codex-storage
/
constantine
mirror of https://github.com/codex-storage/constantine.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
constantine/constantine/elliptic
History
Mamy Ratsimbazafy d376f08d1b
G2 / Operations on the twisted curve E'(Fp2) (#51) 
* Split elliptic curve tests to better use parallel testing

* Add support for printing points on G2

* Implement multiplication and division by optimal sextic non-residue (BLS12-381)

* Implement modular square root in 𝔽p2

* Support EC add and EC double on G2 (for BLS12-381)

* Support G2 divisive twists with non-unit sextic-non-residue like BN254 snarks

* Add EC G2 bench

* cleanup some unused warnings

* Reorg the tests for parallelization and to avoid instantiating huge files
 		2020-06-15 22:58:56 +02:00
..
README.md Initial impl of side-channel resistant scalar mul to securely handle secret keys inputs. 2020-04-17 22:17:28 +02:00
ec_endomorphism_accel.nim Endomorphism acceleration for Scalar Multiplication (#44) 2020-06-14 15:39:06 +02:00
ec_endomorphism_params.nim Endomorphism acceleration for Scalar Multiplication (#44) 2020-06-14 15:39:06 +02:00
ec_scalar_mul.nim G2 / Operations on the twisted curve E'(Fp2) (#51) 2020-06-15 22:58:56 +02:00
ec_weierstrass_affine.nim G2 / Operations on the twisted curve E'(Fp2) (#51) 2020-06-15 22:58:56 +02:00
ec_weierstrass_projective.nim G2 / Operations on the twisted curve E'(Fp2) (#51) 2020-06-15 22:58:56 +02:00

README.md

Elliptic Curves

This folder will hold the implementation of elliptic curves arithmetic

Terminology

Coordinates system

The point P of the curve y² = x³ + ax + b) have the following coordinate:

  • (x, y) in the affine coordinate system
  • (X, Y, Z) with X = xZ and Y = yZ in the homogeneous projective coordinate system. The homogeneous projective coordinates will be called projective coordinates from now on.
  • (X, Y, Z) with X = xZ² and Y = yZ³ in the jacobian projective coordinate system. The jacobian projective coordinates will be called jacobian coordinates from now on.

Operations on a Twist

Pairings require operation on a twisted curve. Formulas are available in Costello2009 and Ionica2017 including an overview of which coordinate system (affine, homogeneous projective or jacobian) is the most efficient for the Miller loop.

In particular for sextic twist (applicable to BN and BLS12 families), the projective coordinates are more efficient while for quadratic and quartic twists, jacobian coordinates ar emore efficient.

When the addition law requires the a or b parameter from the curve Scott2009 and Nogami2010 give the parameter relevant to the twisted curve for the M-Twist (multiplication by non-residue) or D-Twist (Division by non-residue) cases.

Side-Channel resistance

Scalar multiplication

Scalar multiplication of a point P by a scalar k and denoted R = [k]P (or R = kP) is a critical operation to make side-channel resistant.

Elliptic Curve-based signature scheme indeed rely on the fact that computing the inverse of elliptic scalar multiplication is intractable to produce a public key [k]P from the secret (integer) key k. The problem is called ECDLP, Elliptic Curve Discrete Logarithm Problem in the litterature.

Scalar multiplication for elliptic curve presents the same constant-time challenge as square-and-multiply, a naive implementation will leak every bit of the secret key:

  N ← P
  R ← 0
  for i from 0 to log2(k) do
     if k.bit(i) == 1 then
         Q ← point_add(Q, N)
     N ← point_double(N)
  return Q

Point Addition and Doubling

Exceptions in elliptic curve group laws.

For an elliptic curve in short Weierstrass form: y² = x³ + ax + b)

The equation for elliptic curve addition is in affine (x, y) coordinates:

P + Q = R
(Px, Py) + (Qx, Qy) = (Rx, Ry)

with
Rx = λ² - Px - Qx
Ry = λ(Px - Rx) - Py

but in the case of addition

λ = (Qy - Py) / (Px - Qx)

which is undefined for P == Q or P == -Q (as -(x, y) = (x, -y))

the doubling formula uses the slope of the tangent at the limit

λ = (3 Px² + a) / (2 Px)

So we have to take into account 2 special-cases.

Furthermore when using (homogeneous) projective or jacobian coordinates, most formulæ needs to special-case the point at infinity.

Dealing with exceptions

An addition formula that works for both addition and doubling (adding the same point) is called unified. An addition formula that works for all inputs including adding infinity point or the same point is called complete or exception-free.

Abarúa2019 highlight several attacks, their defenses, counterattacks and counterdefenses on elliptic curve implementations.

We use the complete addition law from Renes2015 for projective coordinates, note that the prime order requirement can be relaxed to odd order according to the author.

We use the complete addition law from Bos2014 for Jacobian coordinates, note that there is a prime order requirement.

References