 All right, well, thanks, for the introduction. And I will be speaking about twisted mu4 normal forms, which is a twisted version of a model that I introduced a few years ago. So first, the motivation is elliptic curves over binary fields. So the standards for elliptic curve cryptography for use in Diffie-Hellman or Al-Gamal typically require an ordinary curve over a finite field. And if the characteristic is 2, then the degree of the extension over f2 should be odd. Such an ordinary binary elliptic curve can be written in the following form, y squared plus xy plus ax squared equal to xq plus b. And its J invariant is just the inverse of b, so it doesn't depend on a. The parameter a is just the quadratic twist or it parameterizes the quadratic twist. And for the sake of the standards, binary odd degree extensions, we can assume that a is either 0 or 1. These are the two possible twists. And here you see the two curves. So for these two models become isomorphic over a quadratic extension, where we adjoin a third root of unity, omega such that omega squared plus omega plus 1 equals 0. So this parameter a, either 0 or 1, gives a simple characterization of the pair of twists over a binary odd degree field. And in particular, a equals 0 if and only if the elliptic curve has a point of order 4. So recall that an ordinary binary elliptic curve has even order. So we always have the closest we can get to having prime order is twice a prime. And if a is equal to 0, we have the cardinality equal to 0 mod 4. And if it's a is equal to 1, then we have 2 mod 4. So specifically, a equals 0 gives this point c, c squared 1 on the elliptic curve, where c to the fourth is equal to b. So I can write that down explicitly. So it's been noted that for Hessian, Edwards, or the mu4 normal form that I introduced a few years ago, the existence of a point of small order results in symmetries which can be exploited to yield efficient arithmetic defense against side channel attacks. Unfortunately, the 20th century standards focus on the nearly prime order and minimize that cofactor, so ignoring the benefits of a cofactor greater than 2. So for backward compatibility with NIS, sec, et cetera, curves cannot be put in Hessian, Edwards, or mu4 normal form, which have these cofactors of cofactors h, which are 3, 4, or 4, in the case of Hessian, Edwards, or mu4 normal form, respectively. OK, so Edwards can't be fixed up. So the not backward compatible with these 20th century standards and, worse still, over any prime field, there's a geometric obstruction. You can't just pass to a twist. It's quadratic twist is also odd order. So twisted Edwards curves don't bridge the gap. On the other hand, in view of the dichotomy, a equals 0, a equals 1 that I talked about just a moment ago, if the cardinality is congruent to 2 modulo 4, that is twice a prime, for instance, in the cryptographic setting, then its twist will have a foretortion point. And hence, it can be put in the mu4 normal forms, which are the fastest known arithmetic. And so this motivates studying the twists since the E itself can be described as a twist of a mu4 normal form. So the objective of this work here today is to introduce these twists of the mu4 normal form in order to compute the most efficient arithmetic combined with backward compatibility to standard binary curves. So let me just, before introducing the mu4 and their twists, let me recall the previous state of the art. So previous models, which covered the cases of a equal 1, so remember that's congruent to 2 mod4, include the Lopitzdab, a equals 1 model, and more recently, lambda coordinates became invogue. And we compare the known complexities. Here, just to keep in mind, capital S refers to squareings in the field. And we can consider it equivalent to, well, asymptotically negligible if we use optimal normal bases so that squaring is just a change of variables, cyclic rotation or similar. So for Lopitzdab, the advantages are that they have the best known doubling. So this is a model which uses weighted projective space. We get 2m plus 4s plus 2 multiplications. The small m refers to multiplications by constant, depending on the curve coefficients. On the other hand, this weighted projective model is not very suitable to addition, and the addition is slow. But if you use a windowing method, you can give a bias towards the doubling, and it's more interesting to optimize the doubling operation. Lambda coordinates are a bit slower in doubling, but they improve by 2 multiplications the addition operation. And the mu4 normal form that I introduced, so this is for a equals 1. So this requires a foretortion point. It's not backward compatible. It achieves essentially the same doubling complexity. One more squaring, but again, if that's negligible because of normal bases, the dominant term is the 2m. And the best known addition. So this was almost twice as fast as previously known. So we'd like to get the same order of magnitude for these operations for the twisted variants so that they can actually cover the standards, which lambda coordinates and Lopez de Habdu. OK, so just in tabular form, here we have the previous state of the art and the twisted version that I will introduce shortly. So the lambda coordinates, you see the weak point is the doubling operation, 3 multiplications, a bit better addition, and going down. And what our objective is to cover this last line, you see that we'll have to add two more multiplications, but it still beats any previous methods available, which cover the standards. OK, so just as a remark, you might think that in the bias if we give a waiting for doubling, the 3m might kill lambda coordinates, but it got a lot of interest in recent years and hardware implementations and such, in part because the standard curves have large constants. So the field constants are actually important. And so all of these operations, I believe, in the table, if we equate the capital m and the small m, the small m being a multiplication by a curve constant, then they