mirror of https://github.com/zcash/pasta.git
2f60aed1ce | ||
---|---|---|
Ep | ||
Eq | ||
.gitignore | ||
LICENSE | ||
README.md | ||
amicable.sage | ||
checksumsets.py | ||
clean.sh | ||
injectivitylemma.py | ||
run.sh | ||
verify.sage |
README.md
Tweedledum/Tweedledee supporting evidence
This repository contains supporting evidence that the amicable pair of prime-order curves:
- Ep : y^2 = x^3 + 5 over GF(p) of order q, called Tweedledum;
- Eq : y^2 = x^3 + 5 over GF(q) of order p, called Tweedledee;
with
- p = 2^254 + 4707489545178046908921067385359695873
- q = 2^254 + 4707489544292117082687961190295928833
satisfy some of the SafeCurves criteria.
The criteria that are not satisfied are, in summary:
- large CM discriminant (both curves have CM discriminant 3, as a consequence of how they were constructed);
- completeness (complete formulae are possible, but not according to the Safe curves criterion);
- ladder support (not possible for prime-order curves);
- Elligator 2 support (indistinguishability is possible using Elligator Squared, but not using Elligator 2).
Tweedledum/Tweedledee is the first cycle output by
sage amicable.sage --sequential --nearpowerof2 255 32
.
(The --sequential
option makes the output completely deterministic and so resolves
ambiguity about which result is "first". For exploratory searches it is faster not to
use --sequential
.)
The cycle we call Tweedledum/Tweedledee has changed from the initial draft of the paper.
Prerequisites:
- apt-get install sagemath
- pip install sortedcontainers
Run sage verify.sage Ep
and sage verify.sage Eq
; or ./run.sh
to run both
and also print out the results.