Go to file

Sean Bowe 6e186d12ee Add get_u/get_v methods.		2019-01-07 11:59:03 -07:00
benches	Implementation of most of the point arithmetic API.	2019-01-05 21:45:25 -07:00
doc	Don't check in parsed Sagemath files	2018-08-29 19:03:23 -06:00
src	Add get_u/get_v methods.	2019-01-07 11:59:03 -07:00
.gitignore	Initial commit	2018-08-29 12:00:11 -06:00
COPYRIGHT	Initial commit	2018-08-29 12:00:11 -06:00
Cargo.toml	Update to subtle 2.0	2019-01-06 22:54:43 -07:00
LICENSE-APACHE	Initial commit	2018-08-29 12:00:11 -06:00
LICENSE-MIT	Initial commit	2018-08-29 12:00:11 -06:00
README.md	Improve clarify of README	2018-10-12 12:22:49 -06:00
RELEASES.md	Add (blank) RELEASES.md file.	2018-09-02 07:44:47 -06:00

README.md

jubjub

This is a pure Rust implementation of the Jubjub elliptic curve group and its associated fields.

This implementation has not been reviewed or audited. Use at your own risk.
This implementation targets Rust 1.28 or later.
All operations are constant time unless explicitly noted.

Features

std (on by default): Enables APIs that leverage the Rust standard library.
nightly: Enables subtle/nightly which prevents compiler optimizations that could jeopardize constant time operations.

Documentation

Curve Description

Jubjub is the twisted Edwards curve -u^2 + v^2 = 1 + d.u^2.v^2 of rational points over GF(q) with a subgroup of prime order r and cofactor 8.

q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
d = -(10240/10241)

The choice of GF(q) is made to be the scalar field of the BLS12-381 elliptic curve construction.

Jubjub is birationally equivalent to a Montgomery curve y^2 = x^3 + Ax^2 + x over the same field with A = 40962. This value of A is the smallest integer such that (A - 2) / 4 is a small integer, A^2 - 4 is nonsquare in GF(q), and the Montgomery curve and its quadratic twist have small cofactors 8 and 4, respectively. This is identical to the relationship between Curve25519 and ed25519.

Please see ./doc/evidence/ for supporting evidence that Jubjub meets the SafeCurves criteria. The tool in ./doc/derive/ will derive the curve parameters via the above criteria to demonstrate rigidity.

Acknowledgements

Jubjub was designed by Sean Bowe. Daira Hopwood is responsible for its name and specification. The security evidence in ./doc/evidence/ is the product of Daira Hopwood and based on SafeCurves by Daniel J. Bernstein and Tanja Lange. Peter Newell and Daira Hopwood are responsible for the Jubjub bird image.

Please see Cargo.toml for a list of primary authors of this codebase.

License

Licensed under either of

Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.