Elliptic curve points should be converted to octet strings as described in this section. Informally, if point
compression is being used, the idea is that the compressed y-coordinate is placed in the leftmost octet
of the octet string along with an indication that point compression is on, and the x-coordinate is placed
in the remainder of the octet string; otherwise if point compression is off, the leftmost octet indicates
that point compression is off, and remainder of the octet string contains the x-coordinate followed by the
y-coordinate. Formally the conversion routine is specified as follows:

Input: A point P on an elliptic curve over Fq defined by the field elements a;b.
Output: An octet string M of length mlen octets where mlen = 1 if P = O, mlen = d(log2 q)=8e+1 if
P 6= O and point compression is used, and mlen = 2d(log2 q)=8e+1 if P 6= O and point compression is
not used.
Actions: Convert P to an octet string M = M0M1 : : :Mmlenô€€€1 as follows:
1. If P = O, output M = 0016.
2. If P = (xP;yP) 6= O and point compression is being used, proceed as follows:
2.1. Convert the field element xP to an octet string X of length d(log2 q)=8e octets using the conversion
routine specified in Section 2.3.5.
2.2. Derive from yP a single bit ˜ yP as follows (this allows the y-coordinate to be represented
compactly using a single bit):
2.2.1. If q = p is an odd prime, set ˜ yP = yP (mod 2).
2.2.2. If q = 2m, set ËœyP = 0 if xP = 0, otherwise compute z = zmô€€€1xmô€€€1 +


+z1x+z0 such
that z = yP:xP
􀀀1 and set ˜ yP = z0.
2.3. If ˜ yP = 0, assign the value 0216 to the single octet Y. If ˜yP = 1, assign the value 0316 to the
single octet Y.
2.4. Output M =Y kX.
3. If P = (xP;yP) 6= O and point compression is not being used, proceed as follows:
3.1. Convert the field element xP to an octet string X of length d(log2 q)=8e octets using the conversion
routine specified in Section 2.3.5.
3.2. Convert the field element yP to an octet string Y of length d(log2 q)=8e octets using the conversion
routine specified in Section 2.3.5.
3.3. Output M = 0416 kX kY.

Tags: Cryptography, EllipticCurvePoint