[curves] Isogeny patterns among Edwards curves

[Robert Ransom]

On 1/30/14, Mike Hamburg <mike at shiftleft.org> wrote:

> This issue of decompression to Edwards remains, and this is not cheap: it
> costs 2 square roots instead of 1, or at least a square root and a Legendre
> symbol check (even when p==1 mod 4: the criterion is that d has to be
> nonsquare).  I'm looking for a way to fix this now, but I'm not sure there
> is one.

Do you mean one square root in the quadratic extension field?

(I see (sqrt(d)*x + Y)^2 = 1 + a*(x*Y)^2 + 2*sqrt(d)*x*Y (where Y=1/y)
as a way to recover x and Y.)


Robert Ransom