Adds decaf group #115

armfazh · 2020-05-15T01:15:44Z

Includes a package for the decaf group.

Decaf is specified https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448-03, this implementation is fully compatible with draft. Test vectors for group operations and hashing to group are passing.

Decaf (circl/group) is a safe group abstraction on top of the Goldilocks (edwards448) curve (circl/ecc/goldilocks).

Ed448 also uses Goldilocks curve but only requires specific operations.

Internally, Goldilocks curve is implemented with ted448, a twist of the curve, since it provides faster point arithmetic.

alxdavids

Mostly looks good to me, most of my comments relate to style.

ecc/goldilocks/decaf.go

ecc/goldilocks/constants.go

ecc/goldilocks/twist.go

sign/ed448/ed448.go

alxdavids · 2020-05-15T08:16:52Z

sign/ed448/ed448.go

-	_ = goldilocks.Curve{}.ScalarBaseMult(s).ToBytes(pair.public[:])
+	P := &goldilocks.Point{}
+	goldilocks.Curve{}.ScalarBaseMult(P, s)
+	enc, _ := P.MarshalBinary()


Error being ignored intentionally?

Encoding always succeeds, but Go's standard MarshalBinary interface doesn't care. Maybe it's worthwhile having a separate PackInto function that writes into a buffer instead of returning it. Saves an allocation and then you don't have an error to confuse people about.

Since this error will not occur, added a panic if it happens. Not the best way to handle this error.
I will consider adding PackInto.

ecc/goldilocks/decaf.go

bwesterb · 2020-05-15T08:51:32Z

ecc/goldilocks/point.go

+	fp.Sub(u, u, &one)             // u = y^2-1
+	fp.Sub(v, v, &one)             // v = dy^2-1
+	isQR := fp.InvSqrt(&P.x, u, v) // x = sqrt(u/v)
+	if !isQR {


This is not constant time.

updated take a look

Looks good.

It might be hard though to write constant time algorithms using this function as it returns an error instead of an int. In go-ristretto I have two variants: Equals and EqualsI. The former returns the idiomatic bool and the latter an int, which allows one to write constant time code.

ecc/goldilocks/twist.go

bwesterb · 2020-05-15T08:53:22Z

ecc/goldilocks/twist.go

 	var isZero int
-	if k.IsZero() {
+	if kk.IsZero() {


Not constant time.

ecc/goldilocks/decaf_test.go

ecc/goldilocks/decaf.go

claucece · 2020-05-16T05:40:55Z

I'll check this tomorrow @armfazh

claucece · 2020-05-18T05:21:53Z

Nice! Have you run it against the vectors of: https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/test/ ?

wbl

We should talk more about where the formulas come from and how to make clear the code matches them.

ecc/goldilocks/constants.go

ecc/goldilocks/twist.go

wbl · 2020-05-20T13:00:26Z

ecc/goldilocks/curve.go

-// Double returns 2P.
-func (Curve) Double(P *Point) *Point { R := *P; R.Double(); return &R }
+// Double calculates R = 2P.
+func (Curve) Double(R, P *Point) { *R = *P; R.Double() }


This is a change to the external API of the package.

ecc/goldilocks/decaf.go

ecc/goldilocks/decaf_test.go

ecc/goldilocks/decaf.go

bwesterb

I'll continue my review next week. I can't concentrate on the maths with this heat wave.

ecc/decaf/constants.go

bwesterb · 2020-08-12T17:48:13Z

ecc/decaf/decaf.go

+func IsValid(a *Elt) bool { return ted448.IsOnCurve(&a.p) }
+
+// Identity returns the identity element of the group.
+func Identity() *Elt { return &Elt{ted448.Identity()} }


I don't think the Go compiler gets rid of the allocation here.

ecc/decaf/decaf.go

internal/ted448/point.go

group/decaf448/decaf.go

internal/ted448/scalar.go

armfazh · 2020-08-26T00:44:48Z

@bwesterb Addressed requested changes.

internal/ted448/scalar.go

claucece · 2020-11-05T21:17:18Z

We should add here the draft-ristretto-decaf test vectors, which is pretty easy as they are the multiplicatives of the generator. We can also add here the one-way-map of the draft. I also did a small implementation here of it: https://github.com/claucece/sage-ristretto255-decaf448 in sage.

ecc/goldilocks/constants.go

claucece · 2020-05-18T05:13:16Z

ecc/goldilocks/decaf.go

+	}
+
+	s := &fp.Elt{}
+	copy(s[:], b[:fp.Size])


Mmm.. is there a reason why this constrain should be enforced b[:fp.Size]?

ecc/goldilocks/decaf.go

chris-wood · 2022-02-01T23:36:50Z

@armfazh what's the plan for this PR?

armfazh · 2022-03-11T04:36:31Z

what's the plan for this PR?

