From f4135da5c921e5c2636a95536732d1547648acf3 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Mon, 2 Oct 2017 17:08:00 -0700 Subject: [PATCH] Remove is_negative_decaf since ristretto uses the low bit --- src/edwards.rs | 4 ++-- src/field.rs | 35 +---------------------------------- src/montgomery.rs | 2 +- src/ristretto.rs | 12 ++++++------ 4 files changed, 10 insertions(+), 43 deletions(-) diff --git a/src/edwards.rs b/src/edwards.rs index 16c7469..feed487 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -143,7 +143,7 @@ impl CompressedEdwardsY { // Flip the sign of X if it's not correct let compressed_sign_bit = self.as_bytes()[31] >> 7; - let current_sign_bit = X.is_negative_ed25519(); + let current_sign_bit = X.is_negative(); X.conditional_negate(current_sign_bit ^ compressed_sign_bit); Some(ExtendedPoint{ X: X, Y: Y, Z: Z, T: &X * &Y }) @@ -442,7 +442,7 @@ impl ProjectivePoint { let mut s: [u8; 32]; s = y.to_bytes(); - s[31] ^= (x.is_negative_ed25519() << 7) as u8; + s[31] ^= (x.is_negative() << 7) as u8; CompressedEdwardsY(s) } diff --git a/src/field.rs b/src/field.rs index d25f376..14a2829 100644 --- a/src/field.rs +++ b/src/field.rs @@ -81,44 +81,11 @@ impl FieldElement { /// # Return /// /// If negative, return `1u8`. Otherwise, return `0u8`. - pub fn is_negative_ed25519(&self) -> u8 { //FeIsNegative + pub fn is_negative(&self) -> u8 { let bytes = self.to_bytes(); (bytes[0] & 1) as u8 } - /// Determine if this `FieldElement` is negative, in the - /// sense used by Decaf: `x` is nonnegative if the least - /// absolute residue for `x` lies in `[0, (p-1)/2]`, and - /// is negative otherwise. - /// - /// # Return - /// - /// Returns `1u8` if negative, `0u8` if nonnegative. - /// - /// # Implementation - /// - /// Uses a trick borrowed from Mike Hamburg's code. Let `x \in - /// F_p` and let `y \in Z` be the least absolute residue for `x`. - /// Suppose `y ≤ (p-1)/2`. Then `2y < p` so `2y = 2y mod p` and - /// `2y mod p` is even. On the other hand, if `y > (p-1)/2` then - /// `2y ≥ p`; since `y < p`, `2y \in [p, 2p)`, so `2y mod p = - /// 2y-p`, which is odd. - /// - /// Thus we can test whether `y ≤ (p-1)/2` by checking whether `2y - /// mod p` is even. - pub fn is_negative_decaf(&self) -> u8 { - let y = self + self; - (y.to_bytes()[0] & 1) as u8 - } - - /// Determine if this `FieldElement` is nonnegative, in the - /// sense used by Decaf: `x` is nonnegative if the least - /// absolute residue for `x` lies in `[0, (p-1)/2]`, and - /// is negative otherwise. - pub fn is_nonnegative_decaf(&self) -> u8 { - 1u8 & (!self.is_negative_decaf()) - } - /// Determine if this `FieldElement` is zero. /// /// # Return diff --git a/src/montgomery.rs b/src/montgomery.rs index 9ba71ed..33ddae7 100644 --- a/src/montgomery.rs +++ b/src/montgomery.rs @@ -183,7 +183,7 @@ impl CompressedMontgomeryU { pub fn to_edwards_x(u: &FieldElement, v: &FieldElement, sign: &u8) -> FieldElement { let mut x: FieldElement = &(u * &v.invert()) * &constants::SQRT_MINUS_APLUS2; let neg_x: FieldElement = -(&x); - let current_sign: u8 = x.is_negative_ed25519(); + let current_sign: u8 = x.is_negative(); // Negate x to match the sign: x.conditional_assign(&neg_x, current_sign ^ sign); diff --git a/src/ristretto.rs b/src/ristretto.rs index c7ecb95..9b6628b 100644 --- a/src/ristretto.rs +++ b/src/ristretto.rs @@ -451,7 +451,7 @@ impl CompressedRistretto { let s_bytes_check = s.to_bytes(); let s_encoding_is_canonical = subtle::slices_equal(&s_bytes_check[..], self.as_bytes()); - let s_is_negative = s.is_negative_ed25519(); + let s_is_negative = s.is_negative(); if s_encoding_is_canonical == 0u8 || s_is_negative == 1u8 { return None; @@ -471,13 +471,13 @@ impl CompressedRistretto { let yden_inv = &invsqrt * &(&xden_inv * &xden_sqr); let mut x = &(&s + &s) * &xden_inv; // 2*s*xden_inv - let x_is_negative = x.is_negative_ed25519(); + let x_is_negative = x.is_negative(); x.conditional_negate(x_is_negative); let y = &ynum * &yden_inv; let t = &x * &y; - if ok == 0u8 || t.is_negative_ed25519() == 1u8 || y.is_zero() == 1u8 { + if ok == 0u8 || t.is_negative() == 1u8 || y.is_zero() == 1u8 { return None; } else { return Some(RistrettoPoint(ExtendedPoint{X: x, Y: y, Z: one, T: t})); @@ -643,16 +643,16 @@ impl RistrettoPoint { let ristretto_magic = &constants::invsqrt_a_minus_d; let enchanted_denominator = &i1 * ristretto_magic; - let rotate = (T * &z_inv).is_negative_ed25519(); + let rotate = (T * &z_inv).is_negative(); X.conditional_assign(&iY, rotate); Y.conditional_assign(&iX, rotate); den_inv.conditional_assign(&enchanted_denominator, rotate); - Y.conditional_negate((&X * &z_inv).is_negative_ed25519()); + Y.conditional_negate((&X * &z_inv).is_negative()); let mut s = &den_inv * &(Z - &Y); - let s_is_negative = s.is_negative_ed25519(); + let s_is_negative = s.is_negative(); s.conditional_negate(s_is_negative); CompressedRistretto(s.to_bytes())