On 1/30/14, Mike Hamburg <[email protected]> wrote: > This issue of decompression to Edwards remains, and this is not cheap: it > costs 2 square roots instead of 1, or at least a square root and a Legendre > symbol check (even when p==1 mod 4: the criterion is that d has to be > nonsquare). I'm looking for a way to fix this now, but I'm not sure there > is one.
Do you mean one square root in the quadratic extension field? (I see (sqrt(d)*x + Y)^2 = 1 + a*(x*Y)^2 + 2*sqrt(d)*x*Y (where Y=1/y) as a way to recover x and Y.) Robert Ransom _______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
