1
$\begingroup$

According to this page, Edward's curve point doubling can be represented in a different way by assuming $c=1$ and $d = r^2$.

It then says we can represent $x y$ as $Y Z$ satisfying $r\cdot y = \frac Y Z$

I am a bit confused. How would I then calculate the $x$ coordinate? For example, they have provided the following explicit formula:

YY = Y12
ZZ = r*Z12
V = s*(ZZ-YY)2
W = (ZZ+YY)2
Y3 = W-V
Z3 = W+V

So after obtaining $Y_3$ and $Z_3$, how would I revert back to affine coordinates and calculate $x$ and $y$?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

When $c=1$ and $d = r^2$, an Edwards curve $x^2+y^2=c^2(1+dx^2y^2)$ becomes $$x^2+y^2=1+r^2x^2y^2 \iff x^2(1-r^2 y^2) = 1 - y^2$$ With the $(Y,Z)$ notation, a point $P = (x,y)$ is represented as a pair $(Y:Z)$ satisfying $ry = Y/Z$. Note that this representation does not allow to distinguish $P = (x,y)$ from $-P = (-x,y)$.

Given a pair $(Y:Z)$, one can recover $\pm P = (\pm x, y)$ where $y = Y/(rZ)$ and $\pm x$ is the square root of $(1-y^2)/(1-r^2y^2)$.

Improve this answer
$\endgroup$
3
  • $\begingroup$ I don't think this is the simplest way. For Montgomery or Brier-Joye ladders there is a way to compute the $y$ coordinate given the addition formula and some equations that holds (which for ladders is the fact that the difference of the two internal points is the base point). I imagine the same could apply here to avoid the heavy square root. $\endgroup$
    – Ruggero
    Commented Mar 21, 2018 at 13:12
  • $\begingroup$ @Ruggero: This is another setting. Define $(x_k,y_k) = [k]P$. Using Montgomery-like ladders, you'll get $(Y_k:Z_k)$ and $(Y_{k+1}:Z_{k+1})$. It is then possible to recover $(x_k,y_k)$ without computing a square root but this requires the knowledge of $P=(x,y)$. $\endgroup$
    – user94293
    Commented Mar 22, 2018 at 2:53
  • $\begingroup$ Are you saying that ponzi34 lacked the original $x$ coordinate ? I would doubt that. $\endgroup$
    – Ruggero
    Commented Mar 22, 2018 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.