saymrwulf/risc0-curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/risc0-curve25519-dalek-source.git synced 2026-09-08 20:40:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add links, tweak intro

Browse source
This commit is contained in:
Henry de Valence 2018-03-27 17:18:28 -07:00
parent ff787c2f12
commit c2d409788a
1 changed files with 33 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
docs/ristretto-notes.md
View file

@ -1,15 +1,25 @@
Below are some notes on Ristretto, which are *NOT* a full writeup and which may have errors. Below are some notes on Ristretto, which are not an authoritative
writeup and which may have errors. See also the [Decaf
paper][decaf_paper], the [libdecaf
implementation][ristretto_libdecaf], and the [Sage
script][ristretto_sage].
# Notes on Ristretto Decaf constructs a prime-order group from a cofactor-\\(4\\) Edwards
curve by defining an encoding of a related Jacobi quartic, then
transporting the encoding from the Jacobi quartic to the Edwards curve
by means of an isogeny. Ristretto uses a different Jacobi quartic and
a different isogeny, but is otherwise similar.
These notes only describe Ristretto, and focus on the cofactor-\\(8\\)
case.
## The Jacobi Quartic ## The Jacobi Quartic
The Jacobi quartic is parameterized by \\(e, A\\), and is of the The Jacobi quartic curve is parameterized by \\(e, A\\), and is of the
form $$ \mathcal J\_{e,A} : t\^2 = es\^4 + 2As\^2 + 1, $$ with form $$ \mathcal J\_{e,A} : t\^2 = es\^4 + 2As\^2 + 1, $$ with
identity point \\((0,1)\\). For more details on the Jacobi quartic, identity point \\((0,1)\\). For more details on the Jacobi quartic,
see the [Decaf paper](https://eprint.iacr.org/2015/673.pdf) or see the [Decaf paper][decaf_paper] or
[_Jacobi Quartic Curves [_Jacobi Quartic Curves Revisited_][hwcd_jacobi] by Hisil, Wong,
Revisited_](https://eprint.iacr.org/2009/312.pdf) by Hisil, Wong,
Carter, and Dawson). Carter, and Dawson).
When \\(e = a\^2\\), \\(\mathcal J\_{e,A}\\) has full When \\(e = a\^2\\), \\(\mathcal J\_{e,A}\\) has full
@ -19,10 +29,13 @@ we can write the \\(\mathcal J[2]\\)-coset of a point \\(P =
(s,t)\\) as (s,t)\\) as
$$ $$
P + \mathcal J[2] = \left\\{ P + \mathcal J[2] = \left\\{
(s,t),
(-s,-t), (s,t),
(1/as, -t/as\^2), (-s,-t),
(-1/as, t/as\^2) \right\\}. (1/as, -t/as\^2),
(-1/as, t/as\^2)
\right\\}.
$$ $$
Notice that replacing \\(a\\) by \\(-a\\) just swaps the last two Notice that replacing \\(a\\) by \\(-a\\) just swaps the last two
points, so this set does not depend on the choice of \\(a\\). In points, so this set does not depend on the choice of \\(a\\). In
@ -42,9 +55,8 @@ The encoding is then the (canonical byte encoding of the)
## The Edwards Curve ## The Edwards Curve
Our primary internal model for Curve25519 points are the [_Extended Our primary internal model for Curve25519 points are the [_Extended
Twisted Edwards Coordinates_](https://eprint.iacr.org/2008/522.pdf) Twisted Edwards Coordinates_][hwcd_edwards] of Hisil, Wong, Carter,
of Hisil, Wong, Carter, and Dawson. and Dawson. These correspond to the affine model
These correspond to the affine model
$$\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.$$ $$\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.$$
@ -316,3 +328,11 @@ It's possible to do batch encoding of \\( [2]P \\) using the dual
isogeny \\(\hat{\theta}\\). Defer this for now. isogeny \\(\hat{\theta}\\). Defer this for now.
## ??? ## ???
[ristretto_sage]: https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/aux/ristretto/ristretto.sage
[ristretto_libdecaf]: https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/
[decaf_paper]: https://eprint.iacr.org/2015/673.pdf
[hwcd_jacobi]: https://eprint.iacr.org/2009/312.pdf
[hwcd_edwards]: https://eprint.iacr.org/2008/522.pdf
[edwards_edwards]: https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/S0273-0979-07-01153-6.pdf
[twisted_edwards]: https://eprint.iacr.org/2008/013.pdf