1
$\begingroup$

According to this page, Edward's curve point doubling can be represented in a different way by assuming $c=1$ and $d = r^2$.

It then says we can represent $x y$ as $Y Z$ satisfying $r\cdot y = \frac Y Z$

I am a bit confused. How would I then calculate the $x$ coordinate? For example, they have provided the following explicit formula:

YY = Y12
ZZ = r*Z12
V = s*(ZZ-YY)2
W = (ZZ+YY)2
Y3 = W-V
Z3 = W+V

So after obtaining $Y_3$ and $Z_3$, how would I revert back to affine coordinates and calculate $x$ and $y$?

$\endgroup$
1
$\begingroup$

When $c=1$ and $d = r^2$, an Edwards curve $x^2+y^2=c^2(1+dx^2y^2)$ becomes $$x^2+y^2=1+r^2x^2y^2 \iff x^2(1-r^2 y^2) = 1 - y^2$$ With the $(Y,Z)$ notation, a point $P = (x,y)$ is represented as a pair $(Y:Z)$ satisfying $ry = Y/Z$. Note that this representation does not allow to distinguish $P = (x,y)$ from $-P = (-x,y)$.

Given a pair $(Y:Z)$, one can recover $\pm P = (\pm x, y)$ where $y = Y/(rZ)$ and $\pm x$ is the square root of $(1-y^2)/(1-r^2y^2)$.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I don't think this is the simplest way. For Montgomery or Brier-Joye ladders there is a way to compute the $y$ coordinate given the addition formula and some equations that holds (which for ladders is the fact that the difference of the two internal points is the base point). I imagine the same could apply here to avoid the heavy square root. $\endgroup$ – Ruggero Mar 21 '18 at 13:12
  • $\begingroup$ @Ruggero: This is another setting. Define $(x_k,y_k) = [k]P$. Using Montgomery-like ladders, you'll get $(Y_k:Z_k)$ and $(Y_{k+1}:Z_{k+1})$. It is then possible to recover $(x_k,y_k)$ without computing a square root but this requires the knowledge of $P=(x,y)$. $\endgroup$ – user94293 Mar 22 '18 at 2:53
  • $\begingroup$ Are you saying that ponzi34 lacked the original $x$ coordinate ? I would doubt that. $\endgroup$ – Ruggero Mar 22 '18 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.