# Elliptic curve point multiplication

Elliptic curve point multiplication is the operation of successively adding a point along an elliptic curve to itself repeatedly. It is used in elliptic curve cryptography (ECC) as a means of producing a trapdoor function. The literature presents this operation as scalar multiplication, thus the most common name is elliptic curve scalar multiplication, as written in Hessian form of an elliptic curve.

## Basics

Given a curve, E, defined along some equation in a finite field (such as E: y2 = x3 + ax + b), point multiplication is defined as the repeated addition of a point along that curve. Denote as nP = P + P + P + … + P for some scalar (integer) n and a point P = (x, y) that lies on the curve, E. This type of curve is known as a Weierstrass curve.

The security of modern ECC depends on the intractability of determining n from Q = nP given known values of Q and P. It is known as the elliptic curve discrete logarithm problem.

With 2 distinct points, P and Q, addition is defined as the negation of the point resulting from the intersection of the curve, E, and the straight line defined by the points P and Q, giving the point, R.

{\displaystyle {\begin{aligned}P+Q&=R\\(x_{p},y_{p})+(x_{q},y_{q})&=(x_{r},y_{r})\end{aligned}}}.

Assuming the elliptic curve, E, is given by y2 = x3 + ax + b, this can be calculated as:

{\displaystyle {\begin{aligned}x_{r}&=\lambda ^{2}-x_{p}-x_{q}\\y_{r}&=\lambda (x_{p}-x_{r})-y_{p}\\\lambda &={\frac {y_{q}-y_{p}}{x_{q}-x_{p}}}\end{aligned}}}

### Point doubling

Where the points, P and Q, are coincident, addition is similar, except that there is no well-defined straight line through P and Q, so the operation is closed using limiting case, the tangent to the curve, E, at P and Q.

This is calculated as above, except with:

${\displaystyle \lambda ={\frac {3x_{p}^{2}+a}{2y_{p}}}}$

where a is from the defining equation of the curve, E, above.

## Point multiplication

The straightforward way of computing a point multiplication is through repeated addition. However, this is a fully exponential approach to computing the multiplication.

The simplest method is the double-and-add method,[1] similar to multiply-and-square in modular exponentiation. The algorithm works as follows:

To compute dP, start with the binary representation for d: ${\displaystyle \scriptstyle d~=~d_{0}\,+\,2d_{1}\,+\,2^{2}d_{2}\,+\,\cdots \,+\,2^{m}d_{m}}$, where [${\displaystyle \scriptstyle d_{0}~..~d_{m}}$] ∈ {0,1}

There are two possible iterative algorithms.

Iterative algorithm, index increasing:

  N ← P
Q ← 0
for i from 0 to m do
if di = 1 then
N ← point_double(N)
return Q


Iterative algorithm, index decreasing:

  Q ← 0
for i from m down to 0 do
Q ← point_double(Q)
if di = 1 then
return Q


An alternative way of writing the above as a recursive function is

  f(P, n) is
if n = 0 then
return 0                        # computation complete
else if n = 1 then
return P
else if n mod 2 = 1 then
return point_add(P, f(P, n - 1)) # addition when n is odd
else
return f(point_double(P), n/2)   # doubling when n is even


where f is the function for doubling, P is the coordinate to double, n is the number of times to double the coordinate. Example: 100P can be written as 2(2[P + 2(2[2(P + 2P)])]) and thus requires six doublings and two additions. 100P would be equal to f(P, 100).

This algorithm requires log2(n) iterations of point doubling and addition to compute the full-point multiplication. There are many variations of this algorithm such as using a window, sliding window, NAF, NAF-w, vector chains, and Montgomery ladder.

### Windowed method

In the windowed version of this algorithm,[1] one selects a window size w and computes all ${\displaystyle \scriptstyle 2^{w}}$ values of ${\displaystyle \scriptstyle dP}$ for ${\displaystyle \scriptstyle d~=~0,\,1,\,2,\,\dots ,\,2^{w}\,-\,1}$. The algorithm now uses the representation ${\displaystyle \scriptstyle d~=~d_{0}\,+\,2^{w}d_{1}\,+\,2^{2w}d_{2}\,+\,\cdots \,+\,2^{mw}d_{m}}$ and becomes

  Q ← 0
for i from m to 0 do
Q ← point_double_repeat(Q, w)
if di > 0 then
Q ← point_add(Q, diP) # using pre-computed value of diP
return Q


This algorithm has the same complexity as the double-and-add approach with the benefit of using fewer point additions (which in practice are slower than doubling). Typically, the value of w is chosen to be fairly small making the pre-computation stage a trivial component of the algorithm. For the NIST recommended curves, ${\displaystyle \scriptstyle w~=~4}$ is usually the best selection. The entire complexity for a n-bit number is measured as ${\displaystyle \scriptstyle n\,+\,1}$ point doubles and ${\displaystyle \scriptstyle 2^{w}\,-\,2\,+\,{\frac {n}{w}}}$ point additions.

### Sliding-window method

In the sliding-window version, we look to trade off point additions for point doubles. We compute a similar table as in the windowed version except we only compute the points ${\displaystyle \scriptstyle dP}$ for ${\displaystyle \scriptstyle d~=~2^{w-1},\,2^{w-1}\,+\,1,\,\dots ,\,2^{w}\,-\,1}$. Effectively, we are only computing the values for which the most significant bit of the window is set. The algorithm then uses the original double-and-add representation of ${\displaystyle \scriptstyle d~=~d_{0}\,+\,2d_{1}\,+\,2^{2}d_{2}\,+\,\cdots \,+\,2^{m}d_{m}}$.

  Q ← 0
for i from m downto 0 do
if di = 0 then
Q ← point_double(Q)
else
t ← extract j (up to w − 1) additional bits from d (including di)
i ← i − j
if j < w then
return Q
else
Q ← point_double_repeat(Q, w)
return Q


This algorithm has the benefit that the pre-computation stage is roughly half as complex as the normal windowed method while also trading slower point additions for point doublings. In effect, there is little reason to use the windowed method over this approach. The algorithm requires ${\displaystyle \scriptstyle w\,-\,1\,+\,n}$ point doubles and at most ${\displaystyle \scriptstyle 2^{w-1}\,-\,1\,+\,{\frac {n}{w}}}$ point additions.

### w-ary non-adjacent form (wNAF) method

In the non-adjacent form we aim to make use of the fact that point subtraction is just as easy as point addition to perform fewer (of either) as compared to a sliding-window method. The NAF of the multiplicand ${\displaystyle \scriptstyle d}$ must be computed first with the following algorithm

   i ← 0
while (d > 0) do
if (d mod 2) = 1 then
di ← d mods 2w
d ← d − di
else
di = 0
d ← d/2
i ← i + 1
return (di−1, di-2, …, d0)


Where the mods function is defined as

   if (d mod 2w) >= 2w−1
return (d mod 2w) − 2w
else
return d mod 2w


This produces the NAF needed to now perform the multiplication. This algorithm requires the pre-computation of the points ${\displaystyle \scriptstyle \lbrace 1,\,3,\,5,\,\dots ,\,2^{w-1}\,-\,1\rbrace P}$ and their negatives, where ${\displaystyle \scriptstyle P}$ is the point to be multiplied. On typical Weierstrass curves, if ${\displaystyle \scriptstyle P~=~\lbrace x,\,y\rbrace }$ then ${\displaystyle \scriptstyle -P~=~\lbrace x,\,-y\rbrace }$. So in essence the negatives are cheap to compute. Next, the following algorithm computes the multiplication ${\displaystyle \scriptstyle dP}$:

   Q ← 0
for j ← i − 1 downto 0 do
Q ← point_double(Q)
if (dj != 0)
return Q


The wNAF guarantees that on average there will be a density of ${\displaystyle \scriptstyle {\frac {1}{w\,+\,1}}}$ point additions (slightly better than the unsigned window). It requires 1 point doubling and ${\displaystyle \scriptstyle 2^{w-2}\,-\,1}$ point additions for precomputation. The algorithm then requires ${\displaystyle \scriptstyle n}$ point doublings and ${\displaystyle \scriptstyle {\frac {n}{w\,+\,1}}}$ point additions for the rest of the multiplication.

One property of the NAF is that we are guaranteed that every non-zero element ${\displaystyle \scriptstyle d_{i}}$ is followed by at least ${\displaystyle \scriptstyle w\,-\,1}$ additional zeroes. This is because the algorithm clears out the lower ${\displaystyle \scriptstyle w}$ bits of ${\displaystyle \scriptstyle d}$ with every subtraction of the output of the mods function. This observation can be used for several purposes. After every non-zero element the additional zeroes can be implied and do not need to be stored. Secondly, the multiple serial divisions by 2 can be replaced by a division by ${\displaystyle \scriptstyle 2^{w}}$ after every non-zero ${\displaystyle \scriptstyle d_{i}}$ element and divide by 2 after every zero.

The Montgomery ladder[2] approach computes the point multiplication in a fixed amount of time. This can be beneficial when timing or power consumption measurements are exposed to an attacker performing a side-channel attack. The algorithm uses the same representation as from double-and-add.

  R0 ← 0
R1 ← P
for i from m downto 0 do
if di = 0 then
R0 ← point_double(R0)
else