Commit 42e02e38 authored by Benoit Viguier's avatar Benoit Viguier
Browse files

more text

parent 82cb77e3
......@@ -9,53 +9,62 @@ Finally, we provide a brief description of the formal tools we use in our proofs
\label{subsec:montgomery}
\begin{definition}
Let $a,b \in \K$, $M_{a,b}$ is a Montgomery curve defined over a field $\K$ with equation:
$$M_{a,b}: by^2 = x^3 + ax^2 + x$$
where $a^2 \neq 4$ and $b \neq 0$.
Let $a,b \in \K$ such that $a^2 \neq 4$ and $b \neq 0$, $M_{a,b}$ is a
Montgomery curve defined over a field $\K$ with equation:
$$M_{a,b}: by^2 = x^3 + ax^2 + x$$
\end{definition}
\begin{definition}
For any algebraic extension $\L$ of $\K$, $\K \subseteq \L$,
$M_{a,b}(\L)$ is the set of $\L$-rational points which satisfy the equation with
addition to the point at infinity $\Oinf$.
$$M_{a,b}(\L) = \{\Oinf\} \cup \{(x,y) \in \L \times \L~|~by^2 = x^3 + ax^2 + x\}$$
For any algebraic extension $\L$ of $\K$, $\K \subseteq \L$,
$M_{a,b}(\L)$ is the set of $\L$-rational points which satisfy the equation with
addition to the point at infinity $\Oinf$.
$$M_{a,b}(\L) = \{\Oinf\} \cup \{(x,y) \in \L \times \L~|~by^2 = x^3 + ax^2 + x\}$$
\end{definition}
Details of the formalization can be found in Section~\ref{montgomery}.
For $M_{a,b}$ over $\F{p}$, the parameter $b$ is known as the ``twisting factor'',
for $b'\in \F{p}\backslash\{0\}$ and $b' \neq b$, the curves $M_{a,b}$ and $M_{a,b'}$
are isomorphic via $(x,y) \mapsto (x, \sqrt{b'/b} \cdot y)$.
When $b'/b$ is not a square in \F{p}, $M_{a,b'}$ is a quadratic twist of $M_{a,b}$:
isomorphic over $\F{p^2}$~\cite{cryptoeprint:2017:212}.
\begin{definition}
For $M_{a,b}$ over $\F{p}$, the parameter $b$ is known as the ``twisting factor'',
for $b'\in \F{p}\backslash\{0\}$ and $b' \neq b$, the curves $M_{a,b}$ and $M_{a,b'}$
are isomorphic via $(x,y) \mapsto (x, \sqrt{b'/b} \cdot y)$.
When $b'/b$ is not a square in \F{p}, $M_{a,b'}$ is a quadratic twist of $M_{a,b}$:
isomorphic over $\F{p^2}$~\cite{cryptoeprint:2017:212}.
\end{definition}
Points over $M_{a,b}(\K)$ can be equipped with a structure of an abelian group
with the addition operation $\oplus$ and with neutral element the point at infinity $\Oinf$.
Using this law, we have the scalar multiplication over $M_{a,b}(\K)$ defined by:
$$n\cdot P = \underbrace{P \oplus \cdots \oplus P}_{n\text{ times}}$$
We now consider x-coordinate-only operations. In order to simplify computations,
such coordinates are represented as $X/Z$ fractions. We define two operations:
\begin{align*}
\texttt{xADD} &: (X_P, Z_P, X_Q , Z_Q, X_{P-Q}, Z_{P-Q}) \mapsto (X_{P+Q}, Z_{P+Q})\\
\texttt{xDBL} &: (X_P, Z_P) \mapsto (X_{2P}, Z_{2P})\\
\end{align*}
By using this differential addition and doubling operations we define the Montgomery ladder
computing a x-coordinate-only scalar multiplication (see Algorithm~\ref{montgomery-ladder}).
\begin{algorithm}
\caption{Montgomery ladder for scalar mult.}
\label{montgomery-ladder}
\begin{algorithmic}
\REQUIRE{x-coordinate of $P$ : $P.x$, scalars $n$ and $m$, $n < 2^m$}
\ENSURE{$Q = n \cdot P$}
\STATE $Q \leftarrow (X_P, Z_P)$
\STATE $R \leftarrow \Oinf$
\STATE $Q \leftarrow \Oinf$
\STATE $R \leftarrow (X_P,Z_P)$
\FOR{$k$ := $m$ down to $1$}
\IF{$k^{\text{th}}$ bit of $n$ is $0$}
\STATE $R \leftarrow \texttt{xADD}(Q,R,X_P,Z_P)$
\STATE $Q \leftarrow \texttt{xDBL}(X_P, Z_P)$
\STATE $Q \leftarrow \texttt{xDBL}(Q)$
\ELSE
\STATE $Q \leftarrow \texttt{xADD}(Q,R,X_P,Z_P)$
\STATE $R \leftarrow \texttt{xDBL}(X_P, Z_P)$
\STATE $Q \leftarrow \texttt{xADD}(Q,R,X_P,Z_P)$
\STATE $R \leftarrow \texttt{xDBL}(R)$
\ENDIF
\ENDFOR
\end{algorithmic}
\end{algorithm}
$n$ is a secret input of algorithm~\ref{montgomery-ladder}.
The if statements are secret-dependent and are replaced with constant-time
conditional swap between $Q$ and $R$ in the TweetNaCl implementation.
\subsection{The X25519 key exchange}
\label{preliminaries:A}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment