Score:1

How to recover y-coordinates when using XZ montgomery curve

pl flag

I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates.

for Double and add ladder I am using this:

      A = X2+Z2
      AA = A2
      B = X2-Z2
      BB = B2
      E = AA-BB
      C = X3+Z3
      D = X3-Z3
      DA = D*A
      CB = C*B
      X5 = Z1*(DA+CB)2
      Z5 = X1*(DA-CB)2
      X4 = AA*BB
      Z4 = E*(BB+a24*E)

I tried this way :

x3=2;
y3 = mod(mod((x3.^3 + mod(a*x3.^2,p)+x3),p) * mod(modinvr(b,p),p),p);

for y = 0:22
    x = mod(y^2, 23);
    if x == y3
        fprintf("y = %d\n", y);// here I got two values of y 8 and 15
    end
end

here I got two values of y 8 and 15 both are correct points on the curve but in my case I want to choose 8 because the affine scalar point is (2,8) I have another point on the curve (2,15) but not in my scalar point! so that's why I need to select 8 instead of 15.

swineone avatar
ru flag
Have you tried solving the curve equation for $y$?
Cisco Saeed avatar
pl flag
I tried but it gives me 2 y coordinates but dont know how to choose the correct one
Cisco Saeed avatar
pl flag
@swineone I tried this `%y3=(x+X1/Z1)[(X1+x*Z1)(X2+x*Z2)+(x^2+y)(Z1*Z2)](x*Z1*Z2)^-1+y` but it doesn't give me the correct value?
Cisco Saeed avatar
pl flag
@swineone I edited with my trial
swineone avatar
ru flag
Being a quadratic equation, there are indeed 2 possible solutions. I’m a little rusty on my elliptic curves, but either both are valid, or your standard should specify a disambiguation rule: say, always take the positive value, or a value with some other property.
Cisco Saeed avatar
pl flag
@swineone that rule i am trying to figure it out or there is a different equation for it
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.