saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-03 20:13:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Start writing down some notes on the compression procedure

Browse source
This commit is contained in:
Henry de Valence 2017-07-23 20:47:04 -07:00 committed by Henry de Valence
parent 98c34adf6d
commit 8e21c0b4f0
3 changed files with 455 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Makefile Normal file
View file

@ -0,0 +1,3 @@
doc:
cargo rustdoc --features "nightly yolocrypto" -- --html-in-header katex-header.html

10
katex-header.html Normal file
View file

@ -0,0 +1,10 @@
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.8.3/katex.min.css" integrity="sha384-B41nY7vEWuDrE9Mr+J2nBL0Liu+nl/rBXTdpQal730oTHdlrlXHzYMOhDU60cwde" crossorigin="anonymous">
<script src="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.8.3/katex.min.js" integrity="sha384-L9gv4ooDLrYwW0QCM6zY3EKSSPrsuUncpx26+erN0pJX4wv1B1FzVW1SvpcJPx/8" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/KaTeX/0.8.3/contrib/auto-render.min.js" integrity="sha384-RkgGHBDdR8eyBOoWeZ/vpGg1cOvSAJRflCUDACusAAIVwkwPrOUYykglPeqWakZu" crossorigin="anonymous"></script>
<script>
document.addEventListener("DOMContentLoaded", function() { renderMathInElement(document.body); });
</script>
<style>
.katex { font-size: 1em !important; }
.docblock code, .dockblock-short code { font-size: 0.85em !important; }
</style>

460
src/ristretto.rs
View file

@ -8,12 +8,377 @@
// - Isis Agora Lovecruft <isis@patternsinthevoid.net>
// - Henry de Valence <hdevalence@hdevalence.ca>
//! An implementation of Mike Hamburg's Ristretto cofactor-eliminating
//! point-compression scheme, providing a prime-order group on top of
//! Curve25519.
//! An implementation of Ristretto, which provides a prime-order group.
//!
//! Ristretto is a modification of Mike Hamburg's [Decaf
//! cofactor-eliminating point-compression
//! scheme](https://eprint.iacr.org/2015/673.pdf) to work on top of the
//! Curve25519 group.
//!
//! Note: this code is currently feature-gated with the `yolocrypto`
//! feature flag, because our implementation is still unfinished.
//!
//! # Notes on Ristretto
//!
//! ## Decaf
//!
//! The introduction of the Decaf paper, [_Decaf: Eliminating cofactors
//! through point compression_](https://eprint.iacr.org/2015/673.pdf)
//! notes that while most cryptographic systems require a group of prime
//! order, most concrete implementations using elliptic curve groups
//! fall short -- they either provide a group of prime order, but with
//! incomplete or variable-time addition formulae (for instance, most
//! Weierstrass models), or else they provide a fast and safe
//! implementation of a group whose order is not quite a prime \\(q\\),
//! but \\(hq\\) for a small cofactor \\(h\\) (for instance, Edwards
//! curves, which have cofactor at least \\(4\\)).
//!
//! This abstraction mismatch requires ad-hoc protocol modifications to
//! ensure security; these modifications require careful analysis and
//! are a recurring source of vulnerabilities.
//!
//! The Decaf suggestion is to use a quotient group, such as \\(\mathcal
//! E / \mathcal E[4]\\) or \\(2 \mathcal E / \mathcal E[2] \\), to
//! implement a prime-order group.
//!
//! This requires only changing
//!
//! 1. the function for equality checking (so that two representatives
//! of the same coset are considered equal);
//! 2. the function for encoding (so that two representatives of the
//! same coset are encoded as identical bitstrings);
//! 3. the function for decoding (so that only the canonical encoding of
//! a coset is accepted).
//!
//! Internally, each coset is represented by a curve point; two points
//! may represent the same coset in the same way that two points with
//! different \\(X,Y,Z\\) coordinates may represent the same point. The
//! group operations are carried out using the fast, safe Edwards
//! formulas.
//!
