saymrwulf/pasta_curves-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta_curves-source.git synced 2026-09-05 20:10:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #159 from daira/background-update2

Browse source 
Further clarify notation and make sure that the discussion is correct for non-cyclic groups
This commit is contained in:
str4d 2021-02-02 00:33:02 +13:00 committed by GitHub
commit a0282e7e15
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 25 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
book/src/background/fields.md
View file

@ -58,11 +58,14 @@ group operation is given by multiplication on the field.
[group]: https://en.wikipedia.org/wiki/Group_(mathematics) [group]: https://en.wikipedia.org/wiki/Group_(mathematics)
> #### (aside) Additive vs multiplicative notation > #### (aside) Additive vs multiplicative notation
> If $\cdot$ is written as $+$ and the identity as $0$ or $\mathcal{O}$, then we say the > If $\cdot$ is written as $\times$ or omitted (i.e. $a \cdot b$ written as $ab$), the
> group is "written additively". If $\cdot$ is written as $\times$ or omitted (i.e. > identity as $1$, and inversion as $a^{-1}$, as we did above, then we say that the group
> $a \cdot b$ written as $ab$) and the identity as $1$, then we say it is "written > is "written multiplicatively". If $\cdot$ is written as $+$, the identity as $0$ or
> multiplicatively". It's conventional to use additive notation for elliptic curve > $\mathcal{O}$, and inversion as $-a$, then we say it is "written additively".
> groups, and multiplicative notation when the elements come from a finite field. >
> It's conventional to use additive notation for elliptic curve groups, and multiplicative
> notation when the elements come from a finite field.
>
> When additive notation is used, we also write > When additive notation is used, we also write
> >
> $$[k] A = \underbrace{A + A + \cdots + A}_{k \text{ times}}$$ > $$[k] A = \underbrace{A + A + \cdots + A}_{k \text{ times}}$$
@ -78,29 +81,32 @@ group operation is given by multiplication on the field.
> scalars to negative integers by inversion, i.e. $[-k] A + [k] A = \mathcal{O}$ or > scalars to negative integers by inversion, i.e. $[-k] A + [k] A = \mathcal{O}$ or
> $a^{-k} \times a^k = 1$. > $a^{-k} \times a^k = 1$.
The _order_ of an element $a$ of a finite group is defined (in multiplicative notation) The _order_ of an element $a$ of a finite group is defined as the smallest positive integer
as the smallest positive integer $k$ such that $a^k = 1$. The order _of the group_ is $k$ such that $a^k = 1$ (in multiplicative notation) or $[k] a = \mathcal{O}$ (in additive
the number of elements, which (for finite groups) is also the maximum order of any element. notation). The order _of the group_ is the number of elements.
Groups always have [generators] which are elements that, when the group operation is Groups always have a [generating set], which is a set of elements such that we can produce
applied repeatedly with the same element some number of times, produce every other element any element of the group as (in multiplicative terminology) a product of powers of those
of the group. That is, a generator has maximal order, which we also call the order of the elements. So if the generating set is $g_{1..k}$, we can produce any element of the group
group. There can be many different generators. as $\prod\limits_{i=1}^{k} g_i^{a_i}$. There can be many different generating sets for a
given group.
[generators]: https://en.wikipedia.org/wiki/Generating_set_of_a_group [generating set]: https://en.wikipedia.org/wiki/Generating_set_of_a_group
A group is called [cyclic] if the whole group can be generated by a (not necessarily A group is called [cyclic] if it has a (not necessarily unique) generating set with only
unique) single element. a single element — call it $g$. In that case we can say that $g$ generates the group, and
that the order of $g$ is the order of the group.
Any finite cyclic group $\mathbb{G}$ of order $n$ is [isomorphic] to the integers Any finite cyclic group $\mathbb{G}$ of order $n$ is [isomorphic] to the integers
modulo $n$ (denoted $\mathbb{Z}/n\mathbb{Z}$), such that: modulo $n$ (denoted $\mathbb{Z}/n\mathbb{Z}$), such that:
- the operation $\cdot$ in $\mathbb{G}$ corresponds to addition modulo $n$; - the operation $\cdot$ in $\mathbb{G}$ corresponds to addition modulo $n$;
- the identity $\mathcal{O} \in \mathbb{G}$ corresponds to $0$; - the identity in $\mathbb{G}$ corresponds to $0$;
- some generator $G \in \mathbb{G}$ corresponds to $1$. - some generator $g \in \mathbb{G}$ corresponds to $1$.
Given a generator $G$, the isomorphism is always easy to compute in the Given a generator $g$, the isomorphism is always easy to compute in the
$\mathbb{Z}/n\mathbb{Z} \rightarrow \mathbb{G}$ direction; it is just $a \mapsto [a] G$. $\mathbb{Z}/n\mathbb{Z} \rightarrow \mathbb{G}$ direction; it is just $a \mapsto g^a$
(or in additive notation, $a \mapsto [a] g$).
It may be difficult in general to compute in the $\mathbb{G} \rightarrow \mathbb{Z}/n\mathbb{Z}$ It may be difficult in general to compute in the $\mathbb{G} \rightarrow \mathbb{Z}/n\mathbb{Z}$
direction; we'll discuss this further when we come to [elliptic curves](curves.md). direction; we'll discuss this further when we come to [elliptic curves](curves.md).