Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass curve?

[Samuel Neves <[e-mail]>]

On 04-12-2014 22:17, Dan Brown wrote:
> Well, I haven't really studied these kinds of things before: I more often think of elliptic curves as generic groups, so I could easily be mistaken (e.g. maybe the incorrect outputs really can differ from (0:0:0), or something really wrong in the logic above).  So, I ask the experts here on this list: Is this addition law correct?  Is it complete in the same sense used for Edwards curves?
>
>
>
> If this is all correct, then I would suggest that cofactor 1 short Weierstrass do not have a security problem compared to Edwards curves (e.g. cofactor 4), in the sense of lacking a complete addition law, but rather, just an efficiency problem, in the sense of not having any (known) efficient complete law.

If you read Lenstra-Bosma, you will see that what you call (G:H:I) is already complete (in the field) for curves with
cofactor 1: the exceptional points for the second formula are exactly the points for which P1 - P2 has Y = 0, which does
not happen in cofactor 1. More generally, Arene,  Kohel, and Ritzenthaler (https://arxiv.org/abs/1102.2349, Theorem 4.3)
have shown that any elliptic curve, regardless of cofactor, has a complete addition formula in the field.