Twisted Edwards curves are parameterized by $a, d$ and are of the form

$\mathcal E_{a,d}:ax^2+y^2=1+dx^2y^2.$

These are usually represented by the Extended Twisted Edwards Coordinates of Hisil, Wong, Carter, and Dawson: points are represented in projective coordinates as $(X : Y : Z : T)$ with

$XY=ZT,\ \ aX^2+Y^2=Z^2+dT^2.$

(More details on Edwards curve models can be found in the `curve25519_dalek`

`curve_models`

documentation). The case $a = 1$ is the *untwisted* case; the case $a = -1$ provides the fastest formulas. When not otherwise specified, we $\mathcal E$ for $\mathcal E_{a,d}$ .

When both $d$ and $ad$ are nonsquare (which forces $a$ to be square), the curve is *complete*. In this case the four-torsion subgroup is cyclic, and we can write it explicitly as

$\mathcal E_{a,d}[4] = \{(0,1), (1/\sqrt a, 0), (0, -1), (-1/\sqrt a, 0)\}$

These are the only points with $xy = 0$ ; the points with $y \neq 0$ are 2-torsion.