Daira Hopwood
f0f7068552

2 years ago  

Ep  3 years ago  
Eq  3 years ago  
.gitignore  4 years ago  
LICENSE  6 years ago  
README.md  3 years ago  
addchain_5inv.py  3 years ago  
addchain_5inv_rtl.py  3 years ago  
addchain_7inv.py  3 years ago  
addchain_sqrt.py  3 years ago  
amicable.sage  3 years ago  
animationp.webm  3 years ago  
animationq.webm  3 years ago  
animation.sh  3 years ago  
base_tables.sage  3 years ago  
checksumsets.py  3 years ago  
clean.sh  4 years ago  
hashtocurve.sage  2 years ago  
injectivitylemma.py  3 years ago  
run.sh  3 years ago  
sinsemilla.sage  3 years ago  
squareroot.sage  3 years ago  
squareroottab.sage  2 years ago  
squareroottab16.sage  3 years ago  
subgroupcheck.sage  3 years ago  
verify.sage  3 years ago 
README.md
Pallas/Vesta supporting evidence
This repository contains supporting evidence that the amicable pair of primeorder curves:
 Ep : y^2 = x^3 + 5 over GF(p) of order q, called Pallas;
 Eq : y^2 = x^3 + 5 over GF(q) of order p, called Vesta;
with
 p = 2^254 + 45560315531419706090280762371685220353
 q = 2^254 + 45560315531506369815346746415080538113
satisfy some of the SafeCurves criteria.
The criteria that are not satisfied are, in summary:
 largemagnitude CM discriminant (both curves have CM discriminant of absolute value 3, as a consequence of how they were constructed);
 completeness (complete formulae are possible, but not according to the Safe curves criterion);
 ladder support (not possible for primeorder curves);
 Elligator 2 support (indistinguishability is possible using Elligator Squared, but not using Elligator 2);
 twist security above 100 bits for Pallas.
Pallas/Vesta is the first cycle output by
sage amicable.sage sequential requireisos sortpq ignoretwist nearpowerof2 255 32
.
(The sequential
option makes the output completely deterministic and so resolves
ambiguity about which result is "first". For exploratory searches it is faster not to
use sequential
.)
Prerequisites:
aptget install sagemath
Run sage verify.sage Ep
and sage verify.sage Eq
; or ./run.sh
to run both
and also print out the results.
The output of amicable.sage
with the above options includes isogenies of degree 3,
suitable for use with the "simplified SWU" method for hashing to an elliptic curve.
This is based on code from Appendix A of Wahby and Boneh 2019.
To check the correctness of the endomorphism optimization described in the Halo paper, run
python3 injectivitylemma.py
and python3 checksumsets.py
. To also generate animations
showing the minimum distances between multiples of ζ used in the proof, run ./animation.sh
.
animation.sh
has the following prerequisites:
aptget install ffmpeg ffcvt
pip3 install bintrees Pillow
checksumsets.py
on its own only requires the bintrees
Python package.