Hash2Curve uniform interface #188
Conversation
Tabaie
changed the title
|
@yelhousni There are errors with bw6-633 G1 and bw6-761 G2. The combination of the SSWU and the isogeny is not on the curve. It could either be that the SSWU parameters are incorrect, or the isogeny. Would you take a look at the isogenies? In the meantime I'll develop a test for the map itself to see if the output is actually on E'. |
|
It seems that all the SSWU are "correct" (in the sense that the output is always on E') |
|
@Tabaie So there were some errors in ordering the isogeny denominator coefficients for bw6-761 G2 and a duplicate coefficient in bw6-633 G1. Now everything is corrected and tests pass. |
|
@Tabaie so API wise, we have
In the signatures, |
|
|
I see I thought dst == destination |
| } | ||
|
|
||
| // returns false if u>-u when seen as a bigInt | ||
| func sign0(u fp.Element) bool { |
There was a problem hiding this comment.
@Tabaie can we use fp.Element.LexicographicallyLargest here?
There was a problem hiding this comment.
@gbotrel The result is the same but the change seems to have caused multiple race conditions, no idea why.
EDIT: The result is the opposite actually.
There was a problem hiding this comment.
can you investigate a bit? Are you sure it's coming from that specific commit? (I also don't obviously see why it happened, maybe it uncovered a bug somewhere we need to be aware of 👍 )
There was a problem hiding this comment.
@Tabaie so when I set this e3 to false or true, the tests always pass (bn254):
e3 := false // sign0(u) && sign0(y)
if !e3 {
y.Neg(&y)
}
| } | ||
|
|
||
| // EncodeToG2 maps an fp.Element to a point on the curve using the Shallue and van de Woestijne map | ||
| // https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-2.2.2 |
There was a problem hiding this comment.
@Tabaie can we update the doc of the public functions (EncodeXXX, MapXX, ...) to explain the parameters?
For example, DST is not clear if you don't jump on the specs. Some function says "map an fp.Element" but takes as param a []byte.
|
@gbotrel dst is domain separation tag actually. |
No description provided.