diff --git a/src/curve_models/mod.rs b/src/curve_models/mod.rs
index ba1e9e2..7364c2a 100644
--- a/src/curve_models/mod.rs
+++ b/src/curve_models/mod.rs
@@ -77,16 +77,10 @@ use core::ops::{Add, Sub, Neg};
use constants;
use field::FieldElement;
-
use edwards::ExtendedPoint;
-use edwards::CompressedEdwardsY;
-use montgomery::MontgomeryPoint;
-
use subtle::ConditionallyAssignable;
-
use traits::ValidityCheck;
-
// ------------------------------------------------------------------------
// Internal point representations
// ------------------------------------------------------------------------
@@ -235,70 +229,6 @@ impl ProjectivePoint {
T: &self.X * &self.Y,
}
}
-
- /// Convert this projective point in the Edwards model to its equivalent
- /// projective point on the Montgomery form of the curve.
- ///
- /// Taking the Montgomery curve equation in affine coordinates:
- ///
- /// E_(A,B) = Bv² = u³ + Au² + u (1)
- ///
- /// and given its relations to the coordinates of the Edwards model:
- ///
- /// u = (1+y)/(1-y) (2)
- /// v = (λu)/(x)
- ///
- /// Converting from affine to projective coordinates in the Montgomery
- /// model, we arrive at:
- ///
- /// u = (Z+Y)/(Z-Y) (3)
- /// v = λ * ((Z+Y)/(Z-Y)) * (Z/X)
- ///
- /// The transition between affine and projective is given by
- ///
- /// u → U/W (4)
- /// v → V/W
- ///
- /// thus the Montgomery curve equation (1) becomes
- ///
- /// E_(A,B) : BV²W = U³ + AU²W + UW² ⊆ 𝗣^2 (5)
- ///
- /// Here, again, to differentiate from points in the twisted Edwards model, we
- /// call the point `(x,y)` in affine coordinates `(u,v)` and similarly in projective
- /// space we use `(U:V:W)`. However, since (as per Montgomery's original work) the
- /// v-coordinate is superfluous to the definition of the group law, we merely
- /// use `(U:W)`.
- ///
- /// Therefore, the direct translation between projective Montgomery points
- /// and projective twisted Edwards points is
- ///
- /// (U:W) = (Z+Y:Z-Y) (6)
- ///
- /// Note, however, that there appears to be an exception where `Z=Y`,
- /// since—from equation 2—this would imply that `y=1` (thus causing the
- /// denominator to be zero). If this is the case, then it follows from the
- /// twisted Edwards curve equation
- ///
- /// -x² + y² = 1 + dx²y² (7)
- ///
- /// that
- ///
- /// -x² + 1 = 1 + dx²
- ///
- /// and, assuming that `d ≠ -1`,
- ///
- /// -x² = x²
- /// x = 0
- ///
- /// Therefore, the only valid point with `y=1` is the twisted Edwards
- /// identity point, which correctly becomes `(1:0)`, that is, the identity,
- /// in the Montgomery model.
- pub fn to_montgomery(&self) -> MontgomeryPoint {
- MontgomeryPoint{
- U: &self.Z + &self.Y,
- W: &self.Z - &self.Y,
- }
- }
}
impl CompletedPoint {
diff --git a/src/edwards.rs b/src/edwards.rs
index b2fb397..7fff8d8 100644
--- a/src/edwards.rs
+++ b/src/edwards.rs
@@ -269,10 +269,76 @@ impl ExtendedPoint {
}
}
- /// Convert this point to its equivalent on the Montgomery form of the
- /// curve.
+ /// Convert this `ExtendedPoint` on the Edwards model to the
+ /// corresponding `MontgomeryPoint` on the Montgomery model.
+ ///
+ /// Note that this is a one-way conversion, since the Montgomery
+ /// model does not retain sign information.
+ ///
+ // XXX need to figure out how to keep this in internal docs, and
+ // also to rewrite it to use tex
+ //
+ // # Implementation notes
+ //
+ // Taking the Montgomery curve equation in affine coordinates:
+ //
+ // E_(A,B) = Bv² = u³ + Au² + u (1)
+ //
+ // and given its relations to the coordinates of the Edwards model:
+ //
+ // u = (1+y)/(1-y) (2)
+ // v = (λu)/(x)
+ //
+ // Converting from affine to projective coordinates in the Montgomery
+ // model, we arrive at:
+ //
+ // u = (Z+Y)/(Z-Y) (3)
+ // v = λ * ((Z+Y)/(Z-Y)) * (Z/X)
+ //
+ // The transition between affine and projective is given by
+ //
+ // u → U/W (4)
+ // v → V/W
+ //
+ // thus the Montgomery curve equation (1) becomes
+ //
+ // E_(A,B) : BV²W = U³ + AU²W + UW² ⊆ 𝗣^2 (5)
+ //
+ // Here, again, to differentiate from points in the twisted Edwards model, we
+ // call the point `(x,y)` in affine coordinates `(u,v)` and similarly in projective
+ // space we use `(U:V:W)`. However, since (as per Montgomery's original work) the
+ // v-coordinate is not required to perform scalar multiplication, we merely
+ // use `(U:W)`.
+ //
+ // Therefore, the direct translation between projective Montgomery points
+ // and projective twisted Edwards points is
+ //
+ // (U:W) = (Z+Y:Z-Y) (6)
+ //
+ // Note, however, that there appears to be an exception where `Z=Y`,
+ // since—from equation 2—this would imply that `y=1` (thus causing the
+ // denominator to be zero). If this is the case, then it follows from the
+ // twisted Edwards curve equation
+ //
+ // -x² + y² = 1 + dx²y² (7)
+ //
+ // that
+ //
+ // -x² + 1 = 1 + dx²
+ //
+ // and, assuming that `d ≠ -1`,
+ //
+ // -x² = x²
+ // x = 0
+ //
+ // Therefore, the only valid point with `y=1` is the twisted Edwards
+ // identity point, which correctly becomes `(1:0)`, that is, the identity,
+ // in the Montgomery model.
pub fn to_montgomery(&self) -> MontgomeryPoint {
- self.to_projective().to_montgomery()
+ MontgomeryPoint{
+ U: &self.Z + &self.Y,
+ W: &self.Z - &self.Y,
+ }
}
/// Compress this point to `CompressedEdwardsY` format.