diff --git a/src/edwards.rs b/src/edwards.rs index 102a5ea3e..3b65e2561 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -450,6 +450,10 @@ impl EdwardsPoint { /// Convert this `EdwardsPoint` on the Edwards model to the /// corresponding `MontgomeryPoint` on the Montgomery model. /// + /// This function has one exceptional case; the identity point of + /// the Edwards curve is sent to the 2-torsion point \\((0,0)\\) + /// on the Montgomery curve. + /// /// Note that this is a one-way conversion, since the Montgomery /// model does not retain sign information. pub fn to_montgomery(&self) -> MontgomeryPoint { @@ -457,7 +461,7 @@ impl EdwardsPoint { // // The denominator is zero only when y=1, the identity point of // the Edwards curve. Since 0.invert() = 0, in this case we - // compute u = 0, the identity point of the Montgomery line. + // compute the 2-torsion point (0,0). let U = &self.Z + &self.Y; let W = &self.Z - &self.Y; let u = &U * &W.invert();