Commit d0114f8c authored by benoit's avatar benoit
Browse files

more flow

parent b4906681
......@@ -51,7 +51,7 @@ $a^2 - 4$ is not a square in $\K$, we prove the correctness of the ladder (\tref
\label{tikz:ProofHighLevel1}
\end{figure}
We now turn our attention to the details of the proof.
We now turn our attention to the details of the proof of the ladder's correctness.
\begin{dfn}
Given a field $\K$,
......@@ -345,7 +345,14 @@ final proof of \coqe{Theorem RFC_Correct}.
\fref{tikz:ProofHighLevel2} gives a high-level view of the proofs presented here.
The white tiles are definitions while green tiles are important lemmas and theorems.
A brief overview of the complete proof is described bellow.
\begin{figure}[h]
\centering
\include{tikz/highlevel2}
\caption{Proof dependencies for the correctness of X25519.}
\label{tikz:ProofHighLevel2}
\end{figure}
A brief overview of the complete proof of is described bellow.
We first pose $a = 486662$, $b = 1$, $b' = 2$, $p = 2^{255}-19$, with the equations $C = M_{a,b}$, and $T = M_{a,b'}$.
We prove the primality of $p$ and define the field $\F{p}$.
Subsquently we show that neither $2$ nor $a^2 - 2$ are square in $\F{p}$.
......@@ -354,26 +361,15 @@ We prove that for all $x \in \F{p}$ there exist a point of \xcoord $x$ either on
We prove that all points in $M(\F{p})$ and $T(\F{p})$ can be projected in $M(\F{p^2})$ and derive that computations done in $M(\F{p})$ and $T(\F{p})$ yield to the same results if projected to $M(\F{p^2})$.
Using \tref{thm:montgomery-ladder-correct} we prove that the ladder is correct for $M(\F{p})$ and $T(\F{p})$; with the previous results, this results in the correctness of the ladder for $M(\F{p^2})$, in other words the correctness of X25519.
\begin{figure}[h]
\centering
\include{tikz/highlevel2}
\caption{Proof dependencies for the correctness of X25519.}
\label{tikz:ProofHighLevel2}
\end{figure}
To be able to use the \tref{thm:montgomery-ladder-correct} we need to satisfy
Now that we have an red line for the proof, we turn our attention to the details.
Indeed \tref{thm:montgomery-ladder-correct} cannot be applied directly to prove that X25519 is
doing the computations over $M(\F{p^2})$. This would infer that $\K = \F{p^2}$ and we would need to satisfy
hypothesis~\ref{hyp:a_minus_4_not_square}:%
% $a^2-4$ is not a square in \K:
$$\forall x \in \K,\ x^2 \neq a^2-4.$$
However there always exists $x \in \F{p^2}$ such that $x^2 = a^2-4$,
preventing the use \tref{thm:montgomery-ladder-correct}
with $\K = \F{p^2}$.
\begin{sloppypar}
We first study Curve25519 and one of its quadratic twists Twist25519,
both defined over \F{p}.
\end{sloppypar}
which is not possible as there always exists $x \in \F{p^2}$ such that $x^2 = a^2-4$.
Consequently, we first study Curve25519 and one of its quadratic twists Twist25519,
both defined over \F{p}.
\subsubsection{Curves and twists}
\label{subsec:Zmodp}
......@@ -408,9 +404,11 @@ We now consider $M_{486662,1}(\F{p})$ and $M_{486662,2}(\F{p})$, one of its quad
% \begin{dfn}Let the following instantiations of \aref{alg:montgomery-double-add}:\\
\begin{dfn}
%Let the following instantiations of \aref{alg:montgomery-ladder}:\\
We instantiate \coqe{opt_montgomery} in two specific ways:\\
-- $Curve25519\_Fp(n,x)$ for $M_{486662,1}(\F{p})$.\\
-- $Twist25519\_Fp(n,x)$ for $M_{486662,2}(\F{p})$.
We instantiate \coqe{opt_montgomery} in two specific ways:
\begin{itemize}
\item[--] $Curve25519\_Fp(n,x)$ for $M_{486662,1}(\F{p})$.
