Montgomery curves and their arithmetic

TL;DR

This paper surveys the theory and cryptographic applications of Montgomery elliptic curves, focusing on their arithmetic, algorithms, and use in cryptosystems over non-binary finite fields.

Contribution

It provides a comprehensive overview of Montgomery curves, including their x-only arithmetic, Ladder algorithm, Diffie-Hellman, and differential addition chains, highlighting their foundational role in cryptography.

Findings

Detailed explanation of Montgomery's x-only arithmetic and Ladder algorithm

Analysis of y-coordinate recovery and differential addition chains

Survey of cryptographic protocols using Montgomery curves

Abstract

Three decades ago, Montgomery introduced a new elliptic curve model for use in Lenstra's ECM factorization algorithm. Since then, his curves and the algorithms associated with them have become foundational in the implementation of elliptic curve cryptosystems. This article surveys the theory and cryptographic applications of Montgomery curves over non-binary finite fields, including Montgomery's x-only arithmetic and Ladder algorithm, x-only Diffie--Hellman, y-coordinate recovery, and 2-dimensional and Euclidean differential addition chains such as Montgomery's PRAC algorithm.

Tables

Table 1. Table 1: 4 4 4 -torsion structures on a Montgomery curve ℰ ( A , B ) subscript ℰ 𝐴 𝐵 \mathcal{E}_{(A,B)} and its quadratic twist ℰ ( A , B ′ ) subscript ℰ 𝐴 superscript 𝐵 ′ \mathcal{E}_{(A,B^{\prime})} .

$B$	$A-2$ and $A+2$	${ℰ}_{(A,B)}\left[4\right]\left({𝔽}_q\right)$ contains	${ℰ}_{(A,B^{\prime })}\left[4\right]\left({𝔽}_q\right)$ contains
square	both square	$\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$	$\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$
square	one square	$\mathbb{Z}/4\mathbb{Z}$	$\mathbb{Z}/4\mathbb{Z}$
square	neither square	$\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$	$\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$
nonsquare	both square	$\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$	$\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$
nonsquare	one square	$\mathbb{Z}/4\mathbb{Z}$	$\mathbb{Z}/4\mathbb{Z}$
nonsquare	neither square	$\mathbb{Z}/4\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$	$\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$

Equations

$$[k]:P⟼\underset{k\text{ times}}{\underbrace{P\oplus \cdots \oplus P}}$$

$$\mathbf{x}:\mathcal{E}⟶{\mathbb{P}}^1\cong \mathcal{E}/⟨\ominus ⟩$$

$$\mathbf{x}(P)⟼\mathbf{x}([k]P)$$

$${\mathcal{E}}_{(A,B)}:B{y}^2=x(x^2+Ax+1),$$

$$x=X/Z\text{and}y=Y/Z,$$

$${\mathcal{E}}_{(A,B)}:B{Y}^{2}Z=X(X^2+AXZ+Z^2)\subseteq {\mathbb{P}}^2.$$

$$j({\mathcal{E}}_{(A,B)})=\frac{256(A^2-3{)}^3}{A^2-4},$$

$$x_{\oplus }$$

$$=\lambda (x_P-x_Q)-y_P,$$

$$\lambda =\{\begin{array}{ll}(y_Q-y_P)/(x_Q-x_P)& \text{ if }P\ne Q\text{ or }\ominus Q,\\ (3x_P^2+2A{x}_P+1)/(2B{y}_P)& \text{ if }P=Q;\end{array}$$

$$T:=(0:0:1)\in {\mathcal{E}}_{(A,B)}[2]({\mathbb{F}}_q);$$

$${\tau }_T:(x,y)⟼(1/x,-y/x^2).$$

$${\mathcal{E}}^W:v^2=u^3+(B^2(1-A^2/3))u+B^{3}A/3(2A^2/9-1).$$

$$(x,y)⟼$$

$$(u,v)⟼$$

$${\mathcal{E}}_{(a,d)}^{\mathrm{Ed}}:a{u}^2+v^2=1+d{u}^2{v}^2\text{where}\{\begin{array}{l}a=(A+2)/B,\\ d=(A-2)/B.\end{array}$$

$$\mathbf{x}:P⟼\{\begin{array}{ll}(x_P:1)& \text{ if }P=(x_P:y_P:1),\\ (1:0)& \text{ if }P=O=(0:1:0).\end{array}$$

$$\mathtt{xADD}:(\mathbf{x}(P),\mathbf{x}(Q),\mathbf{x}(P\ominus Q))⟼\mathbf{x}(P\oplus Q).$$

$$\mathtt{xDBL}:\mathbf{x}(P)⟼\mathbf{x}([2]P).$$

$$x_{P\oplus Q}{x}_{P\ominus Q}(x_P-x_Q{)}^2=(x_P{x}_Q-1{)}^2,$$

$$4x_{[2]P}{x}_P(x_P^2+A{x}_P+1)=(x_P^2-1{)}^2.$$

$$(X_P:Z_P)$$

$$(X_{\oplus }:Z_{\oplus })$$

$$\{\begin{array}{l}{X}_{\oplus }=Z_{\ominus }{\left[(X_P-Z_P)(X_Q+Z_Q)+(X_P+Z_P)(X_Q-Z_Q)\right]}^2,\\ Z_{\oplus }=X_{\ominus }{\left[(X_P-Z_P)(X_Q+Z_Q)-(X_P+Z_P)(X_Q-Z_Q)\right]}^2,\end{array}$$

$$\{\begin{array}{l}{X}_{[2]P}=(X_P+Z_P{)}^2(X_P-Z_P{)}^2,\\ Z_{[2]P}=(4X_P{Z}_P)((X_P-Z_P{)}^2+((A+2)/4)(4X_P{Z}_P)).\end{array}$$

$$\mathcal{E}:y^2=x^3+f_2{x}^2+f_{1}x+f_0.$$

$$\begin{cases}X_{\oplus}=Z_{\ominus}\big{[}(X_{P}X_{Q}-f_{1}Z_{P}Z_{Q})^{2}-4f_{0}(Z_{P}X_{Q}+X_{P}Z_{Q}+f_{2}Z_{P}Z_{Q})Z_{P}Z_{Q}\big{]}\\ Z_{\oplus}=X_{\ominus}(Z_{P}X_{Q}-X_{P}Z_{Q})^{2}\end{cases}\!\!\!\!\!\!\!\!$$

$$\{\begin{array}{l}{X}_{[2]P}=(X_P^2-f_1{Z}_P^2{)}^2-4f_0(2X_P{Z}_P+f_2{Z}_P^2)Z_P^2,\\ Z_{[2]P}=4(X_P^4+f_2{X}_P^2{Z}_P^2+f_1{X}_P{Z}_P^3+f_0{Z}_P^4).\end{array}$$

$$(X_{\oplus }:Z_{\oplus })=\left(Z_{\ominus }(X_P{X}_Q-f_1{Z}_P{Z}_Q{)}^2:X_{\ominus }(Z_P{X}_Q-X_P{Z}_Q{)}^2\right),$$

$$(X_{[2]P}:Z_{[2]P})=\left((X_P^2-f_1{Z}_P^2{)}^2:4(X_P^4+f_2{X}_P^2{Z}_P^2+f_1{X}_P{Z}_P^3)\right),$$

$$R_1=R_0\oplus P.$$

$$R_0=[(k{)}_i]P\text{and}{R}_1=[(k{)}_i+1]P,\text{where}(k{)}_i:=\lfloor k/2^i\rfloor .$$

Full text

††dedicatory: A survey in tribute to Peter L. Montgomery

1 Introduction

Peter L. Montgomery’s landmark 1987 paper Speeding the Pollard and elliptic curve methods of factorization montgomery87 introduced what became known as Montgomery curves and the Montgomery ladder as a way of accelerating Lenstra’s ECM factorization method lenstra87 . However, they have gone on to have a far broader impact: while remaining a crucial component of modern factoring software, they have also become central to elliptic curve cryptography.

Consider the following situation: let $q$ be a prime power and let $\mathcal{E}$ be an elliptic curve over $\mathbb{F}_{q}$, with group law $\oplus$, identity point $O$, and negation map $\ominus$. We have scalar multiplication endomorphisms on $\mathcal{E}$ defined by

[TABLE]

for every $k$ in $\mathbb{Z}$ (with $[-k]P:=[k](\ominus P)$). The negation map $\ominus$ is an automorphism of $\mathcal{E}$, and the quotient of $\mathcal{E}$ by $\langle{\ominus}\rangle$ is the 2-to-1 mapping

[TABLE]

such that $\mathbf{x}(P)=\mathbf{x}(Q)$ if and only if $P=Q$ or $P=\ominus Q$. If $\mathcal{E}$ is defined by a Weierstrass equation $y^{2}=f(x)$, then $\mathbf{x}$ is just $P\mapsto x(P)$; in other models or coordinate systems, $\mathbf{x}$ may be more complicated. We call $\mathbb{P}^{1}$ the $x$-line of $\mathcal{E}$.

Now, $\mathbb{P}^{1}$ does not inherit any group structure from $\mathcal{E}$. But since $\ominus$ commutes with $[k]$ (i.e., $[k]({\ominus P})={\ominus[k]P}$), we still get an induced pseudomultiplication

[TABLE]

on $\mathbb{P}^{1}$ for every $k$ in $\mathbb{Z}$.

In his seminal article proposing elliptic curves for use in cryptography, Miller miller85 pointed out that elliptic curve Diffie–Hellman key exchange can be expressed entirely in terms of the maps $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$: given a public base point $\mathbf{x}(P)$ on $\mathbb{P}^{1}$, Alice (resp. Bob) can compute and publish $\mathbf{x}([a]P)$ (resp. $\mathbf{x}([b]P)$) for some secret $a$ and $b$, and then derive the shared secret $\mathbf{x}([b][a]P)=\mathbf{x}([a][b]P)$ from $\mathbf{x}([b]P)$ (resp. $\mathbf{x}([a]P)$). We can always lift the resulting Diffie–Hellman problem to $\mathcal{E}$, so $\mathcal{E}$ provides not only the map $\mathbf{x}$, but also the security of the whole protocol; but by working in $\mathbb{P}^{1}(\mathbb{F}_{q})$ instead of $\mathcal{E}(\mathbb{F}_{q})$ we can save some space, and (hopefully) some time.

As a second application, consider ECM. We are given an integer $N$ whose prime factorization is unknown. Choosing a random elliptic curve $\mathcal{E}$ over $\mathbb{Z}/N\mathbb{Z}$ and constructing a point $P$ in $\mathcal{E}(\mathbb{Z}/N\mathbb{Z})$, we can compute $[B!]P$ for some moderate bound $B$; if there exists a prime factor $p$ of $N$ such that $\#\mathcal{E}(\mathbb{F}_{p})$ is $B$-smooth, then we will have $[B!]P\equiv O\pmod{p}$; and we can detect this situation by taking the GCD of the projective $Z$-coordinate of $[B!]P$ (for a Weierstrass model of $\mathcal{E}$) with $N$. If the GCD is neither $1$ nor $N$, then we have found a factor of $N$; otherwise, we can try again with another random $\mathcal{E}$. But all this still holds if we replace $P$ with $\mathbf{x}(P)$ and $[B!]P$ with $\mathbf{x}([B!]P)$; and the advantages of compactness and simplicity that we can see in Diffie–Hellman on $\mathbb{P}^{1}$ are magnified in the ECM context, where the integer $N$ can be much larger than any reasonable cryptographic $q$.

In both scenarios, our task is simple: we need to define a class of curves $\mathcal{E}$ equipped with efficient algorithms for computing $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$ on $\mathbb{P}^{1}$.

Montgomery’s work provides a brilliant answer to this problem. The Montgomery ladder is a simple yet efficient algorithm for computing $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$. In the abstract, the ladder is a sequence of steps of pseudo-operations derived from the curve $\mathcal{E}$ (see §3.1); choosing a Montgomery curve for $\mathcal{E}$ ensures that each of those steps is optimized. The result, for Montgomery, was an extremely efficient implementation of ECM; and even today, three decades later, Montgomery’s methods remain at the heart of state-of-the-art factoring software such as the widely-distributed GMP-ECM package GMP-ECM ; ECM20 . Later, these same qualities also led to many efficient implementations of elliptic curve cryptosystems, most notably Bernstein’s Curve25519 software curve25519 .

Notation.

Throughout, we work over the finite field $\mathbb{F}_{q}$, where $q$ is a power of an odd prime $p$ (for most contemporary applications, $q=p$ or $p^{2}$). We write $\mathtt{M}$, $\mathtt{S}$, $\mathtt{a}$, and $\mathtt{s}$ for the cost of a single multiplication, squaring, addition, and subtraction in $\mathbb{F}_{q}$, respectively. We will occasionally need to multiply by some constant elements of $\mathbb{F}_{q}$, which we hope to make as cheap as possible: we write $\mathtt{c}$ for the cost of a single such multiplication, to help keep track of this cost separately from the other multiplications with two variable inputs.

2 Montgomery curves

A Montgomery curve over $\mathbb{F}_{q}$ is an elliptic curve defined by an affine equation

[TABLE]

where $A$ and $B$ are parameters in $\mathbb{F}_{q}$ satisfying111These conditions imply nonsingularity: if $B=0$ then $\mathcal{E}_{(A,B)}$ is a union of three lines, while if $A^{2}=4$ then $\mathcal{E}_{(A,B)}$ is a nodal cubic.

$B\not=0$ and $A^{2}\not=4$. Moving to projective plane coordinates $(X:Y:Z)$, with

[TABLE]

we have the projective model

[TABLE]

There is a unique point $O=(0:1:0)$ at infinity on $\mathcal{E}_{(A,B)}$: it is the only point on $\mathcal{E}_{(A,B)}$ where $Z=0$.

2.1 The parameters $A$ and $B$

A Montgomery curve $\mathcal{E}_{(A,B)}$ is specified by two parameters, $A$ and $B$. The most important of the two is $A$, which controls the geometry of $\mathcal{E}_{(A,B)}$. Indeed, the $j$-invariant of $\mathcal{E}_{(A,B)}$ is

[TABLE]

so the $\overline{\mathbb{F}}_{q}$-isomorphism class of $\mathcal{E}_{(A,B)}$ is completely determined by $A^{2}$, and independent of $B$. We see immediately that not every elliptic curve over $\mathbb{F}_{q}$ has a Montgomery model over $\mathbb{F}_{q}$, since while every element of $\mathbb{F}_{q}$ is the $j$-invariant of some curve over $\mathbb{F}_{q}$, not every element of $\mathbb{F}_{q}$ is in the form of the right-hand-side of (2) for some $A$ in $\mathbb{F}_{q}$ (we return to the question of which curves have Montgomery models in §2.4 below).

The parameter $B$ should be thought of as a “twisting factor”: if $B^{\prime}$ is another nonzero element of $\mathbb{F}_{q}$, then $\mathcal{E}_{(A,B)}\cong\mathcal{E}_{(A,B^{\prime})}$ via $(x,y)\mapsto(x,\sqrt{B/B^{\prime}}y)$. This isomorphism is defined over $\mathbb{F}_{q}$ precisely when $B/B^{\prime}$ is a square in $\mathbb{F}_{q}$. Otherwise, $\mathcal{E}_{(A,B^{\prime})}$ is a quadratic twist of $\mathcal{E}_{(A,B)}$: isomorphic to $\mathcal{E}_{(A,B)}$ over $\mathbb{F}_{q^{2}}$, but not over $\mathbb{F}_{q}$.222We saw above that since $j(\mathcal{E}_{(A,B)})$ is a function of $A^{2}$, the $\overline{\mathbb{F}}_{q}$-isomorphism class of $\mathcal{E}_{(A,B)}$ depends only on $A^{2}$. Indeed, $\mathcal{E}_{({-A},B)}$ is $\mathbb{F}_{q}$-isomorphic (via $(x,y)\mapsto(-x,y)$) to $\mathcal{E}_{(A,{-B})}$, which is $\mathbb{F}_{q}$-isomorphic to $\mathcal{E}_{(A,B)}$ if $-1$ is a square in $\mathbb{F}_{q}$ (otherwise it is a quadratic twist).

All such quadratic twists $\mathcal{E}_{(A,B^{\prime})}$ of $\mathcal{E}_{(A,B)}$ are isomorphic to each other over $\mathbb{F}_{q}$: if $B^{\prime\prime}$ is another element of $\mathbb{F}_{q}$ such that $B/B^{\prime\prime}$ is not a square, then $B^{\prime}/B^{\prime\prime}$ must be a square, and then $\mathcal{E}_{(A,B^{\prime})}$ and $\mathcal{E}_{(A,B^{\prime\prime})}$ are isomorphic over $\mathbb{F}_{q}$ via $(x,y)\mapsto(x,\sqrt{B^{\prime}/B^{\prime\prime}}y)$.

The value of $B$ (modulo squares) is more or less incidental for cryptographic implementations. In the context of ECM, the ability to choose $B$ gives us an important degree of freedom for constructing interesting points in $\mathcal{E}(\mathbb{Z}/N\mathbb{Z})$. But when the values of $B$ and $B^{\prime}$ are mathematically and practically irrelevant (i.e., most of the time), we will simply call $\mathcal{E}_{(A,B^{\prime})}$ the quadratic twist of $\mathcal{E}_{(A,B)}$. In general, we use $\mathcal{E}^{\prime}$ to denote the quadratic twist of $\mathcal{E}$.

2.2 The group law

Since $\mathcal{E}_{(A,B)}$ is an elliptic curve, there is a group law $\oplus$ on its points; our first task is to describe it. For the moment, it suffices to work in affine coordinates; optimized projective formulæ will follow later in §3.

The point $O$ at infinity acts as the zero element of the group structure; the negation map is $\ominus:(x:y:1)\mapsto(x:-y:1)$. For addition, if $P=(x_{P},y_{P})$ and $Q=(x_{Q},y_{Q})$ are points on $\mathcal{E}_{(A,B)}$, then $P\oplus Q=(x_{\oplus},y_{\oplus})$ where

[TABLE]

with

[TABLE]

if $P=\ominus Q$, then $P\oplus Q=O$. We note that $\lambda$ is the slope of the secant through $P$ and $Q$ (or the tangent to $\mathcal{E}_{(A,B)}$ at $P$, in the case $P=Q$).

As usual, we write $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ for the group of rational points of $\mathcal{E}_{(A,B)}$ (that is, projective solutions of (1)) with coordinates in $\mathbb{F}_{q}$. The $m$-torsion $\mathcal{E}[m]$ is the kernel of the scalar multiplication $[m]$. In general, its elements are defined over some extension of $\mathbb{F}_{q}$; we write $\mathcal{E}[m](\mathbb{F}_{q})$ for the group of $m$-torsion elements whose coordinates are in $\mathbb{F}_{q}$.

2.3 Special torsion and group structures

What can we say about the group structure of $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$?

We note immediately that $\mathcal{E}_{(A,B)}$ always has a rational point of order two,

[TABLE]

the translation map on $\mathcal{E}_{(A,B)}$ taking $P$ to $P\oplus T$ is

[TABLE]

In projective coordinates, we can see one of the characteristic features of Montgomery curves more clearly. On any elliptic curve $\mathcal{E}$ with a point $T$ of order $2$, the translation-by-$T$ map on $\mathcal{E}$ commutes with $\ominus$, so it induces an involution on the $x$-line $\mathbb{P}^{1}=\mathcal{E}/\langle{\ominus}\rangle$, which has the form $(X:Z)\mapsto(aX+bZ:cX+dZ)$. But for $T=(0,0)$ on a Montgomery curve $\mathcal{E}_{(A,B)}$, this involution is as simple as possible: here, $\tau_{T}$ induces $(X:Z)\mapsto(Z:X)$ on $\mathbb{P}^{1}$.

Montgomery notes in montgomery87 , following Suyama, that the order of $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ is always divisible by 4. The nonsingularity condition requires $B$, $A+2$, and $A-2$ to be nonzero. If we let $\mathcal{E}_{(A,B^{\prime})}$ be the quadratic twist of $\mathcal{E}_{(A,B)}$, then the following facts are easy to check:

If $B(A+2)$ is a square in $\mathbb{F}_{q}$, then $(1,\pm\sqrt{(A+2)/B})$ are points of order 4 in $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ (and if $B(A+2)$ is not a square, then $(1,\pm\sqrt{(A+2)/B^{\prime}})$ are points of order 4 in $\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$).333 Montgomery notes that in an ECM context we can take $B=A+2$ in order to force $(1,1)$ to be a rational point of order 4. 2. 2.

Similarly, if $B(A-2)$ is a square in $\mathbb{F}_{q}$, then $(-1,\pm\sqrt{(A-2)/B})$ are points of order 4 in $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$; otherwise, $(-1,\pm\sqrt{(A-2)/B^{\prime}})$ are points of order 4 in $\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$. 3. 3.

If neither $B(A+2)$ nor $B(A-2)$ is a square, then $A^{2}-4$ must be a square; then $x^{2}+Ax+1$ splits completely over $\mathbb{F}_{p}$, so $\mathcal{E}_{(A,B)}$ has full rational $2$-torsion. If $\alpha$ is one root of $x^{2}+Ax+1$, then the other root is $1/\alpha$; the points $(\alpha:0:1)$ and $(1:0:\alpha)$ have order $2$, and are exchanged by $\tau_{T}$. There are also points of order two on $\mathcal{E}_{(A,B^{\prime})}$ with exactly the same coordinates.

The key thing is that in any finite field, $B(A+2)$, $B(A-2)$, and $A^{2}-4$ cannot all be nonsquares simultaneously: at least one of the above situations is forced to occur, and so $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ is always divisible by $4$. Table 1 summarizes the resulting group structures for various combinations of the three conditions.

Going further, Suyama shows that if we take $A=-(3a^{4}+6a^{2}-1)/4a^{3}$ and $B=(a^{2}-1)^{2}/4ab^{2}$ for some $a$ and $b$ in $\mathbb{F}_{q}$ with $ab(a^{2}-1)(9a^{2}-1)\not=0$, then $(a,b)$ is a point of order $3$ in $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$. This is useful in ECM, where we want to produce curves whose reduction modulo $p$ have smooth order; reducing a curve from Suyama’s parametrization yields a curve whose order is divisible by 12, and hence more probably smooth than a the order of a random curve.

For cryptographic constructions, we generally want $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ to be as near prime as possible. A Montgomery curve over a finite field can never have prime order: we always have $4\mid\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ (and $4\mid\#\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$), so the best we can hope for is $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})=4r$ with $r$ prime. Reassuringly, there is no theoretical obstruction to the existence of $\mathcal{E}_{(A,B)}/\mathbb{F}_{q}$ such that $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})=4r$ with $r$ prime; and indeed, in practice we have no trouble finding $A$ and $B$ in $\mathbb{F}_{q}$ such that $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})/4$ is prime.

2.4 Correspondence with short Weierstrass models

Any Montgomery curve over $\mathbb{F}_{q}$ can be transformed into a short Weierstrass model over $\mathbb{F}_{q}$ (assuming $q$ is not a power of $3$): for example, the rational maps $(x,y)\mapsto(u,v)=(B(x+A/3),B^{2}y)$ and $(u,v)\mapsto(x,y)=(u/B-A/3,v/B^{2})$ define an isomorphism over $\mathbb{F}_{q}$ between $\mathcal{E}_{(A,B)}$ and the short Weierstrass model

[TABLE]

The converse does not hold: not every short Weierstrass model can be transformed into a Montgomery model over $\mathbb{F}_{q}$. This is obvious enough: not every short Weierstrass model has a rational point of order $2$ to map to $T$ (and not every $j$-invariant in $\mathbb{F}_{q}$ can be expressed in the form of (2) with $A$ in $\mathbb{F}_{q}$).

Still, it is useful to have a simple algebraic condition on the coefficients of a short Weierstrass model that encapsulate its transformability to Montgomery form. With this in mind, Okeya, Kurumatani, and Sakurai Okeya–Kurumatani–Sakurai observe that $\mathcal{E}^{W}:v^{2}=u^{3}+au+b$ has a Montgomery model if and only if there exist $\alpha$ and $\beta$ in $\mathbb{F}_{q}$ such that $\alpha^{3}+a\alpha+b=0$ and $3\alpha^{2}+a=\beta^{2}$: we then have an isomorphism $(u,v)\mapsto(x,y)=((u-\alpha)/\beta,v/\beta)$ from $\mathcal{E}^{W}$ to the Montgomery curve $\mathcal{E}_{(3\alpha/\beta,1/\beta)}$. The first relation ensures that there is a rational $2$-torsion point $(\alpha,0)$ in $\mathcal{E}^{W}(\mathbb{F}_{q})$ (which is mapped to $T=(0,0)$ by the isomorphism); the second ensures that translation by the image of that point acts as in (3).

2.5 Correspondence with twisted Edwards models

The last decade has seen the great success of Edwards models for elliptic curves in cryptographic implementations (see eg. edwards07 , danja07 , and BBJLP08 ). It turns out that every Montgomery curve over $\mathbb{F}_{q}$ is $\mathbb{F}_{q}$-isomorphic to a twisted Edwards model, and vice versa (BBJLP08, , §3). The rational maps

[TABLE]

define an isomorphism between $\mathcal{E}_{(A,B)}$ and the twisted Edwards model

[TABLE]

The most natural projective closure for $\mathcal{E}_{(a,d)}^{\mathrm{Ed}}$ is not in $\mathbb{P}^{2}$, but in $\mathbb{P}^{1}\times\mathbb{P}^{1}$, which embeds into $\mathbb{P}^{3}$ via the Segre morphism. Taking coordinates $(U_{0}:U_{1}:U_{2}:U_{3})$ on $\mathbb{P}^{3}$, with $u=U_{1}/U_{0}$, $v=U_{2}/U_{0}$, and $uv=U_{3}/U_{0}$, we obtain the projective model $\mathcal{E}_{(a,d)}^{\mathrm{Ed}}:U_{0}^{2}+dU_{3}^{2}=aU_{1}^{2}+U_{2}^{2},U_{0}U_{3}=U_{1}U_{2}$ (the second equation defines the image of $\mathbb{P}^{1}\times\mathbb{P}^{1}$ in $\mathbb{P}^{3}$); these are the extended Edwards coordinates of HWCD .

The point $O$ on $\mathcal{E}_{(A,B)}$ maps to $(0,1)=(1:0:1:0)$ on $\mathcal{E}^{\mathrm{Ed}}_{(a,d)}$. The negation is $\ominus(u,v)=(-u,v)$, and the map $\mathbf{x}:\mathcal{E}_{(a,d)}^{\mathrm{Ed}}\to\mathbb{P}^{1}$ sends $P$ to $v(P)$; if $\mathcal{E}_{(a,d)}^{\mathrm{Ed}}$ is viewed as a curve in $\mathbb{P}^{1}\times\mathbb{P}^{1}$, then $\mathbf{x}$ is just projection onto the second factor. The distinguished $2$-torsion point $T$ maps to $(0,-1)=(1:0:-1:0)$, and the translation $\tau_{T}$ becomes $(U_{0}:U_{1}:U_{2}:U_{3})\mapsto(U_{0}:U_{1}:-U_{2}:-U_{3})$ on $\mathcal{E}^{\mathrm{Ed}}_{(a,d)}$.

We can also consider the images of the other torsion points described in §2.3. The $2$-torsion points $(\frac{-1}{2}(A\pm\sqrt{A^{2}-4}),0)$ on $\mathcal{E}_{(A,B)}$ map to $(0:(A-2):0:\pm\sqrt{A^{2}-4})$ on $\mathcal{E}_{(a,d)}^{\mathrm{Ed}}$, while the 4-torsion points $(1,\pm\sqrt{(A+\epsilon 2)/B})$ map to $(\pm\sqrt{(A+\epsilon 2)/B}:1:0:0)$ for $\epsilon=\pm 1$.

3 Fast differential arithmetic in $\mathbb{P}^{1}$

In projective coordinates, the quotient map $\mathbf{x}:\mathcal{E}_{(A,B)}\to\mathcal{E}/\langle{\ominus}\rangle=\mathbb{P}^{1}$ is

[TABLE]

We emphasize that the formula $\mathbf{x}((X:Y:Z))=(X:Z)$ only holds on the open subset of $\mathcal{E}_{(A,B)}$ where $Z\not=0$; it does not extend to the point $O=(0:1:0)$ at infinity, because $(0:0)$ is not a projective point.

3.1 Pseudo-operations

Our first step towards computing $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$ is to define efficient pseudo-group operations on $\mathbb{P}^{1}$ derived from the group operation on $\mathcal{E}_{(A,B)}$. As we noted earlier, $\mathbb{P}^{1}$ inherits no group structure from $\mathcal{E}_{(A,B)}$: in particular, there is no map $(\mathbf{x}(P),\mathbf{x}(Q))\mapsto\mathbf{x}(P\oplus Q)$. This is because $\mathbf{x}(P)$ determines $P$ only up to sign, so while $(\mathbf{x}(P),\mathbf{x}(Q))$ mathematically determines the pair $\{\mathbf{x}(P\oplus Q),\mathbf{x}(P\ominus Q)\}$, we cannot tell which of the values is the correct “sum”. However, any three of the values $\{\mathbf{x}(P),\mathbf{x}(Q),\mathbf{x}(P\oplus Q),\mathbf{x}(P\ominus Q))\}$ determines the fourth, so we can define a pseudo-addition on $\mathbb{P}^{1}$ by

[TABLE]

The degenerate case where $P=Q$ becomes a pseudo-doubling

[TABLE]

These two operations will be the basis of our efficient pseudomultiplications.

Our first task is to compute ${\tt xADD}$ and ${\tt xDBL}$ efficiently. Let $P=(x_{P},y_{P})$ and $Q=(x_{Q},y_{Q})$ be points on $\mathcal{E}_{(A,B)}$, with neither equal to $T$ or $O$ (so in particular, $x_{P}$ and $x_{Q}$ are both nonzero). Montgomery observed that if $P\not=Q$, then the $x$-coordinates of $P$, $Q$, $P\oplus Q$, and $P\ominus Q$ are related by

[TABLE]

while in the case $P=Q$, writing $[2]P=(x_{[2]P},y_{[2]P})$, we have

[TABLE]

Analogous identities exist for general Weierstrass models, but they are much simpler for Montgomery curves—as we will see in §3.4. It is this simplicity, due to the special form of $\tau_{T}$ discussed in §2.3, that leads to particularly efficient pseudo-operations for Montgomery curves.

3.2 Pseudo-addition

Our aim is to compute $\mathbf{x}(P\oplus Q)$ in terms of $\mathbf{x}(P)$, $\mathbf{x}(Q)$, and $\mathbf{x}(P\ominus Q)$; we suppose $P\not=Q$ and $P\ominus Q\not=T$. Following Montgomery (montgomery87, , §10.3.1), we move to projective coordinates and write

[TABLE]

Since $P\ominus Q\notin\{O,T\}$, we know that $X_{\ominus}\not=0$ and $Z_{\ominus}\not=0$. Equation (7) therefore becomes the pair of simultaneous relations

[TABLE]

which Algorithm 1 applies to efficiently compute $\mathbf{x}(P\oplus Q)$. If the “difference” $\mathbf{x}(P\ominus Q)$ is fixed then we can normalize it to $(X_{P}:1)$, thus saving one multiplication in Step 1. Note that ${\tt xADD}$ involves neither of the curve parameters $A$ or $B$, so it is identical for all Montgomery curves.

3.3 Pseudo-doubling

It remains to handle the doubling case, where $Q=P$. We want to compute $(X_{[2]P}:Z_{[2]P}):=\mathbf{x}([2]P)$ in terms of $\mathbf{x}(P)$. Again, we follow (montgomery87, , §10.3.1): in projective coordinates, Equation (8) becomes the pair of simultaneous relations

[TABLE]

Algorithm 2 uses these, and the identity $4X_{P}Z_{P}=(X_{P}+Z_{P})^{2}-(X_{P}-Z_{P})^{2}$, to efficiently compute $(X_{[2]P}:Z_{[2]P})$. The fact that the right-hand-sides of (10) are symmetric under $(X_{P}:Z_{P})\leftrightarrow(Z_{P}:X_{P})$ reflects the fact that the doubling map $[2]$ factors through the $2$-isogeny $\mathcal{E}_{(A,B)}\to\mathcal{E}_{(A,B)}/\langle{T}\rangle$; this aspect of Montgomery’s $x$-line arithmetic later found an echo in Doche, Icart, and Kohel’s work on efficient doubling and tripling DIK .

Step 2 of Algorithm 2 is a multiplication by the constant $(A+2)/4$. We emphasize that this is the only place in the $x$-line arithmetic where the parameter $A$ appears. The parameter $B$ never appears at all: $x$-line arithmetic is twist-agnostic. For implementations, therefore, we try to choose $A$ such that the cost of multiplying by $(A+2)/4$ is minimised (for example, taking $A$ such that $(A+2)/4$ is particularly small).

3.4 Comparison with general $x$-line arithmetic

To see how Montgomery’s choice of curve model contributes to efficient $x$-line arithmetic, it is instructive to compare the pseudo-addition with the equivalent formulæ for a general Weierstrass model

[TABLE]

The analogues of (7) and (8) for $\mathcal{E}$ are $x_{\oplus}x_{\ominus}(x_{P}-x_{Q})^{2}=(x_{P}x_{Q}-f_{1})^{2}-4f_{0}(x_{P}+x_{Q}+f_{2})$ and $4x_{[2]P}(x_{P}^{3}+f_{2}x_{P}^{2}+f_{1}x_{P}+f_{0})=(x_{P}^{2}-f_{1})^{2}-4f_{0}(2x_{P}+f_{2})$, respectively. In projective coordinates, these become the relatively complicated pseudo-addition formulæ

[TABLE]

and pseudo-doubling formulæ

[TABLE]

If we specialize and take $f_{2}=0$, leaving $f_{1}$ and $f_{0}$ free, then we are in the case of short Weierstrass models (for which the affine formulæ are classical: see eg. (Cassels, , Formulary)). This imposes no special structure on $\mathcal{E}$, since every elliptic curve is isomorphic to a short Weierstrass model over $\mathbb{F}_{q}$. The resulting projective formulæ were proposed for side-channel-aware implementations by Brier and Joye (Brier–Joye, , §4), with pseudo-addition requiring $7\mathtt{M}+2\mathtt{S}+2\mathtt{c}+3\mathtt{a}+2\mathtt{s}$ and pseudo-doubling $3\mathtt{M}+4\mathtt{S}+2\mathtt{c}+6\mathtt{a}+2\mathtt{s}$.

But we can simplify things more dramatically by taking $f_{0}=0$ instead, leaving $f_{1}$ and $f_{2}$ free. This is equivalent to requiring a rational $2$-torsion point on $\mathcal{E}$, which we move to $(0,0)$. The pseudo-addition formulæ become

[TABLE]

which can be evaluated in $6\mathtt{M}+2\mathtt{S}+1\mathtt{c}+2\mathtt{s}$, while pseudo-doubling becomes

[TABLE]

which can be evaluated in $2\mathtt{M}+4\mathtt{S}+2\mathtt{c}+4\mathtt{a}+1\mathtt{s}$.

Now taking $f_{1}=1$ not only eliminates $1\mathtt{c}$ in the pseudo-addition and pseudo-doubling, it also allows us to save $2\mathtt{M}$ in the pseudo-addition and $2\mathtt{S}$ in the pseudo-doubling (at the cost of a few more additions and subtractions) by exploiting the symmetry of the resulting forms444Translation by the $2$-torsion point $(0,0)$ is defined by $(x,y)\mapsto(f_{1}/x,-f_{1}y/x^{2})$; taking $f_{1}=1$ is therefore equivalent to putting this translation map in the special form of (3). . Indeed, if we write $A$ for $f_{2}$ and allow a possible quadratic twist by $B$, then we have arrived at Montgomery’s model $\mathcal{E}:By^{2}=x(x^{2}+Ax+1)$, and we recover the efficient pseudo-addition and pseudo-doubling in (9) and (10).

4 The Montgomery ladder

We now resume our task of computing $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$. We begin by explaining a version of the Montgomery ladder that uses full group operations to compute $P\mapsto[k]P$ on $\mathcal{E}_{(A,B)}$, before deriving the classic $x$-line Montgomery ladder which computes $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$ using only ${\tt xADD}$ and ${\tt xDBL}$. We then present Okeya and Sakurai’s version of the López–Dahab trick, an appendix to the $x$-only ladder which recovers the full image point $[k]P$ on $\mathcal{E}_{(A,B)}$.

4.1 The ladder in a group

Algorithm 3 presents the Montgomery ladder algorithm in the context of a group, for ease of analysis. (While the algorithm is presented using a Montgomery curve $\mathcal{E}_{(A,B)}$, it is clear that it works in any abelian group).

Algorithm 3 maintains two important invariants. First, looking at Lines 3 and 3, we see that the difference $R_{1}\ominus R_{0}$ never changes; then, looking at Line 3, we see that that difference must always be $P$; hence, at all times,

[TABLE]

Second, after iteration $i$ of the loop (counting downwards from $\ell-2$), we have

[TABLE]

This proves the correctness of Algorithm 3: at Line 3 we have just finished iteration $i=0$, so we return $R_{0}=[(k)_{0}]P=[k]P$. Equation (12) is easy to see once we know (11): looking at $R_{0}$ in each iteration, we recover the classic double-and-add method for computing $[k]P$. First, $R_{0}$ is initialized to $P$; then, if $k_{i}=0$ we double $R_{0}$, while if $k_{i}=1$ we replace $R_{0}$ with $R_{0}\oplus R_{1}$, which is $[2]R_{0}\oplus P$ by (11)—that is, we double $R_{0}$ and add $P$.

4.2 The Montgomery ladder

Equations (11) and (12) allow us to transform Algorithm 3 into Algorithm 4, known as the Montgomery ladder. We want to compute $\mathbf{x}(P)\mapsto\mathbf{x}([k]P)$. We may suppose $P\not=O$, since $\mathbf{x}([k]O)=\mathbf{x}(O)$ for all $k$, and we may also suppose $P\not=T$, since $\mathbf{x}([k]T)=\mathbf{x}(T)$ for odd $k$ and $\mathbf{x}(O)$ for even $k$.

Maintaining the notation of (12), let $(\textnormal{{x}}_{0},\textnormal{{x}}_{1})=(\mathbf{x}([(k)_{i}]P),\mathbf{x}([(k)_{i}+1]P))$. Then (11) shows that we can compute $(\mathbf{x}([(k)_{i-1}]P),\mathbf{x}([(k)_{i-1}+1]P))$ as $({\tt xDBL}(\textnormal{{x}}_{0}),{\tt xADD}(\textnormal{{x}}_{0},\textnormal{{x}}_{1},\mathbf{x}(P)))$ or $({\tt xADD}(\textnormal{{x}}_{0},\textnormal{{x}}_{1},\mathbf{x}(P)),{\tt xDBL}(\textnormal{{x}}_{1}))$, depending on the value of the bit $k_{i}$.555Since the ${\tt xADD}$ and ${\tt xDBL}$ calls always share an argument, it is common for high-performance implementations to exploit any overlap between intermediate calculations in the ${\tt xADD}$ and ${\tt xDBL}$ by merging them in one combined function.

We can therefore initialize $(\textnormal{{x}}_{0},\textnormal{{x}}_{1})$ to $(\mathbf{x}(P),\mathbf{x}([2]P))=(\mathbf{x}(P),{\tt xDBL}(\mathbf{x}(P)))$, and then applying the transitions above for each bit of $k$ will yield $(\textnormal{{x}}_{0},\textnormal{{x}}_{1})=(\mathbf{x}([k]P),\mathbf{x}([k+1]P))$.

While the final value of $\textnormal{{x}}_{0}$ is $\mathbf{x}([k]P)$, the target of our calculation, we will see in §4.3 that the final value $\mathbf{x}([k+1]P)$ of $\textnormal{{x}}_{1}$ can be used to help recover the full group element $[k]P$, if desired. We therefore include $\textnormal{{x}}_{1}$ as an optional second return value in Algorithm 4.

4.3 Recovery of $y$-coordinates

On the surface, the Montgomery ladder appears to be an algorithm for computing $\mathbf{x}([k]P)$ from $\mathbf{x}(P)$. However, López and Dahab LD99 observed that since it actually computes $\mathbf{x}([k]P)$ and $\mathbf{x}([k+1]P)$, the ladder can easily be extended to compute the full scalar multiplication $P\mapsto[k]P$ by first computing $\mathbf{x}(P)\mapsto(\mathbf{x}([k]P),\mathbf{x}([k+1]P))$ and then recovering $[k]P$ from the data $(P,\mathbf{x}([k]P),\mathbf{x}([k+1]P))$.

López and Dahab originally gave formulæ for this recovery step specific to Montgomery curves over binary fields. Their results were extended to prime-field Montgomery curves by Okeya and Sakurai Okeya–Sakurai , and later to short Weierstrass models by Brier and Joye Brier–Joye . Kohel provides a more general and powerful point of view in Kohel11 , treating the image of the curve under the map $Q\mapsto(\mathbf{x}(Q),\mathbf{x}(Q\oplus P))$ as a new model of the elliptic curve itself.

Okeya and Sakurai proceed as follows. Suppose $P$ is not in $\mathcal{E}_{(A,B)}[2]$, and $Q$ is not in $\{P,{\ominus P},O\}$.666This is not a serious restriction in the context of scalar multiplication, where $Q=[k]P$: if $P$ is a point of order $2$, then either $[k]P=O$ or $y([k]P)=0$.

In affine coordinates, writing $(x_{P},y_{P})=P$, $(x_{Q},y_{Q})=Q$, and $(x_{\oplus},y_{\oplus})=P\oplus Q$ as usual, the group law formulæ in §2.2 show that $y_{Q}$ can be deduced from $x_{P}$, $y_{P}$, $x_{Q}$, and $x_{\oplus}$ using the relation

[TABLE]

(note the re-appearance of the twisting parameter $B$).

Algorithm 5, taken from (Okeya–Sakurai, , Algorithm 1), applies this to compute $Q$ from $P$, $\mathbf{x}(Q)$, and $\mathbf{x}(P\oplus Q)$. Lines 5 and 5 involve multiplications by the constants $2A$ and $2B$. Referring back to §3.3, if $(A+2)/4$ is chosen to be advantageously small, then $2A=8((A+2)/4)-4$ is also small. Similarly, referring back to §2.1, we can choose $B$ such that multiplication by $2B$ is essentially free.

Combining Algorithms 4 and 5 yields Algorithm 6, an efficient scalar multiplication routine for the full group $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ using $x$-only arithmetic. This is generally much more efficient than Algorithm 3.

5 Montgomery curves and ladders in elliptic curve cryptography

We saw in §2.3 that no Montgomery curve can have prime order, since their order is always divisible by 4. The presence of this small cofactor 4 has no serious impact on the security level of a well-chosen Montgomery curve, since the state of the art for solving discrete logarithms in large prime-order subgroups of Montgomery curves is still Pollard’s rho method pollardrho .