all have complexity 4m. So it's not too bad, and it was already an improvement to have 11 multiplications. But here we show that we can get it down to 9. So I'll explain how to do that. OK, first, let's just look at the origins of these, at least retrospectively, of these mu4 normal form. So an elliptic curve in twisted normal, Edward's normal form, this is the extended version of Hissell, can be expressed by the intersection of these two quadrics up to some relaying of the coordinates, you can choose to label x, y, z, and t, if you like. And the mu4 normal form, which I introduced, looks like this. So I'm describing it in any characteristics, so I have a plus and minus signs here. But in particular, for c and d equal to minus 1 and minding 16r, that is a twist by minus 1 of the Edward's model. We achieve an isomorphism between these two models. So when 2 is invertible, it has to be invertible because of that coefficient 4 in front of x3, we can recognize the mu4 normal form as just a minus 1 twist of Edward's. It's isomorphic to it. And only the latter model, the mu4 normal form, remains valid over a binary field. So in other words, it has good reduction at 2, whereas Edward's or twisted Edward's aren't valid in characteristic 2. OK, now let me just describe a split version of this because there are a lot of symmetries that make it easier to describe the arithmetic. So if this parameter r, remember, oops, there, the parameter r here, if it's actually 1 over, if it's a fourth power, so it's reciprocal fourth root we call c, this can always be done for binary fields. We can rescale the model and then come up, put it in this form, which looks much more symmetric, in fact, permutation of the coordinates preserves the model. And in fact, that permutation of the coordinates is, in fact, a translation by t, by this point t, which is a four torsion point. And there's another symmetry which is exchange of variables x1 and x3, which is minus 1. So this is what I call the split version of the mu4 normal form. And it has a few more symmetries which makes it easier to describe some of the addition laws. OK, now to describe the twisted version, so twists of an elliptic curve in characteristic 2, or any family of elliptic curves where we want to respect a good reduction at 2, should be defined with respect to essentially an art and Schreyer extension. So an extension of the form x squared minus x equal to a. And the discriminant of that extension is d equal to 1 plus 4 a. And the quadratwist with respect to that extension is precisely the curve here. So with respect to the mu4 normal form that I had earlier, you just delete all of the red bits. d becomes 1, and the a is 0. And in characteristic 2, in fact, d is 1. So this gives the binary twisted mu4 normal form, which looks very much like the mu4 normal form, except for this plus a times x1 plus x3 squared. There's a simple change of variables over that quadratic extension, which brings it back to the other form. So now let me recall the structure of addition. In the previously introduced mu4 normal form, we have these very elegant addition laws. And there are actually four of them, which provide a basis of all possible addition laws, which can be described by quadratic polynomials. So an addition law is just some set of polynomials that we can substitute into, and this gives addition of two points. Now in this work, I generalize this for this twisted family, and it looks almost the same. Here are two of the addition laws, and you just have to add in an additional quadratic polynomial here, which is relatively simple. And you see that the cofactor of this v13 will have already been computed in the process of computing the addition law, and we just need to do two additional multiplications. So let me see. Yeah, here, this is this summary. In IndoCrypt, I introduced the complexity analysis and found 7m plus 2s plus 2 constant multiplications for the complexity of addition of generic points. In order to evaluate either this f or the g in one of those two addition laws, we just need to compute v13 and then multiply it by one of these other two forms. And this gives two additional multiplications, which gets us up to nine multiplications in the underlying field in order to evaluate the mu-4-normal form, OK? Looking at doubling, if a is 0, that corresponds to the previous case, we get the first expression for the doubling formula. And if a is equal to 1, in fact, we changed the position. So it's essentially the same polynomials that we have to compute, but the order is exchanged. So the complexity of doubling remains exactly the same for twisted and non-twisted versions, at least in the setting where we take in this dichotomy between a equals 0 and a equals 1, OK? So, summering again, the same table we had earlier, this gives us the desired complexity. We lose two multiplications for the twisted version, but it covers the standard's better addition than previously known and just as good a multiplications. So also, to understand the lambda coordinates, it should really be viewed as a singular version of this quartic twisted mu-4-normal form in P3, but it's projected by throwing away one of the coordinates to P2 and by carrying around four variables in P3 instead of just the three. In fact, it may seem counterintuitive, but you get faster arithmetic. You've thrown away important information that you should have been carrying along with it and that explains where you're losing the interesting complexity. OK, so just as a conclusion, the faster complexity of mu-4-normal form should be used when you can. If you have the option of choosing your own binary curve and its parameters, choose one with small parameters and a four torsion point, you get the 7M plus 2S complexity. If you want to have backward compatibility to NIST and other standards, then express it in terms of this twisted version. You have a slightly slower performance, two multiplications for addition, but it will cover your standards. And well, thanks for your attention.