From 7097d8f98e7e3226f88c52bcf2637be55874ccea Mon Sep 17 00:00:00 2001
From: Henry de Valence <hdevalence@hdevalence.ca>
Date: Sun, 23 Jul 2017 20:45:54 -0700
Subject: [PATCH] Add Ristretto equality

---
 src/ristretto.rs | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/src/ristretto.rs b/src/ristretto.rs
index c5cd99d..37f042e 100644
--- a/src/ristretto.rs
+++ b/src/ristretto.rs
@@ -10,7 +10,7 @@
 
 //! An implementation of Mike Hamburg's Ristretto cofactor-eliminating
 //! point-compression scheme, providing a prime-order group on top of
-//! a non-prime-order elliptic curve.
+//! Curve25519.
 //!
 //! Note: this code is currently feature-gated with the `yolocrypto`
 //! feature flag, because our implementation is still unfinished.
@@ -43,9 +43,10 @@ use edwards::EdwardsBasepointTable;
 use edwards::Identity;
 use scalar::Scalar;
 
+use subtle;
 use subtle::ConditionallyAssignable;
 use subtle::ConditionallyNegatable;
-use subtle;
+use subtle::Equal;
 
 // ------------------------------------------------------------------------
 // Compressed points
@@ -187,7 +188,7 @@ impl<'de> Deserialize<'de> for RistrettoPoint {
 
 /// A point in a prime-order group.
 ///
-// XXX think about how this API should work
+/// XXX think about how this API should work
 #[derive(Copy, Clone)]
 pub struct RistrettoPoint(pub ExtendedPoint);
 
@@ -395,13 +396,25 @@ impl Identity for RistrettoPoint {
 // Equality
 // ------------------------------------------------------------------------
 
-/// XXX check whether there's a simple way to do equality checking
-/// with cofactor 8, not just cofactor 4, and add a CT equality function?
 impl PartialEq for RistrettoPoint {
     fn eq(&self, other: &RistrettoPoint) -> bool {
-        let  self_compressed =  self.compress();
-        let other_compressed = other.compress();
-        self_compressed == other_compressed
+        self.ct_eq(other) == 1u8
+    }
+}
+
+impl Equal for RistrettoPoint {
+    /// Test equality between two `RistrettoPoint`s.
+    ///
+    /// # Returns
+    ///
+    /// `1u8` if the two `RistrettoPoint`s are equal, and `0u8` otherwise.
+    fn ct_eq(&self, other: &RistrettoPoint) -> u8 {
+        let X1Y2 = &self.0.X * &other.0.Y;
+        let Y1X2 = &self.0.Y * &other.0.X;
+        let X1X2 = &self.0.X * &other.0.X;
+        let Y1Y2 = &self.0.Y * &other.0.Y;
+        
+        X1Y2.ct_eq(&Y1X2) | X1X2.ct_eq(&Y1Y2)
     }
 }