Jacobian curve
Sometimes it is used in cryptography instead of the Weierstrass form because it can provide a defence against simple and differential power analysis style (SPA) attacks; it is possible, indeed, to use the general addition formula also for doubling a point on an elliptic curve of this form: in this way the two operations become indistinguishable from some side-channel information.
In this way, the points of an elliptic curve forms a group.
Note that the identity element of the group operation is not a point on the affine plane, it only appears in the projective coordinates: then O = (0: 1: 0) is the "point at infinity", that is the neutral element in the group law.
Adding and doubling formulas are useful also to compute [n]P, the n-th multiple of a point P on an elliptic curve: this operation is considered the most in elliptic curve cryptography.
An elliptic curve E, over a field K can be put in the Weierstrass form y2 = x3 + ax + b, with a, b in K. What will be of importance later are point of order 2, that is P on E such that [2]P = O and P ≠ O.
From now on, we will use Ea,b to denote the elliptic curve with Weierstrass form y2 = x3 + ax + b.
If Ea,b is such that the cubic polynomial x3 + ax + b has three distinct roots in K and b = 0 we can write Ea,b in the Legendre normal form: In this case we have three points of order two: (0, 0), (–1, 0), (–j, 0).
An elliptic curve in P3(K) can be represented as the intersection of two quadric surfaces: It is possible to define the Jacobi form of an elliptic curve as the intersection of two quadrics.
Let Ea,b be an elliptic curve in the Weierstrass form, we apply the following map to it: We see that the following system of equations holds: The curve E[j] corresponds to the following intersection of surfaces in P3(K): The "special case", E[0], the elliptic curve has a double point and thus it is singular.
S1 is obtained by applying to E[j] the transformation: For S1, the neutral element of the group is the point (0, 1, 1, 1), that is the image of O = (0: 1: 0) under ψ.
: it is easy to verify that P1 and P2 belong to S1 (it is sufficient to see that these points satisfy both equations of the system S1).
There is another kind of coordinate system with which a point in the Jacobi intersection can be represented.
Given the following elliptic curve in the Jacobi intersection form: the extended coordinates describe a point P = (x, y, z) with the variables X, Y, Z, T, XY, ZT, where: Sometimes these coordinates are used, because they are more convenient (in terms of time-cost) in some specific situations.
For more information about the operations based on the use of these coordinates see http://hyperelliptic.org/EFD/g1p/auto-jintersect-extended.html An elliptic curve in Jacobi quartic form can be obtained from the curve Ea,b in the Weierstrass form with at least one point of order 2.
Applying f to Ea,b, one obtains a curve in J of the following form: where: are elements in K. C represents an elliptic curve in the Jacobi quartic form, in Jacobi coordinates.
The general form of a Jacobi quartic curve in affine coordinates is: where often e = 1 is assumed.
The neutral element of the group law of C is the projective point (0: 1: 1).
There are some "strategies" to reduce the operations required for adding and doubling points: the number of multiplications can be decreased to 11 plus 3 multiplications by constants (see [4] section 3 for more details).
The number of multiplications can be reduced by working on the constants e and d: the elliptic curve in the Jacobi form can be modified in order to have a smaller number of operations for adding and doubling.
For more information about the time-cost required in the operations with these coordinates see http://hyperelliptic.org/EFD/g1p/auto-jquartic.html Given an affine Jacobi quartic the Doubling-oriented XXYZZ coordinates introduce an additional curve parameter c satisfying a2 + c2 = 1 and they represent a point (x, y) as (X, XX, Y, Z, ZZ, R), such that: the Doubling-oriented XYZ coordinates, with the same additional assumption (a2 + c2 = 1), represent a point (x, y) with (X, Y, Z) satisfying the following equations: Using the XXYZZ coordinates there is no additional assumption, and they represent a point (x, y) as (X, XX, Y, Z, ZZ) such that: while the XXYZZR coordinates represent (x, y) as (X, XX, Y, Z, ZZ, R) such that: with the XYZ coordinates the point (x, y) is given by (X, Y, Z), with: For more information about the running-time required in a specific case, see Table of costs of operations in elliptic curves.
