source 2008 Bernstein--Birkner--Joye--Lange--Peters http://eprint.iacr.org/2008/013, Section 6 compute A = Z1 Z2 compute B = d A^2 compute C = X1 X2 compute D = Y1 Y2 compute E = C D compute H = C - a D compute I = (X1 + Y1)(X2 + Y2) - C - D compute X3 = (E + B) H compute Y3 = (E - B) I compute Z3 = A H I