Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
What's new
10
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Open sidebar
Nettle
nettle
Commits
71cdc778
Commit
71cdc778
authored
Jul 11, 2014
by
Niels Möller
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Added some ECC notes.
parent
660e482f
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
158 additions
and
0 deletions
+158
-0
ChangeLog
ChangeLog
+2
-0
misc/.gitignore
misc/.gitignore
+4
-0
misc/ecc-formulas.tex
misc/ecc-formulas.tex
+152
-0
No files found.
ChangeLog
View file @
71cdc778
2014-07-11 Niels Möller <nisse@lysator.liu.se>
* misc/ecc-formulas.tex: Some ECC notes.
* testsuite/curve25519-dup-test.c: New testcase.
* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Added
curve25519-dup-test.c.
...
...
misc/.gitignore
View file @
71cdc778
/*.pdf
/*.dvi
/*.log
/*.aux
/auto
misc/ecc-formulas.tex
0 → 100644
View file @
71cdc778
\documentclass
[a4paper]
{
article
}
\usepackage
[utf8]
{
inputenc
}
\usepackage
{
amsmath
}
\usepackage
{
url
}
\author
{
Niels Möller
}
\title
{
Notes on ECC formulas
}
\begin{document}
\maketitle
\section
{
Weierstrass curve
}
Consider only the special case
\begin{equation*}
y
^
2 = x
^
3 - 3x + b (mod p)
\end{equation*}
See
\url
{
http://www.hyperelliptic.org/EFD/g1p/auto-shortw.html
}
.
Affine formulas for duplication,
$
(
x
_
2
, y
_
2
)
=
2
(
x
_
1
, y
_
1
)
$
:
\begin{align*}
t
&
= (2y)
^{
-1
}
3 (x
_
1
^
2 - 1)
\\
x
_
2
&
= t
^
2 - 2 x
_
1
\\
y
_
2
&
= (x
_
1 - x
_
2) * t - y
_
1
\end{align*}
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align}
t
&
= (x
_
2 - x
_
1)
^{
-1
}
(y
_
2 - y
_
1)
\\
x
_
3
&
= t
^
2 - x
_
1 - x
_
2
\\
y
_
3
&
= (x
_
1 - x
_
3) t - y
_
1
\end{align}
\section
{
Montgomery curve
}
Consider the special case
\begin{equation*}
y
^
2 = x
^
3 + b x
^
2 + x
\end{equation*}
See
\url
{
http://www.hyperelliptic.org/EFD/g1p/auto-montgom.html
}
.
Affine formulas for duplication,
$
(
x
_
2
, y
_
2
)
=
2
(
x
_
1
, y
_
1
)
$
:
\begin{align*}
t
&
= (2 y
_
1)
^{
-1
}
(3 x
_
1
^
2 + 2b x
_
1 + 1)
\\
x
_
2
&
= t
^
2 - b - 2 x
_
1
\\
y
_
2
&
= (3 x
_
1 + b) t - t
^
3 - y
_
1
\\
&
= (3 x
_
1 + b - t
^
2) t - y
_
1
\\
&
= (x
_
1 - x
_
2) t - y
_
1
\end{align*}
So the computation is very similar to the Weierstraß case, differing
only in the formula for
$
t
$
, and the
$
b
$
term in
$
x
_
2
$
.
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align*}
t
&
= (x
_
2 - x
_
1)
^{
-1
}
(y
_
2 - y
_
1)
\\
x
_
3
&
= t
^
2 - b - x
_
1 - x
_
2
\\
y
_
3
&
= (2 x
_
1 + x
_
2 + b) t - t
^
3 - y
_
1
\\
&
= (2 x
_
1 + x
_
2 + b - t
^
2) t - y
_
1
\\
&
= (x
_
1 - x
_
3) t - y
_
1
\end{align*}
Again, very similar to the Weierstraß formulas, with only an
additional
$
b
$
term in the formula for
$
x
_
3
$
.
\section
{
Edwards curve
}
For an Edwards curve, we consider the special case
\begin{equation*}
x
^
2 + y
^
2 = 1 + d x
^
2 y
^
2
\end{equation*}
See
\url
{
http://cr.yp.to/papers.html#newelliptic
}
.
