According to the EdDSA specification from the IETF:

For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/Z, y = Y/Z, x * y = T/Z

I'm unfamilar with extended homogeneous coordinates, and I'm used to seeing points as simply (x, y). Can anyone explain where the T and Z variables come from in the specification document?


I found this answer on Stack Overflow that has some great detail:

  • $\begingroup$ Did you see the articles on the page 48? $\endgroup$ – kelalaka Apr 17 '20 at 15:52
  • $\begingroup$ I did have a look through that section, and especially the "EdwardsPoint" class on page 50, but I couldn't see what the T and Z variables are. $\endgroup$ – simbro Apr 17 '20 at 15:59

Extended homogeneous coordinates are a different form of coordinates that provide particularly fast methods of point addition and point doubling formulas for twisted Edwards curves, introduced in Huseyin Hisil, Kenneth Koon-Ho Wong, Gary Carter, Ed Dawson. Twisted Edwards Curves Revisited, 2008.

$X$ and $Y$ roughly correspond to affine $x$ and $y$, $Z$ comes from regular extended (also called projective) coordinates as a scaling and $T$ is the actually “new” element that contains $X\cdot Y$. In particular, section 3 of the paper by Hisil et al. introduces the extended homogeneous coordinates and how to convert to and from extended homogeneous coordinates.

  • $\begingroup$ That's helpful - thanks xorhash! $\endgroup$ – simbro Apr 17 '20 at 16:01
  • $\begingroup$ in reading section 3 of that paper, is states that: "an auxiliary coordinate t=xy to represent a point (x,y) on a x2+y2=1+dx2y2 in extended affine coordinates (x,y,t). One can pass to the projective representation using the map (x,y,t)→(x:y:t:1)". So does that mean that Z is always 1, and T is always x * y ? $\endgroup$ – simbro May 15 '20 at 15:11
  • $\begingroup$ @simbro When going from affine to extended homogeneous, $Z$ is always $1$ and $T$ is always $x\cdot y$, yes. The inverse operation from extended homogeneous $(X:Y:Z:T)$ to affine $(x,y)$ is $x=X\cdot Z$, $y=Y\cdot Z$ and ignore $T$ entirely. $\endgroup$ – xorhash May 15 '20 at 15:32
  • $\begingroup$ Much appreciated. Like everything else, it's obvious once you get it :-) $\endgroup$ – simbro May 15 '20 at 15:43
  • $\begingroup$ @simbro Correction, but I can't edit the comment anymore: $x=X\cdot Z^{-1}$ and $y=Y\cdot Z^{-1}$, note that we take the multiplicative inverse of $Z$. $\endgroup$ – xorhash May 15 '20 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.