Let’s say I have 3 randomly sampled points on a curve in the twisted Edwards form (sampled only the first time and not at each computation) $P1$ $P2$ $P3$ and 3 scalars $S1$ $S2$ $S3$ such as :
- Both $S1$ $S2$ $S3$ are <targetcurve.Suborder (the largest prime factor of the composite curve’s order or the curve order if the curve is a prime)
- The curve pass the Safecurve criterias
Given $packed(S1×P1 + S2×P2 + S3×P3)$ (where packed means keeping only $x$ and dropping the $y$ coordinate but remember this is an edward’s curve where the negation of a coordinate is $(−x,y)$) then why if 1 scalar is modified, finding other scalars to still keep the same previous $x$ is best achieved through solving the discrete logarithm between $P1$ and $P2$ or $P2$ and $P3$ ?