[Cryptography] Edwards curves are just ellipses - and why ECC works

[Bill Cox]

Here's a simplified way to see the equivalence between ellipses and Edwards
curves.  First, here's two forms of the group law, which are equivalent,
though the Edwards form is faster:

Edwards form:

    sn3 = (sn1(cn2/dn2) + sn2)/(1 + d*sn1(cn1/sn1)sn2(cn2/dn2)
    cn3/dn3 = ((cn1/dn1)(cn2/dn2) - sn1*sn2)/(1 -
d*sn1(cn1/dn1)sn2(cn2/dn2))
Old form:

    cn3 = (cn1*cn2 - sn1*sn2*dn1*dn2) / (1 - d*sn1^2*sn2^2)
    sn3 = (sn1*cn2*dn2 + sn2*cn1*dn1) / (1 - d*sn1^2*sn2^2)
    dn3 = (dn1*dn2 - d*sn1*sn2*cn1*cn2) / (1 - d*sn1^2*sn2^2)

Given either of these equivalent addition laws, we can compute a point on
the Edwards curve as:

    x = cn/dn
    y = sn

and we can compute teh point on the ellipse as:

    x = cn
    y = sn/b

The Edwards equation is:

    x^2 + y^2 = 1 + d*x^2*y^2

and the ellipse equation is:

    x^2 + y^2/b = 1

where:

    b^2 = 1/(1-d)

Bill
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20151004/ccef2705/attachment.html>