Posts  / #POST-211169
REDDIT

Why does RFC 7748 use AA instead of BB in the doubling formula for Curve25519?

M
Sep 1, 2025 · 10:40

I’ve been studying the Montgomery ladder formulas for Curve25519, starting from the standard doubling formula in projective coordinates:

https://preview.redd.it/0o0exl2f7jmf1.png?width=492&format=png&auto=webp&s=8492c1012e72f5f3d0fe06d0d37ac2802ade1bad

When you translate this into the RFC 7748 notation:

A = x_2 + z_2
AA = A^2
B = x_2 - z_2
BB = B^2
E = AA - BB
z_2 = E * (BB + a24 * E)

But in the RFC, the z\_2 formula is
`z_2 = E * (AA + a24 * E)`

Why is it `AA` in the second factor instead of `BB`?