Geometric interpretation of an Edwards curve












8












$begingroup$


Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



Geometric interpretation of addition on a Weierstrass curve



(Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





A curve in Edwards form might look like this:



An elliptic curve in Edwards form.



(Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










share|improve this question









$endgroup$

















    8












    $begingroup$


    Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



    Geometric interpretation of addition on a Weierstrass curve



    (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



    To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





    A curve in Edwards form might look like this:



    An elliptic curve in Edwards form.



    (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



    However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
    Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



    When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



    Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










    share|improve this question









    $endgroup$















      8












      8








      8


      2



      $begingroup$


      Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



      Geometric interpretation of addition on a Weierstrass curve



      (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



      To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





      A curve in Edwards form might look like this:



      An elliptic curve in Edwards form.



      (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



      However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
      Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



      When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



      Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?










      share|improve this question









      $endgroup$




      Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure:



      Geometric interpretation of addition on a Weierstrass curve



      (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg)



      To add two points, one draws the line that connects these points. The third intersection point is mirrored to get the result of the addition.





      A curve in Edwards form might look like this:



      An elliptic curve in Edwards form.



      (Image CC SA 3.0 https://commons.wikimedia.org/wiki/File:Edward-curves.svg)



      However, the classical geometric interpretation for addition on Weierstrass curves does not seem to work on these Edwards curves.
      Take for example the point $(0,-1)$. When doubled, this becomes $(0,1)$, the neutral point, according to the addition law $$(x_1, y_1) + (x_2, y_2) = left(frac{x_1y_2 + x_2y_1}{1-dx_1x_2y_1y_2}, frac{y_1y_2 + x_1x_2}{1-dx_1x_2y_1y_2}right).$$



      When using the "classical" Weierstrass geometric interpretation (case 4 in the first image), I would become the point at infinity (which of course does not exist for an Edwards curve).



      Clearly, Edwards curves follow a different way of life. Does there exist a similar geometric interpretation of the addition law for Edwards curves?







      elliptic-curves






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Jan 7 at 14:36









      Ruben De SmetRuben De Smet

      857215




      857215






















          2 Answers
          2






          active

          oldest

          votes


















          5












          $begingroup$

          The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



          enter image description here



          (addition and doubling over $mathbb{R}$ for $d<0$)



          This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






          share|improve this answer











          $endgroup$





















            6












            $begingroup$

            The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



            The correct interpretation for this kind of curves is "adding their angles".
            It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



            You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






            share|improve this answer











            $endgroup$













            • $begingroup$
              Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
              $endgroup$
              – Ruben De Smet
              Jan 7 at 16:00






            • 1




              $begingroup$
              probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
              $endgroup$
              – ddddavidee
              Jan 7 at 16:11






            • 3




              $begingroup$
              @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
              $endgroup$
              – Youssef El Housni
              Jan 7 at 16:40










            • $begingroup$
              @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
              $endgroup$
              – Youssef El Housni
              Jan 7 at 16:57










            • $begingroup$
              I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
              $endgroup$
              – Ruben De Smet
              Jan 7 at 17:35











            Your Answer





            StackExchange.ifUsing("editor", function () {
            return StackExchange.using("mathjaxEditing", function () {
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            });
            });
            }, "mathjax-editing");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "281"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66325%2fgeometric-interpretation-of-an-edwards-curve%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            5












            $begingroup$

            The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



            enter image description here



            (addition and doubling over $mathbb{R}$ for $d<0$)



            This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






            share|improve this answer











            $endgroup$


















              5












              $begingroup$

              The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



              enter image description here



              (addition and doubling over $mathbb{R}$ for $d<0$)



              This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






              share|improve this answer











              $endgroup$
















                5












                5








                5





                $begingroup$

                The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



                enter image description here



                (addition and doubling over $mathbb{R}$ for $d<0$)



                This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.






                share|improve this answer











                $endgroup$



                The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation of the addition law of two points $P$ and $Q$ you need a function $g_{P,Q}=frac{f_1}{f_2}$ with $div(g_{P,Q})=(P)+(Q)-(mathcal{O})-(P+Q)$ where $mathcal{O}=(0,1)$ is the neutral element. The curve has degree 4, so it has $4times deg(f)$ intersection points with the function $f$. We can choose $f_i$ to be quadratic functions to offer enough freedom of cancellation (8 intersections). Quadratic functions (conic sections) are determined by 5 points. Observing that points at infinity $Omega_1 = (1:0:0)$ and $Omega_2 = (0:1:0)$ are singular and have multiplicity 2, let us determine the conic by passing through $P$, $Q$, $(0,-1)$, $Omega_1$ and $Omega_2$. This let only one more intersection point $P+Q$.



                enter image description here



                (addition and doubling over $mathbb{R}$ for $d<0$)



                This was the first suggestion by Arène, Lange, Naehrig and Ritzenthaler to give a geometric interpretation of the addition law.







                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited Jan 7 at 16:33

























                answered Jan 7 at 16:09









                Youssef El HousniYoussef El Housni

                50938




                50938























                    6












                    $begingroup$

                    The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



                    The correct interpretation for this kind of curves is "adding their angles".
                    It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



                    You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






                    share|improve this answer











                    $endgroup$













                    • $begingroup$
                      Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 16:00






                    • 1




                      $begingroup$
                      probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                      $endgroup$
                      – ddddavidee
                      Jan 7 at 16:11






                    • 3




                      $begingroup$
                      @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:40










                    • $begingroup$
                      @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:57










                    • $begingroup$
                      I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 17:35
















                    6












                    $begingroup$

                    The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



                    The correct interpretation for this kind of curves is "adding their angles".
                    It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



                    You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






                    share|improve this answer











                    $endgroup$













                    • $begingroup$
                      Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 16:00






                    • 1




                      $begingroup$
                      probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                      $endgroup$
                      – ddddavidee
                      Jan 7 at 16:11






                    • 3




                      $begingroup$
                      @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:40










                    • $begingroup$
                      @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:57










                    • $begingroup$
                      I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 17:35














                    6












                    6








                    6





                    $begingroup$

                    The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



                    The correct interpretation for this kind of curves is "adding their angles".
                    It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



                    You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange






                    share|improve this answer











                    $endgroup$



                    The geometric interpretation of the "addition law" on Edward Curves is not the same as for Weierstrass Curves.



                    The correct interpretation for this kind of curves is "adding their angles".
                    It works as on a clock. Of course, as for the Weierstrass curves, the geometric interpretation stands for the curve over the real numbers and not in a finite field (useful for cryptography).



                    You can give a look to the ECCHacks: a gentle introduction to elliptic-curve cryptography (starting at page 6) by Daniel J. Bernstein and Tanja Lange







                    share|improve this answer














                    share|improve this answer



                    share|improve this answer








                    edited Jan 7 at 16:09

























                    answered Jan 7 at 15:39









                    ddddavideeddddavidee

                    2,59611429




                    2,59611429












                    • $begingroup$
                      Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 16:00






                    • 1




                      $begingroup$
                      probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                      $endgroup$
                      – ddddavidee
                      Jan 7 at 16:11






                    • 3




                      $begingroup$
                      @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:40










                    • $begingroup$
                      @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:57










                    • $begingroup$
                      I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 17:35


















                    • $begingroup$
                      Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 16:00






                    • 1




                      $begingroup$
                      probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                      $endgroup$
                      – ddddavidee
                      Jan 7 at 16:11






                    • 3




                      $begingroup$
                      @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:40










                    • $begingroup$
                      @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                      $endgroup$
                      – Youssef El Housni
                      Jan 7 at 16:57










                    • $begingroup$
                      I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                      $endgroup$
                      – Ruben De Smet
                      Jan 7 at 17:35
















                    $begingroup$
                    Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                    $endgroup$
                    – Ruben De Smet
                    Jan 7 at 16:00




                    $begingroup$
                    Sometimes I do actually wonder why people even bother with Weierstrass curves. These Edwards curves seem so much more elegant!
                    $endgroup$
                    – Ruben De Smet
                    Jan 7 at 16:00




                    1




                    1




                    $begingroup$
                    probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                    $endgroup$
                    – ddddavidee
                    Jan 7 at 16:11




                    $begingroup$
                    probably because Weierstass curves have been studied at the beginning and maybe we were less aware of the exploitability of timing side channels? (just a supposition)
                    $endgroup$
                    – ddddavidee
                    Jan 7 at 16:11




                    3




                    3




                    $begingroup$
                    @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                    $endgroup$
                    – Youssef El Housni
                    Jan 7 at 16:40




                    $begingroup$
                    @ddddavidee I am not sure about the "angles addition" on Edwards curves. This is only an analogy with the circle case but not a geometric interpretation of the addition law. For Weierstrass equations, I think that the interpretation stands for finite fields as well but the line passing through the points to add is $pmod p$ (see 3rd figure: andrea.corbellini.name/2015/05/23/…).
                    $endgroup$
                    – Youssef El Housni
                    Jan 7 at 16:40












                    $begingroup$
                    @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                    $endgroup$
                    – Youssef El Housni
                    Jan 7 at 16:57




                    $begingroup$
                    @RubenDeSmet another reason for some people not choosing Edwards curves is that they cannot have a prime number of rational points over the base field, and they are therefore incompatible with the prime-order Weierstrass curves used in all of the current cryptographic standards.
                    $endgroup$
                    – Youssef El Housni
                    Jan 7 at 16:57












                    $begingroup$
                    I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                    $endgroup$
                    – Ruben De Smet
                    Jan 7 at 17:35




                    $begingroup$
                    I'll undo the accept until I've studied both a bit more myself. Thanks for both answers!
                    $endgroup$
                    – Ruben De Smet
                    Jan 7 at 17:35


















                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Cryptography Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    Use MathJax to format equations. MathJax reference.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66325%2fgeometric-interpretation-of-an-edwards-curve%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Aardman Animations

                    Are they similar matrix

                    “minimization” problem in Euclidean space related to orthonormal basis