//! The Decaf paper suggests implementing the compression and
//! decompression routines using an isogeny from a Jacobi quartic; for
//! curves of cofactor \\(4\\), this eliminates the cofactor, and
//! explains the name: Decaf is named "after the procedure which divides
//! the effect of coffee by \\(4\\)". However, Curve25519 has a
//! cofactor of \\(8\\). To eliminate its cofactor, we tweak Decaf to
//! restrict further. This gives the
//! [Ristretto](https://en.wikipedia.org/wiki/Ristretto) encoding.
//!
//! ## The Jacobi Quartic
//!
//! The Jacobi quartic is parameterized by \\(e, A\\), and is of the
//! form $$ \mathcal J\_{e,A} : t\^2 = es\^4 + 2As\^2 + 1, $$ with
//! identity point \\((0,1)\\). For more details on the Jacobi quartic,
//! see the [Decaf paper](https://eprint.iacr.org/2015/673.pdf) or
//! [_Jacobi Quartic Curves
//! Revisited_](https://eprint.iacr.org/2009/312.pdf) by Hisil, Wong,
//! Carter, and Dawson).
//!
//! When \\(e = a\^2\\), \\(\mathcal J\_{e,A}\\) has full
//! \\(2\\)-torsion (i.e., \\(\mathcal J[2] \cong \mathbb Z /2 \times
//! \mathbb Z/2\\)), and
//! we can write the \\(\mathcal J[2]\\)-coset of a point \\(P =
//! (s,t)\\) as
//! $$
//! P + \mathcal J[2] = \left\\{
//! (s,t),
//! (-s,-t),
//! (1/as, -t/as\^2),
//! (-1/as, t/as\^2) \right\\}.
//! $$
//! Notice that replacing \\(a\\) by \\(-a\\) just swaps the last two
//! points, so this set does not depend on the choice of \\(a\\). In
//! what follows we require \\(a = \pm 1\\).
//!
//! ## Encoding \\(\mathcal J / \mathcal J[2]\\)
//!
//! To encode points on \\(\mathcal J\\) modulo \\(\mathcal J[2]\\),
//! we need to choose a canonical representative of the above coset.
//! To do this, it's sufficient to make two independent sign choices:
//! the Decaf paper suggests choosing \\((s,t)\\) with \\(s\\)
//! non-negative and finite, and \\(t/s\\) non-negative or infinite.
//!
//! The encoding is then the (canonical byte encoding of the)
//! \\(s\\)-value of the canonical representative.
//!
//! ## The Edwards Curve
//!
//! Our primary internal model for Curve25519 points are the [_Extended
//! Twisted Edwards Coordinates_](https://eprint.iacr.org/2008/522.pdf)
//! of Hisil, Wong, Carter, and Dawson.
//! These correspond to the affine model
//!
//! $$\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.$$
//!
//! In projective coordinates, we represent a point as \\((X:Y:Z:T)\\)
//! with $$XY = ZT, \quad aX\^2 + Y\^2 = Z\^2 + dT\^2.$$ (For more
//! details on this model, see the documentation for the `edwards`
//! module). The case \\(a = 1\\) is the _untwisted_ case; we only
//! consider \\(a = \pm 1\\), and in particular we focus on the twisted
//! Edwards form of Curve25519, which has \\(a = -1, d =
//! -121665/121666\\). When not otherwise specified, we write
//! \\(\mathcal E\\) for \\(\mathcal E\_{-1, -121665/121666}\\).
//!
//! When both \\(d\\) and \\(ad\\) are nonsquare (which forces \\(a\\)
//! to be square), the curve is *complete*. In this case the
//! four-torsion subgroup is cyclic, and we
//! can write it explicitly as
//! $$
//! \mathcal E\_{a,d}[4] = \\{ (0,1),\; (1/\sqrt a, 0),\; (0, -1),\; (-1/\sqrt{a}, 0)\\}.
//! $$
//! These are the only points with \\(xy = 0\\); the points with \\( y
//! \neq 0 \\) are \\(2\\)-torsion. The \\(\mathcal
//! E\_{a,d}[4]\\)-coset of \\(P = (x,y)\\) is then
//! $$
//! P + \mathcal E\_{a,d}[4] = \\{ (x,y),\; (y/\sqrt a, -x\sqrt a),\; (-x, -y),\; (-y/\sqrt a, x\sqrt a)\\}.
//! $$
//! Notice that if \\(xy \neq 0 \\), then exactly two of
//! these points have \\( xy \\) non-negative, and they differ by the
//! \\(2\\)-torsion point \\( (0,-1) \\). This means that we can select
//! a representative modulo \\(\mathcal
//! E\_{a,d}[2] \\) by requiring \\(xy\\) nonnegative and \\(y \neq
//! 0\\), and we can ensure this condition by conditionally adding a
//! \\(4\\)-torsion point if \\(xy\\) is negative or \\(y = 0\\).
//!
//! This procedure gives a canonical lift from \\(\mathcal E / \mathcal
//! E[4]\\) to \\(\mathcal E / \mathcal E[2]\\). Since it involves a
//! conditional rotation, we refer to it as *torquing* the point.
//!
//! The structure of the Curve25519 group is \\( \mathcal E(\mathbb
//! F\_p) \cong \mathbb Z / 8 \times \mathbb Z / \ell\\), where \\( \ell
//! = 2\^{252} + \cdots \\) is a large prime. Because \\(\mathcal E[8]
//! \cong \mathbb Z / 8\\), we have \\(\[2\](\mathcal E[8]) = \mathcal
//! E[4]\\), \\(\mathcal E[4] \cong \mathbb Z / 4
//! \\) and \\( \mathcal E[2] \cong \mathbb Z / 2\\). In particular
//! this tells us that the group
//! $$
//! \frac{\[2\](\mathcal E)}{\mathcal E[4]}
//! $$
//! is well-defined and has prime order \\( (8\ell / 2) / 4 = \ell \\).
//! This is the group we will construct using Ristretto.
//!
//! ## The Isogeny
//!
//! For \\(a = \pm 1\\), we have a \\(2\\)-isogeny
//! $$
//! \theta\_{a,d} : \mathcal J\_{a\^2, -a(a+d)/(a-d)} \longrightarrow \mathcal E\_{a,d}
//! $$
//! (or simply \\(\theta\\)) defined by
//! $$
//! \theta\_{a,d} : (s,t) \mapsto \left( \frac{1}{\sqrt{ad-1}} \cdot \frac{2s}{t},\quad \frac{1+as\^2}{1-as\^2} \right).
//! $$
//!
//! XXX Its dual is ... ?
//!
//! The kernel of the isogeny is \\( \{(0, \pm 1)\} \\).
//! The image of the isogeny is \\(\[2\](\mathcal E)\\). To see this,
//! first note that because \\( \theta \circ \hat{\theta} = [2] \\), we
//! know that \\( \[2\](\mathcal E) \subseteq \theta(\mathcal J)\\); then, to see that
//! \\(\theta(\mathcal J)\\) is exactly \\(\[2\](\mathcal E)\\),
//! recall that isogenous elliptic curves over a finite field have the
//! same number of points (exercise 5.4 of Silverman), so that
//! $$
//! \\# \theta(\mathcal J) = \frac {\\# \mathcal J} {\\# \ker \theta}
//! = \frac {\\# \mathcal E}{2} = \\# \[2\](\mathcal E).
//! $$
//!
//! To determine the image \\(\theta(\mathcal J[2])\\) of the
//! \\(2\\)-torsion, we consider the image of the coset \\(\theta((s,t)
//! + \mathcal J[2])\\). Let \\((x,y) = \theta(s,t)\\); then
//! \\(\theta(-s,-t) = (x,y)\\) and \\(\theta(1/as, -t/as\^2) = (-x,
//! -y)\\), so that \\(\theta(\mathcal J[2]) = \mathcal E[2]\\).
//!
//! The Decaf paper recalls that, for a group \\( G \\) with normal
//! subgroup \\(G' \leq G\\), a group homomorphism \\( \phi : G
//! \rightarrow H \\) induces a homomorphism
//! $$
//! \bar{\phi} : \frac G {G'} \longrightarrow \frac {\phi(G)}{\phi(G')} \leq \frac {H} {\phi(G')},
//! $$
//! and that the induced homomorphism \\(\bar{\phi}\\) is injective if
//! \\( \ker \phi \leq G' \\). In our context, the kernel of
//! \\(\theta\\) is \\( \\{(0, \pm 1)\\} \leq \mathcal J[2] \\),
//! so \\(\theta\\) gives an isomorphism
//! $$
//! \frac {\mathcal J} {\mathcal J[2]}
//! \cong
//! \frac {\theta(\mathcal J)} {\theta(\mathcal J[2])}
//! \cong
//! \frac {\[2\](\mathcal E)} {\mathcal E[2]}.
//! $$
//!
//! We can use the isomorphism to transfer the encoding of \\(\mathcal
//! J / \mathcal J[2] \\) defined above to \\(\[2\](\mathcal E)/\mathcal
//! E[2]\\), by encoding the Edwards point \\((x,y)\\) using the Jacobi
//! quartic encoding of \\(\theta\^{-1}(x,y)\\).
//!
//! Since \\(\\# (\[2\](\mathcal E) / \mathcal E[2]) = (\\#\mathcal
//! E)/4\\), if \\(\mathcal E\\) has cofactor \\(4\\), we're done.
//! Otherwise, if \\(\mathcal E\\) has cofactor \\(8\\), as in the
//! Curve25519 case, we use the torquing procedure to lift \\(\mathcal E
//! / \mathcal E[4]\\) to \\(\mathcal E / \mathcal E[2]\\), and then
//! apply the encoding for \\( \[2\](\mathcal E) / \mathcal E[2] \\).
//!
//! ## The Ristretto Encoding
//!
//! We can write the above encoding/decoding procedure concretely (in affine
//! coordinates) as follows:
//!
//! ### Encoding
//!
//! On input \\( (x,y) \in \[2\](\mathcal E)\\), a representative for a
//! coset in \\( \[2\](\mathcal E) / \mathcal E[4] \\):
//!
//! 1. Check if \\( xy \\) is negative or \\( x = 0 \\); if so, torque
//! the point by setting \\( (x,y) \gets (x,y) + P_4 \\), where
//! \\(P_4\\) is a \\(4\\)-torsion point.
//!
//! 2. Check if \\(x\\) is negative or \\( y = -1 \\); if so, set
//! \\( (x,y) \gets (x,y) + (0,-1) = (-x, -y) \\).
//!
//! 3. Compute $$ s = +\sqrt {(-a) \frac {1 - y} {1 + y} }, $$ choosing
//! the positive square root.
//!
//! The output is then the (canonical) byte-encoding of \\(s\\).
//!
//! If \\(\mathcal E\\) has cofactor \\(4\\), we skip the first step,
//! since our input already represents a coset in
//! \\( \[2\](\mathcal E) / \mathcal E[2] \\).
//!
//! To see that this corresponds to the encoding procedure above, notice
//! that the first step lifts from \\( \mathcal E / \mathcal E[4] \\) to
//! \\(\mathcal E / \mathcal E[2]\\). To understand steps 2 and 3,
//! notice that the \\(y\\)-coordinate of \\(\theta(s,t)\\) is
//! $$
//! y = \frac {1 + as\^2}{1 - as\^2},
//! $$
//! so that the \\(s\\)-coordinate of \\(\theta\^{-1}(x,y)\\) has
//! $$
//! s\^2 = (-a)\frac {1-y}{1+y}.
//! $$
//! Since
//! $$
//! x = \frac 1 {\sqrt {ad - 1}} \frac {2s} {t},
//! $$
//! we also have
//! $$
//! \frac s t = x \frac {\sqrt {ad-1}} 2,
//! $$
//! so that the sign of \\(s/t\\) is determined by the sign of \\(x\\).
//!
