authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2021-11-08 14:55:27+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2021-11-08 14:55:27+01:00
logbd8b94bd0ec592b62b8ae5637375a8d79cbe3e3b
tree7e3e9de3eedaa71f1131f64f5928c33df35baf4e
parent6b5e403e5dcdd55baf318e8734b77ce4bc635fe9

crypto/edwards25519: correctly flip the Y sign in the H2C operation

No security implications, but the current hash-to-curve standard defines the sign of the Y coordinate to be negative if `gx1` is a square, positive otherwise. We were doing it the other way round.

1 files changed, 4 insertions(+), 4 deletions(-)

lib/std/crypto/25519/edwards25519.zig+4-4
......@@ -395,7 +395,7 @@ pub const Edwards25519 = struct {
395395 const fe_f = Fe.fromBytes64(h);
396396 var elr = elligator2(fe_f);
397397
398 const y_sign = elr.not_square;
398 const y_sign = !elr.not_square;
399399 const y_neg = elr.y.neg();
400400 elr.y.cMov(y_neg, @boolToInt(elr.y.isNegative()) ^ @boolToInt(y_sign));
401401 return montToEd(elr.x, elr.y).clearCofactor();
......@@ -542,11 +542,11 @@ test "edwards25519 uniform-to-point" {
542542 try htest.assertEqual("f70718e68ef42d90ca1d936bb2d7e159be6c01d8095d39bd70487c82fe5c973a", p.toBytes()[0..]);
543543}
544544
545// Test vectors from draft-irtf-cfrg-hash-to-curve-10
545// Test vectors from draft-irtf-cfrg-hash-to-curve-12
546546test "edwards25519 hash-to-curve operation" {
547547 var p = Edwards25519.fromString(true, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_", "abc");
548 try htest.assertEqual("31558a26887f23fb8218f143e69d5f0af2e7831130bd5b432ef23883b895831a", p.toBytes()[0..]);
548 try htest.assertEqual("31558a26887f23fb8218f143e69d5f0af2e7831130bd5b432ef23883b895839a", p.toBytes()[0..]);
549549
550550 p = Edwards25519.fromString(false, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_", "abc");
551 try htest.assertEqual("42fa27c8f5a1ae0aa38bb59d5938e5145622ba5dedd11d11736fa2f9502d73e7", p.toBytes()[0..]);
551 try htest.assertEqual("42fa27c8f5a1ae0aa38bb59d5938e5145622ba5dedd11d11736fa2f9502d7367", p.toBytes()[0..]);
552552}