codex-storage
/
constantine
mirror of https://github.com/codex-storage/constantine.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
constantine/constantine/elliptic
History
Mamy Ratsimbazafy 85d365359d
Endomorphism G2 (#79) 
* Clear cofactor in BN254 G2 testgen and frobenius

* Implement G2 endomorphism acceleration in Sage

* Somewhat working accelerated scalar mul G2 (2.2x) faster
- OK for BN254_Snarks
- Some test failing for BLS12-381

* Fix negative miniscalars by adding an extra bit of encoding

* Cleanup accel params

* Small recoding optimizations
 		2020-09-03 23:10:48 +02:00
..
README.md typo 2020-07-09 14:05:11 +02:00
ec_endomorphism_accel.nim Endomorphism G2 (#79) 2020-09-03 23:10:48 +02:00
ec_endomorphism_params.nim Endomorphism G2 (#79) 2020-09-03 23:10:48 +02:00
ec_scalar_mul.nim Endomorphism G2 (#79) 2020-09-03 23:10:48 +02:00
ec_weierstrass_affine.nim G2 / Operations on the twisted curve E'(Fp2) (#51) 2020-06-15 22:58:56 +02:00
ec_weierstrass_projective.nim Lattice decomposition fixes (#71) 2020-08-22 19:45:44 +02:00

README.md

Elliptic Curves

This folder will hold the implementation of elliptic curves arithmetic

Terminology

Coordinates system

The point P of the curve y² = x³ + ax + b) have the following coordinate:

  • (x, y) in the affine coordinate system
  • (X, Y, Z) with X = xZ and Y = yZ in the homogeneous projective coordinate system. The homogeneous projective coordinates will be called projective coordinates from now on.
  • (X, Y, Z) with X = xZ² and Y = yZ³ in the jacobian projective coordinate system. The jacobian projective coordinates will be called jacobian coordinates from now on.

Operations on a Twist

Pairings require operation on a twisted curve. Formulas are available in Costello2009 and Ionica2017 including an overview of which coordinate system (affine, homogeneous projective or jacobian) is the most efficient for the Miller loop.

In particular for sextic twist (applicable to BN and BLS12 families), the projective coordinates are more efficient while for quadratic and quartic twists, jacobian coordinates ar emore efficient.

When the addition law requires the a or b parameter from the curve Scott2009 and Nogami2010 give the parameter relevant to the twisted curve for the M-Twist (multiplication by non-residue) or D-Twist (Division by non-residue) cases.

Side-Channel resistance

Scalar multiplication

Scalar multiplication of a point P by a scalar k and denoted R = [k]P (or R = kP) is a critical operation to make side-channel resistant.

Elliptic Curve-based signature scheme indeed rely on the fact that computing the inverse of elliptic scalar multiplication is intractable to produce a public key [k]P from the secret (integer) key k. The problem is called ECDLP, Elliptic Curve Discrete Logarithm Problem in the litterature.

Scalar multiplication for elliptic curve presents the same constant-time challenge as square-and-multiply, a naive implementation will leak every bit of the secret key:

  N ← P
  R ← 0
  for i from 0 to log2(k) do
     if k.bit(i) == 1 then
         Q ← point_add(Q, N)
     N ← point_double(N)
  return Q

Point Addition and Doubling

Exceptions in elliptic curve group laws.

For an elliptic curve in short Weierstrass form: y² = x³ + ax + b

The equation for elliptic curve addition is in affine (x, y) coordinates:

P + Q = R
(Px, Py) + (Qx, Qy) = (Rx, Ry)

with
Rx = λ² - Px - Qx
Ry = λ(Px - Rx) - Py

but in the case of addition

λ = (Qy - Py) / (Px - Qx)

which is undefined for P == Q or P == -Q (as -(x, y) = (x, -y))

the doubling formula uses the slope of the tangent at the limit

λ = (3 Px² + a) / (2 Px)

So we have to take into account 2 special-cases.

Furthermore when using (homogeneous) projective or jacobian coordinates, most formulæ needs to special-case the point at infinity.

Dealing with exceptions

An addition formula that works for both addition and doubling (adding the same point) is called unified. An addition formula that works for all inputs including adding infinity point or the same point is called complete or exception-free.

Abarúa2019 highlight several attacks, their defenses, counterattacks and counterdefenses on elliptic curve implementations.

We use the complete addition law from Renes2015 for projective coordinates, note that the prime order requirement can be relaxed to odd order according to the author.

We use the complete addition law from Bos2014 for Jacobian coordinates, note that there is a prime order requirement.

References