Assume elliptic curve in Weierstrass form.

$y^2 = x^3 + a x + b$ where $x,y,a,b \in F$

I noticed the point addition formula does not involve parameters $a,b$. Furthermore, one can always solve for $a,b$ given two distinct points.

Thus one can "add" 3 or more distinct points, as long as their coordinates are on $F$, without having them on the same curve. More formally, let $O$ be point of infinity, the set $F \times F \cup O$ is almost closed under point addition operation for short Weierstrass curve. (Almost closed since one has to "add" distinct points)

I did a quick check that associative law for groups no longer holds. What would be some interesting properties for the above setup?

  • $\begingroup$ For $b$ yes, for $a$ no ($a$ needed for doubling). Could you support your claims? given two points to find $a$ and $b$ is here $\endgroup$
    – kelalaka
    Mar 21, 2022 at 14:41
  • $\begingroup$ What if in $P+Q+R$, $Q+R = P$? now you turned to double. You may say, I can calculate $P+Q$ then add $R$. In this case, we can say, who is going to check these?. Instead, we prefer complete formulas if possible. $\endgroup$
    – kelalaka
    Mar 21, 2022 at 14:51
  • $\begingroup$ You are mixin points of the curve and points of its quadratic twist. twist attack is based on this. $\endgroup$
    – kelalaka
    Mar 21, 2022 at 15:25
  • 1
    $\begingroup$ Lack of associativity is a show-stopper in many cryptographic applications. Thus the question is about a solution looking for problem (and I don't know one).@kelalaka: performing point doubling the way you suggest requires associativity, which as pointed in the question does not hold. $\endgroup$
    – fgrieu
    Mar 21, 2022 at 15:55


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.