diff --git a/src/backend/avx2/constants.rs b/src/backend/avx2/constants.rs index 087d96c..362b518 100644 --- a/src/backend/avx2/constants.rs +++ b/src/backend/avx2/constants.rs @@ -55,8 +55,8 @@ pub(crate) static P_TIMES_2_MASKED: FieldElement32x4 = FieldElement32x4([ pub static ODD_MULTIPLES_OF_BASEPOINT: [ExtendedPoint; 8] = [ ExtendedPoint(FieldElement32x4([ u32x8::new(52811034, 40265304, 25909283, 26843545, 1, 28827043, 0, 27438313), - u32x8::new(16144682, 13421772, 17082669, 20132659, 0, 39759291, 0, 244362), - u32x8::new(27570973, 26843545, 30858332, 6710886, 0, 8635006, 0, 11264893), + u32x8::new(16144682, 13421772, 17082669, 20132659, 0, 39759291, 0, 244362), + u32x8::new(27570973, 26843545, 30858332, 6710886, 0, 8635006, 0, 11264893), u32x8::new(40966398, 53687091, 8378388, 13421772, 0, 19351346, 0, 13413597), u32x8::new(20764389, 40265318, 8758491, 26843545, 0, 16611511, 0, 27139452), ])), @@ -68,45 +68,45 @@ pub static ODD_MULTIPLES_OF_BASEPOINT: [ExtendedPoint; 8] = [ u32x8::new(63042604, 52399761, 22087481, 29829870, 8565820, 33723612, 28645162, 8502864), ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(14879397, 3951036, 9454671, 16606238, 23529732, 44147004, 11890541, 17067526), - u32x8::new(58509479, 57216664, 9671992, 32001147, 60966207, 11801823, 10808378, 15115613), - u32x8::new(54854992, 39210911, 8112050, 1353604, 1337416, 35520540, 32967851, 17786030), - u32x8::new(59007462, 40864509, 26240923, 30403852, 28456403, 21546582, 32732450, 21005910), + u32x8::new(14879397, 3951036, 9454671, 16606238, 23529732, 44147004, 11890541, 17067526), + u32x8::new(58509479, 57216664, 9671992, 32001147, 60966207, 11801823, 10808378, 15115613), + u32x8::new(54854992, 39210911, 8112050, 1353604, 1337416, 35520540, 32967851, 17786030), + u32x8::new(59007462, 40864509, 26240923, 30403852, 28456403, 21546582, 32732450, 21005910), u32x8::new(40711675, 22446613, 9664668, 12483629, 26142305, 56254715, 15439904, 214849), ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(52231579, 51632644, 173613, 7677257, 26374424, 45994428, 5303371, 1425942), + u32x8::new(52231579, 51632644, 173613, 7677257, 26374424, 45994428, 5303371, 1425942), u32x8::new(38126791, 48854506, 23252518, 30611978, 49977504, 66706952, 1076178, 27100873), - u32x8::new(26349427, 63077566, 20258199, 3884787, 33226507, 2371423, 5787271, 18628170), - u32x8::new(15005754, 22729577, 4978944, 2522289, 1404784, 56367795, 22517039, 29271243), + u32x8::new(26349427, 63077566, 20258199, 3884787, 33226507, 2371423, 5787271, 18628170), + u32x8::new(15005754, 22729577, 4978944, 2522289, 1404784, 56367795, 22517039, 29271243), u32x8::new(22748934, 35977548, 25561257, 31734126, 22775284, 32000077, 927866, 2278697), ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(66090281, 61980626, 23780289, 6519561, 62542590, 47174086, 28818882, 15661068), - u32x8::new(17433715, 12931425, 12232056, 7885877, 44179512, 35590146, 32787344, 22631048), - u32x8::new(43729883, 6870635, 15782399, 11810556, 2652935, 31800505, 23683367, 13638649), - u32x8::new(64007953, 40242373, 32810277, 20180235, 20399465, 48133835, 32913956, 19094667), + u32x8::new(66090281, 61980626, 23780289, 6519561, 62542590, 47174086, 28818882, 15661068), + u32x8::new(17433715, 12931425, 12232056, 7885877, 44179512, 35590146, 32787344, 22631048), + u32x8::new(43729883, 6870635, 15782399, 11810556, 2652935, 31800505, 23683367, 13638649), + u32x8::new(64007953, 40242373, 32810277, 20180235, 20399465, 48133835, 32913956, 19094667), u32x8::new(56562708, 40269142, 18953105, 9027935, 35700921, 12896915, 14757156, 22773619), ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(65129016, 