5.1 Montgomery curves in cryptographic standards

None of the elliptic curves so far standardardized by NIST FIPS186-4 , Brainpool brainpool , or ANSSI ANSSI can be transformed into Montgomery form over the base field, because they all have prime order, so they are unfortunately incompatible with Montgomery arithmetic. However, the two curves recently proposed by the Internet Research Task Force (IRTF) for standardization in the Transport Layer Security (TLS) protocol are specified in Montgomery form RFC .

Example 1 (Curve25519 curve25519 )

The most widely-known Montgomery curve in contemporary cryptography is the curve used in Bernstein’s Curve25519 software for Diffie–Hellman key exchange. This curve is defined by

[TABLE]

We find $\#\mathcal{E}(\mathbb{F}_{p})=8r$ and $\#\mathcal{E}^{\prime}(\mathbb{F}_{p})=4r^{\prime}$, where $r$ and $r^{\prime}$ are 253-bit primes.

Example 2 (Curve448 goldilocks )

Hamburg’s Curve448 offers a conservative, high-strength alternative to Curve25519 for TLS. This curve is defined by

[TABLE]

We find $\#\mathcal{E}(\mathbb{F}_{p})=4r$ and $\#\mathcal{E}^{\prime}(\mathbb{F}_{p})=4r^{\prime}$, where $r$ and $r^{\prime}$ are 446- and 447-bit primes, respectively.

5.2 Diffie–Hellman with $x$-coordinates

Recall Miller’s $x$-only Diffie–Hellman protocol, described in §1: Alice computes $(a,\mathbf{x}(P))\mapsto\mathbf{x}([a]P)$ and transmits her public key $\mathbf{x}([a]P)$ to Bob. Upon receiving Bob’s public key $\mathbf{x}([b]P)$, she computes $(a,\mathbf{x}([b]P))\mapsto\mathbf{x}([ab]P)$ to arrive at the same shared secret as Bob, who computes $(b,\mathbf{x}([a]P))\mapsto\mathbf{x}([ba]P)$. This $x$-only protocol is the basis of Bernstein’s Curve25519 key exchange software. But in addition to working entirely with $x$-coordinates, Bernstein observed that the Montgomery form allows for another simplification in real-world implementations. Recall from §2.1 that if $\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$ is the quadratic twist of $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$, then precisely one of $B$ and $B^{\prime}$ is a square in $\mathbb{F}_{q}$, and the other is a non-square. It follows that every element $x_{P}$ in $\mathbb{F}_{q}$ corresponds to a point $P=(x_{P},y_{P})$ which is either in $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$, in $\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$, or (if $y_{P}=0$) in both $\mathcal{E}_{(A,B)}[2](\mathbb{F}_{q})$ and $\mathcal{E}_{(A,B^{\prime})}[2](\mathbb{F}_{q})$. Bernstein chose the curve in Example 1 by insisting that both $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ and $\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})$ have cryptographically strong (i.e., almost prime) group orders. This means that every element of $\mathbb{F}_{q}$ corresponds to a point on a cryptographically strong Montgomery curve, and implementers need not perform any point validation checks invalidcurve in this protocol. Moreover, since the Montgomery ladder does not use the constant $B$, it correctly computes $(\mathbf{x}(P),k)\mapsto\mathbf{x}([k]P)$ irrespective of the twist that $P$ lies on. If both $\mathcal{E}_{(A,B)}$ and $\mathcal{E}_{(A,B^{\prime})}$ are secure, then $\mathcal{E}_{(A,B)}$ is said to be twist-secure.

As we noted above, when implementing cryptosystems based on the discrete logarithm or Diffie–Hellman problems, we generally want $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})$ as close to prime as possible. We have $\#\mathcal{E}_{(A,B)}(\mathbb{F}_{q})+\#\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})=2q+2$, as with any elliptic curve-twist pair over $\mathbb{F}_{q}$; so if $\mathcal{E}_{(A,B)}(\mathbb{F}_{q})=4r$ with $r$ prime, then the closest we can come to prime order for the twist is $\#\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})=4r^{\prime}$ with $r^{\prime}$ prime if $q\equiv 3\pmod{4}$, and $\#\mathcal{E}_{(A,B^{\prime})}(\mathbb{F}_{q})=8r^{\prime}$ with $r^{\prime}$ prime if $q\equiv 1\pmod{4}$. We do not know of any theoretical asymptotic results guaranteeing a density or distribution of twist-secure Montgomery curves over any finite field, but there does not seem to be any problem in finding such curves in practice.777An analysis of the frequency of prime-order curves with prime-order twists appears in Shparlinski–Sutantyo ; but this does not apply to Montgomery curves, since they cannot have prime order.

The presence of non-trivial cofactors means that care must be taken in certain scenarios to thwart the threat of small subgroup attacks limlee . For $x$-line Diffie–Hellman, the easiest way to do this is to define all secret scalars to be a multiple of the lowest common multiple of the curve and twist cofactors.

5.3 Constant-time ladders

For secure software implementations of ECC, it is important that scalar multiplication routines exhibit uniform execution patterns with no correlation between timing and secret data; such constant-time behaviour is an essential first step towards preventing timing attacks Kocher . Unlike many other addition chains and scalar multiplication algorithms, the Montgomery ladder has an inherently uniform execution pattern. Nevertheless, a number of issues must still be addressed in order to achieve constant-time implementations.

As it stands, the length of the main loop in Algorithm 4 is determined by the bitlength $k$ of the input scalar $m\in[0,r)$. There are two common strategies for making the loop length independent of $k$. One option is to require all scalars to have their top bit set, either by defining them that way (as was done in curve25519 ) or by adding a small, fixed multiple of the (sub)group order to each scalar. A second option is to modify Step 4 of Algorithm 4, setting $(\textnormal{{x}}_{0},\textnormal{{x}}_{1})\leftarrow(\mathbf{x}(O),\mathbf{x}(P))$ instead of $(\mathbf{x}(P),\mathbf{x}([2]P))$. Since the formulæ for ${\tt xDBL}$ and ${\tt xADD}$ behave correctly under these inputs, $\textnormal{{x}}_{0}$ and $\textnormal{{x}}_{1}$ will remain unchanged until the first non-zero bit of the scalar $k$ is encountered, so a constant-length loop can be achieved by accepting scalars as all bitstrings of a fixed length.

Algorithm 4 presents the ladder using an if statement. Since each if represents branching on potentially secret data, and these branches may be measured in timing variations, it is standard practice to replace the branches with conditional swaps (such as the $\mathtt{SWAP}$ defined in Algorithm 7) to avoid leaking information on secret scalars. The result is Algorithm 8, which consists of a uniform sequence of ${\tt xDBL}$s and ${\tt xADD}$s. Provided the field arithmetic used by the ${\tt xADD}$ and ${\tt xDBL}$ specified in Algorithms 1 and 2 is implemented in a completely uniform way, this yields a completely uniform algorithm.

5.4 Completeness and Bernstein’s modified $\mathbf{x}$-map

Algorithms 4 and 8 do not compute the pseudomultiplication $\mathbf{x}([k]P)$ correctly if $P=O$ or $T$: instead, they return $(X_{k},Z_{k})=(e,0)$ for some $e$ in $\mathbb{F}_{q}$ (see (avoidzero, , Theorem 4.3) for a more precise statement). In some cases $e$ may be [math], in which case $(X_{k}:Z_{k})=(0:0)$ is not even a projective point; but even if $e\not=0$, the resulting $(X_{k}:Z_{k})=(1:0)$ may not be equal to $\mathbf{x}([k]P)$.

In Montgomery’s original context of ECM, this is a feature, not a bug: the ultimate goal there is to produce $(X_{k},Z_{k})$ such that $\gcd(Z_{k},N)>1$, regardless of whether or not $(X_{k}:Z_{k})$ is a correct pseudomultiplication result, or even a legal projective point. But it presents a complication for $x$-line Diffie–Hellman, because it appears that the parties in a key exchange are obliged to carry out some zero checks to ensure that the inputs are not $\mathbf{x}(O)$ or $\mathbf{x}(T)$.

Bernstein shows that a modest modification to the map $\mathbf{x}$ allows such checks to be omitted entirely (avoidzero, , Theorem 5.1). The result is a Diffie–Hellman key exchange where the inputs are not points on the $x$-line, but simple finite field elements, by using the mapping $\mathbf{x}_{0}:\mathcal{E}_{(A,B)}(\mathbb{F}_{q})\to\mathbb{F}_{q}$ defined by

[TABLE]

in place of $\mathbf{x}$. This means using the ladder with input $(X_{P},Z_{P})=(x,1)$, where $x=\mathbf{x}_{0}(P)$ for any $P$ on $\mathcal{E}_{(A,B)}$ or its twist—so $x$ can be any element of $\mathbb{F}_{q}$—then returning $x_{k}=X_{k}Z_{k}^{q-2}$ in $\mathbb{F}_{q}$ instead of $(X_{k},Z_{k})$. Note that $x_{k}=X_{k}/Z_{k}$ if $Z_{k}\not=0$, and [math] otherwise; in either case, $x_{k}=\mathbf{x}_{0}([k]P)$. Bernstein’s $\mathbf{x}_{0}$ therefore provides pseudo-completeness for the ladder on Montgomery curves, and an extremely simple and efficient key exchange based on the maps $x\mapsto x_{k}$.

6 Differential addition chains and higher-dimensional algorithms

An addition chain of length $\ell$ for a nonnegative integer $k$ is an increasing sequence of nonnegative integers, $(c_{0},\dots,c_{\ell})$, with $c_{0}=1$ and $c_{\ell}=k$, satisfying the following property: for all $0<i\leq m$, there exist $j$ and $j^{\prime}$ such that $c_{i}=c_{j}+c_{j^{\prime}}$ with $0\leq j\leq j^{\prime}\leq i$. Addition chains have wide application in public key cryptography due to their correspondence with group exponentiations. In the context of elliptic curve cryptography, the existence of a length $\ell$ addition chain $(c_{0},\dots,c_{\ell})$ for $k$ implies that the scalar multiplication $(k,P)\mapsto[k]P$ can be computed using $\ell$ group operations. Thus, shorter addition chains require fewer operations, and ultimately yield faster scalar multiplication routines.

To use the fast $x$-line arithmetic of Montgomery curves, we need a special type of addition chain. A differential addition chain of length $\ell$ for an integer $k$ is a sequence $(c_{0},\dots,c_{\ell+1})$ with $c_{0}=0$, $c_{1}=1$, and (for our purposes) $k\in\{c_{\ell},c_{\ell+1}\}$, together with the property that for all $1<i\leq\ell+1$, there exist $i^{\prime}$, $j$ and $j^{\prime}$ such that $c_{i}=c_{j}+c_{j^{\prime}}$ and $c_{i^{\prime}}=c_{j^{\prime}}-c_{j}$ with $0\leq i^{\prime}\leq j\leq j^{\prime}<i$. The existence of a length-$\ell$ differential addition chain for $k$ implies that the pseudomultiplication $(k,\mathbf{x}(P))\mapsto\mathbf{x}([k]P)$ can be computed using a total of $\ell$ differential operations (i.e., ${\tt xADD}$s and ${\tt xDBL}$s).

For an $\ell$-bit scalar, the Montgomery ladder corresponds to a length $2\ell-1$ differential addition chain $(c_{0},\dots,c_{2\ell})$; it requires two additions (one of which is a doubling) for each bit of the scalar except the top bit, where only one operation is required. In his search for shorter differential addition chains montgomery-lucas , Montgomery proved that any $\ell$-bit prime scalar requires at least $1.440\ell$ $x$-line operations, providing a lower bound on the number of operations required in a differential addition chain in the worst case (montgomery-lucas, , §3). (The best-case exponents, powers of 2, require 1 operation per bit.)

6.1 Montgomery’s Euclidean algorithms

The Montgomery ladder is a differential addition chain where the difference index $c_{i^{\prime}}$ is in $\{1,0\}$ throughout; this corresponds to every ${\tt xADD}$ taking the same difference $\mathbf{x}(P)$. While this yields a simple and uniform algorithm, allowing $c_{i^{\prime}}$ to vary further can yield shorter addition chains and faster scalar multiplication.

Starting from the (subtractive) Euclidean algorithm for finding the greatest common divisor of two integers, Montgomery derived several algorithms for producing differential addition chains that were significantly shorter than his ladder. The idea is to have a coprime auxiliary exponent alongside the input $k$, and use the intermediate steps in the Euclidean algorithm to write down a differential addition chain for $k$. This process computes a differential addition chain for the auxiliary exponent as well, so these algorithms are inherently 2-dimensional. Here we discuss one of these algorithms, PRAC, beginning with its 2-dimensional core before returning to the 1-dimensional wrapper.

Algorithm 9 (EUCLID2D) is a version of Montgomery’s 2-dimensional PRAC subroutine using only the “binary” transformations proposed by Montgomery in (montgomery-lucas, , Table 4). Given a multiscalar $(m,n)$ and $\mathbf{x}(P)$, $\mathbf{x}(Q)$, and $\mathbf{x}(P\ominus Q)$, it computes $\mathbf{x}([m]P\oplus[n]Q)$ using only ${\tt xADD}$ and ${\tt xDBL}$ operations. This variant chain was used (for non-uniform scalar multiplications) by the implementation of endomorphism-accelerated scalar multiplications on the curve in Example 3.

Since the difference arguments to the ${\tt xADD}$s in EUCLID2D vary, we must be careful about handling differences like $\mathbf{x}(O)$ and $\mathbf{x}(T)$, which cause the ${\tt xADD}$ and ${\tt xDBL}$ we defined in Algorithms 1 and 2 to degenerate. For simplicity, in this section we suppose that ${\tt xADD}$ and ${\tt xDBL}$ have been extended to cover all inputs (perhaps using conditional code, which is acceptable in these non-uniform algorithms).

At first glance, EUCLID2D is much more complicated than LADDER, but it is in fact remarkably simple and elegant. Suppose we want to compute $[m]P\oplus[n]Q$. Lines 9 through 12 maintain the following invariants:

$\gcd(\textnormal{{s}}_{0},\textnormal{{s}}_{1})=\gcd(m,n)$ (the reader may recognise a subtractive Euclidean algorithm here), and $(\textnormal{{x}}_{0},\textnormal{{x}}_{1},\textnormal{{x}}_{\ominus})=(\mathbf{x}(R_{0}),\mathbf{x}(R_{1}),\mathbf{x}(R_{1}\ominus R_{0}))$ for some $R_{0}$ and $R_{1}$ in $\mathcal{E}_{(A,B)}$ such that $[\textnormal{{s}}_{0}]R_{0}\oplus[\textnormal{{s}}_{1}]R_{1}=[m]P\oplus[n]Q$. Hence after the first while loop, having arrived at $\textnormal{{s}}_{0}=0$, we must have $\textnormal{{s}}_{1}=\gcd(m,n)$ and $\textnormal{{x}}_{1}=\mathbf{x}([m/\textnormal{{s}}_{1}]P\oplus[n/\textnormal{{s}}_{1}]Q)$. To complete the task, it suffices to carry out a 1-dimensional pseudomultiplication of $\textnormal{{x}}_{1}$ by $\textnormal{{s}}_{1}=\gcd(m,n)$ (in Line 9 we use LADDER); of course, if $m$ and $n$ are random, then we expect $\textnormal{{s}}_{1}$ to be quite small at this point. The second while loop (Lines 9-14) slightly optimizes this final 1-dimensional pseudomultiplication by using pure pseudo-doubling to exhaust any power of 2 in $\textnormal{{s}}_{1}$, saving a few superfluous xADDs in the LADDER call.

If we had an efficient pseudo-tripling operation $\mathbf{x}(P)\mapsto\mathbf{x}([3]P)$ are relatively efficient, it would be advantageous to include Montgomery’s “ternary” transformations in the loop of Algorithm 9. Independent analyses by Stam (stamthesis, , Conjecture 3.29) and Bernstein (DJB-chain, , §3) conclude that this full version of Montgomery’s 2-dimensional PRAC subroutine computes $\mathbf{x}([m]P\oplus[n]Q)$ for $\ell$-bit multiscalars $(m,n)$ using an average total of $1.82\ell$ differential operations.

Returning to the 1-dimensional problem, Montgomery suggests computing $\mathbf{x}([k]P)$ as $\mathbf{x}([m]P\oplus[n]Q)$, where $(m,n)$ and $Q=[\lambda]P$ satisfy $[m+n\lambda]P=[k]P$ for some $\lambda$ chosen to minimize the complexity of the pseudomultiplication. If we can precompute $\mathbf{x}([\lambda]P)$ from $\mathbf{x}(P)$, then any $\ell$-bit pseudomultiplication can be performed as an $\ell/2$-bit double-pseudomultiplication, and the resulting differential addition chains have average length $0.92\ell$ (stamthesis, , Corollary 3.32). But without precomputation, and following his heuristics for choosing $\lambda$, Montgomery’s PRAC algorithm produces differential addition chains of average length $1.64\ell$ for $\ell$-bit scalars (stamthesis, , Corollary 3.35).

Algorithm 10 is a simplified version of PRAC: we omit the repeated-tripling step that, like the ternary steps omitted in its subroutine Algorithm 9, presupposes the existence of rapid pseudo-tripling on $\mathcal{E}_{(A,B)}$. The idea of taking $(m,n)=(\lfloor{k/\varphi}\rfloor,k-\lfloor{k/\varphi}\rfloor)$, where $\varphi=(1+\sqrt{5})/2$ is the famous golden ratio, is that this induces a sequence of roughly $(\frac{1}{2}\log_{\varphi}{2})\ell$ of the relatively cheap so-called Fibonacci branch (Lines 9-6) of Algorithm 9, followed by roughly $\frac{1}{2}\ell$ branches distributed as for random multiscalars. We refer the reader to Stam’s thesis (stamthesis, , §3.3.4) for further details and analysis.

6.2 Higher-dimensional ladder analogues

Although the short addition chains produced by Montgomery’s Euclidean algorithms are suitable for his original application to ECM, their non-uniform and variable-time behavior makes them less suitable for application to ECC, where uniformity is a mandatory first step towards hiding secret exponents from adversaries exploiting side-channels. For cryptographic multiscalar multiplications, we may need higher-dimensional differential addition chains that share the uniform behavior of the 1-dimensional Montgomery ladder.

Bernstein defines a 2-dimensional analogue of the Montgomery ladder in DJB-chain (the “binary chain”). Given an $\ell$-bit multiscalar $(m,n)$ and the values of $\mathbf{x}(P)$, $\mathbf{x}(Q)$, $\mathbf{x}(P\ominus Q)$ and $\mathbf{x}(P\oplus Q)$, this algorithm computes $\mathbf{x}([m]P\oplus[n]Q)$ using exactly $3\ell$ differential operations. If ${\tt xDBL}$ and ${\tt xADD}$ are implemented in a uniform way, then Bernstein’s algorithm is also uniform: it is a sequence of $\ell$ steps, each consisting of one ${\tt xDBL}$ and two ${\tt xADD}$s. Further, in each of those steps, the argument of ${\tt xDBL}$ is shared by one of the ${\tt xADD}$s, and in some contexts these calls may be merged to use some shared computations.

Every call to ${\tt xADD}$ in Bernstein’s algorithm takes one of the four input values $\mathbf{x}(P)$, $\mathbf{x}(Q)$, $\mathbf{x}(P\ominus Q)$ and $\mathbf{x}(P\oplus Q)$ as its difference argument; this makes it possible to recover the correct $y$-coordinate for the output $\mathbf{x}([m]P\oplus[n]Q)$ using exactly the same technique as in §4.3. This makes Bernstein’s chain a viable option for computing the multiscalar multiplication during the verification phase of signature schemes that take advantage of differential arithmetic.

Brown defined an $n$-dimensional analogue of the Montgomery ladder in Brown . Given an $n$-dimensional multiscalar $(m_{1},\dots,m_{n})$ in $\mathbb{Z}^{n}$, Brown’s algorithm uses $x$-line arithmetic to compute $\mathbf{x}([m_{1}]P_{1}\oplus\dots\oplus[m_{n}]P_{n})$ from the $(3^{n}-1)/2$ input values $\mathbf{x}([e_{1}]P_{1}\oplus\dots\oplus[e_{n}]P_{n})$ with the $e_{i}\in\{-1,0,1\}$ and not all zero.

Example 3 (A Montgomery $\mathbb{Q}$-curve reduction CHS )

The Montgomery curve

[TABLE]

with $A=45116554344555875085017627593321485421+2415910908\sqrt{-1}$ has $\#\mathcal{E}(\mathbb{F}_{p})=4r$ and $\#\mathcal{E}^{\prime}(\mathbb{F}_{p})=8r^{\prime}$, where $r$ and $r^{\prime}$ are 252- and 251-bit primes, respectively. In CHS we see that $\mathcal{E}$ is equipped with an efficiently computable endomorphism $\psi$ of degree $2p$, which acts on $\mathcal{E}(\mathbb{F}_{p^{2}})[r]$ as $[\lambda]$ where $\lambda^{2}\equiv-2\pmod{r}$. The classic Gallant–Lambert–Vanstone (GLV) technique GLV01 could be used to compute 1-dimensional scalar multipications $[k]P$ as 2-dimensional multiplications $[m]P\oplus[n](\psi(P))$, with $m$ and $n$ of roughly 128 bits. The scalar multiplication implementation in CHS transports the GLV approach to the $x$-only setting, simultaneously exploiting Montgomery arithmetic. First, we compute $\mathbf{x}(P)\mapsto\mathbf{x}(\psi(P))$ and $\mathbf{x}(P)\mapsto\mathbf{x}((\psi-1)P)=\mathbf{x}(\psi(P)\ominus P)$. Then given any $k$ in $[0,r)$ we can compute $\mathbf{x}([k]P)=\mathbf{x}([m]P\oplus[n]\psi(P))$, where $m$ and $n$ are 128-bit scalars, using Algorithm 9 for public scalars and Bernstein’s uniform 2-dimensional binary chain for private scalars.

7 Generalizations and other applications

The Montgomery ladder is a general algorithm that works in any abelian group, and in group quotients where analogues of ${\tt xADD}$ are available. The most interesting groups of this kind—at least from a cryptographic point of view—are other models of elliptic curves, and Jacobians of hyperelliptic curves.

7.1 The Montgomery ladder on other models of elliptic curves

The Montgomery ladder can be applied to any model of an elliptic curve, using either the usual addition and doubling operations, or the analogue of $x$-only arithmetic. For Weierstrass models, the chief interest in the Montgomery ladder is its side-channel resistance when computing scalar multiples with secret scalars, as explored by Brier and Joye in Brier–Joye . Gaudry and Lubicz gaudry-lubicz used the classical complex-analytic theory of theta functions to derive pseudo-group law formulæ for $\mathbb{P}^{1}\cong\mathcal{E}_{\lambda}/\langle\ominus\rangle$, where $\mathcal{E}_{\lambda}\colon y^{2}=x(x-1)(x-\lambda)$ is a Legendre model. Their formulæ offer trade-offs with the ${\tt xADD}$ and ${\tt xDBL}$ operations on Montgomery curves, which could make them favorable in certain scenarios.

Castryck, Galbraith, and Farashahi CGF08 made the striking suggestion of using Montgomery curves in conjunction with their corresponding twisted Edwards models. The transformations of (4) and (5) are extremely easy to compute; this allows a mixed arithmetic, passing back-and-forth between $x$-only pseudo-additions on the Montgomery curve and $v$-only pseudo-doublings on the corresponding Edwards curve.

7.2 The Montgomery ladder on hyperelliptic curves

The Montgomery ladder has been applied with great success in hyperelliptic cryptography based on genus-2 curves. The story begins with Smart and Siksek smart-siksek , who observed that we can use pseudo-additions to instantiate Diffie–Hellman key exchange on Kummer surfaces (quotients of Jacobians of genus-2 curves by $\pm 1$). Duquesne Duquesne04 made this concrete by combining the ladder with explicit formulæ for arithmetic on genus-2 curves of the form $\mathcal{H}:y^{2}=xf(x)$, where $f$ is a squarefree degree-4 polynomial. While the factor of $x$ on the right-hand-side also appears in the defining equations of Montgomery curves, Duquesne’s curves are not a true genus-2 Montgomery analogue: we would expect a particularly simple action on the Jacobian of the elements of the kernel of a $(2,2)$-isogeny factoring $[2]$, for example, mirroring the special form of the translation-by-$T$ map on Montgomery curves, but no such structure is imposed by Duquesne’s form. Nevertheless, this special curve form allows a small speedup over general genus-2 arithmetic. Duquesne later described the Montgomery ladder on Kummer surfaces of arbitrary genus-2 curves Duquesne10 , building on Flynn’s arithmetic of general Kummer surfaces (casselsflynn, , Chapter 3).

Gaudry used the Montgomery ladder for efficient pseudomultiplication on a model of the Kummer with especially fast pseudo-addition and pseudo-doubling operations Gaudry , building on observations of D. V. and G. V. Chudnovsky chudnovsky86 . Here, the efficiency really is a consequence of a special $2$-torsion structure: all of the $2$-torsion points are defined over $\mathbb{F}_{q}$, and their translations act linearly on the Kummer by diagonal and permutation matrices. This approach has successfully used in high-speed Diffie–Hellman implementations BoCoHi13 ; kummerstrikes ; muKummer , and a hyperelliptic generalization of ECM factorization Cosset10 .

An analogue of $y$-coordinate recovery (see §4.3) exists in genus 2: Chung and the authors give an explicit algorithm in CCS , recovering Jacobian elements from the output of the Montgomery ladder on the Kummer. This enables the implementation of full signature schemes using Kummer surfaces muKummer .

All of these ideas and techniques are carried much further in the setting of higher-dimensional abelian and Kummer varieties by Lubicz and Robert Lubicz–Robert .