform twisted Edwards curve addition with fewer inversions.

I am reading through the paper and it makes sense until I get to the statement in section 3.1 under figure (5), which says that the unified addition formulae for extended coordinates are somehow derived from the affine addition formulae in figure (1). I cannot for the life of me understand how the formula $$ X_3\:=\:\left(X_1Y_2\:+\:Y_1X_2\right)\left(Z_1Z_2-dT_1T_2\right)$$

can be derived from the formula $$X_3\:=\:\frac{\left(X_1Y_2\:+\:Y_1X_2\right)}{\left(1+dT_1T_2\right)}$$ even with the extended coordinates, and dividing every X1 or Y1 by Z1. Can anyone explain their derivation to me?

Source Link
Norris Duncan
Norris Duncan
  • 43
  • 3

How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick way they perform twisted Edwards curve addition with less inversions.

I am reading through the paper and it makes sense until I get to the statement in section 3.1 under figure (5), which say that the unified addition formulae for extended coordinates are somehow derived from the affine addition formulae in figure (1). I cannot for the life of me understand how the formula $$ X_3\:=\:\left(X_1Y_2\:+\:Y_1X_2\right)\left(Z_1Z_2-dT_1T_2\right)$$

can be derived from the formula $$X_3\:=\:\frac{\left(X_1Y_2\:+\:Y_1X_2\right)}{\left(1+dT_1T_2\right)}$$ even with the extended coordinates, and dividing every X1 or Y1 by Z1. Can anyone explain their derivation to me?