# Decoding

Decoding to a point works as follows where and are the curve parameters as described here.

1. Decode s_bytes to a field element . We interpret these bytes as unsigned little-endian bytes. We check if the length has 32 bytes, where the top 3 bits of the last byte are 0. The 32 bytes are verified to be canonical, and rejected if not (if the input is already a field element in the circuit case, skip this step).

2. Check that is nonnegative, or reject (sign check 1).

3. .

4. .

5. (was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2), rejecting if was_square is false.

6. if is negative (sign check 2)1.

7. .

The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.

1

Note this differs from the Decaf paper in Appendix A.2, but implementations of decaf377 should follow the convention described here.