From 53da2aaaf442c705c7c9c15f94a5d3340faa3200 Mon Sep 17 00:00:00 2001 From: Fabian Drinck Date: Fri, 7 Jun 2019 18:41:26 +0200 Subject: [PATCH 1/2] Remove unneeded check for negativity in edwards point decompression The function `FieldElement::sqrt_ratio_i` always returns a positive root by definition. Therefore the test for negativity in the edwards point decompression function always returns false and we only need to flip its sign if `compressed_sign_bit` is set. --- src/edwards.rs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/edwards.rs b/src/edwards.rs index c60069c..d8f83a5 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -192,9 +192,7 @@ impl CompressedEdwardsY { // Flip the sign of X if it's not correct let compressed_sign_bit = Choice::from(self.as_bytes()[31] >> 7); - let current_sign_bit = X.is_negative(); - - X.conditional_negate(current_sign_bit ^ compressed_sign_bit); + X.conditional_negate(compressed_sign_bit); Some(EdwardsPoint{ X: X, Y: Y, Z: Z, T: &X * &Y }) } From 26ae185bc9a7efe5eb0ce8ef1eede7a64bb9ff1f Mon Sep 17 00:00:00 2001 From: Fabian Drinck Date: Wed, 7 Aug 2019 19:43:10 +0200 Subject: [PATCH 2/2] Apply suggestion by @hdevalence Co-Authored-By: Henry de Valence --- src/edwards.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/edwards.rs b/src/edwards.rs index d8f83a5..3f9e1e3 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -190,7 +190,8 @@ impl CompressedEdwardsY { if is_valid_y_coord.unwrap_u8() != 1u8 { return None; } - // Flip the sign of X if it's not correct + // FieldElement::sqrt_ratio_i always returns the nonnegative square root, + // so we negate according to the supplied sign bit. let compressed_sign_bit = Choice::from(self.as_bytes()[31] >> 7); X.conditional_negate(compressed_sign_bit);