Posts
/ #POST-211169
REDDIT
Why does RFC 7748 use AA instead of BB in the doubling formula for Curve25519?
I’ve been studying the Montgomery ladder formulas for Curve25519, starting from the standard doubling formula in projective coordinates:
https://preview.redd.it/0o0exl2f7jmf1.png?width=492&format=png&auto=webp&s=8492c1012e72f5f3d0fe06d0d37ac2802ade1bad
When you translate this into the RFC 7748 notation:
A = x_2 + z_2
AA = A^2
B = x_2 - z_2
BB = B^2
E = AA - BB
z_2 = E * (BB + a24 * E)
But in the RFC, the z\_2 formula is
`z_2 = E * (AA + a24 * E)`
Why is it `AA` in the second factor instead of `BB`?