Speed records:
The following commands for the Magma computer-algebra system check various addition formulas for Jacobian coordinates.
Jacobian scaling.
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; // here are the formulas: A:=1/Z1; AA:=A^2; X2:=X1*AA; Y2:=Y1*AA*A; Z2:=1; // check: x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); S!(Z2-1); S!(x2-x1); S!(y2-y1);
Jacobian addition (11M+5S+9add+4times2) matches affine addition. Multiplication counts stated in the literature: 17 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i). 16 in 1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'). 16 in 1998 Cohen/Miyaji/Ono. 16 in 2004 Hankerson/Menezes/Vanstone page 92. 16 in 2005 Doche/Lange. 16 in 2007 Bernstein/Lange.
S,M counts stated in the literature: 12M + 4S in 1998 Cohen/Miyaji/Ono, formula (5). 12M + 4S in 2004 Hankerson/Menezes/Vanstone page 92. 12M + 4S in 2005 Doche/Lange. 11M + 5S in 2001 Bernstein. 11M + 5S in 2007 Longa/Miri. 11M + 5S in 2007 Bernstein/Lange.
1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i):
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; S!(y3^2-x3^3-a*x3-b); // here are the formulas: U1:=X1*Z2^2; U2:=X2*Z1^2; S1:=Y1*Z2^3; S2:=Y2*Z1^3; P:=U2-U1; R:=S2-S1; X3:=-(U1+U2)*P^2+R^2; Y3:=-S1*P^3+R*(U1*P^2-X3); Z3:=Z1*Z2*P; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);1986 Chudnovsky/Chudnovsky, page 414, formula (4.3i'):
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; x2:=X2/Z2^2; y2:=Y2/Z2^3; lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: U1:=X1*Z2^2; U2:=X2*Z1^2; S1:=Y1*Z2^3; S2:=Y2*Z1^3; P:=U2-U1; R:=S2-S1; X3:=-(U1+U2)*P^2+R^2; Y3:=(R*(-2*R^2+3*P^2*(U1+U2))-P^3*(S1+S2))/2; Z3:=Z1*Z2*P; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
1998 Cohen/Miyaji/Ono, formula (5):
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; S!(y3^2-x3^3-a*x3-b); // here are the formulas: U1:=X1*Z2^2; U2:=X2*Z1^2; S1:=Y1*Z2^3; S2:=Y2*Z1^3; H:=U2-U1; r:=S2-S1; X3:=-H^3-2*U1*H^2+r^2; Y3:=-S1*H^3+r*(U1*H^2-X3); Z3:=Z1*Z2*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 12M + 4S + 6add + 1times2:
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: Z1Z1:=Z1^2; Z2Z2:=Z2^2; U1:=X1*Z2Z2; U2:=X2*Z1Z1; S1:=Y1*Z2*Z2Z2; S2:=Y2*Z1*Z1Z1; H:=U2-U1; HH:=H^2; HHH:=H*HH; r:=S2-S1; V:=U1*HH; X3:=r^2-HHH-2*V; Y3:=r*(V-X3)-S1*HHH; Z3:=Z1*Z2*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);1998 Hasegawa/Nakajima/Matsui, page 188, 12M + 4S + 8adds + 2times2 + 1halving, 2 temporary registers:
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; x2:=X2/Z2^2; y2:=Y2/Z2^3; lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; R1:=X1; R2:=Y1; R3:=Z1; R4:=X2; R5:=Y2; R6:=Z2; // here are the formulas: R7:=R6^2; R1:=R1*R7; R7:=R6*R7; R2:=R2*R7; R7:=R3^2; R8:=R4*R7; R7:=R3*R7; R7:=R5*R7; R2:=R2-R7; R7:=2*R7; R7:=R2+R7; R1:=R1-R8; R8:=2*R8; R8:=R1+R8; R3:=R3*R6; R3:=R3*R1; R7:=R7*R1; R1:=R1^2; R8:=R8*R1; R7:=R7*R1; R1:=R2^2; R1:=R1-R8; R8:=R8-R1; R8:=R8-R1; R8:=R8*R2; R2:=R8-R7; R2:=R2/2; X3:=R1; Y3:=R2; Z3:=R3; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);2007 Bernstein/Lange, 11M + 5S + 9add + 4times2:
