-
Notifications
You must be signed in to change notification settings - Fork 163
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
k256: implement Scalar::sqrt
#400
Conversation
0d89dc9
to
57a729f
Compare
let w = { | ||
let t0 = self; | ||
let t1 = t0.square(); | ||
let t2 = t1 * t0; | ||
let t3 = t1.square(); | ||
let t4 = t3.square(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Curiously I wasn't able to replace this with pow_vartime
as copied/pasted from p256
, which is how sqrt
is implemented there.
I tried the following:
let w = self.pow_vartime(&[
0x77fa4bd19a06c82,
0xd755db9cd5e91407,
0xffffffffffffffff,
0x1fffffffffffffff,
]);
It's possible I miscomputed the exponent. Here's my Sage:
sage: n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
sage: n
115792089237316195423570985008687907852837564279074904382605163141518161494337
sage: s = 6
sage: t = (n - 1) >> s
sage: t
1809251394333065553493296640760748560200586941860545380978205674086221273349
sage: (t - 1) / 2
904625697166532776746648320380374280100293470930272690489102837043110636674
sage: hex((t - 1) / 2)
'0x1fffffffffffffffffffffffffffffffd755db9cd5e9140777fa4bd19a06c82'
57a729f
to
7520451
Compare
Scalar::sqrt
Scalar::sqrt
Implements Tonelli-Shank's algorithm for q mod 16 = 1 as synthesized using the `ff_derive` crate, similar to #392 which implements it for the `p256`. Like `p256`, as part of implementing this it was discovered that `root_of_unity()` was incorrect. Here it is (re)calculated with sage: sage: n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 sage: GF(n).primitive_element() 7 sage: s = 6 sage: t = (n - 1) >> s sage: power_mod(7,t,n) 5480320495727936603795231718619559942670027629901634955707709633242980176626 Note that the value was computed correctly originally, but the hex digits were shifted such that the resulting value was left shifted by 4-bits. This has now been corrected.
7520451
to
d333555
Compare
Codecov Report
@@ Coverage Diff @@
## master #400 +/- ##
==========================================
+ Coverage 54.88% 58.59% +3.71%
==========================================
Files 29 29
Lines 4207 4565 +358
==========================================
+ Hits 2309 2675 +366
+ Misses 1898 1890 -8
Continue to review full report at Codecov.
|
I had previously attempted to do this in #400 but had trouble tracking down why it wasn't working. It seems the lower two limbs were shifted shifted 8-bits, i.e. a copy-paste error from Sage. I computed the correct limbs using `ff_derive`, and the tests now pass.
I had previously attempted to do this in #400 but had trouble tracking down why it wasn't working. It seems the lower two limbs were shifted shifted 8-bits, i.e. a copy-paste error from Sage. I computed the correct limbs using `ff_derive`, and the tests now pass.
Implements Tonelli-Shank's algorithm for q mod 16 = 1 as synthesized using the
ff_derive
crate, similar to #392 which implements it for thep256
.Like in
p256
, as part of implementing this it was discovered thatroot_of_unity()
was incorrect. Here it is (re)calculated with sage:Note that the value was computed correctly originally, but the hex digits were shifted such that the resulting value was left shifted by 4-bits. This has now been corrected.