Add ed448

Cargo.toml

@@ -10,6 +10,7 @@ members = [
     "p256",
     "p384",
     "p521",
+    "ed448",
     "primefield",
     "primeorder",
     "sm2"

ed448/Cargo.toml

@@ -0,0 +1,45 @@
+[package]
+authors = ["RustCrypto Developers"]
+categories = ["cryptography"]
+description = """A pure-Rust implementation of Ed448 and Curve448 and Decaf.
+This crate also includes signing and verifying of Ed448 signatures.
+"""
+documentation = "https://docs.rs/ed448-goldilocks"
+exclude = [".gitignore", ".github/*"]
+edition = "2021"
+homepage = "https://docs.rs/ed448-goldilocks/"
+keywords = ["cryptography", "decaf", "ed448", "ed448-goldilocks"]
+license = "BSD-3-Clause"
+name = "ed448-goldilocks"
+readme = "README.md"
+repository = "https://github.com/RustCrypto/elliptic-curves/tree/master/ed448"
+version = "0.15.0"
+
+[dependencies]
+crypto-bigint = { version = "0.5.5", features = ["generic-array"], default-features = false }
+elliptic-curve = { version = "0.13", features = ["arithmetic", "bits", "hash2curve", "hazmat", "jwk", "pkcs8", "pem", "sec1"] }
+pkcs8 = { version = "0.10", optional = true }
+rand_core = { version = "0.6", default-features = false }
+serdect = { version = "0.3.0", optional = true }
+sha3 = { version = "0.10", default-features = false }
+crypto_signature = { version = "2.2", default-features = false, features = ["digest", "rand_core"], optional = true, package = "signature" }
+subtle = { version = "2.6", default-features = false }
+zeroize = { version = "1.8", default-features = false, optional = true }
+
+[features]
+default = ["std", "signing", "pkcs8"]
+alloc = ["serdect/alloc", "zeroize/alloc"]
+pkcs8 = ["dep:pkcs8"]
+signing = ["dep:crypto_signature", "zeroize"]
+serde = ["dep:serdect"]
+std = ["serdect/default", "zeroize/default", "crypto_signature/std"]
+zeroize = ["dep:zeroize"]
+
+[dev-dependencies]
+hex-literal = "0.4"
+hex = "0.4"
+elliptic-curve-tools = "0.1.2"
+rand_core = { version = "0.6", features = ["std"] }
+rand_chacha = "0.3"
+serde_bare = "0.5"
+serde_json = "1.0"

ed448/README.md

@@ -0,0 +1,91 @@
+<p align="center">
+<img src="resources/bear.png" width = "400">
+</p>
+
+ed448-goldilocks-plus 
+
+[![Crate][crate-image]][crate-link]
+[![Docs][docs-image]][docs-link]
+![BSD-3 Licensed][license-image]
+
+THIS CODE HAS NOT BEEN AUDITED OR REVIEWED. USE AT YOUR OWN RISK.
+
+## Field Choice
+
+The field size is a Solinas trinomial prime 2^448 - 2^224 -1. This prime is called the Goldilocks prime.
+
+## Curves
+
+This repository implements three curves explicitly and another curve implicitly.
+
+The three explicitly implemented curves are:
+
+- Ed448-Goldilocks
+
+- Curve448
+
+- Twisted-Goldilocks
+
+
+## Ed448-Goldilocks Curve
+
+- The goldilocks curve is an Edwards curve with affine equation x^2 + y^2 = 1 - 39081x^2y^2 .
+- This curve was defined by Mike Hamburg in https://eprint.iacr.org/2015/625.pdf . 
+- The cofactor of this curve over the goldilocks prime is 4.
+
+## Twisted-Goldilocks Curve
+
+- The twisted goldilocks curve is a Twisted Edwards curve with affine equation y^2 - x^2 = 1 - 39082x^2y^2 .
+- This curve is also defined in https://eprint.iacr.org/2015/625.pdf .
+- The cofactor of this curve over the goldilocks prime is 4.
+
+### Isogeny
+
+- This curve is 2-isogenous to Ed448-Goldilocks. Details of the isogeny can be found here: https://www.shiftleft.org/papers/isogeny/isogeny.pdf
+
+## Curve448
+
+This curve is 2-isogenous to Ed448-Goldilocks. Details of Curve448 can be found here: https://tools.ietf.org/html/rfc7748
+
+The main usage of this curve is for X448.
+
+N.B. In that document there is an Edwards curve that is birationally equivalent to Curve448, with a large `d` value. This curve is not implemented and to my knowledge, has no utility.
+
+## Strategy
+
+The main strategy for group arithmetic on Ed448-Goldilocks is to perform the 2-isogeny to map the point to the Twisted-Goldilocks curve, then use the faster Twisted Edwards formulas to perform scalar multiplication. Computing the 2-isogeny then the dual isogeny will pick up a factor of 4 once we map the point back to the Ed448-Goldilocks curve, so the scalar must be adjusted by a factor of 4. Adjusting the scalar is dependent on the point and the scalar. More details can be found in the 2-isogenous paper.
+
+# Decaf
+
+The Decaf strategy [link paper] is used to build a group of prime order from the Twisted Goldilocks curve. The Twisted Goldilocks curve is used as it has faster formulas. We can also use Curve448 or Ed448-Goldilocks. Decaf takes advantage of an isogeny with a Jacobi Quartic curve which is not explicitly defined. Details of this can be found here: https://www.shiftleft.org/papers/decaf/decaf.pdf However, to my knowledge there is no documentation for the Decaf protocol implemented in this repository, which is a tweaked version of the original decaf protocol linked in the paper.
+
+## Completed Point vs Extensible Point
+
+Deviating from Curve25519-Dalek, this library will implement Extensible points instead of Completed Points. Due to the following observation:
+
+- There is a cost of 3/4 Field multiplications to switch from the CompletedPoint. So if we were to perform repeated doubling, this would add an extra cost for each doubling in projective form. More details on the ExtensiblePoint can be found here [3.2]: https://www.shiftleft.org/papers/fff/fff.pdf
+
+## Credits
+
+The library design was taken from Dalek's design of Curve25519. The code for Montgomery curve arithmetic was also taken from Dalek's library.
+
+The golang implementation of Ed448 and libdecaf were used as references.
+
+Special thanks to Mike Hamburg for answering all the questions asked regarding Decaf and goldilocks.
+
+This library adds [hash_to_curve](https://datatracker.ietf.org/doc/rfc9380/) and serialization of structs.
+
+## Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the BSD-3-Clause
+license, shall be dual licensed as above, without any additional terms or
+conditions.
+
+[//]: # (badges)
+
+[crate-image]: https://img.shields.io/crates/v/ed448-goldilocks-plus.svg
+[crate-link]: https://crates.io/crates/ed448-goldilocks-plus
+[docs-image]: https://docs.rs/ed448-goldilocks-plus/badge.svg
+[docs-link]: https://docs.rs/ed448-goldilocks-plus/
+[license-image]: https://img.shields.io/badge/License-BSD%203--Clause-blue.svg

ed448/rustfmt.toml

@@ -0,0 +1,5 @@
+newline_style = "Unix"
+use_field_init_shorthand = true
+reorder_imports = true
+reorder_modules = true
+reorder_impl_items = true

ed448/src/constants.rs

@@ -0,0 +1,18 @@
+use crate::*;
+use crate::{decaf::DecafPoint, Scalar};
+
+pub const DECAF_BASEPOINT: DecafPoint = DecafPoint(curve::twedwards::extended::ExtendedPoint {
+    X: TWISTED_EDWARDS_BASE_POINT.X,
+    Y: TWISTED_EDWARDS_BASE_POINT.Y,
+    Z: TWISTED_EDWARDS_BASE_POINT.Z,
+    T: TWISTED_EDWARDS_BASE_POINT.T,
+});
+
+/// `BASEPOINT_ORDER` is the order of the Ed448 basepoint, i.e.,
+/// $$
+/// \ell = 2^\{446\} + 0x8335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d.
+/// $$
+pub const BASEPOINT_ORDER: Scalar = Scalar([
+    0xab5844f3, 0x2378c292, 0x8dc58f55, 0x216cc272, 0xaed63690, 0xc44edb49, 0x7cca23e9, 0xffffffff,
+    0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3fffffff,
+]);

ed448/src/curve.rs

@@ -0,0 +1,7 @@
+pub mod edwards;
+pub mod montgomery;
+pub(crate) mod scalar_mul;
+pub(crate) mod twedwards;
+
+pub use edwards::{AffinePoint, CompressedEdwardsY, EdwardsPoint};
+pub use montgomery::{MontgomeryPoint, ProjectiveMontgomeryPoint};

