Skip to content

Commit c8aca06

Browse files
daxpeddadaxpedda
committed
Add hash2curve to ProjectiveMontgomeryXpoint 
1 parent b650442 commit c8aca06

File tree

2 files changed

+142
-3
lines changed

2 files changed

+142
-3
lines changed

‎ed448-goldilocks/src/field/element.rs

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,25 @@ impl FieldElement {
434434
MontgomeryPoint::new(x, y)
435435
}
436436

437+
// See https://www.rfc-editor.org/rfc/rfc9380.html#name-curve448-q-3-mod-4-k-1.
438+
// Without y-coordinate.
439+
pub(crate) fn map_to_curve_elligator2_curve448_x(&self) -> FieldElement {
440+
let mut t1 = self.square(); // 1. t1 = u^2
441+
t1 *= Self::Z; // 2. t1 = Z * t1 // Z * u^2
442+
let e1 = t1.ct_eq(&Self::MINUS_ONE); // 3. e1 = t1 == -1 // exceptional case: Z * u^2 == -1
443+
t1.conditional_assign(&Self::ZERO, e1); // 4. t1 = CMOV(t1, 0, e1) // if t1 == -1, set t1 = 0
444+
let mut x1 = t1 + Self::ONE; // 5. x1 = t1 + 1
445+
x1 = x1.invert(); // 6. x1 = inv0(x1)
446+
x1 *= -Self::J; // 7. x1 = -A * x1 // x1 = -A / (1 + Z * u^2)
447+
let mut gx1 = x1 + Self::J; // 8. gx1 = x1 + A
448+
gx1 *= x1; // 9. gx1 = gx1 * x1
449+
gx1 += Self::ONE; // 10. gx1 = gx1 + B
450+
gx1 *= x1; // 11. gx1 = gx1 * x1 // gx1 = x1^3 + A * x1^2 + B * x1
451+
let x2 = -x1 - Self::J; // 12. x2 = -x1 - A
452+
let e2 = gx1.is_square(); // 14. e2 = is_square(gx1)
453+
Self::conditional_select(&x2, &x1, e2) // 15. x = CMOV(x2, x1, e2) // If is_square(gx1), x = x1, else x = x2
454+
}
455+
437456
// See https://www.shiftleft.org/papers/decaf/decaf.pdf#section.A.3.
438457
// Implementation copied from <https://sourceforge.net/p/ed448goldilocks/code/ci/e5cc6240690d3ffdfcbdb1e4e851954b789cd5d9/tree/src/per_curve/elligator.tmpl.c#l28>.
439458
pub(crate) fn map_to_curve_decaf448(&self) -> TwistedExtendedPoint {

‎ed448-goldilocks/src/montgomery/x.rs

Lines changed: 123 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
11
// use crate::constants::A_PLUS_TWO_OVER_FOUR;
2-
use super::{MontgomeryPoint, MontgomeryScalar, ProjectiveMontgomeryPoint};
3-
use crate::AffinePoint;
4-
use crate::field::{ConstMontyType, FieldElement};
2+
use super::{
3+
DEFAULT_ENCODE_TO_CURVE_SUITE, DEFAULT_HASH_TO_CURVE_SUITE, MontgomeryPoint, MontgomeryScalar,
4+
ProjectiveMontgomeryPoint,
5+
};
6+
use crate::field::{ConstMontyType, FieldElement, FieldElementU84};
7+
use crate::{AffinePoint, Curve448};
58
use core::fmt;
69
use core::ops::Mul;
10+
use elliptic_curve::array::Array;
711
use elliptic_curve::bigint::U448;
12+
use elliptic_curve::consts::{U28, U84};
13+
use hash2curve::{ExpandMsg, ExpandMsgXof, Expander, FromOkm, MapToCurve};
14+
use sha3::Shake256;
815
use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq};
916

1017
// Low order points on Curve448 and it's twist
@@ -273,6 +280,67 @@ impl ProjectiveMontgomeryXpoint {
273280
Self { U, W }
274281
}
275282

283+
/// Hash a message to a point on the curve
284+
///
285+
/// Hash using the default domain separation tag and hash function.
286+
/// For more control see [`Self::hash()`].
287+
pub fn hash_with_defaults(msg: &[u8]) -> Self {
288+
Self::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_HASH_TO_CURVE_SUITE])
289+
}
290+
291+
/// Hash a message to a point on the curve
292+
///
293+
/// Implements hash to curve according
294+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
295+
pub fn hash<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
296+
where
297+
X: ExpandMsg<U28>,
298+
{
299+
let mut expander =
300+
X::expand_message(msg, dst, (84 * 2).try_into().expect("should never fail"))
301+
.expect("should never fail with the given `ExpandMsg` and `dst`");
302+
let mut data = Array::<u8, U84>::default();
303+
expander.fill_bytes(&mut data);
304+
let u0 = FieldElementU84::from_okm(&data).0;
305+
expander.fill_bytes(&mut data);
306+
let u1 = FieldElementU84::from_okm(&data).0;
307+
308+
let q0 = Curve448::map_to_curve(FieldElementU84(u0));
309+
let q1 = Curve448::map_to_curve(FieldElementU84(u1));
310+
311+
(q0 + q1).to_projective_x().double().double()
312+
}
313+
314+
/// Encode a message to a point on the curve
315+
///
316+
/// Encode using the default domain separation tag and hash function.
317+
/// For more control see [`Self::encode()`].
318+
pub fn encode_with_defaults(msg: &[u8]) -> Self {
319+
Self::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DEFAULT_ENCODE_TO_CURVE_SUITE])
320+
}
321+
322+
/// Encode a message to a point on the curve
323+
///
324+
/// Implements encode to curve according
325+
/// see <https://datatracker.ietf.org/doc/rfc9380/>
326+
pub fn encode<X>(msg: &[&[u8]], dst: &[&[u8]]) -> Self
327+
where
328+
X: ExpandMsg<U28>,
329+
{
330+
let mut expander = X::expand_message(msg, dst, 84.try_into().expect("should never fail"))
331+
.expect("should never fail with the given `ExpandMsg` and `dst`");
332+
let mut data = Array::<u8, U84>::default();
333+
expander.fill_bytes(&mut data);
334+
let u = FieldElementU84::from_okm(&data).0;
335+
336+
Self {
337+
U: u.map_to_curve_elligator2_curve448_x(),
338+
W: FieldElement::ONE,
339+
}
340+
.double()
341+
.double()
342+
}
343+
276344
/// Convert the point to affine form
277345
pub fn to_affine(&self) -> MontgomeryXpoint {
278346
let x = self.U * self.W.invert();
@@ -303,6 +371,8 @@ mod tests {
303371
use super::*;
304372
use crate::EdwardsPoint;
305373
use elliptic_curve::CurveGroup;
374+
use hex_literal::hex;
375+
use sha3::Shake256;
306376

307377
#[test]
308378
fn test_montgomery_edwards() {
@@ -334,4 +404,54 @@ mod tests {
334404

