143 lines
4.0 KiB
Go
143 lines
4.0 KiB
Go
package bls12381
|
|
|
|
// swuMapG1 is implementation of Simplified Shallue-van de Woestijne-Ulas Method
|
|
// follows the implmentation at draft-irtf-cfrg-hash-to-curve-06.
|
|
func swuMapG1(u *fe) (*fe, *fe) {
|
|
var params = swuParamsForG1
|
|
var tv [4]*fe
|
|
for i := 0; i < 4; i++ {
|
|
tv[i] = new(fe)
|
|
}
|
|
square(tv[0], u)
|
|
mul(tv[0], tv[0], params.z)
|
|
square(tv[1], tv[0])
|
|
x1 := new(fe)
|
|
add(x1, tv[0], tv[1])
|
|
inverse(x1, x1)
|
|
e1 := x1.isZero()
|
|
one := new(fe).one()
|
|
add(x1, x1, one)
|
|
if e1 {
|
|
x1.set(params.zInv)
|
|
}
|
|
mul(x1, x1, params.minusBOverA)
|
|
gx1 := new(fe)
|
|
square(gx1, x1)
|
|
add(gx1, gx1, params.a)
|
|
mul(gx1, gx1, x1)
|
|
add(gx1, gx1, params.b)
|
|
x2 := new(fe)
|
|
mul(x2, tv[0], x1)
|
|
mul(tv[1], tv[0], tv[1])
|
|
gx2 := new(fe)
|
|
mul(gx2, gx1, tv[1])
|
|
e2 := !isQuadraticNonResidue(gx1)
|
|
x, y2 := new(fe), new(fe)
|
|
if e2 {
|
|
x.set(x1)
|
|
y2.set(gx1)
|
|
} else {
|
|
x.set(x2)
|
|
y2.set(gx2)
|
|
}
|
|
y := new(fe)
|
|
sqrt(y, y2)
|
|
if y.sign() != u.sign() {
|
|
neg(y, y)
|
|
}
|
|
return x, y
|
|
}
|
|
|
|
// swuMapG2 is implementation of Simplified Shallue-van de Woestijne-Ulas Method
|
|
// defined at draft-irtf-cfrg-hash-to-curve-06.
|
|
func swuMapG2(e *fp2, u *fe2) (*fe2, *fe2) {
|
|
if e == nil {
|
|
e = newFp2()
|
|
}
|
|
params := swuParamsForG2
|
|
var tv [4]*fe2
|
|
for i := 0; i < 4; i++ {
|
|
tv[i] = e.new()
|
|
}
|
|
e.square(tv[0], u)
|
|
e.mul(tv[0], tv[0], params.z)
|
|
e.square(tv[1], tv[0])
|
|
x1 := e.new()
|
|
e.add(x1, tv[0], tv[1])
|
|
e.inverse(x1, x1)
|
|
e1 := x1.isZero()
|
|
e.add(x1, x1, e.one())
|
|
if e1 {
|
|
x1.set(params.zInv)
|
|
}
|
|
e.mul(x1, x1, params.minusBOverA)
|
|
gx1 := e.new()
|
|
e.square(gx1, x1)
|
|
e.add(gx1, gx1, params.a)
|
|
e.mul(gx1, gx1, x1)
|
|
e.add(gx1, gx1, params.b)
|
|
x2 := e.new()
|
|
e.mul(x2, tv[0], x1)
|
|
e.mul(tv[1], tv[0], tv[1])
|
|
gx2 := e.new()
|
|
e.mul(gx2, gx1, tv[1])
|
|
e2 := !e.isQuadraticNonResidue(gx1)
|
|
x, y2 := e.new(), e.new()
|
|
if e2 {
|
|
x.set(x1)
|
|
y2.set(gx1)
|
|
} else {
|
|
x.set(x2)
|
|
y2.set(gx2)
|
|
}
|
|
y := e.new()
|
|
e.sqrt(y, y2)
|
|
if y.sign() != u.sign() {
|
|
