Binary edwards curves revisited

Abstract

We present new formulas for the arithmetic on the binary Edwards curves which are much faster than the-state-of-the-art. The representative speedup are 3M +2D +S for a point addition, D +S for a mixed point addition, S for a point doubling, M +D for a differential addition and doubling. Here M,S and D are the cost of a multiplication, a squaring and a multiplication by a constant respectively. Notably, the new complete differential addition and doubling for complete binary Edwards curves with 4-torsion points need only 5M+D+4S which is just the cost of the fastest (but incomplete) formulas among various forms of elliptic curves over finite fields of characteristic 2 in the literature. As a result the binary Edwards form becomes definitely the best option for elliptic curve cryptosytems over binary fields in view of both efficiency and resistance against side channel attack.