We will use formulae for curve arithmetic using affine coordinates on short Weierstrass curves, derived from section 4.1 of Hüseyin Hışıl's thesis.

• Inputs:
• Output:

The formulae from Hışıl's thesis are:

Rename to , to , and to , giving

which is equivalent to

Assuming , we have

So we get the constraints:

• Note that this constraint is unsatisfiable for (when ), and so cannot be used with arbitrary inputs.

### Constraints

Suppose that we represent as . ( is not an -coordinate of a valid point because we would need , and is not square in . Also is not a -coordinate of a valid point because is not a cube in .)

For the doubling case, Hışıl's thesis tells us that has to instead be computed as .

Define

Witness where:

Max degree: 6

### Analysis of constraints

#### Cases:

Note that we rely on the fact that is not a valid -coordinate or -coordinate of a point on the Pallas curve other than .

• Completeness:

• Soundness: is the only solution to

• for

• Completeness:

• Soundness: is the only solution to

• for

• Completeness:

• Soundness: is the only solution to

• for

• Completeness:

• Soundness: is computed correctly, and is the only solution.

• for

• Completeness:

• Soundness: is the only solution to

• for and and

• Completeness:

• Soundness: is computed correctly, and is the only solution.