When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or doubling a point. For all I know, those points can belong to any form of elliptic curve. Why is it that in many papers, it is claimed that the Montgomery ladder is fastest on Montgomery curves? What am I missing?


1 Answer 1


Elliptic curves can be represented in different form. The most basic equation, in which every elliptic curve can be represented is the Weierstraß equation:

$$ y^2 = x^3 + ax + b$$

For a Montgomery curve it must be able to be represented in the following form:

$$ (b)y^2 = x^3 + ax^2 + x$$

For every Montgomery curve it is possible to transform its equation to Weierstraß, but not vice versa. Therefore not every elliptic curve is a Montgomery curve.

The Montgomery ladder can only be used by Montgomery curves and can be viewed as a Double and Add-procedure variant with constant time. Such variants and ladders exist for multiple different elliptic curves, but should have different names (e.g. see SafeCurves).

  • 1
    $\begingroup$ Not every elliptic curve can be represented with the short Weierstraß equation. This is only valid if $p \neq 2,3$. For a curve to be represented in Montgomery form there must be an element of order 2. All answer for the Op is written in Squeamish's answer $\endgroup$
    – kelalaka
    Jan 6, 2022 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.