What equation suitable for generation of a public key is used for Edwards curve Ed25519?

The problem is the following – info on Edwards Elliptic Curve on Wikipedia page presents an equation y^2 + x^2 = 1 + d * y^2 * x^2 that doesn't allow us to plot a curve depicted on the first picture.

So, what equation is used for Ed25519? This one?

y^2 + x^2 = 1 - d * y^2 * x^2

enter image description here

Or this one?

y^2 + x^2 = 1 + d * y^2 * x^2

enter image description here

I haven't found any documentation covering this topic.

1 Answer 1


The general equation of the Edwards curve is

ax^2 + y^2 = 1 + dx^2y^2

for Ed25519 a = -1, d = -121665/121666.

The curve is also living in the prime field. The equation is enter image description here

I could not plot this equation in geograba, I guess due to the nature of the prime field over which the equation is defined.(?)

  • I think IOHK used different a and d values for Ed25519 equation. As far as we can easily build a Bitcoin curve (secp256k1) over definite field using its native equation y^2 = x^3 + 7, we'll also be able to build a Cardano curve.
    – Andy Jazz
    Sep 10, 2021 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.