I am learning about Elliptic curve and I reached to Montgomery curve with XZ coordinates with this equation: b*y2=x3+a*x2+x and regarding the information from this link: XZ coordinates add and doubling

and I made this small code in matlab to understand the concepts:

% Define the elliptic curve parameters
a = 1;
b = 1;
p = 23;
% Define the base point
X1 = 8;
Y1 = 3;
X3 = mod((X1^2-Z1^2)^2,p);
Z3 = mod(4*X1*Z1*(X1^2+a*X1*Z1+Z1^2),p);
A = X2+Z2; %X2,Z2 Values?
B = X2-Z2;
C = X3+Z3; %X3,Z3 Does this come from Doubling?
D = X3-Z3;
DA = D*A;
CB = C*B;
X5 = (DA+CB)^2;
Z5 = X1*(DA-CB)^2; %X1 Does this come from Base Point?

in Doubling phase I can Understand X1, Z1 comes from Base Point, but in Addition phase I want to understand the values X2,Z2,X3,Z3,X1 come from where?

Because what I understand that I have base point then from doubling the base point then I got second point so obviously I have base Point X1,Z1 and from doubling I have X3,Z3 what about X2,Z2?

  • $\begingroup$ Any idea about it? $\endgroup$ Feb 25, 2023 at 12:20
  • 1
    $\begingroup$ My trouble in understanding that web page is that I don't know what "differential addition" is. $\endgroup$
    – Myria
    Feb 28, 2023 at 2:11
  • $\begingroup$ @Myria what I understand it is to take -R Value as pseudo value, I am still testing it in Matlab and will come back with solution soon, I hope so! $\endgroup$ Feb 28, 2023 at 12:50
  • $\begingroup$ This answer explains differential addition. Basically, you add point $P$ and $Q$ also knowing $R=Q-P$ (or is it $R=P-Q$) in advance. Unfortunately I can't immediately tell per what order indices $1/2/3$ map to $P/Q/R$, else I would make that an answer. Also I think the question's formula assumes $Z_1=1$, and otherwise you need these slightly more complex formulas (and more modular reductions). If you solved your problem already, please make and accept an answer! $\endgroup$
    – fgrieu
    Mar 28, 2023 at 8:08

1 Answer 1


I'm a novice, so I can't guarantee the correct answer, sorry.

For the initial values you mentioned, in the algorithm for curve25519, such as in this paper, it is specified in Algorithm 1 as: X1 = xP; X2 = 1; Z2 = 0; X3 = xP ; Z3 = 1, where P2 (1, 0) should refer to the point at infinity, which makes P1 and P3 the same point. When you replace the 121666 in Algorithm 2 with (A+2)/4, you can apply to the general Montgomery curve. This is also mentioned in Section 4.4.3 of this article.

I hope it helps:)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.