Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Dmitry Baryshkov
nettle
Commits
71cdc778
Commit
71cdc778
authored
Jul 11, 2014
by
Niels Möller
Browse files
Added some ECC notes.
parent
660e482f
Changes
3
Hide whitespace changes
Inline
Side-by-side
ChangeLog
View file @
71cdc778
2014-07-11 Niels Möller <nisse@lysator.liu.se>
* misc/ecc-formulas.tex: Some ECC notes.
* testsuite/curve25519-dup-test.c: New testcase.
* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Added
curve25519-dup-test.c.
...
...
misc/.gitignore
View file @
71cdc778
/*.pdf
/*.dvi
/*.log
/*.aux
/auto
misc/ecc-formulas.tex
0 → 100644
View file @
71cdc778
\documentclass
[a4paper]
{
article
}
\usepackage
[utf8]
{
inputenc
}
\usepackage
{
amsmath
}
\usepackage
{
url
}
\author
{
Niels Möller
}
\title
{
Notes on ECC formulas
}
\begin{document}
\maketitle
\section
{
Weierstrass curve
}
Consider only the special case
\begin{equation*}
y
^
2 = x
^
3 - 3x + b (mod p)
\end{equation*}
See
\url
{
http://www.hyperelliptic.org/EFD/g1p/auto-shortw.html
}
.
Affine formulas for duplication,
$
(
x
_
2
, y
_
2
)
=
2
(
x
_
1
, y
_
1
)
$
:
\begin{align*}
t
&
= (2y)
^{
-1
}
3 (x
_
1
^
2 - 1)
\\
x
_
2
&
= t
^
2 - 2 x
_
1
\\
y
_
2
&
= (x
_
1 - x
_
2) * t - y
_
1
\end{align*}
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align}
t
&
= (x
_
2 - x
_
1)
^{
-1
}
(y
_
2 - y
_
1)
\\
x
_
3
&
= t
^
2 - x
_
1 - x
_
2
\\
y
_
3
&
= (x
_
1 - x
_
3) t - y
_
1
\end{align}
\section
{
Montgomery curve
}
Consider the special case
\begin{equation*}
y
^
2 = x
^
3 + b x
^
2 + x
\end{equation*}
See
\url
{
http://www.hyperelliptic.org/EFD/g1p/auto-montgom.html
}
.
Affine formulas for duplication,
$
(
x
_
2
, y
_
2
)
=
2
(
x
_
1
, y
_
1
)
$
:
\begin{align*}
t
&
= (2 y
_
1)
^{
-1
}
(3 x
_
1
^
2 + 2b x
_
1 + 1)
\\
x
_
2
&
= t
^
2 - b - 2 x
_
1
\\
y
_
2
&
= (3 x
_
1 + b) t - t
^
3 - y
_
1
\\
&
= (3 x
_
1 + b - t
^
2) t - y
_
1
\\
&
= (x
_
1 - x
_
2) t - y
_
1
\end{align*}
So the computation is very similar to the Weierstraß case, differing
only in the formula for
$
t
$
, and the
$
b
$
term in
$
x
_
2
$
.
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align*}
t
&
= (x
_
2 - x
_
1)
^{
-1
}
(y
_
2 - y
_
1)
\\
x
_
3
&
= t
^
2 - b - x
_
1 - x
_
2
\\
y
_
3
&
= (2 x
_
1 + x
_
2 + b) t - t
^
3 - y
_
1
\\
&
= (2 x
_
1 + x
_
2 + b - t
^
2) t - y
_
1
\\
&
= (x
_
1 - x
_
3) t - y
_
1
\end{align*}
Again, very similar to the Weierstraß formulas, with only an
additional
$
b
$
term in the formula for
$
x
_
3
$
.
\section
{
Edwards curve
}
For an Edwards curve, we consider the special case
\begin{equation*}
x
^
2 + y
^
2 = 1 + d x
^
2 y
^
2
\end{equation*}
See
\url
{
http://cr.yp.to/papers.html#newelliptic
}
.
