 So you will see a lot of formula in this talk. I would like also to tell you that some of them were also found by another team of researchers, so including Dan Benstein, Tanya Lang, and David Coel. So essentially a similar model, what they call twisted Asian curves. Okay, so let's start. And maybe last comment, so in the last talk, Greg just told you that's all tricks to speed up the arithmetic on the empty curve where exhausted. So I hope that after this talk, you will be convinced that it's not completely true. So if you ask a mathematician what's an empty curve, so he will tell you that's an empty curve is a non-singular, a genius one curve with one rational point on it. So in a more concrete way, you can say that's an empty curve is given by a real stress equation where all the coefficients are in some field F. And what we are looking to is actually the set of rational points on the curve. That is all the points on the field, so that satisfy the stress equation. And here you can see that the point that infinity is always on the curve. So this is our rational point. So if there is just one thing that you have to remember about the empty curve is that's the set of all those points from a group. And so that's something which is very useful. So as you will see in a moment. And the natural element is the point at infinity. And so it's quite easy to get the group flow. So it's given by the code and tangent rule. So what do we need an empty curve? So there are a lot of applications. So here are some of them. So they can be used to factorize integer. So there's a very efficient algorithm due to Lensstrah. You can also use, so I guess you all know that, you can use the empty curve for crypto. And the last application for the empty curve is when you have to prove the probability of some number. So again, using the empty curve, so this is quite efficient. So we have application and of course, what we want is an efficient way to compute on the empty curves. So this is the subject of this talk. So for crypto, so it's useful to use empty curve because today there is no way, sorry, there is some way, but there are no sub exponential way to break the discrete log on the empty curve. So this in turn means that you can use shorter key. And so it means also that the competition are faster. So there are different ways to speed up the arithmetic. So you can of course look at the level of the finite field. So you can prove the arithmetic of the finite field. And of course, you will end up with something which is more efficient. But, and there are still some things to do at this level too. So you can also speed up the empty curve arithmetic. So there are different ways to do so. So you can play with the curve equation. You can also look at different coordinate system. And here there are some points I would like to address. So remember that we have points, we have to add point on the curve. And because of the additional loss, so you have exactly two set of equations. So one to add points and another set to double a point. And what is very nice at least for the implementer is to have just one set to add points. Okay, so when you can use exactly the same formula to add or double points, so we said that the addition is complete. So this is really something which is useful. So first because it makes the implementation easy. Second because also it gives some protection against some side channel attacks. Think for example of all SPA type attack. And also, so for example, if you look at some other implementation, so it means that you can save some space. So it means also you save some money. So I will show you different way to add points. I will present you some complete formulas, some unified formula. I will also present you, so sometimes you just need speed, so you don't care about complete formula. So in that case, you may be interesting to have also very fast doubling formula. So I will also show you how this is possible. Also, so one way to compute a scalar multiplication on an elliptic curve, so it's by relying on the so-called Montgomery letter. So in that case, you need what we call a differential addition. So again, we can do it fast. And last formula, so I will show you is auto triple a point. So given some point P, auto compute three times P. So there are many, many, many different way to present an elliptic curve. So here are some of them. So maybe you know the first one, so the classical register as equation, but there are many other one. So all those one are valid over large point field. Okay, so you see the addition curve. So this one. So we can do the same for field of characteristic two. So here are some other curves that we know. So again, you can use the register as equation, but the addition form is also valid and then there is also a binary, so binary Edoard's curve that you can use to play on the binary fields. So if you now take a look at the geometric representation of those curves, so first you may observe that there are indeed elliptic curves, so just one interpoint. And you see at the bottom, so the addition curve and that one is quite beautiful. Actually they are all beautiful because they are very symmetric. So the addition one is very nice. The same for Edoard's, so maybe they are most too beautiful. So maybe you won't agree with that, but I find it beautiful. So this is the equation of an addition curve. So now you have to add two points, so X1, Y1, X2, Y2. So you see that again, the formula is quite elegant. So they are fully symmetric and this is not really a surprise if you look at the curve equation. So you can also double a point, so given X, Y, and Y1, so we have to compute two times this point. So again, you see that formula is quite elegant. So natural elements is the point at infinity one minus one, zero, and you can also observe that to compute the inverse of a point is quite simple, so you have just to swap the two coordinates. So we have a new form, so we can use them for cryptography and actually they have been used. So the first paper, of course, was the paper by S, that's a very old one. And then the two Cheydovsky brothers, so play with the equation and came with a more efficient way to compute on this curve. They can also be used to emulate, so you can use the addition to emulate the doubling. You can also use Asian curve in a parallel way, so it fit nicely in that setting. And also you can play with the coordinates, so not just presenting the point with the classical X, Y, and Z coordinate, but you can add more coordinates to get more efficient arithmetic. So if we look at the startup form, so the one we know today, so you see that it's quite fast, so you just