You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
str4d 38d38af3b7
Merge pull request #32 from kevaundray/patch-1
3 years ago
.github/workflows Replace Fq implementation with bls12_381::Scalar 4 years ago
benches Fix benchmarks 4 years ago
doc Don't check in parsed Sagemath files 5 years ago
src Merge pull request #32 from kevaundray/patch-1 3 years ago
tests Change various into_bytes to to_bytes. 4 years ago
.gitignore Initial commit 5 years ago
COPYRIGHT Initial commit 5 years ago
Cargo.toml Bump version to 0.3 4 years ago
LICENSE-APACHE Initial commit 5 years ago
LICENSE-MIT Initial commit 5 years ago Remove the std feature. 4 years ago Bump version to 0.3 4 years ago


This is a pure Rust implementation of the Jubjub elliptic curve group and its associated fields.

  • This implementation has not been reviewed or audited. Use at your own risk.
  • This implementation targets Rust 1.36 or later.
  • All operations are constant time unless explicitly noted.
  • This implementation does not require the Rust standard library.


Curve Description

Jubjub is the twisted Edwards curve -u^2 + v^2 = 1 + d.u^2.v^2 of rational points over GF(q) with a subgroup of prime order r and cofactor 8.

q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
d = -(10240/10241)

The choice of GF(q) is made to be the scalar field of the BLS12-381 elliptic curve construction.

Jubjub is birationally equivalent to a Montgomery curve y^2 = x^3 + Ax^2 + x over the same field with A = 40962. This value of A is the smallest integer such that (A - 2) / 4 is a small integer, A^2 - 4 is nonsquare in GF(q), and the Montgomery curve and its quadratic twist have small cofactors 8 and 4, respectively. This is identical to the relationship between Curve25519 and ed25519.

Please see ./doc/evidence/ for supporting evidence that Jubjub meets the SafeCurves criteria. The tool in ./doc/derive/ will derive the curve parameters via the above criteria to demonstrate rigidity.


Jubjub was designed by Sean Bowe. Daira Hopwood is responsible for its name and specification. The security evidence in ./doc/evidence/ is the product of Daira Hopwood and based on SafeCurves by Daniel J. Bernstein and Tanja Lange. Peter Newell and Daira Hopwood are responsible for the Jubjub bird image.

Please see Cargo.toml for a list of primary authors of this codebase.


Licensed under either of

at your option.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.