diff --git a/src/constants.rs b/src/constants.rs index 46d4094..f12861a 100644 --- a/src/constants.rs +++ b/src/constants.rs @@ -94,6 +94,14 @@ pub const BASE_CMPRSSD: CompressedEdwardsY = 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66]); +/// Basepoint has y = 4/5. +pub const BASEPOINT: ExtendedPoint = ExtendedPoint{ + X: FieldElement([-14297830, -7645148, 16144683, -16471763, 27570974, -2696100, -26142465, 8378389, 20764389, 8758491]), + Y: FieldElement([-26843541, -6710886, 13421773, -13421773, 26843546, 6710886, -13421773, 13421773, -26843546, -6710886]), + Z: FieldElement([1, 0, 0, 0, 0, 0, 0, 0, 0, 0]), + T: FieldElement([28827062, -6116119, -27349572, 244363, 8635006, 11264893, 19351346, 13413597, 16611511, -6414980]), +}; + /// `l` is the order of base point, i.e. 2^252 + /// 27742317777372353535851937790883648493, in little-endian form pub const l: Scalar = Scalar([ 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, diff --git a/src/curve.rs b/src/curve.rs index 755694b..5d770d1 100644 --- a/src/curve.rs +++ b/src/curve.rs @@ -636,18 +636,24 @@ impl<'a> Neg for &'a PreComputedPoint { // Scalar multiplication // ------------------------------------------------------------------------ -impl ExtendedPoint { - /// Scalar multiplication: compute `a * self`. +/// Trait for scalar multiplication of an arbitrary point. +pub trait ScalarMult { + /// Compute `scalar * self`. + fn scalar_mult(&self, scalar: &S) -> Self; +} + +impl ScalarMult for ExtendedPoint { + /// Scalar multiplication: compute `scalar * self`. /// /// Uses a window of size 4. Note: for scalar multiplication of /// the basepoint, `basepoint_mult` is approximately 4x faster. - pub fn scalar_mult(&self, a: &Scalar) -> ExtendedPoint { + fn scalar_mult(&self, scalar: &Scalar) -> ExtendedPoint { let A = self.to_cached(); let mut As: [CachedPoint; 8] = [A; 8]; for i in 0..7 { As[i+1] = (self + &As[i]).to_extended().to_cached(); } - let e = a.to_radix_16(); + let e = scalar.to_radix_16(); let mut h = ExtendedPoint::identity(); let mut t: CompletedPoint; for i in (0..64).rev() { @@ -657,8 +663,22 @@ impl ExtendedPoint { } h } +} - /// Construct an `ExtendedPoint` from a `Scalar`, `a`, by +/// Trait for scalar multiplication of a distinguished basepoint. +pub trait BasepointMult { + /// Return the basepoint `B`. + fn basepoint() -> Self; + /// Compute `scalar * B`. + fn basepoint_mult(scalar: &S) -> Self; +} + +impl BasepointMult for ExtendedPoint { + fn basepoint() -> ExtendedPoint { + constants::BASEPOINT + } + + /// Construct an `ExtendedPoint` from a `Scalar`, `scalar`, by /// computing the multiple `aB` of the basepoint `B`. /// /// Precondition: the scalar must be reduced. @@ -683,8 +703,8 @@ impl ExtendedPoint { /// We then use the `select_precomputed_point` function, which /// takes `-8 ≤ x < 8` and `[16^2i * B, ..., 8 * 16^2i * B]`, /// and returns `x * 16^2i * B` in constant time. - pub fn basepoint_mult(a: &Scalar) -> ExtendedPoint { //GeScalarMultBase - let e = a.to_radix_16(); + fn basepoint_mult(scalar: &Scalar) -> ExtendedPoint { //GeScalarMultBase + let e = scalar.to_radix_16(); let mut h = ExtendedPoint::identity(); let mut t: CompletedPoint; @@ -702,7 +722,9 @@ impl ExtendedPoint { h } +} +impl ExtendedPoint { /// Multiply by the cofactor: compute `8 * self`. /// /// Convenience wrapper around `mult_by_pow_2`. diff --git a/src/decaf.rs b/src/decaf.rs index ade009a..42d2721 100644 --- a/src/decaf.rs +++ b/src/decaf.rs @@ -181,6 +181,7 @@ mod test { use constants::BASE_CMPRSSD; use curve::CompressedEdwardsY; use curve::ExtendedPoint; + use curve::BasepointMult; use curve::Identity; use super::*;