Laël Cellier on Sat, 05 Jul 2025 21:05:54 +0200


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

What’s the equivalent of this py_ecc code for untwisting the ʙɴ128 curve in Pari/ɢᴘ ?


Simple, I’ve curve defined as definied over finite finite field with and point

As this curve is homomorphic to the curve

defined over , how to convert the point to the

curve such as the discrete logarithm relation between 2 points on the 1st curve is preserved ?

I’ve following code from py_ecc :

def twist(pt: Point2D[FQP]) -> Point2D[FQ12]:
    _x, _y = pt
    # Field isomorphism from Z[p] / x**2 to Z[p] / x**2 - 18*x + 82
    xcoeffs = [_x.coeffs[0] - _x.coeffs[1] * 9, _x.coeffs[1]]
    ycoeffs = [_y.coeffs[0] - _y.coeffs[1] * 9, _y.coeffs[1]]
    # Isomorphism into subfield of Z[p] / w**12 - 18 * w**6 + 82,
    # where w**6 = x
    nx = FQ12([int(xcoeffs[0])] + [0] * 5 + [int(xcoeffs[1])] + [0] * 5)
    ny = FQ12([int(ycoeffs[0])] + [0] * 5 + [int(ycoeffs[1])] + [0] * 5)
    # Divide x coord by w**2 and y coord by w**3
    return (nx * w**2, ny * w**3)

but what it’s Pari/ɢᴘ equivalent ?