From 78d9e70071878b0f7ed0c45c26a1d890c1ce3a17 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Fri, 17 Nov 2017 14:39:16 -0800 Subject: [PATCH] Move ExtendedPoint->MontgomeryPoint conversion to edwards.rs Need to find a solution to the internal/external docs problem --- src/curve_models/mod.rs | 70 --------------------------------------- src/edwards.rs | 72 +++++++++++++++++++++++++++++++++++++++-- 2 files changed, 69 insertions(+), 73 deletions(-) diff --git a/src/curve_models/mod.rs b/src/curve_models/mod.rs index ba1e9e2..7364c2a 100644 --- a/src/curve_models/mod.rs +++ b/src/curve_models/mod.rs @@ -77,16 +77,10 @@ use core::ops::{Add, Sub, Neg}; use constants; use field::FieldElement; - use edwards::ExtendedPoint; -use edwards::CompressedEdwardsY; -use montgomery::MontgomeryPoint; - use subtle::ConditionallyAssignable; - use traits::ValidityCheck; - // ------------------------------------------------------------------------ // Internal point representations // ------------------------------------------------------------------------ @@ -235,70 +229,6 @@ impl ProjectivePoint { T: &self.X * &self.Y, } } - - /// Convert this projective point in the Edwards model to its equivalent - /// projective point on the Montgomery form of the curve. - /// - /// Taking the Montgomery curve equation in affine coordinates: - /// - ///     E_(A,B) = Bv² = u³ + Au² + u   (1) - /// - /// and given its relations to the coordinates of the Edwards model: - /// - ///     u = (1+y)/(1-y)        (2) - ///     v = (λu)/(x) - /// - /// Converting from affine to projective coordinates in the Montgomery - /// model, we arrive at: - /// - ///     u = (Z+Y)/(Z-Y)        (3) - ///     v = λ * ((Z+Y)/(Z-Y)) * (Z/X) - /// - /// The transition between affine and projective is given by - /// - ///     u → U/W        (4) - ///     v → V/W - /// - /// thus the Montgomery curve equation (1) becomes - /// - ///     E_(A,B) : BV²W = U³ + AU²W + UW² ⊆ 𝗣^2  (5) - /// - /// Here, again, to differentiate from points in the twisted Edwards model, we - /// call the point `(x,y)` in affine coordinates `(u,v)` and similarly in projective - /// space we use `(U:V:W)`. However, since (as per Montgomery's original work) the - /// v-coordinate is superfluous to the definition of the group law, we merely - /// use `(U:W)`. - /// - /// Therefore, the direct translation between projective Montgomery points - /// and projective twisted Edwards points is - /// - ///     (U:W) = (Z+Y:Z-Y) (6) - /// - /// Note, however, that there appears to be an exception where `Z=Y`, - /// since—from equation 2—this would imply that `y=1` (thus causing the - /// denominator to be zero). If this is the case, then it follows from the - /// twisted Edwards curve equation - /// - ///     -x² + y² = 1 + dx²y² (7) - /// - /// that - /// - ///     -x² + 1 = 1 + dx² - /// - /// and, assuming that `d ≠ -1`, - /// - ///     -x² = x² - /// x = 0 - /// - /// Therefore, the only valid point with `y=1` is the twisted Edwards - /// identity point, which correctly becomes `(1:0)`, that is, the identity, - /// in the Montgomery model. - pub fn to_montgomery(&self) -> MontgomeryPoint { - MontgomeryPoint{ - U: &self.Z + &self.Y, - W: &self.Z - &self.Y, - } - } } impl CompletedPoint { diff --git a/src/edwards.rs b/src/edwards.rs index b2fb397..7fff8d8 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -269,10 +269,76 @@ impl ExtendedPoint { } } - /// Convert this point to its equivalent on the Montgomery form of the - /// curve. + /// Convert this `ExtendedPoint` on the Edwards model to the + /// corresponding `MontgomeryPoint` on the Montgomery model. + /// + /// Note that this is a one-way conversion, since the Montgomery + /// model does not retain sign information. + /// + // XXX need to figure out how to keep this in internal docs, and + // also to rewrite it to use tex + // + // # Implementation notes + // + // Taking the Montgomery curve equation in affine coordinates: + // + //     E_(A,B) = Bv² = u³ + Au² + u   (1) + // + // and given its relations to the coordinates of the Edwards model: + // + //     u = (1+y)/(1-y)        (2) + //     v = (λu)/(x) + // + // Converting from affine to projective coordinates in the Montgomery + // model, we arrive at: + // + //     u = (Z+Y)/(Z-Y)        (3) + //     v = λ * ((Z+Y)/(Z-Y)) * (Z/X) + // + // The transition between affine and projective is given by + // + //     u → U/W        (4) + //     v → V/W + // + // thus the Montgomery curve equation (1) becomes + // + //     E_(A,B) : BV²W = U³ + AU²W + UW² ⊆ 𝗣^2  (5) + // + // Here, again, to differentiate from points in the twisted Edwards model, we + // call the point `(x,y)` in affine coordinates `(u,v)` and similarly in projective + // space we use `(U:V:W)`. However, since (as per Montgomery's original work) the + // v-coordinate is not required to perform scalar multiplication, we merely + // use `(U:W)`. + // + // Therefore, the direct translation between projective Montgomery points + // and projective twisted Edwards points is + // + //     (U:W) = (Z+Y:Z-Y) (6) + // + // Note, however, that there appears to be an exception where `Z=Y`, + // since—from equation 2—this would imply that `y=1` (thus causing the + // denominator to be zero). If this is the case, then it follows from the + // twisted Edwards curve equation + // + //     -x² + y² = 1 + dx²y² (7) + // + // that + // + //     -x² + 1 = 1 + dx² + // + // and, assuming that `d ≠ -1`, + // + //     -x² = x² + // x = 0 + // + // Therefore, the only valid point with `y=1` is the twisted Edwards + // identity point, which correctly becomes `(1:0)`, that is, the identity, + // in the Montgomery model. pub fn to_montgomery(&self) -> MontgomeryPoint { - self.to_projective().to_montgomery() + MontgomeryPoint{ + U: &self.Z + &self.Y, + W: &self.Z - &self.Y, + } } /// Compress this point to `CompressedEdwardsY` format.