Fast and Simple Point Operations on Edwards448 and E448

Since Edwards curves were introduced in elliptic curve cryptography, they have attracted a lot of attention. The twisted Edwards curves are defined by the equation \(E_{a,d}: ax^2 + y^2 = 1 + d x^2y^2\) . Twisted Edwards curve is the state-of-the-art for \(a=-1\) , and even for \(a \ne -1\) . E448 and Edwards448 are NIST standard curve in 2023 and TLS 1.3 standard curve in 2018. They both can be converted to \(d=-1\) , but can not be converted to \(a=-1\) through isomorphism. The motivation of using a curve with \(d=-1\) is that we want to improve the efficiency of E448, and Edwards448, especially to achieve a great saving in terms of the number of field multiplications ( \({{\textbf {M}}}\) ) and field squarings ( \({{\textbf {S}}}\) ). We propose new explicit formulas for point operations on these curves. Our full point addition only requires \(8 {{\textbf {M}}}\) , and mixed addition requires \(7 {{\textbf {M}}}\) . Our results applied on the Edward448 and E448 yield a clean and simple implementation and achieve a brand new speed record. The scalar multiplication on Edwards448 and E448 have the same cost of \({{\textbf {M}}}\) and \({{\textbf {S}}}\) as that on Edwards25519 per bit.