enter image description here

Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I don't know what is the equation used to get P-Q to get X-,Z-.

So for example if I have P1(8,3,1) so it means (X⊖,Z⊖) = (8,1) and the value of (Xq,Zq) is from doubling? what about (Xp,Zp)?

  • 1
    $\begingroup$ Does the text I added to the question address your concern? Or, are you looking to use differential addition in a context other than the Montgomery Ladder? $\endgroup$
    – poncho
    Commented Mar 2, 2023 at 18:43
  • $\begingroup$ Actually I am looking for deferential Addition in Montgomery curve hyperelliptic.org/EFD/g1p/auto-montgom-xz.html $\endgroup$ Commented Mar 3, 2023 at 14:32

1 Answer 1


I don't know what is the equation used to get P-Q to get X-,Z-.

Actually, if you're using the Montgomery Ladder algorithm, it's the base point we're multiplying.

At each step of the iteration, we have the points $P, P+G, G$ (where $P = zG$, where $z$ is the part of the multiplier we've already entered), and depending on whether the next bit in the multiplier is a 1, we want (if it is a 0) $2P, 2P+G, G$ or (if it is a 1) $2P+G, 2P+2G, G$.

So, the first step is to take $(X_P, Z_P) = P+G$, and $(X_Q, Z_Q) = P$, and $(X_\ominus, Z_\ominus ) = G$; it is easy to see that the precondition $(X_P, Z_P) - (X_Q, Z_Q) = (X_\ominus, Z_\ominus )$ holds; the addition algorithm then gives us $(X_\oplus, Z_\oplus ) = (X_P, Z_P) + (X_Q, Z_Q) = 2P+G$. And, all we need to do is compute either $2P$ or $2P+2G$ - either case is just a doubling of a value we already have.

And, to start the process, we start with $P=0$ (hence our triple is $(0, G, G)$, which fulfills the precondition, and then we can start by shifting the multiplier bits in, in msb to lsb order...

Hence, in this application, $X_\ominus, Z_\ominus )$ is always $G$ (the base point we are multiplying by).

  • $\begingroup$ Actually I am using Montgomery curve differential addition and want to know what is the equation used to get the value of (X⊖,Z⊖) ? $\endgroup$ Commented Mar 2, 2023 at 4:45
  • $\begingroup$ @CiscoSaeed: so, you have $(X_\oplus, Z_\oplus)$, and want to know how to get $(X_\ominus, Z_\ominus)$? $\endgroup$
    – poncho
    Commented Mar 2, 2023 at 13:25
  • $\begingroup$ the issue is how to get (X⊖,Z⊖) to use it in equation without calculation (X⊕,Z⊕) $\endgroup$ Commented Mar 2, 2023 at 13:54
  • $\begingroup$ @CiscoSaeed: If you're just given $(X_P, Z_P), (X_Q, Z_Q)$, you can't. The representation of the points $P, Q$ are missing the $y$ coordinates, that is, the sign information, and so there's nothing distinguishing $P-Q$ from $P+Q$, that is $(X_\ominus, Z_\ominus)$ from $(X_\oplus, Z_\oplus)$. While you could devise a procedure to compute both, there would be no way to know which is which. $\endgroup$
    – poncho
    Commented Mar 2, 2023 at 14:05
  • $\begingroup$ But i don't understand as in paper to use it incase to reduce multiplication so if i used addition so what is the difference? And what is the addition equation? $\endgroup$ Commented Mar 2, 2023 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.