Squashed 'jubjub/' content from commit 9987ddf
git-subtree-dir: jubjub git-subtree-split: 9987ddf8d17a87bd2b14627665768e4038b657c4
This commit is contained in:
Sean Bowe
commit
d029ddea83
|
|
@ -0,0 +1,95 @@
|
||||||
|
name: CI checks
|
||||||
|
|
||||||
|
on: [push, pull_request]
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
lint:
|
||||||
|
name: Lint
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v1
|
||||||
|
- uses: actions-rs/toolchain@v1
|
||||||
|
with:
|
||||||
|
toolchain: 1.36.0
|
||||||
|
override: true
|
||||||
|
|
||||||
|
# Ensure all code has been formatted with rustfmt
|
||||||
|
- run: rustup component add rustfmt
|
||||||
|
- name: Check formatting
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: fmt
|
||||||
|
args: -- --check --color always
|
||||||
|
|
||||||
|
test:
|
||||||
|
name: Test on ${{ matrix.os }}
|
||||||
|
runs-on: ${{ matrix.os }}
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
os: [ubuntu-latest, windows-latest, macOS-latest]
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v1
|
||||||
|
- uses: actions-rs/toolchain@v1
|
||||||
|
with:
|
||||||
|
toolchain: 1.36.0
|
||||||
|
override: true
|
||||||
|
- name: cargo fetch
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: fetch
|
||||||
|
- name: Build tests
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: build
|
||||||
|
args: --verbose --release --tests
|
||||||
|
- name: Run tests
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: test
|
||||||
|
args: --verbose --release
|
||||||
|
|
||||||
|
no-std:
|
||||||
|
name: Check no-std compatibility
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v1
|
||||||
|
- uses: actions-rs/toolchain@v1
|
||||||
|
with:
|
||||||
|
toolchain: 1.36.0
|
||||||
|
override: true
|
||||||
|
- run: rustup target add thumbv6m-none-eabi
|
||||||
|
- name: cargo fetch
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: fetch
|
||||||
|
- name: Build
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: build
|
||||||
|
args: --verbose --target thumbv6m-none-eabi --no-default-features
|
||||||
|
|
||||||
|
doc-links:
|
||||||
|
name: Nightly lint
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v1
|
||||||
|
- uses: actions-rs/toolchain@v1
|
||||||
|
with:
|
||||||
|
toolchain: nightly
|
||||||
|
override: true
|
||||||
|
- name: cargo fetch
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: fetch
|
||||||
|
|
||||||
|
# Ensure intra-documentation links all resolve correctly
|
||||||
|
# Requires #![deny(intra_doc_link_resolution_failure)] in crate.
|
||||||
|
- name: Check intra-doc links
|
||||||
|
uses: actions-rs/cargo@v1
|
||||||
|
with:
|
||||||
|
command: doc
|
||||||
|
args: --document-private-items
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
/target
|
||||||
|
**/*.rs.bk
|
||||||
|
Cargo.lock
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
Copyrights in the "jubjub" library are retained by their contributors. No
|
||||||
|
copyright assignment is required to contribute to the "jubjub" library.
|
||||||
|
|
||||||
|
The "jubjub" library is licensed under either of
|
||||||
|
|
||||||
|
* Apache License, Version 2.0, (see ./LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
|
||||||
|
* MIT license (see ./LICENSE-MIT or http://opensource.org/licenses/MIT)
|
||||||
|
|
||||||
|
at your option.
|
||||||
|
|
||||||
|
Unless you explicitly state otherwise, any contribution intentionally
|
||||||
|
submitted for inclusion in the work by you, as defined in the Apache-2.0
|
||||||
|
license, shall be dual licensed as above, without any additional terms or
|
||||||
|
conditions.
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
[package]
|
||||||
|
authors = [
|
||||||
|
"Sean Bowe <ewillbefull@gmail.com>",
|
||||||
|
"Eirik Ogilvie-Wigley <eowigley@gmail.com>",
|
||||||
|
"Jack Grigg <thestr4d@gmail.com>",
|
||||||
|
]
|
||||||
|
description = "Implementation of the Jubjub elliptic curve group"
|
||||||
|
documentation = "https://docs.rs/jubjub/"
|
||||||
|
homepage = "https://github.com/zkcrypto/jubjub"
|
||||||
|
license = "MIT/Apache-2.0"
|
||||||
|
name = "jubjub"
|
||||||
|
repository = "https://github.com/zkcrypto/jubjub"
|
||||||
|
version = "0.3.0"
|
||||||
|
edition = "2018"
|
||||||
|
|
||||||
|
[dependencies.bls12_381]
|
||||||
|
version = "0.1"
|
||||||
|
default-features = false
|
||||||
|
|
||||||
|
[dependencies.subtle]
|
||||||
|
version = "^2.2.1"
|
||||||
|
default-features = false
|
||||||
|
|
||||||
|
[dev-dependencies.rand_core]
|
||||||
|
version = "0.5"
|
||||||
|
default-features = false
|
||||||
|
|
||||||
|
[dev-dependencies.rand_xorshift]
|
||||||
|
version = "0.2"
|
||||||
|
default-features = false
|
||||||
|
|
||||||
|
[features]
|
||||||
|
default = []
|
||||||
|
|
@ -0,0 +1,201 @@
|
||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright [yyyy] [name of copyright owner]
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
Permission is hereby granted, free of charge, to any
|
||||||
|
person obtaining a copy of this software and associated
|
||||||
|
documentation files (the "Software"), to deal in the
|
||||||
|
Software without restriction, including without
|
||||||
|
limitation the rights to use, copy, modify, merge,
|
||||||
|
publish, distribute, sublicense, and/or sell copies of
|
||||||
|
the Software, and to permit persons to whom the Software
|
||||||
|
is furnished to do so, subject to the following
|
||||||
|
conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice
|
||||||
|
shall be included in all copies or substantial portions
|
||||||
|
of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
|
||||||
|
ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
|
||||||
|
TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
|
||||||
|
SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||||
|
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
||||||
|
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
|
||||||
|
IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
||||||
|
DEALINGS IN THE SOFTWARE.
|
||||||
|
|
@ -0,0 +1,53 @@
|
||||||
|
# jubjub [](https://crates.io/crates/jubjub) #
|
||||||
|
|
||||||
|
<img
|
||||||
|
width="15%"
|
||||||
|
align="right"
|
||||||
|
src="https://raw.githubusercontent.com/zcash/zips/master/protocol/jubjub.png"/>
|
||||||
|
|
||||||
|
This is a pure Rust implementation of the Jubjub elliptic curve group and its associated fields.
|
||||||
|
|
||||||
|
* **This implementation has not been reviewed or audited. Use at your own risk.**
|
||||||
|
* This implementation targets Rust `1.36` or later.
|
||||||
|
* All operations are constant time unless explicitly noted.
