From b6cb7a7983506432821a61dae58613ab58a2cf86 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Thu, 18 May 2017 17:36:12 -0700 Subject: [PATCH 1/3] Increase number of trials for decaf elligator --- src/decaf.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/decaf.rs b/src/decaf.rs index a97347f..548831d 100644 --- a/src/decaf.rs +++ b/src/decaf.rs @@ -666,7 +666,7 @@ mod test { #[test] fn decaf_random_is_valid() { let mut rng = OsRng::new().unwrap(); - for _ in 0..100 { + for _ in 0..100_000 { let P = DecafPoint::random(&mut rng); // Check that P is on the curve assert!(P.0.is_valid()); From fbd8d0a60506aedae9f84469640dda38ea0e3c0d Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Thu, 18 May 2017 17:37:01 -0700 Subject: [PATCH 2/3] Rewrite decaf elligator code to avoid two consecutive additions --- src/decaf.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/decaf.rs b/src/decaf.rs index 548831d..749d218 100644 --- a/src/decaf.rs +++ b/src/decaf.rs @@ -267,6 +267,7 @@ impl DecafPoint { fn elligator_decaf_flavour(r_0: &FieldElement) -> DecafPoint { // Follows Appendix C of the Decaf paper. // Use n = 2 as the quadratic nonresidue so that n*x = x + x. + let minus_one = -&FieldElement::one(); // 1. Compute r <--- nr_0^2. let r_0_squared = r_0.square(); @@ -274,11 +275,15 @@ impl DecafPoint { // 2. Compute D <--- (dr + (a-d)) * (dr - (d + ar)) let dr = &constants::d * &r; - // D = (dr + (a-d)) * (dr - (d + ar)) = (dr + (a-d))*(dr - (d-r)) since a=-1 - let D = &(&dr + &constants::a_minus_d) * &(&dr - &(&constants::d - &r)); + // D = (dr + (a-d)) * (dr - (d + ar)) + // = (dr + (a-d)) * (dr - (d-r)) since a=-1 + // writing as + // = (dr + (a-d)) * dr - (dr + (a-d)) * (d - r) + // avoids two consecutive additions (could cause overflow) + let dr_plus_amd = &dr + &constants::a_minus_d; + let D = &(&dr_plus_amd * &dr) - &(&dr_plus_amd * &(&constants::d - &r)); // 3. Compute N <--- (r+1) * (a-2d) - let minus_one = -&FieldElement::one(); let N = &(&r + &FieldElement::one()) * &(&minus_one - &constants::d2); // 4. Compute From 714bf3dd0713adb09a9300a0dde8ab6db9067c91 Mon Sep 17 00:00:00 2001 From: Henry de Valence Date: Fri, 19 May 2017 13:44:20 -0700 Subject: [PATCH 3/3] Set the number of trials back to 10,000 --- src/decaf.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/decaf.rs b/src/decaf.rs index 749d218..e5a6c45 100644 --- a/src/decaf.rs +++ b/src/decaf.rs @@ -671,7 +671,7 @@ mod test { #[test] fn decaf_random_is_valid() { let mut rng = OsRng::new().unwrap(); - for _ in 0..100_000 { + for _ in 0..10_000 { let P = DecafPoint::random(&mut rng); // Check that P is on the curve assert!(P.0.is_valid());