need 12 multiplication to add two points. And if you have enough memory, so it means that you can use extended coordinates, so in that case, you see that you can trade some multiplication against some squares. Problem is, so the same as for the restress equation, so you cannot use as is the same formula to double a point or to add two different points. So of course, because of that, sorry, the addition law is not complete, so you cannot use the addition law to, for example, double a point, but also you cannot add two points if the difference is a point at infinity. Also it's not possible to represent all elliptic curve using this model because you have to assume that there is a point of other three on your curve. And the converse is not true, so it's not because you have a point of other three that you can use this model. So we will generalize the addition model, so we just add one parameter, so parameter C. So in the addition case, C is equal to one. So this is what we call the generalized addition curves. So because we would like to avoid, it was for you. So because you'd like to avoid division, so we look at the projective form, I have competition, so it's difficult to ask you to stay. So to listen to elliptic curve and press some nice things happening there, that's not interesting. So, what did I say? So that's some point on the curve, so at infinity, so the natural element, so we can choose one minus one zero and again you see that's to inverse a point, so it's quite easy, you just have to swap the X and Y coordinates. So, now if we have to develop the addition law, so because we have this isomorphism, sorry, this isomorphism with the regular addition model, so it's easy to get the addition law on this model. So to add two points, so we have this, so which is exactly the same as for the regular addition model and to double a point, so the only difference is that you see parameter C, so in the equation, which is equal to one of course, on the usual addition model. So of course, we can do exactly the same using projective coordinates, so as I told you before, so the problem is that you cannot use that one to double a point, so we have to find something else and actually this is quite easy, so if you have two points, P1 and P2, so there is point T, so which is point of order three, so I can define point Q1 which is equal to P1 plus T and point Q2 which is equal to P2 minus T and instead of computing P1 plus PQ, so we simply compute Q1 plus Q2 and because T minus T is equal to zero, so the result will be the same. So now, we just plug Q1 and Q2 in equation one and we have this and the good news is that this one is unified, so it means that you can use this one to double a point, so if you know swap, so the other of the two points, so instead of computing P1 plus P2, you compute P2 plus P1, so you have another set of formula and so as for the regular addition model, so you see that that one also is very efficient, so there are just one more application by some constants, so this is true over large prime field and also over binary fields, so you see that if you know compare it with the other one, so you see that it's quite competitive, so of course it cannot be faster than the regular addition one, but this one is more general because whenever you have a point of other three, you can use the last form. So far, we have unified formula, so what we really want to have is complete formula, so we are almost close to that, so if you take a look at the Twitterion, so you can write the Twitterion as the unit of three sets, so the set of point of infinity and set T1 and T2, so remember that the first equation I add, so this one, so this one I cannot use it when the two points, the difference of the two points is a point at infinity and this one, so equation two and equation three, so I cannot use that one when the difference of the two points is T1 or in T2, so if no, C is not the cube in the field, so in that case, the additional law is complete, so it means that you can use it to add points, to double points, and there are no exceptions, so whatever the two input points, you can use the very same formula, so you just add one and this is easy to see, so if you look at the definition of T1, you see that when C is not the cube, so the set of rational point in T1 is empty, remember that the formula was valid when the difference of the two points was not in T1, so it's quite easy to see, so of course, additional law is complete, so there are no exceptions, and also of course, so when C is not the cube, you can use this formula so that they are complete, but you can also work in a subgroup H, which is this one from T1, and again, the formula will be complete, so here are two examples, so the first example is when Q is, so the cardinality of the finite field is equal to one mod three, and when C is not the cube, so in that case, the addition is complete, and another example is when you work in a subgroup, which is not a multiple of three, so in that case, also addition is complete, so that was one point, so something we use also in crypto is the Montgomery ladder, so again because it is very efficient, and on top of that, it is also resistant against such an attack, so simple such an attack, which is a good way to compute this kind of multiplication, so here, even a point P, X1, and YY, so I will present it in a compact way by W, so because you see that the expression of W is symmetric, so in X and Y, W of P is equal to W of minus P, because computing the inverse just means to swap the X and Y coordinates, so if I have to double a point using the W coordinates, so here is the formula, if we use as usual a projective form, so you see again that it is quite efficient, so we just need one multiplication, three squaring, and two multiplication by some constants, so this is for the bubbling, no for adding two different points, so I have to assume that I know their difference, so I have to compute W1 plus W5, and so again, so you see that this is quite fast to evaluate, so using a projective form, so we just need six multiplication, one squaring, and one multiplication by a constant, so again, so you see that this is very competitive, so for a binary field, so we just need seven multiplication, four squaring, and one or three multiplication by a constant, so to sum up, so we presented a generalized asian form, so which is quite useful, because first whenever you have a point of other tree, you can use that form, it's possible to derive a complete addition on those curves, the arithmetic is efficient, and this is especially true when working on a field of characteristics, so thank you for your attention.