Commit aa75f28a authored by Michael Hamburg's avatar Michael Hamburg
Browse files

still need to iron out some sign differences

parent 4fa2c73e
......@@ -14,6 +14,9 @@ def optimized_version_of(spec):
"""Decorator: This function is an optimized version of some specification"""
def decorator(f):
def wrapper(self,*args,**kwargs):
def pr(x):
if isinstance(x,bytearray): return binascii.hexlify(x)
else: return str(x)
try: spec_ans = getattr(self,spec,spec)(*args,**kwargs),None
except Exception as e: spec_ans = None,e
try: opt_ans = f(self,*args,**kwargs),None
......@@ -28,7 +31,7 @@ def optimized_version_of(spec):
# % (f.__name__,str(spec_ans[1]),str(opt_ans[0])))
if spec_ans[0] != opt_ans[0]:
raise SpecException("Mismatch in %s: %s != %s"
% (f.__name__,str(spec_ans[0]),str(opt_ans[0])))
% (f.__name__,pr(spec_ans[0]),pr(opt_ans[0])))
if opt_ans[1] is not None: raise
else: return opt_ans[0]
wrapper.__name__ = f.__name__
......@@ -144,7 +147,7 @@ class RistrettoPoint(QuotientEdwardsPoint):
if y == -1: y = 1 # Avoid divide by 0; doesn't affect impl
if negative(x): x,y = -x,-y
s = xsqrt(self.a*(y-1)/(y+1),exn=Exception("Unimplemented: point is odd: " + str(self)))
s = xsqrt(self.mneg*(1-y)/(1+y),exn=Exception("Unimplemented: point is odd: " + str(self)))
return self.gfToBytes(s)
......@@ -164,28 +167,32 @@ class RistrettoPoint(QuotientEdwardsPoint):
def encode(self):
"""Encode, optimized version"""
a,d = self.a,self.d
a,d,mneg = self.a,self.d,self.mneg
x,y,z,t = self.xyzt()
if self.cofactor==8:
u1 = a*(y+z)*(y-z)
u1 = mneg*(z+y)*(z-y)
u2 = x*y # = t*z
isr = isqrt(u1*u2^2)
i1 = isr*u1
i2 = isr*u2
z_inv = i1*i2*t
i1 = isr*u1 # sqrt(mneg*(z+y)*(z-y))/(x*y)
i2 = isr*u2 # 1/sqrt(a*(y+z)*(y-z))
z_inv = i1*i2*t # 1/z
if negative(t*z_inv):
if a==-1: x,y = y*self.i,x*self.i
else: x,y = -y,x # TODO: test
den_inv = self.magic * i1
if a==-1:
x,y = y*self.i,x*self.i
den_inv = self.magic * i1
x,y = -y,x
den_inv = self.i * self.magic * i1
den_inv = i2
if negative(x*z_inv): y = -y
s = (z-y) * den_inv
num = a*(y+z)*(y-z)
num = mneg*(z+y)*(z-y)
isr = isqrt(num*y^2)
if negative(isr^2*num*y*t): y = -y
s = isr*y*(z-y)
......@@ -406,6 +413,23 @@ class Ed25519Point(RistrettoPoint):
d = F(-121665/121666)
a = F(-1)
i = sqrt(F(-1))
mneg = F(1)
qnr = i
magic = isqrt(a*d-1)
cofactor = 8
encLen = 32
def base(cls):
return cls( 15112221349535400772501151409588531511454012693041857206046113283949847762202, 46316835694926478169428394003475163141307993866256225615783033603165251855960
class NegEd25519Point(RistrettoPoint):
F = GF(2^255-19)
d = F(121665/121666)
a = F(1)
i = sqrt(F(-1))
mneg = F(-1) # TODO checkme vs 1-ad or whatever
qnr = i
magic = isqrt(a*d-1)
cofactor = 8
......@@ -414,14 +438,15 @@ class Ed25519Point(RistrettoPoint):
def base(cls):
y = cls.F(4/5)
x = sqrt((y^2-1)/(cls.d*y^2+1))
if lobit(x): x = -x
x = sqrt((y^2-1)/(cls.d*y^2-cls.a))
if negative(x): x = -x
return cls(x,y)
class IsoEd448Point(RistrettoPoint):
F = GF(2^448-2^224-1)
d = F(39082/39081)
a = F(1)
mneg = F(-1)
qnr = -1
magic = isqrt(a*d-1)
cofactor = 4
......@@ -429,10 +454,10 @@ class IsoEd448Point(RistrettoPoint):
def base(cls):
# = ..., -3/2
return cls.decodeSpec(bytearray(binascii.unhexlify(
return cls( # RFC has it wrong
class TwistedEd448GoldilocksPoint(Decaf_1_1_Point):
F = GF(2^448-2^224-1)
......@@ -446,9 +471,7 @@ class TwistedEd448GoldilocksPoint(Decaf_1_1_Point):
def base(cls):
return cls.decodeSpec(bytearray(binascii.unhexlify(
return cls.decodeSpec(Ed448GoldilocksPoint.base().encodeSpec())
class Ed448GoldilocksPoint(Decaf_1_1_Point):
F = GF(2^448-2^224-1)
......@@ -462,9 +485,9 @@ class Ed448GoldilocksPoint(Decaf_1_1_Point):
def base(cls):
return cls.decodeSpec(bytearray(binascii.unhexlify(
return -2*cls( # FIXME: make not negative
224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710, 298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660
class IsoEd25519Point(Decaf_1_1_Point):
# TODO: twisted iso too!
......@@ -533,6 +556,7 @@ def test(cls,n):
Q = Q1
......@@ -544,6 +568,7 @@ def testElligator(cls,n):
for i in xrange(n):
\newcommand\todo[1]{\textbf{[[TODO: #1]]}\xspace}
\title{The Ristretto and Cortado elliptic curve groups}
\author{Mike Hamburg\thanks{Rambus Security Division}}
\section{Definitions and notation}
Let the symbol $\bot$ denote failure.
\subsection{Field elements}
Let \F\ be a finite field of prime order $p$. For an element $x\in\F$, let $\text{res}(x)$ be the integer representative of $x\in[0,p-1]$. We call an element $x\in\F$ \textit{negative} if $\text{res}(x)$ is odd. Call an element in \F\ \textit{square} if it is a quadratic residue, i.e.\ if there exists $\sqrt{x}\in\F$ such that $\sqrt{x}^2=x$. There will in general be two such square roots; let the notation $\sqrt{x}$ mean the unique non-negative square root of $x$. If $p\equiv1\pmod 4$, then \F\ contains an element $i := \sqrt{-1}$.
Let $\ell := \lceil \log_{2^8} p\rceil$. Each $x\in\F$ has a unique \textit{little-endian byte representation}, namely the sequence
\text{\F\_to\_bytes}(x) := \llbracket b_i\rrbracket_{i=0}^{\l-1} \ \text{where}\ b_i\in[0,255]\text{\ and\ }\sum_{i=0}^{\l-1} 2^{8i} \cdot b_i = \text{res}(x)
\todo{bytes to \F}
For an abelian group \G\ with identity \O, let $n\G$ denote the subgroup of $\G$ which are of the form $n\cdot g$ for some $g\in\G$. Let $\G_n$ denote the $n$-torsion group of \G, namely the subgroup $\{g\in\G : n\cdot g = O\}$.
\subsection{Edwards curves}
We will work with twisted Edwards elliptic curves of the form
$$E_{a,d} : y^2 + a\cdot x^2 = 1 + d\cdot x^2\cdot y^2$$
where $x,y\in\F$. Twisted Edwards curves curves have a group law
$$(x_1,y_1) + (x_2,y_2) :=
\frac{x_1 y_2 + x_2 y_1}{1+d x_1 x_2 y_1 y_2},
\frac{y_1 y_2 - a x_1 x_2}{1-d x_1 x_2 y_1 y_2}
with identity point $\O := (0,1)$ and group inverse operation $$-(x,y) = (-x,y)$$
The group law is called \textit{complete} if is produces the correct answer (rather than e.g.\ $0/0$) for all points on the curve. The above formulas are complete when $d$ and $ad$ are nonsquare in \F, which implies that $a$ is square. When these conditions hold, we also say that the curve itself is complete.
Let the number of points on the curve be $$\#E_{a,d} = h\cdot q$$ where $q$ is prime and $h\in\{4,8\}$. We call $h$ the \textit{cofactor}.
For $P = (x,y)\in E$, we can define the \textit{projective homogeneous form} of $P$ as $(X,Y,Z)$ with $Z\neq 0$ and $$(x,y) = (X/Z,Y/Z)$$ and the \textit{extended homogeneous form} as $(X,Y,Z,T)$ where additionally $XY=ZT$. Extended homogeneous form is popular because it supports simple and efficient complete addition formulas~\cite{hisil}.
\subsection{Montgomery curves}
When $a-d$ is square in \F, the twisted Edwards curve $E_{a,d}$ is isomorphic to the Montgomery curve
$$v^2 = u\cdot\left(u^2 + 2\cdot\frac{a+d}{a-d}\cdot u + 1\right)$$
by the map
$$(u,v) = \left(\frac{1+y}{1-y},\ \ \frac{1+y}{1-y}\cdot\frac1x\cdot\frac{2}{\sqrt{a-d}}\right)$$
with inverse
$$(x,y) = \left(\frac{u}{v}\cdot\frac{\sqrt{a-d}}{2},\ \ \frac{u-1}{u+1}\right)$$
If $M = (u,v)$ is a point on the Montgomery curve, then the $u$-coordinate of $2M$ is $(u^2-1)^2 / (4v^2)$ is necessarily square. It follows that if $(x,y)$ is a point on $E_{a,d}$, and $a-d$ is square, then $(1+y)/(1-y)$ is also square.
