Once again, this is just another of my notes aggregated from various sources. This is a very dumbed down version for just my understanding and it’s my advice to follow the resources attached as they are more thorough and detailed explained by experts on the topic. I’m just a novice who is interested in learning cryptography.
Walking side by side with death
The devil mocks their every step
The snow drives back the foot that’s slow
The dogs of doom are howling more
Now, for the song. This time we’ll listen No Quarter by Led Zeppelin. No description for this. I guess they don’t need one :)
Discrete Logarithm Problem
Discrete logarithm Problem (DLP) for a group $G$ and an element $g∈G$ is,
Given an element $h$ in the subgroup generated by $g$, find an integer $m$ satisfying $h=g_{m}$.
This can be computed using $m=g_{g}(h)$. DLP for some groups is said to be very easy and for some difficult which allowed cryptographers to experiment with it and invent some amazing primitives in cryptography.
DLP is easy for:
 $mZZ $ under addition
 $R_{⋆}$ or $C_{∗}$ under multiplication
And for some groups, it is difficult but not computably infeasible:
 $F_{p}$ under multiplication: said to be subexponential
Elliptic Curves
This is a curve defined in plane $R_{2}$.
${(x,y)∈Kˉ ∣ y_{2}+a_{1}xy+a_{3}y=x_{3}+a_{2}x_{2}+a_{4}x+a_{6},}∪{0} $ Above equation is called the general Weierstrass equation. $0$ is the point at infinity.
 $Kˉ$ is the algebraic closure of field $K$.
 Can be defined on any fields, such as $F_{p},Q,R$.
 EC defined on $F_{p}$ are finite groups.
 ECDLP is discrete logarithm problem for the EC defined on finite field which has exponential time complexity to solve.
 Best known algorithm for an EC defined over $F_{p}$ takes $O(p )$.
We make simplification of the general equation with the case when field characteristic is not 2 or 3. Define curve $E/K$ read as curve $E$ over field $K$. This gives rise to short Weierstrass equation form of the EC.
$E:y_{2}=x_{3}+ax+b $Coordinate System
Affine Coordinates
Traditional representation of the coordinates, i.e. just an $(x,y)$ where $x$ and $y$ satisfy curve equation. Normally this representation is used for storing and transmitting points.
Standard Projective Coordinates
Point in standard projective coordinates $(X,Y,Z)$ represents $(ZX ,ZY )$ in Affine coordinate system. Also called homogeneous projective coordinates as the curve equation takes on the homogeneous form $Y_{2}Z=X_{3}+4Z_{3}$.
Points become straight line through the origin in $(X,Y,Z)$ space, with the affine point being the intersection of the line with the plane $Z=1$. Equivalence relation from plane to projective space can be defined as:
$∼:(a:b:c)∼(a_{′}:b_{′}:c_{′})⟺∃λ(a,b,c)=(λa_{′},λb_{′},λc_{′})$Jacobian Coordinates
Jacobian Point $(X,Y,Z)$ → $Z_{2}X ,Z_{3}Y $. Curve equation becomes $Y_{2}=X_{3}+4Z_{6}$.
Group Law of Elliptic Curves
 Elements of the group are points on elliptic curve.
 identity element is the point at infinity $O$
 inverse of point $P$ is symmetric about $x$axis
 addition rule: given three aligned, nonzero points $P,Q,R$ on EC, $P+Q+R=0$
Elliptic Curves in $F_{p}$
${(x,y)∈(F_{p})_{2} ∣ y_{2}≡x_{3}+ax+b(modp),4a_{3}+27b_{2}≡0(modp)}∪{0} $Every EC has an order $N$ which represents the number of points on the curve. This can be explained using group theory. Let’s say we have a group, and the order of group denotes the number of points on the group. Now, if we take a point on the curve, then it tends to repeat itself in a cycle after some points. An amazing animated tutorial for elliptic curve in $F_{p}$ can be found here.
For Example: Let’s take a curve $y_{2}≡x_{3}+2x+3(modp)$ and the point $P=(3,6)$. The multiples of P are just 5 distinct point on the curve $(0,P,2P,3P,4P)$ and they are just repeating themselves.
This makes set of the multiples of $P$ a cyclic subgroup of the group formed by the elliptic curve. The point $P$ is called the generator or base point of the cyclic subgroup. Finding order of the subgroup is done by finding smallest $n$ such that $nP=0$.
Normally, curves are defined for large prime fields, where short equation covers all possible isomorphism classes of elliptic curves. ^{1}
There are other ways to express an elliptic curve:
 Montgomery equation $By_{2}=x_{3}+Ax_{2}+x$, where $B(A_{2}−4)=0$ in $F_{p}$. substituting $x=Bu−A/3$ and $y=bv$ gives short weierstrass equation.
 Edwards equation $x_{2}+y_{2}=1+dx_{2}y_{2}$, substituting $u=1−y1+y $ and $v=(1−y)x1+y $ produces montgomery equation.
What is the difference between these curve equations? And how does one is beneficial over other?
Concisely answered here and here. Expanding on this, montgomery ladder is faster than standard Weierstrass point multiplication methods as montgomery ladder is constanttime. There is very concise explanation about Curve25519 by Martin Klepmann.
Montgomery curve
$M_{A,B}:By_{2} =x_{3}+Ax_{2}+x,B(A_{2})−4=0 $Why montgomery form is better for multiplication?
Edwards curve
TODO
Twisted Edwards curve
$E(F):{ax_{2}+y_{2}=1+dx_{2}y_{2}} $There is a 1:1 correspondence between TEd curves and Mont curves. In a more cryptographic glossary, every Twisted Edwards curve is birationally equivalent to Montgomery curve^{2}. To convert a curve from Twisted Edwards form to montgomery form:
$a−d4 y_{2}=x_{3}+a−d2(a+d) x_{2}+x$We can also convert a montgomery curve to Twisted Edwards curves using following equation:
$BA+2 x_{2}+y_{2}=1+BA−2 x_{2}y_{2}$Resources
 ethereumbook’s elliptic curve section
 An Introduction to Elliptic Curves
 Exploring Elliptic Curve Pairings
 BLS12381 for the rest of us
 Pairings over BLS12381
 EC domain parameters
 choosing safe curves for ellipticcurve cryptography
 The animated elliptic curves
 Elliptic Curve Cryptography: a gentle introduction
 An introduction to elliptic curves
Footnotes

Pairings For Beginners Page 14 ↩

Birationally equivalent just means that a map exists between two objects and is invertible. ↩