Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Dmitry Baryshkov
nettle
Commits
d51ff03e
Commit
d51ff03e
authored
Sep 06, 2014
by
Niels Möller
Browse files
Notes on the Montgomery ladder.
parent
ac1e6e5a
Changes
1
Hide whitespace changes
Inline
Sidebyside
misc/eccformulas.tex
View file @
d51ff03e
...
...
@@ 63,6 +63,75 @@ y_2)$:
Again, very similar to the Weierstraß formulas, with only an
additional
$
b
$
term in the formula for
$
x
_
3
$
.
\subsection
{
Montgomery ladder
}
It's possible to do operations on a Montgomery curve in terms of the
$
x
$
coordinate only. Or, with homogeneous coordinates, use
$
X
$
and
$
Z
$
with
$
x
=
X
/
Z
$
.
For doubling,
\begin{align*}
x'
&
= (x
^
2  z
^
2)
^
2 = (xz)
^
2 (x+z)
^
2
\\
t
&
= (x+z)
^
2  (xz)
^
2
\\
z'
&
= 4 xz (x
^
2 + bzx + z
^
2) = t
\left
((x+z)
^
2 + b't
\right
)
\end{align*}
with
$
b'
=
(
b

2
)/
4
$
.
Addition is a bit trickier. If we have
$
x
$
and
$
z
$
for points
$
Q
_
1
$
,
$
Q
_
2
$
and
$
Q
_
3
$
, with
$
Q
_
3
=
Q
_
1
+
Q
_
3
$
, and
$
x
_
1
, z
_
1
\neq
0
$
, we
get the coordinates for
$
Q
_
2
+
Q
_
3
$
as
\begin{align*}
x'
&
= 4 (x
_
2 x
_
3  z
_
2 z
_
3)
^
2 z
_
1 =
\left
((x
_
2  z
_
2)(x
_
3 + z
_
3) +
(x
_
2 + z
_
2)(x
_
3  z
_
3)
\right
)
^
2 z
_
1
\\
z'
&
= 4 (x
_
2 z
_
3  z
_
2 x
_
3)
^
2 x
_
1 =
\left
((x
_
2  z
_
2)(x
_
3 + z
_
3) 
(x
_
2 + z
_
2)(x
_
3  z
_
3)
\right
)
^
2 x
_
1
\end{align*}
Note that the doubling formula is symmetric in
$
Q
_
2
$
and
$
Q
_
3
$
. Which
is consistent with negating of
$
Q
_
1
$
, which really is the negatiion of
the
$
y
$
coordinate, which doesn't appear in the formula.
This can be used for a binary ``Montgomery ladder'' to compute
$
n Q
$
for any
$
n
$
. If we have the points
$
Q
$
,
$
n Q
$
, and
$
(
n
+
1
)
Q
$
, we can
compute the three points
\begin{align*}
(2n) Q
&
= 2 (nQ)
&&
\text
{
doubling
}
\\
(2n+1) Q
&
= (nQ) + (n+1)Q
&&
\text
{
addition
}
\\
(2n+2) Q
&
= 2((n+1) Q)
&&
\text
{
doubling
}
\end{align*}
The following algorithm is suggested by dj (see
\url
{
http://www.ietf.org/mailarchive/web/cfrg/current/msg05004.html
}
.
\begin{verbatim}
x2,z2,x3,z3 = 1,0,x1,1
for i in reversed(range(255)):
bit = 1
&
(n >> i)
x2,x3 = cswap(x2,x3,bit)
z2,z3 = cswap(z2,z3,bit)
x3,z3 = ((x2*x3z2*z3)
^
2,x1*(x2*z3z2*x3)
^
2)
x2,z2 = ((x2
^
2z2
^
2)
^
2,4*x2*z2*(x2
^
2+A*x2*z2+z2
^
2))
x2,x3 = cswap(x2,x3,bit)
z2,z3 = cswap(z2,z3,bit)
return x2*z2
^
(p2)
\end{verbatim}
It's not too hard to decipher this. The update for
$
x
_
2
, z
_
2
$
is the
doubling. The update for
$
x
_
3
, z
_
3
$
is an addition.
If the bit is zero, we get
$
x
_
2
', z
_
2
'
$
representing
$
Q
_
2
'
=
2
Q
_
2
$
,
and
$
x
_
3
', z
_
3
'
$
representing
$
Q
_
3
'
=
Q
_
2
+
Q
_
3
=
2
Q
_
2
+
Q
_
1
$
.
What if the bit is set? For the doubling, we get it applied to
$
Q
_
3
$
instead, so we get
$
x
_
3
', z
_
3
'
$
representing
$
Q
_
3
'
=
2
Q
_
3
=
2
Q
_
2
+
2
Q
_
1
$
. For the add, the initial swap flips the sign of one of the
intermediate values, but the end result is the same, so we get
$
x
_
2
',
z
_
2
'
$
representing
$
Q
_
2
'
=
Q
_
2
+
Q
_
3
=
2
Q
_
2
+
Q
_
1
$
, as desired.
Note that the initial conditional swap doesn't have to be a full swap;
if that's convenient in the implementation, a conditional assignment
should be sufficient to get the duplication formula appplied to the
right point. It looks like, in all cases, one will start by computing
$
x
_
2
\pm
z
_
2
$
and
$
x
_
3
\pm
z
_
3
$
, so maybe one can apply conditional
assignment to these values instead.
\section
{
Edwards curve
}
For an Edwards curve, we consider the special case
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment