authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-17 15:48:41+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-08-18 00:31:02-04:00
log8d6004769731deaabbed014c79b4066bd9e380e8
tree0fd6b1abdb2572ca4423f3522f05fcbef636df32
parentfa8935426b425110a89c6a2008013c500b7a3a79

ristretto255: add uniform string->element map & fast equivalence check

2 files changed, 60 insertions(+), 15 deletions(-)

lib/std/crypto/25519/field.zig+6
......@@ -21,6 +21,12 @@ pub const Fe = struct {
2121
2222 pub const edwards25519sqrtamd = Fe{ .limbs = .{ 278908739862762, 821645201101625, 8113234426968, 1777959178193151, 2118520810568447 } }; // 1/sqrt(a-d)
2323
24 pub const edwards25519eonemsqd = Fe{ .limbs = .{ 1136626929484150, 1998550399581263, 496427632559748, 118527312129759, 45110755273534 } }; // 1-d^2
25
26 pub const edwards25519sqdmone = Fe{ .limbs = .{ 1507062230895904, 1572317787530805, 683053064812840, 317374165784489, 1572899562415810 } }; // (d-1)^2
27
28 pub const edwards25519sqrtadm1 = Fe{ .limbs = .{ 2241493124984347, 425987919032274, 2207028919301688, 1220490630685848, 974799131293748 } };
29
2430 pub inline fn isZero(fe: Fe) bool {
2531 var reduced = fe;
2632 reduced.reduce();
lib/std/crypto/25519/ristretto255.zig+54-15
......@@ -12,7 +12,7 @@ pub const Ristretto255 = struct {
1212
1313 p: Curve,
1414
15 fn sqrtRatioM1(u: Fe, v: Fe) !Fe {
15 fn sqrtRatioM1(u: Fe, v: Fe) struct { ratio_is_square: u32, root: Fe } {
1616 const v3 = v.sq().mul(v); // v^3
1717 var x = v3.sq().mul(u).mul(v).pow2523().mul(v3).mul(u); // uv^3(uv^7)^((q-5)/8)
1818 const vxx = x.sq().mul(v); // vx^2
......@@ -24,11 +24,7 @@ pub const Ristretto255 = struct {
2424 const has_f_root = f_root_check.isZero();
2525 const x_sqrtm1 = x.mul(Fe.sqrtm1); // x*sqrt(-1)
2626 x.cMov(x_sqrtm1, @boolToInt(has_p_root) | @boolToInt(has_f_root));
27 const xa = x.abs();
28 if ((@boolToInt(has_m_root) | @boolToInt(has_p_root)) == 0) {
29 return error.NoRoot;
30 }
31 return xa;
27 return .{ .ratio_is_square = @boolToInt(has_m_root) | @boolToInt(has_p_root), .root = x.abs() };
3228 }
3329
3430 fn rejectNonCanonical(s: [32]u8) !void {
......@@ -57,15 +53,14 @@ pub const Ristretto255 = struct {
5753 const u2u2 = u2_.sq(); // (1+s^2)^2
5854 const v = Fe.edwards25519d.mul(u1u1).neg().sub(u2u2); // -(d*u1^2)-u2^2
5955 const v_u2u2 = v.mul(u2u2); // v*u2^2
60 const inv_sqrt = sqrtRatioM1(Fe.one, v_u2u2) catch |e| {
61 return error.InvalidEncoding;
62 };
63 var x = inv_sqrt.mul(u2_);
64 const y = inv_sqrt.mul(x).mul(v).mul(u1_);
56
57 const inv_sqrt = sqrtRatioM1(Fe.one, v_u2u2);
58 var x = inv_sqrt.root.mul(u2_);
59 const y = inv_sqrt.root.mul(x).mul(v).mul(u1_);
6560 x = x.mul(s_);
6661 x = x.add(x).abs();
6762 const t = x.mul(y);
68 if ((@boolToInt(t.isNegative()) | @boolToInt(y.isZero())) != 0) {
63 if ((1 - inv_sqrt.ratio_is_square) | @boolToInt(t.isNegative()) | @boolToInt(y.isZero()) != 0) {
6964 return error.InvalidEncoding;
7065 }
7166 const p: Curve = .{
......@@ -85,9 +80,9 @@ pub const Ristretto255 = struct {
8580 u1_ = u1_.mul(zmy); // (Z+Y)*(Z-Y)
8681 const u2_ = p.x.mul(p.y); // X*Y
8782 const u1_u2u2 = u2_.sq().mul(u1_); // u1*u2^2
88 const inv_sqrt = sqrtRatioM1(Fe.one, u1_u2u2) catch unreachable;
89 const den1 = inv_sqrt.mul(u1_);
90 const den2 = inv_sqrt.mul(u2_);
83 const inv_sqrt = sqrtRatioM1(Fe.one, u1_u2u2);
84 const den1 = inv_sqrt.root.mul(u1_);
85 const den2 = inv_sqrt.root.mul(u2_);
9186 const z_inv = den1.mul(den2).mul(p.t); // den1*den2*T
9287 const ix = p.x.mul(Fe.sqrtm1); // X*sqrt(-1)
9388 const iy = p.y.mul(Fe.sqrtm1); // Y*sqrt(-1)
......@@ -109,6 +104,35 @@ pub const Ristretto255 = struct {
109104 return p.z.sub(y).mul(den_inv).abs().toBytes();
110105 }
111106
107 fn elligator(t: Fe) Curve {
108 const r = t.sq().mul(Fe.sqrtm1); // sqrt(-1)*t^2
109 const u = r.add(Fe.one).mul(Fe.edwards25519eonemsqd); // (r+1)*(1-d^2)
110 var c = comptime Fe.one.neg(); // -1
111 const v = c.sub(r.mul(Fe.edwards25519d)).mul(r.add(Fe.edwards25519d)); // (c-r*d)*(r+d)
112 const ratio_sqrt = sqrtRatioM1(u, v);
113 const wasnt_square = 1 - ratio_sqrt.ratio_is_square;
114 var s = ratio_sqrt.root;
115 const s_prime = s.mul(t).abs().neg(); // -|s*t|
116 s.cMov(s_prime, wasnt_square);
117 c.cMov(r, wasnt_square);
118
119 const n = r.sub(Fe.one).mul(c).mul(Fe.edwards25519sqdmone).sub(v); // c*(r-1)*(d-1)^2-v
120 const w0 = s.add(s).mul(v); // 2s*v
121 const w1 = n.mul(Fe.edwards25519sqrtadm1); // n*sqrt(ad-1)
122 const ss = s.sq(); // s^2
123 const w2 = Fe.one.sub(ss); // 1-s^2
124 const w3 = Fe.one.add(ss); // 1+s^2
125
126 return .{ .x = w0.mul(w3), .y = w2.mul(w1), .z = w1.mul(w3), .t = w0.mul(w2) };
127 }
128
129 /// Map a 64-bit string into a Ristretto255 group element
130 pub fn fromUniform(h: [64]u8) Ristretto255 {
131 const p0 = elligator(Fe.fromBytes(h[0..32].*));
132 const p1 = elligator(Fe.fromBytes(h[32..64].*));
133 return Ristretto255{ .p = p0.add(p1) };
134 }
135
112136 /// Double a Ristretto255 element.
113137 pub inline fn dbl(p: Ristretto255) Ristretto255 {
114138 return .{ .p = p.p.dbl() };
......@@ -125,6 +149,15 @@ pub const Ristretto255 = struct {
125149 pub inline fn mul(p: Ristretto255, s: [32]u8) !Ristretto255 {
126150 return Ristretto255{ .p = try p.p.mul(s) };
127151 }
152
153 /// Return true if two Ristretto255 elements are equivalent
154 pub fn equivalent(p: Ristretto255, q: Ristretto255) bool {
155 const p_ = &p.p;
156 const q_ = &q.p;
157 const a = p_.x.mul(q_.y).equivalent(p_.y.mul(q_.x));
158 const b = p_.y.mul(q_.y).equivalent(p_.x.mul(q_.x));
159 return (@boolToInt(a) | @boolToInt(b)) != 0;
160 }
128161};
129162
130163test "ristretto255" {
......@@ -141,4 +174,10 @@ test "ristretto255" {
141174 const s = [_]u8{15} ++ [_]u8{0} ** 31;
142175 const w = try p.mul(s);
143176 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{w.toBytes()}), "E0C418F7C8D9C4CDD7395B93EA124F3AD99021BB681DFC3302A9D99A2E53E64E");
177
178 std.testing.expect(p.dbl().dbl().dbl().dbl().equivalent(w.add(p)));
179
180 const h = [_]u8{69} ** 32 ++ [_]u8{42} ** 32;
181 const ph = Ristretto255.fromUniform(h);
182 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{ph.toBytes()}), "DCCA54E037A4311EFBEEF413ACD21D35276518970B7A61DC88F8587B493D5E19");
144183}