0

Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain how to achieve this? If not, could you clarify why it's not possible?

Favour
  • 37
  • 5
  • You can construct one, however, it will be a bit more complex. Why do you need this? You need complete and side-channel free addition Is there any "exception-free" coordinates system for Weierstrass curves? – kelalaka Mar 19 '24 at 14:15
  • @kelalaka I followed the link you provided but I wasn't able to come up with anything. I'll have only been able to construct a direct secp256k1 elliptic curve subtraction formula other than negating and adding , assuming you want to subtract $G^x$ from $Q^x$ you can use the below formula. s = (Qy + Gy) * pow(Gx - Qx, -1, p) % p Rx = (s**2 - Qx - Gx) % p Ry = (s * (Rx - Qx) - Qy) % p – Favour Mar 19 '24 at 14:59
  • My point is, we don't need this formula for general scalar multiplication. Why do you need? – kelalaka Mar 19 '24 at 15:04
  • It will help me understand better. If you don't mind can you provide the formula for point multiplication by 3 – Favour Mar 19 '24 at 15:18
  • 2
    @Favour What's wrong with combining a doubling with an addition ? Like computing (2*P)+P? – Ruggero Mar 20 '24 at 10:14

1 Answers1

3

A simple way to derive a point tripling method in Cartesian coordinates for secp256k1 is per $3P=(2P)+P$, and towards this

p = 2**256-2**32-977

def triple(x:int, y:int):
    if x==0 or y==0:
        return 0,0 # point at infinity
    X = x2
    w = 3X
    R = 2y2 % p
    Z = 4yR % p
    u = RR
    B = ((x+R)2-X-u) % p
    h = (w2-2B) % p
    X = 2hy % p
    Y = (w(B-h)-2u) % p
    u = yZ-Y % p
    v = xZ-X % p
    w = v2
    R = wX % p
    w = vw % p
    A = (u2Z-w-2R) % p
    h = pow(wZ,-1,p)
    return vAh % p, (u(R-A)-wY)h % p

I don't claim that's optimal.

fgrieu
  • 140,762
  • 12
  • 307
  • 587