From e6f27ca9960299cc01def53c60b4bbc8cd22a216 Mon Sep 17 00:00:00 2001
From: Henry de Valence <hdevalence@hdevalence.ca>
Date: Sun, 13 Jan 2019 18:01:00 -0800
Subject: [PATCH] Fix Ristretto variable naming in decoding function

The code swaps u_1 and u_2 relative to the formulas (probably when doing the change for a=-1)
---
 src/ristretto.rs | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/ristretto.rs b/src/ristretto.rs
index e6375ed..234af93 100644
--- a/src/ristretto.rs
+++ b/src/ristretto.rs
@@ -258,16 +258,16 @@ impl CompressedRistretto {
         // Step 2.  Compute (X:Y:Z:T).
         let one = FieldElement::one();
         let ss = s.square();
-        let u1 = &one + &ss;      //  1 - as²    where a=-1
-        let u2 = &one - &ss;      //  1 + as²
-        let u1_sqr = u1.square(); // (1 + as²)²
+        let u1 = &one - &ss;      //  1 + as²
+        let u2 = &one + &ss;      //  1 - as²    where a=-1
+        let u2_sqr = u2.square(); // (1 - as²)²
 
-        // v == ad(1-as²)² - (1+as²)²            where d=-121665/121666
-        let v = &(&(-&constants::EDWARDS_D) * &u2.square()) - &u1_sqr;
+        // v == ad(1+as²)² - (1-as²)²            where d=-121665/121666
+        let v = &(&(-&constants::EDWARDS_D) * &u1.square()) - &u2_sqr;
 
-        let (ok, I) = (&v * &u1_sqr).invsqrt(); // 1/sqrt(vu1²)
+        let (ok, I) = (&v * &u2_sqr).invsqrt(); // 1/sqrt(v*u_2²)
 
-        let Dx = &I * &u1;         // 1/sqrt(v)
+        let Dx = &I * &u2;         // 1/sqrt(v)
         let Dy = &I * &(&Dx * &v); // 1/u2
 
         // x == | 2s/sqrt(v) | == + sqrt(4s²/(ad(1+as²)² - (1-as²)²))
@@ -276,7 +276,7 @@ impl CompressedRistretto {
         x.conditional_negate(x_neg);
 
         // y == (1-as²)/(1+as²)
-        let y = &u2 * &Dy;
+        let y = &u1 * &Dy;
 
         // t == ((1+as²) sqrt(4s²/(ad(1+as²)² - (1-as²)²)))/(1-as²)
         let t = &x * &y;