`CT_EQ(u, v)`: return TRUE if u = v, FALSE otherwise.`CT_SELECT(v IF cond ELSE u)`: return v if cond is TRUE, else return u.`CT_ABS(u)`: return -u if IS_NEGATIVE(u), else return u.

`D`= 37095705934669439343138083508754565189542113879843219016388785533085940283555- This is the Edwards d parameter for Curve25519, as specified in Section 4.1 of
.

- This is the Edwards d parameter for Curve25519, as specified in Section 4.1 of
`SQRT_M1`= 19681161376707505956807079304988542015446066515923890162744021073123829784752`SQRT_AD_MINUS_ONE`= 25063068953384623474111414158702152701244531502492656460079210482610430750235`INVSQRT_A_MINUS_D`= 54469307008909316920995813868745141605393597292927456921205312896311721017578`ONE_MINUS_D_SQ`= 1159843021668779879193775521855586647937357759715417654439879720876111806838`D_MINUS_ONE_SQ`= 40440834346308536858101042469323190826248399146238708352240133220865137265952

`(TRUE, +sqrt(u/v))`if u and v are non-zero, and u/v is square;`(TRUE, zero)`if u is zero;`(FALSE, zero)`if v is zero and u is non-zero;`(FALSE, +sqrt(SQRT_M1*(u/v)))`if u and v are non-zero, and u/v is non-square (so`SQRT_M1*(u/v)`is square),

First, interpret the string as an unsigned integer s in little-endian representation. If the length of the string is not 32 bytes, or if the resulting value is >= p, decoding fails. - Note: unlike
field element decoding, the most significant bit is not masked, and non-canonical values are rejected. The test vectors in exercise these edge cases.

- Note: unlike
- If
`IS_NEGATIVE(s)`returns TRUE, decoding fails. - Process s as follows:

- If was_square is FALSE, or
`IS_NEGATIVE(t)`returns TRUE, or y = 0, decoding fails. Otherwise, return the group element represented by the internal representation`(x, y, 1, t)`as the result of decoding.

- Process the internal representation into a field element s as follows:

- Return the 32-byte little-endian encoding of s. More specifically, this is the encoding of the canonical representation of s as an integer between 0 and p-1, inclusive.

- Compute P1 as
`MAP(b[0:32])`. - Compute P2 as
`MAP(b[32:64])`. - Return P1 + P2.

First, mask the most significant bit in the final byte of the string, and interpret the string as an unsigned integer r in little-endian representation. Reduce r modulo p to obtain a field element t. - Masking the most significant bit is equivalent to interpreting the whole string as an unsigned integer in little-endian representation and then reducing it modulo 2^255.
- Note: similarly to
field element decoding, and unlike field element decoding in , the most significant bit is masked, and non-canonical values are accepted.

Process t as follows:

- Return the group element represented by the internal representation
`(w0*w3, w2*w1, w1*w3, w0*w2)`.

`D`= 726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358- This is the Edwards d parameter for edwards448, as specified in
Section 4.2 of
, and is equal to -39081 in the field.

- This is the Edwards d parameter for edwards448, as specified in
Section 4.2 of
`ONE_MINUS_D`= 39082`ONE_MINUS_TWO_D`= 78163`SQRT_MINUS_D`= 98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214`INVSQRT_MINUS_D`= 315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716

`(TRUE, +sqrt(u/v))`if u and v are non-zero, and u/v is square;`(TRUE, zero)`if u is zero;`(FALSE, zero)`if v is zero and u is non-zero;`(FALSE, +sqrt(-u/v))`if u and v are non-zero, and u/v is non-square (so`-(u/v)`is square),

First, interpret the string as an unsigned integer s in little-endian representation. If the length of the string is not 56 bytes, or if the resulting value is >= p, decoding fails. - Note: unlike
field element decoding, non-canonical values are rejected. The test vectors in exercise these edge cases.

- Note: unlike
- If
`IS_NEGATIVE(s)`returns TRUE, decoding fails. - Process s as follows:

- If was_square is FALSE then decoding fails. Otherwise,
return the group element represented by the internal representation
`(x, y, 1, t)`as the result of decoding.

- Process the internal representation into a field element s as follows:

- Return the 56-byte little-endian encoding of s. More specifically, this is the encoding of the canonical representation of s as an integer between 0 and p-1, inclusive.

- Compute P1 as
`MAP(b[0:56])`. - Compute P2 as
`MAP(b[56:112])`. - Return P1 + P2.

Interpret the string as an unsigned integer r in little-endian representation. Reduce r modulo p to obtain a field element t. - Note: similarly to
field element decoding, and unlike field element decoding in , non-canonical values are accepted.

- Note: similarly to
Process t as follows:

- Return the group element represented by the internal representation
`(w0*w3, w2*w1, w1*w3, w0*w2)`.