mirror of https://github.com/zcash/pasta.git
Pallas/Vesta README.
Signedoffby: Daira Hopwood <daira@jacaranda.org>
This commit is contained in:
parent
a35294b64f
commit
1cd1766100
31
README.md
31
README.md

@ 1,16 +1,16 @@


Tweedledum/Tweedledee supporting evidence





Pallas/Vesta supporting evidence







This repository contains supporting evidence that the amicable pair of


primeorder curves:




* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Tweedledum;


* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Tweedledee;


* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Pallas;


* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Vesta;




with




* p = 2^254 + 4707489545178046908921067385359695873


* q = 2^254 + 4707489544292117082687961190295928833


* p = 2^254 + 45560315531419706090280762371685220353


* q = 2^254 + 45560315531506369815346746415080538113




satisfy *some* of the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).





@ 22,17 +22,16 @@ The criteria that are *not* satisfied are, in summary:


criterion);


* ladder support (not possible for primeorder curves);


* Elligator 2 support (indistinguishability is possible using


[Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2).


[Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2);


* twist security above 100 bits for Pallas.




Tweedledum/Tweedledee is the first cycle output by


``sage amicable.sage sequential nearpowerof2 255 32``.


Pallas/Vesta is the first cycle output by


``sage amicable.sage sequential requireisos sortpq ignoretwist nearpowerof2 255 32``.




(The `sequential` option makes the output completely deterministic and so resolves


ambiguity about which result is "first". For exploratory searches it is faster not to


use `sequential`.)




**The cycle we call Tweedledum/Tweedledee has changed from the initial (September 2019) draft of the Halo paper.**




Prerequisites:




* aptget install sagemath



@ 41,10 +40,6 @@ Prerequisites:


Run ``sage verify.sage Ep`` and ``sage verify.sage Eq``; or ``./run.sh`` to run both


and also print out the results.




When ``amicable.sage`` is used with the ``isogenies`` option, the output includes


isogenies suitable for use with the "simplified SWU" method for hashing to an


elliptic curve. This is based on code from Appendix A of


[Wahby and Boneh 2019](https://eprint.iacr.org/2019/403.pdf). Note that simplified SWU


is not necessarily the preferred method to hash to a given curve. In particular it


probably is not for the Tweedle curves; they only have suitable isogenies of degree 23,


which is rather large.


The output of ``amicable.sage`` with the above options includes isogenies of degree 3,


suitable for use with the "simplified SWU" method for hashing to an elliptic curve.


This is based on code from Appendix A of [Wahby and Boneh 2019](https://eprint.iacr.org/2019/403.pdf).




Loading…
Reference in New Issue