Open cathieyun opened 5 years ago
I'll do this this afternoon; I think it would be good to rework the field arithmetic a little bit.
The reason is that the scalar arithmetic in curve25519-dalek is one of the most awkward parts of the implementation, since there's a bunch of slightly different semantic uses that are all kind of smushed together into a few different types with overlapping meanings -- for instance, Scalar
s are used for ristretto255 and curve25519, sometimes in montgomery form, sometimes not.... so it would be good to aim for "conceptual recoherence" for this use case.
Probably we want:
RistrettoScalar
, Ristretto255Scalar
?) for the curve25519-dalek Scalar
type (since we need to interoperate with it for Bulletproofs);FieldElement
type which holds a field element mod l
in Montgomery form;Ristretto255Scalar
s and FieldElement
s.My guess is that we'll want to hide the FieldElement
type from the public API and expose only the Ristretto255Scalar
s (or maybe hide both, depending on how the gadgets work out?)
See curve25519 scalar field arithmetic for reference: https://github.com/dalek-cryptography/curve25519-dalek/blob/master/src/backend/serial/u64/scalar.rs