From b6bfc79cd1db6e0caead4f99d238b8b33c20f8fb Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Tue, 3 Oct 2017 13:27:08 -0700 Subject: [PATCH] Fix up Elligator tests to match ristretto.sage --- src/constants.rs | 8 +++++ src/constants_32bit.rs | 4 +++ src/constants_64bit.rs | 4 +++ src/field.rs | 7 +++++ src/ristretto.rs | 71 ++++++++++++++++++++++++++---------------- 5 files changed, 68 insertions(+), 26 deletions(-) diff --git a/src/constants.rs b/src/constants.rs index f2bca03..d45b9ae 100644 --- a/src/constants.rs +++ b/src/constants.rs @@ -215,6 +215,14 @@ mod test { assert_eq!(&constants::d * &four, constants::d4); } + #[test] + fn test_sqrt_ad_minus_one() { + let a = FieldElement::minus_one(); + let ad_minus_one = &(&a * &constants::d) + &a; + let should_be_ad_minus_one = constants::sqrt_ad_minus_one.square(); + assert_eq!(should_be_ad_minus_one, ad_minus_one); + } + #[test] fn test_a_minus_d() { let a = FieldElement::minus_one(); diff --git a/src/constants_32bit.rs b/src/constants_32bit.rs index bf46fe5..6cbe4db 100644 --- a/src/constants_32bit.rs +++ b/src/constants_32bit.rs @@ -39,6 +39,10 @@ pub const a_minus_d: FieldElement32 = FieldElement32([ 10913609, -13857413, 15372611, -6949391, -114729, 8787816, 6275908, 3247719, 18696448, 12055116, ]); +pub const sqrt_ad_minus_one: FieldElement32 = FieldElement32([ + 24849947, -153582, -23613485, 6347715, -21072328, -667138, -25271143, -15367704, -870347, 14525639 +]); + pub const invsqrt_a_minus_d: FieldElement32 = FieldElement32([ 6111485, 4156064, -27798727, 12243468, -25904040, 120897, 20826367, -7060776, 6093568, -1986012 diff --git a/src/constants_64bit.rs b/src/constants_64bit.rs index ba7b2d9..f497b0d 100644 --- a/src/constants_64bit.rs +++ b/src/constants_64bit.rs @@ -33,6 +33,10 @@ pub const d4: FieldElement64 = FieldElement64([1468021120295602, 186546288051685 pub const a_minus_d: FieldElement64 = FieldElement64([1321844580190025, 1785434093556034, 589740348686294, 217950738957124, 809005158844672]); +pub const sqrt_ad_minus_one: FieldElement64 = FieldElement64([ + 2241493124984347, 425987919032274, 2207028919301688, 1220490630685848, 974799131293748 +]); + pub const invsqrt_a_minus_d: FieldElement64 = FieldElement64([ 278908739862762, 821645201101625, 8113234426968, 1777959178193151, 2118520810568447 ]); diff --git a/src/field.rs b/src/field.rs index 14a2829..840355d 100644 --- a/src/field.rs +++ b/src/field.rs @@ -23,6 +23,7 @@ use core::cmp::{Eq, PartialEq}; use subtle::slices_equal; use subtle::byte_is_nonzero; use subtle::ConditionallyAssignable; +use subtle::ConditionallyNegatable; use subtle::Equal; use constants; @@ -199,6 +200,8 @@ impl FieldElement { /// Given `FieldElements` `u` and `v`, attempt to compute /// `sqrt(u/v)` in constant time. /// + /// This function always returns the nonnegative square root, if it exists. + /// /// It would be much better to use an `Option` type here, but /// doing so forces the caller to branch, which we don't want to /// do. This seems like the least bad solution. @@ -245,6 +248,10 @@ impl FieldElement { let r_prime = &constants::SQRT_M1 * &r; r.conditional_assign(&r_prime, flipped_sign_sqrt); + // Choose the nonnegative square root. + let r_is_negative = r.is_negative(); + r.conditional_negate(r_is_negative); + let was_nonzero_square = correct_sign_sqrt | flipped_sign_sqrt; (was_nonzero_square, r) diff --git a/src/ristretto.rs b/src/ristretto.rs index 9b6628b..c0d2d8b 100644 --- a/src/ristretto.rs +++ b/src/ristretto.rs @@ -674,7 +674,6 @@ impl RistrettoPoint { /// This method is not public because it's just used for hashing /// to a point -- proper elligator support is deferred for now. pub fn elligator_ristretto_flavour(r_0: &FieldElement) -> RistrettoPoint { - println!