Algorithm A2: Montgomery ladder using projective Lopez–Dahab coordinates.

Input: k = (kl−1 … k1 k0)2 with kl−1 = 1, P = (x,y) is a point of EC over GF(2l)

Output: kP = (x1, y1)

initialization

1: X1 ← x, X2 ← x4 + b, Z2 ← x2

processing the second most significant bit

2: ifkl−2 = 1 then

3:  T ← Z2, Z1 ← (X1Z2 + X2)2,

X1 ← X1Z2X2 + xZ1,

4:  T ← X2, U ← b Z24, X2 ← X24+ U,

U ← TZ2, Z2 ← U 2.

5: else

6:  T ← Z2, Z2 ← (X1Z2 + X2)2,

X2 ← X1X2T + xZ2,

7:  T ← X1, U ← bX24, X1 ← X14 + b,

U ← TX2, Z1 ← T2.

8: end if

main loop

9: forifroml − 3downto0do

10:  ifki = 1then

11:   T ← Z1, Z1 ← (X1Z2 + X2Z1)2, X1 ← xZ1 + X1X2TZ2,

12:   T ← X2, X2 ← X24 + bZ24, Z2 ← T2 Z22.

13:  else

14:   T ← Z2, Z2 ← (X2Z1 + X1Z2)2, X2 ← xZ2 + X1X2TZ1,

15:   T ← X1, X1 ← X14 + b Z14, Z1 ← T2 Z12.

16:  end if

17: end for

end of the main loop

calculating affine coordinates of the kP result

18: x1 ← 1/(xZ1Z2)

19: y1 ← y + (x + x1)[(X1 + xZ1)(X2 + xZ2) + (x2 + y)(Z1Z2)] ∙ x1

20: x1 ← X1x1xZ2//i.e., x1 = X1/Z1

21: return (x1, y1)