95 Commits

Author SHA1 Message Date
Mamy André-Ratsimbazafy
d61680e1ad Fix substraction being addition following tower refactor 2020-04-15 00:04:44 +02:00
Mamy André-Ratsimbazafy
5784e78606 Towered extension comparison bug: squaring in 𝔽p6 is not properly implemented 2020-04-15 00:04:44 +02:00
Mamy André-Ratsimbazafy
c8935f0a1d More tests to ensure that inversion of zero is zero 2020-04-15 00:04:44 +02:00
Mamy Ratsimbazafy
c04721a04e
Refactor: Higher-Kinded Tower of Extension Fields (#25)
* Mention that the inverse of 0 is 0 (TODO tests)

* Introduce "Higher-Kinded tower extensions"

* rename isCOmplexExtension -> fromComplexExtension

* update benchmarks with the new tower scheme

* Try to recover some speed on mul/squaring for an optimal tower (but this was not it)
2020-04-14 02:05:42 +02:00
Mamy Ratsimbazafy
2f839cb1bf
Initial support for Elliptic Curve (#24)
* Elliptic curve and Twisted curve templates - initial commit

* Support EC Add on G2 (Sextic Twisted curve for BN and BLS12 families)

* Refactor the config parser to prepare for elliptic coefficient support

* Add elliptic curve parameter for BN254 (Snarks), BLS12-381 and Zexe curve BLS12-377

* Add accessors to curve parameters

* Allow computing the right-hand-side of of Weierstrass equation "y² = x³ + a x + b"

* Randomized test infrastructure for elliptic curves

* Start a testing suite on ellptic curve addition (failing)

* detail projective addition

* Fix EC addition test (forgot initializing Z=1 and that there ar emultiple infinity points)

* Test with random Z coordinate + add elliptic curve test to test suite

* fix reference to the (deactivated) addchain inversion for BN curves [skip ci]

* .nims file leftover [skip ci]
2020-04-13 19:25:59 +02:00
Mamy Ratsimbazafy
1889fc4eeb
Improve bn curve family support (#23)
* Allow tagging BarretoNaehrig family

* Refactor the constant generation and fix XDeclaredButNotUsed

* BN field inversion via addition chain (but slower than generic :/ so deactivated)
2020-04-12 16:09:38 +02:00
Mamy André-Ratsimbazafy
33314fe725
Properly distinguish between Nogami and Snark/Ethereum BN254 closes #19 2020-04-12 03:01:50 +02:00
Mamy Ratsimbazafy
42109d4f1c
Square roots (#22)
* Add modular square root for p ≡ 3 (mod 4)

* Exhaustive tests for sqrt with p ≡ 3 (mod 4)

* fix typo
2020-04-11 23:53:21 +02:00
Mamy André-Ratsimbazafy
a6e4517be2
Implement 𝔽p12 inversion, enable 𝔽p12 tests and bench 2020-04-09 14:28:01 +02:00
Mamy André-Ratsimbazafy
3a1a5f8847
More coverage and crosscheck between multiplication, squaring, addition, substraction, negation 2020-04-09 13:58:56 +02:00
Mamy André-Ratsimbazafy
3a2b35ba26
Fix multiplication in 𝔽p12 2020-04-09 13:37:45 +02:00
Mamy André-Ratsimbazafy
d081fca612
Fix squaring in 𝔽p6 (𝔽p2 squaring require separate target and source buffer) 2020-04-09 13:20:05 +02:00
Mamy André-Ratsimbazafy
f24d87fb00
Fix squaring in 𝔽p12, mul in 𝔽p6 MUST NOT share buffer (i.e. broken value semantics) 2020-04-09 02:00:45 +02:00
Mamy André-Ratsimbazafy
8c478df0c1
𝔽p12 extension - initial commit of squaring 2020-04-09 01:23:10 +02:00
Mamy André-Ratsimbazafy
2d5b173a39
Less magics, les macros, faster compile-times (or not, Fp6 starts to get really slow, like 5s) + some cleanups in curve families + test 𝔽p6 on 32-bit 2020-03-22 12:28:53 +01:00
Mamy André-Ratsimbazafy
c40bc1977d
Inverse in cubic extension field 𝔽p6 = 𝔽p2[∛(1 + 𝑖)] 2020-03-21 23:47:43 +01:00
Mamy André-Ratsimbazafy
ff4a54daba
Add multiplication in 𝔽p6 = 𝔽p2[∛(1+𝑖)] 2020-03-21 19:03:57 +01:00
Mamy André-Ratsimbazafy
1282c38845
Add sage script for BN and BLS12 curve families 2020-03-21 15:50:39 +01:00
Mamy André-Ratsimbazafy
1855d14497
Add more curves for testing: Curve25519, BLS12-377, BN446, FKM-447, BLS12-461, BN462 2020-03-21 13:05:58 +01:00
Mamy André-Ratsimbazafy
03898b2292
Implement squaring for 𝔽p6 = 𝔽p2[∛(1+𝑖)] 2020-03-21 01:59:23 +01:00
Mamy André-Ratsimbazafy
bde619155b
30% faster constant-time inversion 2020-03-20 23:03:52 +01:00
Mamy Ratsimbazafy
6423be0dfb
Add optimized squaring (~15% speedup) (#18)
* Add optimized squaring (~15% speedup)

