Use untwisted Edwards Curve for Ed448 scalar multiplication

ed448-goldilocks/Cargo.toml

@@ -37,9 +37,14 @@ signing = ["dep:ed448", "dep:signature"]
 serde = ["dep:serdect", "ed448?/serde_bytes"]
 
 [dev-dependencies]
+criterion = { version = "0.7", default-features = false, features = ["cargo_bench_support"] }
 hex-literal = "1"
 hex = "0.4"
 rand_core = { version = "0.9", features = ["os_rng"] }
 rand_chacha = "0.9"
 serde_bare = "0.5"
 serde_json = "1.0"
+
+[[bench]]
+harness = false
+name = "bench"

ed448-goldilocks/benches/bench.rs

@@ -0,0 +1,181 @@
+use criterion::{BatchSize, Criterion, criterion_group, criterion_main};
+use ed448_goldilocks::{
+    CompressedDecaf, CompressedEdwardsY, Decaf448, DecafPoint, DecafScalar, EdwardsPoint,
+    EdwardsScalar, MontgomeryPoint,
+};
+use elliptic_curve::{Field, Group};
+use hash2curve::{ExpandMsgXof, GroupDigest};
+use rand_core::{OsRng, TryRngCore};
+use sha3::Shake256;
+
+pub fn ed448(c: &mut Criterion) {
+    let mut group = c.benchmark_group("Ed448");
+
+    group.bench_function("scalar multiplication", |b| {
+        b.iter_batched(
+            || {
+                let point = EdwardsPoint::try_from_rng(&mut OsRng).unwrap();
+                let scalar = EdwardsScalar::try_from_rng(&mut OsRng).unwrap();
+                (point, scalar)
+            },
+            |(point, scalar)| point * scalar,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("point addition", |b| {
+        b.iter_batched(
+            || {
+                let p1 = EdwardsPoint::try_from_rng(&mut OsRng).unwrap();
+                let p2 = EdwardsPoint::try_from_rng(&mut OsRng).unwrap();
+                (p1, p2)
+            },
+            |(p1, p2)| p1 + p2,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("hash_to_curve", |b| {
+        b.iter_batched(
+            || {
+                let mut msg = [0; 64];
+                OsRng.try_fill_bytes(&mut msg).unwrap();
+                msg
+            },
+            |msg| EdwardsPoint::hash_with_defaults(&msg),
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("encode_to_curve", |b| {
+        b.iter_batched(
+            || {
+                let mut msg = [0; 64];
+                OsRng.try_fill_bytes(&mut msg).unwrap();
+                msg
+            },
+            |msg| EdwardsPoint::encode_with_defaults(&msg),
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("compress", |b| {
+        b.iter_batched(
+            || EdwardsPoint::try_from_rng(&mut OsRng).unwrap(),
+            |point| point.compress().0,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("decompress", |b| {
+        b.iter_batched(
+            || EdwardsPoint::try_from_rng(&mut OsRng).unwrap().compress().0,
+            |bytes| CompressedEdwardsY(bytes).decompress().unwrap(),
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.finish();
+}
+
+pub fn decaf448(c: &mut Criterion) {
+    let mut group = c.benchmark_group("Decaf448");
+
+    group.bench_function("scalar multiplication", |b| {
+        b.iter_batched(
+            || {
+                let point = DecafPoint::try_from_rng(&mut OsRng).unwrap();
+                let scalar = DecafScalar::try_from_rng(&mut OsRng).unwrap();
+                (point, scalar)
+            },
+            |(point, scalar)| point * scalar,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("point addition", |b| {
+        b.iter_batched(
+            || {
+                let p1 = DecafPoint::try_from_rng(&mut OsRng).unwrap();
+                let p2 = DecafPoint::try_from_rng(&mut OsRng).unwrap();
+                (p1, p2)
+            },
+            |(p1, p2)| p1 + p2,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("hash_to_curve", |b| {
+        b.iter_batched(
+            || {
+                let mut msg = [0; 64];
+                OsRng.try_fill_bytes(&mut msg).unwrap();
+                msg
+            },
+            |msg| {
+                Decaf448::hash_from_bytes::<ExpandMsgXof<Shake256>>(
+                    &[&msg],
+                    &[b"decaf448_XOF:SHAKE256_D448MAP_RO_"],
+                )
+            },
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("encode_to_curve", |b| {
+        b.iter_batched(
+            || {
+                let mut msg = [0; 64];
+                OsRng.try_fill_bytes(&mut msg).unwrap();
+                msg
+            },
+            |msg| {
+                Decaf448::encode_from_bytes::<ExpandMsgXof<Shake256>>(
+                    &[&msg],
+                    &[b"decaf448_XOF:SHAKE256_D448MAP_NU_"],
+                )
+            },
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("compress", |b| {
+        b.iter_batched(
+            || DecafPoint::try_from_rng(&mut OsRng).unwrap(),
+            |point| point.compress().0,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.bench_function("decompress", |b| {
+        b.iter_batched(
+            || DecafPoint::try_from_rng(&mut OsRng).unwrap().compress().0,
+            |bytes| CompressedDecaf(bytes).decompress().unwrap(),
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.finish();
+}
+
+pub fn curve448(c: &mut Criterion) {
+    let mut group = c.benchmark_group("Curve448");
+
+    group.bench_function("scalar multiplication", |b| {
+        b.iter_batched(
+            || {
+                let mut point = MontgomeryPoint::default();
+                OsRng.try_fill_bytes(&mut point.0).unwrap();
+                let scalar = EdwardsScalar::try_from_rng(&mut OsRng).unwrap();
+                (point, scalar)
+            },
+            |(point, scalar)| &point * &scalar,
+            BatchSize::SmallInput,
+        )
+    });
+
+    group.finish();
+}
+
+criterion_group!(benches, ed448, decaf448, curve448);
+criterion_main!(benches);

ed448-goldilocks/src/curve/scalar_mul.rs

@@ -1,7 +1,5 @@
-pub(crate) mod double_and_add;
 // pub(crate) mod double_base;
 pub(crate) mod variable_base;
 pub(crate) mod window;
 
-pub(crate) use double_and_add::double_and_add;
 pub(crate) use variable_base::variable_base;

ed448-goldilocks/src/curve/scalar_mul/variable_base.rs

@@ -1,11 +1,12 @@
 #![allow(non_snake_case)]
 
 use super::window::wnaf::LookupTable;
-use crate::EdwardsScalar;
+use crate::Scalar;
 use crate::curve::twedwards::{extended::ExtendedPoint, extensible::ExtensiblePoint};
+use crate::field::CurveWithScalar;
 use subtle::{Choice, ConditionallyNegatable};
 
-pub fn variable_base(point: &ExtendedPoint, s: &EdwardsScalar) -> ExtendedPoint {
+pub fn variable_base<C: CurveWithScalar>(point: &ExtendedPoint, s: &Scalar<C>) -> ExtensiblePoint {
     let mut result = ExtensiblePoint::IDENTITY;
 
     // Recode Scalar
@@ -28,21 +29,39 @@ pub fn variable_base(point: &ExtendedPoint, s: &EdwardsScalar) -> ExtendedPoint
         let mut neg_P = lookup.select(abs_value);
         neg_P.conditional_negate(Choice::from((sign) as u8));
 
-        result = result.add_projective_niels(&neg_P);
+        result = result.to_extended().add_projective_niels(&neg_P);
     }
 
-    result.to_extended()
+    result
 }
 
 #[cfg(test)]
 mod test {
     use super::*;
+    use crate::EdwardsScalar;
     use crate::TWISTED_EDWARDS_BASE_POINT;
-    use crate::curve::scalar_mul::double_and_add;
     use elliptic_curve::bigint::U448;
+    use subtle::ConditionallySelectable;
 
     #[test]
     fn test_scalar_mul() {
+        /// Traditional double and add algorithm
+        fn double_and_add(point: &ExtendedPoint, s_bits: [bool; 448]) -> ExtensiblePoint {
+            let mut result = ExtensiblePoint::IDENTITY;
+
+            // NB, we reverse here, so we are going from MSB to LSB
+            // XXX: Would be great if subtle had a From<u32> for Choice. But maybe that is not it's purpose?
+            for bit in s_bits.into_iter().rev() {
+                result = result.double();
+                result.conditional_assign(
+                    &result.to_extended().add_extended(point),
+                    Choice::from(u8::from(bit)),
+                );
+            }
+
+            result
+        }
+
         // XXX: In the future use known multiples from Sage in bytes form?
         let twisted_point = TWISTED_EDWARDS_BASE_POINT;
         let scalar = EdwardsScalar::new(U448::from_be_hex(
@@ -55,7 +74,7 @@ mod test {
         assert_eq!(got, got2);
 
         // Lets see if this is conserved over the isogenies
-        let edwards_point = twisted_point.to_untwisted();
+        let edwards_point = twisted_point.to_extensible().to_untwisted();
         let got_untwisted_point = edwards_point.scalar_mul(&scalar);
         let expected_untwisted_point = got.to_untwisted();
         assert_eq!(got_untwisted_point, expected_untwisted_point);
@@ -69,9 +88,8 @@ mod test {
         let exp = variable_base(&x, &EdwardsScalar::from(1u8));
         assert!(x == exp);
         // Test that 2 * (P + P) = 4 * P
-        let x_ext = x.to_extensible();
-        let expected_two_x = x_ext.add_extensible(&x_ext).double();
+        let expected_two_x = x.add_extended(&x).double();
         let got = variable_base(&x, &EdwardsScalar::from(4u8));
-        assert!(expected_two_x.to_extended() == got);
+        assert!(expected_two_x == got);
     }
 }

ed448-goldilocks/src/curve/scalar_mul/window/wnaf.rs

@@ -6,13 +6,14 @@ pub struct LookupTable([ProjectiveNielsPoint; 8]);
 
 /// Precomputes odd multiples of the point passed in
 impl From<&ExtendedPoint> for LookupTable {
-    fn from(point: &ExtendedPoint) -> LookupTable {
-        let P = point.to_extensible();
-
+    fn from(P: &ExtendedPoint) -> LookupTable {
         let mut table = [P.to_projective_niels(); 8];
 
         for i in 1..8 {
-            table[i] = P.add_projective_niels(&table[i - 1]).to_projective_niels();
+            table[i] = P
+                .add_projective_niels(&table[i - 1])
+                .to_extended()
+                .to_projective_niels();
         }
 
         LookupTable(table)
@@ -22,7 +23,7 @@ impl From<&ExtendedPoint> for LookupTable {
 impl LookupTable {
     /// Selects a projective niels point from a lookup table in constant time
     pub fn select(&self, index: u32) -> ProjectiveNielsPoint {
-        let mut result = ProjectiveNielsPoint::identity();
+        let mut result = ProjectiveNielsPoint::IDENTITY;
 
         for i in 1..9 {
             let swap = index.ct_eq(&(i as u32));
@@ -42,11 +43,8 @@ fn test_lookup() {
     let mut expected_point = ExtendedPoint::IDENTITY;
     for i in 0..8 {
         let selected_point = points.select(i);
-        assert_eq!(selected_point.to_extended(), expected_point);
+        assert_eq!(selected_point.to_extensible(), expected_point);
 
-        expected_point = expected_point
-            .to_extensible()
-            .add_extended(&p)
-            .to_extended();
+        expected_point = expected_point.add_extended(&p).to_extended();
     }
 }

ed448-goldilocks/src/curve/twedwards/affine.rs

@@ -121,13 +121,14 @@ impl AffineNielsPoint {
             && (self.td == other.td)
     }
 
-    /// Converts an AffineNielsPoint to an ExtendedPoint
-    pub(crate) fn to_extended(self) -> ExtendedPoint {
-        ExtendedPoint {
+    /// Converts an AffineNielsPoint to an ExtensiblePoint
+    pub(crate) fn to_extensible(self) -> ExtensiblePoint {
+        ExtensiblePoint {
             X: self.y_plus_x - self.y_minus_x,
             Y: self.y_minus_x + self.y_plus_x,
             Z: FieldElement::ONE,
-            T: self.y_plus_x * self.y_minus_x,
+            T1: self.y_plus_x,
+            T2: self.y_minus_x,
         }
     }
 }
@@ -140,7 +141,7 @@ mod tests {
     #[test]
     fn test_negation() {
         use crate::TWISTED_EDWARDS_BASE_POINT;
-        let a = TWISTED_EDWARDS_BASE_POINT.to_affine();
+        let a = TWISTED_EDWARDS_BASE_POINT.to_extensible().to_affine();
         assert!(a.is_on_curve());
 
         let neg_a = a.negate();