1、背景技术介绍

Extended twisted Edwards curve坐标系及相互转换中指出了，Every Edwards curve has a point of order 4.
论文《Decaf-Eliminating cofactors through point compression 2015-673》中对cofactor=4的曲线进行了压缩，保证了所使用的point步骤small-cofactor subgroup中。若使用small-cofactor subgroup中的point，存在的small-subgroup attack等危害参见博客ristretto对cofactor>1的椭圆曲线(如Curve25519等)的兼容（含Curve25519 cofactor的sage验证）。

以下为对cofactor=4的Edwards(或twisted Edwards curve ε \varepsilon ε)曲线进行压缩和解压缩算法梳理：
该曲线的order为 r = h q , h = 4 r=hq,h=4 r=hq,h=4，其中 q q q为素数。为了消除cofactor subgroup，实际要选择的group为 ε / ε [ 4 ] \varepsilon/\varepsilon[4] ε/ε[4]。（group群的一些基本概念可参见博客Elliptic curve isogeny and group coset）
同时，对于曲线 ε \varepsilon ε上的点，若两个点有small order(可被4整除)，则认为该两点等价。需要涉及以下三方面的调整：

判断points等价的方法需调整，差异为4 order的点应视为等价。
在发送前必须压缩point，同时保证对等价的points，压缩后的序列表示 { 0 , 1 } n \{0,1\}^n {0,1}n也应相同。压缩后的结果为一个Field域内的非负数元素（具体定义见Non-negative field elements）。
解压缩时，应保证仅对有效point的压缩结果进行解压缩。

Non-negative field elements定义：
若 x ∈ F p ，且 x ∈ [ 0 , ( p − 1 ) / 2 ] x\in F_p，且x\in [0,(p-1)/2] x∈Fp，且x∈[0,(p−1)/2]，则 x x x可称为field域内的非负数。否则，称为field域内的负数。

在论文《Decaf-Eliminating cofactors through point compression 2015-673》中提到，对于曲线表现形式选择为Montgomery curve的原因为：Montgomery curves give simple Diffie-Hellman protocols, and twisted Edwards curves give a speed boost but have incomplete formulas in fields of order 3 (mod 4).

1.1 Twisted Edwards curves表示

Twisted Edwards curves的affine坐标系表示为：
ε a , d : = { ( x , y ) ∈ P 2 ( F ) : a ∗ x 2 + y 2 = 1 + d ∗ x 2 ∗ y 2 } \varepsilon_{a,d}:=\{(x,y)\in P^2(F):a*x^2+y^2=1+d*x^2*y^2\} εa,d:={(x,y)∈P2(F):a∗x2+y2=1+d∗x2∗y2}

对应的Extended坐标系表示为：
ε a , d : = { ( X : Y : Z : T ) ∈ P 3 ( F ) : X Y = Z T a n d a ∗ X 2 + Y 2 = Z 2 + d ∗ T 2 } \varepsilon_{a,d}:=\{(X:Y:Z:T)\in P^3(F):XY=ZT\ and\ a*X^2+Y^2=Z^2+d*T^2\} εa,d:={(X:Y:Z:T)∈P3(F):XY=ZT and a∗X2+Y2=Z2+d∗T2}

Edwards curve的identity point表示为 ( 0 , 1 ) = ( 0 : 1 : 1 : 0 ) (0,1)=(0:1:1:0) (0,1)=(0:1:1:0)。

通常地，当 a = 1 a=1 a=1时，为untwisted；当 a = − 1 a=-1 a=−1时，具有更高的计算速度。

由于edwards25519满足完备性条件，所以，其4-torsion subgroup is cyclic：
ε a , d [ 4 ] = { ( 0 , 1 ) , ( 1 / a , 0 ) , ( 0 , − 1 ) , ( − 1 / a , 0 ) } \varepsilon_{a,d}[4]=\{(0,1),(1/\sqrt a,0),(0,-1), (-1/\sqrt a, 0)\} εa,d[4]={(0,1),(1/a ,0),(0,−1),(−1/a ,0)}
这些4-torsion points为edwards25519上仅有的满足 x y = 0 xy=0 xy=0的点。且其中的 y ! = 0 y!=0 y!=0点（即 ( 0 , 1 ) , ( 0 , − 1 ) (0,1),(0,-1) (0,1),(0,−1)）为2-torsion point。可定义Group H = { ( 0 , 1 ) , ( 1 / a , 0 ) , ( 0 , − 1 ) , ( − 1 / a , 0 ) } H=\{(0,1),(1/\sqrt a,0),(0,-1), (-1/\sqrt a, 0)\} H={(0,1),(1/a ,0),(0,−1),(−1/a ,0)}

若a在有限域内存在平方根， a ∗ x 2 + y 2 = 1 + d ∗ x 2 ∗ y 2 a*x^2+y^2=1+d*x^2*y^2 a∗x2+y2=1+d∗x2∗y2可变形为：
a ∗ ( y a ) 2 + ( a x ) 2 = 1 + d ∗ ( y a ) 2 ∗ ( a x ) 2 a*(\frac{y}{\sqrt a})^2+(\sqrt ax)^2=1+d*(\frac{y}{\sqrt a})^2*(\sqrt ax)^2 a∗(a y)2+(a x)2=1+d∗(a y)2∗(a x)2
ε a , d \varepsilon_{a,d} εa,d上的point点除可表示为 ( x , y ) , ( − x , − y ) (x,y),(-x,-y) (x,y),(−x,−y)外，亦可表示为 ( y / a , − a x ) , ( y / a , − a x ) (y/\sqrt a,-\sqrt ax),(y/\sqrt a,-\sqrt ax) (y/a ,−a x),(y/a ,−a x)。之所以横纵坐标分别取不同的符号，是为了保证点表示的唯一性？？？
亦即 ε a , d \varepsilon_{a,d} εa,d对应的group G = { ( x , y ) , ( − x , − y ) , ( y / a , − a x ) , ( y / a , − a x ) } G=\{(x,y),(-x,-y),(y/\sqrt a,-\sqrt ax),(y/\sqrt a,-\sqrt ax)\} G={(x,y),(−x,−y),(y/a ,−a x),(y/a ,−a x)}

所以相应的coset of H= { ( x , y ) , ( − x , − y ) , ( y / a , − a x ) , ( − y / a , a x ) } \{(x,y),(-x,-y),(y/\sqrt a,-\sqrt ax),(-y/\sqrt a,\sqrt ax)\} {(x,y),(−x,−y),(y/a ,−a x),(−y/a ,a x)}

亦即 P + ε a , d [ 4 ] = { ( x , y ) , ( − x , − y ) , ( y / a , − a x ) , ( − y / a , a x ) } P+\varepsilon_{a,d}[4]=\{(x,y),(-x,-y),(y/\sqrt a,-\sqrt ax),(-y/\sqrt a,\sqrt ax)\} P+εa,d[4]={(x,y),(−x,−y),(y/a ,−a x),(−y/a ,a x)}

1.1.1 Edwards 4-torsion subgroup验证

论文《Twisted Edwards Curves Revisited》中有：

可知，当 ( x 1 , y 1 ) (x_1,y_1) (x1,y1)为 ( 0 , 1 ) (0,1) (0,1)或 ( 0 , − 1 ) (0,-1) (0,−1)时，对应的 2 ( 0 , 1 ) = ( 0 , 1 ) = i d e n t i t y p o i n t o f e d w a r d s 2(0,1)=(0,1)=identity\ point\ of\ edwards 2(0,1)=(0,1)=identity point of edwards，和 2 ( 0 , − 1 ) = ( 0 , 1 ) = i d e n t i t y p o i n t o f e d w a r d s 2(0,-1)=(0,1)=identity\ point\ of\ edwards 2(0,−1)=(0,1)=identity point of edwards
∴ ( 0 , 1 ) ( 0 , − 1 ) 为 2 − t o r s i o n p o i n t \therefore (0,1) (0,-1)为2-torsion\ point ∴(0,1)(0,−1)为2−torsion point

而：
2 ( 1 / a , 0 ) = ( 0 , − 1 ) ⇒ 4 ( 1 / a , 0 ) = 2 ( 0 , − 1 ) = ( 0 , 1 ) = i d e n t i t y p o i n t o f e d w a r d s 2(1/\sqrt a,0)=(0,-1)\Rightarrow 4(1/\sqrt a,0)=2(0,-1)=(0,1)=identity\ point\ of\ edwards 2(1/a ,0)=(0,−1)⇒4(1/a ,0)=2(0,−1)=(0,1)=identity point of edwards
2 ( − 1 / a , 0 ) = ( 0 , − 1 ) ⇒ 4 ( − 1 / a , 0 ) = 2 ( 0 , − 1 ) = ( 0 , 1 ) = i d e n t i t y p o i n t o f e d w a r d s 2(-1/\sqrt a,0)=(0,-1)\Rightarrow 4(-1/\sqrt a,0)=2(0,-1)=(0,1)=identity\ point\ of\ edwards 2(−1/a ,0)=(0,−1)⇒4(−1/a ,0)=2(0,−1)=(0,1)=identity point of edwards
∴ ( 1 / a , 0 ) ( − 1 / a , 0 ) 为 4 − t o r s i o n p o i n t \therefore (1/\sqrt a,0) (-1/\sqrt a,0)为4-torsion\ point ∴(1/a ,0)(−1/a ,0)为4−torsion point

因此有：
( x , y ) + ( 0 , − 1 ) = ( − x , − y ) ； ( x , y ) + ( 0 , 1 ) = ( x , y ) ； ( x , y ) + ( 1 / a , 0 ) = ( y / a , − a x ) ； ( x , y ) + ( − 1 / a , 0 ) = ( − y / a , a x ) (x,y)+(0,-1)=(-x,-y)；(x,y)+(0,1)=(x,y)；(x,y)+(1/\sqrt a,0)=(y/\sqrt a,-\sqrt ax)；(x,y)+(-1/\sqrt a,0)=(-y/\sqrt a,\sqrt ax) (x,y)+(0,−1)=(−x,−y)；(x,y)+(0,1)=(x,y)；(x,y)+(1/a ,0)=(y/a ,−a x)；(x,y)+(−1/a ,0)=(−y/a ,a x)
同理对其它G中的点，做类似的计算。
∴ c o s e t o f H = { ( x , y ) , ( − x , − y ) , ( y / a , − a x ) , ( − y / a , a x ) } \therefore coset\ of\ H=\{(x,y),(-x,-y),(y/\sqrt a,-\sqrt ax),(-y/\sqrt a,\sqrt ax)\} ∴coset of H={(x,y),(−x,−y),(y/a ,−a x),(−y/a ,a x)}

1.1.2 edwards的完备性条件

An Edwards curve is called “complete” if d d d and a d ad ad are nonsquare in F, which also implies that a a a is square. A complete Edwards curve has no points at infi nity, and supports fast addition formulas which are complete in that they compute the correct answer for any two input points.
以下magma脚本可证明，ed25519是完备的Edwards curve：

clear;
q:=2^255-19;
LegendreSymbol(37095705934669439343138083508754565189542113879843219016388785533085940283555,q);// 为-1，即不是域Fq内的平方值
LegendreSymbol(-1,q); //为1，即域Fq内的平方值

1.2 Jacobi Quartic curve表示

Jacobi Quartic curve格式如下：
J e , A : t 2 = e s 4 + 2 A s 2 + 1 J_{e,A}:t^2=es^4+2As^2+1 Je,A:t2=es4+2As2+1

当 e = a 2 e=a^2 e=a2时， J e , A J_{e,A} Je,A具有full 2-torsion，即 J [ 2 ] ≅ Z / 2 × Z / 2 J[2]\cong \mathbb{Z}/2\times \mathbb{Z}/2 J[2]≅Z/2×Z/2.
论文《Division Polynomials for Jacobi Quartic Curves》中提到：
Jacobi Quartic curve的identity point表示为 ( 0 , 1 ) (0,1) (0,1)， ( 0 , − 1 ) (0,-1) (0,−1)为2-torsion point。
J e , A [ 2 ] = { ( 0 , 1 ) , ( 0 , − 1 ) } J_{e,A}[2]=\{(0,1),(0,-1)\} Je,A[2]={(0,1),(0,−1)}
可定义Group H = { ( 0 , 1 ) , ( 0 , − 1 ) } H=\{(0,1),(0,-1)\} H={(0,1),(0,−1)}。

当 e = a 2 e=a^2 e=a2时， t 2 = e s 4 + 2 A s 2 + 1 t^2=es^4+2As^2+1 t2=es4+2As2+1可变形为：
( t a s 2 ) 2 = e ( 1 a s ) 4 + 2 A ( 1 a s ) 2 + 1 (\frac{t}{as^2})^2=e(\frac{1}{as})^4+2A(\frac{1}{as})^2+1 (as2t)2=e(as1)4+2A(as1)2+1
因此， J e , A J_{e,A} Je,A上的点point除可表示为 ( s , t ) , ( − s , − t ) (s,t),(-s,-t) (s,t),(−s,−t)外，还可表示为 ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) (1/as,-t/as^2),(-1/as,t/as^2) (1/as,−t/as2),(−1/as,t/as2)。之所以横纵坐标分别取不同的符号，是为了保证点表示的唯一性？？？

亦即 J e , A J_{e,A} Je,A对应的group G = { ( s , t ) , ( − s , − t ) , ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) } G=\{(s,t),(-s,-t),(1/as,-t/as^2),(-1/as,t/as^2)\} G={(s,t),(−s,−t),(1/as,−t/as2),(−1/as,t/as2)}

所以相应的coset of H= { ( s , t ) , ( − s , − t ) , ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) } \{(s,t),(-s,-t),(1/as,-t/as^2),(-1/as,t/as^2)\} {(s,t),(−s,−t),(1/as,−t/as2),(−1/as,t/as2)}

对于任意点 P ∈ G P\in G P∈G,有：
P + J e , A [ 2 ] = { ( s , t ) , ( − s , − t ) , ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) } P+J_{e,A}[2]=\{(s,t),(-s,-t),(1/as,-t/as^2),(-1/as,t/as^2)\} P+Je,A[2]={(s,t),(−s,−t),(1/as,−t/as2),(−1/as,t/as2)}

以上可理解为： J e , A J e , A [ 2 ] = P + J e , A [ 2 ] = { ( s , t ) , ( − s , − t ) , ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) } \frac{J_{e,A}}{J_{e,A}[2]}=P+J_{e,A}[2]=\{(s,t),(-s,-t),(1/as,-t/as^2),(-1/as,t/as^2)\} Je,A[2]Je,A=P+Je,A[2]={(s,t),(−s,−t),(1/as,−t/as2),(−1/as,t/as2)}，任意的点 P ∈ G P\in G P∈G modulo J e , A [ 2 ] J_{e,A}[2] Je,A[2]，可实现一定程度的压缩。

在论文《Decaf-Eliminating cofactors through point compression 2015-673》中，任意点 P P P以 ( s , t ) (s,t) (s,t)形式表示，约定 s , t s,t s,t均为非负数，实际仅需 s s s坐标值即可代表任意点 P P P。

1.2.1 Jacobi Quartic curve 2-torsion point验证

论文《Jacobi Quartic Curves Revisited》中指出Jacobi Quartic curve point addition的公式为：

J e , A : t 2 = e s 4 + 2 A s 2 + 1 J_{e,A}:t^2=es^4+2As^2+1 Je,A:t2=es4+2As2+1相应的double公式为：
2 ( s 1 , t 1 ) = ( 2 s 1 t 1 1 − e s 1 4 , t 1 2 + e s 1 4 t 1 2 + 2 A s 1 2 + 2 e A s 1 6 + 4 e s 1 4 ( 1 − e s 1 4 ) 2 ) = ( s 3 , t 3 ) 2(s_1,t_1)=(\frac{2s_1t_1}{1-es_1^4},\frac{t_1^2+es_1^4t_1^2+2As_1^2+2eAs_1^6+4es_1^4}{(1-es_1^4)^2})=(s_3,t_3) 2(s1,t1)=(1−es142s1t1,(1−es14)2t12+es14t12+2As12+2eAs16+4es14)=(s3,t3)
J e , A : t 2 = e s 4 + 2 A s 2 + 1 J_{e,A}:t^2=es^4+2As^2+1 Je,A:t2=es4+2As2+1相应的addition公式为:
( s 1 , t 1 ) + ( s 2 + t 2 ) = ( s 1 t 2 + t 1 s 2 1 − e s 1 2 s 2 2 , ( t 1 t 2 + 2 A s 1 s 2 ) ( 1 + e s 1 2 s 2 2 ) + 2 e s 1 s 2 ( s 1 2 + s 2 2 ) ( 1 − e s 1 2 s 2 2 ) 2 ) = ( s 3 , t 3 ) (s_1,t_1)+(s_2+t_2)=(\frac{s_1t_2+t_1s_2}{1-es_1^2s_2^2},\frac{(t_1t_2+2As_1s_2)(1+es_1^2s_2^2)+2es_1s_2(s_1^2+s_2^2)}{(1-es_1^2s_2^2)^2})=(s_3,t_3) (s1,t1)+(s2+t2)=(1−es12s22s1t2+t1s2,(1−es12s22)2(t1t2+2As1s2)(1+es12s22)+2es1s2(s12+s22))=(s3,t3)

⇒ 2 ( 0 , − 1 ) = ( 0 , 1 ) = i d e n t i t y p o i n t o f J a c o b i Q u a r t i c \Rightarrow 2(0,-1)=(0,1)=identity\ point\ of\ Jacobi\ Quartic ⇒2(0,−1)=(0,1)=identity point of Jacobi Quartic
∴ ( 0 , − 1 ) 为 2 − t o r s i o n p o i n t . \therefore (0,-1)为2-torsion\ point. ∴(0,−1)为2−torsion point.

⇒ ( s , t ) + ( 0 , − 1 ) = ( − s , − t ) ； ( 1 / a s , − t / a s 2 ) + ( 0 , − 1 ) = ( − 1 / a s , t / a s 2 ) \Rightarrow (s,t)+(0,-1)=(-s,-t)；(1/as,-t/as^2)+(0,-1)=(-1/as,t/as^2) ⇒(s,t)+(0,−1)=(−s,−t)；(1/as,−t/as2)+(0,−1)=(−1/as,t/as2)
∴ c o s e t o f H = { ( s , t ) , ( − s , − t ) , ( 1 / a s , − t / a s 2 ) , ( − 1 / a s , t / a s 2 ) } \therefore coset\ of\ H=\{(s,t),(-s,-t),(1/as,-t/as^2),(-1/as,t/as^2)\} ∴coset of H={(s,t),(−s,−t),(1/as,−t/as2),(−1/as,t/as2)}

1.3 Twisted Edwards curve与Jacobi Quartic curve之间的N-isogenous关系

根据书《Elliptic Curves Number Theory And Cryptography 2n》中定义：

Twisted Edwards curves的affine坐标系表示为：
ε a , d : = { ( x , y ) ∈ P 2 ( F ) : a ∗ x 2 + y 2 = 1 + d ∗ x 2 ∗ y 2 } \varepsilon_{a,d}:=\{(x,y)\in P^2(F):a*x^2+y^2=1+d*x^2*y^2\} εa,d:={(x,y)∈P2(F):a∗x2+y2=1+d∗x2∗y2}
Jacobi Quartic curve格式如下：
J a 2 , a − 2 d : t 2 = a 2 s 4 + 2 ( a − 2 d ) s 2 + 1 J_{a^2,a-2d}:t^2=a^2s^4+2(a-2d)s^2+1 Ja2,a−2d:t2=a2s4+2(a−2d)s2+1
两者之间的映射关系为：
( x , y ) ↦ ( s , t ) : s = x y , t = 2 − y 2 − a x 2 y 2 (x,y)\mapsto (s,t):s=\frac{x}{y},t=\frac{2-y^2-ax^2}{y^2} (x,y)↦(s,t):s=yx,t=y22−y2−ax2

即 ϕ ^ ( x , y ) = ( x y , 2 − y 2 − a x 2 y 2 ) : ε a , d ↦ J a 2 , a − 2 d \hat{\phi } (x,y)=(\frac{x}{y},\frac{2-y^2-ax^2}{y^2}): \varepsilon_{a,d}\mapsto J_{a^2,a-2d} ϕ^(x,y)=(yx,y22−y2−ax2):εa,d↦Ja2,a−2d

( s , t ) ↦ ( x , y ) : x = 2 s 1 + a s 2 , y = 1 − a s 2 t (s,t) \mapsto (x,y):x=\frac{2s}{1+as^2},y=\frac{1-as^2}{t} (s,t)↦(x,y):x=1+as22s,y=t1−as2

即 ϕ ( s , t ) = ( 2 s 1 + a s 2 , 1 − a s 2 t ) : J a 2 , a − 2 d ↦ ε a , d \phi (s,t)=(\frac{2s}{1+as^2},\frac{1-as^2}{t}): J_{a^2,a-2d}\mapsto \varepsilon_{a,d} ϕ(s,t)=(1+as22s,t1−as2):Ja2,a−2d↦εa,d

∵ 2 ( s 1 , t 1 ) = ( 2 s 1 t 1 1 − e s 1 4 , t 1 2 + e s 1 4 t 1 2 + 2 A s 1 2 + 2 e A s 1 6 + 4 e s 1 4 ( 1 − e s 1 4 ) 2 ) = ( x y , 2 − y 2 − a x 2 y 2 ) , 当 x = 2 s 1 + a s 2 , y = 1 − a s 2 t \because 2(s_1,t_1)=(\frac{2s_1t_1}{1-es_1^4},\frac{t_1^2+es_1^4t_1^2+2As_1^2+2eAs_1^6+4es_1^4}{(1-es_1^4)^2})=(\frac{x}{y},\frac{2-y^2-ax^2}{y^2}),当x=\frac{2s}{1+as^2},y=\frac{1-as^2}{t} ∵2(s1,t1)=(1−es142s1t1,(1−es14)2t12+es14t12+2As12+2eAs16+4es14)=(yx,y22−y2−ax2),当x=1+as22s,y=t1−as2

∴ [ 2 ] : J a 2 , a − 2 d ↦ ε a , d \therefore [2]:J_{a^2,a-2d}\mapsto \varepsilon_{a,d} ∴[2]:Ja2,a−2d↦εa,d

∴ \therefore ∴ J a 2 , a − 2 d J_{a^2,a-2d} Ja2,a−2d为 ε a , d \varepsilon_{a,d} εa,d的2-isogenous。

根据推论：

∴ J J [ 2 ] ≅ ϕ ( J ) ϕ ( J [ 2 ] ) ≅ [ 2 ] ( ε ) ε [ 2 ] \therefore \frac{J}{J[2]}\cong \frac{\phi(J)}{\phi(J[2])}\cong \frac{[2](\varepsilon)}{\varepsilon[2]} ∴J[2]J≅ϕ(J[2])ϕ(J)≅ε[2][2](ε)

当曲线的cofactor为4时，有$ # ε ( F p ) = 4 ∗ l \#\varepsilon(F_p)=4*l #ε(Fp)=4∗l，而 [ 2 ] ( ε ) ε [ 2 ] \frac{[2](\varepsilon)}{\varepsilon[2]} ε[2][2](ε)的order即为素数 ( 4 l / 2 ) / 2 = l (4l/2)/2=l (4l/2)/2=l。因此此时即可避免cofactor=4的small-subgroup的影响。
当曲线的cofactor为8时，有$ # ε ( F p ) = 8 ∗ l \#\varepsilon(F_p)=8*l #ε(Fp)=8∗l，有 [ 2 ] ( ε [ 8 ] ) = ε [ 4 ] [2](\varepsilon[8])=\varepsilon[4] [2](ε[8])=ε[4]， ε [ 4 ] ⊆ [ 2 ] ( ε ) \varepsilon[4]\subseteq [2](\varepsilon) ε[4]⊆[2](ε)，于是有 [ 2 ] ( ε ) ε [ 4 ] \frac{[2](\varepsilon)}{\varepsilon[4]} ε[4][2](ε)的order即为 ( 8 l / 2 ) / 4 = l (8l/2)/4=l (8l/2)/4=l。

所以，当曲线的cofactor为8时，接下来是要将points从 ε ε [ 4 ] \frac{\varepsilon}{\varepsilon[4]} ε[4]ε扭转到 ε ε [ 2 ] \frac{\varepsilon}{\varepsilon[2]} ε[2]ε。

根据1.1节有：
ε a , d [ 4 ] = { ( 0 , 1 ) , ( 1 / a , 0 ) , ( 0 , − 1 ) , ( − 1 / a , 0 ) } ; \varepsilon_{a,d}[4]=\{(0,1),(1/\sqrt a,0),(0,-1), (-1/\sqrt a, 0)\}; εa,d[4]={(0,1),(1/a ,0),(0,−1),(−1/a ,0)};
其中 ( 0 , − 1 ) , ( 0 , 1 ) (0,-1),(0,1) (0,−1),(0,1)为2-torsion point， ( 1 / a , 0 ) , ( − 1 / a , 0 ) (1/\sqrt a,0),(-1/\sqrt a, 0) (1/a ,0),(−1/a ,0)为4-torsion point。

