雅可比坐标中的椭圆曲线点加法

Question

我已经检查过类似的问题，但我无法解决我的问题。最相关的是Elliptic curve addition in Jacobian coordinates，但没有解决方案。

我有一个名为 Jacobian 的辅助类，它将具有三个 Jacobian 坐标 X、Y 和 X 我遵循http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-2007-bl上发布的算法

算法是：

Z1Z1 = Z12
Z2Z2 = Z22
U1 = X1*Z2Z2
U2 = X2*Z1Z1
S1 = Y1*Z2*Z2Z2
S2 = Y2*Z1*Z1Z1
H = U2-U1
I = (2*H)2
J = H*I
r = 2*(S2-S1)
V = U1*I
X3 = r2-J-2*V
Y3 = r*(V-X3)-2*S1*J
Z3 = ((Z1+Z2)2-Z1Z1-Z2Z2)*H

当我检查结果时，它不在定义的曲线上。我还用 Sage 进行了检查，但得到了不同的结果。

public Jacobian pointAddition(Jacobian jp1, Jacobian jp2){
        /*
        Reference: http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-2007-bl
        Z1Z1 = Z12
        Z2Z2 = Z22
        U1 = X1*Z2Z2
        U2 = X2*Z1Z1
        S1 = Y1*Z2*Z2Z2
        S2 = Y2*Z1*Z1Z1
        H = U2-U1
        I = (2*H)2
        J = H*I
        r = 2*(S2-S1)
        V = U1*I
        X3 = r2-J-2*V
        Y3 = r*(V-X3)-2*S1*J
        Z3 = ((Z1+Z2)2-Z1Z1-Z2Z2)*H
        */
        if(arePointsInverse(jp1, jp2)){
            return P0;
        }
        if(arePointsEqual(jp1, jp2)){
            return pointDoubling(jp1);
        }
        if(jp1.isInfinity(getGf())){
            return jp2;
        }
        if(jp2.isInfinity(getGf())){
            return jp1;
        }
        BigInteger X1 = jp1.getX();
        BigInteger Y1 = jp1.getY();
        BigInteger Z1 = jp1.getZ();

        BigInteger X2 = jp2.getX();
        BigInteger Y2 = jp2.getY();
        BigInteger Z2 = jp2.getZ();

        BigInteger X3,Y3,Z3;

        BigInteger Z1Z1 = Z1.multiply(Z1);
        //BigInteger Z1Z1 = Z1.pow(2).mod(getGf());
        BigInteger Z2Z2 = Z2.multiply(Z2);
        //BigInteger Z2Z2 = Z2.pow(2).mod(getGf());
        BigInteger U1 = X1.multiply(Z2Z2);
        BigInteger U2 = X2.multiply(Z1Z1); 
        BigInteger S1 = Y1.multiply(Z2.multiply(Z2Z2));
        BigInteger S2 = Y2.multiply(Z1.multiply(Z1Z1));
        BigInteger H = U2.subtract(U1);
        BigInteger I = (TWO.multiply(H)).pow(2);
        BigInteger J = H.multiply(I);
        BigInteger r = TWO.multiply(S2.subtract(S1));
        BigInteger V = U1.multiply(I);

        X3 = ((r.multiply(r)).subtract(J).subtract(TWO.multiply(V))).mod(getGf());
        Y3 = ((r.multiply(V.subtract(X3))).subtract(TWO.multiply(S1.multiply(J))))
                .mod(getGf());
        Z3 = ((((Z1.add(Z2)).pow(2)).subtract(Z1Z1).subtract(Z2Z2)).multiply(H))
                .mod(getGf());
        return new Jacobian(X3,Y3,Z3);
    }

Answer 1

上面的实现是正确的，Jacobian 类（在构造函数中）有一个错误，它用错误的值更新 Z 两次。