saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-04 20:24:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Rename _BASEPOINT to _BASEPOINT_POINT.

Browse source 
Having _BASEPOINT_TABLE and _BASEPOINT_POINT means that it's not possible to
use the slow, generic scalar mult in place of the fast, precomputed scalar
mults.
This commit is contained in:
Henry de Valence 2017-08-14 00:20:18 -07:00
parent 9c7f419ead
commit c29103d109
6 changed files with 55 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/constants.rs
View file

@ -53,9 +53,10 @@ pub const BASE_CMPRSSD: CompressedEdwardsY =
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66]);
/// The Ed25519 basepoint, as a `DecafPoint`.
#[cfg(feature = "yolocrypto")]
pub const DECAF_ED25519_BASEPOINT: DecafPoint = DecafPoint(ED25519_BASEPOINT);
/// The Ed25519 basepoint, as a `DecafPoint`. This is called `_POINT` to distinguish it from
/// `_TABLE`, which provides fast scalar multiplication.
#[cfg(feature = "yolocrypto")] pub const DECAF_ED25519_BASEPOINT_POINT: DecafPoint =
DecafPoint(ED25519_BASEPOINT_POINT);
/// `l` is the order of base point, i.e. 2^252 +
/// 27742317777372353535851937790883648493, in little-endian form

5
src/constants_32bit.rs
View file

@ -94,8 +94,9 @@ pub const SQRT_MINUS_HALF: FieldElement32 = FieldElement32([ // sqrtMinusHalf
-17256545, 3971863, 28865457, -1750208, 27359696,
-16640980, 12573105, 1002827, -163343, 11073975, ]);
/// Basepoint has y = 4/5.
pub const ED25519_BASEPOINT: ExtendedPoint = ExtendedPoint{
/// Basepoint has y = 4/5. This is called `_POINT` to distinguish it from `_TABLE`, which should
/// be used for scalar multiplication (it's much faster).
pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
X: FieldElement32([-14297830, -7645148, 16144683, -16471763, 27570974, -2696100, -26142465, 8378389, 20764389, 8758491]),
Y: FieldElement32([-26843541, -6710886, 13421773, -13421773, 26843546, 6710886, -13421773, 13421773, -26843546, -6710886]),
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),

5
src/constants_64bit.rs
View file

@ -67,8 +67,9 @@ pub const SQRT_MINUS_APLUS2: FieldElement64 = FieldElement64([1693982333959686,
/// `SQRT_MINUS_HALF` is sqrt(-1/2)
pub const SQRT_MINUS_HALF: FieldElement64 = FieldElement64([266547196637087, 2134345371906993, 1135042577398223, 67298593331632, 743161882051057]);
/// Basepoint has y = 4/5.
pub const ED25519_BASEPOINT: ExtendedPoint = ExtendedPoint {
/// Basepoint has y = 4/5. This is called `_POINT` to distinguish it from `_TABLE`, which should
/// be used for scalar multiplication (it's much faster).
pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
X: FieldElement64([1738742601995546, 1146398526822698, 2070867633025821, 562264141797630, 587772402128613]),
Y: FieldElement64([1801439850948184, 1351079888211148, 450359962737049, 900719925474099, 1801439850948198]),
Z: FieldElement64([1, 0, 0, 0, 0]),

16
src/decaf.rs
View file

@ -653,7 +653,7 @@ impl ConditionallyAssignable for DecafPoint {
/// # use curve25519_dalek::constants;
/// # fn main() {
/// let A = DecafPoint::identity();
/// let B = constants::DECAF_ED25519_BASEPOINT;
/// let B = constants::DECAF_ED25519_BASEPOINT_POINT;
///
/// let mut P = A;
///
@ -736,9 +736,9 @@ mod test {
#[test]
#[cfg(feature = "serde")]
fn serde_cbor_basepoint_roundtrip() {
let output = serde_cbor::to_vec(&constants::DECAF_ED25519_BASEPOINT).unwrap();
let output = serde_cbor::to_vec(&constants::DECAF_ED25519_BASEPOINT_POINT).unwrap();
let parsed: DecafPoint = serde_cbor::from_slice(&output).unwrap();
assert_eq!(parsed, constants::DECAF_ED25519_BASEPOINT);
assert_eq!(parsed, constants::DECAF_ED25519_BASEPOINT_POINT);
}
@ -764,10 +764,10 @@ mod test {
#[test]
fn decaf_basepoint_roundtrip() {
let bp_compressed_decaf = constants::DECAF_ED25519_BASEPOINT.compress();
let bp_compressed_decaf = constants::DECAF_ED25519_BASEPOINT_POINT.compress();
let bp_recaf = bp_compressed_decaf.decompress().unwrap().0;
// Check that bp_recaf differs from bp by a point of order 4
let diff = &constants::ED25519_BASEPOINT - &bp_recaf;
let diff = &constants::ED25519_BASEPOINT_POINT - &bp_recaf;
let diff4 = diff.mult_by_pow_2(4); // XXX this is wrong
assert_eq!(diff4.compress_edwards(), CompressedEdwardsY::identity());
}
@ -794,16 +794,16 @@ mod test {
CompressedDecaf([7, 221, 140, 57, 13, 146, 248, 27, 56, 4, 128, 23, 145, 120, 126, 4, 158, 173, 52, 213, 164, 250, 26, 55, 89, 96, 187, 111, 211, 18, 63, 19]),
CompressedDecaf([91, 213, 193, 10, 102, 92, 199, 124, 61, 176, 1, 47, 111, 59, 183, 91, 79, 56, 208, 109, 172, 209, 17, 167, 229, 216, 3, 236, 200, 208, 15, 20]),
];
let mut bp = constants::DECAF_ED25519_BASEPOINT;
let mut bp = constants::DECAF_ED25519_BASEPOINT_POINT;
for i in 0..16 {
assert_eq!(bp.compress(), compressed[i]);
bp = &bp + &constants::DECAF_ED25519_BASEPOINT;
bp = &bp + &constants::DECAF_ED25519_BASEPOINT_POINT;
}
}
#[test]
fn decaf_four_torsion_basepoint() {
let bp = constants::DECAF_ED25519_BASEPOINT;
let bp = constants::DECAF_ED25519_BASEPOINT_POINT;
let bp_coset = bp.coset4();
for i in 0..4 {
assert_eq!(bp, DecafPoint(bp_coset[i]));

72
src/edwards.rs
View file

@ -1319,10 +1319,10 @@ mod test {
.decompress().unwrap();
// Test projective coordinates exactly since we know they should
// only differ by a flipped sign.
assert_eq!(minus_basepoint.X, -(&constants::ED25519_BASEPOINT.X));
assert_eq!(minus_basepoint.Y, constants::ED25519_BASEPOINT.Y);
assert_eq!(minus_basepoint.Z, constants::ED25519_BASEPOINT.Z);
assert_eq!(minus_basepoint.T, -(&constants::ED25519_BASEPOINT.T));
assert_eq!(minus_basepoint.X, -(&constants::ED25519_BASEPOINT_POINT.X));
assert_eq!(minus_basepoint.Y, constants::ED25519_BASEPOINT_POINT.Y);
assert_eq!(minus_basepoint.Z, constants::ED25519_BASEPOINT_POINT.Z);
assert_eq!(minus_basepoint.T, -(&constants::ED25519_BASEPOINT_POINT.T));
}
/// Test that computing 1*basepoint gives the correct basepoint.
@ -1344,7 +1344,7 @@ mod test {
/// using basepoint + basepoint versus the 2*basepoint constant.
#[test]
fn basepoint_plus_basepoint_vs_basepoint2() {
let bp = constants::ED25519_BASEPOINT;
let bp = constants::ED25519_BASEPOINT_POINT;
let bp_added = &bp + &bp;
assert_eq!(bp_added.compress_edwards(), BASE2_CMPRSSD);
}
@ -1353,7 +1353,7 @@ mod test {
/// using the basepoint, basepoint2 constants
#[test]
fn basepoint_plus_basepoint_projective_niels_vs_basepoint2() {
let bp = constants::ED25519_BASEPOINT;
let bp = constants::ED25519_BASEPOINT_POINT;
let bp_added = (&bp + &bp.to_projective_niels()).to_extended();
assert_eq!(bp_added.compress_edwards(), BASE2_CMPRSSD);
}
@ -1362,7 +1362,7 @@ mod test {
/// using the basepoint, basepoint2 constants
#[test]
fn basepoint_plus_basepoint_affine_niels_vs_basepoint2() {
let bp = constants::ED25519_BASEPOINT;
let bp = constants::ED25519_BASEPOINT_POINT;
let bp_affine_niels = bp.to_affine_niels();
let bp_added = (&bp + &bp_affine_niels).to_extended();
assert_eq!(bp_added.compress_edwards(), BASE2_CMPRSSD);
@ -1413,7 +1413,7 @@ mod test {
#[test]
#[cfg(feature="basepoint_table_creation")]
fn test_precomputed_basepoint_mult() {
let table = EdwardsBasepointTable::create(&constants::ED25519_BASEPOINT);
let table = EdwardsBasepointTable::create(&constants::ED25519_BASEPOINT_POINT);
let aB_1 = &constants::ED25519_BASEPOINT_TABLE * &A_SCALAR;
let aB_2 = &table * &A_SCALAR;
assert_eq!(aB_1.compress_edwards(), aB_2.compress_edwards());
@ -1422,14 +1422,14 @@ mod test {
/// Test scalar_mult versus a known scalar multiple from ed25519.py
#[test]
fn scalar_mult_vs_ed25519py() {
let aB = &constants::ED25519_BASEPOINT * &A_SCALAR;
let aB = &constants::ED25519_BASEPOINT_POINT * &A_SCALAR;
assert_eq!(aB.compress_edwards(), A_TIMES_BASEPOINT);
}
/// Test basepoint.double() versus the 2*basepoint constant.
#[test]
fn basepoint_double_vs_basepoint2() {
assert_eq!(constants::ED25519_BASEPOINT.double().compress_edwards(),
assert_eq!(constants::ED25519_BASEPOINT_POINT.double().compress_edwards(),
BASE2_CMPRSSD);
}
@ -1444,7 +1444,7 @@ mod test {
/// Check that converting to projective and then back to extended round-trips.
#[test]
fn basepoint_projective_extended_round_trip() {
assert_eq!(constants::ED25519_BASEPOINT
assert_eq!(constants::ED25519_BASEPOINT_POINT
.to_projective().to_extended().compress_edwards(),
constants::BASE_CMPRSSD);
}
@ -1452,7 +1452,7 @@ mod test {
/// Test computing 16*basepoint vs mult_by_pow_2(4)
#[test]
fn basepoint16_vs_mult_by_pow_2_4() {
let bp16 = constants::ED25519_BASEPOINT.mult_by_pow_2(4);
let bp16 = constants::ED25519_BASEPOINT_POINT.mult_by_pow_2(4);
assert_eq!(bp16.compress_edwards(), BASE16_CMPRSSD);
}
@ -1461,7 +1461,7 @@ mod test {
fn conditional_assign_for_affine_niels_point() {
let id = AffineNielsPoint::identity();
let mut p1 = AffineNielsPoint::identity();
let bp = constants::ED25519_BASEPOINT.to_affine_niels();
let bp = constants::ED25519_BASEPOINT_POINT.to_affine_niels();
p1.conditional_assign(&bp, 0);
assert_eq!(p1, id);
@ -1472,7 +1472,7 @@ mod test {
#[test]
fn is_small_order() {
// The basepoint has large prime order
assert!(constants::ED25519_BASEPOINT.is_small_order() == false);
assert!(constants::ED25519_BASEPOINT_POINT.is_small_order() == false);
// constants::EIGHT_TORSION has all points of small order.
for torsion_point in &constants::EIGHT_TORSION {
assert!(torsion_point.is_small_order() == true);
@ -1488,7 +1488,7 @@ mod test {
#[test]
fn is_identity() {
assert!( ExtendedPoint::identity().is_identity() == true);
assert!(constants::ED25519_BASEPOINT.is_identity() == false);
assert!(constants::ED25519_BASEPOINT_POINT.is_identity() == false);
}
/// Rust's debug builds have overflow and underflow trapping,
@ -1503,7 +1503,7 @@ mod test {
/// the type system and prove correctness).
#[test]
fn monte_carlo_overflow_underflow_debug_assert_test() {
let mut P = constants::ED25519_BASEPOINT;
let mut P = constants::ED25519_BASEPOINT_POINT;
// N.B. each scalar_mult does 1407 field mults, 1024 field squarings,
// so this does ~ 1M of each operation.
for _ in 0..1_000 {
@ -1513,7 +1513,7 @@ mod test {
#[test]
fn scalarmult_extended_point_works_both_ways() {
let G: ExtendedPoint = constants::ED25519_BASEPOINT;
let G: ExtendedPoint = constants::ED25519_BASEPOINT_POINT;
let s: Scalar = A_SCALAR;
let P1 = &G * &s;
@ -1525,7 +1525,7 @@ mod test {
#[test]
#[cfg(feature = "yolocrypto")]
fn scalarmult_decafpoint_works_both_ways() {
let P: DecafPoint = DecafPoint(constants::ED25519_BASEPOINT);
let P: DecafPoint = DecafPoint(constants::ED25519_BASEPOINT_POINT);
let s: Scalar = A_SCALAR;
let P1 = &P * &s;
@ -1551,7 +1551,7 @@ mod test {
let A = A_TIMES_BASEPOINT.decompress().unwrap();
let result = vartime::multiscalar_mult(
&[A_SCALAR, B_SCALAR],
&[A, constants::ED25519_BASEPOINT]
&[A, constants::ED25519_BASEPOINT_POINT]
);
assert_eq!(result.compress_edwards(), DOUBLE_SCALAR_MULT_RESULT);
}
@ -1561,11 +1561,11 @@ mod test {
let A = A_TIMES_BASEPOINT.decompress().unwrap();
let result_vartime = vartime::multiscalar_mult(
&[A_SCALAR, B_SCALAR],
&[A, constants::ED25519_BASEPOINT]
&[A, constants::ED25519_BASEPOINT_POINT]
);
let result_consttime = multiscalar_mult(
&[A_SCALAR, B_SCALAR],
&[A, constants::ED25519_BASEPOINT]
&[A, constants::ED25519_BASEPOINT_POINT]
);
assert_eq!(result_vartime.compress_edwards(), result_consttime.compress_edwards());
@ -1578,7 +1578,7 @@ mod test {
#[test]
#[cfg(feature = "serde")]
fn serde_cbor_basepoint_roundtrip() {
let output = serde_cbor::to_vec(&constants::ED25519_BASEPOINT).unwrap();
let output = serde_cbor::to_vec(&constants::ED25519_BASEPOINT_POINT).unwrap();
let parsed: ExtendedPoint = serde_cbor::from_slice(&output).unwrap();
assert_eq!(parsed.compress_edwards(), constants::BASE_CMPRSSD);
}
@ -1586,7 +1586,7 @@ mod test {
#[test]
#[cfg(feature = "serde")]
fn serde_cbor_decode_invalid_fails() {
let mut output = serde_cbor::to_vec(&constants::ED25519_BASEPOINT).unwrap();
let mut output = serde_cbor::to_vec(&constants::ED25519_BASEPOINT_POINT).unwrap();
// CBOR apparently has two bytes of overhead for a 32-byte string.
// Set the low byte of the compressed point to 1 to make it invalid.
output[2] = 1;
@ -1615,7 +1615,7 @@ mod bench {
#[bench]
fn edwards_compress(b: &mut Bencher) {
let B = &constants::ED25519_BASEPOINT;
let B = &constants::ED25519_BASEPOINT_POINT;
b.iter(|| B.compress_edwards());
}
@ -1627,7 +1627,7 @@ mod bench {
#[bench]
fn scalar_mult(b: &mut Bencher) {
let B = &constants::ED25519_BASEPOINT;
let B = &constants::ED25519_BASEPOINT_POINT;
b.iter(|| B * &A_SCALAR);
}
@ -1638,53 +1638,53 @@ mod bench {
#[bench]
fn add_extended_and_projective_niels_output_completed(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p2 = constants::ED25519_BASEPOINT.to_projective_niels();
let p1 = constants::ED25519_BASEPOINT_POINT;
let p2 = constants::ED25519_BASEPOINT_POINT.to_projective_niels();
b.iter(|| &p1 + &p2);
}
#[bench]
fn add_extended_and_projective_niels_output_extended(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p2 = constants::ED25519_BASEPOINT.to_projective_niels();
let p1 = constants::ED25519_BASEPOINT_POINT;
let p2 = constants::ED25519_BASEPOINT_POINT.to_projective_niels();
b.iter(|| (&p1 + &p2).to_extended());
}
#[bench]
fn add_extended_and_affine_niels_output_completed(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p2 = constants::ED25519_BASEPOINT.to_affine_niels();
let p1 = constants::ED25519_BASEPOINT_POINT;
let p2 = constants::ED25519_BASEPOINT_POINT.to_affine_niels();
b.iter(|| &p1 + &p2);
}
#[bench]
fn add_extended_and_affine_niels_output_extended(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p2 = constants::ED25519_BASEPOINT.to_affine_niels();
let p1 = constants::ED25519_BASEPOINT_POINT;
let p2 = constants::ED25519_BASEPOINT_POINT.to_affine_niels();
b.iter(|| (&p1 + &p2).to_extended());
}
#[bench]
fn projective_double_output_completed(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT.to_projective();
let p1 = constants::ED25519_BASEPOINT_POINT.to_projective();
b.iter(|| p1.double());
}
#[bench]
fn extended_double_output_extended(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p1 = constants::ED25519_BASEPOINT_POINT;
b.iter(|| p1.double());
}
#[bench]
fn mult_by_cofactor(b: &mut Bencher) {
let p1 = constants::ED25519_BASEPOINT;
let p1 = constants::ED25519_BASEPOINT_POINT;
b.iter(|| p1.mult_by_cofactor());
}

2
src/montgomery.rs
View file

@ -170,7 +170,7 @@ mod test {
/// Test Montgomery conversion against the X25519 basepoint.
#[test]
fn basepoint_to_montgomery() {
assert_eq!(constants::ED25519_BASEPOINT.compress_montgomery().unwrap(),
assert_eq!(constants::ED25519_BASEPOINT_POINT.compress_montgomery().unwrap(),
BASE_CMPRSSD_MONTY);
}