absolutebi/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2025-12-08 12:19:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move the entirety of ed448 to Residue, offering a further 2-4x speedup

Browse Source
This commit is contained in:
Luke Parker
2023-04-19 04:02:59 -04:00
parent 334873b6a5
commit ff2febe5aa
4 changed files with 82 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
crypto/ed448/src/backend.rs
View File

@@ -59,7 +59,7 @@ macro_rules! from_wrapper {
($wrapper: ident, $inner: ident, $uint: ident) => { ($wrapper: ident, $inner: ident, $uint: ident) => {
impl From<$uint> for $wrapper { impl From<$uint> for $wrapper {
fn from(a: $uint) -> $wrapper { fn from(a: $uint) -> $wrapper {
Self($inner::from(a)) Self(Residue::new(&$inner::from(a)))
} }
} }
}; };
@@ -68,17 +68,15 @@ macro_rules! from_wrapper {
macro_rules! field { macro_rules! field {
( (
$FieldName: ident, $FieldName: ident,
$ResidueType: ident,
$MODULUS_PADDED_STR: ident,
$MODULUS_STR: ident, $MODULUS_STR: ident,
$MODULUS: ident, $MODULUS: ident,
$WIDE_MODULUS: ident, $WIDE_MODULUS: ident,
$NUM_BITS: literal, $NUM_BITS: literal,
$TWO_INV: expr,
$MULTIPLICATIVE_GENERATOR: literal, $MULTIPLICATIVE_GENERATOR: literal,
$ROOT_OF_UNITY_INV: expr,
$DELTA: expr, $DELTA: expr,
) => { ) => {
use core::{ use core::{
@@ -96,8 +94,6 @@ macro_rules! field {
use $crate::backend::u8_from_bool; use $crate::backend::u8_from_bool;
impl_modulus!(CryptoBigIntModulus, U512, $MODULUS_PADDED_STR);
fn reduce(x: U1024) -> U512 { fn reduce(x: U1024) -> U512 {
U512::from_le_slice(&x.rem(&NonZero::new($WIDE_MODULUS).unwrap()).to_le_bytes()[.. 64]) U512::from_le_slice(&x.rem(&NonZero::new($WIDE_MODULUS).unwrap()).to_le_bytes()[.. 64])
} }
@@ -110,26 +106,16 @@ macro_rules! field {
impl ConditionallySelectable for $FieldName { impl ConditionallySelectable for $FieldName {
fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self { fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
$FieldName(U512::conditional_select(&a.0, &b.0, choice)) $FieldName(Residue::conditional_select(&a.0, &b.0, choice))
} }
} }
math_op!($FieldName, $FieldName, Add, add, AddAssign, add_assign, |x, y| U512::add_mod( math_op!($FieldName, $FieldName, Add, add, AddAssign, add_assign, |x: $ResidueType, y| x
&x, .add(&y));
&y, math_op!($FieldName, $FieldName, Sub, sub, SubAssign, sub_assign, |x: $ResidueType, y| x
&$MODULUS.0 .sub(&y));
)); math_op!($FieldName, $FieldName, Mul, mul, MulAssign, mul_assign, |x: $ResidueType, y| x
math_op!($FieldName, $FieldName, Sub, sub, SubAssign, sub_assign, |x, y| U512::sub_mod( .mul(&y));
&x,
&y,
&$MODULUS.0
));
math_op!($FieldName, $FieldName, Mul, mul, MulAssign, mul_assign, |x, y| {
use crypto_bigint::modular::constant_mod::{ResidueParams, Residue};
Residue::<CryptoBigIntModulus, { CryptoBigIntModulus::LIMBS }>::new(&x)
.mul(&Residue::<CryptoBigIntModulus, { CryptoBigIntModulus::LIMBS }>::new(&y))
.retrieve()
});
from_wrapper!($FieldName, U512, u8); from_wrapper!($FieldName, U512, u8);
from_wrapper!($FieldName, U512, u16); from_wrapper!($FieldName, U512, u16);
@@ -140,7 +126,7 @@ macro_rules! field {
impl Neg for $FieldName { impl Neg for $FieldName {
type Output = $FieldName; type Output = $FieldName;
fn neg(self) -> $FieldName { fn neg(self) -> $FieldName {
Self(self.0.neg_mod(&$MODULUS.0)) Self(self.0.neg())
} }
} }
@@ -154,13 +140,13 @@ macro_rules! field {
impl $FieldName { impl $FieldName {
/// Perform an exponentation. /// Perform an exponentation.
pub fn pow(&self, other: $FieldName) -> $FieldName { pub fn pow(&self, other: $FieldName) -> $FieldName {
let mut table = [Self(U512::ONE); 16]; let mut table = [Self(Residue::ONE); 16];
table[1] = *self; table[1] = *self;
for i in 2 .. 16 { for i in 2 .. 16 {
table[i] = table[i - 1] * self; table[i] = table[i - 1] * self;
} }
let mut res = Self(U512::ONE); let mut res = Self(Residue::ONE);
let mut bits = 0; let mut bits = 0;
for (i, mut bit) in other.to_le_bits().iter_mut().rev().enumerate() { for (i, mut bit) in other.to_le_bits().iter_mut().rev().enumerate() {
bits <<= 1; bits <<= 1;
@@ -183,30 +169,33 @@ macro_rules! field {
} }
impl Field for $FieldName { impl Field for $FieldName {
const ZERO: Self = Self(U512::ZERO); const ZERO: Self = Self(Residue::ZERO);
const ONE: Self = Self(U512::ONE); const ONE: Self = Self(Residue::ONE);
fn random(mut rng: impl RngCore) -> Self { fn random(mut rng: impl RngCore) -> Self {
let mut bytes = [0; 128]; let mut bytes = [0; 128];
rng.fill_bytes(&mut bytes); rng.fill_bytes(&mut bytes);
$FieldName(reduce(U1024::from_le_slice(bytes.as_ref()))) $FieldName(Residue::new(&reduce(U1024::from_le_slice(bytes.as_ref()))))
} }
fn square(&self) -> Self { fn square(&self) -> Self {
*self * self *self * self
} }
fn double(&self) -> Self { fn double(&self) -> Self {
$FieldName((self.0 << 1).rem(&NonZero::new($MODULUS.0).unwrap())) *self + self
} }
fn invert(&self) -> CtOption<Self> { fn invert(&self) -> CtOption<Self> {
const NEG_2: $FieldName = Self($MODULUS.0.saturating_sub(&U512::from_u8(2))); const NEG_2: $FieldName =
Self($ResidueType::sub(&$ResidueType::ZERO, &$ResidueType::new(&U512::from_u8(2))));
CtOption::new(self.pow(NEG_2), !self.is_zero()) CtOption::new(self.pow(NEG_2), !self.is_zero())
} }
fn sqrt(&self) -> CtOption<Self> { fn sqrt(&self) -> CtOption<Self> {
const MOD_1_4: $FieldName = const MOD_1_4: $FieldName = Self($ResidueType::new(
Self($MODULUS.0.saturating_add(&U512::from_u8(1)).wrapping_div(&U512::from_u8(4))); &$MODULUS.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4)),
));
let res = self.pow(MOD_1_4); let res = self.pow(MOD_1_4);
CtOption::new(res, res.square().ct_eq(self)) CtOption::new(res, res.square().ct_eq(self))
} }
@@ -224,30 +213,32 @@ macro_rules! field {
const NUM_BITS: u32 = $NUM_BITS; const NUM_BITS: u32 = $NUM_BITS;
const CAPACITY: u32 = $NUM_BITS - 1; const CAPACITY: u32 = $NUM_BITS - 1;
const TWO_INV: Self = $FieldName(U512::from_le_hex($TWO_INV)); const TWO_INV: Self = $FieldName($ResidueType::new(&U512::from_u8(2)).invert().0);
const MULTIPLICATIVE_GENERATOR: Self = Self(U512::from_u8($MULTIPLICATIVE_GENERATOR)); const MULTIPLICATIVE_GENERATOR: Self =
Self(Residue::new(&U512::from_u8($MULTIPLICATIVE_GENERATOR)));
// True for both the Ed448 Scalar field and FieldElement field // True for both the Ed448 Scalar field and FieldElement field
const S: u32 = 1; const S: u32 = 1;
// Both fields have their root of unity as -1 // Both fields have their root of unity as -1
const ROOT_OF_UNITY: Self = Self($MODULUS.0.saturating_sub(&U512::from_u8(1))); const ROOT_OF_UNITY: Self =
const ROOT_OF_UNITY_INV: Self = $FieldName(U512::from_le_hex($ROOT_OF_UNITY_INV)); Self($ResidueType::sub(&$ResidueType::ZERO, &$ResidueType::new(&U512::ONE)));
const ROOT_OF_UNITY_INV: Self = Self(Self::ROOT_OF_UNITY.0.invert().0);
const DELTA: Self = $FieldName(U512::from_le_hex($DELTA)); const DELTA: Self = $FieldName(Residue::new(&U512::from_le_hex($DELTA)));
fn from_repr(bytes: Self::Repr) -> CtOption<Self> { fn from_repr(bytes: Self::Repr) -> CtOption<Self> {
let res = $FieldName(U512::from_le_slice(&[bytes.as_ref(), [0; 7].as_ref()].concat())); let res = U512::from_le_slice(&[bytes.as_ref(), [0; 7].as_ref()].concat());
CtOption::new(res, res.0.ct_lt(&$MODULUS.0)) CtOption::new($FieldName(Residue::new(&res)), res.ct_lt(&$MODULUS))
} }
fn to_repr(&self) -> Self::Repr { fn to_repr(&self) -> Self::Repr {
let mut repr = GenericArray::<u8, U57>::default(); let mut repr = GenericArray::<u8, U57>::default();
repr.copy_from_slice(&self.0.to_le_bytes()[.. 57]); repr.copy_from_slice(&self.0.retrieve().to_le_bytes()[.. 57]);
repr repr
} }
fn is_odd(&self) -> Choice { fn is_odd(&self) -> Choice {
self.0.is_odd() self.0.retrieve().is_odd()
} }
} }
@@ -261,7 +252,9 @@ macro_rules! field {
} }
fn char_le_bits() -> FieldBits<Self::ReprBits> { fn char_le_bits() -> FieldBits<Self::ReprBits> {
MODULUS.to_le_bits() let mut repr = [0; 56];
repr.copy_from_slice(&MODULUS.to_le_bytes()[.. 56]);
repr.into()
} }
} }

39
crypto/ed448/src/field.rs
View File

@@ -1,10 +1,9 @@
use zeroize::Zeroize; use zeroize::{DefaultIsZeroes, Zeroize};
use crypto_bigint::{U512, U1024}; use crypto_bigint::{
U512, U1024,
/// Ed448 field element. modular::constant_mod::{ResidueParams, Residue},
#[derive(Clone, Copy, PartialEq, Eq, Default, Debug, Zeroize)] };
pub struct FieldElement(pub(crate) U512);
const MODULUS_PADDED_STR: &str = concat!( const MODULUS_PADDED_STR: &str = concat!(
"00000000000000", "00000000000000",
@@ -13,18 +12,27 @@ const MODULUS_PADDED_STR: &str = concat!(
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
); );
impl_modulus!(FieldModulus, U512, MODULUS_PADDED_STR);
pub(crate) type ResidueType = Residue<FieldModulus, { FieldModulus::LIMBS }>;
/// Ed448 field element.
#[derive(Clone, Copy, PartialEq, Eq, Default, Debug)]
pub struct FieldElement(pub(crate) ResidueType);
impl DefaultIsZeroes for FieldElement {}
const MODULUS_STR: &str = concat!( const MODULUS_STR: &str = concat!(
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffe", "fffffffffffffffffffffffffffffffffffffffffffffffffffffffe",
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
); );
// 2**448 - 2**224 - 1 // 2**448 - 2**224 - 1
pub(crate) const MODULUS: FieldElement = FieldElement(U512::from_be_hex(concat!( pub(crate) const MODULUS: U512 = U512::from_be_hex(concat!(
"00000000000000", "00000000000000",
"00", "00",
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffe", "fffffffffffffffffffffffffffffffffffffffffffffffffffffffe",
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
))); ));
const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!(
"0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000",
@@ -35,25 +43,18 @@ const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!(
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffff" "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
)); ));
pub(crate) const Q_4: FieldElement = pub(crate) const Q_4: FieldElement = FieldElement(ResidueType::new(
FieldElement(MODULUS.0.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4))); &MODULUS.saturating_add(&U512::ONE).wrapping_div(&U512::from_u8(4)),
));
field!( field!(
FieldElement, FieldElement,
MODULUS_PADDED_STR, ResidueType,
MODULUS_STR, MODULUS_STR,
MODULUS, MODULUS,
WIDE_MODULUS, WIDE_MODULUS,
448, 448,
concat!(
"00000000000000000000000000000000000000000000000000000080ffffffff",
"ffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000",
),
7, 7,
concat!(
"fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffff",
"ffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000",
),
concat!( concat!(
"3100000000000000000000000000000000000000000000000000000000000000", "3100000000000000000000000000000000000000000000000000000000000000",
"0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000",

15
crypto/ed448/src/point.rs
View File

@@ -10,7 +10,7 @@ use rand_core::RngCore;
use zeroize::Zeroize; use zeroize::Zeroize;
use subtle::{Choice, CtOption, ConstantTimeEq, ConditionallySelectable, ConditionallyNegatable}; use subtle::{Choice, CtOption, ConstantTimeEq, ConditionallySelectable, ConditionallyNegatable};
use crypto_bigint::U512; use crypto_bigint::{U512, modular::constant_mod::Residue};
use group::{ use group::{
ff::{Field, PrimeField, PrimeFieldBits}, ff::{Field, PrimeField, PrimeFieldBits},
@@ -20,18 +20,19 @@ use group::{
use crate::{ use crate::{
backend::u8_from_bool, backend::u8_from_bool,
scalar::{Scalar, MODULUS as SCALAR_MODULUS}, scalar::Scalar,
field::{FieldElement, MODULUS as FIELD_MODULUS, Q_4}, field::{ResidueType, FieldElement, Q_4},
}; };
const D: FieldElement = FieldElement(FIELD_MODULUS.0.saturating_sub(&U512::from_u16(39081))); const D: FieldElement =
FieldElement(ResidueType::sub(&ResidueType::ZERO, &Residue::new(&U512::from_u16(39081))));
const G_Y: FieldElement = FieldElement(U512::from_be_hex(concat!( const G_Y: FieldElement = FieldElement(Residue::new(&U512::from_be_hex(concat!(
"00000000000000", "00000000000000",
"00", "00",
"693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e", "693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e",
"05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14", "05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14",
))); ))));
fn recover_x(y: FieldElement) -> CtOption<FieldElement> { fn recover_x(y: FieldElement) -> CtOption<FieldElement> {
let ysq = y.square(); let ysq = y.square();
@@ -272,7 +273,7 @@ impl MulAssign<&Scalar> for Point {
impl Point { impl Point {
fn is_torsion_free(&self) -> Choice { fn is_torsion_free(&self) -> Choice {
(*self * SCALAR_MODULUS).is_identity() ((*self * (Scalar::ZERO - Scalar::ONE)) + self).is_identity()
} }
} }

36
crypto/ed448/src/scalar.rs
View File

@@ -1,10 +1,9 @@
use zeroize::Zeroize; use zeroize::{DefaultIsZeroes, Zeroize};
use crypto_bigint::{U512, U1024}; use crypto_bigint::{
U512, U1024,
/// Ed448 Scalar field element. modular::constant_mod::{ResidueParams, Residue},
#[derive(Clone, Copy, PartialEq, Eq, Default, Debug, Zeroize)] };
pub struct Scalar(pub(crate) U512);
const MODULUS_PADDED_STR: &str = concat!( const MODULUS_PADDED_STR: &str = concat!(
"00000000000000", "00000000000000",
@@ -13,18 +12,27 @@ const MODULUS_PADDED_STR: &str = concat!(
"7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3",
); );
impl_modulus!(ScalarModulus, U512, MODULUS_PADDED_STR);
type ResidueType = Residue<ScalarModulus, { ScalarModulus::LIMBS }>;
/// Ed448 Scalar field element.
#[derive(Clone, Copy, PartialEq, Eq, Default, Debug)]
pub struct Scalar(pub(crate) ResidueType);
impl DefaultIsZeroes for Scalar {}
const MODULUS_STR: &str = concat!( const MODULUS_STR: &str = concat!(
"3fffffffffffffffffffffffffffffffffffffffffffffffffffffff", "3fffffffffffffffffffffffffffffffffffffffffffffffffffffff",
"7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3",
); );
// 2**446 - 13818066809895115352007386748515426880336692474882178609894547503885 // 2**446 - 13818066809895115352007386748515426880336692474882178609894547503885
pub(crate) const MODULUS: Scalar = Scalar(U512::from_be_hex(concat!( pub(crate) const MODULUS: U512 = U512::from_be_hex(concat!(
"00000000000000", "00000000000000",
"00", "00",
"3fffffffffffffffffffffffffffffffffffffffffffffffffffffff", "3fffffffffffffffffffffffffffffffffffffffffffffffffffffff",
"7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3", "7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3",
))); ));
const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!( const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!(
"0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000",
@@ -37,20 +45,12 @@ const WIDE_MODULUS: U1024 = U1024::from_be_hex(concat!(
field!( field!(
Scalar, Scalar,
MODULUS_PADDED_STR, ResidueType,
MODULUS_STR, MODULUS_STR,
MODULUS, MODULUS,
WIDE_MODULUS, WIDE_MODULUS,
446, 446,
concat!(
"7a22ac554961bc91aac7e2463961b610481b6bd7a46d27e2f41165beffffffff",
"ffffffffffffffffffffffffffffffffffffffffffffff1f0000000000000000",
),
2, 2,
concat!(
"f24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffff",
"ffffffffffffffffffffffffffffffffffffffffffffff3f0000000000000000",
),
concat!( concat!(
"0400000000000000000000000000000000000000000000000000000000000000", "0400000000000000000000000000000000000000000000000000000000000000",
"0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000",
@@ -60,7 +60,7 @@ field!(
impl Scalar { impl Scalar {
/// Perform a wide reduction to obtain a non-biased Scalar. /// Perform a wide reduction to obtain a non-biased Scalar.
pub fn wide_reduce(bytes: [u8; 114]) -> Scalar { pub fn wide_reduce(bytes: [u8; 114]) -> Scalar {
Scalar(reduce(U1024::from_le_slice(&[bytes.as_ref(), &[0; 14]].concat()))) Scalar(Residue::new(&reduce(U1024::from_le_slice(&[bytes.as_ref(), &[0; 14]].concat()))))
} }
} }