Skip to content

Commit 8bf3a1d

Browse files
daxpeddadaxpedda
committed
Add hash2curve to ProjectiveMontgomeryXpoint 
1 parent 34f8497 commit 8bf3a1d

File tree

2 files changed

+143
-2
lines changed

2 files changed

+143
-2
lines changed

‎ed448-goldilocks/src/field/element.rs‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,25 @@ impl FieldElement {
433433
(x, y)
434434
}
435435

436+
// See https://www.rfc-editor.org/rfc/rfc9380.html#name-curve448-q-3-mod-4-k-1.
437+
// Without y-coordinate.
438+
pub(crate) fn map_to_curve_elligator2_x(&self) -> FieldElement {
439+
let mut t1 = self.square(); // 1. t1 = u^2
440+
t1 *= Self::Z; // 2. t1 = Z * t1 // Z * u^2
441+
let e1 = t1.ct_eq(&Self::MINUS_ONE); // 3. e1 = t1 == -1 // exceptional case: Z * u^2 == -1
442+
t1.conditional_assign(&Self::ZERO, e1); // 4. t1 = CMOV(t1, 0, e1) // if t1 == -1, set t1 = 0
443+
let mut x1 = t1 + Self::ONE; // 5. x1 = t1 + 1
444+
x1 = x1.invert(); // 6. x1 = inv0(x1)
445+
x1 *= -Self::J; // 7. x1 = -A * x1 // x1 = -A / (1 + Z * u^2)
446+
let mut gx1 = x1 + Self::J; // 8. gx1 = x1 + A
447+
gx1 *= x1; // 9. gx1 = gx1 * x1
448+
gx1 += Self::ONE; // 10. gx1 = gx1 + B
449+
gx1 *= x1; // 11. gx1 = gx1 * x1 // gx1 = x1^3 + A * x1^2 + B * x1
450+
let x2 = -x1 - Self::J; // 12. x2 = -x1 - A
451+
let e2 = gx1.is_square(); // 14. e2 = is_square(gx1)
452+
Self::conditional_select(&x2, &x1, e2) // 15. x = CMOV(x2, x1, e2) // If is_square(gx1), x = x1, else x = x2
453+
}
454+
436455
// See https://www.shiftleft.org/papers/decaf/decaf.pdf#section.A.3.
437456
// Implementation copied from <https://sourceforge.net/p/ed448goldilocks/code/ci/e5cc6240690d3ffdfcbdb1e4e851954b789cd5d9/tree/src/per_curve/elligator.tmpl.c#l28>.
438457
pub(crate) fn map_to_curve_decaf448(&self) -> TwistedExtendedPoint {

‎ed448-goldilocks/src/montgomery/x.rs‎

Lines changed: 124 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
11
// use crate::constants::A_PLUS_TWO_OVER_FOUR;
2-
use super::{MontgomeryPoint, MontgomeryScalar, ProjectiveMontgomeryPoint};
2+
use super::{
3+
DEFAULT_ENCODE_TO_CURVE_SUITE, DEFAULT_HASH_TO_CURVE_SUITE, MontgomeryPoint, MontgomeryScalar,
4+
ProjectiveMontgomeryPoint,
5+
};
36
use crate::AffinePoint;
4-
use crate::field::{ConstMontyType, FieldElement};
7+
use crate::field::{ConstMontyType, FieldElement, FieldElementU84};
58
use core::fmt;
69
use core::ops::Mul;
10+
use elliptic_curve::array::Array;
711
use elliptic_curve::bigint::U448;
12+
use elliptic_curve::consts::{U28, U84};
13+
use hash2curve::{ExpandMsg, ExpandMsgXof, Expander, FromOkm};
14+
use sha3::Shake256;
815
use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq};
916

1017
// Low order points on Curve448 and it's twist
@@ -273,6 +280,69 @@ impl ProjectiveMontgomeryXpoint {
273280
Self { U, W }
274281
}
275282

283+
/// Hash a message to a point on the curve
284+
///
285+
/// Hash using the default domain separation tag and hash function.
286+
/// For more control see [`Self::hash()`].
287+
pub fn hash_with_defaults(msg: &[u8]) -> Self {
288+
Self::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_HASH_TO_CURVE_SUITE])
289+
}
290+
291+
/// Hash a message to a point on the curve
292+
///
293+
/// Implements hash to curve according
294+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
295+
pub fn hash<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
296+
where
297+
X: ExpandMsg<U28>,
298+
{
299+
let mut expander =
300+
X::expand_message(msg, dst, (84 * 2).try_into().expect("should never fail"))
301+
.expect("should never fail with the given `ExpandMsg` and `dst`");
302+
let mut data = Array::<u8, U84>::default();
303+
expander.fill_bytes(&mut data);
304+
let u0 = FieldElementU84::from_okm(&data).0;
305+
expander.fill_bytes(&mut data);
306+
let u1 = FieldElementU84::from_okm(&data).0;
307+
308+
let (qx, qy) = u0.map_to_curve_elligator2();
309+
let q0 = ProjectiveMontgomeryPoint::new(qx, qy, FieldElement::ONE);
310+
let (qx, qy) = u1.map_to_curve_elligator2();
311+
let q1 = ProjectiveMontgomeryPoint::new(qx, qy, FieldElement::ONE);
312+
313+
(q0 + q1).to_projective_x().double().double()
314+
}
315+
316+
/// Encode a message to a point on the curve
317+
///
318+
/// Encode using the default domain separation tag and hash function.
319+
/// For more control see [`Self::encode()`].
320+
pub fn encode_with_defaults(msg: &[u8]) -> Self {
321+
Self::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_ENCODE_TO_CURVE_SUITE])
322+
}
323+
324+
/// Encode a message to a point on the curve
325+
///
326+
/// Implements encode to curve according
327+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
328+
pub fn encode<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
329+
where
330+
X: ExpandMsg<U28>,
331+
{
332+
let mut expander = X::expand_message(msg, dst, 84.try_into().expect("should never fail"))
333+
.expect("should never fail with the given `ExpandMsg` and `dst`");
334+
let mut data = Array::<u8, U84>::default();
335+
expander.fill_bytes(&mut data);
336+
let u = FieldElementU84::from_okm(&data).0;
337+
338+
Self {
339+
U: u.map_to_curve_elligator2_x(),
340+
W: FieldElement::ONE,
341+
}
342+
.double()
343+
.double()
344+
}
345+
276346
/// Convert the point to affine form
277347
pub fn to_affine(&self) -> MontgomeryXpoint {
278348
let x = self.U * self.W.invert();
@@ -303,6 +373,8 @@ mod tests {
303373
use super::*;
304374
use crate::EdwardsPoint;
305375
use elliptic_curve::CurveGroup;
376+
use hex_literal::hex;
377+
use sha3::Shake256;
306378

307379
#[test]
308380
fn test_montgomery_edwards() {
@@ -334,4 +406,54 @@ mod tests {
334406

