zec
/
pasta
mirror of https://github.com/zcash/pasta.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Pallas/Vesta README. 

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
This commit is contained in:
Daira Hopwood 2020-11-19 21:53:07 +00:00
parent a35294b64f
commit 1cd1766100
1 changed files with 13 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
README.md
View File

@ -1,16 +1,16 @@
Tweedledum/Tweedledee supporting evidence
-----------------------------------------
Pallas/Vesta supporting evidence
--------------------------------
This repository contains supporting evidence that the amicable pair of
prime-order curves:
* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Tweedledum;
* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Tweedledee;
* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Pallas;
* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Vesta;
with
* p = 2^254 + 4707489545178046908921067385359695873
* q = 2^254 + 4707489544292117082687961190295928833
* p = 2^254 + 45560315531419706090280762371685220353
* q = 2^254 + 45560315531506369815346746415080538113
satisfy *some* of the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).
@ -22,17 +22,16 @@ The criteria that are *not* satisfied are, in summary:
criterion);
* ladder support (not possible for prime-order curves);
* Elligator 2 support (indistinguishability is possible using
[Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2).
[Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2);
* twist security above 100 bits for Pallas.
Tweedledum/Tweedledee is the first cycle output by
``sage amicable.sage --sequential --nearpowerof2 255 32``.
Pallas/Vesta is the first cycle output by
``sage amicable.sage --sequential --requireisos --sortpq --ignoretwist --nearpowerof2 255 32``.
(The `--sequential` option makes the output completely deterministic and so resolves
ambiguity about which result is "first". For exploratory searches it is faster not to
use `--sequential`.)
**The cycle we call Tweedledum/Tweedledee has changed from the initial (September 2019) draft of the Halo paper.**
Prerequisites:
* apt-get install sagemath
@ -41,10 +40,6 @@ Prerequisites:
Run ``sage verify.sage Ep`` and ``sage verify.sage Eq``; or ``./run.sh`` to run both
and also print out the results.
When ``amicable.sage`` is used with the ``--isogenies`` option, the output includes
isogenies suitable for use with the "simplified SWU" method for hashing to an
elliptic curve. This is based on code from Appendix A of
[Wahby and Boneh 2019](https://eprint.iacr.org/2019/403.pdf). Note that simplified SWU
is not necessarily the preferred method to hash to a given curve. In particular it
probably is not for the Tweedle curves; they only have suitable isogenies of degree 23,
which is rather large.
The output of ``amicable.sage`` with the above options includes isogenies of degree 3,
suitable for use with the "simplified SWU" method for hashing to an elliptic curve.
This is based on code from Appendix A of [Wahby and Boneh 2019](https://eprint.iacr.org/2019/403.pdf).