mirror of
https://github.com/saymrwulf/risc0-curve25519-dalek-source.git
synced 2026-09-04 20:03:40 +00:00
Rename ExtendedPoint to EdwardsPoint.
This commit is contained in:
Isis Lovecruft
parent
9cb915126e
commit
4f37785f0e
9 changed files with 278 additions and 278 deletions
|
|
@ -13,7 +13,7 @@
|
|||
use stdsimd::simd::u32x8;
|
||||
|
||||
use backend::avx2::field::FieldElement32x4;
|
||||
use backend::avx2::edwards::ExtendedPoint;
|
||||
use backend::avx2::edwards::EdwardsPoint;
|
||||
|
||||
/// The low limbs of (2p, 2p, 2p, 2p), so that
|
||||
/// ```no_run
|
||||
|
|
@ -52,57 +52,57 @@ pub(crate) static P_TIMES_2_MASKED: FieldElement32x4 = FieldElement32x4([
|
|||
]);
|
||||
|
||||
/// Odd multiples of the Ed25519 basepoint:
|
||||
pub static ODD_MULTIPLES_OF_BASEPOINT: [ExtendedPoint; 8] = [
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
pub static ODD_MULTIPLES_OF_BASEPOINT: [EdwardsPoint; 8] = [
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(52811034, 40265304, 25909283, 26843545, 1, 28827043, 0, 27438313),
|
||||
u32x8::new(16144682, 13421772, 17082669, 20132659, 0, 39759291, 0, 244362),
|
||||
u32x8::new(27570973, 26843545, 30858332, 6710886, 0, 8635006, 0, 11264893),
|
||||
u32x8::new(40966398, 53687091, 8378388, 13421772, 0, 19351346, 0, 13413597),
|
||||
u32x8::new(20764389, 40265318, 8758491, 26843545, 0, 16611511, 0, 27139452),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(63703867, 19156774, 608100, 2486757, 12685460, 3173753, 21649412, 16313381),
|
||||
u32x8::new(52397038, 65858675, 26775664, 16661035, 14269998, 9080558, 1059463, 28938752),
|
||||
u32x8::new( 5461635, 28034025, 23358301, 1245198, 1367765, 20288887, 31111942, 18395221),
|
||||
u32x8::new( 1886934, 32436996, 681756, 18977693, 8129860, 40112764, 25764567, 11876840),
|
||||
u32x8::new(63042604, 52399761, 22087481, 29829870, 8565820, 33723612, 28645162, 8502864),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(14879397, 3951036, 9454671, 16606238, 23529732, 44147004, 11890541, 17067526),
|
||||
u32x8::new(58509479, 57216664, 9671992, 32001147, 60966207, 11801823, 10808378, 15115613),
|
||||
u32x8::new(54854992, 39210911, 8112050, 1353604, 1337416, 35520540, 32967851, 17786030),
|
||||
u32x8::new(59007462, 40864509, 26240923, 30403852, 28456403, 21546582, 32732450, 21005910),
|
||||
u32x8::new(40711675, 22446613, 9664668, 12483629, 26142305, 56254715, 15439904, 214849),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(52231579, 51632644, 173613, 7677257, 26374424, 45994428, 5303371, 1425942),
|
||||
u32x8::new(38126791, 48854506, 23252518, 30611978, 49977504, 66706952, 1076178, 27100873),
|
||||
u32x8::new(26349427, 63077566, 20258199, 3884787, 33226507, 2371423, 5787271, 18628170),
|
||||
u32x8::new(15005754, 22729577, 4978944, 2522289, 1404784, 56367795, 22517039, 29271243),
|
||||
u32x8::new(22748934, 35977548, 25561257, 31734126, 22775284, 32000077, 927866, 2278697),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(66090281, 61980626, 23780289, 6519561, 62542590, 47174086, 28818882, 15661068),
|
||||
u32x8::new(17433715, 12931425, 12232056, 7885877, 44179512, 35590146, 32787344, 22631048),
|
||||
u32x8::new(43729883, 6870635, 15782399, 11810556, 2652935, 31800505, 23683367, 13638649),
|
||||
u32x8::new(64007953, 40242373, 32810277, 20180235, 20399465, 48133835, 32913956, 19094667),
|
||||
u32x8::new(56562708, 40269142, 18953105, 9027935, 35700921, 12896915, 14757156, 22773619),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(65129016, 34709402, 25132940, 13788431, 3661652, 16914498, 27409409, 18941039),
|
||||
u32x8::new(42488074, 49427602, 6177212, 20812339, 41644653, 2977316, 12162542, 5293661),
|
||||
u32x8::new( 7981168, 12223605, 6239200, 20403609, 20710415, 4828170, 11627702, 4431044),
|
||||
u32x8::new(65817142, 96824, 25021652, 16364722, 50410869, 24651857, 6979034, 33176209),
|
||||
u32x8::new(33008344, 8687253, 27859668, 28796356, 30192014, 11975680, 11991047, 27710707),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(14676653, 50945941, 13489249, 31456262, 47726639, 21761847, 3324839, 7843947),
|
||||
u32x8::new(53352326, 8688989, 12944061, 12994004, 50113821, 37990636, 1537898, 20483689),
|
||||
u32x8::new(46786852, 15572264, 24004728, 7566233, 32596174, 34437796, 23201722, 3431551),
|
||||
u32x8::new(49025674, 52497128, 13273618, 10266201, 66795206, 2887684, 30966565, 33449990),
|
||||
u32x8::new(53210238, 65839385, 15458877, 18409918, 24777464, 25586795, 15335748, 12323382),
|
||||
])),
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(57816016, 23106045, 24948505, 27413507, 32551424, 26145165, 22632568, 27527446),
|
||||
u32x8::new(53022711, 40974949, 14110533, 30646997, 51399118, 53289754, 32528560, 15822835),
|
||||
u32x8::new(23810949, 51779690, 17532625, 21326637, 60314333, 43761996, 4852905, 3474945),
|
||||
|
|
|
|||
|
|
@ -35,36 +35,36 @@ use backend::avx2;
|
|||
|
||||
/// A point on Curve25519, represented in an AVX2-friendly format.
|
||||
#[derive(Copy, Clone, Debug)]
|
||||
pub struct ExtendedPoint(pub(super) FieldElement32x4);
|
||||
pub struct EdwardsPoint(pub(super) FieldElement32x4);
|
||||
|
||||
impl From<edwards::ExtendedPoint> for ExtendedPoint {
|
||||
fn from(P: edwards::ExtendedPoint) -> ExtendedPoint {
|
||||
ExtendedPoint(FieldElement32x4::new(&P.X, &P.Y, &P.Z, &P.T))
|
||||
impl From<edwards::EdwardsPoint> for EdwardsPoint {
|
||||
fn from(P: edwards::EdwardsPoint) -> EdwardsPoint {
|
||||
EdwardsPoint(FieldElement32x4::new(&P.X, &P.Y, &P.Z, &P.T))
|
||||
}
|
||||
}
|
||||
|
||||
impl From<ExtendedPoint> for edwards::ExtendedPoint {
|
||||
fn from(P: ExtendedPoint) -> edwards::ExtendedPoint {
|
||||
impl From<EdwardsPoint> for edwards::EdwardsPoint {
|
||||
fn from(P: EdwardsPoint) -> edwards::EdwardsPoint {
|
||||
let tmp = P.0.split();
|
||||
edwards::ExtendedPoint{X: tmp[0], Y: tmp[1], Z: tmp[2], T: tmp[3]}
|
||||
edwards::EdwardsPoint{X: tmp[0], Y: tmp[1], Z: tmp[2], T: tmp[3]}
|
||||
}
|
||||
}
|
||||
|
||||
impl ConditionallyAssignable for ExtendedPoint {
|
||||
fn conditional_assign(&mut self, other: &ExtendedPoint, choice: u8) {
|
||||
impl ConditionallyAssignable for EdwardsPoint {
|
||||
fn conditional_assign(&mut self, other: &EdwardsPoint, choice: u8) {
|
||||
self.0.conditional_assign(&other.0, choice);
|
||||
}
|
||||
}
|
||||
|
||||
impl Default for ExtendedPoint {
|
||||
fn default() -> ExtendedPoint {
|
||||
ExtendedPoint::identity()
|
||||
impl Default for EdwardsPoint {
|
||||
fn default() -> EdwardsPoint {
|
||||
EdwardsPoint::identity()
|
||||
}
|
||||
}
|
||||
|
||||
impl Identity for ExtendedPoint {
|
||||
fn identity() -> ExtendedPoint {
|
||||
ExtendedPoint(FieldElement32x4([
|
||||
impl Identity for EdwardsPoint {
|
||||
fn identity() -> EdwardsPoint {
|
||||
EdwardsPoint(FieldElement32x4([
|
||||
u32x8::new(0,1,0,0,1,0,0,0),
|
||||
u32x8::splat(0),
|
||||
u32x8::splat(0),
|
||||
|
|
@ -78,8 +78,8 @@ impl Identity for ExtendedPoint {
|
|||
#[derive(Copy, Clone, Debug)]
|
||||
pub struct CachedPoint(pub(super) FieldElement32x4);
|
||||
|
||||
impl From<ExtendedPoint> for CachedPoint {
|
||||
fn from(P: ExtendedPoint) -> CachedPoint {
|
||||
impl From<EdwardsPoint> for CachedPoint {
|
||||
fn from(P: EdwardsPoint) -> CachedPoint {
|
||||
let mut x = P.0;
|
||||
|
||||
// x = (S2 S3 Z2 T2)
|
||||
|
|
@ -130,10 +130,10 @@ impl<'a> Neg for &'a CachedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
impl<'a> Neg for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a> Neg for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
fn neg(self) -> ExtendedPoint {
|
||||
fn neg(self) -> EdwardsPoint {
|
||||
let mut neg = *self;
|
||||
// (X Y Z T) -> (-X Y Z -T)
|
||||
neg.0.negate(A_LANES | D_LANES);
|
||||
|
|
@ -141,8 +141,8 @@ impl<'a> Neg for &'a ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
impl ExtendedPoint {
|
||||
fn double(&self) -> ExtendedPoint {
|
||||
impl EdwardsPoint {
|
||||
fn double(&self) -> EdwardsPoint {
|
||||
unsafe {
|
||||
use stdsimd::vendor::_mm256_permute2x128_si256;
|
||||
use stdsimd::vendor::_mm256_permutevar8x32_epi32;
|
||||
|
|
@ -232,12 +232,12 @@ impl ExtendedPoint {
|
|||
t1.0[i] = _mm256_permutevar8x32_epi32(tmp, c1);
|
||||
}
|
||||
|
||||
ExtendedPoint(&t0 * &t1)
|
||||
EdwardsPoint(&t0 * &t1)
|
||||
}
|
||||
}
|
||||
|
||||
pub fn mult_by_pow_2(&self, k: u32) -> ExtendedPoint {
|
||||
let mut tmp: ExtendedPoint = *self;
|
||||
pub fn mult_by_pow_2(&self, k: u32) -> EdwardsPoint {
|
||||
let mut tmp: EdwardsPoint = *self;
|
||||
for _ in 0..k {
|
||||
tmp = tmp.double();
|
||||
}
|
||||
|
|
@ -245,11 +245,11 @@ impl ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Add<&'b CachedPoint> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Add<&'b CachedPoint> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Uses a slight tweak of the parallel unified formulas of HWCD'08
|
||||
fn add(self, other: &'b CachedPoint) -> ExtendedPoint {
|
||||
fn add(self, other: &'b CachedPoint) -> EdwardsPoint {
|
||||
unsafe {
|
||||
use stdsimd::vendor::_mm256_permutevar8x32_epi32;
|
||||
|
||||
|
|
@ -280,16 +280,16 @@ impl<'a, 'b> Add<&'b CachedPoint> for &'a ExtendedPoint {
|
|||
}
|
||||
|
||||
// return (S12*S14 S15*S13 S15*S14 S12*S13) = (X3 Y3 Z3 T3)
|
||||
ExtendedPoint(&t0 * &t1)
|
||||
EdwardsPoint(&t0 * &t1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Add<&'b ExtendedPoint> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Add<&'b EdwardsPoint> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Uses a slight tweak of the parallel unified formulas of HWCD'08
|
||||
fn add(self, other: &'b ExtendedPoint) -> ExtendedPoint {
|
||||
fn add(self, other: &'b EdwardsPoint) -> EdwardsPoint {
|
||||
unsafe {
|
||||
use stdsimd::vendor::_mm256_permute2x128_si256;
|
||||
use stdsimd::vendor::_mm256_permutevar8x32_epi32;
|
||||
|
|
@ -342,25 +342,25 @@ impl<'a, 'b> Add<&'b ExtendedPoint> for &'a ExtendedPoint {
|
|||
}
|
||||
|
||||
// return (S12*S14 S15*S13 S15*S14 S12*S13) = (X3 Y3 Z3 T3)
|
||||
ExtendedPoint(&t0 * &t1)
|
||||
EdwardsPoint(&t0 * &t1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Sub<&'b ExtendedPoint> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Sub<&'b EdwardsPoint> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Implement subtraction by negating the point and adding.