Just pushed changes that update this PR.
Please review: @chris-wood @bwesterb @claucece

bwesterb · 2022-03-16T11:08:56Z

what's the plan for this PR?

It's been a while back, but I believe I haven't gone through all the maths in detail. If you want a detailed review, then I'll need to dedicate a day or two to it. Is there a deadline?

Squashed commit of the following: commit ec347f5 Author: armfazh <armfazh@cloudflare.com> Date: Fri Jul 24 15:28:34 2020 -0700 Adding decaf group. commit 796b37e Author: armfazh <armfazh@cloudflare.com> Date: Wed Jul 22 19:44:07 2020 -0700 Updates internal packages of Ed448. commit f5957e7 Author: armfazh <armfazh@cloudflare.com> Date: Wed Jul 22 19:11:15 2020 -0700 Updating Decaf documentation. commit 6f573e6 Author: armfazh <armfazh@cloudflare.com> Date: Wed Jul 22 13:56:12 2020 -0700 Updating documentation of ted448 internal package. commit 7e80bfc Author: armfazh <armfazh@cloudflare.com> Date: Wed Jun 10 01:56:31 2020 -0700 Adapting ed448 for using the internal ted448 package. commit 44ce6c5 Author: armfazh <armfazh@cloudflare.com> Date: Tue Jun 9 23:36:17 2020 -0700 ted448 point public fields. commit 13dd30d Author: armfazh <armfazh@cloudflare.com> Date: Tue Jun 9 20:32:32 2020 -0700 Moving twist implementation to an internal package. commit 4cdcb71 Author: armfazh <armfazh@cloudflare.com> Date: Mon Jun 1 01:30:22 2020 -0700 Solving scalar constant-time operations. commit 26b9ea4 Author: armfazh <armfazh@cloudflare.com> Date: Thu May 21 09:21:36 2020 -0700 Review comments on formulas. commit ff821b5 Author: armfazh <armfazh@cloudflare.com> Date: Tue May 19 16:54:36 2020 -0700 Adding tests for detecting decaf/point invalid encodings. commit 3881ea8 Author: armfazh <armfazh@cloudflare.com> Date: Fri May 15 15:13:53 2020 -0700 One test for decaf, unmarshaling straight-line code, and check for errors. commit 9b048c0 Author: armfazh <armfazh@cloudflare.com> Date: Thu May 14 18:12:57 2020 -0700 Updating interface for decaf and curve. commit a99153c Author: armfazh <armfazh@cloudflare.com> Date: Thu May 14 16:10:04 2020 -0700 Adding goldilocks documentation. commit a62d6bd Author: armfazh <armfazh@cloudflare.com> Date: Thu May 14 14:15:02 2020 -0700 Adding decaf v1.1 and kat tests. commit c72bdfa Author: armfazh <armfazh@cloudflare.com> Date: Wed May 13 13:30:11 2020 -0700 Removing non-used fp functions. commit d4fc865 Author: armfazh <armfazh@cloudflare.com> Date: Tue May 12 11:47:57 2020 -0700 Adding some helper functions. commit 6173c83 Author: armfazh <armfazh@cloudflare.com> Date: Tue May 12 05:15:55 2020 -0700 Decaf decoding working. More tests needed. commit daa36c1 Author: armfazh <armfazh@cloudflare.com> Date: Mon May 11 16:16:16 2020 -0700 Decaf encoding is working, except by the choice of generator. commit 8933f6c Author: armfazh <armfazh@cloudflare.com> Date: Thu May 7 01:19:47 2020 -0700 Decaf encoding requires cannon sqrt. commit 9479b45 Author: armfazh <armfazh@cloudflare.com> Date: Wed Apr 29 14:51:21 2020 -0700 Adding support for decaf quotient group.

armfazh added the enhancement Improvement over something already in the project label May 15, 2020

armfazh self-assigned this May 15, 2020

armfazh requested review from wbl, alxdavids and bwesterb May 15, 2020 01:16

alxdavids reviewed May 15, 2020

View reviewed changes

bwesterb reviewed May 15, 2020

View reviewed changes

ecc/goldilocks/decaf.go Outdated Show resolved Hide resolved

bwesterb reviewed May 15, 2020

View reviewed changes

ecc/goldilocks/twist.go Outdated Show resolved Hide resolved

bwesterb reviewed May 15, 2020

View reviewed changes

ecc/goldilocks/twist.go Outdated

var isZero int

if k.IsZero() {

if kk.IsZero() {

Copy link

Member

bwesterb May 15, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not constant time.

bwesterb requested changes May 15, 2020

View reviewed changes

ecc/goldilocks/decaf_test.go Outdated Show resolved Hide resolved

armfazh mentioned this pull request May 15, 2020

Plans for decaf/ed448 #101

Open

bwesterb reviewed May 15, 2020

View reviewed changes

ecc/goldilocks/decaf.go Outdated Show resolved Hide resolved

wbl suggested changes May 20, 2020

View reviewed changes

wbl reviewed May 20, 2020

View reviewed changes

ecc/goldilocks/decaf.go Outdated Show resolved Hide resolved

armfazh force-pushed the addDecaf branch from 2a8d115 to 89e0fc6 Compare June 1, 2020 16:32

armfazh force-pushed the addDecaf branch 2 times, most recently from 93a4a24 to c97b01e Compare June 10, 2020 08:58

armfazh requested review from bwesterb and chris-wood June 10, 2020 09:20

armfazh force-pushed the addDecaf branch 2 times, most recently from f120857 to ec347f5 Compare July 24, 2020 22:29

armfazh added changesAPI PR changes the API of a package new feature New functionality or module and removed enhancement Improvement over something already in the project labels Jul 24, 2020

armfazh force-pushed the addDecaf branch from ec347f5 to 87b9a72 Compare July 24, 2020 23:08

armfazh requested review from wbl and alxdavids July 24, 2020 23:19

armfazh linked an issue Jul 24, 2020 that may be closed by this pull request

Plans for decaf/ed448 #101

Open

bwesterb reviewed Aug 12, 2020

View reviewed changes

bwesterb reviewed Aug 19, 2020

View reviewed changes

armfazh force-pushed the addDecaf branch from cd17de3 to 3f3c87b Compare August 26, 2020 00:29

armfazh requested a review from bwesterb August 26, 2020 00:44

bwesterb reviewed Aug 26, 2020

View reviewed changes

internal/ted448/scalar.go Outdated Show resolved Hide resolved

claucece reviewed Nov 5, 2020

View reviewed changes

wbl requested review from tanyav2 and removed request for alxdavids April 23, 2021 22:34

mmcloughlin mentioned this pull request May 3, 2021

doc: users list mmcloughlin/addchain#93

Open

armfazh force-pushed the addDecaf branch from e375be0 to bfdf09d Compare March 11, 2022 04:35

armfazh requested review from bwesterb and claucece and removed request for wbl March 11, 2022 04:36

armfazh added 6 commits June 3, 2022 12:49

Returning int instead of bool in fp448 predicates.

c8c168a

Using exponentiation of inverting scalars.

9679bf8

Fixing sha3 import paths.

65407fe

Addition chain for scalar exponentiation.

45008f1

Completing the Group interface and hash to curve.

3bf0eae

armfazh force-pushed the addDecaf branch from bfdf09d to 3bf0eae Compare June 3, 2022 19:54

armfazh requested review from cjpatton and removed request for chris-wood, tanyav2 and claucece January 19, 2024 23:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds decaf group #115

Adds decaf group #115

armfazh commented May 15, 2020 •

edited

alxdavids left a comment

alxdavids May 15, 2020

bwesterb May 15, 2020

armfazh May 15, 2020

bwesterb May 15, 2020

armfazh May 15, 2020

bwesterb May 15, 2020

bwesterb May 15, 2020

bwesterb May 15, 2020

claucece commented May 16, 2020

claucece commented May 18, 2020

wbl left a comment

wbl May 20, 2020

bwesterb left a comment •

edited

bwesterb Aug 12, 2020

armfazh commented Aug 26, 2020

claucece commented Nov 5, 2020

claucece May 18, 2020

chris-wood commented Feb 1, 2022

armfazh commented Mar 11, 2022

bwesterb commented Mar 16, 2022

Adds decaf group #115

Are you sure you want to change the base?

Adds decaf group #115

Conversation

armfazh commented May 15, 2020 • edited

alxdavids left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

claucece commented May 16, 2020

claucece commented May 18, 2020

wbl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bwesterb left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

armfazh commented Aug 26, 2020

claucece commented Nov 5, 2020

Choose a reason for hiding this comment

chris-wood commented Feb 1, 2022

armfazh commented Mar 11, 2022

bwesterb commented Mar 16, 2022

armfazh commented May 15, 2020 •

edited

bwesterb left a comment •

edited