SChernykh
252 lines
6.6 KiB
C++
252 lines
6.6 KiB
C++
// Copyright (c) 2024, The Monero Project
|
|
//
|
|
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without modification, are
|
|
// permitted provided that the following conditions are met:
|
|
//
|
|
// 1. Redistributions of source code must retain the above copyright notice, this list of
|
|
// conditions and the following disclaimer.
|
|
//
|
|
// 2. Redistributions in binary form must reproduce the above copyright notice, this list
|
|
// of conditions and the following disclaimer in the documentation and/or other
|
|
// materials provided with the distribution.
|
|
//
|
|
// 3. Neither the name of the copyright holder nor the names of its contributors may be
|
|
// used to endorse or promote products derived from this software without specific
|
|
// prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
|
|
// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
|
|
// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
|
|
// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
#ifdef _MSC_VER
|
|
#pragma warning(disable: 4800)
|
|
#endif
|
|
|
|
extern "C" {
|
|
#include "crypto-ops.h"
|
|
}
|
|
|
|
#include "fcmp_pp_crypto.h"
|
|
#include <cstring>
|
|
|
|
static bool fe_compare(const fe a, const fe b)
|
|
{
|
|
unsigned char a_bytes[32];
|
|
unsigned char b_bytes[32];
|
|
|
|
fe_tobytes(a_bytes, a);
|
|
fe_tobytes(b_bytes, b);
|
|
|
|
return memcmp(a_bytes, b_bytes, sizeof(a_bytes)) == 0;
|
|
}
|
|
|
|
static bool sqrt_ext(fe y, const fe x)
|
|
{
|
|
fe y_res;
|
|
|
|
fe x2;
|
|
fe_dbl(x2, x);
|
|
|
|
fe b;
|
|
fe_pow22523(b, x2);
|
|
|
|
fe b_sq;
|
|
fe_sq(b_sq, b);
|
|
|
|
fe c;
|
|
fe_mul(c, x2, b_sq);
|
|
|
|
if (fe_compare(c, fe_one) || fe_compare(c, fe_m1))
|
|
{
|
|
fe_0(c);
|
|
c[0] = 3;
|
|
}
|
|
|
|
fe c_sub_1;
|
|
fe_sub(c_sub_1, c, fe_one);
|
|
|
|
fe_mul(y_res, x, b);
|
|
fe_mul(y_res, y_res, c_sub_1);
|
|
|
|
if (fe_isnegative(y_res)) {
|
|
fe_neg(y_res, y_res);
|
|
}
|
|
|
|
fe y_sq;
|
|
fe_sq(y_sq, y_res);
|
|
bool r = fe_compare(x, y_sq);
|
|
|
|
fe_copy(y, y_res);
|
|
return r;
|
|
};
|
|
|
|
namespace fcmp_pp
|
|
{
|
|
// TODO: impl faster sqrt
|
|
bool sqrt(fe y, const fe x)
|
|
{
|
|
return sqrt_ext(y, x);
|
|
};
|
|
} // namespace fcmp_pp
|
|
|
|
static void inv_iso(fe u_out, fe w_out, const fe u, const fe w)
|
|
{
|
|
// 4u
|
|
fe_dbl(u_out, u);
|
|
fe_dbl(u_out, u_out);
|
|
// 2w
|
|
fe_dbl(w_out, w);
|
|
};
|
|
|
|
static void inv_psi1(fe e_out, fe u_out, fe w_out, const fe e, const fe u, const fe w)
|
|
{
|
|
fe e_res, u_res, w_res;
|
|
|
|
fe tt;
|
|
bool cc = sqrt_ext(tt, u);
|
|
fe_copy(w_res, tt);
|
|
fe w_;
|
|
fe_copy(w_, w);
|
|
fe_copy(e_res, e);
|
|
|
|
if (!cc)
|
|
{
|
|
fe tt_sq;
|
|
fe_sq(tt_sq, tt);
|
|
fe neg_u_dbl;
|
|
fe_dbl(neg_u_dbl, u);
|
|
fe_neg(neg_u_dbl, neg_u_dbl);
|
|
if (fe_compare(tt_sq, neg_u_dbl)) {
|
|
fe_mul(tt, tt, fe_sqrtm1);
|
|
}
|
|
|
|
fe_mul(w_, w, tt);
|
|
|
|
fe e_sq;
|
|
fe_sq(e_sq, e);
|
|
fe_mul(w_res, fe_msqrt2b, e_sq);
|
|
|
|
fe_mul(e_res, e_res, tt);
|
|
}
|
|
|
|
fe w_res_sq;
|
|
fe_sq(w_res_sq, w_res);
|
|
|
|
fe e_res_sq;
|
|
fe_sq(e_res_sq, e_res);
|
|
|
|
fe A_e_sq;
|
|
fe_mul(A_e_sq, fe_a0, e_res_sq);
|
|
|
|
fe w_res_w;
|
|
fe_mul(w_res_w, w_res, w_);
|
|
|
|
fe_sub(u_res, w_res_sq, A_e_sq);
|
|
fe_reduce(u_res, u_res);
|
|
fe_sub(u_res, u_res, w_res_w);
|
|
fe_mul(u_res, u_res, fe_inv2);
|
|
|
|
fe_copy(e_out, e_res);
|
|
fe_copy(u_out, u_res);
|
|
fe_copy(w_out, w_res);
|
|
};
|
|
|
|
static bool inv_psi2(fe u_out, fe w_out, const fe e, const fe u, const fe w)
|
|
{
|
|
fe u_res, w_res;
|
|
|
|
if (!fcmp_pp::sqrt(w_res, u))
|
|
return false;
|
|
fe e_sq;
|
|
fe_sq(e_sq, e);
|
|
fe Ap_e_sq;
|
|
fe_mul(Ap_e_sq, fe_ap, e_sq);
|
|
|
|
fe w_res_w;
|
|
fe_mul(w_res_w, w_res, w);
|
|
|
|
fe_sub(u_res, u, Ap_e_sq);
|
|
fe_reduce(u_res, u_res);
|
|
fe_sub(u_res, u_res, w_res_w);
|
|
fe_mul(u_res, u_res, fe_inv2);
|
|
|
|
fe_copy(u_out, u_res);
|
|
fe_copy(w_out, w_res);
|
|
|
|
return true;
|
|
};
|
|
|
|
namespace fcmp_pp
|
|
{
|
|
//----------------------------------------------------------------------------------------------------------------------
|
|
bool mul8_is_identity(const ge_p3 &point) {
|
|
ge_p2 point_ge_p2;
|
|
ge_p3_to_p2(&point_ge_p2, &point);
|
|
ge_p1p1 point_mul8;
|
|
ge_mul8(&point_mul8, &point_ge_p2);
|
|
ge_p3 point_mul8_p3;
|
|
ge_p1p1_to_p3(&point_mul8_p3, &point_mul8);
|
|
return ge_p3_is_point_at_infinity_vartime(&point_mul8_p3);
|
|
}
|
|
//----------------------------------------------------------------------------------------------------------------------
|
|
// https://github.com/kayabaNerve/fcmp-plus-plus/blob/94744c5324e869a9483bbbd93a864e108304bf76/crypto/divisors/src/tests/torsion_check.rs
|
|
// Returns true if point is torsion free
|
|
// Pre-condition: point is a valid point and point*8 not equal to identity
|
|
// WARNING1: this approach needs to be carefully vetted academically and audited
|
|
// before it can be used in production.
|
|
// WARNING2: since fe_add and fe_sub expect the input fe's to be within a
|
|
// smaller domain than the output fe, we sometimes need to "reduce" a field elem
|
|
// to chain calls to fe_add and fe_sub. Notice all calls to fe_reduce.
|
|
bool torsion_check_vartime(const ge_p3 &point) {
|
|
//assert(!mul8_is_identity(point));
|
|
|
|
// ed to wei
|
|
fe e, u, w;
|
|
{
|
|
fe z_plus_ed_y, z_minus_ed_y;
|
|
fe_add(z_plus_ed_y, fe_one, point.Y);
|
|
fe_sub(z_minus_ed_y, fe_one, point.Y);
|
|
|
|
// e
|
|
fe_mul(e, z_minus_ed_y, point.X);
|
|
// u
|
|
fe_mul(u, fe_a_sub_d, z_plus_ed_y);
|
|
fe_mul(u, u, point.X);
|
|
fe_mul(u, u, e);
|
|
// w
|
|
fe_dbl(w, z_minus_ed_y);
|
|
}
|
|
|
|
//assert(check_e_u_w(e, u, w));
|
|
|
|
// Torsion check
|
|
for (int i = 0; i < 2; ++i) {
|
|
inv_iso(u, w, u, w);
|
|
if (!inv_psi2(u, w, e, u, w)) {
|
|
return false;
|
|
}
|
|
inv_psi1(e, u, w, e, u, w);
|
|
//assert(check_e_u_w(e, u, w));
|
|
}
|
|
|
|
fe _;
|
|
inv_iso(u, _, u, w);
|
|
|
|
if (!sqrt(u, u)) {
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
//----------------------------------------------------------------------------------------------------------------------
|
|
//----------------------------------------------------------------------------------------------------------------------
|
|
}//namespace fcmp_pp
|