34709402, 25132940, 13788431, 3661652, 16914498, 27409409, 18941039), - u32x8::new(42488074, 49427602, 6177212, 20812339, 41644653, 2977316, 12162542, 5293661), - u32x8::new( 7981168, 12223605, 6239200, 20403609, 20710415, 4828170, 11627702, 4431044), - u32x8::new(65817142, 96824, 25021652, 16364722, 50410869, 24651857, 6979034, 33176209), + u32x8::new(65129016, 34709402, 25132940, 13788431, 3661652, 16914498, 27409409, 18941039), + u32x8::new(42488074, 49427602, 6177212, 20812339, 41644653, 2977316, 12162542, 5293661), + u32x8::new( 7981168, 12223605, 6239200, 20403609, 20710415, 4828170, 11627702, 4431044), + u32x8::new(65817142, 96824, 25021652, 16364722, 50410869, 24651857, 6979034, 33176209), u32x8::new(33008344, 8687253, 27859668, 28796356, 30192014, 11975680, 11991047, 27710707), - ])), + ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(14676653, 50945941, 13489249, 31456262, 47726639, 21761847, 3324839, 7843947), - u32x8::new(53352326, 8688989, 12944061, 12994004, 50113821, 37990636, 1537898, 20483689), - u32x8::new(46786852, 15572264, 24004728, 7566233, 32596174, 34437796, 23201722, 3431551), - u32x8::new(49025674, 52497128, 13273618, 10266201, 66795206, 2887684, 30966565, 33449990), + u32x8::new(14676653, 50945941, 13489249, 31456262, 47726639, 21761847, 3324839, 7843947), + u32x8::new(53352326, 8688989, 12944061, 12994004, 50113821, 37990636, 1537898, 20483689), + u32x8::new(46786852, 15572264, 24004728, 7566233, 32596174, 34437796, 23201722, 3431551), + u32x8::new(49025674, 52497128, 13273618, 10266201, 66795206, 2887684, 30966565, 33449990), u32x8::new(53210238, 65839385, 15458877, 18409918, 24777464, 25586795, 15335748, 12323382), ])), ExtendedPoint(FieldElement32x4([ - u32x8::new(57816016, 23106045, 24948505, 27413507, 32551424, 26145165, 22632568, 27527446), - u32x8::new(53022711, 40974949, 14110533, 30646997, 51399118, 53289754, 32528560, 15822835), - u32x8::new(23810949, 51779690, 17532625, 21326637, 60314333, 43761996, 4852905, 3474945), - u32x8::new(13323962, 10752742, 16431634, 26425049, 24258356, 53260846, 19756601, 19546842), + u32x8::new(57816016, 23106045, 24948505, 27413507, 32551424, 26145165, 22632568, 27527446), + u32x8::new(53022711, 40974949, 14110533, 30646997, 51399118, 53289754, 32528560, 15822835), + u32x8::new(23810949, 51779690, 17532625, 21326637, 60314333, 43761996, 4852905, 3474945), + u32x8::new(13323962, 10752742, 16431634, 26425049, 24258356, 53260846, 19756601, 19546842), u32x8::new(17403634, 52199608, 32323720, 5313255, 48522162, 33376516, 31903659, 15291466), ])), ]; diff --git a/src/backend/avx2/edwards.rs b/src/backend/avx2/edwards.rs index 76c81b0..1a58133 100644 --- a/src/backend/avx2/edwards.rs +++ b/src/backend/avx2/edwards.rs @@ -200,16 +200,16 @@ impl ExtendedPoint { // See discussion of bounds in the module-level documentation. // // We want to compute - // - // + | S1 | S1 | S1 | S1 | - // + | S2 | | | S2 | - // + | | | S3 | | - // + | | | S3 | | + // + // + | S1 | S1 | S1 | S1 | + // + | S2 | | | S2 | + // + | | | S3 | | + // + | | | S3 | | // + | | | |-S4 | - // + | | 2p | 2p | | - // - | | S2 | S2 | | - // ======================= - // S5 S6 S8 S9 + // + | | 2p | 2p | | + // - | | S2 | S2 | | + // ======================= + // S5 S6 S8 S9 // for i in 0..5 { let zero = i32x8::splat(0); @@ -908,7 +908,7 @@ mod test { let P2 = &B * &s1; let R = &(&P1 * &s1) + &(&P2 * &s2); - + let R_multiscalar = multiscalar_mult(&[s1, s2], &[P1.into(), P2.into()]); assert_eq!(edwards::EdwardsPoint::from(R).compress(), @@ -928,7 +928,7 @@ mod test { let P2 = &B * &s1; let R = &(&P1 * &s1) + &(&P2 * &s2); - + let R_multiscalar = vartime::multiscalar_mult(&[s1, s2], &[P1.into(), P2.into()]); assert_eq!(edwards::EdwardsPoint::from(R).compress(), diff --git a/src/backend/avx2/field.rs b/src/backend/avx2/field.rs index 7f422e0..3f69aad 100644 --- a/src/backend/avx2/field.rs +++ b/src/backend/avx2/field.rs @@ -69,7 +69,7 @@ impl FieldElement32x4 { out[2].0[i] = c_2i + (c_2i_1 << 26); out[3].0[i] = d_2i + (d_2i_1 << 26); } - + out } @@ -280,7 +280,7 @@ impl FieldElement32x4 { // c98 = (c9, c9, c8, c8, c9, c9, c8, c8) // let c9_19: u32x8; - unsafe { + unsafe { use stdsimd::vendor::_mm256_mul_epu32; use stdsimd::vendor::_mm256_shuffle_epi32; let c9_spread: u32x8 = _mm256_shuffle_epi32(c98.into(), 0b11_01_10_00).into(); @@ -318,7 +318,7 @@ impl FieldElement32x4 { // Since z[3] < 2^64, c < 2^(64-25) = 2^39, // so z[4] < 2^26 + 2^39 < 2^39.0002 carry(&mut z, 4); carry(&mut z, 8); - // Now z[4] < 2^26 + // Now z[4] < 2^26 // and z[5] < 2^25 + 2^13.0002 < 2^25.0004 (good enough) // Last carry has a multiplication by 19. In the serial case we @@ -402,7 +402,7 @@ impl FieldElement32x4 { use stdsimd::vendor::_mm256_mul_epu32; unsafe { _mm256_mul_epu32(x,y) } } - + #[inline(always)] fn m_lo(x: u32x8, y: u32x8) -> u32x8 { use stdsimd::vendor::_mm256_mul_epu32; @@ -464,7 +464,7 @@ impl FieldElement32x4 { // > 4485585228861014016 // // So these multiples of p are big enough to avoid underflow - // in subtraction, and small enough to fit within u64 + // in subtraction, and small enough to fit within u64 // with room for a carry. let low__p37 = u64x4::splat(0x3ffffed << 37); @@ -481,7 +481,7 @@ impl FieldElement32x4 { z7 = mask_neg(z7, odd__p37, neg_mask); z8 = mask_neg(z8, even_p37, neg_mask); z9 = mask_neg(z9, odd__p37, neg_mask); - + FieldElement32x4::reduce64([z0, z1, z2, z3, z4, z5, z6, z7, z8, z9]) } } @@ -495,7 +495,7 @@ impl<'a, 'b> Mul<&'b FieldElement32x4> for &'a FieldElement32x4 { use stdsimd::vendor::_mm256_mul_epu32; unsafe { _mm256_mul_epu32(x,y) } } - + #[inline(always)] fn m_lo(x: u32x8, y: u32x8) -> u32x8 { use stdsimd::vendor::_mm256_mul_epu32; @@ -519,7 +519,7 @@ impl<'a, 'b> Mul<&'b FieldElement32x4> for &'a FieldElement32x4 { let y1_19 = m_lo(v19, y1); // This fits in a u32 let y2_19 = m_lo(v19, y2); // iff 26 + b + lg(19) < 32 let y3_19 = m_lo(v19, y3); // if b < 32 - 26 - 4.248 = 1.752 - let y4_19 = m_lo(v19, y4); + let y4_19 = m_lo(v19, y4); let y5_19 = m_lo(v19, y5); // below, b<2.5: this is a bottleneck, let y6_19 = m_lo(v19, y6); // could be avoided by promoting to let y7_19 = m_lo(v19, y7); // u64 here instead of in m() diff --git a/src/backend/avx2/mod.rs b/src/backend/avx2/mod.rs index 04462b1..385be33 100644 --- a/src/backend/avx2/mod.rs +++ b/src/backend/avx2/mod.rs @@ -57,7 +57,7 @@ //! Here \\( k = 2d \\) is a curve constant. //! //! # Implementation strategy -//! +//! //! For a software implementation, each "processor"'s operations are too //! low-latency to parallelize across threads. However, the main cost //! is in the multiplication and squaring steps, which share a single @@ -74,7 +74,7 @@ //! The addition and subtraction steps are done largely serially, using //! masking to handle the instruction divergence. The remaining //! obstacle to parallelism is the multiplication by the curve constant -//! \\(k = 2d\\). In the Curve25519 case, this is +//! \\(k = 2d\\). In the Curve25519 case, this is //! //! $$ k \equiv 2 \frac{-121665}{121666} \\ \equiv 16295367250680780974490674513165176452449235426866156013048779062215315747161 \pmod p. $$ //! @@ -110,7 +110,7 @@ //! analyzes a 2-wide variant of the Montgomery ladder (for comparison //! with parallel Edwards formulas); this strategy was used in 2015 by //! Tung Chou's `sandy2x` implementation, which used a 2-wide field -//! implementation in 128-bit vector registers. +//! implementation in 128-bit vector registers. //! //! Curiously, however, although the [`sandy2x` paper][sandy2x] also //! implements Edwards arithmetic, and cites the HWCD paper, it doesn't @@ -133,11 +133,11 @@ //! This optimization is not compatible with the parallel formulas, which are //! therefore slightly less efficient when counting the total number of //! field multiplications and squarings. In particular, vectorized doublings -//! are less efficient than serial doublings. +//! are less efficient than serial doublings. //! In addition, the parallel formulas can only use a \\( 32 \times 32 //! \rightarrow 64 \\)-bit integer multiplier, so the speedup from //! vectorization must overcome the disadvantage of losing the \\( 64 -//! \times 64 \rightarrow 128\\)-bit (serial) integer multiplier. +//! \times 64 \rightarrow 128\\)-bit (serial) integer multiplier. //! //! # Tweaked formulas //! @@ -156,7 +156,7 @@ //! S\_0 &\gets Y\_1 - X\_1 \\\\ //! S\_1 &\gets Y\_1 + X\_1 \\\\ //! S\_2 &\gets Y\_2 - X\_2 \\\\ -//! S\_3 &\gets Y\_2 + X\_2 +//! S\_3 &\gets Y\_2 + X\_2 //! \end{aligned} //! $$ //! @@ -165,7 +165,7 @@ //! S\_4 &\gets S\_0 S\_2 \\\\ //! S\_5 &\gets S\_1 S\_3 \\\\ //! S\_6 &\gets Z\_1 Z\_2 \\\\ -//! S\_7 &\gets T\_1 T\_2 +//! S\_7 &\gets T\_1 T\_2 //! \end{aligned} //! $$ //! @@ -177,7 +177,7 @@ //! S\_{11} &\gets S\_7 \cdot -2 \cdot 121665 //! \end{aligned} //! $$ -//! +//! //! $$ //! \begin{aligned} //! S\_{12} &\gets S\_9 - S\_8 \\\\ @@ -205,7 +205,7 @@ //! $$ //! \begin{aligned} //! S\_2 &\gets Y\_2 - X\_2 \\\\ -//! S\_3 &\gets Y\_2 + X\_2 +//! S\_3 &\gets Y\_2 + X\_2 //! \end{aligned} //! $$ //! @@ -226,7 +226,7 @@ //! multiplications of small constants instead of a serial computation //! of multiplication by a large constant. //! -//! To perform readdition of \\(P_1 = (X_1 : Y_1 : Z_1 : T_1) \\) and +//! To perform readdition of \\(P_1 = (X_1 : Y_1 : Z_1 : T_1) \\) and //! \\(P_2 = (S\_2', S\_3', Z\_2', T\_2') \\), we compute //! //! $$ @@ -244,7 +244,7 @@ //! S\_{11} &\gets T\_1 T\_2' //! \end{aligned} //! $$ -//! +//! //! $$ //! \begin{aligned} //! S\_{12} &\gets S\_9 - S\_8 \\\\ @@ -278,7 +278,7 @@ //! S\_1 &\gets X\_1\^2 \\\\ //! S\_2 &\gets Y\_1\^2 \\\\ //! S\_3 &\gets Z\_1\^2 \\\\ -//! S\_4 &\gets S\_0\^2 +//! S\_4 &\gets S\_0\^2 //! \end{aligned} //! $$ //! @@ -297,7 +297,7 @@ //! X\_3 &\gets S\_8 S\_9 \\\\ //! Y\_3 &\gets S\_5 S\_6 \\\\ //! Z\_3 &\gets S\_8 S\_6 \\\\ -//! T\_3 &\gets S\_5 S\_9 +//! T\_3 &\gets S\_5 S\_9 //! \end{aligned} //! $$ //! @@ -331,11 +331,11 @@ //! +& & 2p & 2p & 2p \\\\ //! -& & S\_2 & S\_2 & \\\\ //! -& & & & S\_4 \\\\ -//! =& S\_5 & S\_6 & S\_8 & S\_9 +//! =& S\_5 & S\_6 & S\_8 & S\_9 //! \end{matrix} //! $$ //! -//! results in bit-excesses \\( (1.00, 1.59, 2.33, 2.00)\\) for +//! results in bit-excesses \\( (1.00, 1.59, 2.33, 2.00)\\) for //! \\( (S\_5, S\_6, S\_8, S\_9 ) \\). The products we want to compute //! are then //! @@ -344,7 +344,7 @@ //! X\_3 &\gets S\_8 S\_9 \leftrightarrow (2.33, 2.00) \\\\ //! Y\_3 &\gets S\_5 S\_6 \leftrightarrow (1.00, 1.59) \\\\ //! Z\_3 &\gets S\_8 S\_6 \leftrightarrow (2.33, 1.59) \\\\ -//! T\_3 &\gets S\_5 S\_9 \leftrightarrow (1.00, 2.00) +//! T\_3 &\gets S\_5 S\_9 \leftrightarrow (1.00, 2.00) //! \end{aligned} //! $$ //! @@ -361,20 +361,20 @@ //! +& & & & S\_4' \\\\ //! +& & 2p & 2p & \\\\ //! -& & S\_2 & S\_2 & \\\\ -//! =& S\_5 & S\_6 & S\_8 & S\_9 +//! =& S\_5 & S\_6 & S\_8 & S\_9 //! \end{matrix} //! $$ //! -//! resulting in bit-excesses \\( (1.00, 1.59, 2.33, 1.59)\\) for +//! resulting in bit-excesses \\( (1.00, 