The Montgomery ladder is a technique for scalar multiplication in an elliptic curve group, characterized by performing double-and-add at each step according to the multiplicand/exponent, rather double-and-conditionally-add in standard scalar multiplication. Applied to an elliptic curve in Montgomery form, it is efficient (it's initial goal) and easy to make constant-time. It's generalizable to exponentiation in any Abelian group.

12 questions
Filter by
Sorted by
Tagged with
141 views

### Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
• 142k
342 views

### How to recover y-coordinates when using XZ montgomery curve

I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates. for ...
• 241
147 views

### What is the equation to get P-Q in Montgomery curve XZ coordinates

Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
• 241
239 views

### XZ coordinates for Montgomery curves

I am learning about Elliptic curve and I reached to Montgomery curve with XZ coordinates with this equation: b*y2=x3+a*x2+x and regarding the information from this ...
• 241
391 views

### Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
1 vote
288 views

### Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
• 11
1 vote
452 views

### Montgomery Ladder with affine/projective Coordinates

So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is. With this Post i understood the basic affine arithmetic and Ladder. So this is not really faster ...
• 2,307
1k views

### Fastest known Elliptic Curve Cryptography "solution" (coordinate systems (multiple?), algorithms, precomputed values etc)?

TL;DR: Does anyone have a reference to a study, implementation of different algorithms or otherwise "truth" about which solution - a set of coordinate systems and algorithms that enables the ...
• 151
1 vote
271 views

### What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...
2k views

### Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
4k views