e.neg(y, y)
|
|
}
|
|
return x, y
|
|
}
|
|
|
|
var swuParamsForG1 = struct {
|
|
z *fe
|
|
zInv *fe
|
|
a *fe
|
|
b *fe
|
|
minusBOverA *fe
|
|
}{
|
|
a: &fe{0x2f65aa0e9af5aa51, 0x86464c2d1e8416c3, 0xb85ce591b7bd31e2, 0x27e11c91b5f24e7c, 0x28376eda6bfc1835, 0x155455c3e5071d85},
|
|
b: &fe{0xfb996971fe22a1e0, 0x9aa93eb35b742d6f, 0x8c476013de99c5c4, 0x873e27c3a221e571, 0xca72b5e45a52d888, 0x06824061418a386b},
|
|
z: &fe{0x886c00000023ffdc, 0x0f70008d3090001d, 0x77672417ed5828c3, 0x9dac23e943dc1740, 0x50553f1b9c131521, 0x078c712fbe0ab6e8},
|
|
zInv: &fe{0x0e8a2e8ba2e83e10, 0x5b28ba2ca4d745d1, 0x678cd5473847377a, 0x4c506dd8a8076116, 0x9bcb227d79284139, 0x0e8d3154b0ba099a},
|
|
minusBOverA: &fe{0x052583c93555a7fe, 0x3b40d72430f93c82, 0x1b75faa0105ec983, 0x2527e7dc63851767, 0x99fffd1f34fc181d, 0x097cab54770ca0d3},
|
|
}
|
|
|
|
var swuParamsForG2 = struct {
|
|
z *fe2
|
|
zInv *fe2
|
|
a *fe2
|
|
b *fe2
|
|
minusBOverA *fe2
|
|
}{
|
|
a: &fe2{
|
|
fe{0, 0, 0, 0, 0, 0},
|
|
fe{0xe53a000003135242, 0x01080c0fdef80285, 0xe7889edbe340f6bd, 0x0b51375126310601, 0x02d6985717c744ab, 0x1220b4e979ea5467},
|
|
},
|
|
b: &fe2{
|
|
fe{0x22ea00000cf89db2, 0x6ec832df71380aa4, 0x6e1b94403db5a66e, 0x75bf3c53a79473ba, 0x3dd3a569412c0a34, 0x125cdb5e74dc4fd1},
|
|
fe{0x22ea00000cf89db2, 0x6ec832df71380aa4, 0x6e1b94403db5a66e, 0x75bf3c53a79473ba, 0x3dd3a569412c0a34, 0x125cdb5e74dc4fd1},
|
|
},
|
|
z: &fe2{
|
|
fe{0x87ebfffffff9555c, 0x656fffe5da8ffffa, 0x0fd0749345d33ad2, 0xd951e663066576f4, 0xde291a3d41e980d3, 0x0815664c7dfe040d},
|
|
fe{0x43f5fffffffcaaae, 0x32b7fff2ed47fffd, 0x07e83a49a2e99d69, 0xeca8f3318332bb7a, 0xef148d1ea0f4c069, 0x040ab3263eff0206},
|
|
},
|
|
zInv: &fe2{
|
|
fe{0xacd0000000011110, 0x9dd9999dc88ccccd, 0xb5ca2ac9b76352bf, 0xf1b574bcf4bc90ce, 0x42dab41f28a77081, 0x132fc6ac14cd1e12},
|
|
fe{0xe396ffffffff2223, 0x4fbf332fcd0d9998, 0x0c4bbd3c1aff4cc4, 0x6b9c91267926ca58, 0x29ae4da6aef7f496, 0x10692e942f195791},
|
|
},
|
|
minusBOverA: &fe2{
|
|
fe{0x903c555555474fb3, 0x5f98cc95ce451105, 0x9f8e582eefe0fade, 0xc68946b6aebbd062, 0x467a4ad10ee6de53, 0x0e7146f483e23a05},
|
|
fe{0x29c2aaaaaab85af8, 0xbf133368e30eeefa, 0xc7a27a7206cffb45, 0x9dee04ce44c9425c, 0x04a15ce53464ce83, 0x0b8fcaf5b59dac95},
|
|
},
|
|
}
|