Commit 2406eb00 authored by benoit's avatar benoit
Browse files

minor

parent 756d8f98
......@@ -37,7 +37,8 @@ with it in the proofs (\ref{subsec:curvep2}).
correctness. The white tiles are definitions, the orange ones are hypothesis and
the green tiles represent major lemmas and theorems.
The plan is as follows.
% The plan is as follows.
% (This is part of the description of the picture).
We consider the field $\K$ and formalize the Montgomery curves ($M_{a,b}(\K)$).
Then, by using the equivalent Weierstra{\ss} form ($E_{a',b'}(\K)$) from the library of Bartzia and Strub,
we prove that $M_{a,b}(\K)$ forms an commutative group.
......@@ -51,6 +52,9 @@ $a^2 - 4$ is not a square in $\K$, we prove the correctness of the ladder (\tref
\label{tikz:ProofHighLevel1}
\end{figure}
% this is for the flow of the text otherwise someone will again complain of a definition poping out of nowhere.
We now turn our attention to the details of the proof of the ladder's correctness.
\begin{dfn}
Given a field $\K$,
using an appropriate choice of coordinates,
......@@ -79,8 +83,8 @@ Then, this equation $E(x,y)$ can be reduced into its short Weierstra{\ss} form.
In this setting, Bartzia and Strub defined the parametric type \texttt{ec} which
represents the points on a specific curve. It is parameterized by
a \texttt{K : ecuFieldType}, the type of fields whose characteristic is neither 2 nor 3,
and \texttt{E : ecuType}, a record that packs the curve parameters $a$ and $b$
a \texttt{K : ecuFieldType} ---the type of fields whose characteristic is neither 2 nor 3---
and \texttt{E : ecuType} ---a record that packs the curve parameters $a$ and $b$---
along with the proof that $\Delta(a,b) \neq 0$.
\begin{lstlisting}[language=Coq]
Inductive point := EC_Inf | EC_In of K * K.
......@@ -96,16 +100,12 @@ Definition oncurve (p : point) :=
Inductive ec : Type := EC p of oncurve p.
\end{lstlisting}
Points on an elliptic curve form an commutative group when equipped with the following structure.
Points on an elliptic curve form an abelian group when equipped with the following structure.%
\begin{itemize}
\item The negation of a point $P = (x,y)$ is defined by reflection over the $x$-axis, \ie $-P = (x, -y)$.
\item The addition of two points $P, Q \in E_{a,b}(\K) \setminus \{\Oinf\}$ with $P \neq Q$ and $P \neq -Q$
is defined as the negation of the third intersection point of the line through $P$ and $Q$.
In case $P = Q$, we either use the line tangent to $P$ if $P$ is not an inflection point,
and define $P + Q = -P = -Q$ otherwise.
In case $P = -Q$, we define $P + Q = \Oinf$.
\item The point $\Oinf$ acts as the neutral element. Hence, we define $-\Oinf = \Oinf$,
$P + \Oinf = P$ and $\Oinf + P = P$.
\item The addition of two points $P$ and $Q$ is defined as the negation of the third intersection point
of the line passing through $P$ and $Q$, or tangent to $P$ if $P = Q$.
\item $\Oinf$ is the neutral element under this law: if 3 points are collinear, their sum is equal to $\Oinf$
\end{itemize}
These operations are defined in Coq as follows (where we omit the code for the tangent case):
\begin{lstlisting}[language=Coq]
......@@ -147,8 +147,8 @@ than the Weierstra{\ss} form. We consider the Montgomery form \cite{MontgomerySp
Similar to the definition of \texttt{ec}, we define the parametric type \texttt{mc} which
represents the points on a specific Montgomery curve.
It is parameterized by
a \texttt{K : ecuFieldType}, the type of fields whose characteristic is neither
2 nor 3, and \texttt{M : mcuType}, a record that packs the curve
a \texttt{K : ecuFieldType} ---the type of fields whose characteristic is neither
2 nor 3--- and \texttt{M : mcuType} ---a record that packs the curve
parameters $a$ and $b$ along with the proofs that $b \neq 0$ and $a^2 \neq 4$.
\begin{lstlisting}[language=Coq,belowskip=-0.1 \baselineskip]
Record mcuType :=
......@@ -177,7 +177,7 @@ Definition add (p1 p2 : point K) :=
(| xs, - s * (xs - x1) - y1 |)
end.
\end{lstlisting}
And again we prove the result is on the curve: % (again with coercion):
And again we prove the result is on the curve:
\begin{lstlisting}[language=Coq]
Lemma addO (p q : mc) : oncurve (add p q).
......@@ -185,21 +185,19 @@ Definition addmc (p1 p2 : mc) : mc :=
MC p1 p2 (addO p1 p2)
\end{lstlisting}
Remarkably, of all the group properties, associativity is the hardest one to prove for elliptic curves.
Instead of reproving this property for Montgomery curves, we transfer it from the Weierstra{\ss} curves
with a trick.
We define a bijection between a Montgomery curve and its short Weierstra{\ss} form
(as in \lref{lemma:bij-ecc})
and prove that it respects the addition as defined on the respective curves.
It is then easy to verify all the group laws for Montgomery curves from the Weierstra{\ss} ones.
(\lref{lemma:bij-ecc}) and prove that it respects the addition as defined on the
respective curves. In this way we get all the group laws for Montgomery curves from the Weierstra{\ss} ones.
After we have verified the group properties, it follows that the bijection is a group isomorphism.
After having verified the group properties, it follows that the bijection is a group isomorphism.
\begin{lemma}
\label{lemma:bij-ecc}
Let $M_{a,b}$ be a Montgomery curve, define
\vspace{-0.3em}
$$a' = \frac{3-a^2}{3b^2} \text{\ \ \ \ and\ \ \ \ } b' = \frac{2a^3 - 9a}{27b^3}.$$
then $E_{a',b'}$ is a Weierstra{\ss} curve, and the mapping
$\varphi : M_{a,b} \to E_{a',b'}$ defined as:
$\varphi : M_{a,b} \mapsto E_{a',b'}$ defined as:
\vspace{-0.5em}
\begin{align*}
\varphi(\Oinf_M) & = \Oinf_E \\
\varphi( (x , y) ) & = \left( \frac{x}{b} + \frac{a}{3b} , \frac{y}{b} \right)
......@@ -226,13 +224,13 @@ After we have verified the group properties, it follows that the bijection is a
\label{subsec:ECC-projective}
In a projective plane, points are represented by the triples $(X:Y:Z)$ excluding $(0:0:0)$.
Scalar multiples of triples are identified with eachother, \ie
Scalar multiples of triples are identified with each other, \ie
for all $\lambda \neq 0$, the triples $(X:Y:Z)$ and $(\lambda X:\lambda Y:\lambda Z)$ represent
the same point in the projective plane.
For $Z\neq 0$, the point $(X:Y:Z)$ corresponds to the
point $(X/Z,Y/Z)$ in the affine plane.
Likewise, the point $(X,Y)$ in the affine plane corresponds to $(X:Y:1)$ in the projective plane.
The points $(X : Y : 0)$ can be considered as points at infinity.
% The points $(X : Y : 0)$ can be considered as points at infinity.
Using fractions as coordinates, the equation for a Montgomery curve $M_{a,b}$
becomes
......@@ -256,10 +254,11 @@ Hypothesis mcu_no_square :
We define $\chi$ and $\chi_0$ to return the \xcoord of points on a curve.
\begin{dfn}
Let $\chi : M_{a,b}(\K) \to \K \cup \{\infty\}$ and $\chi_0 : M_{a,b}(\K) \to \K$ such that
Let $\chi : M_{a,b}(\K) \mapsto \K \cup \{\infty\}$ and $\chi_0 : M_{a,b}(\K) \mapsto \K$ such that
\vspace{-0.5em}
\begin{align*}
\chi((x,y)) &= x, & \chi(\Oinf) &= \infty, &&\text{and} \\
\chi_0((x,y)) &= x, & \chi_0(\Oinf) &= 0.
\chi((x,y)) & = x, & \chi(\Oinf) & = \infty, & & \text{and} \\[-0.5ex]
\chi_0((x,y)) & = x, & \chi_0(\Oinf) & = 0.
\end{align*}
\end{dfn}
......@@ -270,9 +269,10 @@ Using projective coordinates we prove the formula for differential addition.% (\
let $X_1, Z_1, X_2, Z_2, X_4, Z_4 \in \K$, such that $(X_1,Z_1) \neq (0,0)$,
$(X_2,Z_2) \neq (0,0)$, $X_4 \neq 0$ and $Z_4 \neq 0$.
Define
\vspace{-0.5em}
\begin{align*}
X_3 & = Z_4((X_1 - Z_1)(X_2+Z_2) + (X_1+Z_1)(X_2-Z_2))^2 \\
Z_3 & = X_4((X_1 - Z_1)(X_2+Z_2) - (X_1+Z_1)(X_2-Z_2))^2,
X_3 & = Z_4((X_1 - Z_1)(X_2+Z_2) + (X_1+Z_1)(X_2-Z_2))^2 \\[-0.5ex]
Z_3 & = X_4((X_1 - Z_1)(X_2+Z_2) - (X_1+Z_1)(X_2-Z_2))^2
\end{align*}
then for any point $P_1$ and $P_2$ in $M_{a,b}(\K)$ such that
$X_1/Z_1 = \chi(P_1), X_2/Z_2 = \chi(P_2)$, and $X_4/Z_4 = \chi(P_1 - P_2)$,
......@@ -550,8 +550,7 @@ We now study the case of the scalar multiplication and show similar proofs.
such that $\varphi((x,y)) = ((x,0), (y,0))$.
\item[--] $\varphi_t: M_{486662,2}(\F{p}) \mapsto M_{486662,1}(\F{p^2})$\\
such that $\varphi((x,y)) = ((x,0), (0,y))$.
\item[--] $\psi: \F{p^2} \mapsto \F{p}$\\
such that $\psi(x,y) = x$.
\item[--] $\psi: \F{p^2} \mapsto \F{p}$ such that $\psi(x,y) = x$.
\end{itemize}
\end{dfn}
......@@ -559,15 +558,17 @@ We now study the case of the scalar multiplication and show similar proofs.
\label{lemma:proj}
For all $n \in \N$, for all point $P\in\F{p}\times\F{p}$ on the curve
$M_{486662,1}(\F{p})$ (respectively on the quadratic twist $M_{486662,2}(\F{p})$), we have
\vspace{-0.3em}
\begin{align*}
P &\in M_{486662,1}(\F{p}) & \implies \varphi_c(n \cdot P) &= n \cdot \varphi_c(P), &&\text{and} \\
P &\in M_{486662,2}(\F{p}) & \implies \varphi_t(n \cdot P) &= n \cdot \varphi_t(P).
P & \in M_{486662,1}(\F{p}) & \implies \varphi_c(n \cdot P) & = n \cdot \varphi_c(P), & & \text{and} \\
P & \in M_{486662,2}(\F{p}) & \implies \varphi_t(n \cdot P) & = n \cdot \varphi_t(P).
\end{align*}
\end{lemma}
Notice that
\vspace{-0.5em}
\begin{align*}
\forall P \in M_{486662,1}(\F{p}), &&\psi(\chi_0(\varphi_c(P))) &= \chi_0(P), &&\text{and} \\
\forall P \in M_{486662,2}(\F{p}), &&\psi(\chi_0(\varphi_t(P))) &= \chi_0(P).
\forall P \in M_{486662,1}(\F{p}), & & \psi(\chi_0(\varphi_c(P))) & = \chi_0(P), & & \text{and} \\
\forall P \in M_{486662,2}(\F{p}), & & \psi(\chi_0(\varphi_t(P))) & = \chi_0(P).
\end{align*}
In summary, for all $n \in \N$, $n < 2^{255}$, for any point $P\in\F{p}\times\F{p}$
......
......@@ -244,7 +244,7 @@ the same time.
\label{subsec:num-repr-rfc}
As described in \sref{subsec:Number-TweetNaCl}, numbers in \TNaCle{gf}
(typedef of an array of 16 \TNaCle{long long}) are represented
(array of 16 \TNaCle{long long}) are represented
in $2^{16}$ and we use a direct mapping to represent that array as a list
integers in Coq. However, in order to show the correctness of the basic operations,
we need to convert this number to an integer.
......@@ -273,8 +273,7 @@ Lemma mult_GF_Zlength :
forall (a:list Z) (b:list Z),
Zlength a = 16 ->
Zlength b = 16 ->
(Z16.lst (Low.M a b)) :GF =
(Z16.lst a * Z16.lst b) :GF.
(Z16.lst (Low.M a b)):GF = (Z16.lst a * Z16.lst b):GF.
\end{lstlisting}
However for our purpose, simple functional correctness is not enough.
......
......@@ -64,6 +64,8 @@ $(P_b, P_{1-b})$.
By using the differential addition and doubling operations we define the Montgomery ladder
computing a \xcoord-only scalar multiplication (see \aref{alg:montgomery-ladder}).
% \setlength{\textfloatsep}{1em}
\begin{algorithm}
\caption{Montgomery ladder for scalar mult.}
\label{alg:montgomery-ladder}
......@@ -83,7 +85,6 @@ computing a \xcoord-only scalar multiplication (see \aref{alg:montgomery-ladder}
\end{algorithmic}
\end{algorithm}
\subsection{The X25519 key exchange}
\label{subsec:X25519-key-exchange}
......
\section{Organization of the proof files}
\label{appendix:proof-folders}
\subheading{Requirements}
\subheading{Requirements.}
Our proofs requires the use of \emph{Coq 8.8.2} for the proofs and
\emph{Opam 2.0} to manage the dependencies. We are aware that there exists more
recent versions of Coq; VST; CompCert etc. however to avoid dealing with backward
breaking compatibility we decided to freeze our dependencies.
\subheading{Associated files}
The archive containing the proof is composed of two folders \textbf{\texttt{packages}}
\subheading{Associated files.}
The repository containing the proof is composed of two folders \textbf{\texttt{packages}}
and \textbf{\texttt{proofs}}.
It aims to be used at the same time as an \emph{opam} repository to manage
the dependencies of the proof and to provide the code.
......
......@@ -119,7 +119,7 @@ Fixpoint ZofList {n:Z} (a:list Z) : Z :=
| h :: q => h + 2^n * ZofList q
end.
\end{lstlisting}
The encoding from integers to bytes is defined in a similar way:
The encoding from integers to bytes is defined in a similar way.
\begin{dfn}
Let \Coqe{ListofZ32} : $\Z \rightarrow \Z \rightarrow \texttt{list}~\Z$, given
$n$ and $a$ returns $a$'s little-endian encoding as a list with radix $2^n$.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment