Why is Montgomery Ladder fast on Montgomery Curves?

Question

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or doubling a point. For all I know, those points can belong to any form of elliptic curve. Why is it that in many papers, it is claimed that the Montgomery ladder is fastest on Montgomery curves? What am I missing?

Answer 1

Elliptic curves can be represented in different form. The most basic equation, in which every elliptic curve can be represented is the Weierstraß equation:

$$ y^2 = x^3 + ax + b$$

For a Montgomery curve it must be able to be represented in the following form:

$$ (b)y^2 = x^3 + ax^2 + x$$

For every Montgomery curve it is possible to transform its equation to Weierstraß, but not vice versa. Therefore not every elliptic curve is a Montgomery curve.

The Montgomery ladder can only be used by Montgomery curves and can be viewed as a Double and Add-procedure variant with constant time. Such variants and ladders exist for multiple different elliptic curves, but should have different names (e.g. see SafeCurves).