335405
assert_eq!(x_identity.to_extended(Choice::from(1)), identity);
336406
}
407+
408+
#[test]
409+
fn hash_with_test_vectors() {
410+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_RO_";
411+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
412+
(b"", hex!("5ea5ff623d27c75e73717514134e73e419f831a875ca9e82915fdfc7069d0a9f8b532cfb32b1d8dd04ddeedbe3fa1d0d681c01e825d6a9ea"), hex!("afadd8de789f8f8e3516efbbe313a7eba364c939ecba00dabf4ced5c563b18e70a284c17d8f46b564c4e6ce11784a3825d941116622128c1")),
413+
(b"abc", hex!("9b2f7ce34878d7cebf34c582db14958308ea09366d1ec71f646411d3de0ae564d082b06f40cd30dfc08d9fb7cb21df390cf207806ad9d0e4"), hex!("138a0eef0a4993ea696152ed7db61f7ddb4e8100573591e7466d61c0c568ecaec939e36a84d276f34c402526d8989a96e99760c4869ed633")),
414+
(b"abcdef0123456789", hex!("f54ecd14b85a50eeeee0618452df3a75be7bfba11da5118774ae4ea55ac204e153f77285d780c4acee6c96abe3577a0c0b00be6e790cf194"), hex!("935247a64bf78c107069943c7e3ecc52acb27ce4a3230407c8357341685ea2152e8c3da93f8cd77da1bddb5bb759c6e7ae7d516dced42850")),
415+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("5bd67c4f88adf6beb10f7e0d0054659776a55c97b809ec8b3101729e104fd0f684e103792f267fd87cc4afc25a073956ef4f268fb02824d5"), hex!("da1f5cb16a352719e4cb064cf47ba72aeba7752d03e8ca2c56229f419b4ef378785a5af1a53dd7ab4d467c1f92f7b139b3752faf29c96432")),
416+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("ea441c10b3636ecedd5c0dfcae96384cc40de8390a0ab648765b4508da12c586d55dc981275776507ebca0e4d1bcaa302bb69dcfa31b3451"), hex!("fee0192d49bcc0c28d954763c2cbe739b9265c4bebe3883803c64971220cfda60b9ac99ad986cd908c0534b260b5cfca46f6c2b0f3f21bda")),
417+
];
418+
419+
for (msg, x, y) in MSGS {
420+
let p = ProjectiveMontgomeryXpoint::hash::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
421+
.to_affine();
422+
let mut xx = [0u8; 56];
423+
xx.copy_from_slice(&x[..]);
424+
xx.reverse();
425+
let mut yy = [0u8; 56];
426+
yy.copy_from_slice(&y[..]);
427+
yy.reverse();
428+
assert_eq!(p.0, xx);
429+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
430+
}
431+
}
432+
433+
#[test]
434+
fn encode_with_test_vectors() {
435+
const DST: &[u8] = b"QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_NU_";
436+
const MSGS: &[(&[u8], [u8; 56], [u8; 56])] = &[
437+
(b"", hex!("b65e8dbb279fd656f926f68d463b13ca7a982b32f5da9c7cc58afcf6199e4729863fb75ca9ae3c95c6887d95a5102637a1c5c40ff0aafadc"), hex!("ea1ea211cf29eca11c057fe8248181591a19f6ac51d45843a65d4bb8b71bc83a64c771ed7686218a278ef1c5d620f3d26b53162188645453")),
438+
(b"abc", hex!("51aceca4fa95854bbaba58d8a5e17a86c07acadef32e1188cafda26232131800002cc2f27c7aec454e5e0c615bddffb7df6a5f7f0f14793f"), hex!("c590c9246eb28b08dee816d608ef233ea5d76e305dc458774a1e1bd880387e6734219e2018e4aa50a49486dce0ba8740065da37e6cf5212c")),
439+
(b"abcdef0123456789", hex!("c6d65987f146b8d0cb5d2c44e1872ac3af1f458f6a8bd8c232ffe8b9d09496229a5a27f350eb7d97305bcc4e0f38328718352e8e3129ed71"), hex!("4d2f901bf333fdc4135b954f20d59207e9f6a4ecf88ce5af11c892b44f79766ec4ecc9f60d669b95ca8940f39b1b7044140ac2040c1bf659")),
440+
(b"q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", hex!("9b8d008863beb4a02fb9e4efefd2eba867307fb1c7ce01746115d32e1db551bb254e8e3e4532d5c74a83949a69a60519ecc9178083cbe943"), hex!("346a1fca454d1e67c628437c270ec0f0c4256bb774fe6c0e49de7004ff6d9199e2cd99d8f7575a96aafc4dc8db1811ba0a44317581f41371")),
441+
(b"a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hex!("8746dc34799112d1f20acda9d7f722c9abb29b1fb6b7e9e566983843c20bd7c9bfad21b45c5166b808d2f5d44e188f1fdaf29cdee8a72e4c"), hex!("7c1293484c9287c298a1a0600c64347eee8530acf563cd8705e05728274d8cd8101835f8003b6f3b78b5beb28f5be188a3d7bce1ec5a36b1")),
442+
];
443+
444+
for (msg, x, y) in MSGS {
445+
let p = ProjectiveMontgomeryXpoint::encode::<ExpandMsgXof<Shake256>>(&[msg], &[DST])
446+
.to_affine();
447+
let mut xx = [0u8; 56];
448+
xx.copy_from_slice(&x[..]);
449+
xx.reverse();
450+
let mut yy = [0u8; 56];
451+
yy.copy_from_slice(&y[..]);
452+
yy.reverse();
453+
assert_eq!(p.0, xx);
454+
assert!(p.y(Choice::from(0)) == yy || p.y(Choice::from(1)) == yy);
455+
}
456+
}
337457
}

0 commit comments

Comments
 (0)