335407
assert_eq!(x_identity.to_extended(Choice::from(1)), identity);
336408
}
409+
410+
#[test]
411+
fn hash_with_test_vectors() {
412+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_RO_";
413+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
414+
(b"", hex!("5ea5ff623d27c75e73717514134e73e419f831a875ca9e82915fdfc7069d0a9f8b532cfb32b1d8dd04ddeedbe3fa1d0d681c01e825d6a9ea"), hex!("afadd8de789f8f8e3516efbbe313a7eba364c939ecba00dabf4ced5c563b18e70a284c17d8f46b564c4e6ce11784a3825d941116622128c1")),
415+
(b"abc", hex!("9b2f7ce34878d7cebf34c582db14958308ea09366d1ec71f646411d3de0ae564d082b06f40cd30dfc08d9fb7cb21df390cf207806ad9d0e4"), hex!("138a0eef0a4993ea696152ed7db61f7ddb4e8100573591e7466d61c0c568ecaec939e36a84d276f34c402526d8989a96e99760c4869ed633")),
416+
(b"abcdef0123456789", hex!("f54ecd14b85a50eeeee0618452df3a75be7bfba11da5118774ae4ea55ac204e153f77285d780c4acee6c96abe3577a0c0b00be6e790cf194"), hex!("935247a64bf78c107069943c7e3ecc52acb27ce4a3230407c8357341685ea2152e8c3da93f8cd77da1bddb5bb759c6e7ae7d516dced42850")),
417+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("5bd67c4f88adf6beb10f7e0d0054659776a55c97b809ec8b3101729e104fd0f684e103792f267fd87cc4afc25a073956ef4f268fb02824d5"), hex!("da1f5cb16a352719e4cb064cf47ba72aeba7752d03e8ca2c56229f419b4ef378785a5af1a53dd7ab4d467c1f92f7b139b3752faf29c96432")),
418+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("ea441c10b3636ecedd5c0dfcae96384cc40de8390a0ab648765b4508da12c586d55dc981275776507ebca0e4d1bcaa302bb69dcfa31b3451"), hex!("fee0192d49bcc0c28d954763c2cbe739b9265c4bebe3883803c64971220cfda60b9ac99ad986cd908c0534b260b5cfca46f6c2b0f3f21bda")),
419+
];
420+
421+
for (msg, x, y) in MSGS {
422+
let p = ProjectiveMontgomeryXpoint::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
423+
.to_affine();
424+
let mut xx = [0u8; 56];
425+
xx.copy_from_slice(&x[..]);
426+
xx.reverse();
427+
let mut yy = [0u8; 56];
428+
yy.copy_from_slice(&y[..]);
429+
yy.reverse();
430+
assert_eq!(p.0, xx);
431+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
432+
}
433+
}
434+
435+
#[test]
436+
fn encode_with_test_vectors() {
437+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_NU_";
438+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
439+
(b"", hex!("b65e8dbb279fd656f926f68d463b13ca7a982b32f5da9c7cc58afcf6199e4729863fb75ca9ae3c95c6887d95a5102637a1c5c40ff0aafadc"), hex!("ea1ea211cf29eca11c057fe8248181591a19f6ac51d45843a65d4bb8b71bc83a64c771ed7686218a278ef1c5d620f3d26b53162188645453")),
440+
(b"abc", hex!("51aceca4fa95854bbaba58d8a5e17a86c07acadef32e1188cafda26232131800002cc2f27c7aec454e5e0c615bddffb7df6a5f7f0f14793f"), hex!("c590c9246eb28b08dee816d608ef233ea5d76e305dc458774a1e1bd880387e6734219e2018e4aa50a49486dce0ba8740065da37e6cf5212c")),
441+
(b"abcdef0123456789", hex!("c6d65987f146b8d0cb5d2c44e1872ac3af1f458f6a8bd8c232ffe8b9d09496229a5a27f350eb7d97305bcc4e0f38328718352e8e3129ed71"), hex!("4d2f901bf333fdc4135b954f20d59207e9f6a4ecf88ce5af11c892b44f79766ec4ecc9f60d669b95ca8940f39b1b7044140ac2040c1bf659")),
442+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("9b8d008863beb4a02fb9e4efefd2eba867307fb1c7ce01746115d32e1db551bb254e8e3e4532d5c74a83949a69a60519ecc9178083cbe943"), hex!("346a1fca454d1e67c628437c270ec0f0c4256bb774fe6c0e49de7004ff6d9199e2cd99d8f7575a96aafc4dc8db1811ba0a44317581f41371")),
443+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("8746dc34799112d1f20acda9d7f722c9abb29b1fb6b7e9e566983843c20bd7c9bfad21b45c5166b808d2f5d44e188f1fdaf29cdee8a72e4c"), hex!("7c1293484c9287c298a1a0600c64347eee8530acf563cd8705e05728274d8cd8101835f8003b6f3b78b5beb28f5be188a3d7bce1ec5a36b1")),
444+
];
445+
446+
for (msg, x, y) in MSGS {
447+
let p = ProjectiveMontgomeryXpoint::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
448+
.to_affine();
449+
let mut xx = [0u8; 56];
450+
xx.copy_from_slice(&x[..]);
451+
xx.reverse();
452+
let mut yy = [0u8; 56];
453+
yy.copy_from_slice(&y[..]);
454+
yy.reverse();
455+
assert_eq!(p.0, xx);
456+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
457+
}
458+
}
337459
}

0 commit comments

Comments
 (0)