saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-04 20:24:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #185 from isislovecruft/feature/ristretto-decoding-cleanup

Browse source 
ristretto decoding cleanup
This commit is contained in:
Henry de Valence 2018-08-20 14:47:57 -07:00 committed by GitHub
commit cdc661c80d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
src/ristretto.rs
View file

@ -242,24 +242,30 @@ impl CompressedRistretto {
return None;
}
// Step 2. The rest. (XXX write comments)
// Step 2. Compute (X:Y:Z:T).
let one = FieldElement::one();
let ss = s.square();
let yden = &one + &ss; // 1 - a*s^2
let ynum = &one - &ss; // 1 + a*s^2
let yden_sqr = yden.square();
let xden_sqr = &(&(-&constants::EDWARDS_D) * &ynum.square()) - &yden_sqr;
let u1 = &one + &ss; // 1 - as² where a=-1
let u2 = &one - &ss; // 1 + as²
let u1_sqr = u1.square(); // (1 + as²)²
let (ok, invsqrt) = (&xden_sqr * &yden_sqr).invsqrt();
// v == ad(1-as²)² - (1+as²)² where d=-121665/121666
let v = &(&(-&constants::EDWARDS_D) * &u2.square()) - &u1_sqr;
let xden_inv = &invsqrt * &yden;
let yden_inv = &invsqrt * &(&xden_inv * &xden_sqr);
let (ok, I) = (&v * &u1_sqr).invsqrt(); // 1/sqrt(vu1²)
let mut x = &(&s + &s) * &xden_inv; // 2*s*xden_inv
let x_is_negative = x.is_negative();
x.conditional_negate(x_is_negative);
let y = &ynum * &yden_inv;
let Dx = &I * &u1; // 1/sqrt(v)
let Dy = &I * &(&Dx * &v); // 1/u2
// x == | 2s/sqrt(v) | == + sqrt(4s²/(ad(1+as²)² - (1-as²)²))
let mut x = &(&s + &s) * &Dx;
let x_neg = x.is_negative();
x.conditional_negate(x_neg);
// y == (1-as²)/(1+as²)
let y = &u2 * &Dy;
// t == ((1+as²) sqrt(4s²/(ad(1+as²)² - (1-as²)²)))/(1-as²)
let t = &x * &y;
if ok.unwrap_u8() == 0u8 || t.is_negative().unwrap_u8() == 1u8 || y.is_zero().unwrap_u8() == 1u8 {