1.59, 2.33, 1.59)\\) for //! \\( (S\_5, S\_6, S\_8, S\_9 ) \\). The products we want to compute -//! are then +//! are then //! //! $$ //! \begin{aligned} //! X\_3 &\gets S\_8 S\_9 \leftrightarrow (2.33, 1.59) \\\\ //! Y\_3 &\gets S\_5 S\_6 \leftrightarrow (1.00, 1.59) \\\\ //! Z\_3 &\gets S\_8 S\_6 \leftrightarrow (2.33, 1.59) \\\\ -//! T\_3 &\gets S\_5 S\_9 \leftrightarrow (1.00, 1.59) +//! T\_3 &\gets S\_5 S\_9 \leftrightarrow (1.00, 1.59) //! \end{aligned} //! $$ //! diff --git a/src/backend/u64/field.rs b/src/backend/u64/field.rs index 20cb6da..0859991 100644 --- a/src/backend/u64/field.rs +++ b/src/backend/u64/field.rs @@ -135,7 +135,7 @@ impl<'a, 'b> Mul<&'b FieldElement64> for &'a FieldElement64 { // How big are the c[i]? We have // - // c[i] < 2^(102 + 2*b) * (1+i + (4-i)*19) + // c[i] < 2^(102 + 2*b) * (1+i + (4-i)*19) // < 2^(102 + lg(1 + 4*19) + 2*b) // < 2^(108.27 + 2*b) // @@ -261,19 +261,19 @@ impl FieldElement64 { // Because we don't need to canonicalize, only to reduce the // limb sizes, it's OK to do a "weak reduction", where we // compute the carry-outs in parallel. - + let c0 = limbs[0] >> 51; let c1 = limbs[1] >> 51; let c2 = limbs[2] >> 51; let c3 = limbs[3] >> 51; let c4 = limbs[4] >> 51; - + limbs[0] &= LOW_51_BIT_MASK; limbs[1] &= LOW_51_BIT_MASK; limbs[2] &= LOW_51_BIT_MASK; limbs[3] &= LOW_51_BIT_MASK; limbs[4] &= LOW_51_BIT_MASK; - + limbs[0] += c4 * 19; limbs[1] += c0; limbs[2] += c1; @@ -448,7 +448,7 @@ impl FieldElement64 { let mut c4: u128 = m(a[2], a[2]) + 2*( m(a[0], a[4]) + m(a[1], a[3]) ); // Same bound as in multiply: - // c[i] < 2^(102 + 2*b) * (1+i + (4-i)*19) + // c[i] < 2^(102 + 2*b) * (1+i + (4-i)*19) // < 2^(102 + lg(1 + 4*19) + 2*b) // < 2^(108.27 + 2*b) // @@ -504,7 +504,7 @@ impl FieldElement64 { a[0] &= LOW_51_BIT_MASK; // Now all a[i] < 2^(51 + epsilon) and a = self^(2^k). - + k = k - 1; if k == 0 { break; diff --git a/src/constants.rs b/src/constants.rs index 16edb4f..1c80dff 100644 --- a/src/constants.rs +++ b/src/constants.rs @@ -20,7 +20,7 @@ //! //! let B = &constants::RISTRETTO_BASEPOINT_TABLE; //! let l = &constants::BASEPOINT_ORDER; -//! +//! //! let A = l * B; //! assert!(A.is_identity()); //! ``` @@ -69,7 +69,7 @@ pub const RISTRETTO_BASEPOINT_POINT: RistrettoPoint = RistrettoPoint(ED25519_BAS /// \ell = 2^\{252\} + 27742317777372353535851937790883648493. /// $$ pub const BASEPOINT_ORDER: Scalar = Scalar{ - bytes: [ + bytes: [ 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, diff --git a/src/curve_models/window.rs b/src/curve_models/window.rs index 6723cee..c247459 100644 --- a/src/curve_models/window.rs +++ b/src/curve_models/window.rs @@ -23,7 +23,7 @@ use traits::Identity; /// A lookup table of precomputed multiples of a point \\(P\\), used to /// compute \\( xP \\) for \\( -8 \leq x \leq 8 \\). /// -/// The computation of \\( xP \\) is done in constant time by the `select` function. +/// The computation of \\( xP \\) is done in constant time by the `select` function. /// /// Since `LookupTable` does not implement `Index`, it's more difficult /// to accidentally use the table directly. Unfortunately the table is @@ -52,7 +52,7 @@ use clear_on_drop::clear::ZeroSafe; /// XXX is this a good compromise? unsafe impl ZeroSafe for LookupTable {} -impl LookupTable +impl LookupTable where T: Identity + ConditionallyAssignable + ConditionallyNegatable { /// Given \\(-8 \leq x \leq 8\\), return \\(xP\\) in constant time. diff --git a/src/edwards.rs b/src/edwards.rs index 8f95323..4a41cba 100644 --- a/src/edwards.rs +++ b/src/edwards.rs @@ -110,7 +110,7 @@ use scalar::Scalar; use montgomery::MontgomeryPoint; use curve_models::ProjectivePoint; -use curve_models::CompletedPoint; +use curve_models::CompletedPoint; use curve_models::AffineNielsPoint; use curve_models::ProjectiveNielsPoint; @@ -315,7 +315,7 @@ impl EdwardsPoint { /// Convert the representation of this point from extended /// coordinates to projective coordinates. /// - /// Free. + /// Free. pub(crate) fn to_projective(&self) -> ProjectivePoint { ProjectivePoint{ X: self.X, @@ -348,7 +348,7 @@ impl EdwardsPoint { // also to rewrite it to use tex // // # Implementation notes - // + // // Taking the Montgomery curve equation in affine coordinates: // //     E_(A,B) = Bv² = u³ + Au² + u   (1) @@ -583,7 +583,7 @@ impl<'a, 'b> Mul<&'b EdwardsPoint> for &'a Scalar { /// /// A iterable of `Scalar`s and a iterable of `EdwardsPoints`. It is an /// error to call this function with two iterators of different lengths. -/// +/// // XXX later when we do more fancy multiscalar mults, we can delegate // based on the iter's size hint -- hdevalence #[cfg(any(feature = "alloc", feature = "std"))] @@ -600,7 +600,7 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> EdwardsPoint // Otherwise, proceed as normal: #[cfg(not(all(feature="nightly", all(feature="avx2_backend", target_feature="avx2"))))] { //assert_eq!(scalars.len(), points.len()); - + use clear_on_drop::ClearOnDrop; let lookup_tables_vec: Vec<_> = points.into_iter() @@ -668,7 +668,7 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> EdwardsPoint pub struct EdwardsBasepointTable(pub(crate) [LookupTable; 32]); impl EdwardsBasepointTable { - /// The computation uses Pippeneger's algorithm, as described on + /// The computation uses Pippeneger's algorithm, as described on /// page 13 of the Ed25519 paper. Write the scalar \\(a\\) in radix \\(16\\) with /// coefficients in \\([-8,8)\\), i.e., /// $$ diff --git a/src/montgomery.rs b/src/montgomery.rs index c7406ef..fc58a53 100644 --- a/src/montgomery.rs +++ b/src/montgomery.rs @@ -39,7 +39,7 @@ use scalar::Scalar; // XXX Move these to a common "group" module? At the same time, we should // XXX probably make a `trait Group` once const generics are implemented in // XXX Rust. —isis -// +// // XXX I put these in a `traits` module for now - hdevalence use traits::{Identity, ValidityCheck}; diff --git a/src/ristretto.rs b/src/ristretto.rs index a7564be..6c30121 100644 --- a/src/ristretto.rs +++ b/src/ristretto.rs @@ -190,7 +190,7 @@ mod notes { //! These correspond to the affine model //! //! $$\mathcal E\_{a,d} : ax\^2 + y\^2 = 1 + dx\^2y\^2.$$ -//! +//! //! In projective coordinates, we represent a point as \\((X:Y:Z:T)\\) //! with $$XY = ZT, \quad aX\^2 + Y\^2 = Z\^2 + dT\^2.$$ (For more //! details on this model, see the documentation for the `edwards` @@ -231,7 +231,7 @@ mod notes { //! \cong \mathbb Z / 8\\), we have \\(\[2\](\mathcal E[8]) = \mathcal //! E[4]\\), \\(\mathcal E[4] \cong \mathbb Z / 4 //! \\) and \\( \mathcal E[2] \cong \mathbb Z / 2\\). In particular -//! this tells us that the group +//! this tells us that the group //! $$ //! \frac{\[2\](\mathcal E)}{\mathcal E[4]} //! $$ @@ -272,16 +272,16 @@ mod notes { //! The Decaf paper recalls that, for a group \\( G \\) with normal //! subgroup \\(G' \leq G\\), a group homomorphism \\( \phi : G //! \rightarrow H \\) induces a homomorphism -//! $$ +//! $$ //! \bar{\phi} : \frac G {G'} \longrightarrow \frac {\phi(G)}{\phi(G')} \leq \frac {H} {\phi(G')}, -//! $$ +//! $$ //! and that the induced homomorphism \\(\bar{\phi}\\) is injective if //! \\( \ker \phi \leq G' \\). In our context, the kernel of //! \\(\theta\\) is \\( \\{(0, \pm 1)\\} \leq \mathcal J[2] \\), //! so \\(\theta\\) gives an isomorphism //! $$ -//! \frac {\mathcal J} {\mathcal J[2]} -//! \cong +//! \frac {\mathcal J} {\mathcal J[2]} +//! \cong //! \frac {\theta(\mathcal J)} {\theta(\mathcal J[2])} //! \cong //! \frac {\[2\](\mathcal E)} {\mathcal E[2]}. @@ -313,26 +313,26 @@ mod notes { //! the point by setting \\( (x,y) \gets (x,y) + P_4 \\), where //! \\(P_4\\) is a \\(4\\)-torsion point. //! -//! 