p434

Documentation

Index

• Constants
• Variables
• func CalcAplus2Over4(cparams *ProjectiveCurveParameters) (ret Fp2)
• func CalcCurveParamsEquiv3(cparams *ProjectiveCurveParameters) CurveCoefficientsEquiv
• func CalcCurveParamsEquiv4(cparams *ProjectiveCurveParameters) CurveCoefficientsEquiv
• func DeriveSecretA(ss, prv []byte, pub3Pt *[3]Fp2)
• func DeriveSecretB(ss, prv []byte, pub3Pt *[3]Fp2)
• func Fp2Batch3Inv(x1, x2, x3, y1, y2, y3 *Fp2)
• func FromMontgomery(out, in *common.Fp2)
• func Jinvariant(cparams *ProjectiveCurveParameters, j *Fp2)
• func Pow2k(xP *ProjectivePoint, params *CurveCoefficientsEquiv, k uint32)
• func Pow3k(xP *ProjectivePoint, params *CurveCoefficientsEquiv, k uint32)
• func PublicKeyGenA(pub3Pt *[3]Fp2, prvBytes []byte)
• func PublicKeyGenB(pub3Pt *[3]Fp2, prvBytes []byte)
• func PublicKeyValidation(cparams *ProjectiveCurveParameters, P, Q, PmQ *ProjectivePoint, nbits uint) error
• func RecoverCoordinateA(curve *ProjectiveCurveParameters, xp, xq, xr *Fp2)
• func RecoverCurveCoefficients3(cparams *ProjectiveCurveParameters, coefEq *CurveCoefficientsEquiv)
• func RecoverCurveCoefficients4(cparams *ProjectiveCurveParameters, coefEq *CurveCoefficientsEquiv)
• func ScalarMul3Pt(cparams *ProjectiveCurveParameters, P, Q, PmQ *ProjectivePoint, nbits uint, ...) ProjectivePoint
• func ToMontgomery(out, in *common.Fp2)

Constants

const (
	// Number of uint64 limbs used to store field element
	FpWords = 7
)

Variables

var (
	// HasADXandBMI2 signals support for ADX and BMI2
	HasADXandBMI2 = cpu.X86.HasBMI2 && cpu.X86.HasADX

	// P434 is a prime used by field Fp434
	P434 = common.Fp{
		0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFDC1767AE2FFFFFF,
		0x7BC65C783158AEA3, 0x6CFC5FD681C52056, 0x2341F27177344,
	}

	// P434x2 = 2*p434 - 1
	P434x2 = common.Fp{
		0xFFFFFFFFFFFFFFFE, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFB82ECF5C5FFFFFF,
		0xF78CB8F062B15D47, 0xD9F8BFAD038A40AC, 0x4683E4E2EE688,
	}

	// P434p1 = p434 + 1
	P434p1 = common.Fp{
		0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0xFDC1767AE3000000,
		0x7BC65C783158AEA3, 0x6CFC5FD681C52056, 0x0002341F27177344,
	}

	// P434R2 = (2^448)^2 mod p
	P434R2 = common.Fp{
		0x28E55B65DCD69B30, 0xACEC7367768798C2, 0xAB27973F8311688D, 0x175CC6AF8D6C7C0B,
		0xABCD92BF2DDE347E, 0x69E16A61C7686D9A, 0x000025A89BCDD12A,
	}

	P434p1Zeros = 3
)

Functions

func CalcAplus2Over4

func CalcAplus2Over4(cparams *ProjectiveCurveParameters) (ret Fp2)

Helper function for RightToLeftLadder(). Returns A+2C / 4.

func CalcCurveParamsEquiv3

func CalcCurveParamsEquiv3(cparams *ProjectiveCurveParameters) CurveCoefficientsEquiv

Computes equivalence (A:C) ~ (A+2C : A-2C)

func CalcCurveParamsEquiv4

func CalcCurveParamsEquiv4(cparams *ProjectiveCurveParameters) CurveCoefficientsEquiv

Computes equivalence (A:C) ~ (A+2C : 4C)

func DeriveSecretA

func DeriveSecretA(ss, prv []byte, pub3Pt *[3]Fp2)

Establishing shared keys in in 2-torsion group

func DeriveSecretB

func DeriveSecretB(ss, prv []byte, pub3Pt *[3]Fp2)

Establishing shared keys in in 3-torsion group

func Fp2Batch3Inv

func Fp2Batch3Inv(x1, x2, x3, y1, y2, y3 *Fp2)

Set (y1, y2, y3) = (1/x1, 1/x2, 1/x3).

All xi, yi must be distinct.

func FromMontgomery

func FromMontgomery(out, in *common.Fp2)

Converts in.A and in.B from Montgomery domain and stores in 'out' out.A = in.A mod p out.B = in.B mod p

After returning from the call 'in' is not modified.

func Jinvariant

func Jinvariant(cparams *ProjectiveCurveParameters, j *Fp2)

Computes j-invariant for a curve y2=x3+A/Cx+x with A,C in F_(p^2). Result is returned in jBytes buffer, encoded in little-endian format. Caller provided jBytes buffer has to be big enough to j-invariant value. In case of SIDH, buffer size must be at least size of shared secret. Implementation corresponds to Algorithm 9 from SIKE.

func Pow2k

func Pow2k(xP *ProjectivePoint, params *CurveCoefficientsEquiv, k uint32)

Given the curve parameters, xP = x(P), computes xP = x([2^k]P) Safe to overlap xP, x2P.

func Pow3k

func Pow3k(xP *ProjectivePoint, params *CurveCoefficientsEquiv, k uint32)

Given the curve parameters, xP = x(P), and k >= 0, compute xP = x([3^k]P).

Safe to overlap xP, xR.

func PublicKeyGenA

func PublicKeyGenA(pub3Pt *[3]Fp2, prvBytes []byte)

Generate a public key in the 2-torsion group. Public key is a set of three x-coordinates: xP,xQ,x(P-Q), where P,Q are points on E_a(Fp2)

func PublicKeyGenB

func PublicKeyGenB(pub3Pt *[3]Fp2, prvBytes []byte)

Generate a public key in the 2-torsion group. Public key is a set of three x-coordinates: xP,xQ,x(P-Q), where P,Q are points on E_a(Fp2)

func PublicKeyValidation

func PublicKeyValidation(cparams *ProjectiveCurveParameters, P, Q, PmQ *ProjectivePoint, nbits uint) error

PublicKeyValidation preforms public key/ciphertext validation using the CLN test. CLN test: Check that P and Q are both of order 3^e3 and they generate the torsion E_A[3^e3] A countermeasure for remote timing attacks on SIKE; suggested by https://eprint.iacr.org/2022/054.pdf Any curve E_A (SIKE 434, 503, 751) that passes CLN test is supersingular. Input: The public key / ciphertext P, Q, PmQ. The projective coordinate A of the curve defined by (P, Q, PmQ) Outputs: Whether (P,Q,PmQ) follows the CLN test

func RecoverCoordinateA

func RecoverCoordinateA(curve *ProjectiveCurveParameters, xp, xq, xr *Fp2)

Given affine points x(P), x(Q) and x(Q-P) in a extension field F_{p^2}, function recorvers projective coordinate A of a curve. This is Algorithm 10 from SIKE.

func RecoverCurveCoefficients3

func RecoverCurveCoefficients3(cparams *ProjectiveCurveParameters, coefEq *CurveCoefficientsEquiv)

Recovers (A:C) curve parameters from projectively equivalent (A+2C:A-2C).

func RecoverCurveCoefficients4

func RecoverCurveCoefficients4(cparams *ProjectiveCurveParameters, coefEq *CurveCoefficientsEquiv)

Recovers (A:C) curve parameters from projectively equivalent (A+2C:4C).

func ScalarMul3Pt

func ScalarMul3Pt(cparams *ProjectiveCurveParameters, P, Q, PmQ *ProjectivePoint, nbits uint, scalar []uint8) ProjectivePoint

Scalarmul3Pt is a right-to-left point multiplication that given the x-coordinate of P, Q and P-Q calculates the x-coordinate of R=Q+[scalar]P. nbits must be smaller or equal to len(scalar).

func ToMontgomery

func ToMontgomery(out, in *common.Fp2)

Converts in.A and in.B to Montgomery domain and stores in 'out' out.A = in.A * R mod p out.B = in.B * R mod p Performs v = v*R^2*R^(-1) mod p, for both in.A and in.B