saymrwulf/risc0-curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/risc0-curve25519-dalek-source.git synced 2026-09-04 20:03:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Split explanation of encoding formulas

Browse source
This commit is contained in:
Henry de Valence 2018-04-04 17:42:10 -07:00
parent 25024a63bc
commit fbee5e252c
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
docs/ristretto-notes.md
View file

@ -179,10 +179,10 @@ apply the encoding for \\( \[2\](\mathcal E) / \mathcal E[2] \\).
## The Ristretto Encoding
We can write the above encoding/decoding procedure concretely (in affine
coordinates) as follows:
We can write the above encoding/decoding procedure in affine
coordinates as follows:
### Encoding
### Encoding in Affine Coordinates
On input \\( (x,y) \in \[2\](\mathcal E)\\), a representative for a
coset in \\( \[2\](\mathcal E) / \mathcal E[4] \\):
@ -203,8 +203,12 @@ If \\(\mathcal E\\) has cofactor \\(4\\), we skip the first step,
since our input already represents a coset in
\\( \[2\](\mathcal E) / \mathcal E[2] \\).
To see that this corresponds to the encoding procedure above, notice
that the first step lifts from \\( \mathcal E / \mathcal E[4] \\) to
### Interpreting the Encoding Procedure
How does this procedure correspond to the description involving
\\( \theta \\)?
The first step lifts from \\( \mathcal E / \mathcal E[4] \\) to
\\(\mathcal E / \mathcal E[2]\\). To understand steps 2 and 3,
notice that the \\(y\\)-coordinate of \\(\theta(s,t)\\) is
$$
@ -232,7 +236,7 @@ sign (by choosing the positive square root). Finally, the check
that \\(y \neq -1\\) prevents division-by-zero when encoding the
identity; it falls out of the optimized formulas below.
### Decoding
### Decoding to Affine Coordinates
On input `s_bytes`, decoding proceeds as follows: