diff --git a/src/decaf_fast.c b/src/decaf_fast.c index d40b0a2..ea85bf6 100644 --- a/src/decaf_fast.c +++ b/src/decaf_fast.c @@ -474,7 +474,7 @@ static void gf_encode ( unsigned char ser[SER_BYTES], gf a ) { field_serialize(ser, (field_t *)a); } -extern const gf SQRT_MINUS_ONE; /* Intern this? */ +extern const gf SQRT_MINUS_ONE, SQRT_ONE_MINUS_D; /* Intern this? */ static void deisogenize ( gf_s *__restrict__ s, @@ -502,20 +502,33 @@ static void deisogenize ( gf_mul ( d, b, a ); /* "osx" = 1 / sqrt(z^2-x^2) */ gf_mul ( a, b, c ); gf_mul ( b, a, d ); /* 1/tz */ - /* - * Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x - * Pink bike shed: frob = zx * 1/tz - */ - gf_mul ( a, b, c ); // "frob" in sage file + + decaf_bool_t rotate; + { + gf e; + gf_sqr(e, t); + gf_mul(a, e, b); + rotate = hibit(a); + /* + * Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x + * Pink bike shed: frob = zx * 1/tz + */ + gf_mul ( a, b, c ); /* this is the case for PinkBikeShed */ + cond_sel ( a, a, SQRT_ONE_MINUS_D, rotate ); + gf_sub ( e, ZERO, x ); + cond_sel ( x, p->y, e, rotate ); + } + + gf_mul ( c, a, d ); // new "osx" gf_mul ( a, c, p->z ); gf_add ( a, a, a ); // 2 * "osx" * Z - decaf_bool_t tg1 = toggle_hibit_t_over_s ^~ hibit(a); + decaf_bool_t tg1 = rotate ^ toggle_hibit_t_over_s ^~ hibit(a); cond_neg ( c, tg1 ); cond_neg ( a, tg1 ); gf_mul ( d, b, p->z ); gf_add ( d, d, c ); - gf_mul ( b, d, p->y ); + gf_mul ( b, d, x ); /* here "x" = y unless rotate */ cond_neg ( b, toggle_hibit_s ^ hibit(b) ); } @@ -1058,10 +1071,13 @@ decaf_bool_t API_NS(point_eq) ( const point_t p, const point_t q ) { gf_mul ( b, q->y, p->x ); decaf_bool_t succ = gf_eq(a,b); + /* Interesting note: the 4tor would normally be rotation. + * But because of the *i twist, it's actually + * (x,y) <-> (iy,ix) + */ gf_mul ( a, p->y, q->y ); gf_mul ( b, q->x, p->x ); - gf_add ( a, a, b); - succ |= gf_eq(a,ZERO); + succ |= gf_eq(a,b); return succ; } diff --git a/src/p25519/f_arithmetic.c b/src/p25519/f_arithmetic.c index ed6f833..768d864 100644 --- a/src/p25519/f_arithmetic.c +++ b/src/p25519/f_arithmetic.c @@ -18,6 +18,14 @@ const field_a_t SQRT_MINUS_ONE = {FIELD_LITERAL( // FIXME goes elsewhere? 0x2b8324804fc1d )}; +const field_a_t SQRT_ONE_MINUS_D = {FIELD_LITERAL( // FIXME MAGIC goes elsewhere? + 0x6db8831bbddec, + 0x38d7b56c9c165, + 0x016b221394bdc, + 0x7540f7816214a, + 0x0a0d85b4032b1 +)}; + static const field_a_t ONE = {FIELD_LITERAL( // FIXME copy-pasted 1,0,0,0,0 )};