Summary
The GLV decomposition in scalar_impl.h uses constants a1, b1, a2, b2 that form the reduced lattice basis. These constants have a beautiful number-theoretic interpretation that is currently undocumented: they are exactly the Eisenstein integer factors of the group order n.
Background
The code already notes:
0Let l = -1/2 + i*sqrt(3)/2, the complex root of X^2 + X + 1.
What isn’t mentioned is that Z[l] is classically known as the Eisenstein integers Z[ω], studied by Gotthold Eisenstein in 1844. This ring has unique factorization, and primes p ≡ 1 (mod 3) split as p = π·π̄ = a² + ab + b².
The Connection
The secp256k1 group order n factors in Z[ω] as:
0n = N(π) = π · π̄ where π = a - bω
Using the standard Eisenstein norm N(x + yω) = x² - xy + y², we have:
0N(a - bω) = a² - a(-b) + (-b)² = a² + ab + b² = n
where:
0a = 303414439467246543595250775667605759171 (128 bits)
1b = 64502973549206556628585045361533709077 (126 bits)
The GLV basis constants are exactly these Eisenstein factors:
| Constant | Value | Eisenstein factor |
|---|---|---|
| a1 | 0x3086d221a7d46bcde86c90e49284eb15 |
b |
| -b1 | 0xe4437ed6010e88286f547fa90abfe4c3 |
a |
| a2 | 0x114ca50f7a8e2f3f657c1108d9d44cfd8 |
a + b |
| b2 | 0x3086d221a7d46bcde86c90e49284eb15 |
b |
Verification (SageMath)
0n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
1a = 303414439467246543595250775667605759171
2b = 64502973549206556628585045361533709077
3
4# Verify norm formula
5assert a^2 + a*b + b^2 == n # ✓
6
7# Verify in Eisenstein ring
8K.<w> = NumberField(x^2 + x + 1)
9pi = a - b*w # Note: π = a - bω
10assert pi.norm() == n # ✓
11
12# GLV constants from libsecp256k1
13a1 = 0x3086d221a7d46bcde86c90e49284eb15
14b1_neg = 0xe4437ed6010e88286f547fa90abfe4c3
15
16assert a1 == b # ✓
17assert b1_neg == a # ✓
Why This Matters
- Independent verification: The constants can be verified through Eisenstein factorization, not just derived from Frobenius trace
- Educational value: Connects modern ECC optimization to classical algebraic number theory (1844)
- Mathematical elegance: The GLV lattice is literally the kernel of the ring homomorphism
Z[ω] → Z_n
Suggested Documentation Addition
Add to the existing comment in scalar_impl.h:
0/*
1 * Note: Z[l] is classically known as the ring of Eisenstein integers Z[ω],
2 * studied by Gotthold Eisenstein (1844). The group order n factors in this
3 * ring as n = N(π) where π = a - b*l is an Eisenstein prime with norm
4 * N(a - b*l) = a² + ab + b². The lattice basis vectors {a1 + b1*l, a2 + b2*l}
5 * correspond exactly to these factors: a1 = b, -b1 = a, a2 = a + b, b2 = b.
6 *
7 * This provides an independent verification path for the constants through
8 * classical algebraic number theory.
9 */
References
- Eisenstein, G. (1844). “Beweis der allgemeinsten Reciprocitätsgesetze”
- Gallant, R., Lambert, R., Vanstone, S. (2001). “Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms”
- Cox, D. “Primes of the Form x² + ny²” — Chapter on Eisenstein integers
This observation connects two mathematical traditions that developed independently: 19th-century algebraic number theory and 21st-century elliptic curve cryptography.
