From 24def7ce02712904d4b04e4dc1860307f338f739 Mon Sep 17 00:00:00 2001
From: Daira Hopwood <daira@jacaranda.org>
Date: Sun, 21 Feb 2021 21:00:50 +0000
Subject: [PATCH] Fix case where the input to map_to_curve_simple_swu is 0, and
 remove unneeded B_OVER_ZA constants.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
---
 src/pasta/curves.rs      | 20 --------------------
 src/pasta/hashtocurve.rs | 13 +++----------
 2 files changed, 3 insertions(+), 30 deletions(-)

diff --git a/src/pasta/curves.rs b/src/pasta/curves.rs
index 966d04a..b90e39d 100644
--- a/src/pasta/curves.rs
+++ b/src/pasta/curves.rs
@@ -695,13 +695,11 @@ macro_rules! impl_projective_curve_specific {
                     &us[0],
                     $name::THETA,
                     $name::Z,
-                    $name::B_OVER_ZA,
                 );
                 let q1 = hashtocurve::map_to_curve_simple_swu::<$base, $name_affine, $iso_affine>(
                     &us[1],
                     $name::THETA,
                     $name::Z,
-                    $name::B_OVER_ZA,
                 );
                 let r = q0 + &q1;
                 assert!(bool::from(r.is_on_curve()));
@@ -988,15 +986,6 @@ impl Ep {
         0x4000000000000000,
     ]);
 
-    /// `b * &((*z * a).invert().unwrap())` where a and b correspond with curve
-    /// constants for the isogenous curve
-    pub const B_OVER_ZA: Fp = Fp::from_raw([
-        0xaf333253bca63800,
-        0xf6ca6e5ce0e2b674,
-        0xe9585bf1a0c67160,
-        0x2c150731d26bf03d,
-    ]);
-
     /// `(F::ROOT_OF_UNITY.invert().unwrap() * z).sqrt().unwrap()`
     pub const THETA: Fp = Fp::from_raw([
         0xca330bcc09ac318e,
@@ -1097,15 +1086,6 @@ impl Eq {
         0x4000000000000000,
     ]);
 
-    /// `b * &((*z * a).invert().unwrap())` where a and b correspond with curve
-    /// constants for the isogenous curve
-    pub const B_OVER_ZA: Fq = Fq::from_raw([
-        0xb66e73e89c4736c2,
-        0x6fa1dc53f442887a,
-        0xcb59112c429e2216,
-        0x252ca74e8e7b7846,
-    ]);
-
     /// `(F::ROOT_OF_UNITY.invert().unwrap() * z).sqrt().unwrap()`
     pub const THETA: Fq = Fq::from_raw([
         0x632cae9872df1b5d,
diff --git a/src/pasta/hashtocurve.rs b/src/pasta/hashtocurve.rs
index 26758f6..db69f06 100644
--- a/src/pasta/hashtocurve.rs
+++ b/src/pasta/hashtocurve.rs
@@ -98,7 +98,6 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
     u: &F,
     theta: F,
     z: F,
-    b_over_za: F,
 ) -> I::Projective {
     // 1. tv1 = inv0(Z^2 * u^4 + Z * u^2)
     // 2. x1 = (-B / A) * (1 + tv1)
@@ -127,17 +126,11 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
     let z_u2 = z * u.square();
     let ta = z_u2.square() + z_u2;
     let num_x1 = b * (ta + F::one());
-    let div = -a * ta;
+    let div = a * F::conditional_select(&-ta, &z, ta.ct_is_zero());
     let num2_x1 = num_x1.square();
     let div2 = div.square();
     let div3 = div2 * div;
-    let ta_is_zero = ta.ct_is_zero();
-    let num_gx1 = F::conditional_select(
-        &((num2_x1 + a * div2) * num_x1 + b * div3),
-        &b_over_za,
-        ta_is_zero,
-    );
-    let div_gx1 = F::conditional_select(&div3, &F::one(), ta_is_zero);
+    let num_gx1 = (num2_x1 + a * div2) * num_x1 + b * div3;
 
     // 5. x2 = Z * u^2 * x1
     let num_x2 = z_u2 * num_x1; // same div
@@ -145,7 +138,7 @@ pub fn map_to_curve_simple_swu<F: FieldExt, C: CurveAffine<Base = F>, I: CurveAf
     // 6. gx2 = x2^3 + A * x2 + B  [optimized out; see below]
     // 7. If is_square(gx1), set x = x1 and y = sqrt(gx1)
     // 8. Else set x = x2 and y = sqrt(gx2)
-    let (gx1_square, y1) = F::sqrt_ratio(&num_gx1, &div_gx1);
+    let (gx1_square, y1) = F::sqrt_ratio(&num_gx1, &div3);
 
     // This magic also comes from a generalization of [WB2019, section 4.2].
     //