Hessian form of an elliptic curve


In geometry, the Hessian curve is a plane curve similar to folium of Descartes. It is named after the German mathematician Otto Hesse.
This curve was suggested for application in elliptic curve cryptography, because arithmetic in this curve representation is faster and needs less memory than arithmetic in standard Weierstrass form.

Definition

Let be a field and consider an elliptic curve in the
following special case of Weierstrass form over :
where the curve has discriminant
Then the point has order 3.
To prove that has order 3, note that the tangent to
at is the line which intersects
with multiplicity 3 at.
Conversely,
given a point of order 3 on an elliptic curve
both defined over a field one can put the curve into Weierstrass
form with so that the tangent at
is the line. Then the equation of the curve is
with.
Now, to obtain the Hessian curve, it is necessary to do the following transformation:
First let denote a root of the polynomial
Then
Note that if has a finite field of order
, then every element of has a unique cube root; in general,
lies in an extension field of K.
Now by defining the following value another curve, C, is obtained, that is birationally equivalent to E:
which is called cubic Hessian form
in the affine plane .
Furthermore, .
Starting from the Hessian curve, a birationally equivalent Weierstrass equation is given by
under the transformations:
and
where:
and

Group law

It is interesting to analyze the group law of the elliptic curve, defining the addition and doubling formulas. Furthermore, in this case, we only need to use the same procedure to compute the addition, doubling or subtraction of points to get efficient results, as said above.
In general, the group law is defined in the following way: if three points lie in the same line then they sum up to zero. So, by this property, the group laws are different for every curve.
In this case, the correct way is to use the Cauchy-Desboves´ formulas, obtaining the point at infinity =, that is, the neutral element.
Let P= be a point on the curve. The line contains the point and the point at infinity.
Therefore, -P is the third point of the intersection of this line with the curve. Intersecting the elliptic curve with the line, the following condition is obtained
Since is non zero , the x-coordinate of is and the y-coordinate of is, i.e., or in projective coordinates .
In some application of elliptic curve cryptography and the elliptic curve method of factorization it is necessary to compute the scalar multiplications of P, say P for some integer n, and they are based on the double-and-add method; these operations need the addition and doubling formulas.
Doubling
Now, if is a point on the elliptic curve, it is possible to define a "doubling" operation using Cauchy-Desboves´ formulae:
Addition
In the same way, for two different points, say and, it is possible to define the addition formula. Let denote the sum of these points,, then its coordinates are given by:

Algorithms and examples

There is one algorithm that can be used to add two different points or to double; it is given by Joye and Quisquater. Then, the following result gives the possibility the obtain the doubling operation by the addition:
Proposition. Let P = be a point on a Hessian elliptic curve E. Then: 2 = + .
Furthermore, we have ≠.
Finally, contrary to other parameterizations, there is no subtraction to compute the negation of a point. Hence, this addition algorithm can also be used for subtracting two points and on a Hessian elliptic curve:
- = +
To sum up, by adapting the order of the inputs according to equation or, the addition algorithm presented above can be used indifferently for:
Adding 2 points, Doubling a point and Subtracting 2 points with only 12 multiplications and 7 auxiliary variables including the 3 result variables. Before the invention of Edwards curves,
these results represent the fastest known method for implementing the elliptic curve scalar multiplication towards resistance against side-channel attacks.
For some algorithms protection against side-channel attacks is not necessary. So, for these doublings can be faster. Since there are many algorithms, only the best for the addition and doubling formulas is given here, with one example for each one:

Addition

Let P1 = and P2 = be two points distinct to. Assuming that Z1=Z2=1 then the algorithm is given by:
A = X1 Y2
B = Y1 X2
The cost needed is 8 multiplications and 3 additions readdition cost of 7 multiplications and 3 additions, depending on the first point.
;Example
Given the following points in the curve for d=-1 P1= and P2=, then if P3=P1+P2 we have:
Then: P3 =

Doubling

Let P = be a point, then the doubling formula is given by:
The cost of this algorithm is three multiplications + three squarings + 11 additions + 3×2.
;Example
If is a point over the Hessian curve with parameter d=-1, then the coordinates of are given by:
X = = -4
Y = = -2
Z = = 0
That is,

Extended coordinates

There is another coordinates system with which a Hessian curve can be represented; these new coordinates are called extended coordinates. They can speed up the addition and doubling. To have more information about operations with the extended coordinates see:
http://hyperelliptic.org/EFD/g1p/auto-hessian-extended.html#addition-add-20080225-hwcd
and are represented by satisfying the following equations: