Geometric interpretation of an Edwards curve












3














Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



Geometric interpretation of addition on a Weierstrass curve



(Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





A curve in Edwards form might look like this:



An elliptic curve in Edwards form.



(Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










share|improve this question



























    3














    Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



    Geometric interpretation of addition on a Weierstrass curve



    (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



    To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





    A curve in Edwards form might look like this:



    An elliptic curve in Edwards form.



    (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



    However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
    Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



    When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



    Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










    share|improve this question

























      3












      3








      3


      1





      Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



      Geometric interpretation of addition on a Weierstrass curve



      (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



      To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





      A curve in Edwards form might look like this:



      An elliptic curve in Edwards form.



      (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



      However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
      Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



      When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



      Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










      share|improve this question













      Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



      Geometric interpretation of addition on a Weierstrass curve



      (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



      To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





      A curve in Edwards form might look like this:



      An elliptic curve in Edwards form.



      (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



      However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
      Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



      When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



      Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?







      elliptic-curves






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 2 hours ago









      Ruben De SmetRuben De Smet

      797215




      797215






















          2 Answers
          2






          active

          oldest

          votes


















          2














          The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



          The correct interpretation for this kind of curves is "adding their angles".
          It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



          You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






          share|improve this answer























          • Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
            – Ruben De Smet
            42 mins ago










          • probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
            – ddddavidee
            31 mins ago










          • @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
            – Youssef El Housni
            2 mins ago



















          0














          The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



          enter image description here



          (addition and doubling over $mathbb{R}$ for $d<0$)



          This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






          share|improve this answer























            Your Answer





            StackExchange.ifUsing("editor", function () {
            return StackExchange.using("mathjaxEditing", function () {
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            });
            });
            }, "mathjax-editing");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "281"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66325%2fgeometric-interpretation-of-an-edwards-curve%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            2














            The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



            The correct interpretation for this kind of curves is "adding their angles".
            It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



            You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






            share|improve this answer























            • Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
              – Ruben De Smet
              42 mins ago










            • probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
              – ddddavidee
              31 mins ago










            • @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
              – Youssef El Housni
              2 mins ago
















            2














            The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



            The correct interpretation for this kind of curves is "adding their angles".
            It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



            You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






            share|improve this answer























            • Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
              – Ruben De Smet
              42 mins ago










            • probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
              – ddddavidee
              31 mins ago










            • @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
              – Youssef El Housni
              2 mins ago














            2












            2








            2






            The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



            The correct interpretation for this kind of curves is "adding their angles".
            It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



            You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






            share|improve this answer














            The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



            The correct interpretation for this kind of curves is "adding their angles".
            It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



            You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited 33 mins ago

























            answered 1 hour ago









            ddddavideeddddavidee

            2,57111429




            2,57111429












            • Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
              – Ruben De Smet
              42 mins ago










            • probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
              – ddddavidee
              31 mins ago










            • @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
              – Youssef El Housni
              2 mins ago


















            • Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
              – Ruben De Smet
              42 mins ago










            • probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
              – ddddavidee
              31 mins ago










            • @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
              – Youssef El Housni
              2 mins ago
















            Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
            – Ruben De Smet
            42 mins ago




            Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
            – Ruben De Smet
            42 mins ago












            probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
            – ddddavidee
            31 mins ago




            probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
            – ddddavidee
            31 mins ago












            @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
            – Youssef El Housni
            2 mins ago




            @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
            – Youssef El Housni
            2 mins ago











            0














            The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



            enter image description here



            (addition and doubling over $mathbb{R}$ for $d<0$)



            This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






            share|improve this answer




























              0














              The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



              enter image description here



              (addition and doubling over $mathbb{R}$ for $d<0$)



              This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






              share|improve this answer


























                0












                0








                0






                The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



                enter image description here



                (addition and doubling over $mathbb{R}$ for $d<0$)



                This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






                share|improve this answer














                The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



                enter image description here



                (addition and doubling over $mathbb{R}$ for $d<0$)



                This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.







                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited 9 mins ago

























                answered 33 mins ago









                Youssef El HousniYoussef El Housni

                37938




                37938






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Cryptography Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    Use MathJax to format equations. MathJax reference.


                    To learn more, see our tips on writing great answers.





                    Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                    Please pay close attention to the following guidance:


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66325%2fgeometric-interpretation-of-an-edwards-curve%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    CARDNET

                    Boot-repair Failure: Unable to locate package grub-common:i386

                    濃尾地震