|
||||||
|
* This implementation does not require the Rust standard library.
|
||||||
|
|
||||||
|
## [Documentation](https://docs.rs/jubjub)
|
||||||
|
|
||||||
|
## Curve Description
|
||||||
|
|
||||||
|
Jubjub is the [twisted Edwards curve](https://en.wikipedia.org/wiki/Twisted_Edwards_curve) `-u^2 + v^2 = 1 + d.u^2.v^2` of rational points over `GF(q)` with a subgroup of prime order `r` and cofactor `8`.
|
||||||
|
|
||||||
|
```
|
||||||
|
q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
|
||||||
|
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
|
||||||
|
d = -(10240/10241)
|
||||||
|
```
|
||||||
|
|
||||||
|
The choice of `GF(q)` is made to be the scalar field of the BLS12-381 elliptic curve construction.
|
||||||
|
|
||||||
|
Jubjub is birationally equivalent to a [Montgomery curve](https://en.wikipedia.org/wiki/Montgomery_curve) `y^2 = x^3 + Ax^2 + x` over the same field with `A = 40962`. This value of `A` is the smallest integer such that `(A - 2) / 4` is a small integer, `A^2 - 4` is nonsquare in `GF(q)`, and the Montgomery curve and its quadratic twist have small cofactors `8` and `4`, respectively. This is identical to the relationship between Curve25519 and ed25519.
|
||||||
|
|
||||||
|
Please see [./doc/evidence/](./doc/evidence/) for supporting evidence that Jubjub meets the [SafeCurves](https://safecurves.cr.yp.to/index.html) criteria. The tool in [./doc/derive/](./doc/derive/) will derive the curve parameters via the above criteria to demonstrate rigidity.
|
||||||
|
|
||||||
|
## Acknowledgements
|
||||||
|
|
||||||
|
Jubjub was designed by Sean Bowe. Daira Hopwood is responsible for its name and specification. The security evidence in [./doc/evidence/](./doc/evidence/) is the product of Daira Hopwood and based on SafeCurves by Daniel J. Bernstein and Tanja Lange. Peter Newell and Daira Hopwood are responsible for the Jubjub bird image.
|
||||||
|
|
||||||
|
Please see `Cargo.toml` for a list of primary authors of this codebase.
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Licensed under either of
|
||||||
|
|
||||||
|
* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
|
||||||
|
* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
|
||||||
|
|
||||||
|
at your option.
|
||||||
|
|
||||||
|
### Contribution
|
||||||
|
|
||||||
|
Unless you explicitly state otherwise, any contribution intentionally
|
||||||
|
submitted for inclusion in the work by you, as defined in the Apache-2.0
|
||||||
|
license, shall be dual licensed as above, without any additional terms or
|
||||||
|
conditions.
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# 0.3.0
|
||||||
|
|
||||||
|
This release now depends on the `bls12_381` crate, which exposes the `Fq` field type that we re-export.
|
||||||
|
|
||||||
|
* The `Fq` and `Fr` field types now have better constant function support for various operations and constructors.
|
||||||
|
* We no longer depend on the `byteorder` crate.
|
||||||
|
* We've bumped our `rand_core` dev-dependency up to 0.5.
|
||||||
|
* We've removed the `std` and `nightly` features.
|
||||||
|
* We've bumped our dependency of `subtle` up to `^2.2.1`.
|
||||||
|
|
||||||
|
# 0.2.0
|
||||||
|
|
||||||
|
This release switches to `subtle 2.1` to bring in the `CtOption` type, and also makes a few useful API changes.
|
||||||
|
|
||||||
|
* Implemented `Mul<Fr>` for `AffineNielsPoint` and `ExtendedNielsPoint`
|
||||||
|
* Changed `AffinePoint::to_niels()` to be a `const` function so that constant curve points can be constructed without statics.
|
||||||
|
* Implemented `multiply_bits` for `AffineNielsPoint`, `ExtendedNielsPoint`
|
||||||
|
* Removed `CtOption` and replaced it with `CtOption` from `subtle` crate.
|
||||||
|
* Modified receivers of some methods to reduce stack usage
|
||||||
|
* Changed various `into_bytes` methods into `to_bytes`
|
||||||
|
|
||||||
|
# 0.1.0
|
||||||
|
|
||||||
|
Initial release.
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
#![feature(test)]
|
||||||
|
|
||||||
|
extern crate test;
|
||||||
|
|
||||||
|
use jubjub::*;
|
||||||
|
use test::Bencher;
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_mul_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fq::one();
|
||||||
|
let b = -Fq::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n *= &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_sub_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fq::one();
|
||||||
|
let b = -Fq::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n -= &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_add_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fq::one();
|
||||||
|
let b = -Fq::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n += &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_square_assign(bencher: &mut Bencher) {
|
||||||
|
let n = Fq::one();
|
||||||
|
bencher.iter(move || n.square());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_invert(bencher: &mut Bencher) {
|
||||||
|
let n = Fq::one();
|
||||||
|
bencher.iter(move || n.invert());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_sqrt(bencher: &mut Bencher) {
|
||||||
|
let n = Fq::one().double().double();
|
||||||
|
bencher.iter(move || n.sqrt());
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
#![feature(test)]
|
||||||
|
|
||||||
|
extern crate test;
|
||||||
|
|
||||||
|
use jubjub::*;
|
||||||
|
use test::Bencher;
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_mul_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fr::one();
|
||||||
|
let b = -Fr::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n *= &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_sub_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fr::one();
|
||||||
|
let b = -Fr::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n -= &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_add_assign(bencher: &mut Bencher) {
|
||||||
|
let mut n = Fr::one();
|
||||||
|
let b = -Fr::one();
|
||||||
|
bencher.iter(move || {
|
||||||
|
n += &b;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_square_assign(bencher: &mut Bencher) {
|
||||||
|
let n = Fr::one();
|
||||||
|
bencher.iter(move || n.square());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_invert(bencher: &mut Bencher) {
|
||||||
|
let n = Fr::one();
|
||||||
|
bencher.iter(move || n.invert());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_sqrt(bencher: &mut Bencher) {
|
||||||
|
let n = Fr::one().double().double();
|
||||||
|
bencher.iter(move || n.sqrt());
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,58 @@
|
||||||
|
#![feature(test)]
|
||||||
|
|
||||||
|
extern crate test;
|
||||||
|
|
||||||
|
use jubjub::*;
|
||||||
|
use test::Bencher;
|
||||||
|
|
||||||
|
// Non-Niels
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_point_doubling(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
bencher.iter(move || a.double());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_point_addition(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = -ExtendedPoint::identity();
|
||||||
|
bencher.iter(move || a + b);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_point_subtraction(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = -ExtendedPoint::identity();
|
||||||
|
bencher.iter(move || a + b);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Niels
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_cached_point_addition(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = ExtendedPoint::identity().to_niels();
|
||||||
|
bencher.iter(move || &a + &b);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_cached_affine_point_subtraction(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = AffinePoint::identity().to_niels();
|
||||||
|
bencher.iter(move || &a + &b);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_cached_point_subtraction(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = ExtendedPoint::identity().to_niels();
|
||||||
|
bencher.iter(move || &a + &b);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[bench]
|
||||||
|
fn bench_cached_affine_point_addition(bencher: &mut Bencher) {
|
||||||
|
let a = ExtendedPoint::identity();
|
||||||
|
let b = AffinePoint::identity().to_niels();
|
||||||
|
bencher.iter(move || &a + &b);
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
*.sage.py
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
|
||||||
|
Fq = GF(q)
|
||||||
|
|
||||||
|
# We wish to find a Montgomery curve with B = 1 and A the smallest such
|
||||||
|
# that (A - 2) / 4 is a small integer.
|
||||||
|
def get_A(n):
|
||||||
|
return (n * 4) + 2
|
||||||
|
|
||||||
|
# A = 2 is invalid (singular curve), so we start at i = 1 (A = 6)
|
||||||
|
i = 1
|
||||||
|
|
||||||
|
while True:
|
||||||
|
A = Fq(get_A(i))
|
||||||
|
i = i + 1
|
||||||
|
|
||||||
|
# We also want that A^2 - 4 is nonsquare.
|
||||||
|
if ((A^2) - 4).is_square():
|
||||||
|
continue
|
||||||
|
|
||||||
|
ec = EllipticCurve(Fq, [0, A, 0, 1, 0])
|
||||||
|
o = ec.order()
|
||||||
|
|
||||||
|
if (o % 8 == 0):
|
||||||
|
o = o // 8
|
||||||
|
if is_prime(o):
|
||||||
|
twist = ec.quadratic_twist()
|
||||||
|
otwist = twist.order()
|
||||||
|
if (otwist % 4 == 0):
|
||||||
|
otwist = otwist // 4
|
||||||
|
if is_prime(otwist):
|
||||||
|
print "A = %s" % A
|
||||||
|
exit(0)
|
||||||
|
|
@ -0,0 +1,102 @@
|
||||||
|
# Byte-compiled / optimized / DLL files
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
|
||||||
|
# C extensions
|
||||||
|
*.so
|
||||||
|
|
||||||
|
# Distribution / packaging
|
||||||
|
.Python
|
||||||
|
env/
|
||||||
|
build/
|
||||||
|
develop-eggs/
|
||||||
|
dist/
|
||||||
|
downloads/
|
||||||
|
eggs/
|
||||||
|
.eggs/
|
||||||
|
lib/
|
||||||
|
lib64/
|
||||||
|
parts/
|
||||||
|
sdist/
|
||||||
|
var/
|
||||||
|
wheels/
|
||||||
|
*.egg-info/
|
||||||
|
.installed.cfg
|
||||||
|
*.egg
|
||||||
|
|
||||||
|
# PyInstaller
|
||||||
|
# Usually these files are written by a python script from a template
|
||||||
|
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||||
|
*.manifest
|
||||||
|
*.spec
|
||||||
|
|
||||||
|
# Installer logs
|
||||||
|
pip-log.txt
|
||||||
|
pip-delete-this-directory.txt
|
||||||
|
|
||||||
|
# Unit test / coverage reports
|
||||||
|
htmlcov/
|
||||||
|
.tox/
|
||||||
|
.coverage
|
||||||
|
.coverage.*
|
||||||
|
.cache
|
||||||
|
nosetests.xml
|
||||||
|
coverage.xml
|
||||||
|
*.cover
|
||||||
|
.hypothesis/
|
||||||
|
|
||||||
|
# Translations
|
||||||
|
*.mo
|
||||||
|
*.pot
|
||||||
|
|
||||||
|
# Django stuff:
|
||||||
|
*.log
|
||||||
|
local_settings.py
|
||||||
|
|
||||||
|
# Flask stuff:
|
||||||
|
instance/
|
||||||
|
.webassets-cache
|
||||||
|
|
||||||
|
# Scrapy stuff:
|
||||||
|
.scrapy
|
||||||
|
|
||||||
|
# Sphinx documentation
|
||||||
|
docs/_build/
|
||||||
|
|
||||||
|
# PyBuilder
|
||||||
|
target/
|
||||||
|
|
||||||
|
# Jupyter Notebook
|
||||||
|
.ipynb_checkpoints
|
||||||
|
|
||||||
|
# pyenv
|
||||||
|
.python-version
|
||||||
|
|
||||||
|
# celery beat schedule file
|
||||||
|
celerybeat-schedule
|
||||||
|
|
||||||
|
# SageMath parsed files
|
||||||
|
*.sage.py
|
||||||
|
|
||||||
|
# dotenv
|
||||||
|
.env
|
||||||
|
|
||||||
|
# virtualenv
|
||||||
|
.venv
|
||||||
|
venv/
|
||||||
|
ENV/
|
||||||
|
|
||||||
|
# Spyder project settings
|
||||||
|
.spyderproject
|
||||||
|
.spyproject
|
||||||
|
|
||||||
|
# Rope project settings
|
||||||
|
.ropeproject
|
||||||
|
|
||||||
|
# mkdocs documentation
|
||||||
|
/site
|
||||||
|
|
||||||
|
# mypy
|
||||||
|
.mypy_cache/
|
||||||
|
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
Copyright (c) 2017 The Zcash developers
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in
|
||||||
|
all copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||||
|
THE SOFTWARE.
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
Jubjub supporting evidence
|
||||||
|
--------------------------
|
||||||
|
|
||||||
|
This repository contains supporting evidence that the twisted Edwards curve
|
||||||
|
-x^2 + y^2 = 1 - (10240/10241).x^2.y^2 of rational points over
|
||||||
|
GF(52435875175126190479447740508185965837690552500527637822603658699938581184513),
|
||||||
|
[also called "Jubjub"](https://z.cash/technology/jubjub.html),
|
||||||
|
satisfies the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).
|
||||||
|
|
||||||
|
The script ``verify.sage`` is based on
|
||||||
|
[this script from the SafeCurves site](https://safecurves.cr.yp.to/verify.html),
|
||||||
|
modified
|
||||||
|
|
||||||
|
* to support twisted Edwards curves;
|
||||||
|
* to generate a file 'primes' containing the primes needed for primality proofs,
|
||||||
|
if it is not already present;
|
||||||
|
* to change the directory in which Pocklington proof files are generated
|
||||||
|
(``proof/`` rather than ``../../../proof``), and to create that directory
|
||||||
|
if it does not exist.
|
||||||
|
|
||||||
|
Prerequisites:
|
||||||
|
|
||||||
|
* apt-get install sagemath
|
||||||
|
* pip install sortedcontainers
|
||||||
|
|
||||||
|
Run ``sage verify.sage .``, or ``./run.sh`` to also print out the results.
|
||||||
|
|
||||||
|
Note that the "rigidity" criterion cannot be checked automatically.
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
-1
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
19257038036680949359750312669786877991949435402254120286184196891950884077233
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
6554484396890773809930967563523245729705921265872317281365359162392183254199
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
52435875175126190479447740508185965837690552500527637822603658699938581184513
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
fully rigid
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
#!/bin/sh
|
||||||
|
sage verify.sage .
|
||||||
|
grep -Rn '.' verify-* |grep '^verify-.*:1:' |sed 's/:1:/ = /'
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
tedwards
|
||||||
|
|
@ -0,0 +1,444 @@
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
from errno import ENOENT, EEXIST
|
||||||
|
from sortedcontainers import SortedSet
|
||||||
|
|
||||||
|
|
||||||
|
def readfile(fn):
|
||||||
|
fd = open(fn,'r')
|
||||||
|
r = fd.read()
|
||||||
|
fd.close()
|
||||||
|
return r
|
||||||
|
|
||||||
|
def writefile(fn,s):
|
||||||
|
fd = open(fn,'w')
|
||||||
|
fd.write(s)
|
||||||
|
fd.close()
|
||||||
|
|
||||||
|
def expand2(n):
|
||||||
|
s = ""
|
||||||
|
|
||||||
|
while n != 0:
|
||||||
|
j = 16
|
||||||
|
while 2**j < abs(n): j += 1
|
||||||
|
if 2**j - abs(n) > abs(n) - 2**(j-1): j -= 1
|
||||||
|
|
||||||
|
if abs(abs(n) - 2**j) > 2**(j - 10):
|
||||||
|
if n > 0:
|
||||||
|
if s != "": s += " + "
|
||||||
|
s += str(n)
|
||||||
|
else:
|
||||||
|
s += " - " + str(-n)
|
||||||
|
n = 0
|
||||||
|
elif n > 0:
|
||||||
|
if s != "": s += " + "
|
||||||
|
s += "2^" + str(j)
|
||||||
|
n -= 2**j
|
||||||
|
else:
|
||||||
|
s += " - 2^" + str(j)
|
||||||
|
n += 2**j
|
||||||
|
|
||||||
|
return s
|
||||||
|
|
||||||
|
def requirement(fn,istrue):
|
||||||
|
writefile(fn,str(istrue) + '\n')
|
||||||
|
return istrue
|
||||||
|
|
||||||
|
def verify():
|
||||||
|
try:
|
||||||
|
os.mkdir('proof')
|
||||||
|
except OSError as e:
|
||||||
|
if e.errno != EEXIST: raise
|
||||||
|
|
||||||
|
try:
|
||||||
|
s = set(map(Integer, readfile('primes').split()))
|
||||||
|
except IOError, e:
|
||||||
|
if e.errno != ENOENT: raise
|
||||||
|
s = set()
|
||||||
|
|
||||||
|
needtofactor = SortedSet()
|
||||||
|
V = SortedSet() # distinct verified primes
|
||||||
|
verify_primes(V, s, needtofactor)
|
||||||
|
verify_pass(V, needtofactor)
|
||||||
|
|
||||||
|
old = V
|
||||||
|
needtofactor.update(V)
|
||||||
|
while len(needtofactor) > len(old):
|
||||||
|
k = len(needtofactor) - len(old)
|
||||||
|
sys.stdout.write('Factoring %d integer%s' % (k, '' if k == 1 else 's'))
|
||||||
|
sys.stdout.flush()
|
||||||
|
for x in needtofactor:
|
||||||
|
if x not in old:
|
||||||
|
for (y, z) in factor(x):
|
||||||
|
s.add(y)
|
||||||
|
sys.stdout.write('.')
|
||||||
|
sys.stdout.flush()
|
||||||
|
|
||||||
|
print('')
|
||||||
|
|
||||||
|
old = needtofactor.copy()
|
||||||
|
verify_primes(V, s, needtofactor)
|
||||||
|
|
||||||
|
writefile('primes', '\n'.join(map(str, s)) + '\n')
|
||||||
|
writefile('verify-primes', '<html><body>\n' +
|
||||||
|
''.join(('2\n' if v == 2 else
|
||||||
|
'<a href=proof/%s.html>%s</a>\n' % (v,v)) for v in V) +
|
||||||
|
'</body></html>\n')
|
||||||
|
|
||||||
|
verify_pass(V, needtofactor)
|
||||||
|
|
||||||
|
|
||||||
|
def verify_primes(V, s, needtofactor):
|
||||||
|
for n in sorted(s):
|
||||||
|
if not n.is_prime() or n in V: continue
|
||||||
|
needtofactor.add(n-1)
|
||||||
|
if n == 2:
|
||||||
|
V.add(n)
|
||||||
|
continue
|
||||||
|
for trybase in primes(2,10000):
|
||||||
|
base = Integers(n)(trybase)
|
||||||
|
if base^(n-1) != 1: continue
|
||||||
|
proof = 'Primality proof for n = %s:\n' % n
|
||||||
|
proof += '<p>Take b = %s.\n' % base
|
||||||
|
proof += '<p>b^(n-1) mod n = 1.\n'
|
||||||
|
f = factor(1)
|
||||||
|
for v in reversed(V):
|
||||||
|
if f.prod()^2 <= n:
|
||||||
|
if n % v == 1:
|
||||||
|
u = base^((n-1)/v)-1
|
||||||
|
if u.is_unit():
|
||||||
|
if v == 2:
|
||||||
|
proof += '<p>2 is prime.\n'
|
||||||
|
else:
|
||||||
|
proof += '<p><a href=%s.html>%s is prime.</a>\n' % (v,v)
|
||||||
|
proof += '<br>b^((n-1)/%s)-1 mod n = %s, which is a unit, inverse %s.\n' % (v,u,1/u)
|
||||||
|
f *= factor(v)^(n-1).valuation(v)
|
||||||
|
if f.prod()^2 <= n: continue
|
||||||
|
if n % f.prod() != 1: continue
|
||||||
|
proof += '<p>(%s) divides n-1.\n' % f
|
||||||
|
proof += '<p>(%s)^2 > n.\n' % f
|
||||||
|
proof += "<p>n is prime by Pocklington's theorem.\n"
|
||||||
|
proof += '\n'
|
||||||
|
writefile('proof/%s.html' % n,proof)
|
||||||
|
V.add(n)
|
||||||
|
break
|
||||||
|
|
||||||
|
|
||||||
|
def verify_pass(V, needtofactor):
|
||||||
|
p = Integer(readfile('p'))
|
||||||
|
k = GF(p)
|
||||||
|
kz.<z> = k[]
|
||||||
|
l = Integer(readfile('l'))
|
||||||
|
x0 = Integer(readfile('x0'))
|
||||||
|
y0 = Integer(readfile('y0'))
|
||||||
|
x1 = Integer(readfile('x1'))
|
||||||
|
y1 = Integer(readfile('y1'))
|
||||||
|
shape = readfile('shape').strip()
|
||||||
|
rigid = readfile('rigid').strip()
|
||||||
|
|
||||||
|
safefield = True
|
||||||
|
safeeq = True
|
||||||
|
safebase = True
|
||||||
|
saferho = True
|
||||||
|
safetransfer = True
|
||||||
|
safedisc = True
|
||||||
|
saferigid = True
|
||||||
|
safeladder = True
|
||||||
|
safetwist = True
|
||||||
|
safecomplete = True
|
||||||
|
safeind = True
|
||||||
|
|
||||||
|
pstatus = 'Unverified'
|
||||||
|
if not p.is_prime(): pstatus = 'False'
|
||||||
|
needtofactor.add(p)
|
||||||
|
if p in V: pstatus = 'True'
|
||||||
|
if pstatus != 'True': safefield = False
|
||||||
|
writefile('verify-pisprime',pstatus + '\n')
|
||||||
|
|
||||||
|
pstatus = 'Unverified'
|
||||||
|
if not l.is_prime(): pstatus = 'False'
|
||||||
|
needtofactor.add(l)
|
||||||
|
if l in V: pstatus = 'True'
|
||||||
|
if pstatus != 'True': safebase = False
|
||||||
|
writefile('verify-lisprime',pstatus + '\n')
|
||||||
|
|
||||||
|
writefile('expand2-p','= %s\n' % expand2(p))
|
||||||
|
writefile('expand2-l','<br>= %s\n' % expand2(l))
|
||||||
|
|
||||||
|
writefile('hex-p',hex(p) + '\n')
|
||||||
|
writefile('hex-l',hex(l) + '\n')
|
||||||
|
writefile('hex-x0',hex(x0) + '\n')
|
||||||
|
writefile('hex-x1',hex(x1) + '\n')
|
||||||
|
writefile('hex-y0',hex(y0) + '\n')
|
||||||
|
writefile('hex-y1',hex(y1) + '\n')
|
||||||
|
|
||||||
|
gcdlpis1 = gcd(l,p) == 1
|
||||||
|
safetransfer &= requirement('verify-gcdlp1',gcdlpis1)
|
||||||
|
|
||||||
|
writefile('verify-movsafe','Unverified\n')
|
||||||
|
writefile('verify-embeddingdegree','Unverified\n')
|
||||||
|
if gcdlpis1 and l.is_prime():
|
||||||
|
u = Integers(l)(p)
|
||||||
|
d = l-1
|
||||||
|
needtofactor.add(d)
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0: d /= v
|
||||||
|
if d == 1:
|
||||||
|
d = l-1
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0:
|
||||||
|
if u^(d/v) != 1: break
|
||||||
|
d /= v
|
||||||
|
safetransfer &= requirement('verify-movsafe',(l-1)/d <= 100)
|
||||||
|
writefile('verify-embeddingdegree','<font size=1>%s</font><br>= (l-1)/%s\n' % (d,(l-1)/d))
|
||||||
|
|
||||||
|
t = p+1-l*round((p+1)/l)
|
||||||
|
if l^2 > 16*p:
|
||||||
|
writefile('verify-trace','%s\n' % t)
|
||||||
|
f = factor(1)
|
||||||
|
d = (p+1-t)/l
|
||||||
|
needtofactor.add(d)
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0:
|
||||||
|
d //= v
|
||||||
|
f *= factor(v)
|
||||||
|
writefile('verify-cofactor','%s\n' % f)
|
||||||
|
else:
|
||||||
|
writefile('verify-trace','Unverified\n')
|
||||||
|
writefile('verify-cofactor','Unverified\n')
|
||||||
|
|
||||||
|
D = t^2-4*p
|
||||||
|
needtofactor.add(D)
|
||||||
|
for v in V:
|
||||||
|
while D % v^2 == 0: D /= v^2
|
||||||
|
if prod([v for v in V if D % v == 0]) != -D:
|
||||||
|
writefile('verify-disc','Unverified\n')
|
||||||
|
writefile('verify-discisbig','Unverified\n')
|
||||||
|
safedisc = False
|
||||||
|
else:
|
||||||
|
f = -prod([factor(v) for v in V if D % v == 0])
|
||||||
|
if D % 4 != 1:
|
||||||
|
D *= 4
|
||||||
|
f = factor(4) * f
|
||||||
|
Dbits = (log(-D)/log(2)).numerical_approx()
|
||||||
|
writefile('verify-disc','<font size=1>%s</font><br>= <font size=1>%s</font><br>≈ -2^%.1f\n' % (D,f,Dbits))
|
||||||
|
safedisc &= requirement('verify-discisbig',D < -2^100)
|
||||||
|
|
||||||
|
pi4 = 0.78539816339744830961566084581987572105
|
||||||
|
rho = log(pi4*l)/log(4)
|
||||||
|
writefile('verify-rho','%.1f\n' % rho)
|
||||||
|
saferho &= requirement('verify-rhoabove100',rho.numerical_approx() >= 100)
|
||||||
|
|
||||||
|
twistl = 'Unverified'
|
||||||
|
d = p+1+t
|
||||||
|
needtofactor.add(d)
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0: d /= v
|
||||||
|
if d == 1:
|
||||||
|
d = p+1+t
|
||||||
|
for v in V:
|
||||||
|
if d % v == 0:
|
||||||
|
if twistl == 'Unverified' or v > twistl: twistl = v
|
||||||
|
|
||||||
|
writefile('verify-twistl','%s\n' % twistl)
|
||||||
|
writefile('verify-twistembeddingdegree','Unverified\n')
|
||||||
|
writefile('verify-twistmovsafe','Unverified\n')
|
||||||
|
if twistl == 'Unverified':
|
||||||
|
writefile('hex-twistl','Unverified\n')
|
||||||
|
writefile('expand2-twistl','Unverified\n')
|
||||||
|
writefile('verify-twistcofactor','Unverified\n')
|
||||||
|
writefile('verify-gcdtwistlp1','Unverified\n')
|
||||||
|
writefile('verify-twistrho','Unverified\n')
|
||||||
|
safetwist = False
|
||||||
|
else:
|
||||||
|
writefile('hex-twistl',hex(twistl) + '\n')
|
||||||
|
writefile('expand2-twistl','<br>= %s\n' % expand2(twistl))
|
||||||
|
f = factor(1)
|
||||||
|
d = (p+1+t)/twistl
|
||||||
|
needtofactor.add(d)
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0:
|
||||||
|
d //= v
|
||||||
|
f *= factor(v)
|
||||||
|
writefile('verify-twistcofactor','%s\n' % f)
|
||||||
|
gcdtwistlpis1 = gcd(twistl,p) == 1
|
||||||
|
safetwist &= requirement('verify-gcdtwistlp1',gcdtwistlpis1)
|
||||||
|
|
||||||
|
movsafe = 'Unverified'
|
||||||
|
embeddingdegree = 'Unverified'
|
||||||
|
if gcdtwistlpis1 and twistl.is_prime():
|
||||||
|
u = Integers(twistl)(p)
|
||||||
|
d = twistl-1
|
||||||
|
needtofactor.add(d)
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0: d /= v
|
||||||
|
if d == 1:
|
||||||
|
d = twistl-1
|
||||||
|
for v in V:
|
||||||
|
while d % v == 0:
|
||||||
|
if u^(d/v) != 1: break
|
||||||
|
d /= v
|
||||||
|
safetwist &= requirement('verify-twistmovsafe',(twistl-1)/d <= 100)
|
||||||
|
writefile('verify-twistembeddingdegree',"<font size=1>%s</font><br>= (l'-1)/%s\n" % (d,(twistl-1)/d))
|
||||||
|
|
||||||
|
rho = log(pi4*twistl)/log(4)
|
||||||
|
writefile('verify-twistrho','%.1f\n' % rho)
|
||||||
|
safetwist &= requirement('verify-twistrhoabove100',rho.numerical_approx() >= 100)
|
||||||
|
|
||||||
|
precomp = 0
|
||||||
|
joint = l
|
||||||
|
needtofactor.add(p+1-t)
|
||||||
|
needtofactor.add(p+1+t)
|
||||||
|
for v in V:
|
||||||
|
d1 = p+1-t
|
||||||
|
d2 = p+1+t
|
||||||
|
while d1 % v == 0 or d2 % v == 0:
|
||||||
|
if d1 % v == 0: d1 //= v
|
||||||
|
if d2 % v == 0: d2 //= v
|
||||||
|
# best case for attack: cyclic; each power is usable
|
||||||
|
# also assume that kangaroo is as efficient as rho
|
||||||
|
if v + sqrt(pi4*joint/v) < sqrt(pi4*joint):
|
||||||
|
precomp += v
|
||||||
|
joint /= v
|
||||||
|
|
||||||
|
rho = log(precomp + sqrt(pi4 * joint))/log(2)
|
||||||
|
writefile('verify-jointrho','%.1f\n' % rho)
|
||||||
|
safetwist &= requirement('verify-jointrhoabove100',rho.numerical_approx() >= 100)
|
||||||
|
|
||||||
|
|
||||||
|
x0 = k(x0)
|
||||||
|
y0 = k(y0)
|
||||||
|
x1 = k(x1)
|
||||||
|
y1 = k(y1)
|
||||||
|
|
||||||
|
if shape in ('edwards', 'tedwards'):
|
||||||
|
d = Integer(readfile('d'))
|
||||||
|
a = 1
|
||||||
|
if shape == 'tedwards':
|
||||||
|
a = Integer(readfile('a'))
|
||||||
|
|
||||||
|
writefile('verify-shape','Twisted Edwards\n')
|
||||||
|
writefile('verify-equation','%sx^2+y^2 = 1%+dx^2y^2\n' % (a, d))
|
||||||
|
if a == 1:
|
||||||
|
writefile('verify-shape','Edwards\n')
|
||||||
|
writefile('verify-equation','x^2+y^2 = 1%+dx^2y^2\n' % d)
|
||||||
|
|
||||||
|
a = k(a)
|
||||||
|
d = k(d)
|
||||||
|
elliptic = a*d*(a-d)
|
||||||
|
level0 = a*x0^2+y0^2-1-d*x0^2*y0^2
|
||||||
|
level1 = a*x1^2+y1^2-1-d*x1^2*y1^2
|
||||||
|
|
||||||
|
if shape == 'montgomery':
|
||||||
|
writefile('verify-shape','Montgomery\n')
|
||||||
|
A = Integer(readfile('A'))
|
||||||
|
B = Integer(readfile('B'))
|
||||||
|
equation = '%sy^2 = x^3<wbr>%+dx^2+x' % (B,A)
|
||||||
|
if B == 1:
|
||||||
|
equation = 'y^2 = x^3<wbr>%+dx^2+x' % A
|
||||||
|
writefile('verify-equation',equation + '\n')
|
||||||
|
|
||||||
|
A = k(A)
|
||||||
|
B = k(B)
|
||||||
|
elliptic = B*(A^2-4)
|
||||||
|
level0 = B*y0^2-x0^3-A*x0^2-x0
|
||||||
|
level1 = B*y1^2-x1^3-A*x1^2-x1
|
||||||
|
|
||||||
|
if shape == 'shortw':
|
||||||
|
writefile('verify-shape','short Weierstrass\n')
|
||||||
|
a = Integer(readfile('a'))
|
||||||
|
b = Integer(readfile('b'))
|
||||||
|
writefile('verify-equation','y^2 = x^3<wbr>%+dx<wbr>%+d\n' % (a,b))
|
||||||
|
|
||||||
|
a = k(a)
|
||||||
|
b = k(b)
|
||||||
|
elliptic = 4*a^3+27*b^2
|
||||||
|
level0 = y0^2-x0^3-a*x0-b
|
||||||
|
level1 = y1^2-x1^3-a*x1-b
|
||||||
|
|
||||||
|
writefile('verify-elliptic',str(elliptic) + '\n')
|
||||||
|
safeeq &= requirement('verify-iselliptic',elliptic != 0)
|
||||||
|
safebase &= requirement('verify-isoncurve0',level0 == 0)
|
||||||
|
safebase &= requirement('verify-isoncurve1',level1 == 0)
|
||||||
|
|
||||||
|
if shape in ('edwards', 'tedwards'):
|
||||||
|
A = 2*(a+d)/(a-d)
|
||||||
|
B = 4/(a-d)
|
||||||
|
x0,y0 = (1+y0)/(1-y0),((1+y0)/(1-y0))/x0
|
||||||
|
x1,y1 = (1+y1)/(1-y1),((1+y1)/(1-y1))/x1
|
||||||
|
shape = 'montgomery'
|
||||||
|
|
||||||
|
if shape == 'montgomery':
|
||||||
|
a = (3-A^2)/(3*B^2)
|
||||||
|
b = (2*A^3-9*A)/(27*B^3)
|
||||||
|
x0,y0 = (x0+A/3)/B,y0/B
|
||||||
|
x1,y1 = (x1+A/3)/B,y1/B
|
||||||
|
shape = 'shortw'
|
||||||
|
|
||||||
|
try:
|
||||||
|
E = EllipticCurve([a,b])
|
||||||
|
numorder2 = 0
|
||||||
|
numorder4 = 0
|
||||||
|
for P in E(0).division_points(4):
|
||||||
|
if P != 0 and 2*P == 0:
|
||||||
|
numorder2 += 1
|
||||||
|
if 2*P != 0 and 4*P == 0:
|
||||||
|
numorder4 += 1
|
||||||
|
writefile('verify-numorder2',str(numorder2) + '\n')
|
||||||
|
writefile('verify-numorder4',str(numorder4) + '\n')
|
||||||
|
completesingle = False
|
||||||
|
completemulti = False
|
||||||
|
if numorder4 == 2 and numorder2 == 1:
|
||||||
|
# complete edwards form, and montgomery with unique point of order 2
|
||||||
|
completesingle = True
|
||||||
|
completemulti = True
|
||||||
|
# should extend this to allow complete twisted hessian
|
||||||
|
safecomplete &= requirement('verify-completesingle',completesingle)
|
||||||
|
safecomplete &= requirement('verify-completemulti',completemulti)
|
||||||
|
safecomplete &= requirement('verify-ltimesbase1is0',l * E([x1,y1]) == 0)
|
||||||
|
writefile('verify-ltimesbase1',str(l * E([x1,y1])) + '\n')
|
||||||
|
writefile('verify-cofactorbase01',str(((p+1-t)//l) * E([x0,y0]) == E([x1,y1])) + '\n')
|
||||||
|
except:
|
||||||
|
writefile('verify-numorder2','Unverified\n')
|
||||||
|
writefile('verify-numorder4','Unverified\n')
|
||||||
|
writefile('verify-ltimesbase1','Unverified\n')
|
||||||
|
writefile('verify-cofactorbase01','Unverified\n')
|
||||||
|
safecomplete = False
|
||||||
|
|
||||||
|
montladder = False
|
||||||
|
for r,e in (z^3+a*z+b).roots():
|
||||||
|
if (3*r^2+a).is_square():
|
||||||
|
montladder = True
|
||||||
|
safeladder &= requirement('verify-montladder',montladder)
|
||||||
|
|
||||||
|
indistinguishability = False
|
||||||
|
elligator2 = False
|
||||||
|
if (p+1-t) % 2 == 0:
|
||||||
|
if b != 0:
|
||||||
|
indistinguishability = True
|
||||||
|
elligator2 = True
|
||||||
|
safeind &= requirement('verify-indistinguishability',indistinguishability)
|
||||||
|
writefile('verify-ind-notes','Elligator 2: %s.\n' % ['No','Yes'][elligator2])
|
||||||
|
|
||||||
|
saferigid &= (rigid == 'fully rigid' or rigid == 'somewhat rigid')
|
||||||
|
|
||||||
|
safecurve = True
|
||||||
|
safecurve &= requirement('verify-safefield',safefield)
|
||||||
|
safecurve &= requirement('verify-safeeq',safeeq)
|
||||||
|
safecurve &= requirement('verify-safebase',safebase)
|
||||||
|
safecurve &= requirement('verify-saferho',saferho)
|
||||||
|
safecurve &= requirement('verify-safetransfer',safetransfer)
|
||||||
|
safecurve &= requirement('verify-safedisc',safedisc)
|
||||||
|
safecurve &= requirement('verify-saferigid',saferigid)
|
||||||
|
safecurve &= requirement('verify-safeladder',safeladder)
|
||||||
|
safecurve &= requirement('verify-safetwist',safetwist)
|
||||||
|
safecurve &= requirement('verify-safecomplete',safecomplete)
|
||||||
|
safecurve &= requirement('verify-safeind',safeind)
|
||||||
|
requirement('verify-safecurve',safecurve)
|
||||||
|
|
||||||
|
originaldir = os.open('.',os.O_RDONLY)
|
||||||
|
for i in range(1,len(sys.argv)):
|
||||||
|
os.fchdir(originaldir)
|
||||||
|
os.chdir(sys.argv[i])
|
||||||
|
verify()
|
||||||
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
11076627216317271660298050606127911965867021807910416450833192264015104452986
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
8076246640662884909881801758704306714034609987455869804520522091855516602923
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
44412834903739585386157632289020980010620626017712148233229312325549216099227
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
13262374693698910701929044844600465831413122818447359594527400194675274060458
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,174 @@
|
||||||
|
/// Compute a + b + carry, returning the result and the new carry over.
|
||||||
|
#[inline(always)]
|
||||||
|
pub const fn adc(a: u64, b: u64, carry: u64) -> (u64, u64) {
|
||||||
|
let ret = (a as u128) + (b as u128) + (carry as u128);
|
||||||
|
(ret as u64, (ret >> 64) as u64)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Compute a - (b + borrow), returning the result and the new borrow.
|
||||||
|
#[inline(always)]
|
||||||
|
pub const fn sbb(a: u64, b: u64, borrow: u64) -> (u64, u64) {
|
||||||
|
let ret = (a as u128).wrapping_sub((b as u128) + ((borrow >> 63) as u128));
|
||||||
|
(ret as u64, (ret >> 64) as u64)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Compute a + (b * c) + carry, returning the result and the new carry over.
|
||||||
|
#[inline(always)]
|
||||||
|
pub const fn mac(a: u64, b: u64, c: u64, carry: u64) -> (u64, u64) {
|
||||||
|
let ret = (a as u128) + ((b as u128) * (c as u128)) + (carry as u128);
|
||||||
|
(ret as u64, (ret >> 64) as u64)
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_add_binop_specify_output {
|
||||||
|
($lhs:ident, $rhs:ident, $output:ident) => {
|
||||||
|
impl<'b> Add<&'b $rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn add(self, rhs: &'b $rhs) -> $output {
|
||||||
|
&self + rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'a> Add<$rhs> for &'a $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn add(self, rhs: $rhs) -> $output {
|
||||||
|
self + &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Add<$rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn add(self, rhs: $rhs) -> $output {
|
||||||
|
&self + &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_sub_binop_specify_output {
|
||||||
|
($lhs:ident, $rhs:ident, $output:ident) => {
|
||||||
|
impl<'b> Sub<&'b $rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn sub(self, rhs: &'b $rhs) -> $output {
|
||||||
|
&self - rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'a> Sub<$rhs> for &'a $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn sub(self, rhs: $rhs) -> $output {
|
||||||
|
self - &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Sub<$rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn sub(self, rhs: $rhs) -> $output {
|
||||||
|
&self - &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_binops_additive_specify_output {
|
||||||
|
($lhs:ident, $rhs:ident, $output:ident) => {
|
||||||
|
impl_add_binop_specify_output!($lhs, $rhs, $output);
|
||||||
|
impl_sub_binop_specify_output!($lhs, $rhs, $output);
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_binops_multiplicative_mixed {
|
||||||
|
($lhs:ident, $rhs:ident, $output:ident) => {
|
||||||
|
impl<'b> Mul<&'b $rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn mul(self, rhs: &'b $rhs) -> $output {
|
||||||
|
&self * rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'a> Mul<$rhs> for &'a $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn mul(self, rhs: $rhs) -> $output {
|
||||||
|
self * &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Mul<$rhs> for $lhs {
|
||||||
|
type Output = $output;
|
||||||
|
|
||||||
|
#[inline]
|
||||||
|
fn mul(self, rhs: $rhs) -> $output {
|
||||||
|
&self * &rhs
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_binops_additive {
|
||||||
|
($lhs:ident, $rhs:ident) => {
|
||||||
|
impl_binops_additive_specify_output!($lhs, $rhs, $lhs);
|
||||||
|
|
||||||
|
impl SubAssign<$rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn sub_assign(&mut self, rhs: $rhs) {
|
||||||
|
*self = &*self - &rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl AddAssign<$rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn add_assign(&mut self, rhs: $rhs) {
|
||||||
|
*self = &*self + &rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'b> SubAssign<&'b $rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn sub_assign(&mut self, rhs: &'b $rhs) {
|
||||||
|
*self = &*self - rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'b> AddAssign<&'b $rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn add_assign(&mut self, rhs: &'b $rhs) {
|
||||||
|
*self = &*self + rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
macro_rules! impl_binops_multiplicative {
|
||||||
|
($lhs:ident, $rhs:ident) => {
|
||||||
|
impl_binops_multiplicative_mixed!($lhs, $rhs, $lhs);
|
||||||
|
|
||||||
|
impl MulAssign<$rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn mul_assign(&mut self, rhs: $rhs) {
|
||||||
|
*self = &*self * &rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl<'b> MulAssign<&'b $rhs> for $lhs {
|
||||||
|
#[inline]
|
||||||
|
fn mul_assign(&mut self, rhs: &'b $rhs) {
|
||||||
|
*self = &*self * rhs;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,29 @@
|
||||||
|
use jubjub::*;
|
||||||
|
use rand_core::{RngCore, SeedableRng};
|
||||||
|
use rand_xorshift::XorShiftRng;
|
||||||
|
|
||||||
|
pub const NUM_BLACK_BOX_CHECKS: u32 = 2000;
|
||||||
|
|
||||||
|
pub fn new_rng() -> XorShiftRng {
|
||||||
|
XorShiftRng::from_seed([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
|
||||||
|
}
|
||||||
|
|
||||||
|
pub trait MyRandom {
|
||||||
|
fn new_random<T: RngCore>(rng: &mut T) -> Self;
|
||||||
|
}
|
||||||
|
|
||||||
|
impl MyRandom for Fq {
|
||||||
|
fn new_random<T: RngCore>(rng: &mut T) -> Self {
|
||||||
|
let mut random_bytes = [0u8; 64];
|
||||||
|
rng.fill_bytes(&mut random_bytes);
|
||||||
|
Fq::from_bytes_wide(&random_bytes)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl MyRandom for Fr {
|
||||||
|
fn new_random<T: RngCore>(rng: &mut T) -> Self {
|
||||||
|
let mut random_bytes = [0u8; 64];
|
||||||
|
rng.fill_bytes(&mut random_bytes);
|
||||||
|
Fr::from_bytes_wide(&random_bytes)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,120 @@
|
||||||
|
mod common;
|
||||||
|
|
||||||
|
use common::{new_rng, MyRandom, NUM_BLACK_BOX_CHECKS};
|
||||||
|
use jubjub::*;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_to_and_from_bytes() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a, Fq::from_bytes(&Fq::to_bytes(&a)).unwrap());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_associativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
let b = Fq::new_random(&mut rng);
|
||||||
|
let c = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!((a + b) + c, a + (b + c))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a + Fq::zero());
|
||||||
|
assert_eq!(a, Fq::zero() + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_subtract_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a - Fq::zero());
|
||||||
|
assert_eq!(a, Fq::zero() - -&a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_inverse() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
let a_neg = -&a;
|
||||||
|
assert_eq!(Fq::zero(), a + a_neg);
|
||||||
|
assert_eq!(Fq::zero(), a_neg + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_commutativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
let b = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a + b, b + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_associativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
let b = Fq::new_random(&mut rng);
|
||||||
|
let c = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!((a * b) * c, a * (b * c))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a * Fq::one());
|
||||||
|
assert_eq!(a, Fq::one() * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_inverse() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
if a == Fq::zero() {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
let a_inv = a.invert().unwrap();
|
||||||
|
assert_eq!(Fq::one(), a * a_inv);
|
||||||
|
assert_eq!(Fq::one(), a_inv * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_commutativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
let b = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(a * b, b * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiply_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fq::new_random(&mut rng);
|
||||||
|
assert_eq!(Fq::zero(), Fq::zero() * a);
|
||||||
|
assert_eq!(Fq::zero(), a * Fq::zero());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,120 @@
|
||||||
|
mod common;
|
||||||
|
|
||||||
|
use common::{new_rng, MyRandom, NUM_BLACK_BOX_CHECKS};
|
||||||
|
use jubjub::*;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_to_and_from_bytes() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a, Fr::from_bytes(&Fr::to_bytes(&a)).unwrap());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_associativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
let b = Fr::new_random(&mut rng);
|
||||||
|
let c = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!((a + b) + c, a + (b + c))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a + Fr::zero());
|
||||||
|
assert_eq!(a, Fr::zero() + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_subtract_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a - Fr::zero());
|
||||||
|
assert_eq!(a, Fr::zero() - -&a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_inverse() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
let a_neg = -&a;
|
||||||
|
assert_eq!(Fr::zero(), a + a_neg);
|
||||||
|
assert_eq!(Fr::zero(), a_neg + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_additive_commutativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
let b = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a + b, b + a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_associativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
let b = Fr::new_random(&mut rng);
|
||||||
|
let c = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!((a * b) * c, a * (b * c))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a, a * Fr::one());
|
||||||
|
assert_eq!(a, Fr::one() * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_inverse() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
if a == Fr::zero() {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
let a_inv = a.invert().unwrap();
|
||||||
|
assert_eq!(Fr::one(), a * a_inv);
|
||||||
|
assert_eq!(Fr::one(), a_inv * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiplicative_commutativity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
let b = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(a * b, b * a);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_multiply_additive_identity() {
|
||||||
|
let mut rng = new_rng();
|
||||||
|
for _ in 0..NUM_BLACK_BOX_CHECKS {
|
||||||
|
let a = Fr::new_random(&mut rng);
|
||||||
|
assert_eq!(Fr::zero(), Fr::zero() * a);
|
||||||
|
assert_eq!(Fr::zero(), a * Fr::zero());
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue