diff --git a/crypto/ed448/src/backend.rs b/crypto/ed448/src/backend.rs index ad17409b..b9f17a9b 100644 --- a/crypto/ed448/src/backend.rs +++ b/crypto/ed448/src/backend.rs @@ -59,7 +59,7 @@ macro_rules! from_wrapper { ($wrapper: ident, $inner: ident, $uint: ident) => { impl From<$uint> for $wrapper { fn from(a: $uint) -> $wrapper { - Self($inner::from(a)) + Self(Residue::new(&$inner::from(a))) } } }; @@ -68,17 +68,15 @@ macro_rules! from_wrapper { macro_rules! field { ( $FieldName: ident, + $ResidueType: ident, - $MODULUS_PADDED_STR: ident, $MODULUS_STR: ident, $MODULUS: ident, $WIDE_MODULUS: ident, $NUM_BITS: literal, - $TWO_INV: expr, $MULTIPLICATIVE_GENERATOR: literal, - $ROOT_OF_UNITY_INV: expr, $DELTA: expr, ) => { use core::{ @@ -96,8 +94,6 @@ macro_rules! field { use $crate::backend::u8_from_bool; - impl_modulus!(CryptoBigIntModulus, U512, $MODULUS_PADDED_STR); - fn reduce(x: U1024) -> U512 { U512::from_le_slice(&x.rem(&NonZero::new($WIDE_MODULUS).unwrap()).to_le_bytes()[.. 64]) } @@ -110,26 +106,16 @@ macro_rules! field { impl ConditionallySelectable for $FieldName { fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self { - $FieldName(U512::conditional_select(&a.0, &b.0, choice)) + $FieldName(Residue::conditional_select(&a.0, &b.0, choice)) } } - math_op!($FieldName, $FieldName, Add, add, AddAssign, add_assign, |x, y| U512::add_mod( - &x, - &y, - &$MODULUS.0 - )); - math_op!($FieldName, $FieldName, Sub, sub, SubAssign, sub_assign, |x, y| U512::sub_mod( - &x, - &y, - &$MODULUS.0 - )); - math_op!($FieldName, $FieldName, Mul, mul, MulAssign, mul_assign, |x, y| { - use crypto_bigint::modular::constant_mod::{ResidueParams, Residue}; - Residue::::new(&x) - .mul(&Residue::::new(&y)) - .retrieve() - }); + math_op!($FieldName, $FieldName, Add, add, AddAssign, add_assign, |x: $ResidueType, y| x + .add(&y)); + math_op!($FieldName, $FieldName, Sub, sub, SubAssign, sub_assign, |x: $ResidueType, y| x + .sub(&y)); + math_op!($FieldName, $FieldName, Mul, mul, MulAssign, mul_assign, |x: $ResidueType, y| x + .mul(&y)); from_wrapper!($FieldName, U512, u8); from_wrapper!($FieldName, U512, u16); @@ -140,7 +126,7 @@ macro_rules! field { impl Neg for $FieldName { type Output = $FieldName; fn neg(self) -> $FieldName { - Self(self.0.neg_mod(&$MODULUS.0)) + Self(self.0.neg()) } } @@ -154,13 +140,13 @@ macro_rules! field { impl $FieldName { /// Perform an exponentation. pub fn pow(&self, other: $FieldName) -> $FieldName { - let mut table = [Self(U512::ONE); 16]; + let mut table = [Self(Residue::ONE); 16]; table[1] = *self; for i in 2 .. 16 { table[i] = table[i - 1] * self; } - let mut res = Self(U512::ONE); + let mut res = Self(Residue::ONE); let mut bits = 0; for (i, mut bit) in other.to_le_bits().iter_mut().rev().enumerate() { bits <<= 1; @@ -183,30 +169,33 @@ macro_rules! field { } impl Field for $FieldName { - const ZERO: Self = Self(U512::ZERO); - const ONE: Self = Self(U512::ONE); + const ZERO: Self = Self(Residue::ZERO); + const ONE: Self = Self(Residue::ONE); fn random(mut rng: impl RngCore) -> Self { let mut bytes = [0; 128]; rng.fill_bytes(&mut bytes); - $FieldName(reduce(U1024::from_le_slice(bytes.as_ref()))) + $FieldName(Residue::new(&reduce(U1024::from_le_slice(bytes.as_ref())))) } fn square(&self) -> Self { *self * self } fn double(&self) -> Self { - $FieldName((self.0 << 1).rem(&NonZero::new($MODULUS.0).unwrap())) + *self + self } fn invert(&self) -> CtOption { - const NEG_2: $FieldName = Self($MODULUS.0.saturating_sub(&U512::from_u8(2))); + const NEG_2: $FieldName = + Self($ResidueType::sub(&$ResidueType::ZERO, &$ResidueType::new(&U512::from_u8(2)))); CtOption::new(self.pow(NEG_2), !self.is_zero()) } fn sqrt(&self) -> CtOption { - const MOD_1_4: $FieldName = - Self($MODULUS.0.saturating_add(&U512::from_u8(1)).wrapping_div(&U512::from_u8(4))); + const MOD_1_4: $FieldName = Self($ResidueType::new( + &$MODULUS.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4)), + )); + let res = self.pow(MOD_1_4); CtOption::new(res, res.square().ct_eq(self)) } @@ -224,30 +213,32 @@ macro_rules! field { const NUM_BITS: u32 = $NUM_BITS; const CAPACITY: u32 = $NUM_BITS - 1; - const TWO_INV: Self = $FieldName(U512::from_le_hex($TWO_INV)); + const TWO_INV: Self = $FieldName($ResidueType::new(&U512::from_u8(2)).invert().0); - const MULTIPLICATIVE_GENERATOR: Self = Self(U512::from_u8($MULTIPLICATIVE_GENERATOR)); + const MULTIPLICATIVE_GENERATOR: Self = + Self(Residue::new(&U512::from_u8($MULTIPLICATIVE_GENERATOR))); // True for both the Ed448 Scalar field and FieldElement field const S: u32 = 1; // Both fields have their root of unity as -1 - const ROOT_OF_UNITY: Self = Self($MODULUS.0.saturating_sub(&U512::from_u8(1))); - const ROOT_OF_UNITY_INV: Self = $FieldName(U512::from_le_hex($ROOT_OF_UNITY_INV)); + const ROOT_OF_UNITY: Self = + Self($ResidueType::sub(&$ResidueType::ZERO, &$ResidueType::new(&U512::ONE))); + const ROOT_OF_UNITY_INV: Self = Self(Self::ROOT_OF_UNITY.0.invert().0); - const DELTA: Self = $FieldName(U512::from_le_hex($DELTA)); + const DELTA: Self = $FieldName(Residue::new(&U512::from_le_hex($DELTA))); fn from_repr(bytes: Self::Repr) -> CtOption { - let res = $FieldName(U512::from_le_slice(&[bytes.as_ref(), [0; 7].as_ref()].concat())); - CtOption::new(res, res.0.ct_lt(&$MODULUS.0)) + let res = U512::from_le_slice(&[bytes.as_ref(), [0; 7].as_ref()].concat()); + CtOption::new($FieldName(Residue::new(&res)), res.ct_lt(&$MODULUS)) } fn to_repr(&self) -> Self::Repr { let mut repr = GenericArray::::default(); - repr.copy_from_slice(&self.0.to_le_bytes()[.. 57]); + repr.copy_from_slice(&self.0.retrieve().to_le_bytes()[.. 57]); repr } fn is_odd(&self) -> Choice { - self.0.is_odd() + self.0.retrieve().is_odd() } } @@ -261,7 +252,9 @@ macro_rules! field { } fn char_le_bits() -> FieldBits { - MODULUS.to_le_bits() + let mut repr = [0; 56]; + repr.copy_from_slice(&MODULUS.to_le_bytes()[.. 56]); + repr.into() } } diff --git a/crypto/ed448/src/field.rs b/crypto/ed448/src/field.rs index 47d73e33..d74d0987 100644 --- a/crypto/ed448/src/field.rs +++ b/crypto/ed448/src/field.rs @@ -1,10 +1,9 @@ -use zeroize::Zeroize; +use zeroize::{DefaultIsZeroes, Zeroize}; -use crypto_bigint::{U512, U1024}; - -/// Ed448 field element. -#[derive(Clone, Copy, PartialEq, Eq, Default, Debug, Zeroize)] -pub struct FieldElement(pub(crate) U512); +use crypto_bigint::{ + U512, U1024, + modular::constant_mod::{ResidueParams, Residue}, +}; const MODULUS_PADDED_STR: &str = concat!( "00000000000000", @@ -13,18 +12,27 @@ const MODULUS_PADDED_STR: &str = concat!( "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", ); +impl_modulus!(FieldModulus, U512, MODULUS_PADDED_STR); +pub(crate) type ResidueType = Residue; + +/// Ed448 field element. +#[derive(Clone, Copy, PartialEq, Eq, Default, Debug)] +pub struct FieldElement(pub(crate) ResidueType); + +impl DefaultIsZeroes for FieldElement {} + const MODULUS_STR: &str = concat!( "fffffffffffffffffffffffffffffffffffffffffffffffffffffffe", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", ); // 2**448 - 2**224 - 1 -pub(crate) const MODULUS: FieldElement = FieldElement(U512::from_be_hex(concat!( +pub(crate) const MODULUS: U512 = U512::from_be_hex(concat!( "00000000000000", "00", "fffffffffffffffffffffffffffffffffffffffffffffffffffffffe", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", -))); +)); const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( "0000000000000000000000000000000000000000000000000000000000000000", @@ -35,25 +43,18 @@ const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff" )); -pub(crate) const Q_4: FieldElement = - FieldElement(MODULUS.0.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4))); +pub(crate) const Q_4: FieldElement = FieldElement(ResidueType::new( + &MODULUS.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4)), +)); field!( FieldElement, - MODULUS_PADDED_STR, + ResidueType, MODULUS_STR, MODULUS, WIDE_MODULUS, 448, - concat!( - "00000000000000000000000000000000000000000000000000000080ffffffff", - "ffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000", - ), 7, - concat!( - "fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffff", - "ffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000", - ), concat!( "3100000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", diff --git a/crypto/ed448/src/point.rs b/crypto/ed448/src/point.rs index ee755d1d..a2ac08e2 100644 --- a/crypto/ed448/src/point.rs +++ b/crypto/ed448/src/point.rs @@ -10,7 +10,7 @@ use rand_core::RngCore; use zeroize::Zeroize; use subtle::{Choice, CtOption, ConstantTimeEq, ConditionallySelectable, ConditionallyNegatable}; -use crypto_bigint::U512; +use crypto_bigint::{U512, modular::constant_mod::Residue}; use group::{ ff::{Field, PrimeField, PrimeFieldBits}, @@ -20,18 +20,19 @@ use group::{ use crate::{ backend::u8_from_bool, - scalar::{Scalar, MODULUS as SCALAR_MODULUS}, - field::{FieldElement, MODULUS as FIELD_MODULUS, Q_4}, + scalar::Scalar, + field::{ResidueType, FieldElement, Q_4}, }; -const D: FieldElement = FieldElement(FIELD_MODULUS.0.saturating_sub(&U512::from_u16(39081))); +const D: FieldElement = + FieldElement(ResidueType::sub(&ResidueType::ZERO, &Residue::new(&U512::from_u16(39081)))); -const G_Y: FieldElement = FieldElement(U512::from_be_hex(concat!( +const G_Y: FieldElement = FieldElement(Residue::new(&U512::from_be_hex(concat!( "00000000000000", "00", "693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e", "05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14", -))); +)))); fn recover_x(y: FieldElement) -> CtOption { let ysq = y.square(); @@ -272,7 +273,7 @@ impl MulAssign<&Scalar> for Point { impl Point { fn is_torsion_free(&self) -> Choice { - (*self * SCALAR_MODULUS).is_identity() + ((*self * (Scalar::ZERO - Scalar::ONE)) + self).is_identity() } } diff --git a/crypto/ed448/src/scalar.rs b/crypto/ed448/src/scalar.rs index b64e2f94..e5845d87 100644 --- a/crypto/ed448/src/scalar.rs +++ b/crypto/ed448/src/scalar.rs @@ -1,10 +1,9 @@ -use zeroize::Zeroize; +use zeroize::{DefaultIsZeroes, Zeroize}; -use crypto_bigint::{U512, U1024}; - -/// Ed448 Scalar field element. -#[derive(Clone, Copy, PartialEq, Eq, Default, Debug, Zeroize)] -pub struct Scalar(pub(crate) U512); +use crypto_bigint::{ + U512, U1024, + modular::constant_mod::{ResidueParams, Residue}, +}; const MODULUS_PADDED_STR: &str = concat!( "00000000000000", @@ -13,18 +12,27 @@ const MODULUS_PADDED_STR: &str = concat!( "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", ); +impl_modulus!(ScalarModulus, U512, MODULUS_PADDED_STR); +type ResidueType = Residue; + +/// Ed448 Scalar field element. +#[derive(Clone, Copy, PartialEq, Eq, Default, Debug)] +pub struct Scalar(pub(crate) ResidueType); + +impl DefaultIsZeroes for Scalar {} + const MODULUS_STR: &str = concat!( "3fffffffffffffffffffffffffffffffffffffffffffffffffffffff", "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", ); // 2**446 - 13818066809895115352007386748515426880336692474882178609894547503885 -pub(crate) const MODULUS: Scalar = Scalar(U512::from_be_hex(concat!( +pub(crate) const MODULUS: U512 = U512::from_be_hex(concat!( "00000000000000", "00", "3fffffffffffffffffffffffffffffffffffffffffffffffffffffff", "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", -))); +)); const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( "0000000000000000000000000000000000000000000000000000000000000000", @@ -37,20 +45,12 @@ const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( field!( Scalar, - MODULUS_PADDED_STR, + ResidueType, MODULUS_STR, MODULUS, WIDE_MODULUS, 446, - concat!( - "7a22ac554961bc91aac7e2463961b610481b6bd7a46d27e2f41165beffffffff", - "ffffffffffffffffffffffffffffffffffffffffffffff1f0000000000000000", - ), 2, - concat!( - "f24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffff", - "ffffffffffffffffffffffffffffffffffffffffffffff3f0000000000000000", - ), concat!( "0400000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", @@ -60,7 +60,7 @@ field!( impl Scalar { /// Perform a wide reduction to obtain a non-biased Scalar. pub fn wide_reduce(bytes: [u8; 114]) -> Scalar { - Scalar(reduce(U1024::from_le_slice(&[bytes.as_ref(), &[0; 14]].concat()))) + Scalar(Residue::new(&reduce(U1024::from_le_slice(&[bytes.as_ref(), &[0; 14]].concat())))) } }