2. Check if \\(x\\) is negative or \\( y = -1 \\); if so, set +//! 2. Check if \\(x\\) is negative or \\( y = -1 \\); if so, set //! \\( (x,y) \gets (x,y) + (0,-1) = (-x, -y) \\). //! //! 3. Compute $$ s = +\sqrt {(-a) \frac {1 - y} {1 + y} }, $$ choosing //! the positive square root. //! -//! The output is then the (canonical) byte-encoding of \\(s\\). +//! The output is then the (canonical) byte-encoding of \\(s\\). //! //! If \\(\mathcal E\\) has cofactor \\(4\\), we skip the first step, //! since our input already represents a coset in //! \\( \[2\](\mathcal E) / \mathcal E[2] \\). -//! +//! //! To see that this corresponds to the encoding procedure above, notice //! that the first step lifts from \\( \mathcal E / \mathcal E[4] \\) to //! \\(\mathcal E / \mathcal E[2]\\). To understand steps 2 and 3, -//! notice that the \\(y\\)-coordinate of \\(\theta(s,t)\\) is +//! notice that the \\(y\\)-coordinate of \\(\theta(s,t)\\) is //! $$ //! y = \frac {1 + as\^2}{1 - as\^2}, //! $$ -//! so that the \\(s\\)-coordinate of \\(\theta\^{-1}(x,y)\\) has +//! so that the \\(s\\)-coordinate of \\(\theta\^{-1}(x,y)\\) has //! $$ //! s\^2 = (-a)\frac {1-y}{1+y}. //! $$ @@ -387,7 +387,7 @@ mod notes { //! \\) requires an inverse square root. //! As inversions are expensive, we'd like to be able to do this //! whole computation with only one inverse square root, by batching -//! together the inversion and the inverse square root. +//! together the inversion and the inverse square root. //! //! However, it is not obvious how to do this, since the inverse square //! root computation depends on the affine coordinates (which select the @@ -403,7 +403,7 @@ mod notes { //! $$ //! //! Here \\( (X:Y:Z:T) \\) are the coordinates of the distinguished -//! representative of the coset. +//! representative of the coset. //! Write \\( (X\_0 : Y\_0 : Z\_0 : T\_0) \\) //! for the coordinates of the initial representative. Then the //! torquing procedure in step 1 replaces \\( (X\_0 : Y\_0 : Z\_0 : @@ -427,9 +427,9 @@ mod notes { //! $$ //! (a-d)X\^2Y\^2 = Z\^4 - aZ\^2X\^2 - Z\^2Y\^2 + aX\^2Y\^2 = (Z\^2 - Y\^2)(Z\^2 + X\^2). //! $$ -//! +//! //! The encoding procedure is as follows: -//! +//! //! 1. \\(u\_1 \gets (Z\_0 + Y\_0)(Z\_0 - Y\_0) = Z\_0\^2 - Y\_0\^2 \\) //! 2. \\(u\_2 \gets X\_0 Y\_0 \\) //! 3. \\(I \gets \mathrm{invsqrt}(u\_1 u\_2\^2) = 1/\sqrt{X\_0\^2 Y\_0\^2 (Z\_0\^2 - Y\_0\^2)} \\) @@ -708,18 +708,18 @@ impl RistrettoPoint { /// # // See https://doc.rust-lang.org/book/documentation.html#documentation-as-tests /// # fn main() { /// let mut rng = OsRng::new().unwrap(); - /// let points: Vec = + /// let points: Vec = /// (0..32).map(|_| RistrettoPoint::random(&mut rng)).collect(); /// /// let compressed = RistrettoPoint::double_and_compress_batch(&points); - /// + /// /// for (P, P2_compressed) in points.iter().zip(compressed.iter()) { /// assert_eq!