* avoid repetitions in tests
2020-03-17 22:04:37 +01:00
Mamy Ratsimbazafy
4ff0e3d90b
Internals refactor + renewed focus on perf (#17)
* Lay out the refactoring objectives and tradeoffs

* Refactor the 32 and 64-bit primitives [skip ci]

* BigInts and Modular BigInts compile

* Make the bigints test compile

* Fix modular reduction

* Fix reduction tests vs GMP

* Implement montegomery mul, pow, inverse, WIP finite field compilation

* Make FiniteField compile

* Fix exponentiation compilation

* Fix Montgomery magic constant computation  for 2^64 words

* Fix typo in non-optimized CIOS - passing finite fields IO tests

* Add limbs comparisons [skip ci]

* Fix on precomputation of the Montgomery magic constant

* Passing all tests including 𝔽p2

* modular addition, the test for mersenne prime was wrong

* update benches

* Fix "nimble test" + typo on out-of-place field addition

* bigint division, normalization is needed: https://travis-ci.com/github/mratsim/constantine/jobs/298359743

* missing conversion in subborrow non-x86 fallback - https://travis-ci.com/github/mratsim/constantine/jobs/298359744

* Fix little-endian serialization

* Constantine32 flag to run 32-bit constantine on 64-bit machines

* IO Field test, ensure that BaseType is used instead of uint64 when the prime can field in uint32

* Implement proper addcarry and subborrow fallback for the compile-time VM

* Fix export issue when the logical wordbitwidth == physical wordbitwidth - passes all tests (32-bit and 64-bit)

* Fix uint128 on ARM

* Fix C++ conditional copy and ARM addcarry/subborrow

* Add investigation for SIGFPE in Travis

* Fix debug display for unsafeDiv2n1n

* multiplexer typo

* moveMem bug in glibc of Ubuntu 16.04?

* Was probably missing an early clobbered register annotation on conditional mov

* Note on Montgomery-friendly moduli

* Strongly suspect a GCC before GCC 7 codegen bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87139)

* hex conversion was (for debugging) not taking requested order into account + inlining comment

* Use 32-bit limbs on ARM64, uint128 builtin __udivti4 bug?

* Revert "Use 32-bit limbs on ARM64, uint128 builtin __udivti4 bug?"

This reverts commit 087f9aa7fb40bbd058d05cbd8eec7fc082911f49.

* Fix subborrow fallback for non-x86 (need to maks the borrow)
2020-03-16 16:33:51 +01:00
Mamy André-Ratsimbazafy
feacf2b2ea
Fix 64-bit limbs, passing all tests 2020-02-29 14:49:38 +01:00
Mamy André-Ratsimbazafy
155aa21767
Add inverse on 𝔽p2 = 𝔽p[𝑖] 2020-02-27 01:20:51 +01:00
Mamy André-Ratsimbazafy
1f0ef23da7
Add Fp2_complex tests 2020-02-26 19:28:43 +01:00
Mamy André-Ratsimbazafy
df886aa3ca
Significantly reduce compile-time and size of field tests vs GMP (4.4MB of C previously vs 160kB after commit). 2020-02-26 18:54:44 +01:00
Mamy André-Ratsimbazafy
6de97b5d1e
Random init was producing invalid montgomery form for field elements 2020-02-26 10:28:54 +01:00
Mamy André-Ratsimbazafy
945d36c2f2
More Fp2 sanity checks 2020-02-26 01:46:11 +01:00
Mamy André-Ratsimbazafy
ff98558c4b
Fix carry bug in sum/diff 2020-02-26 01:31:05 +01:00
Mamy André-Ratsimbazafy
c621355d8d
Add new tests to track issue in the new sum/diff 2020-02-26 01:23:18 +01:00
Mamy André-Ratsimbazafy
5fab0b6c49
Add secp256k1 and add sanity checks on Fp2 2020-02-26 00:55:30 +01:00
Mamy André-Ratsimbazafy
e2096297cf
Expose the equality proc beyond the debugConstantine flag 2020-02-26 00:08:57 +01:00
Mamy André-Ratsimbazafy
9f7c8515a4
Prepare RNG with 2^512 bit of state for random testing on Fp2 2020-02-25 23:52:56 +01:00
Mamy André-Ratsimbazafy
c956c82165
cleanup test imports 2020-02-25 20:55:23 +01:00
Mamy André-Ratsimbazafy
320ecbff1a
Change square signature and reorg finite fields to avoid/highlight proc that allocate a temporary 2020-02-25 15:18:39 +01:00
Mamy André-Ratsimbazafy
2aa33ea226
Fused initialization and arithmetic finite field primitive to have Fp2 less verbose and more efficient 2020-02-25 11:00:27 +01:00
Mamy André-Ratsimbazafy
bb8dc579ea
conditional arithmetic prefixed with c: cadd, csub. Also use ccopy instead of cmov to avoid potential confusion like in https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/issues/210 2020-02-25 01:26:21 +01:00
Mamy André-Ratsimbazafy
6b05c69652
Rename Fq -> Fp 2020-02-24 17:10:09 +01:00
Mamy Ratsimbazafy
3bd70991d4
reorg the codebase + add/update READMEs in folders with research (#12)
* reorg the codebase + add/update READMEs in folders with research

* fix readme

* update pairing implementation papers

* Seperate hash-to-curve in its own folder, distinguish between norms, research and presentations

* Better markdown line breaks

* Add in-depth analysis of towers of extension fields for BN curve

* Fix Colm Ó hÉigeartaigh name and add Hash-to-Curve reference
2020-02-24 10:50:19 +01:00
Mamy André-Ratsimbazafy
68727e5c8d
Add modular inversion + test vs GMP 2020-02-22 19:50:24 +01:00
Mamy André-Ratsimbazafy
acfc99c4f0
Add an unsafe modular exponentiation that may leak exponent bits to timing attacks/oscilloscopes/memory cache attacks 2020-02-22 18:18:17 +01:00
Mamy André-Ratsimbazafy
e0f4e49cb5
Test modular exponentiation with BN254 and BLS12-381 moduli 2020-02-22 16:56:04 +01:00
Mamy André-Ratsimbazafy
24f2e1088e
Fix modular exp tests 2020-02-22 16:39:57 +01:00
Mamy André-Ratsimbazafy
4b65d0d723
Skeleton of modular exponentiation 2020-02-22 16:37:31 +01:00
Mamy André-Ratsimbazafy
ef5dd8345b
Allow compile-time bigint serialization + terminology: serialize -> export 2020-02-18 12:36:42 +01:00
Mamy André-Ratsimbazafy
9395febada
add octet string encode/decode (bigEndian raw int) 2020-02-18 11:54:36 +01:00
Mamy André-Ratsimbazafy
d7d20c50b6
Add primitive for window-based modular exponentiation 2020-02-17 00:13:42 +01:00
Mamy André-Ratsimbazafy
6694023f16
Revert "Use cmov name instead of mux to be in line with IETF spec on Hash to curve and Verifiable Random Functions"
This reverts commit 56177c0cfe6b0c39321a197699c730ff61c56829.
cmov will be the high-level name (similar to Milagro and Hash_to_curve draft) and mux will be the low-level one
2020-02-16 22:13:54 +01:00
Mamy André-Ratsimbazafy
56177c0cfe
Use cmov name instead of mux to be in line with IETF spec on Hash to curve and Verifiable Random Functions 2020-02-16 21:34:21 +01:00