This section contains details and justification on how and why Ristretto works, and a derivation of the formulas contained in the Explicit Formulas chapter.

These notes are meant to be self-contained, but it may be also be useful to consult the Decaf paper. Decaf constructs a prime-order group from a cofactor-\(4\) Edwards curve by defining an encoding of a related Jacobi quartic, then transporting the encoding from the Jacobi quartic to the Edwards curve by means of an isogeny.

Ristretto uses the same strategy, but with a different isogeny, different sign choices, and is explicitly designed to cover the cofactor-\(8\) case, making it easy to use with a cofactor-\(8\) curve such as Curve25519. This construction also allows implementations to replace the Edwards form of Curve25519 with a faster curve while maintaining interoperability.