Re: [Cfrg] Question about edwards448 mapping in draft-irtf-cfrg-curves-11

[Andrew Bennett <[e-mail]>]

Whoops, for some reason I didn't connect the meaning of the 4-isogeny
between curve448 and edwards448 as being a scalar multiplication by 4.
Thank you for your accurate guess :-)

I was curious if I could find some sort of reproducible pattern for
converting between the (u,v) of curve448 and the (x,y) of edwards448 and
wound up with this slow/messy conversion using Sage (in case anyone else in
the future is confused like I was):

p = 2^448-2^224-1
F = GF(p)
d = -39081
E = EllipticCurve(F,[0,2-4*d,0,1,0])
curve448_basepoint = E.lift_x(5)
curve448_basepoint_div4 = curve448_basepoint.division_points(4)[0]
u = curve448_basepoint_div4[0]
v = curve448_basepoint_div4[1]
edwards448_x = 4*v*(u^2 - 1)/(u^4 - 2*u^2 + 4*v^2 + 1) % p
edwards448_y = -(u^5 - 2*u^3 - 4*u*v^2 + u)/(u^5 - 2*u^2*v^2 - 2*u^3 -
2*v^2 + u) % p

Thanks again for you help!
Andrew Bennett

On Sun, Jan 17, 2016 at 9:26 PM Ilari Liusvaara <[e-mail]>
wrote:

> On Mon, Jan 18, 2016 at 03:59:18AM +0000, Andrew Bennett wrote:
> > Hello,
> >
> > Quick disclaimer: my question detailed below might simply be due to my
> own
> > lack of knowledge related to the mathematical concepts of elliptic curves
> > and their isogenies.
>
> Quick guess to the cause: This is not isomorphism, but 4-isogeny, so
> when one round-trips once, the point gets multiplied (as in scalar
> multiplication by four: 4G).
>
> The conversion from Edwards basepoint to Montgomery basepoint "works"
> since the Edwards basepoint is specifically chosen so that:
>
> - It yields Montgomery basepoint when converted
> - It has prime order.
>
>
> -Ilari
>