I would like to transpose the Ed25519 ref10 implementation to a similar twisted Edwards curve that is based on another prime, in order to have the same speed optimizations in place for the new curve. Most of the code is not too hard to understand.

However, I don't understand what is going on in the function 'fe_mul', where there are several multiplications by constant factors like 19 and 38.

Can somebody please give me a hint where these constants are coming from? Many thanks!

  • $\begingroup$ The order of the field is $p=2^{255}-19$. Sometimes it's convenient to reduce modulo $2p = 2^{256}-38$ $\endgroup$ Jul 13, 2015 at 12:46

1 Answer 1


The section 'Radix-$2^{64}$ representation' on page 11 of the Ed25519 paper ("High-speed high-security signatures" by Bernstein et al.) actually explains the technique. I should have read the paper more carefully.

As pointed out by CodesInChaos, the order of the field is $p=2^{255}-19$ and the 38 corresponds to $2p=2^{256}-38$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.