Twisted Edwards Curves

Twisted Edwards curves are parameterized by $a, d$ and are of the form

$$\mathcal E_{a,d}​:ax^2+y^2=1+dx^2y^2.$$

These are usually represented by the Extended Twisted Edwards Coordinates of Hisil, Wong, Carter, and Dawson: points are represented in projective coordinates as $(X : Y : Z : T)$ with

$$XY=ZT,\ \ aX^2+Y^2=Z^2+dT^2.$$

(More details on Edwards curve models can be found in the curve25519_dalek curve_models documentation). The case $a = 1$ is the untwisted case; the case $a = -1$ provides the fastest formulas. When not otherwise specified, we $\mathcal E$ for $\mathcal E_{a,d}$ ​.

When both $d$ and $ad$ are nonsquare (which forces $a$ to be square), the curve is complete. In this case the four-torsion subgroup is cyclic, and we can write it explicitly as

$$\mathcal E_{a,d}​[4] = \{(0,1), (1/\sqrt a, 0), (0, -1), (-1/\sqrt a, 0)\}$$

These are the only points with $xy = 0$ ; the points with $y \neq 0$ are 2-torsion.