From 95bf09a335cb6de47964f064979dcab32a9e9a89 Mon Sep 17 00:00:00 2001
From: Henry de Valence <hdevalence@hdevalence.ca>
Date: Tue, 21 Feb 2017 12:33:57 -0800
Subject: [PATCH] Check xy is nonnegative, y nonzero in decoding.

---
 src/decaf.rs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/decaf.rs b/src/decaf.rs
index 83a417f..98e9386 100644
--- a/src/decaf.rs
+++ b/src/decaf.rs
@@ -83,7 +83,16 @@ impl CompressedDecaf {
         let Y = &w * &Z;
         let T = &w * &X;
 
-        Some(DecafPoint(ExtendedPoint{ X: X, Y: Y, Z: Z, T: T }))
+        // "To decode the point, one must decode it to affine form
+        // instead of projective, and check that xy is non-negative."
+        //
+        // XXX can we merge this inversion with the one above?
+        let xy = &T * &Z.invert();
+        if (Y.is_nonzero() & xy.is_nonnegative_decaf()) == 1u8 {
+            Some(DecafPoint(ExtendedPoint{ X: X, Y: Y, Z: Z, T: T }))
+        } else {
+            None
+        }
     }
 }