//! Recall that to choose a canonical representative of \\( (s,t) +
//! \mathcal J[2] \\), it's sufficient to make two sign choices: the
//! sign of \\(s\\) and the sign of \\(s/t\\). Step 2 determines the
//! sign of \\(s/t\\), while step 3 computes \\(s\\) and determines its
//! sign (by choosing the positive square root). Finally, the check
//! that \\(y \neq -1\\) prevents division-by-zero when encoding the
//! identity; it falls out of the optimized formulas below.
//!
//! ### Decoding
//!
//! On input `s_bytes`, decoding proceeds as follows:
//!
//! 1. Decode `s_bytes` to \\(s\\); reject if `s_bytes` is not the
//! canonical encoding of \\(s\\).
//!
//! 2. Check whether \\(s\\) is negative; if so, reject.
//!
//! 3. Compute
//! $$
//! y \gets \frac {1 + as\^2}{1 - as\^2}.
//! $$
//!
//! 4. Compute
//! $$
//! x \gets +\sqrt{ \frac{4s\^2} {ad(1+as\^2)\^2 - (1-as\^2)\^2}},
//! $$
//! choosing the positive square root, or reject if the square root does
//! not exist.
//!
//! 5. Check whether \\(xy\\) is negative or \\(y = 0\\); if so, reject.
//!
//! ## Encoding in Extended Coordinates
//!
//! The formulas above are given in affine coordinates, but the usual
//! internal representation is extended twisted Edwards coordinates \\(
//! (X:Y:Z:T) \\) with \\( x = X/Z \\), \\(y = Y/Z\\), \\(xy = T/Z \\).
//! Selecting the distinguished representative of the coset
//! requires the affine coordinates \\( (x,y) \\), and computing \\( s
//! \\) requires an inverse square root.
//! As inversions are expensive, we'd like to be able to do this
//! whole computation with only one inverse square root, by batching
//! together the inversion and the inverse square root.
//!
//! However, it is not obvious how to do this, since the inverse square
//! root computation depends on the affine coordinates (which select the
//! distinguished representative).
//!
//! In what follows we consider only the case
//! \\(a = -1\\); a similar argument applies to the case \\( a = 1\\).
//!
//! Since \\(y = Y/Z\\), in extended coordinates the formula for \\(s\\) becomes
//! $$
//! s = \sqrt{ \frac{ 1 - Y/Z}{1+Y/Z}} = \sqrt{\frac{Z - Y}{Z+Y}}
//! = \frac {Z - Y} {\sqrt{Z\^2 - Y\^2}}.
//! $$
//!
//! Here \\( (X:Y:Z:T) \\) are the coordinates of the distinguished
//! representative of the coset.
//! Write \\( (X\_0 : Y\_0 : Z\_0 : T\_0) \\)
//! for the coordinates of the initial representative. Then the
//! torquing procedure in step 1 replaces \\( (X\_0 : Y\_0 : Z\_0 :
//! T\_0) \\) by \\( (iY\_0 : iX\_0 : Z\_0 : -T\_0) \\). This means we
//! want to obtain either
//! $$
//! \frac {1} { \sqrt{Z\_0\^2 - Y\_0\^2}}
//! \quad \text{or} \quad
//! \frac {1} { \sqrt{Z\_0\^2 + X\_0\^2}}.
//! $$
//!
//! We can relate these using the identity
//! $$
//! (a-d)X\^2Y\^2 = (Z\^2 - aX\^2)(Z\^2 - Y\^2),
//! $$
//! which is valid for all curve points. To see this, recall from the curve equation that
//! $$
//! -dX\^2Y\^2 = Z\^4 - aZ\^2X\^2 - Z\^2Y\^2,
//! $$
//! so that
//! $$
//! (a-d)X\^2Y\^2 = Z\^4 - aZ\^2X\^2 - Z\^2Y\^2 + aX\^2Y\^2 = (Z\^2 - Y\^2)(Z\^2 + X\^2).
//! $$
//!
//! The encoding procedure is as follows:
//!