\todo{Nega montgomery}
First, we characterize the 2-torsion and 4-torsion groups.\\
Let $E_{a,d}$ be a complete Edwards curve. Its 2-torsion subgroup is generated by $(0,-1)$. The 4-torsion subgroup is generated by $(1/\sqrt{a},0)$.
Adding the 2-torsion generator to $(x,y)$ produces $(-x,-y)$. Adding the 4-torsion generator $(1/\sqrt{a},0)$ produces $(y/\sqrt{a},-x\cdot\sqrt{a})$
Let $E_{a,d}$ be a complete twisted Edwards curve over \F, and $P_1 = (x_1,y_1)$ be any point on it. Then there are exactly two points $P_2 = (x_2,y_2)$ satisfying $x_1 y_2 = x_2 y_1$, namely $P_1$ itself and $(-x_1,-y_1)$. That is, there are either 0 or 2 points on any line through the origin.
Plugging into the group operation gives
$$x_1 y_2 = x_2 y_1 \Longleftrightarrow P_1-P_2 = (0,y_3)$$
for some $y_3$. Plugging $x=0$ into the curve equation gives $y=\pm1$, the 2-torsion points. Adding back, we have $P_2 = P_1 + (0,\pm1) = (\pm x_1, \pm y_1)$ as claimed.
If $E_{a,d}$ is a complete Edwards curve, then $a^2-ad$ is square in \F\ (and thus $a-d$ is square in \F) if and only if the cofactor of $E_{a,d}$ is divisible by 8.
Doubling an 8-torsion generator $(x,y)$ should produce a 4-torsion generator, i.e.\ a point with $y=0$. From the doubling formula, this happens precisely when $y^2=ax^2$, or $2ax^2=1+adx^4$. This has roots in \F\ if and only if its discriminant $4a^2-4ad$ is square, so that $a^2-ad$ is square.
If $(x_2,y_2) = 2\cdot(x_1,y_1)$ is an even point in $E_{a,d}$, then $(1-ax_2^2)$ is a quadratic residue in \F. \todo{$(y_2^2-1)$}.
The doubling formula has $$x_2 = \frac{2x_1 y_1}{y_1^2+ax_1^2}$$
so that $$1-ax_2^2 = \left(\frac{y_1^2-ax_1^2}{y_1^2+ax_1^2}\right)^2$$
is a quadratic residue. Now for any point $(x,y)\in E_{a,d}$, we have
= y^2+ax^2-1-ax^2y^2
= (d-a)x^2y^2
which is a quadratic residue by Lemma~\ref{lemma:dma}.
\section{The Espresso groups}
Let $E$ be a complete twisted Edwards curve with $a\in\{\pm1\}$ and cofactor $4$ or $8$. We describe the \textit{Espresso} group $\G(E)$ as
$$\text{Espresso}(E) := 2E / E_{h/2}$$
This group has prime order $q$.
\subsection{Group law}
The group law on $\text{Espresso}(E)$ is the same as that on $E$.
Two elements $P_1 := (x_1,y_1)$ and $P_2 := (x_2,y_2)$ in $\text{Espresso}(E)$ are equal if they differ by an element of $E_{h/2}$.
If $h=4$, the points are equal if $P_1-P_2\in E_2$. By Lemma~\ref{lemma:line}, this is equivalent to $$x_1 y_2 = x_2 y_1$$
If $h=8$, the points are equal if $P_1-P_2\in E_4$. By Lemmas~\ref{lemma:tors} and~\ref{lemma:line}, this is equivalent to $$x_1 y_2 = x_2 y_1\text{\ \ or\ \ }x_1 x_2 = -a y_1 y_2$$
These equations are homogeneous, so they may be evaluated in projective homogeneous form with $X_i$ and $Y_i$ in place of $x_i$ and $y_i$
We now describe how to encode a point $P = (x,y)$ to bytes. The requirements of encoding are that
\item Any point $P\in2E$ can be encoded.
\item Two points $P,Q$ have the same encoding if and only if $P-Q\in E_{h/2}$.
When $h=4$, we encode a point as $\sqrt{a(y-1)/(y+1)}$
\ No newline at end of file
Have (1-ydbl)/(1+ydbl)
= (y^2-1)/(ax^2-1)
Have (y^2-1)*(ax^2-1) = (a-d) x^2 y^2
==> (1-ydbl)/(1+ydbl) has same parity as a-d
No points at infinity => d nonsqr, ad nonsqr -> a sqr.
Point of order 8: ax^2=y^2
2y^2 = 1+day^4
product of roots = 1/ad = nonsquare, so one will be square (if no point at infty)
b^2-4ac = 4(1-ad) -> 1-ad square iff point of order 8 exists
If a^2 = 1, then 1-ad = a(a-d)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment