1

Assume elliptic curve in Weierstrass form.

$y^2 = x^3 + a x + b$ where $x,y,a,b \in F$

I noticed the point addition formula does not involve parameters $a,b$. Furthermore, one can always solve for $a,b$ given two distinct points.

Thus one can "add" 3 or more distinct points, as long as their coordinates are on $F$, without having them on the same curve. More formally, let $O$ be point of infinity, the set $F \times F \cup O$ is almost closed under point addition operation for short Weierstrass curve. (Almost closed since one has to "add" distinct points)

I did a quick check that associative law for groups no longer holds. What would be some interesting properties for the above setup?

Kh40tiK
  • 121
  • 3
  • For $b$ yes, for $a$ no ($a$ needed for doubling). Could you support your claims? given two points to find $a$ and $b$ is here – kelalaka Mar 21 '22 at 14:41
  • What if in $P+Q+R$, $Q+R = P$? now you turned to double. You may say, I can calculate $P+Q$ then add $R$. In this case, we can say, who is going to check these?. Instead, we prefer complete formulas if possible. – kelalaka Mar 21 '22 at 14:51
  • You are mixin points of the curve and points of its quadratic twist. twist attack is based on this. – kelalaka Mar 21 '22 at 15:25
  • 1
    Lack of associativity is a show-stopper in many cryptographic applications. Thus the question is about a solution looking for problem (and I don't know one).@kelalaka: performing point doubling the way you suggest requires associativity, which as pointed in the question does not hold. – fgrieu Mar 21 '22 at 15:55

0 Answers0