\item[--] $Twist25519\_Fp(n,x)$ for $M_{486662,2}(\F{p})$.
\end{itemize}
\end{dfn}
With \tref{thm:montgomery-ladder-correct} we derive the following two lemmas:
......@@ -539,13 +537,15 @@ Lemma x_is_on_curve_or_twist_implies_x_in_Fp2:
We now study the case of the scalar multiplication and show similar proofs.
\begin{dfn}
Define the functions $\varphi_c$, $\varphi_t$ and $\psi$\\
-- $\varphi_c: M_{486662,1}(\F{p}) \mapsto M_{486662,1}(\F{p^2})$\\
such that $\varphi((x,y)) = ((x,0), (y,0))$.\\
-- $\varphi_t: M_{486662,2}(\F{p}) \mapsto M_{486662,1}(\F{p^2})$\\
such that $\varphi((x,y)) = ((x,0), (0,y))$.\\
-- $\psi: \F{p^2} \mapsto \F{p}$\\
such that $\psi(x,y) = x$.
Define the functions $\varphi_c$, $\varphi_t$ and $\psi$
\begin{itemize}
\item[--] $\varphi_c: M_{486662,1}(\F{p}) \mapsto M_{486662,1}(\F{p^2})$\\
such that $\varphi((x,y)) = ((x,0), (y,0))$.
\item[--] $\varphi_t: M_{486662,2}(\F{p}) \mapsto M_{486662,1}(\F{p^2})$\\
such that $\varphi((x,y)) = ((x,0), (0,y))$.
\item[--] $\psi: \F{p^2} \mapsto \F{p}$\\
such that $\psi(x,y) = x$.
\end{itemize}
\end{dfn}
\begin{lemma}
......
......@@ -18,7 +18,6 @@ BOLD = "\033[1m"
all: tweetverif.pdf reviews.pdf
# main pdf
tweetverif.pdf: FORCE tweetverif.tex tweetnacl.diff
@echo $(BOLD)$(LIGHTPURPLE)"Building tweetverif.pdf"$(NO_COLOR)$(DARKGRAY)
......
......@@ -47,12 +47,12 @@
\begin{scope}[yshift=-2.5 cm,xshift=4.125 cm]
\draw[fill=green!20] (-0.3,0) -- (1.78,0) -- (1.78,-1.25) -- (-0.3, -1.25) -- cycle;
\draw (0.75,0) node[textstyle, anchor=north] {$\forall x \in \F{p},$\\[.6ex]$\forall P \in C(\F{p}),$\\[.6ex]$x = \chi_0(P)\implies$\\[.6ex]lad. $n$ $x = \chi_0(n \cdot P)$};
\draw (0.75,0) node[textstyle, anchor=north] {$\forall x \in \F{p},$\\[.6ex]$\forall P \in C(\F{p}),$\\[.6ex]$x = \chi_0(P)\implies$\\[.6ex]lad $n$ $x = \chi_0(n \cdot P)$};
\end{scope}
\begin{scope}[yshift=-2.5 cm,xshift=6.25 cm]
\draw[fill=green!20] (-0.3,0) -- (1.78,0) -- (1.78,-1.25) -- (-0.3, -1.25) -- cycle;
\draw (0.75,0) node[textstyle, anchor=north] {$\forall x \in \F{p},$\\[.6ex]$\forall Q \in T(\F{p}),$\\[.6ex]$x = \chi_0(Q)\implies$\\[.6ex]lad. $n$ $x = \chi_0(n \cdot Q)$};
\draw (0.75,0) node[textstyle, anchor=north] {$\forall x \in \F{p},$\\[.6ex]$\forall Q \in T(\F{p}),$\\[.6ex]$x = \chi_0(Q)\implies$\\[.6ex]lad $n$ $x = \chi_0(n \cdot Q)$};
\end{scope}
\path [thick, double, ->] (1.875,-1.75) edge [out=-90, in=90] (1.875,-2.5);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment