1
$\begingroup$

According to the EdDSA specification from the IETF:

For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/Z, y = Y/Z, x * y = T/Z

I'm unfamilar with extended homogeneous coordinates, and I'm used to seeing points as simply (x, y). Can anyone explain where the T and Z variables come from in the specification document?

UPDATE:

I found this answer on Stack Overflow that has some great detail:

$\endgroup$
2
  • $\begingroup$ Did you see the articles on the page 48? $\endgroup$
    – kelalaka
    Apr 17, 2020 at 15:52
  • $\begingroup$ I did have a look through that section, and especially the "EdwardsPoint" class on page 50, but I couldn't see what the T and Z variables are. $\endgroup$
    – simbro
    Apr 17, 2020 at 15:59

1 Answer 1

0
$\begingroup$

Extended homogeneous coordinates are a different form of coordinates that provide particularly fast methods of point addition and point doubling formulas for twisted Edwards curves, introduced in Huseyin Hisil, Kenneth Koon-Ho Wong, Gary Carter, Ed Dawson. Twisted Edwards Curves Revisited, 2008.

$X$ and $Y$ roughly correspond to affine $x$ and $y$, $Z$ comes from regular extended (also called projective) coordinates as a scaling and $T$ is the actually “new” element that contains $X\cdot Y$. In particular, section 3 of the paper by Hisil et al. introduces the extended homogeneous coordinates and how to convert to and from extended homogeneous coordinates.

$\endgroup$
7
  • $\begingroup$ That's helpful - thanks xorhash! $\endgroup$
    – simbro
    Apr 17, 2020 at 16:01
  • $\begingroup$ in reading section 3 of that paper, is states that: "an auxiliary coordinate t=xy to represent a point (x,y) on a x2+y2=1+dx2y2 in extended affine coordinates (x,y,t). One can pass to the projective representation using the map (x,y,t)→(x:y:t:1)". So does that mean that Z is always 1, and T is always x * y ? $\endgroup$
    – simbro
    May 15, 2020 at 15:11
  • $\begingroup$ @simbro When going from affine to extended homogeneous, $Z$ is always $1$ and $T$ is always $x\cdot y$, yes. The inverse operation from extended homogeneous $(X:Y:Z:T)$ to affine $(x,y)$ is $x=X\cdot Z$, $y=Y\cdot Z$ and ignore $T$ entirely. $\endgroup$
    – xorhash
    May 15, 2020 at 15:32
  • $\begingroup$ Much appreciated. Like everything else, it's obvious once you get it :-) $\endgroup$
    – simbro
    May 15, 2020 at 15:43
  • $\begingroup$ @simbro Correction, but I can't edit the comment anymore: $x=X\cdot Z^{-1}$ and $y=Y\cdot Z^{-1}$, note that we take the multiplicative inverse of $Z$. $\endgroup$
    – xorhash
    May 15, 2020 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.