Decoding to a point works as follows:

  1. Decode s_bytes to a field element , rejecting if the encoding is non-canonical. (If the input is already a field element in the circuit case, skip this step).

  2. Check that is nonnegative, or reject (sign check 1).

  3. .

  4. .

  5. (was_square, v) = sqrt_ratio_zeta(1, u_2 * u_1^2), rejecting if was_square is false.

  6. if is negative (sign check 2).

  7. .

The resulting coordinates are the affine Edwards coordinates of an internal representative of the group element.

  • simplify formulas using numerator instead of 1