Hessian form of an elliptic curve

It is named after the German mathematician Otto Hesse.

This curve was suggested for application in elliptic curve cryptography, because arithmetic in this curve representation is faster and needs less memory than arithmetic in standard Weierstrass form.

in the following special case of Weierstrass form over

To obtain the Hessian curve, it is necessary to do the following transformation: First let

has a unique cube root; in general,

lies in an extension field of K. Now by defining the following value

another curve, C, is obtained, that is birationally equivalent to E:

which is called cubic Hessian form (in projective coordinates)

Starting from the Hessian curve, a birationally equivalent Weierstrass equation is given by

It is interesting to analyze the group law of the elliptic curve, defining the addition and doubling formulas (because the SPA and DPA attacks are based on the running time of these operations).

Furthermore, in this case, we only need to use the same procedure to compute the addition, doubling or subtraction of points to get efficient results, as said above.

In general, the group law is defined in the following way: if three points lie in the same line then they sum up to zero.

So, by this property, the group laws are different for every curve.

Intersecting the elliptic curve with the line, the following condition is obtained

In some application of elliptic curve cryptography and the elliptic curve method of factorization (ECM) it is necessary to compute the scalar multiplications of P, say [n]P for some integer n, and they are based on the double-and-add method; these operations need the addition and doubling formulas.

is a point on the elliptic curve, it is possible to define a "doubling" operation using Cauchy-Desboves´ formulae:

, it is possible to define the addition formula.

Let R denote the sum of these points, R = P + Q, then its coordinates are given by:

There is one algorithm that can be used to add two different points or to double; it is given by Joye and Quisquater.

Then, the following result gives the possibility the obtain the doubling operation by the addition: Proposition.

Finally, contrary to other parameterizations, there is no subtraction to compute the negation of a point.

Hence, this addition algorithm can also be used for subtracting two points P = (X1:Y1:Z1) and Q = (X2:Y2:Z2) on a Hessian elliptic curve: To sum up, by adapting the order of the inputs according to equation (2) or (3), the addition algorithm presented above can be used indifferently for: Adding 2 (diff.)

Before the invention of Edwards curves, these results represent the fastest known method for implementing the elliptic curve scalar multiplication towards resistance against side-channel attacks.

For some algorithms protection against side-channel attacks is not necessary.

Since there are many algorithms, only the best for the addition and doubling formulas is given here, with one example for each one: Let P1 = (X1:Y1:Z1) and P2 = (X2:Y2:Z2) be two points distinct to θ.

The cost needed is 8 multiplications and 3 additions readdition cost of 7 multiplications and 3 additions, depending on the first point.

Given the following points in the curve for d = −1 P1 = (1:0:−1) and P2 = (0:−1:1), then if P3 = P1 + P2 we have: Then: P3 = (−1:−1:0) Let P = (X1 : Y1 : Z1) be a point, then the doubling formula is given by: The cost of this algorithm is three multiplications + three squarings + 11 additions + 3×2.

is a point over the Hessian curve with parameter d = −1, then the coordinates of

To have more information about operations with the extended coordinates see: http://hyperelliptic.org/EFD/g1p/auto-hessian-extended.html#addition-add-20080225-hwcd

{\displaystyle X,Y,Z,XX,YY,ZZ,XY,YZ,XZ}