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align*}
t
&
= d x
_
1 x
_
2 y
_
1 y
_
2
\\
x
_
3
&
= (1 + t)
^{
-1
}
(x
_
1 y
_
2 + y
_
1 x
_
2)
\\
y
_
3
&
= (1 - t)
^{
-1
}
(y
_
1 y
_
2 - x
_
1 x
_
2)
\end{align*}
With homogeneous coordinates
$
(
X
_
1
, Y
_
1
, Z
_
1
)
$
etc., D.~J.~Bernstein
suggests the formulas
\begin{align*}
A
&
= Z
_
1 Z
_
2
\\
B
&
= A
^
2
\\
C
&
= X
_
1 X
_
2
\\
D
&
= Y
_
1 Y
_
2
\\
E
&
= d C D
\\
F
&
= B - E
\\
G
&
= B + E
\\
X
_
3
&
= A F [(X
_
1 + Y
_
1)(X
_
2 + Y
_
2) - C - D]
\\
Y
_
3
&
= A G (D - C)
\\
Z
_
3
&
= F G
\end{align*}
This works also for doubling, but a more efficient variant is
\begin{align*}
B
&
= (X
_
1 + Y
_
1)
^
2
\\
C
&
= X
_
1
^
2
\\
D
&
= Y
_
1
^
2
\\
E
&
= C + D
\\
H
&
= Z
_
1
^
2
\\
J
&
= E - 2H
\\
X
_
3
&
= (B - E) J
\\
Y
_
3
&
= E (C - D)
\\
Z
_
3
&
= E J
\end{align*}
\section
{
Curve25519
}
Curve25519 is defined as the Montgomery curve
\begin{equation*}
y
^
2 = x
^
3 + b x
^
2 + x
\pmod
p
\end{equation*}
with
$
b
=
486662
$
and
$
p
=
2
^{
255
}
-
19
$
. It is equivalent to the
Edwards curve
\begin{equation*}
u
^
2 + v
^
2 = 1 + d u
^
2 v
^
2
\pmod
p
\end{equation*}
with
$
d
=
(
121665
/
121666
)
\bmod
p
$
. The equivalence is given by
mapping
$
P
=
(
x,y
)
$
to
$
P'
=
(
u, v
)
$
, as follows.
\begin{itemize}
\item
$
P
=
\infty
$
corresponds to
$
P'
=
(
0
,
1
)
$
\item
$
P
=
(
0
,
0
)
$
corresponds to
$
P'
=
(
0
,
-
1
)
$
\item
Otherwise, for all other points on the curve. First note that
$
x
\neq
-
1
$
(since then the right hand side is a not a quadratic
residue), and that
$
y
\neq
0
$
(since
$
y
=
0
$
and
$
x
\neq
0
$
implies
that
$
x
^
2
+
bx
+
1
=
0
$
, or
$
(
x
+
b
/
2
)
^
2
=
(
b
/
2
)
^
2
-
1
$
, which also
isn't a quadratic residue). The correspondence is then given by
\begin{align*}
u
&
=
\sqrt
{
b
}
\,
x / y
\\
v
&
= (x-1) / (x+1)
\end{align*}
\end{itemize}
The inverse transformation is
\begin{align*}
x
&
= (1+v) / (1-v)
\\
y
&
=
\sqrt
{
b
}
x / u
\end{align*}
If the Edwards coordinates are represented using homogeneous
coordinates,
$
u
=
U
/
W
$
and
$
v
=
V
/
W
$
, then
\begin{align*}
x
&
=
\frac
{
W+V
}{
W-V
}
\\
y
&
=
\sqrt
{
b
}
\frac
{
(W+V) W
}{
(W-V) U
}
\end{align*}
so we need to invert the value
$
(
W
-
V
)
U
$
.
\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: t
%%% End:
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment