1

This question covers how to convert a projective point $(X_E, Y_E, Z_E)$ on a twisted Edwards curve to a projective point $(X_M, Y_M, Z_M)$ on a Montgomery Curve. Using XZ coordinates, there is no inversion needed as $X_M, Z_M$ can be directly obtained.

Is it also possible to convert inversion-free the other way around? Using the birational affine map $$(u,v)_M \mapsto (x,y)_E = \left( \frac{u}{v}, \frac{u-1}{u+1}\right)_E$$ and the same idea from 1, you either get $$y_E = \frac{Y_E}{Z_E} = \frac{X_M - Z_M}{X_M + Z_M} \quad\to\quad \begin{array}{l} Y_E = X_M - Z_M \newline Z_E = X_M + Z_M\end{array}$$ or $$x_E = \frac{X_E}{Z_E} = \frac{X_M}{Y_M} \quad\to\quad \begin{array}{l} X_E = X_M \newline Z_E = Y_M\end{array}.$$ Is there a way to recover the respective missing coordinate, i.e., $X_E$ or $Y_E$, inversion-free?

It would also suffice to directly transform the XZ Montgomery point to affine twisted Edwards form $(x_M, y_M)$ using one inversion.

rndm_me
  • 76
  • 5

1 Answers1

1

I figured it out. You can clear the denominators by multiplying with $Z_M$ and get: $$\begin{align*} (X_M, Y_M, Z_M) &\mapsto (X_E, Y_E, Z_E)\\ &= \big(X_M \cdot (X_M + Z_M),\: Y_M \cdot (X_M - Z_M),\: Y_M \cdot (X_M + Z_M) \big) \end{align*}$$

rndm_me
  • 76
  • 5