Skip to content

Commit 705d717

Browse files
daxpeddadaxpedda
committed
Add hash2curve to ProjectiveMontgomeryXpoint 
1 parent 4306725 commit 705d717

File tree

2 files changed

+142
-3
lines changed

2 files changed

+142
-3
lines changed

‎ed448-goldilocks/src/field/element.rs

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,25 @@ impl FieldElement {
426426
MontgomeryPoint::new(x, y)
427427
}
428428

429+
// See https://www.rfc-editor.org/rfc/rfc9380.html#name-curve448-q-3-mod-4-k-1.
430+
// Without y-coordinate.
431+
pub(crate) fn map_to_curve_elligator2_curve448_x(&self) -> FieldElement {
432+
let mut t1 = self.square(); // 1. t1 = u^2
433+
t1 *= Self::Z; // 2. t1 = Z * t1 // Z * u^2
434+
let e1 = t1.ct_eq(&Self::MINUS_ONE); // 3. e1 = t1 == -1 // exceptional case: Z * u^2 == -1
435+
t1.conditional_assign(&Self::ZERO, e1); // 4. t1 = CMOV(t1, 0, e1) // if t1 == -1, set t1 = 0
436+
let mut x1 = t1 + Self::ONE; // 5. x1 = t1 + 1
437+
x1 = x1.invert(); // 6. x1 = inv0(x1)
438+
x1 *= -Self::J; // 7. x1 = -A * x1 // x1 = -A / (1 + Z * u^2)
439+
let mut gx1 = x1 + Self::J; // 8. gx1 = x1 + A
440+
gx1 *= x1; // 9. gx1 = gx1 * x1
441+
gx1 += Self::ONE; // 10. gx1 = gx1 + B
442+
gx1 *= x1; // 11. gx1 = gx1 * x1 // gx1 = x1^3 + A * x1^2 + B * x1
443+
let x2 = -x1 - Self::J; // 12. x2 = -x1 - A
444+
let e2 = gx1.is_square(); // 14. e2 = is_square(gx1)
445+
Self::conditional_select(&x2, &x1, e2) // 15. x = CMOV(x2, x1, e2) // If is_square(gx1), x = x1, else x = x2
446+
}
447+
429448
// See https://www.shiftleft.org/papers/decaf/decaf.pdf#section.A.3.
430449
// Implementation copied from <https://sourceforge.net/p/ed448goldilocks/code/ci/e5cc6240690d3ffdfcbdb1e4e851954b789cd5d9/tree/src/per_curve/elligator.tmpl.c#l28>.
431450
pub(crate) fn map_to_curve_decaf448(&self) -> TwistedExtendedPoint {

‎ed448-goldilocks/src/montgomery/x.rs

Lines changed: 123 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
11
// use crate::constants::A_PLUS_TWO_OVER_FOUR;
2-
use super::{MontgomeryPoint, MontgomeryScalar, ProjectiveMontgomeryPoint};
3-
use crate::AffinePoint;
4-
use crate::field::{ConstMontyType, FieldElement};
2+
use super::{
3+
DEFAULT_ENCODE_TO_CURVE_SUITE, DEFAULT_HASH_TO_CURVE_SUITE, MontgomeryPoint, MontgomeryScalar,
4+
ProjectiveMontgomeryPoint,
5+
};
6+
use crate::field::{ConstMontyType, FieldElement, FieldElementU84};
7+
use crate::{AffinePoint, Curve448};
58
use core::fmt;
69
use core::ops::Mul;
10+
use elliptic_curve::array::Array;
711
use elliptic_curve::bigint::U448;
12+
use elliptic_curve::consts::{U28, U84};
13+
use hash2curve::{ExpandMsg, ExpandMsgXof, Expander, FromOkm, MapToCurve};
14+
use sha3::Shake256;
815
use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq};
916

1017
impl MontgomeryXpoint {
@@ -290,6 +297,67 @@ impl ProjectiveMontgomeryXpoint {
290297
Self { U, W }
291298
}
292299

300+
/// Hash a message to a point on the curve
301+
///
302+
/// Hash using the default domain separation tag and hash function.
303+
/// For more control see [`Self::hash()`].
304+
pub fn hash_with_defaults(msg: &[u8]) -> Self {
305+
Self::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_HASH_TO_CURVE_SUITE])
306+
}
307+
308+
/// Hash a message to a point on the curve
309+
///
310+
/// Implements hash to curve according
311+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
312+
pub fn hash<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
313+
where
314+
X: ExpandMsg<U28>,
315+
{
316+
let mut expander =
317+
X::expand_message(msg, dst, (84 * 2).try_into().expect("should never fail"))
318+
.expect("should never fail with the given `ExpandMsg` and `dst`");
319+
let mut data = Array::<u8, U84>::default();
320+
expander.fill_bytes(&mut data);
321+
let u0 = FieldElementU84::from_okm(&data).0;
322+
expander.fill_bytes(&mut data);
323+
let u1 = FieldElementU84::from_okm(&data).0;
324+
325+
let q0 = Curve448::map_to_curve(FieldElementU84(u0));
326+
let q1 = Curve448::map_to_curve(FieldElementU84(u1));
327+
328+
Self::from(q0 + q1).double().double()
329+
}
330+
331+
/// Encode a message to a point on the curve
332+
///
333+
/// Encode using the default domain separation tag and hash function.
334+
/// For more control see [`Self::encode()`].
335+
pub fn encode_with_defaults(msg: &[u8]) -> Self {
336+
Self::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_ENCODE_TO_CURVE_SUITE])
337+
}
338+
339+
/// Encode a message to a point on the curve
340+
///
341+
/// Implements encode to curve according
342+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
343+
pub fn encode<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
344+
where
345+
X: ExpandMsg<U28>,
346+
{
347+
let mut expander = X::expand_message(msg, dst, 84.try_into().expect("should never fail"))
348+
.expect("should never fail with the given `ExpandMsg` and `dst`");
349+
let mut data = Array::<u8, U84>::default();
350+
expander.fill_bytes(&mut data);
351+
let u = FieldElementU84::from_okm(&data).0;
352+
353+
Self {
354+
U: u.map_to_curve_elligator2_curve448_x(),
355+
W: FieldElement::ONE,
356+
}
357+
.double()
358+
.double()
359+
}
360+
293361
/// Convert the point to affine form
294362
pub fn to_affine(&self) -> MontgomeryXpoint {
295363
let x = self.U * self.W.invert();
@@ -320,6 +388,8 @@ mod tests {
320388
use super::*;
321389
use crate::EdwardsPoint;
322390
use elliptic_curve::CurveGroup;
391+
use hex_literal::hex;
392+
use sha3::Shake256;
323393

324394
#[test]
325395
fn test_montgomery_edwards() {
@@ -351,4 +421,54 @@ mod tests {
351421