|
||||
///
|
||||
/// Empirically, this seems about the same cost as a custom subtraction impl (maybe because the
|
||||
/// benefit is cancelled by increased code size?)
|
||||
fn sub(self, other: &'b ExtendedPoint) -> ExtendedPoint {
|
||||
fn sub(self, other: &'b EdwardsPoint) -> EdwardsPoint {
|
||||
self + &(-other)
|
||||
}
|
||||
}
|
||||
|
||||
impl From<ExtendedPoint> for LookupTable<CachedPoint> {
|
||||
fn from(P: ExtendedPoint) -> Self {
|
||||
impl From<EdwardsPoint> for LookupTable<CachedPoint> {
|
||||
fn from(P: EdwardsPoint) -> Self {
|
||||
let mut points = [CachedPoint::from(P); 8];
|
||||
for i in 0..7 {
|
||||
points[i+1] = (&P + &points[i]).into();
|
||||
|
|
@ -369,12 +369,12 @@ impl From<ExtendedPoint> for LookupTable<CachedPoint> {
|
|||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
/// Scalar multiplication: compute `scalar * self`.
|
||||
///
|
||||
/// Uses a window of size 4.
|
||||
fn mul(self, scalar: &'b Scalar) -> ExtendedPoint {
|
||||
fn mul(self, scalar: &'b Scalar) -> EdwardsPoint {
|
||||
// Construct a lookup table of [P,2P,3P,4P,5P,6P,7P,8P]
|
||||
let lookup_table = LookupTable::<CachedPoint>::from(*self);
|
||||
|
||||
|
|
@ -392,7 +392,7 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
|||
// s*P = P*s_0 + 16*(P*s_1 + 16*(P*s_2 + 16*( ... + P*s_63)...))
|
||||
//
|
||||
// We sum right-to-left.
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
for i in (0..64).rev() {
|
||||
// Q = 16*Q
|
||||
Q = Q.mult_by_pow_2(4);
|
||||
|
|
@ -407,13 +407,13 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
|||
pub struct EdwardsBasepointTable(pub [LookupTable<CachedPoint>; 32]);
|
||||
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsBasepointTable {
|
||||
type Output = ExtendedPoint;
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
fn mul(self, scalar: &'b Scalar) -> ExtendedPoint {
|
||||
fn mul(self, scalar: &'b Scalar) -> EdwardsPoint {
|
||||
let a = scalar.to_radix_16();
|
||||
|
||||
let tables = &self.0;
|
||||
let mut P = ExtendedPoint::identity();
|
||||
let mut P = EdwardsPoint::identity();
|
||||
|
||||
for i in (0..64).filter(|x| x % 2 == 1) {
|
||||
P = &P + &tables[i/2].select(a[i]);
|
||||
|
|
@ -430,17 +430,17 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsBasepointTable {
|
|||
}
|
||||
|
||||
impl<'a, 'b> Mul<&'a EdwardsBasepointTable> for &'b Scalar {
|
||||
type Output = ExtendedPoint;
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Given `self` a table of precomputed multiples of the point `B`, compute `B * s`.
|
||||
fn mul(self, basepoint_table: &'a EdwardsBasepointTable) -> ExtendedPoint {
|
||||
fn mul(self, basepoint_table: &'a EdwardsBasepointTable) -> EdwardsPoint {
|
||||
basepoint_table * &self
|
||||
}
|
||||
}
|
||||
|
||||
impl EdwardsBasepointTable {
|
||||
/// Create a table of precomputed multiples of `basepoint`.
|
||||
pub fn create(basepoint: &ExtendedPoint) -> EdwardsBasepointTable {
|
||||
pub fn create(basepoint: &EdwardsPoint) -> EdwardsBasepointTable {
|
||||
// XXX use init_with
|
||||
let mut table = EdwardsBasepointTable([LookupTable::default(); 32]);
|
||||
let mut P = *basepoint;
|
||||
|
|
@ -461,24 +461,24 @@ impl EdwardsBasepointTable {
|
|||
///
|
||||
/// # Input
|
||||
///
|
||||
/// A vector of `Scalar`s and a vector of `ExtendedPoints`. It is an
|
||||
/// A vector of `Scalar`s and a vector of `EdwardsPoints`. It is an
|
||||
/// error to call this function with two vectors of different lengths.
|
||||
///
|
||||
/// XXX this takes `edwards::ExtendedPoints` because we have to alloc scratch space here anyways,
|
||||
/// XXX this takes `edwards::EdwardsPoints` because we have to alloc scratch space here anyways,
|
||||
/// and we need some space to store the converted points, so we may as well do the conversion here.
|
||||
/// maybe there's a better way to avoid code duplication... however we can't quite just write a
|
||||
/// generic `multiscalar_mult` because the non-vectorized code passes between models and this code
|
||||
/// doesn't.
|
||||
#[cfg(any(feature = "alloc", feature = "std"))]
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> edwards::ExtendedPoint
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> edwards::EdwardsPoint
|
||||
where I: IntoIterator<Item = &'a Scalar>,
|
||||
J: IntoIterator<Item = &'b edwards::ExtendedPoint>
|
||||
J: IntoIterator<Item = &'b edwards::EdwardsPoint>
|
||||
{
|
||||
//assert_eq!(scalars.len(), points.len());
|
||||
|
||||
use clear_on_drop::ClearOnDrop;
|
||||
let lookup_tables_vec: Vec<_> = points.into_iter()
|
||||
.map(|P| LookupTable::from(ExtendedPoint::from(*P)) )
|
||||
.map(|P| LookupTable::from(EdwardsPoint::from(*P)) )
|
||||
.collect();
|
||||
|
||||
let lookup_tables = ClearOnDrop::new(lookup_tables_vec);
|
||||
|
|
@ -516,7 +516,7 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> edwards::Extende
|
|||
// This provides the speedup over doing n independent scalar
|
||||
// mults: we perform 63 multiplications by 16 instead of 63*n
|
||||
// multiplications, saving 252*(n-1) doublings.
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
// XXX this algorithm makes no effort to be cache-aware; maybe it could be improved?
|
||||
for j in (0..64).rev() {
|
||||
Q = Q.mult_by_pow_2(4);
|
||||
|
|
@ -534,10 +534,10 @@ pub mod vartime {
|
|||
use super::*;
|
||||
|
||||
/// Holds odd multiples 1A, 3A, ..., 15A of a point A.
|
||||
struct OddMultiples([ExtendedPoint; 8]);
|
||||
struct OddMultiples([EdwardsPoint; 8]);
|
||||
|
||||
impl OddMultiples {
|
||||
fn create(A: ExtendedPoint) -> OddMultiples {
|
||||
fn create(A: EdwardsPoint) -> OddMultiples {
|
||||
// XXX would be great to skip this initialization
|
||||
let mut Ai = [A; 8];
|
||||
let A2 = A.double();
|
||||
|
|
@ -550,9 +550,9 @@ pub mod vartime {
|
|||
}
|
||||
|
||||
impl Index<usize> for OddMultiples {
|
||||
type Output = ExtendedPoint;
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
fn index(&self, _index: usize) -> &ExtendedPoint {
|
||||
fn index(&self, _index: usize) -> &EdwardsPoint {
|
||||
&(self.0[_index])
|
||||
}
|
||||
}
|
||||
|
|
@ -563,8 +563,8 @@ pub mod vartime {
|
|||
///
|
||||
/// This is the same as calling the iterator-based function, but slightly faster.
|
||||
pub fn double_scalar_mult_basepoint(a: &Scalar,
|
||||
A: &edwards::ExtendedPoint,
|
||||
b: &Scalar) -> edwards::ExtendedPoint {
|
||||
A: &edwards::EdwardsPoint,
|
||||
b: &Scalar) -> edwards::EdwardsPoint {
|
||||
let a_naf = a.non_adjacent_form();
|
||||
let b_naf = b.non_adjacent_form();
|
||||
|
||||
|
|
@ -580,7 +580,7 @@ pub mod vartime {
|
|||
let odd_multiples_of_A = OddMultiples::create((*A).into());
|
||||
let odd_multiples_of_B = &avx2::constants::ODD_MULTIPLES_OF_BASEPOINT;
|
||||
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
|
||||
loop {
|
||||
Q = Q.double();
|
||||
|
|
@ -613,12 +613,12 @@ pub mod vartime {
|
|||
///
|
||||
/// # Input
|
||||
///
|
||||
/// A vector of `Scalar`s and a vector of `ExtendedPoints`. It is an
|
||||
/// A vector of `Scalar`s and a vector of `EdwardsPoints`. It is an
|
||||
/// error to call this function with two vectors of different lengths.
|
||||
#[cfg(any(feature = "alloc", feature = "std"))]
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> edwards::ExtendedPoint
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> edwards::EdwardsPoint
|
||||
where I: IntoIterator<Item = &'a Scalar>,
|
||||
J: IntoIterator<Item = &'b edwards::ExtendedPoint>
|
||||
J: IntoIterator<Item = &'b edwards::EdwardsPoint>
|
||||
{
|
||||
//assert_eq!(scalars.len(), points.len());
|
||||
|
||||
|
|
@ -628,7 +628,7 @@ pub mod vartime {
|
|||
let odd_multiples: Vec<_> = points.into_iter()
|
||||
.map(|P| OddMultiples::create((*P).into()) ).collect();
|
||||
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
|
||||
for i in (0..255).rev() {
|
||||
Q = Q.double();
|
||||
|
|
@ -651,7 +651,7 @@ mod test {
|
|||
|
||||
use constants;
|
||||
|
||||
fn serial_add(P: edwards::ExtendedPoint, Q: edwards::ExtendedPoint) -> edwards::ExtendedPoint {
|
||||
fn serial_add(P: edwards::EdwardsPoint, Q: edwards::EdwardsPoint) -> edwards::EdwardsPoint {
|
||||
use backend::u64::field::FieldElement64;
|
||||
|
||||
let (X1, Y1, Z1, T1) = (P.X, P.Y, P.Z, P.T);
|
||||
|
|
@ -708,20 +708,20 @@ mod test {
|
|||
let Z3 = &S15 * &S14; // R2 * R3
|
||||
let T3 = &S12 * &S13; // R1 * R4
|
||||
|
||||
edwards::ExtendedPoint{X: X3, Y: Y3, Z: Z3, T: T3}
|
||||
edwards::EdwardsPoint{X: X3, Y: Y3, Z: Z3, T: T3}
|
||||
}
|
||||
|
||||
fn addition_test_helper(P: edwards::ExtendedPoint, Q: edwards::ExtendedPoint) {
|
||||
fn addition_test_helper(P: edwards::EdwardsPoint, Q: edwards::EdwardsPoint) {
|
||||
// Test the serial implementation of the parallel addition formulas
|
||||
let R_serial: edwards::ExtendedPoint = serial_add(P.into(), Q.into()).into();
|
||||
let R_serial: edwards::EdwardsPoint = serial_add(P.into(), Q.into()).into();
|
||||
// Test the vector implementation of the parallel addition formulas
|
||||
let R_vector: edwards::ExtendedPoint = (&ExtendedPoint::from(P) + &ExtendedPoint::from(Q)).into();
|
||||
let R_vector: edwards::EdwardsPoint = (&EdwardsPoint::from(P) + &EdwardsPoint::from(Q)).into();
|
||||
// Test the vector implementation of the parallel subtraction formulas
|
||||
let S_vector: edwards::ExtendedPoint = (&ExtendedPoint::from(P) - &ExtendedPoint::from(Q)).into();
|
||||
let S_vector: edwards::EdwardsPoint = (&EdwardsPoint::from(P) - &EdwardsPoint::from(Q)).into();
|
||||
|
||||
// Test the vector implementation of the parallel readdition formulas
|
||||
let cached_Q = CachedPoint::from(ExtendedPoint::from(Q));
|
||||
let T_vector: edwards::ExtendedPoint = (&ExtendedPoint::from(P) + &cached_Q).into();
|
||||
let cached_Q = CachedPoint::from(EdwardsPoint::from(Q));
|
||||
let T_vector: edwards::EdwardsPoint = (&EdwardsPoint::from(P) + &cached_Q).into();
|
||||
|
||||
println!("Testing point addition:");
|
||||
println!("P = {:?}", P);
|
||||
|
|
@ -742,18 +742,18 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn sub_vs_add_minus() {
|
||||
let P: ExtendedPoint = edwards::ExtendedPoint::identity().into();
|
||||
let Q: ExtendedPoint = edwards::ExtendedPoint::identity().into();
|
||||
let P: EdwardsPoint = edwards::EdwardsPoint::identity().into();
|
||||
let Q: EdwardsPoint = edwards::EdwardsPoint::identity().into();
|
||||
|
||||
let mQ = -&Q;
|
||||
|
||||
println!("sub");
|
||||
let R1: edwards::ExtendedPoint = (&P - &Q).into();
|
||||
let R1: edwards::EdwardsPoint = (&P - &Q).into();
|
||||
println!("add neg");
|
||||
let R2: edwards::ExtendedPoint = (&P + &mQ).into();
|
||||
let R2: edwards::EdwardsPoint = (&P + &mQ).into();
|
||||
|
||||
assert_eq!(R2.compress(), edwards::ExtendedPoint::identity().compress());
|
||||
assert_eq!(R1.compress(), edwards::ExtendedPoint::identity().compress());
|
||||
assert_eq!(R2.compress(), edwards::EdwardsPoint::identity().compress());
|
||||
assert_eq!(R1.compress(), edwards::EdwardsPoint::identity().compress());
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -763,12 +763,12 @@ mod test {
|
|||
use scalar::Scalar;
|
||||
|
||||
println!("Testing id +- id");
|
||||
let P = edwards::ExtendedPoint::identity();
|
||||
let Q = edwards::ExtendedPoint::identity();
|
||||
let P = edwards::EdwardsPoint::identity();
|
||||
let Q = edwards::EdwardsPoint::identity();
|
||||
addition_test_helper(P, Q);
|
||||
|
||||
println!("Testing id +- B");
|
||||
let P = edwards::ExtendedPoint::identity();
|
||||
let P = edwards::EdwardsPoint::identity();
|
||||
let Q = constants::ED25519_BASEPOINT_POINT;
|
||||
addition_test_helper(P, Q);
|
||||
|
||||
|
|
@ -783,7 +783,7 @@ mod test {
|
|||
addition_test_helper(P, Q);
|
||||
}
|
||||
|
||||
fn serial_double(P: edwards::ExtendedPoint) -> edwards::ExtendedPoint {
|
||||
fn serial_double(P: edwards::EdwardsPoint) -> edwards::EdwardsPoint {
|
||||
let (X1, Y1, Z1, T1) = (P.X, P.Y, P.Z, P.T);
|
||||
|
||||
macro_rules! print_var {
|
||||
|
|
@ -823,12 +823,12 @@ mod test {
|
|||
let Z3 = &S8 * &S6;
|
||||
let T3 = &S5 * &S9;
|
||||
|
||||
edwards::ExtendedPoint{X: X3, Y: Y3, Z: Z3, T: T3}
|
||||
edwards::EdwardsPoint{X: X3, Y: Y3, Z: Z3, T: T3}
|
||||
}
|
||||
|
||||
fn doubling_test_helper(P: edwards::ExtendedPoint) {
|
||||
let R1: edwards::ExtendedPoint = serial_double(P.into()).into();
|
||||
let R2: edwards::ExtendedPoint = ExtendedPoint::from(P).double().into();
|
||||
fn doubling_test_helper(P: edwards::EdwardsPoint) {
|
||||
let R1: edwards::EdwardsPoint = serial_double(P.into()).into();
|
||||
let R2: edwards::EdwardsPoint = EdwardsPoint::from(P).double().into();
|
||||
println!("Testing point doubling:");
|
||||
println!("P = {:?}", P);
|
||||
println!("(serial) R1 = {:?}", R1);
|
||||
|
|
@ -845,7 +845,7 @@ mod test {
|
|||
use scalar::Scalar;
|
||||
|
||||
println!("Testing [2]id");
|
||||
let P = edwards::ExtendedPoint::identity();
|
||||
let P = edwards::EdwardsPoint::identity();
|
||||
doubling_test_helper(P);
|
||||
|
||||
println!("Testing [2]B");
|
||||
|
|
@ -859,26 +859,26 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn identity_trait_vs_edwards_identity() {
|
||||
let id1: edwards::ExtendedPoint = ExtendedPoint::identity().into();
|
||||
let id2: edwards::ExtendedPoint = edwards::ExtendedPoint::identity();
|
||||
let id1: edwards::EdwardsPoint = EdwardsPoint::identity().into();
|
||||
let id2: edwards::EdwardsPoint = edwards::EdwardsPoint::identity();
|
||||
assert_eq!(id1.compress(), id2.compress());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn neg_vs_edwards_neg() {
|
||||
let B: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let Bneg = -&B;
|
||||
assert_eq!(edwards::ExtendedPoint::from(Bneg).compress(),
|
||||
assert_eq!(edwards::EdwardsPoint::from(Bneg).compress(),
|
||||
(-&constants::ED25519_BASEPOINT_POINT).compress());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scalar_mult_vs_edwards_scalar_mult() {
|
||||
let B: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
// some random bytes
|
||||
let s = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
|
||||
let R1 = edwards::ExtendedPoint::from(&B * &s);
|
||||
let R1 = edwards::EdwardsPoint::from(&B * &s);
|
||||
let R2 = &constants::ED25519_BASEPOINT_TABLE * &s;
|
||||
|
||||
assert_eq!(R1.compress(), R2.compress());
|
||||
|
|
@ -886,7 +886,7 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn scalar_mult_vs_basepoint_table_scalar_mult() {
|
||||
let B: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B_table = EdwardsBasepointTable::create(&B);
|
||||
// some random bytes
|
||||
let s = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
|
|
@ -894,13 +894,13 @@ mod test {
|
|||
let P1 = &B * &s;
|
||||
let P2 = &B_table * &s;
|
||||
|
||||
assert_eq!(edwards::ExtendedPoint::from(P1).compress(),
|
||||
edwards::ExtendedPoint::from(P2).compress());
|
||||
assert_eq!(edwards::EdwardsPoint::from(P1).compress(),
|
||||
edwards::EdwardsPoint::from(P2).compress());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn multiscalar_mult_vs_adding_scalar_mults() {
|
||||
let B: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let s1 = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
let s2 = Scalar::from_bits([165, 30, 79, 89, 58, 24, 195, 245, 248, 146, 203, 236, 119, 43, 64, 119, 196, 111, 188, 251, 248, 53, 234, 59, 215, 28, 218, 13, 59, 120, 14, 4]);
|
||||
|
||||
|
|
@ -911,7 +911,7 @@ mod test {
|
|||
|
||||
let R_multiscalar = multiscalar_mult(&[s1, s2], &[P1.into(), P2.into()]);
|
||||
|
||||
assert_eq!(edwards::ExtendedPoint::from(R).compress(),
|
||||
assert_eq!(edwards::EdwardsPoint::from(R).compress(),
|
||||
R_multiscalar.compress());
|
||||
}
|
||||
|
||||
|
|
@ -920,7 +920,7 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn multiscalar_mult_vs_adding_scalar_mults() {
|
||||
let B: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let B: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.into();
|
||||
let s1 = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
let s2 = Scalar::from_bits([165, 30, 79, 89, 58, 24, 195, 245, 248, 146, 203, 236, 119, 43, 64, 119, 196, 111, 188, 251, 248, 53, 234, 59, 215, 28, 218, 13, 59, 120, 14, 4]);
|
||||
|
||||
|
|
@ -931,7 +931,7 @@ mod test {
|
|||
|
||||
let R_multiscalar = vartime::multiscalar_mult(&[s1, s2], &[P1.into(), P2.into()]);
|
||||
|
||||
assert_eq!(edwards::ExtendedPoint::from(R).compress(),
|
||||
assert_eq!(edwards::EdwardsPoint::from(R).compress(),
|
||||
R_multiscalar.compress());
|
||||
}
|
||||
}
|
||||
|
|
@ -950,22 +950,22 @@ mod bench {
|
|||
fn conversion_into__avx2_format(b: &mut Bencher) {
|
||||
let B = constants::ED25519_BASEPOINT_POINT;
|
||||
|
||||
b.iter(|| ExtendedPoint::from(B));
|
||||
b.iter(|| EdwardsPoint::from(B));
|
||||
}
|
||||
|
||||
#[bench]
|
||||
fn conversion_outof_avx2_format(b: &mut Bencher) {
|
||||
let B = constants::ED25519_BASEPOINT_POINT;
|
||||
let B_avx2 = ExtendedPoint::from(B);
|
||||
let B_avx2 = EdwardsPoint::from(B);
|
||||
|
||||
b.iter(|| edwards::ExtendedPoint::from(B_avx2));
|
||||
b.iter(|| edwards::EdwardsPoint::from(B_avx2));
|
||||
}
|
||||
|
||||
#[bench]
|
||||
fn point_readdition(b: &mut Bencher) {
|
||||
let B = &constants::ED25519_BASEPOINT_TABLE;
|
||||
let P = ExtendedPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let Q = ExtendedPoint::from(B * &Scalar::from_u64(98932328));
|
||||
let P = EdwardsPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let Q = EdwardsPoint::from(B * &Scalar::from_u64(98932328));
|
||||
let Q_cached = CachedPoint::from(Q);
|
||||
|
||||
b.iter(|| &P + &Q_cached );
|
||||
|
|
@ -974,8 +974,8 @@ mod bench {
|
|||
#[bench]
|
||||
fn point_addition(b: &mut Bencher) {
|
||||
let B = &constants::ED25519_BASEPOINT_TABLE;
|
||||
let P = ExtendedPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let Q = ExtendedPoint::from(B * &Scalar::from_u64(98932328));
|
||||
let P = EdwardsPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let Q = EdwardsPoint::from(B * &Scalar::from_u64(98932328));
|
||||
|
||||
b.iter(|| &P + &Q );
|
||||
}
|
||||
|
|
@ -983,7 +983,7 @@ mod bench {
|
|||
#[bench]
|
||||
fn point_doubling(b: &mut Bencher) {
|
||||
let B = &constants::ED25519_BASEPOINT_TABLE;
|
||||
let P = ExtendedPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let P = EdwardsPoint::from(B * &Scalar::from_u64(83973422));
|
||||
|
||||
b.iter(|| P.double() );
|
||||
}
|
||||
|
|
@ -991,7 +991,7 @@ mod bench {
|
|||
#[bench]
|
||||
fn scalar_mult(b: &mut Bencher) {
|
||||
let B = &constants::ED25519_BASEPOINT_TABLE;
|
||||
let P = ExtendedPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let P = EdwardsPoint::from(B * &Scalar::from_u64(83973422));
|
||||
let s = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
|
||||
b.iter(|| &P * &s );
|
||||
|
|
@ -999,14 +999,14 @@ mod bench {
|
|||
|
||||
#[bench]
|
||||
fn basepoint_table_creation(b: &mut Bencher) {
|
||||
let B = ExtendedPoint::from(constants::ED25519_BASEPOINT_POINT);
|
||||
let B = EdwardsPoint::from(constants::ED25519_BASEPOINT_POINT);
|
||||
|
||||
b.iter(|| EdwardsBasepointTable::create(&B) );
|
||||
}
|
||||
|
||||
#[bench]
|
||||
fn basepoint_mult(b: &mut Bencher) {
|
||||
let B = ExtendedPoint::from(constants::ED25519_BASEPOINT_POINT);
|
||||
let B = EdwardsPoint::from(constants::ED25519_BASEPOINT_POINT);
|
||||
let table = EdwardsBasepointTable::create(&B);
|
||||
let s = Scalar::from_bits([233, 1, 233, 147, 113, 78, 244, 120, 40, 45, 103, 51, 224, 199, 189, 218, 96, 140, 211, 112, 39, 194, 73, 216, 173, 33, 102, 93, 76, 200, 84, 12]);
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
use backend::u32::field::FieldElement32;
|
||||
use backend::u32::scalar::Scalar32;
|
||||
use edwards::ExtendedPoint;
|
||||
use edwards::EdwardsPoint;
|
||||
|
||||
/// Edwards `d` value, equal to `-121665/121666 mod p`.
|
||||
pub(crate) const EDWARDS_D: FieldElement32 = FieldElement32([
|
||||
|
|
@ -84,7 +84,7 @@ pub(crate) const RR: Scalar32 = Scalar32([ 0x0b5f9d12, 0x1e141b17, 0x158d7f3d, 0
|
|||
/// The Ed25519 basepoint has y = 4/5. This is called `_POINT` to
|
||||
/// distinguish it from `_TABLE`, which should be used for scalar
|
||||
/// multiplication (it's much faster).
|
||||
pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
|
||||
pub const ED25519_BASEPOINT_POINT: EdwardsPoint = EdwardsPoint{
|
||||
X: FieldElement32([52811034, 25909283, 16144682, 17082669, 27570973, 30858332, 40966398, 8378388, 20764389, 8758491]),
|
||||
Y: FieldElement32([40265304, 26843545, 13421772, 20132659, 26843545, 6710886, 53687091, 13421772, 40265318, 26843545]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
|
|
@ -98,50 +98,50 @@ pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
|
|||
///
|
||||
/// Thus Ɛ[4] is the points indexed by 0,2,4,6 and Ɛ[2] is the points
|
||||
/// indexed by 0,4.
|
||||
pub const EIGHT_TORSION: [ExtendedPoint; 8] = [
|
||||
ExtendedPoint{
|
||||
pub const EIGHT_TORSION: [EdwardsPoint; 8] = [
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
Y: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([21352778, 5345713, 4660180, 25206575, 24143089, 14568123, 30185756, 21306662, 33579924, 8345318]),
|
||||
Y: FieldElement32([6952903, 1265500, 60246523, 7057497, 4037696, 5447722, 35427965, 15325401, 19365852, 31985330]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([41846657, 21581751, 11716001, 27684820, 48915701, 16297738, 20670665, 24995334, 3541542, 28543251])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([32595773, 7943725, 57730914, 30054016, 54719391, 272472, 25146209, 2005654, 66782178, 22147949]),
|
||||
Y: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([21352778, 5345713, 4660180, 25206575, 24143089, 14568123, 30185756, 21306662, 33579924, 8345318]),
|
||||
Y: FieldElement32([60155942, 32288931, 6862340, 26496934, 63071167, 28106709, 31680898, 18229030, 47743011, 1569101]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([25262188, 11972680, 55392862, 5869611, 18193162, 17256693, 46438198, 8559097, 63567321, 5011180])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
Y: FieldElement32([67108844, 33554431, 67108863, 33554431, 67108863, 33554431, 67108863, 33554431, 67108863, 33554431]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([45756067, 28208718, 62448683, 8347856, 42965774, 18986308, 36923107, 12247769, 33528939, 25209113]),
|
||||
Y: FieldElement32([60155942, 32288931, 6862340, 26496934, 63071167, 28106709, 31680898, 18229030, 47743011, 1569101]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([41846657, 21581751, 11716001, 27684820, 48915701, 16297738, 20670665, 24995334, 3541542, 28543251])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([34513072, 25610706, 9377949, 3500415, 12389472, 33281959, 41962654, 31548777, 326685, 11406482]),
|
||||
Y: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
T: FieldElement32([0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
|
||||
},
|
||||
ExtendedPoint{
|
||||
EdwardsPoint{
|
||||
X: FieldElement32([45756067, 28208718, 62448683, 8347856, 42965774, 18986308, 36923107, 12247769, 33528939, 25209113]),
|
||||
Y: FieldElement32([6952903, 1265500, 60246523, 7057497, 4037696, 5447722, 35427965, 15325401, 19365852, 31985330]),
|
||||
Z: FieldElement32([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
|
||||
use backend::u64::field::FieldElement64;
|
||||
use backend::u64::scalar::Scalar64;
|
||||
use edwards::ExtendedPoint;
|
||||
use edwards::EdwardsPoint;
|
||||
|
||||
/// Edwards `d` value, equal to `-121665/121666 mod p`.
|
||||
pub(crate) const EDWARDS_D: FieldElement64 = FieldElement64([929955233495203, 466365720129213, 1662059464998953, 2033849074728123, 1442794654840575]);
|
||||
|
|
@ -57,7 +57,7 @@ pub(crate) const RR: Scalar64 = Scalar64([ 0x0009d265e952d13b, 0x000d63c715bea69
|
|||
/// The Ed25519 basepoint has y = 4/5. This is called `_POINT` to
|
||||
/// distinguish it from `_TABLE`, which should be used for scalar
|
||||
/// multiplication (it's much faster).
|
||||
pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
|
||||
pub const ED25519_BASEPOINT_POINT: EdwardsPoint = EdwardsPoint{
|
||||
X: FieldElement64([1738742601995546, 1146398526822698, 2070867633025821, 562264141797630, 587772402128613]),
|
||||
Y: FieldElement64([1801439850948184, 1351079888211148, 450359962737049, 900719925474099, 1801439850948198]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
|
|
@ -71,57 +71,57 @@ pub const ED25519_BASEPOINT_POINT: ExtendedPoint = ExtendedPoint{
|
|||
///
|
||||
/// Thus Ɛ[4] is the points indexed by 0,2,4,6 and Ɛ[2] is the points
|
||||
/// indexed by 0,4.
|
||||
pub const EIGHT_TORSION: [ExtendedPoint; 8] = [
|
||||
ExtendedPoint {
|
||||
pub const EIGHT_TORSION: [EdwardsPoint; 8] = [
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([0, 0, 0, 0, 0]),
|
||||
Y: FieldElement64([1, 0, 0, 0, 0]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([0, 0, 0, 0, 0]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([358744748052810, 1691584618240980, 977650209285361, 1429865912637724, 560044844278676]),
|
||||
Y: FieldElement64([84926274344903, 473620666599931, 365590438845504, 1028470286882429, 2146499180330972]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([1448326834587521, 1857896831960481, 1093722731865333, 1677408490711241, 1915505153018406]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([533094393274173, 2016890930128738, 18285341111199, 134597186663265, 1486323764102114]),
|
||||
Y: FieldElement64([0, 0, 0, 0, 0]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([0, 0, 0, 0, 0]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([358744748052810, 1691584618240980, 977650209285361, 1429865912637724, 560044844278676]),
|
||||
Y: FieldElement64([2166873539340326, 1778179147085316, 1886209374839743, 1223329526802818, 105300633354275]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([803472979097708, 393902981724766, 1158077081819914, 574391322974006, 336294660666841]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([0, 0, 0, 0, 0]),
|
||||
Y: FieldElement64([2251799813685228, 2251799813685247, 2251799813685247, 2251799813685247, 2251799813685247]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([0, 0, 0, 0, 0]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([1893055065632419, 560215195444267, 1274149604399886, 821933901047523, 1691754969406571]),
|
||||
Y: FieldElement64([2166873539340326, 1778179147085316, 1886209374839743, 1223329526802818, 105300633354275]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([1448326834587521, 1857896831960481, 1093722731865333, 1677408490711241, 1915505153018406]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([1718705420411056, 234908883556509, 2233514472574048, 2117202627021982, 765476049583133]),
|
||||
Y: FieldElement64([0, 0, 0, 0, 0]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
T: FieldElement64([0, 0, 0, 0, 0]),
|
||||
}
|
||||
,
|
||||
ExtendedPoint {
|
||||
EdwardsPoint {
|
||||
X: FieldElement64([1893055065632419, 560215195444267, 1274149604399886, 821933901047523, 1691754969406571]),
|
||||
Y: FieldElement64([84926274344903, 473620666599931, 365590438845504, 1028470286882429, 2146499180330972]),
|
||||
Z: FieldElement64([1, 0, 0, 0, 0]),
|
||||
|
|
|
|||
|
|
@ -56,7 +56,7 @@
|
|||
//! introduced in [_Twisted Edwards Curves
|
||||
//! Revisited_][hisil-wong-carter-dawson-2008] by Hisil, Wong, Carter,
|
||||
//! and Dawson. In `curve25519-dalek`, it is represented as the
|
||||
//! `ExtendedPoint` struct. We can map from \\(\mathbb P\^3 \\) to
|
||||
//! `EdwardsPoint` struct. We can map from \\(\mathbb P\^3 \\) to
|
||||
//! \\(\mathbb P\^2 \\) by sending \\( (W\_0:W\_1:W\_2:W\_3) \\) to \\(
|
||||
//! (W\_1:W\_2:W\_3) \\). Notice that
|
||||
//! $$
|
||||
|
|
@ -103,7 +103,7 @@
|
|||
//!
|
||||
//! Our naming for the `CompletedPoint` (\\(\mathbb P\^1 \times \mathbb
|
||||
//! P\^1 \\)), `ProjectivePoint` (\\(\mathbb P\^2 \\)), and
|
||||
//! `ExtendedPoint` (\\(\mathbb P\^3 \\)) structs follows the naming in
|
||||
//! `EdwardsPoint` (\\(\mathbb P\^3 \\)) structs follows the naming in
|
||||
//! Adam Langley's [Golang ed25519][agl-ed25519] implementation, which
|
||||
//! `curve25519-dalek` was originally derived from.
|
||||
//!
|
||||
|
|
@ -130,7 +130,7 @@ use core::ops::{Add, Sub, Neg};
|
|||
use constants;
|
||||
|
||||
use field::FieldElement;
|
||||
use edwards::ExtendedPoint;
|
||||
use edwards::EdwardsPoint;
|
||||
use subtle::ConditionallyAssignable;
|
||||
use traits::ValidityCheck;
|
||||
|
||||
|
|
@ -302,8 +302,8 @@ impl ProjectivePoint {
|
|||
/// \\( \mathbb P\^3 \\) model.
|
||||
///
|
||||
/// This costs \\(3 \mathrm M + 1 \mathrm S\\).
|
||||
pub fn to_extended(&self) -> ExtendedPoint {
|
||||
ExtendedPoint{
|
||||
pub fn to_extended(&self) -> EdwardsPoint {
|
||||
EdwardsPoint{
|
||||
X: &self.X * &self.Z,
|
||||
Y: &self.Y * &self.Z,
|
||||
Z: self.Z.square(),
|
||||
|
|
@ -329,8 +329,8 @@ impl CompletedPoint {
|
|||
/// \\) model to the \\( \mathbb P\^3 \\) model.
|
||||
///
|
||||
/// This costs \\(4 \mathrm M \\).
|
||||
pub fn to_extended(&self) -> ExtendedPoint {
|
||||
ExtendedPoint{
|
||||
pub fn to_extended(&self) -> EdwardsPoint {
|
||||
EdwardsPoint{
|
||||
X: &self.X * &self.T,
|
||||
Y: &self.Y * &self.Z,
|
||||
Z: &self.Z * &self.T,
|
||||
|
|
@ -374,7 +374,7 @@ impl ProjectivePoint {
|
|||
//
|
||||
// upstream rust issue: https://github.com/rust-lang/rust/issues/46380
|
||||
//#[doc(hidden)]
|
||||
impl<'a, 'b> Add<&'b ProjectiveNielsPoint> for &'a ExtendedPoint {
|
||||
impl<'a, 'b> Add<&'b ProjectiveNielsPoint> for &'a EdwardsPoint {
|
||||
type Output = CompletedPoint;
|
||||
|
||||
fn add(self, other: &'b ProjectiveNielsPoint) -> CompletedPoint {
|
||||
|
|
@ -396,7 +396,7 @@ impl<'a, 'b> Add<&'b ProjectiveNielsPoint> for &'a ExtendedPoint {
|
|||
}
|
||||
|
||||
//#[doc(hidden)]
|
||||
impl<'a, 'b> Sub<&'b ProjectiveNielsPoint> for &'a ExtendedPoint {
|
||||
impl<'a, 'b> Sub<&'b ProjectiveNielsPoint> for &'a EdwardsPoint {
|
||||
type Output = CompletedPoint;
|
||||
|
||||
fn sub(self, other: &'b ProjectiveNielsPoint) -> CompletedPoint {
|
||||
|
|
@ -418,7 +418,7 @@ impl<'a, 'b> Sub<&'b ProjectiveNielsPoint> for &'a ExtendedPoint {
|
|||
}
|
||||
|
||||
//#[doc(hidden)]
|
||||
impl<'a, 'b> Add<&'b AffineNielsPoint> for &'a ExtendedPoint {
|
||||
impl<'a, 'b> Add<&'b AffineNielsPoint> for &'a EdwardsPoint {
|
||||
type Output = CompletedPoint;
|
||||
|
||||
fn add(self, other: &'b AffineNielsPoint) -> CompletedPoint {
|
||||
|
|
@ -439,7 +439,7 @@ impl<'a, 'b> Add<&'b AffineNielsPoint> for &'a ExtendedPoint {
|
|||
}
|
||||
|
||||
//#[doc(hidden)]
|
||||
impl<'a, 'b> Sub<&'b AffineNielsPoint> for &'a ExtendedPoint {
|
||||
impl<'a, 'b> Sub<&'b AffineNielsPoint> for &'a EdwardsPoint {
|
||||
type Output = CompletedPoint;
|
||||
|
||||
fn sub(self, other: &'b AffineNielsPoint) -> CompletedPoint {
|
||||
|
|
|
|||
|
|
@ -92,12 +92,12 @@ impl<T: Debug> Debug for LookupTable<T> {
|
|||
}
|
||||
}
|
||||
|
||||
use edwards::ExtendedPoint;
|
||||
use edwards::EdwardsPoint;
|
||||
use curve_models::ProjectiveNielsPoint;
|
||||
use curve_models::AffineNielsPoint;
|
||||
|
||||
impl<'a> From<&'a ExtendedPoint> for LookupTable<ProjectiveNielsPoint> {
|
||||
fn from(P: &'a ExtendedPoint) -> Self {
|
||||
impl<'a> From<&'a EdwardsPoint> for LookupTable<ProjectiveNielsPoint> {
|
||||
fn from(P: &'a EdwardsPoint) -> Self {
|
||||
let mut points = [P.to_projective_niels(); 8];
|
||||
for j in 0..7 {
|
||||
points[j+1] = (P + &points[j])
|
||||
|
|
@ -108,8 +108,8 @@ impl<'a> From<&'a ExtendedPoint> for LookupTable<ProjectiveNielsPoint> {
|
|||
}
|
||||
}
|
||||
|
||||
impl<'a> From<&'a ExtendedPoint> for LookupTable<AffineNielsPoint> {
|
||||
fn from(P: &'a ExtendedPoint) -> Self {
|
||||
impl<'a> From<&'a EdwardsPoint> for LookupTable<AffineNielsPoint> {
|
||||
fn from(P: &'a EdwardsPoint) -> Self {
|
||||
let mut points = [P.to_affine_niels(); 8];
|
||||
// XXX batch inversion would be good if perf mattered here
|
||||
for j in 0..7 {
|
||||
|
|
|
|||
208
src/edwards.rs
208
src/edwards.rs
|
|
@ -77,11 +77,11 @@ impl CompressedEdwardsY {
|
|||
self.0
|
||||
}
|
||||
|
||||
/// Attempt to decompress to an `ExtendedPoint`.
|
||||
/// Attempt to decompress to an `EdwardsPoint`.
|
||||
///
|
||||
/// Returns `None` if the input is not the \\(y\\)-coordinate of a
|
||||
/// curve point.
|
||||
pub fn decompress(&self) -> Option<ExtendedPoint> {
|
||||
pub fn decompress(&self) -> Option<EdwardsPoint> {
|
||||
let Y = FieldElement::from_bytes(self.as_bytes());
|
||||
let Z = FieldElement::one();
|
||||
let YY = Y.square();
|
||||
|
|
@ -96,16 +96,16 @@ impl CompressedEdwardsY {
|
|||
let current_sign_bit = X.is_negative();
|
||||
X.conditional_negate(current_sign_bit ^ compressed_sign_bit);
|
||||
|
||||
Some(ExtendedPoint{ X: X, Y: Y, Z: Z, T: &X * &Y })
|
||||
Some(EdwardsPoint{ X: X, Y: Y, Z: Z, T: &X * &Y })
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------------------
|
||||
// Serde support
|
||||
// ------------------------------------------------------------------------
|
||||
// Serializes to and from `ExtendedPoint` directly, doing compression
|
||||
// Serializes to and from `EdwardsPoint` directly, doing compression
|
||||
// and decompression internally. This means that users can create
|
||||
// structs containing `ExtendedPoint`s and use Serde's derived
|
||||
// structs containing `EdwardsPoint`s and use Serde's derived
|
||||
// serializers to serialize those structures.
|
||||
|
||||
#[cfg(feature = "serde")]
|
||||
|
|
@ -114,7 +114,7 @@ use serde::{self, Serialize, Deserialize, Serializer, Deserializer};
|
|||
use serde::de::Visitor;
|
||||
|
||||
#[cfg(feature = "serde")]
|
||||
impl Serialize for ExtendedPoint {
|
||||
impl Serialize for EdwardsPoint {
|
||||
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
|
||||
where S: Serializer
|
||||
{
|
||||
|
|
@ -123,20 +123,20 @@ impl Serialize for ExtendedPoint {
|
|||
}
|
||||
|
||||
#[cfg(feature = "serde")]
|
||||
impl<'de> Deserialize<'de> for ExtendedPoint {
|
||||
impl<'de> Deserialize<'de> for EdwardsPoint {
|
||||
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
|
||||
where D: Deserializer<'de>
|
||||
{
|
||||
struct ExtendedPointVisitor;
|
||||
struct EdwardsPointVisitor;
|
||||
|
||||
impl<'de> Visitor<'de> for ExtendedPointVisitor {
|
||||
type Value = ExtendedPoint;
|
||||
impl<'de> Visitor<'de> for EdwardsPointVisitor {
|
||||
type Value = EdwardsPoint;
|
||||
|
||||
fn expecting(&self, formatter: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
|
||||
formatter.write_str("a valid point in Edwards y + sign format")
|
||||
}
|
||||
|
||||
fn visit_bytes<E>(self, v: &[u8]) -> Result<ExtendedPoint, E>
|
||||
fn visit_bytes<E>(self, v: &[u8]) -> Result<EdwardsPoint, E>
|
||||
where E: serde::de::Error
|
||||
{
|
||||
if v.len() == 32 {
|
||||
|
|
@ -151,7 +151,7 @@ impl<'de> Deserialize<'de> for ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
deserializer.deserialize_bytes(ExtendedPointVisitor)
|
||||
deserializer.deserialize_bytes(EdwardsPointVisitor)
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -159,14 +159,14 @@ impl<'de> Deserialize<'de> for ExtendedPoint {
|
|||
// Internal point representations
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
/// An `ExtendedPoint` represents a point on the Edwards form of Curve25519.
