Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z)

Question

The Wikipedia page for Montgomery curves shows how to convert points on a twisted Edwards curve to and from points on an equivalent Montgomery curve. However, their description and the original twisted Edwards curve paper use affine coordinates for the conversion.

Is it possible to convert directly from projective twisted Edwards coordinates (X,Y,Z) to projective Montgomery coordinates (X,Z) and back without expensive inversions in the underlying field $\mathbb{F}_p$? Does anybody know explicit formulas for this or a method on how to produce the projective equivalent of the description found on Wikipedia?

The ultimate goal is to convert to Montgomery points with as little cost as possible, do the scalar multiplication using cheap Montgomery arithmetic and at the end convert the point back to twisted Edwards coordinates.

Answer 1

The conversion formula from twisted Edwards to Montgomery form is:

$$x_{mont} = \frac{X_{mont}}{Z_{mont}}= \frac{1+y_{ed}}{1-y_{ed}} = \frac{1+\frac{Y_{ed}}{Z_{ed}}}{1-\frac{Y_{ed}}{Z_{ed}}} = \frac{Z_{ed}+Y_{ed}}{Z_{ed}-Y_{ed}}$$

If you want the affine $x_{mont}$, you need to compute the inversion. But if you just need $X_{mont}$ and $Z_{mont}$ you can skip the inversion, since the nominator is X and the denominator Z.

$$X_{mont} = Z_{ed}+Y_{ed}$$ $$Z_{mont} = Z_{ed}-Y_{ed}$$

Some additional notes:

1. If you use $Z \neq 1$ as input for the Montgomery ladder, this will increase the cost of this scalar multiplication by more than the cost of an initial inversion (about 10% of the ladder cost).
2. If you really need to minimize the cost of inversions, you might want to use batch inversions, which can compute the inverse of multiple values, available at the same time, with a cost only slightly higher than a single inversion.
3. At the end of a scalar multiplication you need to compute an inversion, no matter which form you use, since you want an affine output. In that case you can convert between forms for free, since you can merge the inversions into a single one.
4. When using the cheap X,Z Montgomery ladder and convert back to twisted Edwards, you get $Y$ and $Z$. You can recover $|X|$ from that using the curve equation (essentially a point decompression, cost similar to a field inversion), but you don't know the sign of $X$.
5. Variable base-point twisted Edwards isn't much more expensive than Montgomery if you can afford the memory for the lookup table.