source 2008 Bernstein--Birkner--Joye--Lange--Peters http://eprint.iacr.org/2008/013, Section 6, plus Z2=1, plus Z1=1, plus common-subexpression elimination
unified
assume Z1 = 1
assume Z2 = 1
compute C = X1 X2
compute D = Y1 Y2
compute E = C D
compute H = C - a D
compute I = (X1 + Y1)(X2 + Y2) - C - D
compute X3 = (E + d) H
compute Y3 = (E - d) I
compute Z3 = H I