|
||||
/// An `EdwardsPoint` represents a point on the Edwards form of Curve25519.
|
||||
///
|
||||
/// The name refers to the extended twisted Edwards coordinates of
|
||||
/// Hisil, Wong, Carter, and Dawson, and more details on curve models
|
||||
/// can be found in the `curve25519-dalek` internal documentation.
|
||||
#[derive(Copy, Clone)]
|
||||
#[allow(missing_docs)]
|
||||
pub struct ExtendedPoint {
|
||||
pub struct EdwardsPoint {
|
||||
pub(crate) X: FieldElement,
|
||||
pub(crate) Y: FieldElement,
|
||||
pub(crate) Z: FieldElement,
|
||||
|
|
@ -186,9 +186,9 @@ impl Identity for CompressedEdwardsY {
|
|||
}
|
||||
}
|
||||
|
||||
impl Identity for ExtendedPoint {
|
||||
fn identity() -> ExtendedPoint {
|
||||
ExtendedPoint{ X: FieldElement::zero(),
|
||||
impl Identity for EdwardsPoint {
|
||||
fn identity() -> EdwardsPoint {
|
||||
EdwardsPoint{ X: FieldElement::zero(),
|
||||
Y: FieldElement::one(),
|
||||
Z: FieldElement::one(),
|
||||
T: FieldElement::zero() }
|
||||
|
|
@ -199,7 +199,7 @@ impl Identity for ExtendedPoint {
|
|||
// Validity checks (for debugging, not CT)
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl ValidityCheck for ExtendedPoint {
|
||||
impl ValidityCheck for EdwardsPoint {
|
||||
// XXX this should also check that T is correct
|
||||
fn is_valid(&self) -> bool {
|
||||
self.to_projective().is_valid()
|
||||
|
|
@ -210,8 +210,8 @@ impl ValidityCheck for ExtendedPoint {
|
|||
// Constant-time assignment
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl ConditionallyAssignable for ExtendedPoint {
|
||||
fn conditional_assign(&mut self, other: &ExtendedPoint, choice: u8) {
|
||||
impl ConditionallyAssignable for EdwardsPoint {
|
||||
fn conditional_assign(&mut self, other: &EdwardsPoint, choice: u8) {
|
||||
self.X.conditional_assign(&other.X, choice);
|
||||
self.Y.conditional_assign(&other.Y, choice);
|
||||
self.Z.conditional_assign(&other.Z, choice);
|
||||
|
|
@ -223,8 +223,8 @@ impl ConditionallyAssignable for ExtendedPoint {
|
|||
// Constant-time Equality
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl Equal for ExtendedPoint {
|
||||
fn ct_eq(&self, other: &ExtendedPoint) -> u8 {
|
||||
impl Equal for EdwardsPoint {
|
||||
fn ct_eq(&self, other: &EdwardsPoint) -> u8 {
|
||||
slices_equal(self.compress().as_bytes(),
|
||||
other.compress().as_bytes())
|
||||
}
|
||||
|
|
@ -234,7 +234,7 @@ impl Equal for ExtendedPoint {
|
|||
// Point conversions
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl ExtendedPoint {
|
||||
impl EdwardsPoint {
|
||||
/// Convert to a ProjectiveNielsPoint
|
||||
pub(crate) fn to_projective_niels(&self) -> ProjectiveNielsPoint {
|
||||
ProjectiveNielsPoint{
|
||||
|
|
@ -271,7 +271,7 @@ impl ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
/// Convert this `ExtendedPoint` on the Edwards model to the
|
||||
/// Convert this `EdwardsPoint` on the Edwards model to the
|
||||
/// corresponding `MontgomeryPoint` on the Montgomery model.
|
||||
///
|
||||
/// Note that this is a one-way conversion, since the Montgomery
|
||||
|
|
@ -360,9 +360,9 @@ impl ExtendedPoint {
|
|||
// Doubling
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl ExtendedPoint {
|
||||
impl EdwardsPoint {
|
||||
/// Add this point to itself.
|
||||
pub(crate) fn double(&self) -> ExtendedPoint {
|
||||
pub(crate) fn double(&self) -> EdwardsPoint {
|
||||
self.to_projective().double().to_extended()
|
||||
}
|
||||
}
|
||||
|
|
@ -371,49 +371,49 @@ impl ExtendedPoint {
|
|||
// Addition and Subtraction
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl<'a, 'b> Add<&'b ExtendedPoint> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
fn add(self, other: &'b ExtendedPoint) -> ExtendedPoint {
|
||||
impl<'a, 'b> Add<&'b EdwardsPoint> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
fn add(self, other: &'b EdwardsPoint) -> EdwardsPoint {
|
||||
(self + &other.to_projective_niels()).to_extended()
|
||||
}
|
||||
}
|
||||
|
||||
define_add_variants!(LHS = ExtendedPoint, RHS = ExtendedPoint, Output = ExtendedPoint);
|
||||
define_add_variants!(LHS = EdwardsPoint, RHS = EdwardsPoint, Output = EdwardsPoint);
|
||||
|
||||
impl<'b> AddAssign<&'b ExtendedPoint> for ExtendedPoint {
|
||||
fn add_assign(&mut self, _rhs: &'b ExtendedPoint) {
|
||||
*self = (self as &ExtendedPoint) + _rhs;
|
||||
impl<'b> AddAssign<&'b EdwardsPoint> for EdwardsPoint {
|
||||
fn add_assign(&mut self, _rhs: &'b EdwardsPoint) {
|
||||
*self = (self as &EdwardsPoint) + _rhs;
|
||||
}
|
||||
}
|
||||
|
||||
define_add_assign_variants!(LHS = ExtendedPoint, RHS = ExtendedPoint);
|
||||
define_add_assign_variants!(LHS = EdwardsPoint, RHS = EdwardsPoint);
|
||||
|
||||
impl<'a, 'b> Sub<&'b ExtendedPoint> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
fn sub(self, other: &'b ExtendedPoint) -> ExtendedPoint {
|
||||
impl<'a, 'b> Sub<&'b EdwardsPoint> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
fn sub(self, other: &'b EdwardsPoint) -> EdwardsPoint {
|
||||
(self - &other.to_projective_niels()).to_extended()
|
||||
}
|
||||
}
|
||||
|
||||
define_sub_variants!(LHS = ExtendedPoint, RHS = ExtendedPoint, Output = ExtendedPoint);
|
||||
define_sub_variants!(LHS = EdwardsPoint, RHS = EdwardsPoint, Output = EdwardsPoint);
|
||||
|
||||
impl<'b> SubAssign<&'b ExtendedPoint> for ExtendedPoint {
|
||||
fn sub_assign(&mut self, _rhs: &'b ExtendedPoint) {
|
||||
*self = (self as &ExtendedPoint) - _rhs;
|
||||
impl<'b> SubAssign<&'b EdwardsPoint> for EdwardsPoint {
|
||||
fn sub_assign(&mut self, _rhs: &'b EdwardsPoint) {
|
||||
*self = (self as &EdwardsPoint) - _rhs;
|
||||
}
|
||||
}
|
||||
|
||||
define_sub_assign_variants!(LHS = ExtendedPoint, RHS = ExtendedPoint);
|
||||
define_sub_assign_variants!(LHS = EdwardsPoint, RHS = EdwardsPoint);
|
||||
|
||||
// ------------------------------------------------------------------------
|
||||
// Negation
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl<'a> Neg for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a> Neg for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
fn neg(self) -> ExtendedPoint {
|
||||
ExtendedPoint{
|
||||
fn neg(self) -> EdwardsPoint {
|
||||
EdwardsPoint{
|
||||
X: -(&self.X),
|
||||
Y: self.Y,
|
||||
Z: self.Z,
|
||||
|
|
@ -422,10 +422,10 @@ impl<'a> Neg for &'a ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
impl Neg for ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl Neg for EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
fn neg(self) -> ExtendedPoint {
|
||||
fn neg(self) -> EdwardsPoint {
|
||||
-&self
|
||||
}
|
||||
}
|
||||
|
|
@ -434,30 +434,30 @@ impl Neg for ExtendedPoint {
|
|||
// Scalar multiplication
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl<'b> MulAssign<&'b Scalar> for ExtendedPoint {
|
||||
impl<'b> MulAssign<&'b Scalar> for EdwardsPoint {
|
||||
fn mul_assign(&mut self, scalar: &'b Scalar) {
|
||||
let result = (self as &ExtendedPoint) * scalar;
|
||||
let result = (self as &EdwardsPoint) * scalar;
|
||||
*self = result;
|
||||
}
|
||||
}
|
||||
|
||||
define_mul_assign_variants!(LHS = ExtendedPoint, RHS = Scalar);
|
||||
define_mul_assign_variants!(LHS = EdwardsPoint, RHS = Scalar);
|
||||
|
||||
define_mul_variants!(LHS = ExtendedPoint, RHS = Scalar, Output = ExtendedPoint);
|
||||
define_mul_variants!(LHS = Scalar, RHS = ExtendedPoint, Output = ExtendedPoint);
|
||||
define_mul_variants!(LHS = EdwardsPoint, RHS = Scalar, Output = EdwardsPoint);
|
||||
define_mul_variants!(LHS = Scalar, RHS = EdwardsPoint, Output = EdwardsPoint);
|
||||
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsPoint {
|
||||
type Output = EdwardsPoint;
|
||||
/// Scalar multiplication: compute `scalar * self`.
|
||||
///
|
||||
/// For scalar multiplication of a basepoint,
|
||||
/// `EdwardsBasepointTable` is approximately 4x faster.
|
||||
fn mul(self, scalar: &'b Scalar) -> ExtendedPoint {
|
||||
fn mul(self, scalar: &'b Scalar) -> EdwardsPoint {
|
||||
// If we built with AVX2, use the AVX2 backend.
|
||||
#[cfg(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2")))] {
|
||||
use backend::avx2::edwards as edwards_avx2;
|
||||
let P_avx2 = edwards_avx2::ExtendedPoint::from(*self);
|
||||
return ExtendedPoint::from(&P_avx2 * scalar);
|
||||
let P_avx2 = edwards_avx2::EdwardsPoint::from(*self);
|
||||
return EdwardsPoint::from(&P_avx2 * scalar);
|
||||
}
|
||||
// Otherwise, proceed as normal:
|
||||
#[cfg(not(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2"))))] {
|
||||
|
|
@ -478,7 +478,7 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
|||
// s*P = P*s_0 + 16*(P*s_1 + 16*(P*s_2 + 16*( ... + P*s_63)...))
|
||||
//
|
||||
// We sum right-to-left.
