# Decoding

Decoding to a point works as follows:

1. Decode s_bytes to a field element , rejecting if the encoding is non-canonical. (If the input is already a field element in the circuit case, skip this step).

2. Check that is nonnegative, or reject (sign check 1).

3. .

4. .

5. (was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2), rejecting if was_square is false.

6. if is negative (sign check 2).

7. .

The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.

• simplify formulas using numerator instead of 1