Decoding

Decoding to a point works as follows:

1. Decode s_bytes to a field element $s$, rejecting if the encoding is non-canonical. (If the input is already a field element in the circuit case, skip this step).

2. Check that $s$ is nonnegative, or reject (sign check 1).

3. $u_1\leftarrow 1-s^2$.

4. $u_2\leftarrow u_1^2-4d{s}^2$.

5. (was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2), rejecting if was_square is false.

6. $v\leftarrow -v$ if $2s{u}_{1}v$ is negative (sign check 2).

7. $(x,y)\leftarrow (2s{v}^2{u}_1{u}_2,(1+s^2)v{u}_2)$.

The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.

• simplify formulas using numerator instead of 1