Affine formulas for addition,
$
(
x
_
3
, y
_
3
)
=
(
x
_
1
, y
_
1
)
+
(
x
_
2
,
y
_
2
)
$
:
\begin{align*}
t
&
= d x
_
1 x
_
2 y
_
1 y
_
2
\\
x
_
3
&
= (1 + t)
^{
-1
}
(x
_
1 y
_
2 + y
_
1 x
_
2)
\\
y
_
3
&
= (1 - t)
^{
-1
}
(y
_
1 y
_
2 - x
_
1 x
_
2)
\end{align*}
With homogeneous coordinates
$
(
X
_
1
, Y
_
1
, Z
_
1
)
$
etc., D.~J.~Bernstein
suggests the formulas
\begin{align*}
A
&
= Z
_
1 Z
_
2
\\
B
&
= A
^
2
\\
C
&
= X
_
1 X
_
2
\\
D
&
= Y
_
1 Y
_
2
\\
E
&
= d C D
\\
F
&
= B - E
\\
G
&
= B + E
\\
X
_
3
&
= A F [(X
_
1 + Y
_
1)(X
_
2 + Y
_
2) - C - D]
\\
Y
_
3
&
= A G (D - C)
\\
Z
_
3
&
= F G
\end{align*}
This works also for doubling, but a more efficient variant is
\begin{align*}
B
&
= (X
_
1 + Y
_
1)
^
2
\\
C
&
= X
_
1
^
2
\\
D
&
= Y
_
1
^
2
\\
E
&
= C + D
\\
H
&
= Z
_
1
^
2
\\
J
&
= E - 2H
\\
X
_
3
&
= (B - E) J
\\
Y
_
3
&
= E (C - D)
\\
Z
_
3
&
= E J
\end{align*}
\section
{
Curve25519
}
Curve25519 is defined as the Montgomery curve
\begin{equation*}
y
^
2 = x
^
3 + b x
^
2 + x
\pmod
p
\end{equation*}
with
$
b
=
486662
$
and
$
p
=
2
^{
255
}
-
19
$
. It is equivalent to the
Edwards curve
\begin{equation*}
u
^
2 + v
^
2 = 1 + d u
^
2 v
^
2
\pmod
p
\end{equation*}
with
$
d
=
(
121665
/
121666
)
\bmod
p
$
. The equivalence is given by
mapping
$
P
=
(
x,y
)
$
to
$
P'
=
(
u, v
)
$
, as follows.
\begin{itemize}
\item
$
P
=
\infty
$
corresponds to
$
P'
=
(
0
,
1
)
$
\item
$
P
=
(
0
,
0
)
$
corresponds to
$
P'
=
(
0
,
-
1
)
$
\item
Otherwise, for all other points on the curve. First note that
$
x
\neq
-
1
$
(since then the right hand side is a not a quadratic
residue), and that
$
y
\neq
0
$
(since
$
y
=
0
$
and
$
x
\neq
0
$
implies
that
$
x
^
2
+
bx
+
1
=
0
$
, or
$
(
x
+
b
/
2
)
^
2
=
(
b
/
2
)
^
2
-
1
$
, which also
isn't a quadratic residue). The correspondence is then given by
\begin{align*}
u
&
=
\sqrt
{
b
}
\,
x / y
\\
v
&
= (x-1) / (x+1)
\end{align*}
\end{itemize}
The inverse transformation is
\begin{align*}
x
&
= (1+v) / (1-v)
\\
y
&
=
\sqrt
{
b
}
x / u
\end{align*}
If the Edwards coordinates are represented using homogeneous
coordinates,
$
u
=
U
/
W
$
and
$
v
=
V
/
W
$
, then
\begin{align*}
x
&
=
\frac
{
W+V
}{
W-V
}
\\
y
&
=
\sqrt
{
b
}
\frac
{
(W+V) W
}{
(W-V) U
}
\end{align*}
so we need to invert the value
$
(
W
-
V
)
U
$
.
\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: t
%%% End:
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment