I am trying to implement arithmetic over points on a short Weierstrass elliptic curve and I have trouble with corner cases of the points addition operation. Let me specify the parameters of the curve and what is the problem exactly:
- As a test curve I use Bitcoin elliptic curve $y^2 = x^3 + 7$
- For testing purpose I do integer arithmetic $x\bmod 11$ to keep it simple for debugging purpose
- I do arithmetic exactly as specified herein Wikipedia
The problem I have is with doubling of the point $(5, 0)$. In the doubling formula, there is a modulo inverse of $y$ point coordinate, that clearly doesn't exist for $(5, 0)$ since $y=0$. So my questions are:
- How am I supposed to handle this case?
- Is $x$ or $y$ equal to $0$ even allowed when doing math for short Weierstrass elliptic curves?
- What is the exact list of corner cases that need to be handled when implementing an addition for short Weierstrass elliptic curve
Currently, my implementation has the following branching in the following order:
- If one of the arguments in addition operation is the point at infinity, the other argument of operation is returned as the result
- If one of the arguments is equal to a negative of the second argument result is the point at infinity
- If arguments in addition operation are equal to each other then doubling formula is used as specified here in Wikipedia
- Otherwise a basic addition formula is used as specified in Wikipedia
Negation is done by simply negating the $y$ coordinate with the exception that the negation of point at infinity gives back the point at infinity.
How far is this list from being complete? What else needs to be handled for this type of elliptic curve?
For those of you terrified by the fact that some noob is implementing math of an elliptic curve himself have no fear. This is not for practical crypto application, this is just a fun home project, the goal is to understand rather than to get a crypto-ready implementation :)
UPDATE: I used the comment of @corpsfini to update the routine and it turns out that I had an implementation flaw cause with $(5, 0)$ we have a case 2 of my branching scheme since $(5,0)$ is equal to negative of itself. So I fixed the bug and now all the unit tests work fine for $\bmod 11$ and some other random small groups. However the question remains, is it all that's out there? The SafeCurves web site warns that there are some failure cases that might not be disclosed by the random tests and that it's really hard to get them right. What I've coded up so far doesn't seem to be complex at all, yeah a bunch of if/else statements, but not something that I would call hard to get right. I expect that there is something else. Does anybody have an idea?