International Association
for Cryptologic Research

Since Edwards curves were introduced in elliptic curve cryptography, they have attracted a lot of attention. The twisted Edwards curves are defined by the equation $E_{a,d}: ax^2 + y^2 = 1 + d x^2y^2$. Twisted Edwards curve is the state-of-the-art for $a=-1$, and even for $a \ne -1$. E448 and Edwards448 are NIST standard curve in 2023 and TLS 1.3 standard curve in 2018. They both can be converted to $d=-1$, but can not be converted to $a=-1$ through isomorphism. The motivation of using a curve with $d=-1$ is that we want to improve the efficiency of E448, and Edwards448, especially to achieve a great saving in terms of the number of field multiplications ($\bfm M$) and field squarings ($\bfm S$). We propose new explicit formulas for point operations on these curves. Our full point addition only requires $8 \bfm M$, and mixed addition requires $7 \bfm M$. Our results applied on the Edward448 and E448 yield a clean and simple implementation and achieve a brand new speed record. The scalar multiplication on Edwards448 and E448 have the same cost of $\bfm M$ and $\bfm S$ as that on Edwards25519 per bit.