P + ε a , d [ 4 ] = { ( x , y ) , ( − x , − y ) , ( y / a , − a x ) , ( − y / a , a x ) } P+\varepsilon_{a,d}[4]=\{(x,y),(-x,-y),(y/\sqrt a,-\sqrt ax),(-y/\sqrt a,\sqrt ax)\} P+εa,d[4]={(x,y),(−x,−y),(y/a ,−a x),(−y/a ,a x)}

( x , y ) + ( 0 , − 1 ) = ( − x , − y ) ； ( x , y ) + ( 0 , 1 ) = ( x , y ) ； ( x , y ) + ( 1 / a , 0 ) = ( y / a , − a x ) ； ( x , y ) + ( − 1 / a , 0 ) = ( − y / a , a x ) (x,y)+(0,-1)=(-x,-y)；(x,y)+(0,1)=(x,y)；(x,y)+(1/\sqrt a,0)=(y/\sqrt a,-\sqrt ax)；(x,y)+(-1/\sqrt a,0)=(-y/\sqrt a,\sqrt ax) (x,y)+(0,−1)=(−x,−y)；(x,y)+(0,1)=(x,y)；(x,y)+(1/a ,0)=(y/a ,−a x)；(x,y)+(−1/a ,0)=(−y/a ,a x)
注意上面公式中：

当要求 x y > 0 xy>0 xy>0时，加法中对应的均为2-torsion point ( 0 , 1 ) , ( 0 , − 1 ) (0,1),(0,-1) (0,1),(0,−1)，所以，此时相当于求的是： P + ε a , d [ 2 ] = { ( x , y ) , ( − x , − y ) } P+\varepsilon_{a,d}[2]=\{(x,y),(-x,-y)\} P+εa,d[2]={(x,y),(−x,−y)}。
亦即由此实现由 ε ε [ 4 ] \frac{\varepsilon}{\varepsilon[4]} ε[4]ε扭转到 ε ε [ 2 ] \frac{\varepsilon}{\varepsilon[2]} ε[2]ε。
当 x y < 0 xy<0 xy<0或 y = 0 y=0 y=0时，对应的点在 { ( y / a , − a x ) , ( − y / a , a x ) } \{(y/\sqrt a,-\sqrt ax),(-y/\sqrt a,\sqrt ax)\} {(y/a ,−a x),(−y/a ,a x)}中，在此基础上再加一个点 Q 4 Q_4 Q4【当 a = 1 a=1 a=1时， Q 4 = ( 1 , 0 ) Q_4=(1,0) Q4=(1,0)；当 a = − 1 a=-1 a=−1时， Q 4 = ( i , 0 ) Q_4=(i,0) Q4=(i,0)】。当 a = 1 a=1 a=1时，有 ( y / a , − a x ) + ( 1 , 0 ) = ( − x , − y ) ; ( − y / a , a x ) + ( 1 , 0 ) = ( x , y ) (y/\sqrt a,-\sqrt ax)+(1,0)=(-x,-y);(-y/\sqrt a,\sqrt ax)+(1,0)=(x,y) (y/a ,−a x)+(1,0)=(−x,−y);(−y/a ,a x)+(1,0)=(x,y)；当 a = − 1 ， a = i a=-1，\sqrt a=i a=−1，a =i时，有 ( y / a , − a x ) + ( i , 0 ) = ( x , y ) ; ( − y / a , a x ) + ( i , 0 ) = ( − x , − y ) (y/\sqrt a,-\sqrt ax)+(i,0)=(x,y);(-y/\sqrt a,\sqrt ax)+(i,0)=(-x,-y) (y/a ,−a x)+(i,0)=(x,y);(−y/a ,a x)+(i,0)=(−x,−y)。因此，通过加上一个点 Q 4 Q_4 Q4【当 a = 1 a=1 a=1时， Q 4 = ( 1 , 0 ) Q_4=(1,0) Q4=(1,0)；当 a = − 1 a=-1 a=−1时， Q 4 = ( i , 0 ) Q_4=(i,0) Q4=(i,0)】，可实现由 ε ε [ 4 ] \frac{\varepsilon}{\varepsilon[4]} ε[4]ε扭转到 ε ε [ 2 ] \frac{\varepsilon}{\varepsilon[2]} ε[2]ε。

2、 ristretto255 point压缩算法

论文《Decaf-Eliminating cofactors through point compression 2015-673》中采用的压缩算法是直接使用由Jacobi quartic curve 映射到edwards curve（ a 1 x 2 + y 2 = 1 + d 1 x 2 y 2 , a 1 = 1 a_1x^2+y^2=1+d_1x^2y^2, a_1=1 a1x2+y2=1+d1x2y2,a1=1）的关系：
( s , t ) ↦ ( x , y ) : x = 2 s 1 + a 1 s 2 , y = 1 − a 1 s 2 t (s,t) \mapsto (x,y):x=\frac{2s}{1+a_1s^2},y=\frac{1-a_1s^2}{t} (s,t)↦(x,y):x=1+a1s22s,y=t1−a1s2
⇒ s = ( 1 ± 1 − a 1 x 2 ) / a 1 x \Rightarrow s=(1\pm \sqrt{1-a_1x^2})/a_1x ⇒s=(1±1−a1x2 )/a1x

而ristretto255 point压缩算法采用的是由Jacobi quartic curve 映射到Montgomery curve，然后再映射到ed25519（ a 2 x 2 + y 2 = 1 + d 2 x 2 y 2 , a 2 = − 1 = − a 1 , d 2 = a 1 d 1 a 1 − d 1 a_2x^2+y^2=1+d_2x^2y^2,a_2=-1=-a_1,d_2=\frac{a_1d_1}{a_1-d_1} a2x2+y2=1+d2x2y2,a2=−1=−a1,d2=a1−d1a1d1）的关系：

