`ENCODE`, an encoding function from internal representations to bytestrings so that all equivalent representations on the same ristretto255 element are encoded as identical bytestrings;`DECODE`, a decoding function from bytestrings to internal representations with built-in validation, so that only the canonical encodings of valid ristretto255 elements are accepted;`EQUALS`, an equality check that operates on internal representations, so that all representations of the same ristretto255 element are considered equivalent;`FROM_UNIFORM_BYTES`, a map from uniformly distributed bytestrings to ristretto255 elements suitable for hash-to-group and random-point operations.

D = 37095705934669439343138083508754565189542113879843219016388785533085940283555 This is the Edwards d parameter for Curve25519, as specified in Section 4.1 of .

SQRT_M1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752 SQRT_AD_MINUS_ONE = 25063068953384623474111414158702152701244531502492656460079210482610430750235 INVSQRT_A_MINUS_D = 54469307008909316920995813868745141605393597292927456921205312896311721017578 ONE_MINUS_D_SQ = 1159843021668779879193775521855586647937357759715417654439879720876111806838 D_MINUS_ONE_SQ = 40440834346308536858101042469323190826248399146238708352240133220865137265952

CT_EQ(u, v): Return TRUE if u = v, FALSE otherwise. CT_SELECT(v IF cond ELSE u): Return v if cond is TRUE, else return u. CT_NEG(u, cond): Return -u if cond is TRUE, else return u. CT_ABS(u): Return -u if u is negative, else return u.

(TRUE, +sqrt(u/v)) if u and v are non-zero, and u/v is square; (TRUE, zero) if u is zero; (FALSE, zero) if v is zero and u is non-zero; (FALSE, +sqrt(SQRT_M1*(u/v))) if u and v are non-zero, and u/v is non-square (so SQRT_M1*(u/v) is square).

First, interpret the string as an integer s in little-endian representation. If the resulting value is >= p, decoding fails. If IS_NEGATIVE(s) returns TRUE, decoding fails. Process s as follows:

If was_square is FALSE, or IS_NEGATIVE(t) returns TRUE, or y = 0, decoding fails. Otherwise, return the internal representation in extended coordinates (x, y, 1, t).

Process the internal representation into a field element s as follows:

Return the canonical little-endian encoding of s.

Interpret the least significant 255 bits of b[ 0..32] as an integer r0 in little-endian representation. Reduce r0 modulo p. Interpret the least significant 255 bits of b[32..64] as an integer r1 in little-endian representation. Reduce r1 modulo p. Compute group element P1 as MAP(r0) Compute group element P2 as MAP(r1). Return the group element P1 + P2.