Comment by throwaway81523
2 days ago
It's very hard to get stuff right with the secp curves. That's one of the reasons for the move to curve25519 and similar. The book "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes, and Vanstone is mostly very careful step by step instruction of how to do secp* arithmetic properly. It would still be useful to have some formal verification to help the assurance of of any particular implementation.
25519 just brings in a different set of problems though, see for example https://hdevalence.ca/blog/2020-10-04-its-25519am, and @mmsc's post above which barely scratches the surface.
There are complete formulae for all prime-order Weierstrass curves. The work for secure implementation of prime-order curves is now simpler than for Edwards elliptic curves.