8
$\begingroup$

Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:

Geometric interpretation of addition on a Weierstrass curve

(Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)

To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.


A curve in Edwards form might look like this:

An elliptic curve in Edwards form.

(Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)

However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves. Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = \left(\frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, \frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}\right).$$

When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).

Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?

$\endgroup$
5
$\begingroup$

The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=\frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(\mathcal{O})-(P+Q)$ where $\mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4\times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $\Omega_1 = (1:0:0)$ and $\Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $\Omega_1$ and $\Omega_2$. This let only one more intersection point $P+Q$.

enter image description here

(addition and doubling over $\mathbb{R}$ for $d<0$)

This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.

$\endgroup$
6
$\begingroup$

The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.

The correct interpretation for this kind of curves is "adding their angles". It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).

You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange

$\endgroup$
  • $\begingroup$ Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant! $\endgroup$ – Ruben De Smet Jan 7 at 16:00
  • 1
    $\begingroup$ probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition) $\endgroup$ – ddddavidee Jan 7 at 16:11
  • 3
    $\begingroup$ @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $\pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…). $\endgroup$ – Youssef El Housni Jan 7 at 16:40
  • $\begingroup$ @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards. $\endgroup$ – Youssef El Housni Jan 7 at 16:57
  • $\begingroup$ I'll undo the accept until I've studied both a bit more myself. Thanks for both answers! $\endgroup$ – Ruben De Smet Jan 7 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.