//! 1. \\(u\_1 \gets (Z\_0 + Y\_0)(Z\_0 - Y\_0) = Z\_0\^2 - Y\_0\^2 \\)
//! 2. \\(u\_2 \gets X\_0 Y\_0 \\)
//! 3. \\(I \gets \mathrm{invsqrt}(u\_1 u\_2\^2) = 1/\sqrt{X\_0\^2 Y\_0\^2 (Z\_0\^2 - Y\_0\^2)} \\)
//! 4. \\(D\_1 \gets u\_1 I = \sqrt{(Z\_0\^2 - Y\_0\^2)/(X\_0\^2 Y\_0\^2)} \\)
//! 5. \\(D\_2 \gets u\_2 I = \pm \sqrt{1/(Z\_0\^2 - Y\_0\^2)} \\)
//! 6. \\(Z\_{inv} \gets D\_1 D\_2 T\_0 = (u\_1 u\_2)/(u\_1 u\_2\^2) T\_0 = T\_0 / X\_0 Y\_0 = 1/Z\_0 \\)
//! 7. If \\( T\_0 Z\_{inv} = x\_0 y\_0 \\) is negative:
//! 1. \\( X \gets iY\_0 \\)
//! 2. \\( Y \gets iX\_0 \\)
//! 3. \\( D \gets D\_1 / \sqrt{a-d} = 1/\sqrt{Z\_0\^2 + X\_0\^2} \\)
//! 8. Otherwise:
//! 1. \\( X \gets X\_0 \\)
//! 2. \\( Y \gets Y\_0 \\)
//! 3. \\( D \gets D\_2 = \pm \sqrt{1/(Z\_0\^2 - Y\_0\^2)} \\)
//! 9. If \\( X Z\_{inv} = x \\) is negative, set \\( Y \gets - Y\\)
//! 10. Compute \\( s \gets (Z - Y) D = (Z - Y) / \sqrt{Z\^2 - Y\^2} \\) and return.
//!
//! ## Decoding to Extended Coordinates
//!
//! ## Equality Testing
//!
//! ## Elligator
//!
//! ## The Double-Ristretto Encoding
//!
//! It's possible to do batch encoding of \\( [2]P \\) using the dual
//! isogeny \\(\hat{\theta}\\). Defer this for now.
//!
//! ## ???
// We allow non snake_case names because coordinates in projective space are
// traditionally denoted by the capitalisation of their respective
@ -93,9 +458,10 @@ impl CompressedRistretto {
}
// Step 2. The rest. (XXX write comments)
let one = FieldElement::one();
let ss = s.square();
let yden = &FieldElement::one() + &ss;
let ynum = &FieldElement::one() - &ss;
let yden = &one + &ss; // 1 - a*s^2
let ynum = &one - &ss; // 1 + a*s^2
let yden_sqr = yden.square();
let xden_sqr = &(&(-&constants::d) * &ynum.square()) - &yden_sqr;
@ -104,19 +470,17 @@ impl CompressedRistretto {
let xden_inv = &invsqrt * &yden;
let yden_inv = &invsqrt * &(&xden_inv * &xden_sqr);
let mut x = &(&s + &s) * &xden_inv;
let mut x = &(&s + &s) * &xden_inv; // 2*s*xden_inv
let x_is_negative = x.is_negative_ed25519();
x.conditional_negate(x_is_negative);
let y = &ynum * &yden_inv;
let t = &x * &y;
if ok == 0u8 || t.is_negative_ed25519() == 1u8 || x.is_zero() == 1u8 {
if ok == 0u8 || t.is_negative_ed25519() == 1u8 || y.is_zero() == 1u8 {
return None;
} else {
return Some(RistrettoPoint(ExtendedPoint{
X: x, Y: y, Z: FieldElement::one(), T: t
}));
return Some(RistrettoPoint(ExtendedPoint{X: x, Y: y, Z: one, T: t}));
}
}
}
@ -186,24 +550,86 @@ impl<'de> Deserialize<'de> for RistrettoPoint {
// Internal point representations
// ------------------------------------------------------------------------
/// A point in a prime-order group.
/// A `RistrettoPoint` represents a point in the Ristretto group for
/// Curve25519. Ristretto, a variant of Decaf, constructs a
/// prime-order group as a quotient group of a subgroup of (the
/// Edwards form of) Curve25519.
