This function takes as parameters Jacobian coordinates (p1:p2:p3) and (q1:q2:q3) of points on the elliptic curve secp256r1 and returns Jacobian coordinates representing their sum. Additionally, if a point is (0,0,0), then the other point is returned (see Finding ref↗).

Inputs

(p1, p2, p3)

(q1, q2, q3)

Validation: No checks in this function.

Impact: For each of (p1,p2,p3) and (q1,q2,q3), the caller should ensure that these are either valid Jacobian coordinates for a point on the secp256r1 curve or (0,0,0).

Correctness:

\begin{itemize}
\ItemCheckboxChecked \texttt{pd} agrees with the constant \texttt{pp} defined in the library.
\ItemCheckboxChecked Assuming \texttt{(p1,p2,p3)=(0,0,0)}, the function returns \texttt{(q1,q2,q3)}.
\ItemCheckboxChecked Assuming \texttt{(q1,q2,q3)=(0,0,0)}, the function returns \texttt{(p1,p2,p3)}.
\ItemCheckboxUnchecked Assuming \texttt{(p1:p2:p3)} and \texttt{(q1:q2:q3)} are valid Jacobian coordinates for points on the secp256r1 curve, \texttt{(r1:r2:r3) = (p1:p2:p3) + (q1:q2:q3)}.
\begin{itemize}
\ItemCheckboxUnchecked 1. This holds when \texttt{(p1:p2:p3)=(q1:q2:q3)} (i.e., they represent the same point on the curve).
\ItemCheckboxChecked 2. This holds when \texttt{(p1:p2:p3)=-(q1:q2:q3)} (i.e., they represent additively inverse points on the curve).
\ItemCheckboxChecked 3. This holds when neither conditions above are the case.
\end{itemize}
\ItemCheckboxChecked The return values satisfy \texttt{0 <= r1, r2, r3 < pd}, as long as the corresponding property holds for the arguments (for this check we refer also to section \ref{ModularSubtractionTrick}).
\end{itemize}

Detailed steps taken to check correctness of the result: Assuming (p1:p2:p3) and (q1:q2:q3) are valid Jacobian coordinates for points on the secp256r1 curve, we compare each of the steps of the computation done in the function with the reference book, case $P_{1}=±P_{2}$ (though we do not assume this here). Equality is here to be taken modulo pd. Here we take (p1,p2,p3) and (q1,q2,q3) to correspond to $(x_{1},y_{1},z_{1})$ and $(x_{2},y_{2},z_{2})$ in the book.

Case 1: Points are equal. In this case, the result is not correct. We will have u1=u2 and s1=s2, which implies that all variables defined afterwards are zero. See Finding ref↗.

Case 2: Points are additive inverses. For easier notation, we use notation from Washington's book. If the points are each other's additive inverse, then there must be a nonzero $c$ (mod $p$) so that $(x_{2},y_{2},z_{2})=(c_{2}x_{1},−c_{3}y_{1},cz_{1})$. Then it follows that $r=c_{2}c_{1}z_{1}=s$ and $t=c_{3}y_{1}z_{1}=−u$, and hence $(x_{3}:y_{3}:z_{3})=(4u_{2}:−8u_{3}:0)=((−2u)_{2}⋅1:(−2u)_{3}⋅1:(−2u)⋅0)=(1:1:0)$

Case 3: Points are different and not additive inverses. Then we obtain the point $(r1:r2:r3)=(4x_{3}:8y_{3}:2z_{3})=(2_{2}x_{3}:2_{3}y_{3}:2z_{3})=(x_{3}:y_{3}:z_{3})$ which is the correct result according to the book.