0
$\begingroup$

Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain how to achieve this? If not, could you clarify why it's not possible?

$\endgroup$
5
  • $\begingroup$ You can construct one, however, it will be a bit more complex. Why do you need this? You need complete and side-channel free addition Is there any "exception-free" coordinates system for Weierstrass curves? $\endgroup$
    – kelalaka
    Mar 19 at 14:15
  • $\begingroup$ @kelalaka I followed the link you provided but I wasn't able to come up with anything. I'll have only been able to construct a direct secp256k1 elliptic curve subtraction formula other than negating and adding , assuming you want to subtract $G^x$ from $Q^x$ you can use the below formula. s = (Qy + Gy) * pow(Gx - Qx, -1, p) % p Rx = (s**2 - Qx - Gx) % p Ry = (s * (Rx - Qx) - Qy) % p $\endgroup$
    – Favour
    Mar 19 at 14:59
  • $\begingroup$ My point is, we don't need this formula for general scalar multiplication. Why do you need? $\endgroup$
    – kelalaka
    Mar 19 at 15:04
  • $\begingroup$ It will help me understand better. If you don't mind can you provide the formula for point multiplication by 3 $\endgroup$
    – Favour
    Mar 19 at 15:18
  • 2
    $\begingroup$ @Favour What's wrong with combining a doubling with an addition ? Like computing (2*P)+P? $\endgroup$
    – Ruggero
    Mar 20 at 10:14

1 Answer 1

3
$\begingroup$

A simple way to derive a point tripling method in Cartesian coordinates for secp256k1 is per $3P=(2P)+P$, and towards this

p = 2**256-2**32-977

def triple(x:int, y:int):
    if x==0 or y==0:
        return 0,0 # point at infinity
    X = x**2
    w = 3*X
    R = 2*y**2 % p
    Z = 4*y*R % p
    u = R*R
    B = ((x+R)**2-X-u) % p
    h = (w**2-2*B) % p
    X = 2*h*y % p
    Y = (w*(B-h)-2*u) % p
    u = y*Z-Y % p
    v = x*Z-X % p
    w = v**2
    R = w*X % p
    w = v*w % p
    A = (u**2*Z-w-2*R) % p
    h = pow(w*Z,-1,p)
    return v*A*h % p, (u*(R-A)-w*Y)*h % p

I don't claim that's optimal.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.