Consider the curve on $\mathbb R^2$ with equation $y^2=x^3+b$, for some fixed real $b>0$. It forms an elliptic curve group $(E,+)$ under point addition. There exists an isomorphism to that group from the group formed by the interval $[0,1)$ under addition$\pmod 1$. And we can reduce to a single such isomorhism $f$, among two, by adding the condition that $f(1/4)$ has a positive $y$ coordinate.
Is there a name for that rather canonical isomorphism $f$, or a variant, e.g. from $[0,2\pi)$ rather than $[0,1)\,$? What's an efficient way to compute $f$, or $f^{-1}$?
That's illustrated below for $b=2^{-12}$, with the images by $f$ of $\{0.1,0.2,\ldots,0.9\}\subset[0,1)$ shown. $f(0)$ is the point at infinity, that is the neutral for point addition.
Examples of the isomorphism $f$ a work:
- we geometrically add the point $P=f(0.3)$ and the point $Q=f(0.8)$, by drawing the line $(P,Q)$, noticing that it intersects the curve at point $R=f(0.9)$, which symmetric is point $R'=f(0.1)$, therefore $P+Q=R'$ and indeed $0.3+0.8\equiv0.1\pmod 1$.
- we geometrically double the point $P=f(0.9)$ by drawing the tangent to the curve at $P$, noticing that it intersects the curve at point $R=f(0.2)$, which symmetric is point $R'=f(0.8)$, therefore $P+P=R'$ and indeed $0.9+0.9\equiv0.8\pmod 1$.
Note: I have determined $f(1/10)=(0.3529269345486749\ldots, 0.2102470200494472\ldots)$ by numerically solving the equation corresponding to $10\times f(1/10)=f(0)$ with the scalar multiplication made using point doubling and addition, and keeping the solution with the largest $x$ and $y$. The other points follow.
Update: I found no generic name, but devised a mildly workable way to evaluate $f$
- precompute the first $k$ terms of the $u_i$ defined by $$\begin{align}u_1&=-1\\ v_i&=\sqrt{{u_i}^2-u_i+1}+u_i\\ u_{i+1}&=\sqrt{(2\,v_i-1)\,(u_i+1)}+v_i\end{align}$$ which first terms $u_1$ are -1, 0.732051…, 3.60592…, 14.4667…, 57.8693…, 231.477…, 925.910…, 3703.64…, 14814.6…, 59258.2…
- It holds that the $x$ coordinate of $f(2^{-i})$ is $u_i\,b^{1/3}$, and the (non-negative) $y$ coordinate follows from the curve's equation.
- This allows evaluating $f(t)$ for any $t$ with $2^k\,t$ an integer.