(*P2_compressed, (P + P).compress()); /// } /// # } /// ``` #[cfg(any(feature = "alloc", feature = "std"))] - pub fn double_and_compress_batch<'a, I>(points: I) -> Vec + pub fn double_and_compress_batch<'a, I>(points: I) -> Vec where I: IntoIterator { #[derive(Copy, Clone, Debug)] @@ -787,7 +787,7 @@ impl RistrettoPoint { let negcheck2 = (&(&h * &e) * &Zinv).is_negative(); g.conditional_negate(negcheck2); - + let mut s = &(&h - &g) * &(&magic * &(&g * &Tinv)); let s_is_negative = s.is_negative(); @@ -819,7 +819,7 @@ impl RistrettoPoint { let r = i * &r_0.square(); - // D = (dr -a)(ar-d) = -(dr+1)(r+d) + // D = (dr -a)(ar-d) = -(dr+1)(r+d) let D = -&( &(&(d * &r) + &one) * &(&r + d) ); // N = a(d-a)(d+a)(r+1) = -(r+1)(d^2 -1) let d_sq = d.square(); @@ -957,7 +957,7 @@ impl Equal for RistrettoPoint { let Y1X2 = &self.0.Y * &other.0.X; let X1X2 = &self.0.X * &other.0.X; let Y1Y2 = &self.0.Y * &other.0.Y; - + X1Y2.ct_eq(&Y1X2) | X1X2.ct_eq(&Y1Y2) } } @@ -1379,11 +1379,11 @@ mod test { fn double_and_compress_1024_random_points() { let mut rng = OsRng::new().unwrap(); - let points: Vec = + let points: Vec = (0..1024).map(|_| RistrettoPoint::random(&mut rng)).collect(); let compressed = RistrettoPoint::double_and_compress_batch(&points); - + for (P, P2_compressed) in points.iter().zip(compressed.iter()) { assert_eq!(*P2_compressed, (P + P).compress()); } @@ -1431,7 +1431,7 @@ mod bench { fn double_and_compress_n_random_points(n: usize, b: &mut Bencher) { let mut rng = OsRng::new().unwrap(); - let points: Vec = + let points: Vec = (0..n).map(|_| RistrettoPoint::random(&mut rng)).collect(); b.iter(|| RistrettoPoint::double_and_compress_batch(&points) ); diff --git a/src/scalar.rs b/src/scalar.rs index 72b2b01..ae17169 100644 --- a/src/scalar.rs +++ b/src/scalar.rs @@ -34,14 +34,14 @@ use backend; use constants; /// An `UnpackedScalar` represents an element of the field GF(l), optimized for speed. -/// +/// /// This is a type alias for one of the scalar types in the `backend` /// module. #[cfg(feature="radix_51")] type UnpackedScalar = backend::u64::scalar::Scalar64; /// An `UnpackedScalar` represents an element of the field GF(l), optimized for speed. -/// +/// /// This is a type alias for one of the scalar types in the `backend` /// module. #[cfg(not(feature="radix_51"))] @@ -75,11 +75,11 @@ type UnpackedScalar = backend::u32::scalar::Scalar32; #[derive(Copy, Clone)] pub struct Scalar { /// `bytes` is a little-endian byte encoding of an integer representing a scalar modulo the group order. - /// + /// /// # Invariant - /// + /// /// The integer representing this scalar must be bounded above by \\(2\^{255}\\), or equivalently the high bit of `bytes[31]` must be zero. - /// + /// // XXX This is pub(crate) so we can write literal constants. If const fns were stable, we could make the Scalar constructors const fns and use those instead. pub(crate) bytes: [u8; 32], } @@ -124,7 +124,7 @@ impl Scalar { } /// Construct a `Scalar` from the low 255 bits of a 256-bit integer. - /// + /// /// This function is intended for applications like X25519 which /// require specific bit-patterns when performing scalar /// multiplication. @@ -462,7 +462,7 @@ impl Scalar { // Step 1: write out bits of the scalar let mut naf = self.bits(); - // Step 2: zero coefficients by carrying them upwards or downwards + // Step 2: zero coefficients by carrying them upwards or downwards 'bits: for i in 0..256 { if naf[i] == 0 { continue 'bits; } 'window: for b in 1..6 { @@ -481,7 +481,7 @@ impl Scalar { // Since naf[k] = 0 or 1 for k > i, naf[k] == 1. naf[k] = 0; // Subtract 2^k } else { - // By now we have subtracted 2^k = + // By now we have subtracted 2^k = // 2^(i+b) + 2^(i+b) + 2^(i+b+1) + ... + 2^(k-1). naf[k] = 1; // Add back 2^k. break 'carry; @@ -542,7 +542,7 @@ impl Scalar { x_mod_l.pack() } - /// Check whether this `Scalar` is the canonical representative mod \\(\ell\\). + /// Check whether this `Scalar` is the canonical representative mod \\(\ell\\). /// /// This is intended for uses like input validation, where variable-time code is acceptable. ///