International Association for Cryptologic Research

International Association
for Cryptologic Research


Peng Xu


Fast and Simple Point Operations on Edwards448 and E448
Luying Li Wei Yu Peng Xu
Since Edwards curves were introduced in elliptic curve cryptography, they have attracted a lot of attention. The twisted Edwards curves are defined by the equation $E_{a,d}: ax^2 + y^2 = 1 + d x^2y^2$. Twisted Edwards curve is the state-of-the-art for $a=-1$, and even for $a \ne -1$. E448 and Edwards448 are NIST standard curve in 2023 and TLS 1.3 standard curve in 2018. They both can be converted to $d=-1$, but can not be converted to $a=-1$ through isomorphism. The motivation of using a curve with $d=-1$ is that we want to improve the efficiency of E448, and Edwards448, especially to achieve a great saving in terms of the number of field multiplications ($\bfm M$) and field squarings ($\bfm S$). We propose new explicit formulas for point operations on these curves. Our full point addition only requires $8 \bfm M$, and mixed addition requires $7 \bfm M$. Our results applied on the Edward448 and E448 yield a clean and simple implementation and achieve a brand new speed record. The scalar multiplication on Edwards448 and E448 have the same cost of $\bfm M$ and $\bfm S$ as that on Edwards25519 per bit.


Luying Li (1)
Peng Xu (1)
Wei Yu (1)