In mathematics, the Twisted Hessian curve represents a generalization of Hessian curves; it was introduced in elliptic curve cryptography to speed up the addition and doubling formulas and to have strongly unified arithmetic. In some operations (see the last sections), it is close in speed to Edwards curves.

Definition

Let K be a field. According to^[1] twisted Hessian curves were introduced by Bernstein, Lange, and Kohel.

The twisted Hessian form in affine coordinates is given by:

${\displaystyle a\cdot x^{3}+y^{3}+1=d\cdot x\cdot y}$

and in projective coordinates:

${\displaystyle a\cdot X^{3}+Y^{3}+Z^{3}=d\cdot X\cdot Y\cdot Z}$

where ${\displaystyle x={\frac {X}{Z))}$ and ${\displaystyle y={\frac {Y}{Z))}$ and a, d in K

Note that these curves are birationally equivalent to Hessian curves.

The Hessian curve is just a special case of Twisted Hessian curve, with a=1.

Considering the equation a · x³ + y³ + 1 = d · x · y, note that:

if a has a cube root in K, there exists a unique b such that a = b³.Otherwise, it is necessary to consider an extension field of K (e.g., K(a^1/3)). Then, since b³ · x³ = bx³, defining t = b · x, the following equation is needed (in Hessian form) to do the transformation:

${\displaystyle t^{3}+y^{3}+1=d\cdot x\cdot y}$.

This means that Twisted Hessian curves are birationally equivalent to elliptic curve in Weierstrass form.

Group law

It is interesting to analyze the group law of the elliptic curve, defining the addition and doubling formulas (because the simple power analysis and differential power analysis attacks are based on the running time of these operations). In general, the group law is defined in the following way: if three points lies in the same line then they sum up to zero. So, by this property, the explicit formulas for the group law depend on the curve shape.

Let P = (x₁, y₁) be a point, then its inverse is −P = (x₁/y₁, 1/y₁) in the plane. In projective coordinates, let P = (X : Y : Z) be one point, then −P = (X₁/Y₁ : 1/Y₁ : Z) is the inverse of P.

Furthermore, the neutral element (in affine plane) is: θ = (0, −1) and in projective coordinates: θ = (0 : −1 : 1).

In some applications of elliptic curve cryptography and the elliptic curve method of integer factorization (ECM) it is necessary to compute the scalar multiplications of P, say [n]P for some integer n, and they are based on the double-and-add method; so the addition and doubling formulas are needed.

The addition and doubling formulas for this elliptic curve can be defined, using the affine coordinates to simplify the notation:

Addition formulas

Let p = (x₁, y₁) and Q = (x₂, y₂); then, R = P + Q = (x₃, y₃) is given by the following equations:

${\displaystyle x_{3}={\frac {x_{1}-y_{1}^{2}\cdot x_{2}\cdot y_{2)){a\cdot x_{1}\cdot y_{1}\cdot x_{2}^{2}-y_{2))))$

${\displaystyle y_{3}={\frac {y_{1}\cdot y_{2}^{2}-a\cdot x_{1}^{2}\cdot x_{2)){a\cdot x_{1}\cdot y_{1}\cdot x_{2}^{2}-y_{2))))$

Doubling formulas

Let P = (x, y); then [2]P = (x₁, y₁) is given by the following equations:

${\displaystyle x_{1}={\frac {x-y^{3}\cdot x}{a\cdot y\cdot x^{3}-y))}$

${\displaystyle y_{1}={\frac {y^{3}-a\cdot x^{3)){a\cdot y\cdot x^{3}-y))}$

Algorithms and examples

Here some efficient algorithms of the addition and doubling law are given; they can be important in cryptographic computations, and the projective coordinates are used to this purpose.

Addition

${\displaystyle A=X_{1}\cdot Z_{2))$

${\displaystyle B=Z_{1}\cdot Z_{2))$

${\displaystyle C=Y_{1}X_{2))$

${\displaystyle D=Y_{1}\cdot Y_{2))$

${\displaystyle E=Z_{1}\cdot Y_{2))$

${\displaystyle F=a\cdot X_{1}\cdot X_{2))$

${\displaystyle X_{3}=A\cdot B-C\cdot D}$

${\displaystyle Y_{3}=D\cdot E-F\cdot A}$

${\displaystyle Z_{3}=F\cdot C-B\cdot E}$

The cost of this algorithm is 12 multiplications, one multiplication by a (constant) and 3 additions.

Example:

let P₁ = (1 : −1 : 1) and P₂ = (−2 : 1 : 1) be points over a twisted Hessian curve with a=2 and d=-2.Then R = P₁ + P₂ is given by:

${\displaystyle A=-1;B=-1;C=-1;D=-1;E=1;F=2;}$

${\displaystyle x_{3}=0}$

${\displaystyle y_{3}=-3}$

${\displaystyle z_{3}=-3}$

That is, R= (0 : −3 : −3).

Doubling

${\displaystyle D=X_{1}^{3))$

${\displaystyle E=Y_{1}^{3))$

${\displaystyle F=Z_{1}^{3))$

${\displaystyle G=a\cdot D}$

${\displaystyle X_{3}=X_{1}\cdot (E-F)}$

${\displaystyle Y_{3}=Z_{1}\cdot (G-E)}$

${\displaystyle Z_{3}=Y_{1}\cdot (F-G)}$

The cost of this algorithm is 3 multiplications, one multiplication by constant, 3 additions and 3 cube powers. This is the best result obtained for this curve.

Example:

let P = (1 : −1 : 1) be a point over the curve defined by a=2 and d=-2 as above, then R = [2]P = (x₃ : y₃ : z₃) is given by:

${\displaystyle D=1;E=-1;F=1;G=-4;}$

${\displaystyle x_{3}=-2}$

${\displaystyle y_{3}=-3}$

${\displaystyle z_{3}=-5}$

That is R = (−2 : −3 : 5).