Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Considering the equation of the elliptic curves over $GF(p)$
$y^3 = x^2+ax+b$ ,
why is there some magic in using $a=-3$ ? In some well known curves (e.g. P-256) only $b$ is specified, while $a$ ist taken as $-3$. In a software library I use, $-3$ is the default value, what means, that is assumes $a=-3$ if not otherwise specified.
Why is $a=-3$ special?
The reason is that choosing $a=-3$ allows for a more efficient computation of the doubling operation, when used in projective coordinates.
In fact if you look at the doubling formula in, for example, Jacobian coordinates from wikibooks you can see that it requires the computation of an intermediate value as $M = 3*X^2 + a*Z^4$, where $(X,Y,Z)$ is the Jacobian representation of the affine point $(x,y)$ through the relation $(x,y) = (X/Z^2,Y/Z^3)$.
That formula to compute $M$ can be simplified to $M = 3*(X + Z^2)*(X - Z^2)$ exchanging the computation of two squares $X^2$ and $(Z^2)^2$ with the multiplication $(X + Z^2)*(X - Z^2)$ and, of course, you also avoided the multiplication by $a$.
This results in a more efficient computation of the doubling formula and works well even in homegeneous or Chudnovsky coordinates.
One of the requirement of an elliptic curves is its absence of singular point.
Given her Weierstrass Form $$y^2 = x^3 + a x + b$$ The discriminant must not be nul: $$4a^3 + 27b^2 \neq0$$ if $a= -3$ then this becomes:$$4\times (-27) + 27 b^2 \neq 0\\-4+b^2\neq0 \\b\neq2\ \land\ b \neq -2$$ This is rather simple to check when choosing $b$.
Yet another advantage of the NIST curves is that they use a = −3, which improves addition in Jacobian coordinates.
from Wikipedia (also cf Ruggero's answer).
