The hash-to-group operation applies Elligator twice and adds the results.

Given bytes, 64 bytes of hash output, construct field elements \(r_0, r_1\) as

• \(r_0\) is the low 255 bits of bytes[ 0..32], taken mod \(p\).
• \(r_1\) is the low 255 bits of bytes[32..64], taken mod \(p\).

Apply the Elligator map below to the inputs \(r_0, r_1\) to obtain points \(P_1, P_2\), and return \(P_1 + P_2\).

1. \(r \gets ir_0^2\).
2. \(N_s \gets (r+1)(1-d^2) \textcolor{gray}{= a(r+1)(a+d)(a-d)} \).
3. \(c \gets -1\).
4. \(D \gets (c - dr)(r+d) \textcolor{gray}{= (dr -a)(ar-d)} \).
5. Ns_D_is_sq, \(s \gets \) sqrt_ratio_i(N_s, D).
6. \(s' \gets -|s r_0|\).
7. \(s \gets s' \) if not Ns_D_is_sq.
8. \(c \gets r \) if not Ns_D_is_sq.
9. \(N_t \gets c(r-1)(d-1)^2 - D\).
10. \(W_0 \gets 2sD \).
11. \(W_1 \gets N_t\sqrt{ad-1} \).
12. \(W_2 \gets 1 - s^2 \textcolor{gray}{= 1 +as^2} \).
13. \(W_3 \gets 1 + s^2 \textcolor{gray}{= 1 -as^2} \).
14. Return \( (W_0 W_3 : W_2 W_1 : W_1 W_3 : W_0 W_2) \).