Decoding
Decoding to a point works as follows:
-
Decode
s_bytes
to a field element , rejecting if the encoding is non-canonical. (If the input is already a field element in the circuit case, skip this step). -
Check that is nonnegative, or reject (sign check 1).
-
.
-
.
-
(was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2)
, rejecting ifwas_square
is false. -
if is negative (sign check 2).
-
.
The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.
- simplify formulas using numerator instead of 1