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: Z1Z1:=Z1^2; Z2Z2:=Z2^2; U1:=X1*Z2Z2; U2:=X2*Z1Z1; S1:=Y1*Z2*Z2Z2; S2:=Y2*Z1*Z1Z1; H:=U2-U1; I:=(2*H)^2; J:=H*I; r:=2*(S2-S1); V:=U1*I; X3:=r^2-J-2*V; Y3:=r*(V-X3)-2*S1*J; Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);2007 Bernstein/Lange, 10M + 4S + 9add + 4times2 after 1M + 1S for caching:
K<a,b,X1,Y1,X2,Y2>:=FieldOfFractions(PolynomialRing(Rationals(),6)); R<Z1,Z2>:=PolynomialRing(K,2); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: // cached: Z2Z2:=Z2^2; Z2Z2Z2:=Z2*Z2Z2; // uncached: Z1Z1:=Z1^2; U1:=X1*Z2Z2; U2:=X2*Z1Z1; S1:=Y1*Z2Z2Z2; S2:=Y2*Z1*Z1Z1; H:=U2-U1; I:=(2*H)^2; J:=H*I; r:=2*(S2-S1); V:=U1*I; X3:=r^2-J-2*V; Y3:=r*(V-X3)-2*S1*J; Z3:=((Z1+Z2)^2-Z1Z1-Z2Z2)*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
Jacobian mixed addition (7M+4S+9add+3times2+1times4) matches affine addition. S,M counts stated in the literature: 8M+3S in 2004 Hankerson/Menezes/Vanstone page 89 ("three field squarings and eight field multiplications"). 8M+3S in 2005 Doche/Lange. 7M+4S in 2007 Longa/Miri. 7M+4S in 2007 Bernstein/Lange.
Substituting Z2=1 in the general addition formulas, 8M + 3S + 6add + 5times2:
K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5)); R<Z1,Y2>:=PolynomialRing(K,2); Z2:=1; S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: Z1Z1:=Z1^2; U2:=X2*Z1Z1; S2:=Y2*Z1*Z1Z1; H:=U2-X1; I:=(2*H)^2; J:=H*I; r:=2*(S2-Y1); V:=X1*I; X3:=r^2-J-2*V; Y3:=r*(V-X3)-2*Y1*J; Z3:=2*Z1*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
2004 Hankerson/Menezes/Vanstone, page 91, 8M + 3S + 6add + 1times2, 4 temporary registers:
K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5)); R<Z1,Y2>:=PolynomialRing(K,2); Z2:=1; S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: T1:=Z1^2; T2:=T1*Z1; T1:=T1*X2; T2:=T2*Y2; T1:=T1-X1; T2:=T2-Y1; Z3:=Z1*T1; T3:=T1^2; T4:=T3*T1; T3:=T3*X1; T1:=2*T3; X3:=T2^2; X3:=X3-T1; X3:=X3-T4; T3:=T3-X3; T3:=T3*T2; T4:=T4*Y1; Y3:=T3-T4; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
2007 Bernstein/Lange, 7M + 4S + 9add + 3times2 + 1times4:
K<a,b,X1,Y1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),5)); R<Z1,Y2>:=PolynomialRing(K,2); Z2:=1; S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: Z1Z1:=Z1^2; U2:=X2*Z1Z1; S2:=Y2*Z1*Z1Z1; H:=U2-X1; HH:=H^2; I:=4*HH; J:=H*I; r:=2*(S2-Y1); V:=X1*I; X3:=r^2-J-2*V; Y3:=r*(V-X3)-2*Y1*J; Z3:=(Z1+H)^2-Z1Z1-HH; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
Jacobian addition with Z1=1 and Z2=1. 2007 Bernstein/Lange, 4M + 2S + 6add + 4times2 + 1times4:
K<a,b,X1,X2>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Y1,Y2>:=PolynomialRing(K,2); Z1:=1; Z2:=1; S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6,Y2^2-X2^3-a*X2*Z2^4-b*Z2^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; // here are the formulas: H:=X2-X1; HH:=H^2; I:=4*HH; J:=H*I; r:=2*(Y2-Y1); V:=X1*I; X3:=r^2-J-2*V; Y3:=r*(V-X3)-2*Y1*J; Z3:=2*H; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
Jacobian doubling (1M+8S+1D+10add+2times2+1times3+1times8) matches affine doubling. Multiplication counts stated in the literature: 10 in 1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) ("9 multiplications ... and one multiplication by a"). 10 in 2007 Longa/Miri. 10 in 2007 Bernstein/Lange.
S,M counts stated in the literature: 4M+6S in 1998 Cohen/Miyaji/Ono, formula (6). 4M+6S in 2004 Hankerson/Menezes/Vanstone page 88 ("six field squarings and four field multiplications"). 4M+6S in 2005 Doche/Lange. 2M+8S in 2007 Longa/Miri. 2M+8S in 2007 Bernstein/Lange.
1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii):
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: S:=4*X1*Y1^2; M:=3*X1^2+a*Z1^4; T:=-2*S+M^2; X3:=T; Y3:=-8*Y1^4+M*(S-T); Z3:=2*Y1*Z1; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);1998 Cohen/Miyaji/Ono, formula (6):
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: S:=4*X1*Y1^2; M:=3*X1^2+a*Z1^4; T:=M^2-2*S; X3:=T; Y3:=-8*Y1^4+M*(S-T); Z3:=2*Y1*Z1; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);Eliminating common subexpressions from 1998 Cohen/Miyaji/Ono, 3M + 6S + 1D + 4add + 2times2 + 1times3 + 1times4 + 1times8:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: XX:=X1^2; YY:=Y1^2; ZZ:=Z1^2; S:=4*X1*YY; M:=3*XX+a*ZZ^2; T:=M^2-2*S; X3:=T; Y3:=M*(S-T)-8*YY^2; Z3:=2*Y1*Z1; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);1998 Hasegawa/Nakajima/Matsui, page 188, 3M + 6S + 1D + 6add + 3times2 + 1halving, 2 temporary registers:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); R1:=X1; R2:=Y1; R3:=Z1; // here are the formulas: R4:=R3^2; R3:=R2*R3; R3:=2*R3; R4:=R4^2; R4:=a*R4; R5:=R1^2; R4:=R4+R5; R5:=2*R5; R4:=R4+R5; R2:=2*R2; R2:=R2^2; R5:=R2^2; R5:=R5/2; R2:=R2*R1; R1:=R4^2; R1:=R1-R2; R1:=R1-R2; R2:=R2-R1; R2:=R2*R4; R2:=R2-R5; X3:=R1; Y3:=R2; Z3:=R3; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
2007 Bernstein/Lange, 1M + 8S + 1D + 10add + 2times2 + 1times3 + 1times8:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: XX:=X1^2; YY:=Y1^2; YYYY:=YY^2; ZZ:=Z1^2; S:=2*((X1+YY)^2-XX-YYYY); M:=3*XX+a*ZZ^2; T:=M^2-2*S; X3:=T; Y3:=M*(S-T)-8*YYYY; Z3:=(Y1+Z1)^2-YY-ZZ; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Jacobian doubling for a=-3 (3M+5S+8add+1times3+1times4+2times8) matches affine doubling. Multiplication counts stated in the literature: 8 in 1986 Chudnovksy/Chudnovsky, page 414 ("8 multiplications"). 8 in 2004 Hankerson/Menezes/Vanstone page 92. 8 in 2005 Doche/Lange. 8 in 2007 Longa/Miri. 8 in 2007 Bernstein/Lange.
S,M counts stated in the literature: 4M+4S in 2004 Hankerson/Menezes/Vanstone page 92. 3M+5S in 2001 Bernstein. 3M+5S in 2007 Longa/Miri. 3M+5S in 2007 Bernstein/Lange.
1986 Chudnovksy/Chudnovsky, page 414, formula (4.2ii) modified as indicated after "It is even smarter ..." for the special case a = -3:
K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); a:=-3; R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: S:=4*X1*Y1^2; M:=3*(X1-Z1^2)*(X1+Z1^2); T:=-2*S+M^2; X3:=T; Y3:=-8*Y1^4+M*(S-T); Z3:=2*Y1*Z1; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
1998 Hasegawa/Nakajima/Matsui, page 188, 4M + 4S + 7add + 3times2 + 1halving, 2 temporary registers, in the special case a = -3:
K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); a:=-3; R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); R1:=X1; R2:=Y1; R3:=Z1; // here are the formulas: R4:=R3^2; R3:=R2*R3; R3:=2*R3; R5:=R1-R4; R4:=R1+R4; R5:=R4*R5; R4:=2*R5; R4:=R4+R5; R2:=2*R2; R2:=R2^2; R5:=R2^2; R5:=R5/2; R2:=R2*R1; R1:=R4^2; R1:=R1-R2; R1:=R1-R2; R2:=R2-R1; R2:=R2*R4; R2:=R2-R5; X3:=R1; Y3:=R2; Z3:=R3; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
2004 Hankerson/Menezes/Vanstone, page 91, 4M + 4S + 5add + 2times2 + 1times3 + 1halving, 3 temporary registers, in the special case a = -3:
K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); a:=-3; R<Z1>:=PolynomialRing(K,1); S:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; S!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; S!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; S!(y3^2-x3^3-a*x3-b); // here are the formulas: T1:=Z1^2; T2:=X1-T1; T1:=X1+T1; T2:=T2*T1; T2:=3*T2; Y3:=2*Y1; Z3:=Y3*Z1; Y3:=Y3^2; T3:=Y3*X1; Y3:=Y3^2; Y3:=Y3/2; X3:=T2^2; T1:=2*T3; X3:=X3-T1; T1:=T3-X3; T1:=T1*T2; Y3:=T1-Y3; S!(x3-X3/Z3^2); S!(y3-Y3/Z3^3);
2001 Bernstein, 3M + 5S + 8add + 1times3 + 1times4 + 2times8, in the special case a = -3:
K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); a:=-3; R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: delta:=Z1^2; gamma:=Y1^2; beta:=X1*gamma; alpha:=3*(X1-delta)*(X1+delta); X3:=alpha^2-8*beta; Z3:=(Y1+Z1)^2-gamma-delta; Y3:=alpha*(4*beta-X3)-8*gamma^2; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Jacobian doubling with Z1=1. 2007 Bernstein/Lange, 1M + 5S + 7add + 3times2 + 1times3 + 1times8:
K<a,b,X1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); R<Y1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; Z1:=1; X2:=X1; Y2:=Y1; Z2:=Z1; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); x2:=X2/Z2^2; y2:=Y2/Z2^3; SS!(y2^2-x2^3-a*x2-b); lambda:=(3*x1^2+a)/(2*y1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: XX:=X1^2; YY:=Y1^2; YYYY:=YY^2; S:=2*((X1+YY)^2-XX-YYYY); M:=3*XX+a; T:=M^2-2*S; X3:=T; Y3:=M*(S-T)-8*YYYY; Z3:=2*Y1; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Jacobian tripling (5M+10S+1D+15add+1times3+2times4+1times6+1times8+1times16) matches doubling and addition. Multiplication counts stated in the literature: 16 in 2005 Dimitrov/Imbert/Mishra, page 69 ("6[s]+10[m]"). 16 in 2007 Longa/Miri. 16 in 2007 Bernstein/Lange.