("r_0 = {:?}", r_0); let (i, d) = (&constants::SQRT_M1, &constants::d); let one = FieldElement::one(); @@ -693,24 +692,22 @@ impl RistrettoPoint { // s = sqrt(N/D) if N/D is square s.conditional_assign(&maybe_s, N_over_D_is_square); + // XXX how do we reuse the computation of sqrt(N/D) to find sqrt(rN/D) ? let (rN_over_D_is_square, mut maybe_s) = FieldElement::sqrt_ratio(&(&r*&N), &D); maybe_s.negate(); // s = -sqrt(rN/D) if rN/D is square (should happen exactly when N/D is nonsquare) - debug_assert_eq!(N_over_D_is_square | rN_over_D_is_square, 1u8); + debug_assert_eq!(N_over_D_is_square ^ rN_over_D_is_square, 1u8); s.conditional_assign(&maybe_s, rN_over_D_is_square); c.conditional_assign(&r, rN_over_D_is_square); // T = (c * (r - one) * (d-one).square()) - D; let T = &(&c * &(&(&r - &one) * &((d - &one).square()))) - &D; - - // 7. Apply the isogeny: - // (x,y) = ((2s)/(1+as^2), (1-as^2)/(t)) let s_sq = s.square(); let P = CompletedPoint{ - X: &(&(&s + &s) * &D) * &constants::invsqrt_a_minus_d, - Z: T, + X: &(&s + &s) * &D, + Z: &T * &constants::sqrt_ad_minus_one, Y: &FieldElement::one() - &s_sq, T: &FieldElement::one() + &s_sq, }; @@ -1148,27 +1145,49 @@ mod test { #[test] fn elligator_vs_ristretto_sage() { - let bytes: [[u8;32]; 8] = [ - [192, 145, 157, 191, 240, 79, 98, 26, 219, 167, 184, 111, 133, 98, 100, 169, 53, 212, 205, 130, 146, 94, 65, 146, 119, 203, 119, 173, 37, 165, 171, 55], - [69, 173, 250, 65, 1, 193, 109, 14, 236, 65, 151, 62, 107, 251, 239, 220, 248, 91, 248, 108, 58, 105, 8, 202, 118, 132, 76, 243, 204, 93, 139, 123], - [127, 120, 209, 207, 219, 237, 6, 90, 135, 67, 142, 124, 14, 239, 3, 143, 113, 4, 100, 152, 221, 33, 161, 178, 93, 245, 179, 208, 198, 145, 26, 130], - [87, 87, 58, 155, 29, 72, 49, 81, 244, 242, 182, 81, 188, 210, 236, 63, 219, 132, 127, 254, 176, 13, 29, 221, 135, 223, 243, 171, 7, 39, 99, 236], - [88, 38, 95, 13, 223, 230, 14, 110, 116, 0, 69, 36, 119, 243, 213, 176, 171, 131, 186, 116, 141, 27, 170, 151, 3, 82, 101, 52, 102, 128, 245, 126], - [98, 141, 61, 219, 49, 68, 22, 180, 151, 85, 129, 92, 188, 52, 75, 228, 134, 51, 208, 129, 29, 8, 201, 221, 21, 106, 187, 219, 40, 167, 89, 135], - [193, 136, 83, 249, 207, 20, 145, 19, 202, 210, 31, 203, 118, 146, 4, 223, 159, 37, 9, 83, 0, 85, 2, 224, 90, 197, 201, 190, 92, 170, 29, 29], - [226, 211, 37, 13, 123, 99, 51, 180, 181, 241, 222, 237, 76, 148, 136, 181, 166, 8, 105, 38, 173, 8, 142, 239, 163, 157, 118, 95, 122, 156, 175, 130], + // Test vectors extracted from ristretto.sage. + // + // Notice that all of the byte sequences have bit 255 set to 0; this is because + // ristretto.sage does not mask the high bit of a field element. When the high bit is set, + // the ristretto.sage elligator implementation gives different results, since it takes a + // different field element as input. + let bytes: [[u8;32]; 16] = [ + [184, 249, 135, 49, 253, 123, 89, 113, 67, 160, 6, 239, 7, 105, 211, 41, 192, 249, 185, 57, 9, 102, 70, 198, 15, 127, 7, 26, 160, 102, 134, 71], + [229, 14, 241, 227, 75, 9, 118, 60, 128, 153, 226, 21, 183, 217, 91, 136, 98, 0, 231, 156, 124, 77, 82, 139, 142, 134, 164, 169, 169, 62, 250, 52], + [115, 109, 36, 220, 180, 223, 99, 6, 204, 169, 19, 29, 169, 68, 84, 23, 21, 109, 189, 149, 127, 205, 91, 102, 172, 35, 112, 35, 134, 69, 186, 34], + [16, 49, 96, 107, 171, 199, 164, 9, 129, 16, 64, 62, 241, 63, 132, 173, 209, 160, 112, 215, 105, 50, 157, 81, 253, 105, 1, 154, 229, 25, 120, 83], + [156, 131, 161, 162, 236, 251, 5, 187, 167, 171, 17, 178, 148, 210, 90, 207, 86, 21, 79, 161, 167, 215, 234, 1, 136, 242, 182, 248, 38, 85, 79, 86], + [251, 177, 124, 54, 18, 101, 75, 235, 245, 186, 19, 46, 133, 157, 229, 64, 10, 136, 181, 185, 78, 144, 254, 167, 137, 49, 107, 10, 61, 10, 21, 25], + [232, 193, 20, 68, 240, 77, 186, 77, 183, 40, 44, 86, 150, 31, 198, 212, 76, 81, 3, 217, 197, 8, 126, 128, 126, 152, 164, 208, 153, 44, 189, 77], + [173, 229, 149, 177, 37, 230, 30, 69, 61, 56, 172, 190, 219, 115, 167, 194, 71, 134, 59, 75, 28, 244, 118, 26, 162, 97, 64, 16, 15, 189, 30, 64], + [106, 71, 61, 107, 250, 117, 42, 151, 91, 202, 212, 100, 52, 188, 190, 21, 125, 218, 31, 18, 253, 241, 160, 133, 57, 242, 3, 164, 189, 68, 111, 75], + [112, 204, 182, 90, 220, 198, 120, 73, 173, 107, 193, 17, 227, 40, 162, 36, 150, 141, 235, 55, 172, 183, 12, 39, 194, 136, 43, 153, 244, 118, 91, 89], + [111, 24, 203, 123, 254, 189, 11, 162, 51, 196, 163, 136, 204, 143, 10, 222, 33, 112, 81, 205, 34, 35, 8, 66, 90, 6, 164, 58, 170, 177, 34, 25], + [225, 183, 30, 52, 236, 82, 6, 183, 109, 25, 227, 181, 25, 82, 41, 193, 80, 77, 161, 80, 242, 203, 79, 204, 136, 245, 131, 110, 237, 106, 3, 58], + [207, 246, 38, 56, 30, 86, 176, 90, 27, 200, 61, 42, 221, 27, 56, 210, 79, 178, 189, 120, 68, 193, 120, 167, 77, 185, 53, 197, 124, 128, 191, 126], + [1, 136, 215, 80, 240, 46, 63, 147, 16, 244, 230, 207, 82, 189, 74, 50, 106, 169, 138, 86, 30, 131, 214, 202, 166, 125, 251, 228, 98, 24, 36, 21], + [210, 207, 228, 56, 155, 116, 207, 54, 84, 195, 251, 215, 249, 199, 116, 75, 109, 239, 196, 251, 194, 246, 252, 228, 70, 146, 156, 35, 25, 39, 241, 4], + [34, 116, 123, 9, 8, 40, 93, 189, 9, 103, 57, 103, 66, 227, 3, 2, 157, 107, 134, 219, 202, 74, 230, 154, 78, 107, 219, 195, 214, 14, 84, 80], ]; - let encoded_images: [CompressedRistretto; 8] = [ - CompressedRistretto([238, 201, 94, 143, 244, 113, 239, 63, 170, 196, 93, 156, 166, 5, 218, 254, 185, 105, 73, 246, 11, 230, 151, 52, 20, 137, 229, 166, 155, 106, 116, 124]), - CompressedRistretto([68, 175, 63, 102, 231, 235, 10, 88, 97, 149, 247, 12, 123, 253, 148, 220, 96, 254, 49, 159, 229, 148, 128, 176, 254, 18, 228, 9, 62, 247, 181, 54]), - CompressedRistretto([190, 124, 251, 26, 36, 146, 47, 180, 34, 157, 67, 33, 157, 156, 89, 227, 103, 217, 30, 118, 28, 28, 136, 154, 154, 52, 74, 240, 18, 180, 3, 54]), - CompressedRistretto([112, 226, 8, 36, 70, 90, 119, 210, 94, 246, 31, 241, 93, 26, 160, 93, 172, 53, 79, 242, 104, 205, 90, 203, 25, 224, 47, 57, 236, 194, 199, 105]), - CompressedRistretto([160, 118, 169, 159, 50, 146, 83, 248, 19, 37, 76, 156, 115, 62, 59, 96, 108, 111, 70, 208, 134, 44, 78, 101, 117, 236, 236, 159, 81, 87, 211, 70]), - CompressedRistretto([112, 225, 32, 170, 213, 187, 251, 68, 124, 174, 236, 185, 129, 52, 150, 101, 224, 198, 45, 161, 248, 79, 172, 80, 115, 9, 169, 132, 15, 201, 193, 126]), - CompressedRistretto([72, 100, 105, 93, 207, 23, 159, 154, 142, 204, 169, 166, 224, 250, 45, 29, 185, 222, 57, 161, 32, 68, 212, 219, 168, 21, 24, 43, 138, 217, 86, 79]), - CompressedRistretto([84, 138, 118, 133, 135, 2, 173, 1, 226, 119, 13, 35, 193, 82, 29, 196, 27, 242, 113, 32, 133, 101, 51, 142, 124, 218, 226, 241, 186, 15, 124, 32]), + let encoded_images: [CompressedRistretto; 16] = [ + CompressedRistretto([176, 157, 237, 97, 66, 29, 140, 166, 168, 94, 26, 157, 212, 216, 229, 160, 195, 246, 232, 239, 169, 112, 63, 193, 64, 32, 152, 69, 11, 190, 246, 86]), + CompressedRistretto([234, 141, 77, 203, 181, 225, 250, 74, 171, 62, 15, 118, 78, 212, 150, 19, 131, 14, 188, 238, 194, 244, 141, 138, 166, 162, 83, 122, 228, 201, 19, 26]), + CompressedRistretto([232, 231, 51, 92, 5, 168, 80, 36, 173, 179, 104, 68, 186, 149, 68, 40, 140, 170, 27, 103, 99, 140, 21, 242, 43, 62, 250, 134, 208, 255, 61, 89]), + CompressedRistretto([208, 120, 140, 129, 177, 179, 237, 159, 252, 160, 28, 13, 206, 5, 211, 241, 192, 218, 1, 97, 130, 241, 20, 169, 119, 46, 246, 29, 79, 80, 77, 84]), + CompressedRistretto([202, 11, 236, 145, 58, 12, 181, 157, 209, 6, 213, 88, 75, 147, 11, 119, 191, 139, 47, 142, 33, 36, 153, 193, 223, 183, 178, 8, 205, 120, 248, 110]), + CompressedRistretto([26, 66, 231, 67, 203, 175, 116, 130, 32, 136, 62, 253, 215, 46, 5, 214, 166, 248, 108, 237, 216, 71, 244, 173, 72, 133, 82, 6, 143, 240, 104, 41]), + CompressedRistretto([40, 157, 102, 96, 201, 223, 200, 197, 150, 181, 106, 83, 103, 126, 143, 33, 145, 230, 78, 6, 171, 146, 210, 143, 112, 5, 245, 23, 183, 138, 18, 120]), + CompressedRistretto([220, 37, 27, 203, 239, 196, 176, 131, 37, 66, 188, 243, 185, 250, 113, 23, 167, 211, 154, 243, 168, 215, 54, 171, 159, 36, 195, 81, 13, 150, 43, 43]), + CompressedRistretto([232, 121, 176, 222, 183, 196, 159, 90, 238, 193, 105, 52, 101, 167, 244, 170, 121, 114, 196, 6, 67, 152, 80, 185, 221, 7, 83, 105, 176, 208, 224, 121]), + CompressedRistretto([226, 181, 183, 52, 241, 163, 61, 179, 221, 207, 220, 73, 245, 242, 25, 236, 67, 84, 179, 222, 167, 62, 167, 182, 32, 9, 92, 30, 165, 127, 204, 68]), + CompressedRistretto([226, 119, 16, 242, 200, 139, 240, 87, 11, 222, 92, 146, 156, 243, 46, 119, 65, 59, 1, 248, 92, 183, 50, 175, 87, 40, 206, 53, 208, 220, 148, 13]), + CompressedRistretto([70, 240, 79, 112, 54, 157, 228, 146, 74, 122, 216, 88, 232, 62, 158, 13, 14, 146, 115, 117, 176, 222, 90, 225, 244, 23, 94, 190, 150, 7, 136, 96]), + CompressedRistretto([22, 71, 241, 103, 45, 193, 195, 144, 183, 101, 154, 50, 39, 68, 49, 110, 51, 44, 62, 0, 229, 113, 72, 81, 168, 29, 73, 106, 102, 40, 132, 24]), + CompressedRistretto([196, 133, 107, 11, 130, 105, 74, 33, 204, 171, 133, 221, 174, 193, 241, 36, 38, 179, 196, 107, 219, 185, 181, 253, 228, 47, 155, 42, 231, 73, 41, 78]), + CompressedRistretto([58, 255, 225, 197, 115, 208, 160, 143, 39, 197, 82, 69, 143, 235, 92, 170, 74, 40, 57, 11, 171, 227, 26, 185, 217, 207, 90, 185, 197, 190, 35, 60]), + CompressedRistretto([88, 43, 92, 118, 223, 136, 105, 145, 238, 186, 115, 8, 214, 112, 153, 253, 38, 108, 205, 230, 157, 130, 11, 66, 101, 85, 253, 110, 110, 14, 148, 112]), ]; - for i in 0..8 { + for i in 0..16 { let r_0 = FieldElement::from_bytes(&bytes[i]); let Q = RistrettoPoint::elligator_ristretto_flavour(&r_0); assert_eq!(Q.compress(), encoded_images[i]);