I see people talk about Edward curves (when I discuss Ed25519) as better curves than Weierstrass for computations. Now I get that Edward curves have the nice addition formula, but if we have a specific Weierstrass curve, wouldn't addition also involve the same computation, since we have fixed equations for that, that we solve analytically once and then just compute them?

To put the question from a different perspective: Some people also mention "constant time scalar multiplication" with Edward curves. I didn't find any constant-time formula for multiplication, I just found one for addition and doubling of points (so doubling + addition is not constant, or is it constant with respect to something else?), which brings me back to the comparison with Weierstrass curves. Don't we have fixed formulas for that too (after calculating some derivatives analytically) that can be seen as constant-time?

I would appreciate explaining the computational features of Edward curves compared to their math. I couldn't find that information online.

  • 1
    $\begingroup$ The main point is that you need less finite-field multiplications for each operation for edwards curves than for generic weierstrass curves (explore the formulas here). As these operations don't actually require branching in sensible scalar multiplication strategies there's no inherent implementation advantage of Edwards over Weierstrass curves beyond the faster addition / doubling. $\endgroup$
    – SEJPM
    Commented Jun 18, 2020 at 11:33
  • $\begingroup$ @SEJPM So the statement "constant time" is not really true. Thanks. That answers my question. $\endgroup$ Commented Jun 18, 2020 at 14:46


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.