352422
assert_eq!(x_identity.to_extended(Choice::from(1)), identity);
353423
}
424+
425+
#[test]
426+
fn hash_with_test_vectors() {
427+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_RO_";
428+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
429+
(b"", hex!("5ea5ff623d27c75e73717514134e73e419f831a875ca9e82915fdfc7069d0a9f8b532cfb32b1d8dd04ddeedbe3fa1d0d681c01e825d6a9ea"), hex!("afadd8de789f8f8e3516efbbe313a7eba364c939ecba00dabf4ced5c563b18e70a284c17d8f46b564c4e6ce11784a3825d941116622128c1")),
430+
(b"abc", hex!("9b2f7ce34878d7cebf34c582db14958308ea09366d1ec71f646411d3de0ae564d082b06f40cd30dfc08d9fb7cb21df390cf207806ad9d0e4"), hex!("138a0eef0a4993ea696152ed7db61f7ddb4e8100573591e7466d61c0c568ecaec939e36a84d276f34c402526d8989a96e99760c4869ed633")),
431+
(b"abcdef0123456789", hex!("f54ecd14b85a50eeeee0618452df3a75be7bfba11da5118774ae4ea55ac204e153f77285d780c4acee6c96abe3577a0c0b00be6e790cf194"), hex!("935247a64bf78c107069943c7e3ecc52acb27ce4a3230407c8357341685ea2152e8c3da93f8cd77da1bddb5bb759c6e7ae7d516dced42850")),
432+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("5bd67c4f88adf6beb10f7e0d0054659776a55c97b809ec8b3101729e104fd0f684e103792f267fd87cc4afc25a073956ef4f268fb02824d5"), hex!("da1f5cb16a352719e4cb064cf47ba72aeba7752d03e8ca2c56229f419b4ef378785a5af1a53dd7ab4d467c1f92f7b139b3752faf29c96432")),
433+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("ea441c10b3636ecedd5c0dfcae96384cc40de8390a0ab648765b4508da12c586d55dc981275776507ebca0e4d1bcaa302bb69dcfa31b3451"), hex!("fee0192d49bcc0c28d954763c2cbe739b9265c4bebe3883803c64971220cfda60b9ac99ad986cd908c0534b260b5cfca46f6c2b0f3f21bda")),
434+
];
435+
436+
for (msg, x, y) in MSGS {
437+
let p = ProjectiveMontgomeryXpoint::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
438+
.to_affine();
439+
let mut xx = [0u8; 56];
440+
xx.copy_from_slice(&x[..]);
441+
xx.reverse();
442+
let mut yy = [0u8; 56];
443+
yy.copy_from_slice(&y[..]);
444+
yy.reverse();
445+
assert_eq!(p.0, xx);
446+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
447+
}
448+
}
449+
450+
#[test]
451+
fn encode_with_test_vectors() {
452+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_NU_";
453+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
454+
(b"", hex!("b65e8dbb279fd656f926f68d463b13ca7a982b32f5da9c7cc58afcf6199e4729863fb75ca9ae3c95c6887d95a5102637a1c5c40ff0aafadc"), hex!("ea1ea211cf29eca11c057fe8248181591a19f6ac51d45843a65d4bb8b71bc83a64c771ed7686218a278ef1c5d620f3d26b53162188645453")),
455+
(b"abc", hex!("51aceca4fa95854bbaba58d8a5e17a86c07acadef32e1188cafda26232131800002cc2f27c7aec454e5e0c615bddffb7df6a5f7f0f14793f"), hex!("c590c9246eb28b08dee816d608ef233ea5d76e305dc458774a1e1bd880387e6734219e2018e4aa50a49486dce0ba8740065da37e6cf5212c")),
456+
(b"abcdef0123456789", hex!("c6d65987f146b8d0cb5d2c44e1872ac3af1f458f6a8bd8c232ffe8b9d09496229a5a27f350eb7d97305bcc4e0f38328718352e8e3129ed71"), hex!("4d2f901bf333fdc4135b954f20d59207e9f6a4ecf88ce5af11c892b44f79766ec4ecc9f60d669b95ca8940f39b1b7044140ac2040c1bf659")),
457+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("9b8d008863beb4a02fb9e4efefd2eba867307fb1c7ce01746115d32e1db551bb254e8e3e4532d5c74a83949a69a60519ecc9178083cbe943"), hex!("346a1fca454d1e67c628437c270ec0f0c4256bb774fe6c0e49de7004ff6d9199e2cd99d8f7575a96aafc4dc8db1811ba0a44317581f41371")),
458+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("8746dc34799112d1f20acda9d7f722c9abb29b1fb6b7e9e566983843c20bd7c9bfad21b45c5166b808d2f5d44e188f1fdaf29cdee8a72e4c"), hex!("7c1293484c9287c298a1a0600c64347eee8530acf563cd8705e05728274d8cd8101835f8003b6f3b78b5beb28f5be188a3d7bce1ec5a36b1")),
459+
];
460+
461+
for (msg, x, y) in MSGS {
462+
let p = ProjectiveMontgomeryXpoint::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
463+
.to_affine();
464+
let mut xx = [0u8; 56];
465+
xx.copy_from_slice(&x[..]);
466+
xx.reverse();
467+
let mut yy = [0u8; 56];
468+
yy.copy_from_slice(&y[..]);
469+
yy.reverse();
470+
assert_eq!(p.0, xx);
471+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
472+
}
473+
}
354474
}

0 commit comments

Comments
 (0)