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
for i in (0..64).rev() {
|
||||
// Q <-- 16*Q
|
||||
Q = Q.mult_by_pow_2(4);
|
||||
|
|
@ -491,14 +491,14 @@ impl<'a, 'b> Mul<&'b Scalar> for &'a ExtendedPoint {
|
|||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Mul<&'b ExtendedPoint> for &'a Scalar {
|
||||
type Output = ExtendedPoint;
|
||||
impl<'a, 'b> Mul<&'b EdwardsPoint> for &'a Scalar {
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Scalar multiplication: compute `scalar * self`.
|
||||
///
|
||||
/// For scalar multiplication of a basepoint,
|
||||
/// `EdwardsBasepointTable` is approximately 4x faster.
|
||||
fn mul(self, point: &'b ExtendedPoint) -> ExtendedPoint {
|
||||
fn mul(self, point: &'b EdwardsPoint) -> EdwardsPoint {
|
||||
point * self
|
||||
}
|
||||
}
|
||||
|
|
@ -514,15 +514,15 @@ impl<'a, 'b> Mul<&'b ExtendedPoint> for &'a Scalar {
|
|||
///
|
||||
/// # Input
|
||||
///
|
||||
/// A iterable of `Scalar`s and a iterable of `ExtendedPoints`. It is an
|
||||
/// A iterable of `Scalar`s and a iterable of `EdwardsPoints`. It is an
|
||||
/// error to call this function with two iterators of different lengths.
|
||||
///
|
||||
// XXX later when we do more fancy multiscalar mults, we can delegate
|
||||
// based on the iter's size hint -- hdevalence
|
||||
#[cfg(any(feature = "alloc", feature = "std"))]
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> ExtendedPoint
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> EdwardsPoint
|
||||
where I: IntoIterator<Item = &'a Scalar>,
|
||||
J: IntoIterator<Item = &'b ExtendedPoint>
|
||||
J: IntoIterator<Item = &'b EdwardsPoint>
|
||||
{
|
||||
// If we built with AVX2, use the AVX2 backend.
|
||||
#[cfg(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2")))] {
|
||||
|
|
@ -575,7 +575,7 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> ExtendedPoint
|
|||
// This provides the speedup over doing n independent scalar
|
||||
// mults: we perform 63 multiplications by 16 instead of 63*n
|
||||
// multiplications, saving 252*(n-1) doublings.
|
||||
let mut Q = ExtendedPoint::identity();
|
||||
let mut Q = EdwardsPoint::identity();
|
||||
// XXX this impl makes no effort to be cache-aware; maybe it could be improved?
|
||||
for j in (0..64).rev() {
|
||||
Q = Q.mult_by_pow_2(4);
|
||||
|
|
@ -628,11 +628,11 @@ impl EdwardsBasepointTable {
|
|||
///
|
||||
/// The radix-\\(16\\) representation requires that the scalar is bounded
|
||||
/// by \\(2\^{255}\\), which is always the case.
|
||||
fn basepoint_mul(&self, scalar: &Scalar) -> ExtendedPoint {
|
||||
fn basepoint_mul(&self, scalar: &Scalar) -> EdwardsPoint {
|
||||
let a = scalar.to_radix_16();
|
||||
|
||||
let tables = &self.0;
|
||||
let mut P = ExtendedPoint::identity();
|
||||
let mut P = EdwardsPoint::identity();
|
||||
|
||||
for i in (0..64).filter(|x| x % 2 == 1) {
|
||||
P = (&P + &tables[i/2].select(a[i])).to_extended();
|
||||
|
|
@ -649,29 +649,29 @@ impl EdwardsBasepointTable {
|
|||
}
|
||||
|
||||
impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsBasepointTable {
|
||||
type Output = ExtendedPoint;
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Construct an `ExtendedPoint` from a `Scalar` \\(a\\) by
|
||||
/// Construct an `EdwardsPoint` from a `Scalar` \\(a\\) by
|
||||
/// computing the multiple \\(aB\\) of this basepoint \\(B\\).
|
||||
fn mul(self, scalar: &'b Scalar) -> ExtendedPoint {
|
||||
fn mul(self, scalar: &'b Scalar) -> EdwardsPoint {
|
||||
// delegate to a private function so that its documentation appears in internal docs
|
||||
self.basepoint_mul(scalar)
|
||||
}
|
||||
}
|
||||
|
||||
impl<'a, 'b> Mul<&'a EdwardsBasepointTable> for &'b Scalar {
|
||||
type Output = ExtendedPoint;
|
||||
type Output = EdwardsPoint;
|
||||
|
||||
/// Construct an `ExtendedPoint` from a `Scalar` \\(a\\) by
|
||||
/// Construct an `EdwardsPoint` from a `Scalar` \\(a\\) by
|
||||
/// computing the multiple \\(aB\\) of this basepoint \\(B\\).
|
||||
fn mul(self, basepoint_table: &'a EdwardsBasepointTable) -> ExtendedPoint {
|
||||
fn mul(self, basepoint_table: &'a EdwardsBasepointTable) -> EdwardsPoint {
|
||||
basepoint_table * &self
|
||||
}
|
||||
}
|
||||
|
||||
impl EdwardsBasepointTable {
|
||||
/// Create a table of precomputed multiples of `basepoint`.
|
||||
pub fn create(basepoint: &ExtendedPoint) -> EdwardsBasepointTable {
|
||||
pub fn create(basepoint: &EdwardsPoint) -> EdwardsBasepointTable {
|
||||
// XXX use init_with
|
||||
let mut table = EdwardsBasepointTable([LookupTable::default(); 32]);
|
||||
let mut P = *basepoint;
|
||||
|
|
@ -683,25 +683,25 @@ impl EdwardsBasepointTable {
|
|||
table
|
||||
}
|
||||
|
||||
/// Get the basepoint for this table as an `ExtendedPoint`.
|
||||
/// Get the basepoint for this table as an `EdwardsPoint`.
|
||||
///
|
||||
/// XXX maybe this would be better as a `From` impl
|
||||
pub fn basepoint(&self) -> ExtendedPoint {
|
||||
pub fn basepoint(&self) -> EdwardsPoint {
|
||||
// self.0[0].select(1) = 1*(16^2)^0*B
|
||||
// but as an `AffineNielsPoint`, so add identity to convert to extended.
|
||||
(&ExtendedPoint::identity() + &self.0[0].select(1)).to_extended()
|
||||
(&EdwardsPoint::identity() + &self.0[0].select(1)).to_extended()
|
||||
}
|
||||
}
|
||||
|
||||
impl ExtendedPoint {
|
||||
impl EdwardsPoint {
|
||||
/// Multiply by the cofactor: compute `8 * self`.
|
||||
pub fn mult_by_cofactor(&self) -> ExtendedPoint {
|
||||
pub fn mult_by_cofactor(&self) -> EdwardsPoint {
|
||||
self.mult_by_pow_2(3)
|
||||
}
|
||||
|
||||
/// Compute `2^k * self` by successive doublings.
|
||||
/// Requires `k > 0`.
|
||||
pub(crate) fn mult_by_pow_2(&self, k: u32) -> ExtendedPoint {
|
||||
pub(crate) fn mult_by_pow_2(&self, k: u32) -> EdwardsPoint {
|
||||
let mut r: CompletedPoint;
|
||||
let mut s = self.to_projective();
|
||||
for _ in 0..(k-1) {
|
||||
|
|
@ -738,7 +738,7 @@ impl ExtendedPoint {
|
|||
|
||||
// XXX should this be in another module, with types and `From` impls, like `CompressedEdwardsY`?
|
||||
|
||||
impl ExtendedPoint {
|
||||
impl EdwardsPoint {
|
||||
/// Use Elligator2 to try to convert `self` to a uniformly random
|
||||
/// string.
|
||||
///
|
||||
|
|
@ -752,7 +752,7 @@ impl ExtendedPoint {
|
|||
/// Use Elligator2 to convert a uniformly random string to a curve
|
||||
/// point.
|
||||
#[allow(unused_variables)] // REMOVE WHEN IMPLEMENTED
|
||||
fn from_uniform_representative(bytes: &[u8; 32]) -> ExtendedPoint {
|
||||
fn from_uniform_representative(bytes: &[u8; 32]) -> EdwardsPoint {
|
||||
unimplemented!();
|
||||
}
|
||||
}
|
||||
|
|
@ -761,9 +761,9 @@ impl ExtendedPoint {
|
|||
// Debug traits
|
||||
// ------------------------------------------------------------------------
|
||||
|
||||
impl Debug for ExtendedPoint {
|
||||
impl Debug for EdwardsPoint {
|
||||
fn fmt(&self, f: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
|
||||
write!(f, "ExtendedPoint{{\n\tX: {:?},\n\tY: {:?},\n\tZ: {:?},\n\tT: {:?}\n}}",
|
||||
write!(f, "EdwardsPoint{{\n\tX: {:?},\n\tY: {:?},\n\tZ: {:?},\n\tT: {:?}\n}}",
|
||||
&self.X, &self.Y, &self.Z, &self.T)
|
||||
}
|
||||
}
|
||||
|
|
@ -790,7 +790,7 @@ pub mod vartime {
|
|||
struct OddMultiples([ProjectiveNielsPoint; 8]);
|
||||
|
||||
impl OddMultiples {
|
||||
fn create(A: &ExtendedPoint) -> OddMultiples {
|
||||
fn create(A: &EdwardsPoint) -> OddMultiples {
|
||||
let mut Ai = [ProjectiveNielsPoint::identity(); 8];
|
||||
let A2 = A.double();
|
||||
Ai[0] = A.to_projective_niels();
|
||||
|
|
@ -818,12 +818,12 @@ pub mod vartime {
|
|||
///
|
||||
/// # Input
|
||||
///
|
||||
/// A iterable of `Scalar`s and a iterable of `ExtendedPoints`. It is an
|
||||
/// A iterable of `Scalar`s and a iterable of `EdwardsPoints`. It is an
|
||||
/// error to call this function with two iterators of different lengths.
|
||||
#[cfg(any(feature = "alloc", feature = "std"))]
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> ExtendedPoint
|
||||
pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> EdwardsPoint
|
||||
where I: IntoIterator<Item = &'a Scalar>,
|
||||
J: IntoIterator<Item = &'b ExtendedPoint>
|
||||
J: IntoIterator<Item = &'b EdwardsPoint>
|
||||
{
|
||||
// If we built with AVX2, use the AVX2 backend.
|
||||
#[cfg(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2")))] {
|
||||
|
|
@ -866,9 +866,9 @@ pub mod vartime {
|
|||
#[cfg(feature="precomputed_tables")]
|
||||
pub fn double_scalar_mult_basepoint(
|
||||
a: &Scalar,
|
||||
A: &ExtendedPoint,
|
||||
A: &EdwardsPoint,
|
||||
b: &Scalar,
|
||||
) -> ExtendedPoint {
|
||||
) -> EdwardsPoint {
|
||||
// If we built with AVX2, use the AVX2 backend.
|
||||
#[cfg(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2")))] {
|
||||
use backend::avx2::edwards as edwards_avx2;
|
||||
|
|
@ -1033,7 +1033,7 @@ mod test {
|
|||
assert_eq!(bp.compress(), constants::BASE_CMPRSSD);
|
||||
}
|
||||
|
||||
/// Test `impl Add<ExtendedPoint> for ExtendedPoint`
|
||||
/// Test `impl Add<EdwardsPoint> for EdwardsPoint`
|
||||
/// using basepoint + basepoint versus the 2*basepoint constant.
