# How to modify a positive scalar in scalar multiplication in order to get the additive inverse on twisted Edwards curves?

I know this is something possible because of Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used? implies it.

So let’s say I’ve a positive scalar S1 and 2 points A and B on a Twisted Edward curve defined on a prime field such as $$S1×A=B$$, how to modify the scalar in order to turn $$B$$ into $$−B$$ ?
I’m meaning the coordinates of $$B$$ into $$(−x,y)$$ using the same $$A$$.

• hint $P + [-1]P = (0,1)$, then consider the order of $P$ Commented Jul 11 at 11:30
• @kelalaka Of course, I was talking about when $B$ isn t the point at infinity. Commented Jul 11 at 11:36
• What is the order of $A$, this is the key. Commented Jul 11 at 12:35

Let $$A$$ and $$B$$ be in the same subgroup with order $$n$$, Remember, Edward curves are not prime curves, and let

• $$[S_1]A = B$$

then we can turn $$B$$ into $$-B$$ using

$$[-S_1]A = -B$$

notice that $$[-S_1]A + [S_1]A = B - B$$. So if one wants a little proof

\begin{align} \mathcal{O} &= \mathcal{O} & & \mathcal{O} \text{ is the identity (0,1) }\\ A - A &= B - B\\ [S_1]A + [-S_1]A &= B - B\\ \end{align}

so, just negate the scalar of $$A$$, and we are done!

• I forgot to add that the scalar must be >0 and the curve is defined on a prime field. Does it work is $S_1$ is equald to $A$’s order ÷2 ? Commented Jul 11 at 15:02
• I think you are confusing the field where the curve equation is defined and the order of the curve on that field. When the order of the curve is a prime number we call it a prime curve. This work in all cases. Commented Jul 11 at 15:39
• What I’m meaning is in addition to the prime curve, $S_1$>0 and <$A$’s order. If $S_1$ is above $A$’s order divided by 2, is it equivalent to having $S_1$ being a negative integer ? Commented Jul 11 at 15:49
• @user2284570: remember that we always have $[S_1]A = [S_1 + kn]A$ where $n$ is the order of $A$ and $k$ is any integer (e.g. $-1$). Hence, for any $S_1$, there's an equivalent scalar that is negative. Commented Jul 11 at 17:34
• @poncho yes, but I want to be sure if such scalar is below the order of $A$ or if there’s an other way to achieve this. Commented Jul 11 at 18:44