|
| 1 | +# ECC Preliminaries |
| 2 | +This module includes a brief explanation of the elliptic curve cryptography primitives used in the library. |
| 3 | +- [Basic ECC Toolbox][crate::docs::ecc#basic-ecc-toolbox] |
| 4 | +- [Twisted Edward's Curve][crate::docs::ecc#twisted-edwards-curve] |
| 5 | + - [EdDSA][crate::docs::ecc#eddsa---edwards-curve-digital-signature-algorithm] |
| 6 | +- [BLS12-381][crate::docs::ecc#bls12-381] |
| 7 | + - [Pairings][crate::docs::ecc#pairing] |
| 8 | +- [Jubjub][crate::docs::ecc#jubjub] |
| 9 | + |
| 10 | +## Basic ECC Toolbox |
| 11 | +- $p$: a large prime number. |
| 12 | +- $\mathbb{F}_p$: Finite field over prime $p$. |
| 13 | +- $E(\mathbb{F}_p): y^2=x^3+ax+b$: is an elliptic curve of the short Weierstrass form defined over $\mathbb{F}_p$. |
| 14 | +- $P = (x, y)$ is a point on $E(\mathbb{F}_p)$. |
| 15 | +- $-P = (x, -y)$ is the negative of the point $P$. |
| 16 | +- $P + (-P) = \mathcal{O}$ is the identity of the curve. |
| 17 | +- $P + \mathcal{O} = P$. |
| 18 | +- Elliptic curve scalar multiplication: |
| 19 | + - Let $n \leftarrow \mathbb{Z}_p$, |
| 20 | + - Let $P$ be a point on $E(\mathbb{F}_p)$, |
| 21 | + - $Q = n \cdot P$ is a point on $E(\mathbb{F}_p)$. |
| 22 | +- Elliptic curve discrete logarithm problem: |
| 23 | + - Let $P$ and $Q$ be points on $E(\mathbb{F}_p)$ and $Q = n \cdot P$. |
| 24 | + - Knowing $P$ and $Q$, finding $n = \log_P^Q$ is a hard problem. |
| 25 | +- Base point: Let $G$ be a base point, then $G$ generates all points at $E(\mathbb{F}_p)$. |
| 26 | +- Order of a point: If $l\cdot P = \mathcal{O}$, then $l$ is the order of $P$. |
| 27 | + |
| 28 | +## Twisted Edward's Curve |
| 29 | +Let $\mathbb{F}_p$ be a field where $p$ is a large prime. The twisted Edward's curve is defined as follows: |
| 30 | + |
| 31 | +$$ E_{E, a, d}: ax^2 + y^2 = 1 + dx^2y^2$$ |
| 32 | + |
| 33 | +where $a, d \in \mathbb{F}_p$ and non-zero. |
| 34 | + |
| 35 | +* A point on $E_{E, a, d}$ is represented as $P = (x, y)$. |
| 36 | +* Negative of a point: $-P = (-x, y)$. |
| 37 | +* Neutral element(point at infinity): $\mathcal{O} = (0,1)$. |
| 38 | +* Let $P = (x_1, y_1)$ and $Q = (x_2, y_2)$ be points on $E_{E, a, d}$. $P+Q = (x_3, y_3)$ is written as: |
| 39 | + |
| 40 | +$$(x_3, y_3) = \Bigg(\frac{x_1y_2 + y_1x_2}{1 + dx_1x_2y_1y_2}, \frac{y_1y_2 - ax_1x_2}{1 - dx_1x_2y_1y_2}\Bigg).$$ |
| 41 | + |
| 42 | + |
| 43 | +### EdDSA - (Edward's Curve Digital Signature Algorithm) |
| 44 | +Let $B$ be the base point of $E_{E, a, d}$ with order $l$ and $H$ be a hash function with $2b-$bit output size where $2^{b-1} > p$. |
| 45 | +* $keygen$ |
| 46 | + * **Input**: Security parameter $\lambda$. |
| 47 | + * **Output**: Keypair $(x, P)$. |
| 48 | + * **Algorithm**: |
| 49 | + * Choose a random scalar as the private key: $x \leftarrow \mathbb{Z}_p$, |
| 50 | + * Compute the public key: $P \leftarrow x \cdot B$, |
| 51 | + * Return $(x, P)$. |
| 52 | +* $sign$ |
| 53 | + * **Input**: Keypair $(x, P)$, message $m$. |
| 54 | + * **Output**: Signature $\sigma = (R, s)$. |
| 55 | + * **Algorithm**: |
| 56 | + * Get the hash of private key and the message: $r = H(H_{b, \ldots, 2b-1}(x) || m)$. |
| 57 | + * Compute the point $R = r \cdot B$. |
| 58 | + * Calculate $s \equiv r + H(R || P|| m) x \mod{l}$. |
| 59 | + * Return $(R, s)$. |
| 60 | +* $verify$ |
| 61 | + * **Input**: Message $m$, public key $P$, signature $\sigma = (R, s)$. |
| 62 | + * **Output**: $true/false$ |
| 63 | + * **Algorithm**: |
| 64 | + * If $s \cdot B = R + H(R || P|| m) \cdot P$, return $true$. |
| 65 | + * Else, return $false$. |
| 66 | + |
| 67 | + |
| 68 | +--- |
| 69 | + |
| 70 | + |
| 71 | +## BLS12-381 |
| 72 | + |
| 73 | +### Curve setting |
| 74 | +* `z = -0xd201000000010000` (hexadecimal): low hamming weight, few bits set to $1$. |
| 75 | + * Field modulus: $q = \frac{1}{3}(z-1)^2(z^4 - z^2 + 1) + z$, $381$-bit |
| 76 | + ```ignore |
| 77 | + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab |
| 78 | + ``` |
| 79 | + * Subgroup size: $r = (z^4 - z^2 + 1)$, $255$-bit. |
| 80 | + ```ignore |
| 81 | + 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 |
| 82 | + ``` |
| 83 | +* **Curve 1:** $E(\mathbb{F}_q): y^2 = x^3 + 4$. |
| 84 | +* **Curve 2:** $E'(\mathbb{F}_{q^2}): y^2 = x^3 + 4 (1 + i)$. |
| 85 | + |
| 86 | +### Pairing |
| 87 | +A pairing is a bilinear map, taking as input two points, each from two distinct groups of the same prime order, $r$. This map outputs a point from a group $G_T$. The pairing is defined as follows: |
| 88 | + |
| 89 | +$$e: G_1 \times G_2 \rightarrow G_T$$ |
| 90 | + |
| 91 | +* $P \in G_1 \sub E(\mathbb{F}_q)$ |
| 92 | +* $Q \in G_2 \sub E'(\mathbb{F}_{q^2})$ |
| 93 | +* $G_T \sub \mathbb{F}_{q^{12}}$ |
| 94 | + |
| 95 | +Pairing is denoted as $e(P, R)$. Pairing-based cryptography uses the following properties: |
| 96 | +* $e(P, Q+R) = e(P, Q) \cdot e(P, R)$, |
| 97 | +* $e(P+S, R) = e(P, R) \cdot e(S, R)$. |
| 98 | + |
| 99 | +Thus, the following identity holds: |
| 100 | + |
| 101 | +$$e(\[a\]P, \[b\]Q) = e(P, \[b\]Q)^a = e(P, Q)^{ab} = e(P, \[a\]Q)b = e(\[b\]P, \[a\]Q).$$ |
| 102 | + |
| 103 | + |
| 104 | +## jubjub |
| 105 | + |
| 106 | +Jubjub is an elliptic curve of the twisted Edward's form. It is defined over finite field $\mathbb{F}_q$ where |
| 107 | +```ignore |
| 108 | +q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 |
| 109 | +``` |
| 110 | +with a subgroup of order $r$ and cofactor $8$. |
| 111 | +```ignore |
| 112 | +r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7 |
| 113 | +``` |
| 114 | +Let $d = -(10240/10241)$, the Jubjub curve is defined as follows: |
| 115 | + |
| 116 | +$$E_{d}: -u^2 + v^2 = 1 + du^2v^2.$$ |
| 117 | + |
| 118 | +* $\mathbb{F}_q$ is chosen to be the scalar field of BLS12-381 curve construction. |
0 commit comments