Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Dmitry Baryshkov
nettle
Commits
a59f2e2b
Commit
a59f2e2b
authored
Aug 27, 2014
by
Niels Möller
Browse files
Notes on the EdDSA twist.
parent
03d8c760
Changes
1
Hide whitespace changes
Inline
Side-by-side
misc/ecc-formulas.tex
View file @
a59f2e2b
...
...
@@ -26,11 +26,11 @@ Affine formulas for duplication, $(x_2, y_2) = 2(x_1, y_1)$:
\end{align*}
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align}
\begin{align
*
}
t
&
= (x
_
2 - x
_
1)
^{
-1
}
(y
_
2 - y
_
1)
\\
x
_
3
&
= t
^
2 - x
_
1 - x
_
2
\\
y
_
3
&
= (x
_
1 - x
_
3) t - y
_
1
\end{align}
\end{align
*
}
\section
{
Montgomery curve
}
...
...
@@ -105,6 +105,29 @@ This works also for doubling, but a more efficient variant is
Z
_
3
&
= E J
\end{align*}
\section
{
EdDSA
}
The EdDSA paper (
\url
{
http://ed25519.cr.yp.to/ed25519-20110926.pdf
}
)
suggests using the twisted Edwards curve,
\begin{equation*}
-x
^
2 + y
^
2 = 1 + d x
^
2 y
^
2
\pmod
{
p
}
\end{equation*}
Assuming -1 has a square root modulo
$
p
$
, a point
$
(
x, y
)
$
lies on
this curve if and only if
$
(
\sqrt
{
-
1
}
x, p
)
$
lies of the non-twisted
Edwards curve. The point additin formulas for the twisted Edwards
curve are
\begin{align*}
t
&
= d x
_
1 x
_
2 y
_
1 y
_
2
\\
x
_
3
&
= (1 + t)
^{
-1
}
(x
_
1 y
_
2 + y
_
1 x
_
2)
\\
y
_
3
&
= (1 - t)
^{
-1
}
(y
_
1 y
_
2 + x
_
1 x
_
2)
\end{align*}
For the other formulas, it should be fine to just switch the sign of
terms involving
$
x
_
1
x
_
2
$
or
$
x
_
1
^
2
$
. The paper suggests further
optimizations: For precomputed points, use the representation
$
(
x
-
y,
x
+
y, dxy
)
$
. And for temporary points, maintain an additional redundant
coordinate
$
T
$
, with
$
Z T
=
X Y
$
(see
\url
{
http://eprint.iacr.org/2008/522.pdf
}
).
\section
{
Curve25519
}
Curve25519 is defined as the Montgomery curve
...
...
@@ -145,6 +168,25 @@ coordinates, $u = U/W$ and $v = V/W$, then
\end{align*}
so we need to invert the value
$
(
W
-
V
)
U
$
.
\subsection
{
Transforms for the twisted Edwards Curve
}
If we use the twisted Edwards curve instead, let
$
\alpha
=
\sqrt
{
-
1
}
\pmod
{
p
}$
. Then we work with coordinates
$
(
u', v
)
$
, where
$
u'
=
\alpha
u
$
. The transform from Montgomery form
$
(
x, y
)
$
is then
\begin{align*}
u
&
= (
\alpha
\sqrt
{
b+2
}
)
\,
x / y
\\
v
&
= (x-1) / (x+1)
\end{align*}
And the inverse transform is similarly
\begin{align*}
x
&
= (1+v) / (1-v)
\\
y
&
= (
\alpha
\sqrt
{
b+2
}
)
\,
x / u
\end{align*}
so it's just a change of the transform constant, effectively using
$
\sqrt
{
-(
b
+
2
)
}$
instead.
\subsection
{
Coordinates outside of the base field
}
The curve25519 function is defined with an input point represented by
the
$
x
$
-coordinate only, and is specified as allowing any value. The
corresponding
$
y
$
coordinate is given by
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment