From 17347b04a75ef531081c438478fa20646d2f9b1f Mon Sep 17 00:00:00 2001
From: Michael Hamburg <mike@shiftleft.org>
Date: Sat, 7 Oct 2017 00:57:28 -0700
Subject: [PATCH] test harness to invert elligator by brute force

---
 aux/ristretto/ristretto.sage | 55 ++++++++++++++++++++++++++++++++----
 1 file changed, 49 insertions(+), 6 deletions(-)

diff --git a/aux/ristretto/ristretto.sage b/aux/ristretto/ristretto.sage
index b2d3396..b6728bb 100644
--- a/aux/ristretto/ristretto.sage
+++ b/aux/ristretto/ristretto.sage
@@ -385,25 +385,34 @@ class Decaf_1_1_Point(QuotientEdwardsPoint):
                 for toggle_s in [False,True]:
                     for toggle_r in [False,True]:
                         s,m1,m12,swap = self.toJacobiQuartic(toggle_rotation,toggle_altx,toggle_s)
-                        
-                        if self == self.__class__():
+
+                        print
+                        print toggle_rotation,toggle_altx,toggle_s
+                        print m1
+                        print m12
+                    
+                    
+                        if self == self.__class__() and self.cofactor == 4:
                             # Hacks for identity!
                             if toggle_altx: m12 = 1
                             elif toggle_s: m1 = 1
                             elif toggle_r: continue
                             ## BOTH???
-                        
+                    
                         rnum = (d*a*m12-m1)
                         rden = ((d*a-1)*m12+m1)
                         if swap: rnum,rden = rden,rnum
-                        
+                    
                         ok,sr = isqrt_i(rnum*rden*self.qnr)
                         if not ok: continue
                         sr *= rnum
+                        print "Works! %d %x" % (swap,sr)
+                    
                         if negative(sr) != toggle_r: sr = -sr
                         ret = self.gfToBytes(sr)
-                        #assert self.elligator(ret) == self or self.elligator(ret) == -self
-                        if self.elligator(ret) == -self and self != -self: print "Negated!",[toggle_rotation,toggle_altx,toggle_s,toggle_r]
+                        if self.elligator(ret) != self and self.elligator(ret) != -self:
+                            print "WRONG!",[toggle_rotation,toggle_altx,toggle_s]
+                        if self.elligator(ret) == -self and self != -self: print "Negated!",[toggle_rotation,toggle_altx,toggle_s]
                         rets.append(bytes(ret))
         return rets
 
@@ -478,6 +487,40 @@ class Decaf_1_1_Point(QuotientEdwardsPoint):
         if negative(s) == iss: s = -s
         return cls.fromJacobiQuartic(s,t)
             
+    def elligatorInverseBruteForce(self):
+        """Invert Elligator using SAGE's polynomial solver"""
+        a,d = self.a,self.d
+        R.<r0> = self.F[]
+        r = self.qnr * r0^2
+        den = (d*r-(d-a))*((d-a)*r-d)
+        n1 = (r+1)*(a-2*d)/den
+        n2 = r*n1
+        ret = set()
+        for s2,t in [(n1, -(r-1)*(a-2*d)^2 / den - 1),
+                     (n2,r*(r-1)*(a-2*d)^2 / den - 1)]:
+            x2 = 4*s2/(1+a*s2)^2
+            y = (1-a*s2) / t
+
+            selfT = self
+            for i in xrange(self.cofactor/2):
+                xT,yT = selfT
+                polyX = xT^2-x2
+                polyY = yT-y
+                sx = set(r for r,_ in polyX.numerator().roots())
+                sy = set(r for r,_ in polyY.numerator().roots())
+                ret = ret.union(sx.intersection(sy))
+            
+                selfT = selfT.torque()
+
+        ret = [self.gfToBytes(r) for r in ret]
+        
+        for r in ret:
+            assert self.elligator(r) in [self,-self]
+            
+        ret = [r for r in ret if self.elligator(r) == self]
+
+        return ret
+            
 class Ed25519Point(RistrettoPoint):
     F = GF(2^255-19)
     d = F(-121665/121666)