Decoding to a point works as follows where and are the curve parameters as described here.

  1. Decode s_bytes to a field element . We interpret these bytes as unsigned little-endian bytes. We check if the length has 32 bytes, where the top 3 bits of the last byte are 0. The 32 bytes are verified to be canonical, and rejected if not (if the input is already a field element in the circuit case, skip this step).

  2. Check that is nonnegative, or reject (sign check 1).

  3. .

  4. .

  5. (was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2), rejecting if was_square is false.

  6. if is negative (sign check 2)1.

  7. .

The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.


Note this differs from the Decaf paper in Appendix A.2, but implementations of decaf377 should follow the convention described here.