ed448/src/curve/edwards.rs

@@ -0,0 +1,15 @@
+/// This module contains the code for the Goldilocks curve.
+/// The goldilocks curve is the (untwisted) Edwards curve with affine equation x^2 + y^2 = 1 - 39081x^2y^2
+/// Scalar Multiplication for this curve is pre-dominantly delegated to the Twisted Edwards variation using a (doubling) isogeny
+/// Passing the point back to the Goldilocks curve using the dual-isogeny clears the cofactor.
+/// The small remainder of the Scalar Multiplication is computed on the untwisted curve.
+/// See <https://www.shiftleft.org/papers/isogeny/isogeny.pdf> for details
+///
+/// This isogeny strategy does not clear the cofactor on the Goldilocks curve unless the Scalar is a multiple of 4.
+/// or the point is known to be in the q-torsion subgroup.
+/// Hence, one will need to multiply by the cofactor to ensure it is cleared when using the Goldilocks curve.
+/// If this is a problem, one can use a different isogeny strategy (Decaf/Ristretto)
+pub(crate) mod affine;
+pub(crate) mod extended;
+pub use affine::AffinePoint;
+pub use extended::{CompressedEdwardsY, EdwardsPoint};

ed448/src/curve/edwards/affine.rs

@@ -0,0 +1,117 @@
+use crate::curve::edwards::EdwardsPoint;
+use crate::field::FieldElement;
+use crate::*;
+use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
+
+#[cfg(feature = "zeroize")]
+use zeroize::DefaultIsZeroes;
+
+/// Affine point on untwisted curve
+#[derive(Copy, Clone, Debug)]
+pub struct AffinePoint {
+    pub(crate) x: FieldElement,
+    pub(crate) y: FieldElement,
+}
+
+impl Default for AffinePoint {
+    fn default() -> Self {
+        Self::IDENTITY
+    }
+}
+
+impl ConstantTimeEq for AffinePoint {
+    fn ct_eq(&self, other: &Self) -> Choice {
+        self.x.ct_eq(&other.x) & self.y.ct_eq(&other.y)
+    }
+}
+
+impl ConditionallySelectable for AffinePoint {
+    fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
+        Self {
+            x: FieldElement::conditional_select(&a.x, &b.x, choice),
+            y: FieldElement::conditional_select(&a.y, &b.y, choice),
+        }
+    }
+}
+
+impl PartialEq for AffinePoint {
+    fn eq(&self, other: &Self) -> bool {
+        self.ct_eq(other).into()
+    }
+}
+
+impl Eq for AffinePoint {}
+
+impl elliptic_curve::point::AffineCoordinates for AffinePoint {
+    type FieldRepr = Ed448FieldBytes;
+
+    fn x(&self) -> Self::FieldRepr {
+        Ed448FieldBytes::clone_from_slice(&self.x.to_bytes())
+    }
+
+    fn y_is_odd(&self) -> Choice {
+        self.y.is_negative()
+    }
+}
+
+#[cfg(feature = "zeroize")]
+impl DefaultIsZeroes for AffinePoint {}
+
+impl AffinePoint {
+    /// The identity point
+    pub const IDENTITY: AffinePoint = AffinePoint {
+        x: FieldElement::ZERO,
+        y: FieldElement::ONE,
+    };
+
+    pub(crate) fn isogeny(&self) -> Self {
+        let x = self.x;
+        let y = self.y;
+        let mut t0 = x.square(); // x^2
+        let t1 = t0 + FieldElement::ONE; // x^2+1
+        t0 -= FieldElement::ONE; // x^2-1
+        let mut t2 = y.square(); // y^2
+        t2 = t2.double(); // 2y^2
+        let t3 = x.double(); // 2x
+
+        let mut t4 = t0 * y; // y(x^2-1)
+        t4 = t4.double(); // 2y(x^2-1)
+        let xNum = t4.double(); // xNum = 4y(x^2-1)
+
+        let mut t5 = t0.square(); // x^4-2x^2+1
+        t4 = t5 + t2; // x^4-2x^2+1+2y^2
+        let xDen = t4 + t2; // xDen = x^4-2x^2+1+4y^2
+
+        t5 *= x; // x^5-2x^3+x
+        t4 = t2 * t3; // 4xy^2
+        let yNum = t4 - t5; // yNum = -(x^5-2x^3+x-4xy^2)
+
+        t4 = t1 * t2; // 2x^2y^2+2y^2
+        let yDen = t5 - t4; // yDen = x^5-2x^3+x-2x^2y^2-2y^2
+
+        Self {
+            x: xNum * xDen.invert(),
+            y: yNum * yDen.invert(),
+        }
+    }
+
+    /// Convert to edwards extended point
+    pub fn to_edwards(&self) -> EdwardsPoint {
+        EdwardsPoint {
+            X: self.x,
+            Y: self.y,
+            Z: FieldElement::ONE,
+            T: self.x * self.y,
+        }
+    }
+
+    /// The X coordinate
+    pub fn x(&self) -> [u8; 56] {
+        self.x.to_bytes()
+    }
+
+    /// The Y coordinate
+    pub fn y(&self) -> [u8; 56] {
+        self.y.to_bytes()
+    }
+}