3
$\begingroup$

I'm reading on Jubjub, which is planned for the next upgrade of Zcash. It is based on a Twisted Edwards curve with parameters $a = -1$ and $d = −(10240/10241)$. The reading says Jubjub does not need projective coordinates because inversion is cheap.

My question is, is the "cheap inversion" property that of Twisted Edwards curves in general, or the parameter selection of Jubjub in particular?

| improve this question | |
$\endgroup$
1
$\begingroup$

In the particular case of jubjub, it will be used in a Rank-1 Constraint System(R1CS) where inversion is cheap, costing one multiplication.

Jubjub is an embedded curve and the main purpose of developing it, is due that you can use it in a constraint system. Outside of its applications in R1CS, inversion is not cheap.

Since inversion is cheap, we can use the affine formula directly.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks @user679128. Does that mean "inversion is cheap" for Jubjub in particular? Or is it the case for all Twisted Edward curves with a = -1? Or is it dependent on a and d? Or maybe just d? Or maybe something else? $\endgroup$ – user10496 Jun 7 '19 at 12:24
  • 1
    $\begingroup$ What is R1CS ?? $\endgroup$ – Ruggero Jun 7 '19 at 12:35
  • $\begingroup$ @jww if you were building a public key encryption scheme, then it would not be “cheap” and you would want to use projective coordinates. The fact that inversion is cheap in r1cs is not due to jubjub $\endgroup$ – user69644 Jun 7 '19 at 12:39
  • $\begingroup$ @Ruggero I should have expanded: rank-1 constraint system. Modified answer $\endgroup$ – user69644 Jun 7 '19 at 12:41
  • 1
    $\begingroup$ Good point. Afaik inversion is cheap in all proof systems that use r1cs including bulletproofs for arbitrary circuits $\endgroup$ – user69644 Jun 7 '19 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy