# How to derive the curve Ed25519 from Curve25519?

According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the Edwards curve (Ed25519) $$x^{2}+y^{2}=1+(121665/121666)\cdot x^{2}y^{2}.$$The paper says that the transformation is easy and can be done with$$v=\sqrt{486662}\cdot u/x$$ $$u=(1+y)/(1-y).$$ However, when I try to do this transformation I do not obtain the Edwards curve, but I get $$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ with $d=486662$.

So I wonder how, starting from Curve25519, I can get to $e=121665/121666$ and $$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}?$$ Thanks!

The detailed transformation: • maybe this helps (somehow): $(d-2)/ 4=121665$ and $(d+2)/4=121666$, meaning $(d-2)/(d+2)=121665/121666$. – SEJPM Jul 16 '15 at 19:15
• things would work out perfectly if "your" $dy^2$ could be replaced by $(d+2)y^2$ and "your" standalone $d$ by $d+2$... Did you verify your transformations are correct? – SEJPM Jul 16 '15 at 19:18
• @SEJPM: Thanks for your hints! I checked the transform twice, so I think it is correct. Maybe one has to divide by $d$ and then maybe the birational equivalence allows to replace $x^2$ by $x^2d/(d+2)$? The factor 4 is then just a simplification. – Chris Jul 16 '15 at 19:33
• @SEJPM Seems you´ve got an acceptable answer right there around the corner… ;) – e-sushi Jul 16 '15 at 19:40
• I think I've just got it. According to this presentation you're allowed to linearly transform the coordinates (and some other things) if you want to keep birational equivalence. So the change you proposed seems to be allowed. – SEJPM Jul 16 '15 at 21:00

To understand on how to get from $$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ to $$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$ one first needs to observe that $e=(d-2)/(d+2)=121665/121666$ holds.
So the substitution $x^2:=x^2\cdot d/(d+2)$ is allowed. If you now perform the substitution, you'll observe $$dx^{2}+dy^{2}=d+d(d-2)/(d+2)x^{2}y^{2}$$ and dividing by $d$ yields the desired equation.