///
/// XXX think about how this API should work
/// Internally, a `RistrettoPoint` is a wrapper type around
/// `ExtendedPoint`, with custom equality, compression, and
/// decompression routines to account for the quotient.
#[derive(Copy, Clone)]
pub struct RistrettoPoint(pub ExtendedPoint);
impl RistrettoPoint {
/// Compress in Ristretto format.
///
/// # Implementation Notes
///
/// The Ristretto encoding is as follows, on input in affine coordinates `(x,y)`:
///
/// 1. If `xy` is negative or `x = 0`, "rotate" the point by
/// setting `(x,y) = (iy, ix)`.
/// 2. If `x` is negative, set `(x,y) = (-x, -y)`.
/// 3. Compute `s = +sqrt((1-y)/(1+y))`.
/// 4. Return the little-endian 32-byte encoding of `s`.
///
/// However, our input is in extended twisted Edwards coordinates
/// `(X:Y:Z:T)` with `x = X/Z`, `y = Y/Z`, `xy = T/Z` (see the
/// module-level documentation on curve representations for more
/// details). Since inversions are expensive, we'd like to be
/// able to do this whole computation with only one inversion.
///
/// Since `y = Y/Z`, in extended coordinates the formula for `s` becomes
///
///     s = sqrt((1 - Y/Z)/(1 + Y/Z)) = sqrt((Z-Y)/(Z+Y)). <span style="float: right">(1)</span>
///
/// We can compute this as
///
///     s = (Z - Y) / sqrt((Z-Y)(Z+Y)). <span style="float: right">(1)</span>
///
/// The denominator is
///
///     invsqrt((Z-Y)(Z+Y)) = invsqrt(Z² - Y²). <span style="float: right">(1)</span>
///
/// Write the input point as `(X₀:Y₀:Z₀:T₀)`. The rotation in
/// step 1 of the encoding procedure replaces `(X₀:Y₀:Z₀:T₀)` by
/// `(iY₀:iX₀:Z₀:-T₀)`. We therefore wish to relate the
/// computation of
///
///     invsqrt(Z² - Y²) = invsqrt(Z₀² - Y₀²) [non-rotated case]
///
/// with the computation of
///
///     invsqrt(Z² - Y²) = invsqrt(Z₀² + X₀²). [rotated case]
///
/// Recall the curve equation (in the 𝗣² model):
///
///     (-X² + Y²)Z² = Z⁴ + dX²Y². <span style="float: right">(1)</span>
///
/// This means that, for any point `(X:Y:Z:T)` in extended coordinates, we have
///
///     -dX²Y² = Z⁴ + Z²X² - Z²Y², <span style="float: right">(2)</span>
///
/// so that
///
///     (-1-d)X²Y² = Z⁴ + Z²X² - Z²Y² - X²Y², <span style="float: right">(3)</span>
///
/// and hence
///
///     (-1-d)X²Y² = (Z² - Y²)(Z² + X²). <span style="float: right">(4)</span>
///
/// Taking inverse square roots gives
///
///     invsqrt(Z² + X²) = invsqrt(-1-d) sqrt((Z² - Y²)/(X²Y²)). <span style="float: right">(4)</span>
///
///
pub fn compress(&self) -> CompressedRistretto {
let mut X = self.0.X;
let mut Y = self.0.Y;
let Z = &self.0.Z;
let T = &self.0.T;
println!("{:?}", self);
println!("Z = {:?}", self.0.Z);
println!("Y = {:?}", self.0.Y);
let u1 = &(Z + &Y) * &(Z - &Y);
let u2 = &X * &Y;
// Ignore return value since this is always square
@ -227,8 +653,6 @@ impl RistrettoPoint {
Y.conditional_negate((&X * &z_inv).is_negative_ed25519());
let mut s = &den_inv * &(Z - &Y);
let s_is_zero = s.is_zero();
s.conditional_assign(&FieldElement::one(), s_is_zero);
let s_is_negative = s.is_negative_ed25519();
s.conditional_negate(s_is_negative);