# Elliptic curve representation

According to this page, Edward's curve point doubling can be represented in a different way by assuming $c=1$ and $d = r^2$.

It then says we can represent $x y$ as $Y Z$ satisfying $r\cdot y = \frac Y Z$

I am a bit confused. How would I then calculate the $x$ coordinate? For example, they have provided the following explicit formula:

YY = Y12
ZZ = r*Z12
V = s*(ZZ-YY)2
W = (ZZ+YY)2
Y3 = W-V
Z3 = W+V


So after obtaining $Y_3$ and $Z_3$, how would I revert back to affine coordinates and calculate $x$ and $y$?

## 1 Answer

When $c=1$ and $d = r^2$, an Edwards curve $x^2+y^2=c^2(1+dx^2y^2)$ becomes $$x^2+y^2=1+r^2x^2y^2 \iff x^2(1-r^2 y^2) = 1 - y^2$$ With the $(Y,Z)$ notation, a point $P = (x,y)$ is represented as a pair $(Y:Z)$ satisfying $ry = Y/Z$. Note that this representation does not allow to distinguish $P = (x,y)$ from $-P = (-x,y)$.

Given a pair $(Y:Z)$, one can recover $\pm P = (\pm x, y)$ where $y = Y/(rZ)$ and $\pm x$ is the square root of $(1-y^2)/(1-r^2y^2)$.

• I don't think this is the simplest way. For Montgomery or Brier-Joye ladders there is a way to compute the $y$ coordinate given the addition formula and some equations that holds (which for ladders is the fact that the difference of the two internal points is the base point). I imagine the same could apply here to avoid the heavy square root. – Ruggero Mar 21 '18 at 13:12
• @Ruggero: This is another setting. Define $(x_k,y_k) = [k]P$. Using Montgomery-like ladders, you'll get $(Y_k:Z_k)$ and $(Y_{k+1}:Z_{k+1})$. It is then possible to recover $(x_k,y_k)$ without computing a square root but this requires the knowledge of $P=(x,y)$. – user94293 Mar 22 '18 at 2:53
• Are you saying that ponzi34 lacked the original $x$ coordinate ? I would doubt that. – Ruggero Mar 22 '18 at 8:09