Go to file
Henry de Valence b12ceb5623 Nit: change wording on use of the subtle crate.
It's not that the crate is relying on `subtle` to perform constant-time
arithmetic, because the arithmetic implementations are done in this crate and
it's the fact that they're implemented in a constant-time way that's important.
Using subtle helps with constant-time operations but it is not enough, and
changing the wording of that sentence clarifies that.

(This is a nit).
2019-11-27 11:03:44 -08:00
.github/workflows Check no-std compatibility 2019-11-14 13:31:25 +00:00
benches Fix benchmarks 2019-03-31 23:17:24 -06:00
doc Don't check in parsed Sagemath files 2018-08-29 19:03:23 -06:00
src Nit: change wording on use of the subtle crate. 2019-11-27 11:03:44 -08:00
tests Change various into_bytes to to_bytes. 2019-05-31 19:47:56 -06:00
.gitignore Initial commit 2018-08-29 12:00:11 -06:00
COPYRIGHT Initial commit 2018-08-29 12:00:11 -06:00
Cargo.toml Remove nightly advice for subtle. 2019-11-27 11:01:05 -08:00
LICENSE-APACHE Initial commit 2018-08-29 12:00:11 -06:00
LICENSE-MIT Initial commit 2018-08-29 12:00:11 -06:00
README.md Remove nightly advice for subtle. 2019-11-27 11:01:05 -08:00
RELEASES.md Bump version to 0.2.0 2019-06-03 12:23:33 -06:00

README.md

jubjub Crates.io

This is a pure Rust implementation of the Jubjub elliptic curve group and its associated fields.

  • This implementation has not been reviewed or audited. Use at your own risk.
  • This implementation targets Rust 1.33 or later.
  • All operations are constant time unless explicitly noted.

Features

  • std (on by default): Enables APIs that leverage the Rust standard library.

Documentation

Curve Description

Jubjub is the twisted Edwards curve -u^2 + v^2 = 1 + d.u^2.v^2 of rational points over GF(q) with a subgroup of prime order r and cofactor 8.

q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
d = -(10240/10241)

The choice of GF(q) is made to be the scalar field of the BLS12-381 elliptic curve construction.

Jubjub is birationally equivalent to a Montgomery curve y^2 = x^3 + Ax^2 + x over the same field with A = 40962. This value of A is the smallest integer such that (A - 2) / 4 is a small integer, A^2 - 4 is nonsquare in GF(q), and the Montgomery curve and its quadratic twist have small cofactors 8 and 4, respectively. This is identical to the relationship between Curve25519 and ed25519.

Please see ./doc/evidence/ for supporting evidence that Jubjub meets the SafeCurves criteria. The tool in ./doc/derive/ will derive the curve parameters via the above criteria to demonstrate rigidity.

Acknowledgements

Jubjub was designed by Sean Bowe. Daira Hopwood is responsible for its name and specification. The security evidence in ./doc/evidence/ is the product of Daira Hopwood and based on SafeCurves by Daniel J. Bernstein and Tanja Lange. Peter Newell and Daira Hopwood are responsible for the Jubjub bird image.

Please see Cargo.toml for a list of primary authors of this codebase.

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.