mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-08 04:09:23 +00:00
79aff5d4c8
* Partial move to ff 0.13 It turns out the newly released k256 0.12 isn't on ff 0.13, preventing further work at this time. * Update all crates to work on ff 0.13 The provided curves still need to be expanded to fit the new API. * Finish adding dalek-ff-group ff 0.13 constants * Correct FieldElement::product definition Also stops exporting macros. * Test most new parts of ff 0.13 * Additionally test ff-group-tests with BLS12-381 and the pasta curves We only tested curves from RustCrypto. Now we test a curve offered by zk-crypto, the group behind ff/group, and the pasta curves, which is by Zcash (though Zcash developers are also behind zk-crypto). * Finish Ed448 Fully specifies all constants, passes all tests in ff-group-tests, and finishes moving to ff-0.13. * Add RustCrypto/elliptic-curves to allowed git repos Needed due to k256/p256 incorrectly defining product. * Finish writing ff 0.13 tests * Add additional comments to dalek * Further comments * Update ethereum-serai to ff 0.13
52 lines
1.5 KiB
Rust
52 lines
1.5 KiB
Rust
use subtle::ConditionallySelectable;
|
|
|
|
use curve25519_dalek::edwards::{EdwardsPoint, CompressedEdwardsY};
|
|
|
|
use group::ff::{Field, PrimeField};
|
|
use dalek_ff_group::FieldElement;
|
|
|
|
use crate::hash;
|
|
|
|
/// Monero's hash to point function, as named `ge_fromfe_frombytes_vartime`.
|
|
pub fn hash_to_point(bytes: [u8; 32]) -> EdwardsPoint {
|
|
#[allow(non_snake_case)]
|
|
let A = FieldElement::from(486662u64);
|
|
|
|
let v = FieldElement::from_square(hash(&bytes)).double();
|
|
let w = v + FieldElement::ONE;
|
|
let x = w.square() + (-A.square() * v);
|
|
|
|
// This isn't the complete X, yet its initial value
|
|
// We don't calculate the full X, and instead solely calculate Y, letting dalek reconstruct X
|
|
// While inefficient, it solves API boundaries and reduces the amount of work done here
|
|
#[allow(non_snake_case)]
|
|
let X = {
|
|
let u = w;
|
|
let v = x;
|
|
let v3 = v * v * v;
|
|
let uv3 = u * v3;
|
|
let v7 = v3 * v3 * v;
|
|
let uv7 = u * v7;
|
|
uv3 * uv7.pow((-FieldElement::from(5u8)) * FieldElement::from(8u8).invert().unwrap())
|
|
};
|
|
let x = X.square() * x;
|
|
|
|
let y = w - x;
|
|
let non_zero_0 = !y.is_zero();
|
|
let y_if_non_zero_0 = w + x;
|
|
let sign = non_zero_0 & (!y_if_non_zero_0.is_zero());
|
|
|
|
let mut z = -A;
|
|
z *= FieldElement::conditional_select(&v, &FieldElement::from(1u8), sign);
|
|
#[allow(non_snake_case)]
|
|
let Z = z + w;
|
|
#[allow(non_snake_case)]
|
|
let mut Y = z - w;
|
|
|
|
Y *= Z.invert().unwrap();
|
|
let mut bytes = Y.to_repr();
|
|
bytes[31] |= sign.unwrap_u8() << 7;
|
|
|
|
CompressedEdwardsY(bytes).decompress().unwrap().mul_by_cofactor()
|
|
}
|