saymrwulf/pasta_curves-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta_curves-source.git synced 2026-09-04 20:03:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix case where the input to map_to_curve_simple_swu is 0, and remove unneeded B_OVER_ZA constants.

Browse source 
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
This commit is contained in:
Daira Hopwood 2021-02-21 21:00:50 +00:00
parent 704a6c3637
commit 24def7ce02
2 changed files with 3 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/pasta/curves.rs
View file

@ -695,13 +695,11 @@ macro_rules! impl_projective_curve_specific {
&us[0],
$name::THETA,
$name::Z,
$name::B_OVER_ZA,
);
let q1 = hashtocurve::map_to_curve_simple_swu::<$base, $name_affine, $iso_affine>(
&us[1],
$name::THETA,
$name::Z,
$name::B_OVER_ZA,
);
let r = q0 + &q1;
assert!(bool::from(r.is_on_curve()));
@ -988,15 +986,6 @@ impl Ep {
0x4000000000000000,
]);
/// `b * &((*z * a).invert().unwrap())` where a and b correspond with curve
/// constants for the isogenous curve
pub const B_OVER_ZA: Fp = Fp::from_raw([
0xaf333253bca63800,
0xf6ca6e5ce0e2b674,
0xe9585bf1a0c67160,
0x2c150731d26bf03d,
]);
/// `(F::ROOT_OF_UNITY.invert().unwrap() * z).sqrt().unwrap()`
pub const THETA: Fp = Fp::from_raw([
0xca330bcc09ac318e,
@ -1097,15 +1086,6 @@ impl Eq {
0x4000000000000000,
]);
/// `b * &((*z * a).invert().unwrap())` where a and b correspond with curve
/// constants for the isogenous curve
pub const B_OVER_ZA: Fq = Fq::from_raw([
0xb66e73e89c4736c2,
0x6fa1dc53f442887a,
0xcb59112c429e2216,
0x252ca74e8e7b7846,
]);
/// `(F::ROOT_OF_UNITY.invert().unwrap() * z).sqrt().unwrap()`
pub const THETA: Fq = Fq::from_raw([
0x632cae9872df1b5d,

13
src/pasta/hashtocurve.rs
View file

@ -98,7 +98,6 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
u: &F,
theta: F,
z: F,
b_over_za: F,
) -> I::Projective {
// 1. tv1 = inv0(Z^2 * u^4 + Z * u^2)
// 2. x1 = (-B / A) * (1 + tv1)
@ -127,17 +126,11 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
let z_u2 = z * u.square();
let ta = z_u2.square() + z_u2;
let num_x1 = b * (ta + F::one());
let div = -a * ta;
let div = a * F::conditional_select(&-ta, &z, ta.ct_is_zero());
let num2_x1 = num_x1.square();
let div2 = div.square();
let div3 = div2 * div;
let ta_is_zero = ta.ct_is_zero();
let num_gx1 = F::conditional_select(
&((num2_x1 + a * div2) * num_x1 + b * div3),
&b_over_za,
ta_is_zero,
);
let div_gx1 = F::conditional_select(&div3, &F::one(), ta_is_zero);
let num_gx1 = (num2_x1 + a * div2) * num_x1 + b * div3;
// 5. x2 = Z * u^2 * x1
let num_x2 = z_u2 * num_x1; // same div
@ -145,7 +138,7 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
// 6. gx2 = x2^3 + A * x2 + B [optimized out; see below]
// 7. If is_square(gx1), set x = x1 and y = sqrt(gx1)
// 8. Else set x = x2 and y = sqrt(gx2)
let (gx1_square, y1) = F::sqrt_ratio(&num_gx1, &div_gx1);
let (gx1_square, y1) = F::sqrt_ratio(&num_gx1, &div3);
// This magic also comes from a generalization of [WB2019, section 4.2].
//