[Cryptography] Edwards curves are just ellipses - and why ECC works

[Bill Cox]

On Fri, Oct 2, 2015 at 6:00 PM, Bill Cox <waywardgeek at gmail.com> wrote:

> Here's another Python file showing how Edwards curves and the Edwards
> addition law is the same as the old ellipse and it's addition law.  This
> one does the full modulo arithmetic.
>
> Bil
>

Just to clarify how these programs show the equivalence, compare th "x"
values on each line to the "sn" values.  They are the same.  The "x" values
are computed using the Edwards addition law, while the "sn" values are
computed using the ancient ellipse addition law.

In describing the mapping to the ellipse, I forgot a minor point:  The
Edwards X coordinate is equal to the sn value from the ellipse.  To get the
(x, y) point on the  ellipse, the "cn" value is the X coordinate, but you
have to divide the "sn" value by the "b" coefficient from the ellipse
equation, which is:

    x^2 + y^2/b^2 = 1

It looks like there never was a good consensus for whether this form should
be the "official" unit ellipse, or whether we should use this alternate
form:

    x^2/a^2 + y^2 = 1

The choice makes some minor differences in the resulting unit ellipse
equations.  In particular, the excellent paper above describing elliptic
functions as trigonometry use this second form, while Wikipedia and Wolfram
both use the first.  My code is based on the first, to be more easily
verified using Wikipedia.

If you compare my code carefully to Wikipedia, you'll see one difference.
Wikipedia defines the r "radius" as 1/sqrt(x^2 + y^2).  It's wrong.  To get
the code to work, you have to use the sensible, correct equation for the
radius, which is sqrt(x^2 + y^2).  Their statement that dn = 1/r is also
inverted.

Bill
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20151003/c92a989b/attachment.html>