Add Tweedledum/Tweedledee parameters.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2019-09-08 16:23:57 +01:00 · 2019-09-08 16:23:57 +01:00 · 28b6046fcc
parent 03ec3685aa
commit 28b6046fcc
21 changed files with 46 additions and 19 deletions
--- a/Ep/a
+++ b/Ep/a
@ -0,0 +1 @@
+0
--- a/Ep/b
+++ b/Ep/b
@ -0,0 +1 @@
+5
--- a/Ep/l
+++ b/Ep/l
@ -0,0 +1 @@
+57896044618658097711785492504343953925989756877607147991657089165100807356417
--- a/Ep/p
+++ b/Ep/p
@ -0,0 +1 @@
+57896044618658097711785492504343953925989756877607163761872965584918954377217
--- a/Ep/rigid
+++ b/Ep/rigid
@ -0,0 +1 @@
+not rigid
--- a/Ep/shape
+++ b/Ep/shape
@ -0,0 +1 @@
+shortw
--- a/Ep/x0
+++ b/Ep/x0
@ -0,0 +1 @@
+-1
--- a/Ep/x1
+++ b/Ep/x1
@ -0,0 +1 @@
+-1
--- a/Ep/y0
+++ b/Ep/y0
@ -0,0 +1 @@
+2
--- a/Ep/y1
+++ b/Ep/y1
@ -0,0 +1 @@
+2
--- a/Eq/a
+++ b/Eq/a
@ -0,0 +1 @@
+0
--- a/Eq/b
+++ b/Eq/b
@ -0,0 +1 @@
+5
--- a/Eq/l
+++ b/Eq/l
@ -0,0 +1 @@
+57896044618658097711785492504343953925989756877607163761872965584918954377217
--- a/Eq/p
+++ b/Eq/p
@ -0,0 +1 @@
+57896044618658097711785492504343953925989756877607147991657089165100807356417
--- a/Eq/rigid
+++ b/Eq/rigid
@ -0,0 +1 @@
+not rigid
--- a/Eq/shape
+++ b/Eq/shape
@ -0,0 +1 @@
+shortw
--- a/Eq/x0
+++ b/Eq/x0
@ -0,0 +1 @@
+-1
--- a/Eq/x1
+++ b/Eq/x1
@ -0,0 +1 @@
+-1
--- a/Eq/y0
+++ b/Eq/y0
@ -0,0 +1 @@
+2
--- a/Eq/y1
+++ b/Eq/y1
@ -0,0 +1 @@
+2
--- a/README.md
+++ b/README.md
@ -1,28 +1,35 @@
-Jubjub supporting evidence
--------------------------
+Tweedledum/Tweedledee supporting evidence
+-----------------------------------------

-This repository contains supporting evidence that the twisted Edwards curve
-x^2 + y^2 = 1 - (10240/10241).x^2.y^2 of rational points over
-GF(52435875175126190479447740508185965837690552500527637822603658699938581184513),
-[also called "Jubjub"](https://z.cash/technology/jubjub.html),
-satisfies the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).
+This repository contains supporting evidence that the amicable pair of
+prime-order curves:

-The script ``verify.sage`` is based on
-[this script from the SafeCurves site](https://safecurves.cr.yp.to/verify.html),
-modified
+* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Tweedledum;
+* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Tweedledee;

-* to support twisted Edwards curves;
-* to generate a file 'primes' containing the primes needed for primality proofs,
-  if it is not already present;
-* to change the directory in which Pocklington proof files are generated
-  (``proof/`` rather than ``../../../proof``), and to create that directory
-  if it does not exist.
+with
+
+* p = 57896044618658097711785492504343953925989756877607163761872965584918954377217
+* q = 57896044618658097711785492504343953925989756877607147991657089165100807356417
+
+satisfy *some* of the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).
+
+The criteria that are *not* satisfied are, in summary:
+
+* large CM discriminant (both curves have CM discriminant 3, as a consequence of how
+  they were constructed);
+* completeness (complete formulae are possible, but not according to the Safe curves
+  criterion);
+* ladder support (not possible for prime-order curves);
+* Elligator 2 support (indistinguishability is possible using
+  [Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2);
+* twist security;
+* rigidity.

 Prerequisites:

 * apt-get install sagemath
 * pip install sortedcontainers

-Run ``sage verify.sage .``, or ``./run.sh`` to also print out the results.
-
-Note that the "rigidity" criterion cannot be checked automatically.
+Run ``sage verify.sage Ep`` and ``sage verify.sage Eq``; or ``./run.sh`` to run both
+and also print out the results.
				`@ -0,0 +1 @@`
				`57896044618658097711785492504343953925989756877607147991657089165100807356417`