From 869a464927a0c38b3e902821253fb048eeacdaa7 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Fri, 27 Jul 2018 10:56:02 -0700 Subject: [PATCH 01/13] Fix unbumped version number This is too late for the 0.19.0 release (I missed it because I grepped for "0.18.", and the version in the README doesn't specify a minor version), but it will now be in line with the other version strings. When we put out the 1.0.0-pre.0 release we can change both together (our docs already say we've released it, because we inserted an extra version, oops). --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f241f81..e0ff3c3 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ make doc-internal To import `curve25519-dalek`, add the following to the dependencies section of your project's `Cargo.toml`: ```toml -curve25519-dalek = "^0.18" +curve25519-dalek = "0.19" ``` Then import the crate as: ```rust,no_run From 47d85103d3ce35791309dff07ecee304bcaf1f55 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Fri, 3 Aug 2018 11:00:29 -0700 Subject: [PATCH 02/13] Add note on FFI to README.md Closes #182. --- README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/README.md b/README.md index f241f81..22c5822 100644 --- a/README.md +++ b/README.md @@ -147,6 +147,22 @@ cargo bench --no-default-features --features "std avx2_backend" Performance is a secondary goal behind correctness, safety, and clarity, but we aim to be competitive with other implementations. +# FFI + +Unfortunately, we have no plans to add FFI to `curve25519-dalek` directly. The +reason is that we use Rust features to provide an API that maintains safety +invariants, which are not possible to maintain across an FFI boundary. For +instance, as described in the _Safety_ section above, invalid points are +impossible to construct, and this would not be the case if we exposed point +operations over FFI. + +However, `curve25519-dalek` is designed as a *mid-level* API, aimed at +implementing other, higher-level primitives. Instead of providing FFI at the +mid-level, our suggestion is to implement the higher-level primitive (a +signature, PAKE, ZKP, etc) in Rust, using `curve25519-dalek` as a dependency, +and have that crate provide a minimal, byte-buffer-oriented FFI specific to +that primitive. + # Contributing Please see [CONTRIBUTING.md][contributing]. From 0c8a046340e3005cd4d87e3a86593ce5f38a5d16 Mon Sep 17 00:00:00 2001 From: Isis Lovecruft Date: Wed, 15 Aug 2018 21:15:11 +0000 Subject: [PATCH 03/13] Cleanup and comment Ristretto decoding to match explicit formulae. --- src/ristretto.rs | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/src/ristretto.rs b/src/ristretto.rs index ea54d27..92c0b39 100644 --- a/src/ristretto.rs +++ b/src/ristretto.rs @@ -242,24 +242,30 @@ impl CompressedRistretto { return None; } - // Step 2. The rest. (XXX write comments) + // Step 2. Compute (X:Y:Z:T). let one = FieldElement::one(); let ss = s.square(); - let yden = &one + &ss; // 1 - a*s^2 - let ynum = &one - &ss; // 1 + a*s^2 - let yden_sqr = yden.square(); - let xden_sqr = &(&(-&constants::EDWARDS_D) * &ynum.square()) - &yden_sqr; + let u1 = &one + &ss; // 1 - as² where a=-1 + let u2 = &one - &ss; // 1 + as² + let u1_sqr = u1.square(); // (1 + as²)² - let (ok, invsqrt) = (&xden_sqr * &yden_sqr).invsqrt(); + // v == ad(1-as²)² - (1+as²)² where d=-121665/121666 + let v = &(&(-&constants::EDWARDS_D) * &u2.square()) - &u1_sqr; - let xden_inv = &invsqrt * &yden; - let yden_inv = &invsqrt * &(&xden_inv * &xden_sqr); + let (ok, I) = (&v * &u1_sqr).invsqrt(); // 1/sqrt(vu1²) - let mut x = &(&s + &s) * &xden_inv; // 2*s*xden_inv - let x_is_negative = x.is_negative(); - x.conditional_negate(x_is_negative); - let y = &ynum * &yden_inv; + let Dx = &I * &u1; // 1/sqrt(v) + let Dy = &I * &(&Dx * &v); // 1/u2 + // x == | 2s/sqrt(v) | == + sqrt(4s²/(ad(1+as²)² - (1-as²)²)) + let mut x = &(&s + &s) * &Dx; + let x_neg = x.is_negative(); + x.conditional_negate(x_neg); + + // y == (1-as²)/(1+as²) + let y = &u2 * &Dy; + + // t == ((1+as²) sqrt(4s²/(ad(1+as²)² - (1-as²)²)))/(1-as²) let t = &x * &y; if ok.unwrap_u8() == 0u8 || t.is_negative().unwrap_u8() == 1u8 || y.is_zero().unwrap_u8() == 1u8 { From acceea04f6d94dde140d2f1c445f9e0970959002 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Mon, 27 Aug 2018 11:46:19 -0700 Subject: [PATCH 04/13] Bump byteorder version to avoid breaking on stable As pointed out by @ruuda: > This is more of a problem with `#[feature]` in Rust; once a feature becomes > stable, having `#[feature]` becomes an error, so it is not easy to depend on a > feature on nightly, and then have the same code work on stable once the feature > is stabilized. The earliest `byteorder` version without a `#[feature]` is `1.2.3`, so we require any higher version than that one. Closes #184. Closes #186. --- Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 0976cdf..6ebd786 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -42,7 +42,7 @@ harness = false [dependencies] rand = { version = "0.5", default-features = false } -byteorder = { version = "1", default-features = false, features = ["i128"] } +byteorder = { version = "^1.2.3", default-features = false, features = ["i128"] } digest = "0.7" generic-array = "0.9" clear_on_drop = "=0.2.3" @@ -52,7 +52,7 @@ packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } [build-dependencies] rand = { version = "0.5", default-features = false } -byteorder = { version = "1", default-features = false, features = ["i128"] } +byteorder = { version = "^1.2.3", default-features = false, features = ["i128"] } digest = "0.7" generic-array = "0.9" clear_on_drop = "=0.2.3" From bed5aa00c5b22873ed9e7a5ec3b2f9d2c886e05c Mon Sep 17 00:00:00 2001 From: Isis Lovecruft Date: Wed, 5 Sep 2018 03:19:58 +0000 Subject: [PATCH 05/13] Bump subtle dependency version to 0.9.0. --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 6ebd786..7a71c8b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -46,7 +46,7 @@ byteorder = { version = "^1.2.3", default-features = false, features = ["i128"] digest = "0.7" generic-array = "0.9" clear_on_drop = "=0.2.3" -subtle = { version = "0.7", features = ["generic-impls"], default-features = false } +subtle = { version = "0.9", default-features = false } serde = { version = "1.0", optional = true } packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } From 819a85ef1885ec8fb24a5d12a37bdba9e78590d2 Mon Sep 17 00:00:00 2001 From: Isis Lovecruft Date: Thu, 13 Sep 2018 22:44:41 +0000 Subject: [PATCH 06/13] Fix a typo in the curve model docs. --- src/curve_models/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/curve_models/mod.rs b/src/curve_models/mod.rs index d2ded64..3f68132 100644 --- a/src/curve_models/mod.rs +++ b/src/curve_models/mod.rs @@ -97,7 +97,7 @@ //! output of an addition or doubling always lies in \\( \mathbb P\^1 \times //! \mathbb P\^1\\), and the choice of which formula to use is replaced //! by a choice of whether to convert the result to \\( \mathbb P\^2 \\) -//! or \\(\mathbb P\^2 \\). However, this tweak is not described in +//! or \\(\mathbb P\^3 \\). However, this tweak is not described in //! their paper, only in their software. //! //! Our naming for the `CompletedPoint` (\\(\mathbb P\^1 \times \mathbb From 7d29b862173df16ce779f55ce041e1d62766dae6 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Thu, 13 Sep 2018 23:35:57 -0700 Subject: [PATCH 07/13] Update packed_simd version --- Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 7a71c8b..25e34c9 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -48,7 +48,7 @@ generic-array = "0.9" clear_on_drop = "=0.2.3" subtle = { version = "0.9", default-features = false } serde = { version = "1.0", optional = true } -packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } +packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } [build-dependencies] rand = { version = "0.5", default-features = false } @@ -58,7 +58,7 @@ generic-array = "0.9" clear_on_drop = "=0.2.3" subtle = { version = "0.7", features = ["generic-impls"], default-features = false } serde = { version = "1.0", optional = true } -packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } +packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } [features] nightly = ["subtle/nightly", "clear_on_drop/nightly"] From 10d8436f0d1b3e3c213a71773bfb5a11e41d7666 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Thu, 13 Sep 2018 23:35:57 -0700 Subject: [PATCH 08/13] Update packed_simd version --- Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 0976cdf..a346376 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -48,7 +48,7 @@ generic-array = "0.9" clear_on_drop = "=0.2.3" subtle = { version = "0.7", features = ["generic-impls"], default-features = false } serde = { version = "1.0", optional = true } -packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } +packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } [build-dependencies] rand = { version = "0.5", default-features = false } @@ -58,7 +58,7 @@ generic-array = "0.9" clear_on_drop = "=0.2.3" subtle = { version = "0.7", features = ["generic-impls"], default-features = false } serde = { version = "1.0", optional = true } -packed_simd = { version = "0.1.0", features = ["into_bits"], optional = true } +packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } [features] nightly = ["subtle/nightly", "clear_on_drop/nightly"] From 59e06c543e7e865be5aa5bdf1b1e84b0ba74598b Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Fri, 27 Jul 2018 10:56:02 -0700 Subject: [PATCH 09/13] Fix unbumped version number This is too late for the 0.19.0 release (I missed it because I grepped for "0.18.", and the version in the README doesn't specify a minor version), but it will now be in line with the other version strings. When we put out the 1.0.0-pre.0 release we can change both together (our docs already say we've released it, because we inserted an extra version, oops). --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f241f81..e0ff3c3 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ make doc-internal To import `curve25519-dalek`, add the following to the dependencies section of your project's `Cargo.toml`: ```toml -curve25519-dalek = "^0.18" +curve25519-dalek = "0.19" ``` Then import the crate as: ```rust,no_run From f95806e00dc29618d574bd2ef4ec59837877e0c4 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Mon, 17 Sep 2018 12:33:24 -0700 Subject: [PATCH 10/13] Bump version to 0.19.1 This fixes the AVX2 build on nightly. --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index a346376..69b45b6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "curve25519-dalek" -version = "0.19.0" +version = "0.19.1" authors = ["Isis Lovecruft ", "Henry de Valence "] readme = "README.md" From 27a9b9940db3d9d06f447dce16b14e0077476bb9 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Tue, 25 Sep 2018 17:02:46 -0700 Subject: [PATCH 11/13] Update subtle to stable 1.0 --- Cargo.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 25e34c9..aa6d5e6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -46,7 +46,7 @@ byteorder = { version = "^1.2.3", default-features = false, features = ["i128"] digest = "0.7" generic-array = "0.9" clear_on_drop = "=0.2.3" -subtle = { version = "0.9", default-features = false } +subtle = { version = "1", default-features = false } serde = { version = "1.0", optional = true } packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } @@ -56,7 +56,7 @@ byteorder = { version = "^1.2.3", default-features = false, features = ["i128"] digest = "0.7" generic-array = "0.9" clear_on_drop = "=0.2.3" -subtle = { version = "0.7", features = ["generic-impls"], default-features = false } +subtle = { version = "1", default-features = false } serde = { version = "1.0", optional = true } packed_simd = { version = "0.3.0", features = ["into_bits"], optional = true } From 2c70cf2c8fcbba6bd0b1c5f66650e3cf892776a8 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Tue, 25 Sep 2018 17:06:04 -0700 Subject: [PATCH 12/13] this was delayed, add it back later --- README.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/README.md b/README.md index e699da4..833d3c1 100644 --- a/README.md +++ b/README.md @@ -26,11 +26,6 @@ prime-order group from a non-prime-order Edwards curve. This provides the speed and safety benefits of Edwards curve arithmetic, without the pitfalls of cofactor-related abstraction mismatches. -## Stability - -We have recently released a `1.0.0-pre.0` version of `curve25519-dalek` and -would greatly appreciate testing and feedback on our API and performance. - # Documentation The semver-stable, public-facing `curve25519-dalek` API is documented From b0658b05f86ef51683d75ff274d48a2209f9cf91 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Tue, 25 Sep 2018 17:21:10 -0700 Subject: [PATCH 13/13] Bump version --- Cargo.toml | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 34450d1..b50c9fb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "curve25519-dalek" -version = "0.19.1" +version = "0.20.0" authors = ["Isis Lovecruft ", "Henry de Valence "] readme = "README.md" diff --git a/README.md b/README.md index 833d3c1..3d2c328 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ make doc-internal To import `curve25519-dalek`, add the following to the dependencies section of your project's `Cargo.toml`: ```toml -curve25519-dalek = "0.19" +curve25519-dalek = "0.20" ``` Then import the crate as: ```rust,no_run