"Batched affine" short-Weierstrass elliptic-curve additions In https://safecurves.cr.yp.to/rho.html Bernstein talks about fastest possible rho method that uses &quot;batched affine&quot; additions and requires only 5 multiplications mod p, 1 squaring mod p and some small &quot;extra&quot; work that is negligible. Affine means conventional (X,Y) coordinates, no projective coordinates. How is it possible to do group operations on elliptic curve with so little computation and without doing inverse? What exactly he means by &quot;batched affine&quot;?
The affine addition formula for short Weierstrass curves is usually given by
$$
\begin{align}
\lambda &amp;= \frac{y_2 - y_1}{x_2 - x_1} \\
x_3 &amp;= \lambda^2 - x_1 - x_2 \\
y_3 &amp;= \lambda(x_1 - x_3) - y_1 \\
\end{align}.
$$
This gives us 1 inversion, 2 multiplications, 1 squaring, and a few field additions.
The trick here, when adding many points in parallel, is to use the so-called Montgomery trick (thus called because it was popularized in Montgomery's 1987 paper), which trades $n$ inversions by $3n$ multiplications and a single field inversion.
Here follows a simple description of the algorithm from Modern Computer Arithmetic:

So in reality you are still performing an inverse, but it is amortized among many simultaneous additions; for large enough numbers its cost becomes negligible.