Questions tagged [montgomery-ladder]
The Montgomery ladder is a technique for scalar multiplication in an elliptic curve group, characterized by performing double-and-add at each step according to the multiplicand/exponent, rather double-and-conditionally-add in standard scalar multiplication. Applied to an elliptic curve in Montgomery form, it is efficient (it's initial goal) and easy to make constant-time. It's generalizable to exponentiation in any Abelian group.
13 questions
1
vote
0
answers
54
views
Montgomery Ladder on Weierstrass Curve
I want to use the Montgomery ladder to speed up the process of calculating scalar multiplication. Here I use the Montgomery ladder but on the Weierstrass curve.
In the equation $x^3 + 2x + 9 \bmod 37$ ...
- 11
3
votes
1
answer
173
views
Standard Montgomery curves over prime field
Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field?
I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
- 145k
2
votes
2
answers
437
views
How to recover y-coordinates when using XZ montgomery curve
I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates.
for ...
- 241
2
votes
1
answer
170
views
What is the equation to get P-Q in Montgomery curve XZ coordinates
Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
- 241
2
votes
1
answer
309
views
XZ coordinates for Montgomery curves
I am learning about Elliptic curve and I reached to Montgomery curve with XZ coordinates with this equation: b*y2=x3+a*x2+x and regarding the information from this ...
- 241
5
votes
1
answer
429
views
Why is Montgomery Ladder fast on Montgomery Curves?
When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
1
vote
1
answer
309
views
Performing EdDSA/Ed448 employing Montgomery ladder
EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
- 11
1
vote
1
answer
498
views
Montgomery Ladder with affine/projective Coordinates
So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is.
With this Post i understood the basic affine arithmetic and Ladder.
So this is not really faster ...
- 2,447
4
votes
0
answers
1k
views
Fastest known Elliptic Curve Cryptography "solution" (coordinate systems (multiple?), algorithms, precomputed values etc)?
TL;DR: Does anyone have a reference to a study, implementation of different algorithms or otherwise "truth" about which solution - a set of coordinate systems and algorithms that enables the ...
- 151
1
vote
1
answer
303
views
What scalars produce the wrong values with X25519's montgomery ladder?
This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances.
The following Montgomery ladder as ...
3
votes
1
answer
2k
views
Can Montgomery ladder multiplication be used with secp256k1?
While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say:
The curve secp256k1 does not ...
- 31
5
votes
2
answers
4k
views
Advantages of Montgomery Ladder-based Scalar Multiplication
I do not quite understand what the greatest advantages are of using the Montgomery ladder algorithm for scalar multiplication?
Can someone help me out?
- 53
4
votes
1
answer
924
views
What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder
I am trying to understand the below paragraph.
Elliptic curve Diffie-Hellman is often calculated using the Montgomery
ladder. This gives a simple and efficient calculation that is
naturally ...
- 267