# Curve Models

Decaf and Ristretto make use of three curve shapes: Jacobi quartic, twisted Edwards, and Montgomery, and isogenies between them.

## The Jacobi Quartic

The Jacobi quartic curve is parameterized by \(e, A\), and is of the
form $$ \mathcal J_{e,A} : t^2 = es^4 + 2As^2 + 1, $$ with
identity point \((0,1)\). For more details on the Jacobi quartic,
see the *Decaf* paper or
*Jacobi Quartic Curves Revisited* by Hisil, Wong,
Carter, and Dawson).

When \(e = a^2\) is a square, \(\mathcal J_{e,A}\) has full \(2\)-torsion (i.e., \(\mathcal J[2] \cong \mathbb Z /2 \times \mathbb Z/2\)), and we can write the \(\mathcal J[2]\)-coset of a point \(P = (s,t)\) as $$ P + \mathcal J[2] = \left\{ (s,t), (-s,-t), (1/as, -t/as^2), (-1/as, t/as^2) \right\}. $$ Notice that replacing \(a\) by \(-a\) just swaps the last two points, so this set does not depend on the choice of \(a\).

## Twisted Edwards Curves

Twisted Edwards curves are parameterized by \(a, d\) and are of the form
$$
\mathcal E_{a,d} : ax^2 + y^2 = 1 + dx^2y^2.
$$
These are usually represented by the *Extended Twisted Edwards
Coordinates* of Hisil, Wong, Carter, and Dawson: points are
represented in projective coordinates as \((X:Y:Z:T)\) with
$$
XY = ZT, \quad aX^2 + Y^2 = Z^2 + dT^2.
$$
(More details on Edwards curve models can be found in the
`curve25519_dalek`

`curve_models`

documentation). The
case \(a = 1\) is the *untwisted* case; the case \(a = -1\)
provides the fastest formulas. When not otherwise specified, we write
\(\mathcal E\) for \(\mathcal E_{a,d}\).

When both \(d\) and \(ad\) are nonsquare (which forces \(a\) to be
square), the curve is *complete*. In this case the four-torsion subgroup is
cyclic, and we can write it explicitly as
$$
\mathcal E_{a,d}[4] = \{ (0,1),\; (1/\sqrt a, 0),\; (0, -1),\; (-1/\sqrt{a}, 0)\}.
$$
These are the only points with \(xy = 0\); the points with
\( y \neq 0 \) are \(2\)-torsion.

## Montgomery Curves

Montgomery curves are parameterized by \(B, A\) with \(B \neq 0\)
and \(A^2 \neq 4 \) and are of the form
\[
\mathcal M_{B,A} : Bv^2 = u(u^2 + Au + 1),
\]
with the identity point at infinity. More details can be found in the
*Decaf* paper or in *Montgomery curves and their
arithmetic* by Costello and Smith.