ScriptSig Isomorphism

scriptSig = <sig> <pubKey>

Isomorphism (and birational equivalence)

<sig> - One can sometimes convert a short Weierstrass curve y^2=x^3+ax+b to a Montgomery curve as follows. Find r satisfying r^3+ar+b=0. Find s satisfying s^2=3r^2+a. Define u=(x-r)/s, B=1/s^3, and A=3r/s. Then By^2=u^3+Au^2+u. One can perform x-coordinate scalar multiplication on y^2=x^3+ax+b by converting x to u, performing u-coordinate scalar multiplication on By^2=u^3+Au^2+u with the Montgomery ladder, and converting back.

The reason this does not always work is that, for the majority of curves, the field F_p does not contain suitable elements r and s. One can work around this by replacing F_p with an extension field, but this requires much less simple field operations inside scalar multiplication.

In particular, curves of prime order or 2*prime order can never be converted to Montgomery curves over F_p: Montgomery curves always have order divisible by 4.