I want to test an implementation of elliptic curve cryptography over binary Edwards curves as defined here. I want to test it by generating a random curve. Generating the curve itself is trivial (I do not look for secure parameters), I would then like to count the number of points by using a binary version of Schoof's algorithm.
My problem is: How can I go from a binary Edwards curve: $\left(x+y\right)\left( d_1+d_2 \left( x+y \right)\right)=xy \left( 1+x \right)+\left(1+y \right)$ To a binary Weierstrass curve with equation: $y^2+xy=x^3+a_2x^2+a_6$, which will have the same number of points on that curve, and use that result for my binary Edwards curve?
The paper states that there is an birational equivalence between the two curves, but this does not seem to preserve the number of points on the curves when I try to go from one curve to the other and calculating the number of points on a curve I already know e.g. see "The Selected Curve" page 12 . Does there exist an isomorphism that would preserve this property?
It turned out that my calculations for $a_2$ and $a_6$ was wrong. I did not use GF addition and multiplication modulo the basis polynomial. The correct calculation to go from binary Edwards to binary Weierstrass is the following: $v^2+uv=u^3+\left(d_1^2+d_2\right)u^2+d_1^4\left(d_1^4+d_1^2+d_2^2\right)$
Using the curve mentioned in the question we have $d_1=d_2$ and $d=162147178771382273$ this gives: $v^2+uv=u^3+\left(d_1^2+d_1\right)u^2+d_1^8$(because of characteristic 2) where $d_1^2+d_1=21093706297282747224397388833619968$ and $d_1^8=7661881051710536811818955047070455139496868605102260666985611265$ Counting the points on this binary Weierstrass curve now gives the same amount of points as for the original curve.
To answer SpamIAM's comment: When we work with the affine binary Edwards curve as the question suggests, the points at infinity should not cause any troubles as the neutral element is $\left(0,0\right)$