The Montgomery ladder is a technique for scalar multiplication in an elliptic curve group, characterized by performing double-and-add at each step according to the multiplicand/exponent, rather double-and-conditionally-add in standard scalar multiplication. Applied to an elliptic curve in Montgomery form, it is efficient (it's initial goal) and easy to make constant-time. It's generalizable to exponentiation in any Abelian group.
Questions tagged [montgomery-ladder]
13 questions
5
votes
1 answer
Why is Montgomery Ladder fast on Montgomery Curves?
When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or doubling a point. For all I know, those points can…
Gautham Krishna
- 51
- 2
5
votes
2 answers
Advantages of Montgomery Ladder-based Scalar Multiplication
I do not quite understand what the greatest advantages are of using the Montgomery ladder algorithm for scalar multiplication?
Can someone help me out?
Ceesz
- 53
- 1
- 4
4
votes
0 answers
Fastest known Elliptic Curve Cryptography "solution" (coordinate systems (multiple?), algorithms, precomputed values etc)?
TL;DR: Does anyone have a reference to a study, implementation of different algorithms or otherwise "truth" about which solution - a set of coordinate systems and algorithms that enables the fastest known Point multiplication for e.g. X25519…
Sajjon
- 151
- 9
4
votes
1 answer
What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder
I am trying to understand the below paragraph.
Elliptic curve Diffie-Hellman is often calculated using the Montgomery
ladder. This gives a simple and efficient calculation that is
naturally resistant to timing side channels. The Montgomery…
tarun14110
- 277
- 2
- 8
3
votes
1 answer
Can Montgomery ladder multiplication be used with secp256k1?
While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say:
The curve secp256k1 does not allow the Montgomery ladder
implementation.
Is…
Diego Maü
- 31
- 2
3
votes
1 answer
Standard Montgomery curves over prime field
Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field?
I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of scalar multiplication with $X/Z$ coordinates and…
fgrieu
- 149,326
- 13
- 324
- 622
2
votes
2 answers
How to recover y-coordinates when using XZ montgomery curve
I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates.
for Double and add ladder I am using this:
A =…
Cisco Saeed
- 251
- 1
- 7
2
votes
1 answer
What is the equation to get P-Q in Montgomery curve XZ coordinates
Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I don't know what is the equation used to get P-Q to get X-,Z-.
So for example if I have P1(8,3,1) so it means (X⊖,Z⊖) =…
Cisco Saeed
- 251
- 1
- 7
2
votes
1 answer
XZ coordinates for Montgomery curves
I am learning about Elliptic curve and I reached to Montgomery curve with XZ coordinates with this equation: b*y2=x3+a*x2+x and regarding the information from this link: XZ coordinates add and doubling
and I made this small code in matlab to…
Cisco Saeed
- 251
- 1
- 7
1
vote
1 answer
Performing EdDSA/Ed448 employing Montgomery ladder
EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and the $y$-coordinate is required to recover.…
Mojtaba
- 11
- 4
1
vote
1 answer
Montgomery Ladder with affine/projective Coordinates
So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is.
With this Post i understood the basic affine arithmetic and Ladder.
So this is not really faster than arithmetic on common weierstrass equations. In…
Titanlord
- 2,812
- 13
- 37
1
vote
1 answer
What scalars produce the wrong values with X25519's montgomery ladder?
This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances.
The following Montgomery ladder as implemented in the ref10 implementation is unsafe:…
Loup Vaillant
- 69
- 4
1
vote
0 answers
Montgomery Ladder on Weierstrass Curve
I want to use the Montgomery ladder to speed up the process of calculating scalar multiplication. Here I use the Montgomery ladder but on the Weierstrass curve.
In the equation $x^3 + 2x + 9 \bmod 37$ the result is correct.
But why on the curve $x^3…
Tessa
- 11
- 2