An elliptic curve over a finite field has coefficients and points whose arithmetic is restricted to that field. Over an extension field, point coordinates become polynomials reduced modulo an irreducible polynomial; the extension curve retains the base curve’s coefficients as polynomial constants. These curves supply the G1 and G2 points needed by elliptic-curve pairings. section 13.0 section 13.5
If a base curve has cardinality #E = h·r with large prime r, an extension degree k satisfies p^k ≡ 1 mod r. The extension-curve cardinality is #E_k = p^k + 1 − t_k, where t values follow t_(n+2) = t_1t_(n+1) − pt_n. These values support cofactor calculations and pairing-oriented curve selection. section 13.5
Point operations preserve the familiar elliptic-curve workflow while replacing field-number routines with polynomial routines:
- Add points with the ordinary addition formulas, performing every coordinate and slope operation on polynomials modulo the irreducible polynomial; explicitly handle infinity inputs and a zero slope denominator. section 13.2.5
- Multiply a point with unchanged double-and-add control flow, invoking polynomial point addition for doubling and conditional addition. section 13.2.6
- Determine a point’s order by multiplying it by candidate factors until the point at infinity is reached. section 16.3
Tiny extension curve
A curve with polynomial-constant coefficients a4 = 23 and a6 = 42 over a field based on 43 has extension cardinality 1815. Enumerated points include polynomial coordinates such as x = 0, y = 4x + 2, illustrating that an extension field exposes nonconstant-coordinate points alongside base-field points. section 13.3.3
Equation 13.4
\[\begin{gathered} \lambda=\frac{x_1^2+x_1 x_2 + x_2^2 + a_4}{y_1 + y_2}\\ x_3=\lambda^2-x_1-x_2\\ y_3=\lambda(x_1-x_3)-y_1 \label{eqplyad} \end{gathered}\]The addition equation maps directly to polynomial arithmetic: compute λ, then derive x3 and y3, reducing polynomial results in the extension field. section 13.2.5
