Generally this curve is considered over a finite fieldK (for example, over a finite field of qelements, K = Fq) with characteristic different from 2 and with A ≠ ±2 and B ≠ 0, but they are also considered over the rationals with the same restrictions for A and B.
It is possible to do some "operations" between the points of an elliptic curve: "adding" two points consists of finding a third one such that ; "doubling" a point consists of computing (For more information about operations see The group law) and below.
A point on the elliptic curve in the Montgomery form can be represented in Montgomery coordinates , where are projective coordinates and for .
Notice that this kind of representation for a point loses information: indeed, in this case, there is no distinction between the affine points and because they are both given by the point . However, with this representation it is possible to obtain multiples of points, that is, given , to compute .
Now, considering the two points and : their sum is given by the point whose coordinates are:
If , then the operation becomes a "doubling"; the coordinates of are given by the following equations:
The first operation considered above (addition) has a time-cost of 3M+2S, where M denotes the multiplication between two general elements of the field on which the elliptic curve is defined, while S denotes squaring of a general element of the field.
The second operation (doubling) has a time-cost of 2M + 2S + 1D, where D denotes the multiplication of a general element by a constant; notice that the constant is , so can be chosen in order to have a small D.
Given two points , on the Montgomery curve in affine coordinates, the point represents, geometrically the third point of intersection between and the line passing through and . It is possible to find the coordinates of , in the following way:
1) consider a generic line in the affine plane and let it pass through and (impose the condition), in this way, one obtains and ;
2) intersect the line with the curve , substituting the variable in the curve equation with ; the following equation of third degree is obtained:
As it has been observed before, this equation has three solutions that correspond to the coordinates of , and . In particular this equation can be re-written as:
3) Comparing the coefficients of the two identical equations given above, in particular the coefficients of the terms of second degree, one gets:
So, can be written in terms of , , , , as:
4) To find the coordinate of the point it is sufficient to substitute the value in the line . Notice that this will not give the point directly. Indeed, with this method one find the coordinates of the point such that , but if one needs the resulting point of the sum between and , then it is necessary to observe that: if and only if . So, given the point , it is necessary to find , but this can be done easily by changing the sign to the coordinate of . In other words, it will be necessary to change the sign of the coordinate obtained by substituting the value in the equation of the line.
Given a point on the Montgomery curve , the point represents geometrically the third point of intersection between the curve and the line tangent to ; so, to find the coordinates of the point it is sufficient to follow the same method given in the addition formula; however, in this case, the line y = lx + m has to be tangent to the curve at , so, if with
then the value of l, which represents the slope of the line, is given by:
Theorem (i) Every twisted Edwards curve is birationally equivalent to a Montgomery curve over .
In particular, the twisted Edwards curve is birationally equivalent to the Montgomery curve where , and .
^Katsuyuki Okeya, Hiroyuki Kurumatani, and Kouichi Sakurai (2000). Elliptic Curves with the Montgomery-Form and Their Cryptographic Applications. Public Key Cryptography (PKC2000). doi:10.1007/978-3-540-46588-1_17.CS1 maint: multiple names: authors list (link)