saymrwulf/risc0-curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/risc0-curve25519-dalek-source.git synced 2026-09-04 20:03:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add link to curve models

Browse source
This commit is contained in:
Henry de Valence 2018-04-04 11:30:35 -07:00
parent 83c3d97651
commit 862dd33695
1 changed files with 18 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
docs/ristretto-notes.md
View file

@ -52,20 +52,23 @@ The encoding is then the (canonical byte encoding of the)
## The Edwards Curve
Our primary internal model for Curve25519 points are the [_Extended
Twisted Edwards Coordinates_][hwcd_edwards] of Hisil, Wong, Carter,
and Dawson. These correspond to the affine model
$$\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.$$
The primary internal model in `curve25519-dalek` for Curve25519 points
is the [_Extended Twisted Edwards Coordinates_][hwcd_edwards] of
Hisil, Wong, Carter, and Dawson. These correspond to the affine model
$$
\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.
$$
In projective coordinates, we represent a point as \\((X:Y:Z:T)\\)
with $$XY = ZT, \quad aX\^2 + Y\^2 = Z\^2 + dT\^2.$$ (For more
details on this model, see the documentation for the `edwards`
module). The case \\(a = 1\\) is the _untwisted_ case; we only
consider \\(a = \pm 1\\), and in particular we focus on the twisted
Edwards form of Curve25519, which has \\(a = -1, d =
-121665/121666\\). When not otherwise specified, we write
\\(\mathcal E\\) for \\(\mathcal E\_{-1, -121665/121666}\\).
with
$$
XY = ZT, \quad aX\^2 + Y\^2 = Z\^2 + dT\^2.
$$
(For more details on this model, see the
[`curve_models`][curve_models] documentation). The case \\(a = 1\\) is
the _untwisted_ case; we only consider \\(a = \pm 1\\), and in
particular we focus on the twisted Edwards form of Curve25519, which
has \\(a = -1, d = -121665/121666\\). When not otherwise specified,
we write \\(\mathcal E\\) for \\(\mathcal E\_{-1, -121665/121666}\\).
When both \\(d\\) and \\(ad\\) are nonsquare (which forces \\(a\\)
to be square), the curve is *complete*. In this case the
@ -333,4 +336,5 @@ isogeny \\(\hat{\theta}\\). Defer this for now.
[hwcd_jacobi]: https://eprint.iacr.org/2009/312.pdf
[hwcd_edwards]: https://eprint.iacr.org/2008/522.pdf
[edwards_edwards]: https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/S0273-0979-07-01153-6.pdf
[twisted_edwards]: https://eprint.iacr.org/2008/013.pdf
[twisted_edwards]: https://eprint.iacr.org/2008/013.pdf
[curve_models]: ../../curve_models/index.html