Closed survived closed 3 years ago
@elichai thank you for review! Your comments are very valuable!
on the other hand it makes future constant time operations harder
I think, to support constant time operations, we need underlying library to support points at infinity. E.g. C library that secp256k1
crate is based on, it actually supports points at infinity via dedicated primitives, but secp256k1
crate hides these primitives from their API (for obvious reasons)
I think, to support constant time operations, we need underlying library to support points at infinity.
Yeah I've been thinking about this for a while, See my comment here: https://github.com/ZenGo-X/curv/issues/43#issuecomment-864886342
Progress:
Unresolved questions (subject to move to separate issues):
p256
,digest
,sha2
See the badge:curve25519-dalek
for ed25519 implementation instead ofcryptoxide
curve25519-dalek
seems to be well-designed and well-documented, it's more actively used thancryptoxide
(3 500 000 vs 100 000 total downloads). Besides, we already rely oncurve25519-dalek
crate to supply ristretto curvefrom_uniform_bytes
constructor to ECPoint trait that maps uniformly distributed bytes to a point with unknown discrete log. Only ristretto, bls12_381, and ed25519 curves have implementation of hash-to-curve. P256 and K256 require research on this.rP = O
(r=group_order). There are new techniques making use of endomorphisms for performing faster subgroup checks