( s , t ) ↦ ( u , v ) : u = 1 a 1 s 2 , v = − t a 1 s 3 (s,t)\mapsto (u,v): u=\frac{1}{a_1s^2},v=\frac{-t}{a_1s^3} (s,t)↦(u,v):u=a1s21,v=a1s3−t
( u , v ) ↦ ( x , y ) : x = u v ( ± A + 2 a 2 B ) , y = u − 1 u + 1 (u,v)\mapsto (x,y): x=\frac{u}{v}(\pm \sqrt{\frac{A+2}{a_2B}}),y=\frac{u-1}{u+1} (u,v)↦(x,y):x=vu(±a2BA+2 ),y=u+1u−1
a 2 = − a 1 , a 2 = ± 1 a_2=-a_1,a_2=\pm 1 a2=−a1,a2=±1
⇒ a 2 2 = 1 , a 1 2 = 1 \Rightarrow a_2^2=1,a_1^2=1 ⇒a22=1,a12=1
A = 2 − 4 d 1 / a 1 , B = a 1 A=2-4d_1/a_1,B=a_1 A=2−4d1/a1,B=a1
d 2 = a 1 d 1 a 1 − d 1 , d 1 = a 2 d 2 a 2 − d 2 d_2=\frac{a_1d_1}{a_1-d_1},d_1=\frac{a_2d_2}{a_2-d_2} d2=a1−d1a1d1,d1=a2−d2a2d2
⇒ d 1 d 2 = a 1 a 2 d 1 d 2 ( a 1 − d 1 ) ( a 2 − d 2 ) \Rightarrow d_1d_2=\frac{a_1a_2d_1d_2}{(a_1-d_1)(a_2-d_2)} ⇒d1d2=(a1−d1)(a2−d2)a1a2d1d2
⇒ a 1 a 2 = ( a 1 − d 1 ) ( a 2 − d 2 ) \Rightarrow a_1a_2=(a_1-d_1)(a_2-d_2) ⇒a1a2=(a1−d1)(a2−d2)

⇒ y = u − 1 u + 1 = 1 + a 2 s 2 1 − a 2 s 2 \Rightarrow y=\frac{u-1}{u+1}=\frac{1+a_2s^2}{1-a_2s^2} ⇒y=u+1u−1=1−a2s21+a2s2
取非负数根：
⇒ s = 1 − a 2 1 − y 1 + y = a 2 2 − a 2 1 − y 1 + y = − a 2 1 − y 1 + y \Rightarrow s=\sqrt{\frac{1}{-a_2}\frac{1-y}{1+y}}=\sqrt{\frac{a_2^2}{-a_2}\frac{1-y}{1+y}}=\sqrt{-a_2\frac{1-y}{1+y}} ⇒s=−a211+y1−y =−a2a221+y1−y =−a21+y1−y

⇒ s 2 = ( − a 2 ) 1 − y 1 + y \Rightarrow s^2=(-a_2)\frac{1-y}{1+y} ⇒s2=(−a2)1+y1−y

根据 https://ristretto.group/details/isogenies.html 有：
x = u v ( ± A + 2 a 2 B ) = 2 s t a 1 − d 1 a 1 2 a 2 x=\frac{u}{v}(\pm \sqrt{\frac{A+2}{a_2B}})=\frac{2s}{t}\sqrt{\frac{a_1-d_1}{a_1^2a_2}} x=vu(±a2BA+2 )=t2sa12a2a1−d1
∵ a 1 a 2 = ( a 1 − d 1 ) ( a 2 − d 2 ) \because a_1a_2=(a_1-d_1)(a_2-d_2) ∵a1a2=(a1−d1)(a2−d2)
∵ a 2 2 = 1 , a 1 = − a 2 \because a_2^2=1,a_1=-a_2 ∵a22=1,a1=−a2
⇒ x = 2 s t a 1 − d 1 a 1 2 a 2 = 2 s t a 1 − d 1 a 1 ( a 1 − d 1 ) ( a 2 − d 2 ) = 2 s t 1 − a 2 ( a 2 − d 2 ) = 1 a 2 d 2 − 1 2 s t \Rightarrow x=\frac{2s}{t}\sqrt{\frac{a_1-d_1}{a_1^2a_2}}=\frac{2s}{t}\sqrt{\frac{a_1-d_1}{a_1(a_1-d_1)(a_2-d_2)}}=\frac{2s}{t}\sqrt{\frac{1}{-a_2(a_2-d_2)}}=\frac{1}{\sqrt {a_2d_2-1}}\frac{2s}{t} ⇒x=t2sa12a2a1−d1 =t2sa1(a1−d1)(a2−d2)a1−d1 =t2s−a2(a2−d2)1 =a2d2−1 1t2s

⇒ s t = x a 2 d 2 − 1 2 \Rightarrow \frac{s}{t}=x\frac{\sqrt{a_2d_2-1}}{2} ⇒ts=x2a2d2−1

所以可看出， s / t s/t s/t的符号由 x x x的符号决定。

详细的流程为：

3、 ristretto255 point解压缩算法

解压缩的过程是根据 s s s值，恢复 ( x , y ) (x,y) (x,y)：
⇒ y = u − 1 u + 1 = 1 + a 2 s 2 1 − a 2 s 2 \Rightarrow y=\frac{u-1}{u+1}=\frac{1+a_2s^2}{1-a_2s^2} ⇒y=u+1u−1=1−a2s21+a2s2
∵ s t = x a 2 d 2 − 1 2 \because \frac{s}{t}=x\frac{\sqrt{a_2d_2-1}}{2} ∵ts=x2a2d2−1
∵ a 1 = − a 2 \because a_1=-a_2 ∵a1=−a2
∵ J e , A = J a 1 2 , a 1 − 2 d 1 : t 2 = e s 4 + 2 A s 2 + 1 = a 1 2 s 4 + 2 ( a 1 − 2 d 1 ) s 2 + 1 = ( 1 − a 2 s 2 ) 2 − 4 d 1 s 2 \because J_{e,A}=J_{a_1^2,a_1-2d_1}: t^2=es^4+2As^2+1=a_1^2s^4+2(a_1-2d_1)s^2+1=(1-a_2s^2)^2-4d_1s^2 ∵Je,A=Ja12,a1−2d1:t2=es4+2As2+1=a12s4+2(a1−2d1)s2+1=(1−a2s2)2−4d1s2
⇒ x 2 = 4 s 2 t 2 ( a 2 d 2 − 1 ) = 4 s 2 ( a 2 d 2 − 1 ) ( ( 1 − a 2 s 2 ) 2 − 4 d 1 s 2 ) \Rightarrow x^2=\frac{4s^2}{t^2(a_2d_2-1)}=\frac{4s^2}{(a_2d_2-1)((1-a_2s^2)^2-4d_1s^2)} ⇒x2=t2(a2d2−1)4s2=(a2d2−1)((1−a2s2)2−4d1s2)4s2
⇒ x 2 = 4 s 2 ( a 2 d 2 − 1 ) ( ( 1 − a 2 s 2 ) 2 − 4 d 1 s 2 ) = 4 s 2 a 2 d 2 ( 1 − a 2 s 2 ) 2 − 4 a 2 d 2 d 1 s 2 + 4 d 1 s 2 − ( 1 − a 2 s 2 ) 2 \Rightarrow x^2=\frac{4s^2}{(a_2d_2-1)((1-a_2s^2)^2-4d_1s^2)}=\frac{4s^2}{a_2d_2(1-a_2s^2)^2-4a_2d_2d_1s^2+4d_1s^2-(1-a_2s^2)^2} ⇒x2=(a2d2−1)((1−a2s2)2−4d1s2)4s2=a2d2(1−a2s2)2−4a2d2d1s2+4d1s2−(1−a2s2)24s2

