Twisted Edwards Curves

Twisted Edwards curves are parameterized by a,da, d and are of the form

Ea,d:ax2+y2=1+dx2y2.\mathcal E_{a,d}​:ax^2+y^2=1+dx^2y^2.

These are usually represented by the Extended Twisted Edwards Coordinates of Hisil, Wong, Carter, and Dawson: points are represented in projective coordinates as (X:Y:Z:T)(X : Y : Z : T) with

XY=ZT,  aX2+Y2=Z2+dT2.XY=ZT,\ \ aX^2+Y^2=Z^2+dT^2.

(More details on Edwards curve models can be found in the curve25519_dalek curve_models documentation). The case a=1a = 1 is the untwisted case; the case a=1a = -1 provides the fastest formulas. When not otherwise specified, we E\mathcal E for Ea,d\mathcal E_{a,d} ​.

When both dd and adad are nonsquare (which forces aa to be square), the curve is complete. In this case the four-torsion subgroup is cyclic, and we can write it explicitly as

Ea,d[4]={(0,1),(1/a,0),(0,1),(1/a,0)}\mathcal E_{a,d}​[4] = \{(0,1), (1/\sqrt a, 0), (0, -1), (-1/\sqrt a, 0)\}

These are the only points with xy=0xy = 0 ; the points with y0y \neq 0 are 2-torsion.