Using projective coordinates we prove the formula for differential addition.% (\lref{lemma:xADD}).
Using homogeneous coordinates we prove the formula for differential addition.% (\lref{lemma:xADD}).
\begin{lemma}
\label{lemma:xADD}
Let $M_{a,b}$ be a Montgomery curve such that $a^2-4$ is not a square in \K, and
...
...
@@ -274,7 +281,7 @@ Using projective coordinates we prove the formula for differential addition.% (\
These definitions should be understood in $\K\cup\{\infty\}$.
If $x\ne0$ then we define $x/0=\infty$.
\end{lemma}
Similarly we also prove the formula for point doubling.% (\lref{lemma:xDBL}).
Similarly, we also prove the formula for point doubling.% (\lref{lemma:xDBL}).
\begin{lemma}
\label{lemma:xDBL}
Let $M_{a,b}$ be a Montgomery curve such that $a^2-4$ is not a square in \K, and
...
...
@@ -289,7 +296,7 @@ Similarly we also prove the formula for point doubling.% (\lref{lemma:xDBL}).
\end{lemma}
With \lref{lemma:xADD} and \lref{lemma:xDBL}, we are able to compute efficiently
differential additions and point doublings using projective coordinates.
differential additions and point doublings using homogeneous coordinates.
\subsubsection{Scalar multiplication algorithms}
\label{subsec:ECC-ladder}
...
...
@@ -352,10 +359,10 @@ The white tiles are definitions while green tiles are important lemmas and theor
\label{tikz:ProofHighLevel2}
\end{figure}
A brief overview of the complete proof of is described bellow.
A brief overview of the complete proof is described below.
We first pose $a =486662$, $b =1$, $b' =2$, $p =2^{255}-19$, with the equations $C = M_{a,b}$, and $T = M_{a,b'}$.
We prove the primality of $p$ and define the field $\F{p}$.
Subsquently we show that neither $2$ nor $a^2-2$ are square in $\F{p}$.
Subsequently, we show that neither $2$ nor $a^2-2$ are square in $\F{p}$.
We consider $\F{p^2}$ and define $C(\F{p})$, $T(\F{p})$, and $C(\F{p^2})$.
We prove that for all $x \in\F{p}$ there exist a point of \xcoord$x$ either on $C(\F{p})$ or on the quadratic twist $T(\F{p})$.
We prove that all points in $M(\F{p})$ and $T(\F{p})$ can be projected in $M(\F{p^2})$ and derive that computations done in $M(\F{p})$ and $T(\F{p})$ yield to the same results if projected to $M(\F{p^2})$.
...
...
@@ -518,7 +525,7 @@ of formulas by using rewrite rules:
\end{equation*}
The injection $a \mapsto(a,0)$ from $\F{p}$ to $\F{p^2}$ preserves
$0, 1, +, -, \times$. Thus $(a,0)$ can be abbreviated as $a$ without confusions.
$0, 1, +, -, \times$. Thus $(a,0)$ can be abbreviated as $a$ without confusion.
We define $M_{486662,1}(\F{p^2})$. With the rewrite rule above, it is straightforward
to prove that any point on the curve $M_{486662,1}(\F{p})$ is also on the curve
...
...
@@ -551,25 +558,25 @@ We now study the case of the scalar multiplication and show similar proofs.
\begin{lemma}
\label{lemma:proj}
For all $n \in\N$, for all point $P\in\F{p}\times\F{p}$ on the curve
$M_{486662,1}(\F{p})$ (respectively on the quadratic twist $M_{486662,2}(\F{p})$), we have:
$M_{486662,1}(\F{p})$ (respectively on the quadratic twist $M_{486662,2}(\F{p})$), we have
\begin{align*}
P \in M_{486662,1}(\F{p}) &\implies\varphi_c(n \cdot P) = n \cdot\varphi_c(P) \\
P \in M_{486662,2}(\F{p}) &\implies\varphi_t(n \cdot P) = n \cdot\varphi_t(P)
P &\in M_{486662,1}(\F{p}) &\implies\varphi_c(n \cdot P) &= n \cdot\varphi_c(P), &&\text{and}\\
P &\in M_{486662,2}(\F{p}) &\implies\varphi_t(n \cdot P) &= n \cdot\varphi_t(P).
\end{align*}
\end{lemma}
Notice that:
Notice that
\begin{align*}
\forall P \in M_{486662,1}(\F{p}),\ \ \psi(\chi_0(\varphi_c(P))) = \chi_0(P) \\
\forall P \in M_{486662,2}(\F{p}),\ \ \psi(\chi_0(\varphi_t(P))) = \chi_0(P)
\forall P \in M_{486662,1}(\F{p}),&&\psi(\chi_0(\varphi_c(P))) &= \chi_0(P), &&\text{and}\\
\forall P \in M_{486662,2}(\F{p}),&&\psi(\chi_0(\varphi_t(P))) &= \chi_0(P).
\end{align*}
In summary for all $n \in\N,\ n < 2^{255}$, for any given point $P\in\F{p}\times\F{p}$
In summary, for all $n \in\N$, $n < 2^{255}$, for any point $P\in\F{p}\times\F{p}$
in $M_{486662,1}(\F{p})$ or $M_{486662,2}(\F{p})$, $Curve25519\_Fp$
computes the $\chi_0(n \cdot P)$.
We proved that for all $P \in\F{p^2}\times\F{p^2}$ such that $\chi_0(P)\in\F{p}$
computes $\chi_0(n \cdot P)$.
We have proved that for all $P \in\F{p^2}\times\F{p^2}$ such that $\chi_0(P)\in\F{p}$,
there exists a corresponding point on the curve or the twist over $\F{p}$.
We proved that for any point, on the curve or the twist we can compute the
scalar multiplication by $n$ and yield to the same result as if we did the
Moreover, we have proved that for any point on the curve or the twist, we can compute the
scalar multiplication by $n$ and obtain the same result as if we did the
computation in $\F{p^2}$.
% As a result we have proved theorem 2.1 of \cite{Ber06}:
% No: missing uniqueness !
...
...
@@ -589,7 +596,7 @@ computation in $\F{p^2}$.
% curve25519_Fp_ladder n x = (p *+ n)#x0 /p.
% \end{lstlisting}
We then prove the equivalence between of operations in $\Ffield$ and $\Zfield$,
We then prove the equivalence of operations between $\Ffield$ and $\Zfield$,
in other words between \coqe{Zmodp} and \coqe{:GF}.
This allows us to show that given a clamped value $n$ and normalized \xcoord of $P$,
\coqe{RFC} gives the same results as $Curve25519\_Fp$.