∵ d 1 = a 2 d 2 a 2 − d 2 , a 2 2 = 1 \because d_1=\frac{a_2d_2}{a_2-d_2},a_2^2=1 ∵d1=a2−d2a2d2,a22=1
∴ a 2 d 2 ( 1 − a 2 s 2 ) 2 − 4 a 2 d 2 d 1 s 2 + 4 d 1 s 2 = a 2 d 2 ( 1 − a 2 s 2 ) 2 − 4 a 2 d 2 d 1 s 2 + 4 a 2 2 d 1 s 2 = a 2 d 2 ( 1 − a 2 s 2 ) 2 + 4 a 2 d 1 s 2 ( a 2 − d 2 ) = a 2 d 2 ( 1 − a 2 s 2 ) 2 + 4 a 2 s 2 a 2 d 2 = a 2 d 2 ( 1 + a 2 s 2 ) 2 \therefore a_2d_2(1-a_2s^2)^2-4a_2d_2d_1s^2+4d_1s^2=a_2d_2(1-a_2s^2)^2-4a_2d_2d_1s^2+4a_2^2d_1s^2=a_2d_2(1-a_2s^2)^2+4a_2d_1s^2(a_2-d_2)=a_2d_2(1-a_2s^2)^2+4a_2s^2a_2d_2=a_2d_2(1+a_2s^2)^2 ∴a2d2(1−a2s2)2−4a2d2d1s2+4d1s2=a2d2(1−a2s2)2−4a2d2d1s2+4a22d1s2=a2d2(1−a2s2)2+4a2d1s2(a2−d2)=a2d2(1−a2s2)2+4a2s2a2d2=a2d2(1+a2s2)2

⇒ x 2 = 4 s 2 ( a 2 d 2 − 1 ) ( ( 1 − a 2 s 2 ) 2 − 4 d 1 s 2 ) = 4 s 2 a 2 d 2 ( 1 + a 2 s 2 ) 2 − ( 1 − a 2 s 2 ) 2 \Rightarrow x^2=\frac{4s^2}{(a_2d_2-1)((1-a_2s^2)^2-4d_1s^2)}=\frac{4s^2}{a_2d_2(1+a_2s^2)^2-(1-a_2s^2)^2} ⇒x2=(a2d2−1)((1−a2s2)2−4d1s2)4s2=a2d2(1+a2s2)2−(1−a2s2)24s2

取正数根有：
⇒ x = + 4 s 2 a 2 d 2 ( 1 + a 2 s 2 ) 2 − ( 1 − a 2 s 2 ) 2 \Rightarrow x=+\sqrt{\frac{4s^2}{a_2d_2(1+a_2s^2)^2-(1-a_2s^2)^2}} ⇒x=+a2d2(1+a2s2)2−(1−a2s2)24s2

整个解压缩的流程为：

4、实际压缩和解压缩过程中用到的常量值

edwards25519中 a = − 1 a=-1 a=−1，所以 i = i= i=SQRT_M1。
《The ristretto255 Group draft-hdevalence-cfrg-ristretto-01》中对一些常量值进行了计算：

* D = 37095705934669439343138083508754565189542113879843219016388785533085940283555
- This is the Edwards d parameter for Curve25519, as specified in Section 4.1 of [RFC7748].
* SQRT_M1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752
* SQRT_AD_MINUS_ONE = 25063068953384623474111414158702152701244531502492656460079210482610430750235
* INVSQRT_A_MINUS_D = 54469307008909316920995813868745141605393597292927456921205312896311721017578
* ONE_MINUS_D_SQ = 1159843021668779879193775521855586647937357759715417654439879720876111806838
* D_MINUS_ONE_SQ = 40440834346308536858101042469323190826248399146238708352240133220865137265952

相应的sage脚本验证为：

sage: p=2^255-19
sage: mod(2506306895338462347411141415870215270124453150249265646007921048261043
....: 0750235^2,p)
20800338683988658368647408995589388737092878452977063003340006470870624536393
sage: mod(-121665/121666,p) //D值
37095705934669439343138083508754565189542113879843219016388785533085940283555
sage: d=mod(-121665/121666,p)
sage: mod(sqrt(-d-1),p) //SQRT_AD_MINUS_ONE值
25063068953384623474111414158702152701244531502492656460079210482610430750235
sage: mod(-d-1,p)
32832975665273474237674078345641801225390460830327625559649581521346134069713
sage: p
57896044618658097711785492504343953926634992332820282019728792003956564819949
sage: mod(5446930700890931692099581386874514160539359729292745692120531289631172
....: 1017578*250630689533846234741114141587021527012445315024926564600792104826
....: 10430750235,p)
57896044618658097711785492504343953926634992332820282019728792003956564819948
sage: p
57896044618658097711785492504343953926634992332820282019728792003956564819949
sage: a=2241493124984347
sage: b=425987919032274
sage: c=2207028919301688
sage: d=1220490630685848
sage: e=974799131293748
sage: a+b*2^51+c*2^102+d*2^153+e*2^204
25063068953384623474111414158702152701244531502492656460079210482610430750235
sage: l=a+b*2^51+c*2^102+d*2^153+e*2^204
sage: mod(l^2,p)
20800338683988658368647408995589388737092878452977063003340006470870624536393
sage: d
1220490630685848
sage: a=929955233495203
sage: b=466365720129213
sage: c=1662059464998953
sage: d=2033849074728123
sage: e=1442794654840575
sage: D=a+b*2^51+c*2^102+d*2^153+e*2^204
....:
sage: D
37095705934669439343138083508754565189542113879843219016388785533085940283555
sage: mod(D-1,p)
37095705934669439343138083508754565189542113879843219016388785533085940283554
sage: mod(-D-1,p)
20800338683988658368647408995589388737092878452977063003340006470870624536393
sage: a=278908739862762
sage: b=821645201101625
sage: c=8113234426968
sage: d=1777959178193151
sage: e=2118520810568447
sage: m=a+b*2^51+c*2^102+d*2^153+e*2^204
....:
sage: m
54469307008909316920995813868745141605393597292927456921205312896311721017578
sage: mod(l*m,p)
57896044618658097711785492504343953926634992332820282019728792003956564819948sage: 57896044618658097711785492504343953926634992332820282019728792003956564819
....: 948-p
-1
sage: l
25063068953384623474111414158702152701244531502492656460079210482610430750235
sage: hex(l)
'376931bf2b8348ac0f3cfcc931f5d1fdaf9d8e0c1b7854bd7e97f6a0497b2e1b'
sage: m
54469307008909316920995813868745141605393597292927456921205312896311721017578
sage: hex(m)
'786c8905cfaffca216c27b91fe01d8409d2f16175a4172be99c8fdaa805d40ea'
sage: mod((1-D)^2,p)
40440834346308536858101042469323190826248399146238708352240133220865137265952
sage: D
37095705934669439343138083508754565189542113879843219016388785533085940283555
sage: mod(1-D^2,p) //ONE_MINUS_D_SQ值
1159843021668779879193775521855586647937357759715417654439879720876111806838
sage: p-l
32832975665273474237674078345641801225390460830327625559649581521346134069714
sage: (p-l)*m
1788389431527829492869725092323360218484488678733938239121849300962925603156558697721738157939675524196853104345063905463952335683787129472311662471432692
sage: mod((p-l)*m,p)
1

参考资料：
[1] 论文《Decaf-Eliminating cofactors through point compression 2015-673》
[2] 《The ristretto255 Group draft-hdevalence-cfrg-ristretto-01》
[3] https://ristretto.group/formulas/encoding.html
[4] https://ristretto.group/formulas/decoding.html
[5] Extended twisted Edwards curve坐标系及相互转换
[6] ristretto对cofactor>1的椭圆曲线(如Curve25519等)的兼容（含Curve25519 cofactor的sage验证）
[7] https://ristretto.group/details/curve_models.html

ristretto255 point压缩和解压缩算法（1）——affine坐标系下相关推荐

ristretto255 point压缩和解压缩算法（2）——extended坐标系下
接前一博客ristretto255 point压缩和解压缩算法(1)--affine坐标系下. 1.affine坐标系与extended坐标系之间的映射关系 Twisted Edwards curve ...
powershell 压缩和解压zip
项目场景: 前端项目发布到windows环境需要需要先压缩传输后再解压问题描述简单的压缩和解压zip在windows下,视窗情况下,右键就可以实现,但是如果是在命令下,windows不自带unzi ...
压缩算法：字符串（JSON）压缩和解压【JDK之Deflater压缩与Inflater解压】
Deflater 是使用了LZ77算法与哈夫曼编码的一个无损数据压缩算法. Java 提供的 Deflater 和 Inflater 类对 json 进行压缩和解压缩,下面是工具类: package ...
详解LZ77字典编码压缩和解压缩流程（典型的压缩算法）
字典编码本质上是将在字典中出现过的字符串使用一个索引值代替,以此来达到压缩目的.基于字典的压缩算法有很多,LZ77和LZ78是最原始的两个算法,后者是前者的变体,原理基本上相似.本文对LZ77字典编码 ...
java putnextentry_Java对zip格式压缩和解压缩
Java对zip格式压缩和解压缩通过使用java的相关类可以实现对文件或文件夹的压缩,以及对压缩文件的解压. 1.1 ZIP和GZIP的区别 gzip是一种文件压缩工具(或该压缩工具产生的压缩文件格 ...
使用GZipStream实现压缩和解压缩
概述之前做项目,涉及到存入到数据库或者http传输的数据量比较大,这个时候,就需要考虑在存入数据库或者发送传输之前,将数据压缩下,当从数据库中取出时,再解压还原数据.特地找了下发现有GZipStre ...
java 解压到内存,Java GZip 基于内存实现压缩和解压的方法
欢迎大家关注本博,同时欢迎大家评论交流,可以给个赞哦!!! GZip是常用的无损压缩算法实现,在Linux中较为常见,像我们在Linux安装软件时,基本都是.tar.gz格式..tar.gz格式文件需 ...
zip压缩文件处理方案(Zip4j压缩和解压)
主要特性 Create, Add, Extract, Update, Remove files from a Zip file针对ZIP压缩文件创建.添加.抽出.更新和移除文件 Read/Write ...
linux 高效压缩工具xz的压缩和解压使用
xz是什么高压缩率的工具,它使用 LZMA2 压缩算法,生成的压缩文件比传统使用的 gzip.bzip2 生成的压缩文件更小, 不过xz也有一个坏处就是压缩时间比较长,比7z压缩时间还长一些.不过压 ...

ristretto255 point压缩和解压缩算法（1）——affine坐标系下

1、背景技术介绍

1.1 Twisted Edwards curves表示

1.1.1 Edwards 4-torsion subgroup验证

1.1.2 edwards的完备性条件

1.2 Jacobi Quartic curve表示

1.2.1 Jacobi Quartic curve 2-torsion point验证

1.3 Twisted Edwards curve与Jacobi Quartic curve之间的N-isogenous关系

2、 ristretto255 point压缩算法

3、 ristretto255 point解压缩算法

4、实际压缩和解压缩过程中用到的常量值

ristretto255 point压缩和解压缩算法（1）——affine坐标系下相关推荐

最新文章

热门文章

ristretto255 point压缩和解压缩算法（1）——affine坐标系下

1、背景技术介绍

1.1 Twisted Edwards curves表示

1.1.1 Edwards 4-torsion subgroup验证

1.1.2 edwards的完备性条件

1.2 Jacobi Quartic curve表示

1.2.1 Jacobi Quartic curve 2-torsion point验证

1.3 Twisted Edwards curve与Jacobi Quartic curve之间的N-isogenous关系

2、 ristretto255 point压缩算法

3、 ristretto255 point解压缩算法

4、 实际压缩和解压缩过程中用到的常量值

ristretto255 point压缩和解压缩算法（1）——affine坐标系下相关推荐

最新文章

热门文章

4、实际压缩和解压缩过程中用到的常量值