Skip to main content

Questions tagged [montgomery-ladder]

The Montgomery ladder is a technique for scalar multiplication in an elliptic curve group, characterized by performing double-and-add at each step according to the multiplicand/exponent, rather double-and-conditionally-add in standard scalar multiplication. Applied to an elliptic curve in Montgomery form, it is efficient (it's initial goal) and easy to make constant-time. It's generalizable to exponentiation in any Abelian group.

Filter by
Sorted by
Tagged with
3 votes
1 answer
141 views

Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
fgrieu's user avatar
  • 142k
2 votes
2 answers
342 views

How to recover y-coordinates when using XZ montgomery curve

I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates. for ...
Cisco Saeed's user avatar
2 votes
1 answer
147 views

What is the equation to get P-Q in Montgomery curve XZ coordinates

Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
Cisco Saeed's user avatar
2 votes
1 answer
239 views

XZ coordinates for Montgomery curves

I am learning about Elliptic curve and I reached to Montgomery curve with XZ coordinates with this equation: b*y2=x3+a*x2+x and regarding the information from this ...
Cisco Saeed's user avatar
5 votes
1 answer
391 views

Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
Gautham Krishna's user avatar
1 vote
1 answer
288 views

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
Mojtaba's user avatar
  • 11
1 vote
1 answer
452 views

Montgomery Ladder with affine/projective Coordinates

So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is. With this Post i understood the basic affine arithmetic and Ladder. So this is not really faster ...
Titanlord's user avatar
  • 2,307
4 votes
0 answers
1k views

Fastest known Elliptic Curve Cryptography "solution" (coordinate systems (multiple?), algorithms, precomputed values etc)?

TL;DR: Does anyone have a reference to a study, implementation of different algorithms or otherwise "truth" about which solution - a set of coordinate systems and algorithms that enables the ...
Sajjon's user avatar
  • 151
1 vote
1 answer
271 views

What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...
Loup Vaillant's user avatar
3 votes
1 answer
2k views

Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
Diego Maü's user avatar
5 votes
2 answers
4k views

Advantages of Montgomery Ladder-based Scalar Multiplication

I do not quite understand what the greatest advantages are of using the Montgomery ladder algorithm for scalar multiplication? Can someone help me out?
Ceesz's user avatar
  • 53
4 votes
1 answer
891 views

What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder

I am trying to understand the below paragraph. Elliptic curve Diffie-Hellman is often calculated using the Montgomery ladder. This gives a simple and efficient calculation that is naturally ...
tarun14110's user avatar