What are the differences between the elliptic curve equations?

Question

I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones.

Now there's also the "Montgomery" representation: $by^2\equiv x^3 + ax^2 + x \pmod p$ where the famous Curve25519 is an example for.

To get things even more complicated there are "Edwards" and "Twisted Edwards" curves (of which I don't even have the general equations). A well-known sample would be Ed25519 I think.

• Now what are the equations of these curves ([twisted] edwards only)?
• Can they be converted into each other?
• What are the computational advantages over using a given curve equation over another?
• Are there any security implications (including side-channels) in choosing a specific equation?

Answer 1

All of these are answered by the SafeCurves project:

• For twisted Edwards curves, $ax^2 + y^2 \equiv 1 + dx^2y^2 \pmod p$. Edwards curves are the special case a = 1.
• Edwards curves can be converted to Montgomery form.
  Montgomery curves can be converted to Weierstrass form.
  Some, but not all, Weierstrass curves can be converted to Montgomery form.
• The Montgomery ladder (applicable only to Edwards and Montgomery curves) is faster than standard weierstrass point multiplication methods.
• the Montgomery ladder is constant-time, while the standard Weierstrass point multiplication methods are not.
  The Brier-Joye ladder allows constant-time point multiplication on Weierstrass curves, but is much slower than the standard point multiplication methods.
  The EdDSA signature scheme is only supported by twisted Edwards curves.