|
||||
#[test]
|
||||
fn basepoint_plus_basepoint_vs_basepoint2() {
|
||||
|
|
@ -1042,7 +1042,7 @@ mod test {
|
|||
assert_eq!(bp_added.compress(), BASE2_CMPRSSD);
|
||||
}
|
||||
|
||||
/// Test `impl Add<ProjectiveNielsPoint> for ExtendedPoint`
|
||||
/// Test `impl Add<ProjectiveNielsPoint> for EdwardsPoint`
|
||||
/// using the basepoint, basepoint2 constants
|
||||
#[test]
|
||||
fn basepoint_plus_basepoint_projective_niels_vs_basepoint2() {
|
||||
|
|
@ -1051,7 +1051,7 @@ mod test {
|
|||
assert_eq!(bp_added.compress(), BASE2_CMPRSSD);
|
||||
}
|
||||
|
||||
/// Test `impl Add<AffineNielsPoint> for ExtendedPoint`
|
||||
/// Test `impl Add<AffineNielsPoint> for EdwardsPoint`
|
||||
/// using the basepoint, basepoint2 constants
|
||||
#[test]
|
||||
fn basepoint_plus_basepoint_affine_niels_vs_basepoint2() {
|
||||
|
|
@ -1061,13 +1061,13 @@ mod test {
|
|||
assert_eq!(bp_added.compress(), BASE2_CMPRSSD);
|
||||
}
|
||||
|
||||
/// Check that equality of `ExtendedPoints` handles projective
|
||||
/// Check that equality of `EdwardsPoints` handles projective
|
||||
/// coordinates correctly.
|
||||
#[test]
|
||||
fn extended_point_equality_handles_scaling() {
|
||||
let mut two_bytes = [0u8; 32]; two_bytes[0] = 2;
|
||||
let id1 = ExtendedPoint::identity();
|
||||
let id2 = ExtendedPoint{
|
||||
let id1 = EdwardsPoint::identity();
|
||||
let id2 = EdwardsPoint{
|
||||
X: FieldElement::zero(),
|
||||
Y: FieldElement::from_bytes(&two_bytes),
|
||||
Z: FieldElement::from_bytes(&two_bytes),
|
||||
|
|
@ -1083,7 +1083,7 @@ mod test {
|
|||
// construct a point as aB so it has denominators (ie. Z != 1)
|
||||
let aB = &constants::ED25519_BASEPOINT_TABLE * &A_SCALAR;
|
||||
let aB_affine_niels = aB.to_affine_niels();
|
||||
let also_aB = (&ExtendedPoint::identity() + &aB_affine_niels).to_extended();
|
||||
let also_aB = (&EdwardsPoint::identity() + &aB_affine_niels).to_extended();
|
||||
assert_eq!( aB.compress(),
|
||||
also_aB.compress());
|
||||
}
|
||||
|
|
@ -1178,13 +1178,13 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn compressed_identity() {
|
||||
assert_eq!(ExtendedPoint::identity().compress(),
|
||||
assert_eq!(EdwardsPoint::identity().compress(),
|
||||
CompressedEdwardsY::identity());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn is_identity() {
|
||||
assert!( ExtendedPoint::identity().is_identity() == true);
|
||||
assert!( EdwardsPoint::identity().is_identity() == true);
|
||||
assert!(constants::ED25519_BASEPOINT_POINT.is_identity() == false);
|
||||
}
|
||||
|
||||
|
|
@ -1210,7 +1210,7 @@ mod test {
|
|||
|
||||
#[test]
|
||||
fn scalarmult_extended_point_works_both_ways() {
|
||||
let G: ExtendedPoint = constants::ED25519_BASEPOINT_POINT;
|
||||
let G: EdwardsPoint = constants::ED25519_BASEPOINT_POINT;
|
||||
let s: Scalar = A_SCALAR;
|
||||
|
||||
let P1 = &G * &s;
|
||||
|
|
@ -1265,7 +1265,7 @@ mod test {
|
|||
#[cfg(feature = "serde")]
|
||||
fn serde_cbor_basepoint_roundtrip() {
|
||||
let output = serde_cbor::to_vec(&constants::ED25519_BASEPOINT_POINT).unwrap();
|
||||
let parsed: ExtendedPoint = serde_cbor::from_slice(&output).unwrap();
|
||||
let parsed: EdwardsPoint = serde_cbor::from_slice(&output).unwrap();
|
||||
assert_eq!(parsed.compress(), constants::BASE_CMPRSSD);
|
||||
}
|
||||
|
||||
|
|
@ -1276,7 +1276,7 @@ mod test {
|
|||
// CBOR apparently has two bytes of overhead for a 32-byte string.
|
||||
// Set the low byte of the compressed point to 1 to make it invalid.
|
||||
output[2] = 1;
|
||||
let parsed: Result<ExtendedPoint, _> = serde_cbor::from_slice(&output);
|
||||
let parsed: Result<EdwardsPoint, _> = serde_cbor::from_slice(&output);
|
||||
assert!(parsed.is_err());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ use core::ops::{Mul, MulAssign};
|
|||
use constants;
|
||||
use constants::APLUS2_OVER_FOUR;
|
||||
use field::FieldElement;
|
||||
use edwards::{ExtendedPoint, CompressedEdwardsY};
|
||||
use edwards::{EdwardsPoint, CompressedEdwardsY};
|
||||
use scalar::Scalar;
|
||||
|
||||
// XXX Move these to a common "group" module? At the same time, we should
|
||||
|
|
@ -72,13 +72,13 @@ impl CompressedMontgomeryU {
|
|||
self.0
|
||||
}
|
||||
|
||||
/// Attempt to decompress to an `ExtendedPoint`.
|
||||
/// Attempt to decompress to an `EdwardsPoint`.
|
||||
///
|
||||
/// # Note
|
||||
///
|
||||
/// Since there are two curve points with the same
|
||||
/// `u`-coordinate, the `u`-coordinate does not fully specify a
|
||||
/// point. That is, roundtripping between an `ExtendedPoint` and
|
||||
/// point. That is, roundtripping between an `EdwardsPoint` and
|
||||
/// a `CompressedMontgomeryU` discards its sign bit.
|
||||
///
|
||||
/// # Warning
|
||||
|
|
@ -87,13 +87,13 @@ impl CompressedMontgomeryU {
|
|||
///
|
||||
/// # Return
|
||||
///
|
||||
/// An `Option<ExtendedPoint>`, which will be `None` if either condition holds:
|
||||
/// An `Option<EdwardsPoint>`, which will be `None` if either condition holds:
|
||||
///
|
||||
/// * `u = -1`, or
|
||||
/// * `v` is not square.
|
||||
//
|
||||
// XXX any other exceptional points for the birational map?
|
||||
pub fn decompress_edwards(&self) -> Option<ExtendedPoint> {
|
||||
pub fn decompress_edwards(&self) -> Option<EdwardsPoint> {
|
||||
let u: FieldElement = FieldElement::from_bytes(&self.0);
|
||||
|
||||
// If u = -1, then v^2 = u*(u^2+486662*u+1) = 486660.
|
||||
|
|
@ -432,7 +432,7 @@ mod test {
|
|||
/// identity.
|
||||
#[test]
|
||||
fn identity_to_monty() {
|
||||
let id = ExtendedPoint::identity();
|
||||
let id = EdwardsPoint::identity();
|
||||
assert_eq!(id.to_montgomery().compress(), MontgomeryPoint::identity().compress());
|
||||
}
|
||||
|
||||
|
|
@ -471,7 +471,7 @@ mod test {
|
|||
let mut csprng: OsRng = OsRng::new().unwrap();
|
||||
|
||||
let s: Scalar = Scalar::random(&mut csprng);
|
||||
let p_edwards: ExtendedPoint = &constants::ED25519_BASEPOINT_TABLE * &s;
|
||||
let p_edwards: EdwardsPoint = &constants::ED25519_BASEPOINT_TABLE * &s;
|
||||
let p_montgomery: MontgomeryPoint = p_edwards.to_montgomery();
|
||||
|
||||
let expected = &s * &p_edwards;
|
||||
|
|
@ -484,7 +484,7 @@ mod test {
|
|||
fn ladder_basepoint_times_two_matches_double() {
|
||||
let two: Scalar = Scalar::from_u64(2u64);
|
||||
let result: MontgomeryPoint = &BASE_COMPRESSED_MONTGOMERY.decompress() * &two;
|
||||
let expected: ExtendedPoint = constants::ED25519_BASEPOINT_POINT.double();
|
||||
let expected: EdwardsPoint = constants::ED25519_BASEPOINT_POINT.double();
|
||||
|
||||
assert_eq!(result.compress(), expected.to_montgomery().compress());
|
||||
}
|
||||
|
|
|
|||
|
|
@ -406,7 +406,7 @@ use subtle::ConditionallyNegatable;
|
|||
use subtle::Equal;
|
||||
|
||||
use edwards;
|
||||
use edwards::ExtendedPoint;
|
||||
use edwards::EdwardsPoint;
|
||||
use edwards::EdwardsBasepointTable;
|
||||
|
||||
use scalar::Scalar;
|
||||
|
|
@ -487,7 +487,7 @@ impl CompressedRistretto {
|
|||
if ok == 0u8 || t.is_negative() == 1u8 || y.is_zero() == 1u8 {
|
||||
return None;
|
||||
} else {
|
||||
return Some(RistrettoPoint(ExtendedPoint{X: x, Y: y, Z: one, T: t}));
|
||||
return Some(RistrettoPoint(EdwardsPoint{X: x, Y: y, Z: one, T: t}));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -563,10 +563,10 @@ impl<'de> Deserialize<'de> for RistrettoPoint {
|
|||
/// Edwards form of) Curve25519.
|
||||
///
|
||||
/// Internally, a `RistrettoPoint` is a wrapper type around
|
||||
/// `ExtendedPoint`, with custom equality, compression, and
|
||||
/// `EdwardsPoint`, with custom equality, compression, and
|
||||
/// decompression routines to account for the quotient.
|
||||
#[derive(Copy, Clone)]
|
||||
pub struct RistrettoPoint(pub(crate) ExtendedPoint);
|
||||
pub struct RistrettoPoint(pub(crate) EdwardsPoint);
|
||||
|
||||
impl RistrettoPoint {
|
||||
/// Compress in Ristretto format.
|
||||
|
|
@ -748,7 +748,7 @@ impl RistrettoPoint {
|
|||
|
||||
|
||||
/// Return the coset self + E[4], for debugging.
|
||||
fn coset4(&self) -> [ExtendedPoint; 4] {
|
||||
fn coset4(&self) -> [EdwardsPoint; 4] {
|
||||
[ self.0
|
||||
, &self.0 + &constants::EIGHT_TORSION[2]
|
||||
, &self.0 + &constants::EIGHT_TORSION[4]
|
||||
|
|
@ -881,7 +881,7 @@ impl RistrettoPoint {
|
|||
|
||||
impl Identity for RistrettoPoint {
|
||||
fn identity() -> RistrettoPoint {
|
||||
RistrettoPoint(ExtendedPoint::identity())
|
||||
RistrettoPoint(EdwardsPoint::identity())
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue