5.1.4 Point Addition

5.1.4 Point Addition

For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/Z, y = Y/Z, x * y = T/Z.

The neutral point is (0,1), or equivalently in extended homogeneous coordinates (0, Z, Z, 0) for any non-zero Z.

The following formulas for adding two points, (x3,y3) = (x1,y1)+(x2,y2), on twisted Edwards curves with a=-1, square a, and non-square d are described in Section 3.1 of [Edwards-revisited] and in [EFD-TWISTED-ADD]. They are complete, i.e., they work for any pair of valid input points.

                A = (Y1-X1)*(Y2-X2)
                B = (Y1+X1)*(Y2+X2)
                C = T1*2*d*T2
                D = Z1*2*Z2
                E = B-A
                F = D-C
                G = D+C
                H = B+A
                X3 = E*F
                Y3 = G*H
                T3 = E*H
                Z3 = F*G

For point doubling, (x3,y3) = (x1,y1)+(x1,y1), one could just substitute equal points in the above (because of completeness, such substitution is valid) and observe that four multiplications turn into squares. However, using the formulas described in Section 3.2 of [Edwards-revisited] and in [EFD-TWISTED-DBL] saves a few smaller operations.

                A = X1^2
                B = Y1^2
                C = 2*Z1^2
                H = A+B
                E = H-(X1+Y1)^2
                G = A-B
                F = C+G
                X3 = E*F
                Y3 = G*H
                T3 = E*H
                Z3 = F*G