S,M counts stated in the literature: 10M+6S in 2005 Dimitrov/Imbert/Mishra, page 69. 6M+10S in 2007 Longa/Miri. 6M+10S in 2007 Bernstein/Lange.
2005 Dimitrov/Imbert/Mishra:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); lambda:=(3*x1^2+a)/(2*y1); x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1; SS!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: M:=3*X1^2+a*Z1^4; E:=12*X1*Y1^2-M^2; T:=8*Y1^4; X3:=8*Y1^2*(T-M*E)+X1*E^2; Y3:=Y1*(4*(M*E-T)*(2*T-M*E)-E^3); Z3:=Z1*E; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Eliminating common subexpressions from 2005 Dimitrov/Imbert/Mishra, 8M + 7S + 1D + 6add + 2times2 + 1times3 + 1times4 + 1times6:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); lambda:=(3*x1^2+a)/(2*y1); x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1; SS!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: ZZ:=Z1^2; YY:=Y1^2; C:=2*YY; M:=3*X1^2+a*ZZ^2; E:=6*X1*C-M^2; EE:=E^2; T:=2*C^2; U:=M*E-T; U4:=4*U; X3:=X1*EE-C*U4; Y3:=Y1*(U4*(T-U)-E*EE); Z3:=Z1*E; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
2007 Bernstein/Lange, 5M + 10S + 1D + 15add + 1times3 + 2times4 + 1times6 + 1times8 + 1times16:
K<a,b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),4)); R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); lambda:=(3*x1^2+a)/(2*y1); x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1; SS!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: XX:=X1^2; YY:=Y1^2; ZZ:=Z1^2; YYYY:=YY^2; M:=3*XX+a*ZZ^2; MM:=M^2; E:=6*((X1+YY)^2-XX-YYYY)-MM; EE:=E^2; T:=16*YYYY; U:=(M+E)^2-MM-EE-T; X3:=4*(X1*EE-4*YY*U); Y3:=8*Y1*(U*(T-U)-E*EE); Z3:=(Z1+E)^2-ZZ-EE; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);
Jacobian tripling with a=-3 (7M+7S+13add+1times3+2times4+1times8+1times12+1times16) matches doubling and addition. Multiplication counts stated in the literature: 14 in 2007 Longa/Miri. 14 in 2007 Bernstein/Lange.
S,M counts stated in the literature: 7M+7S in 2007 Longa/Miri. 7M+7S in 2007 Bernstein/Lange.
2007 Bernstein/Lange, 7M + 7S + 13add + 1times3 + 2times4 + 1times8 + 1times12 + 1times16:
K<b,X1,Y1>:=FieldOfFractions(PolynomialRing(Rationals(),3)); a:=-3; R<Z1>:=PolynomialRing(K,1); SS:=quo<R|Y1^2-X1^3-a*X1*Z1^4-b*Z1^6>; x1:=X1/Z1^2; y1:=Y1/Z1^3; SS!(y1^2-x1^3-a*x1-b); lambda:=(3*x1^2+a)/(2*y1); x2:=lambda^2-x1-x1; y2:=lambda*(x1-x2)-y1; SS!(y2^2-x2^3-a*x2-b); lambda:=(y2-y1)/(x2-x1); x3:=lambda^2-x1-x2; y3:=lambda*(x1-x3)-y1; SS!(y3^2-x3^3-a*x3-b); // here are the formulas: YY:=Y1^2; ZZ:=Z1^2; YYYY:=YY^2; M:=3*(X1-ZZ)*(X1+ZZ); MM:=M^2; E:=12*X1*YY-MM; EE:=E^2; T:=16*YYYY; U:=(M+E)^2-MM-EE-T; X3:=4*(X1*EE-4*YY*U); Y3:=8*Y1*(U*(T-U)-E*EE); Z3:=(Z1+E)^2-ZZ-EE; SS!(x3-X3/Z3^2); SS!(y3-Y3/Z3^3);