You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
Daira Hopwood f0f7068552 Add test vectors for map_to_simple_swu. 2 years ago
Ep Update parameters for Pallas/Vesta. 3 years ago
Eq Update parameters for Pallas/Vesta. 3 years ago
.gitignore Adapt for Tweedledum/Tweedledee. 4 years ago
LICENSE Add LICENSE and .gitignore. Also fix the curve equation. 6 years ago
README.md README: cosmetics. 3 years ago
addchain_5inv.py Addition chains for 5^-1 (mod p-1, q-1). 3 years ago
addchain_5inv_rtl.py Add right-to-left addition chains for 5^-1 (mod p-1, q-1). 3 years ago
addchain_7inv.py Addition chains for 7^-1 (mod p-1, q-1). 3 years ago
addchain_sqrt.py Implement the optimization from [WB2019, section 4.2] that removes the remaining inversion. 3 years ago
amicable.sage Python 3 portability. 3 years ago
animation-p.webm checksumsets.py: fix an off-by-one error in the final frames of the animation (not the actual check). 3 years ago
animation-q.webm checksumsets.py: fix an off-by-one error in the final frames of the animation (not the actual check). 3 years ago
animation.sh checksumsets.py: add support for generating animations. 3 years ago
base_tables.sage Remove -r personalisations from Sinsemilla Q 3 years ago
checksumsets.py checksumsets.py: fix an off-by-one error in the final frames of the animation (not the actual check). 3 years ago
clean.sh Add clean.sh . 4 years ago
hashtocurve.sage Add test vectors for map_to_simple_swu. 2 years ago
injectivitylemma.py injectivitylemma.py: output information that I used in a slide in my ZK Study Club presentation. 3 years ago
run.sh Update parameters for Pallas/Vesta. 3 years ago
sinsemilla.sage Add sinsemilla.sage. 3 years ago
squareroot.sage Import sys explicitly rather than relying on sage to do it. 3 years ago
squareroottab.sage Sage-on-Python 3 compatibility fixes. 2 years ago
squareroottab16.sage Add isogeny for Vesta. 3 years ago
subgroupcheck.sage subgroupcheck.sage: ensure that progress dots are printed consistently by all threads. 3 years ago
verify.sage Remove requirement for sortedcontainers. 3 years ago

README.md

Pallas/Vesta supporting evidence

This repository contains supporting evidence that the amicable pair of prime-order curves:

  • Ep : y^2 = x^3 + 5 over GF(p) of order q, called Pallas;
  • Eq : y^2 = x^3 + 5 over GF(q) of order p, called Vesta;

with

  • p = 2^254 + 45560315531419706090280762371685220353
  • q = 2^254 + 45560315531506369815346746415080538113

satisfy some of the SafeCurves criteria.

The criteria that are not satisfied are, in summary:

  • large-magnitude CM discriminant (both curves have CM discriminant of absolute value 3, as a consequence of how they were constructed);
  • completeness (complete formulae are possible, but not according to the Safe curves criterion);
  • ladder support (not possible for prime-order curves);
  • Elligator 2 support (indistinguishability is possible using Elligator Squared, but not using Elligator 2);
  • twist security above 100 bits for Pallas.

Pallas/Vesta is the first cycle output by sage amicable.sage --sequential --requireisos --sortpq --ignoretwist --nearpowerof2 255 32.

(The --sequential option makes the output completely deterministic and so resolves ambiguity about which result is "first". For exploratory searches it is faster not to use --sequential.)

Prerequisites:

  • apt-get install sagemath

Run sage verify.sage Ep and sage verify.sage Eq; or ./run.sh to run both and also print out the results.

The output of amicable.sage with the above options includes isogenies of degree 3, suitable for use with the "simplified SWU" method for hashing to an elliptic curve. This is based on code from Appendix A of Wahby and Boneh 2019.

To check the correctness of the endomorphism optimization described in the Halo paper, run python3 injectivitylemma.py and python3 checksumsets.py. To also generate animations showing the minimum distances between multiples of ζ used in the proof, run ./animation.sh.

animation.sh has the following prerequisites:

  • apt-get install ffmpeg ffcvt
  • pip3 install bintrees Pillow

checksumsets.py on its own only requires the bintrees Python package.