2

Given a generalised Weierstass curve $E$ over a field $\mathbb{K}$ with $O$ denoting its point at infinity in two-dimensional projective space; am I wrong in thinking that $O$ is not an affine point in $E(\mathbb{K})$?

Algorithm $13$ of Selecting Elliptic Curves for Cryptography: An Efficiency and Security Analysis, on page $22$, has input '$P$,$Q\in E_b(\mathbb{F_p})$ such that $P=(X_1,Y_1,Z_1)$ is in projective coordinates and $Q=(x_1,y_1)$ is in affine coordinates.' but then in line two, they consider the case $Q=O$ and, as far as I'm aware, $O$ is a point in two-dimensional projective space and not two-dimensional affine space.

Is it maybe that when writing algorithms, the technical details are left a little loose?

  • 1
    No, your guess is correct. With the Weierstrass equation $y^2+axy+by=x^3+cx^2+dx+e$, the “point at infinity” $\Bbb O$ is $(0:1:0)$ . – Lubin Apr 19 '21 at 15:46

1 Answers1

2

We want the curves to work as a group and in order to do that an extra point is created, but that's unsatisfactory: the point of infinity has no place in the geometric picture and in the algebraic construction and we magically add one with no coordinates.

$$E(\mathbb{K}) := \{ (x, y) \in \mathbb{K}^2 \mid y^2+a_1xy+a_3y = x^3+a_2x^2+a_4x+a_6\} \cup \{\mathcal O\}$$

An Elliptic Curve cannot be easily understood without the projective plane. In the projective plane, the points are represented as $(X:Y:Z)$ as an equivalence class since the $(X,Y,Z) \sim (\lambda X,\lambda Y,\lambda Z)$

The points of the form $(x:y:1)$ are called affine point and we naturally map this $(x,y)$ as the affine coordinates with $x = X /Z$ and $Y=Y/Z$

Now the point at infinity defined as $(0:1:0)$ and we cannot map this into affine coordinates since we will have a division by zero.

The writing $Q=\mathcal{O}$, where $Q$ is an affine point, is used in the sense of programming, as you can see they are writing an algorithm, and $\mathcal{O}$ is a symbol in the affine coordinates we added during the construction.

While programming, the point of infinity is usually represented as a full of zero bytes to distinguish from the other points.

kelalaka
  • 1,679