You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 

136 lines
4.4 KiB

  1. Important work items for Ed448-Goldilocks:
  2. * Better architecture detection / factoring of arch-related headers.
  3. [PROGRESS]
  4. * Better factoring of high-level vs low-level library.
  5. * Factor out hash, crandom from core library?
  6. * Signed 32-bit NEON implementation to avoid bias/reduce after subtract
  7. * Documentation: write high-level API docs, and internal docs to help
  8. other implementors.
  9. * Partial progress on Doxygenating the code.
  10. * Documentation: write a spec or add to Watson's
  11. * Cleanup: rename everything consistently.
  12. * namespace_op or op_namespace? namespace_op_type?
  13. * We don't have to be super-careful with the namespacing, because
  14. symbols will be scrubbed by exported.sym.
  15. * Cleanup: hard-coded tables (probably?)
  16. * This reduces the work required for goldilocks_init() at the expense
  17. of library size.
  18. * Makes error-handling and thread safety easier.
  19. * Use the SAGE tool?
  20. * Cleanup: unify intrinsics code
  21. * Word_t, mask_t, bigregister_t, etc.
  22. * Generate asm intrinsics with a script?
  23. * [DONE] Bugfix: make sure that init() and randomization are thread-safe.
  24. * [DONE] Security: check on deserialization that points are < p.
  25. * [NEEDS TESTING] Check also that they're nonzero or otherwise non-pathological?
  26. * Testing:
  27. * Corner-case testing
  28. * More bulk random testing
  29. * Negative testing.
  30. * SAGE-(auto?)-generated test vectors
  31. * Test the Barrett fields
  32. * Safety: add static analysis attributes for compilers that support them
  33. * Most functions now have warn on ignored return.
  34. * Safety:
  35. * [DONE] Check for init() if it's still required once we've done the above
  36. * Decide what to do about RNG failures
  37. * abort
  38. * return error and zeroize
  39. * return error but continue if RNG is kind of mostly OK
  40. * Flexibility: decide which API options are good.
  41. * [DONE?] Eg, should functions take nbits and table sizes?
  42. * [DONE] Remove hardcoded adjustments from comb control.
  43. * These adjustments make the output wrong when it's not 450 bits.
  44. * Other slow Barrett fields? Montgomery fields?
  45. * Mid-level API
  46. * Make it easier to work with untwisted Edwards objects.
  47. * Probably use extended or projective, not extensible coordinates.
  48. * Scalarmul with other cofactor modes.
  49. * High-level API:
  50. * SHA512 Elligator Edition? Maybe write a paper first.
  51. * Elligator.
  52. * Need to write Elligator inverse. Might not be Elligator-2S.
  53. * FHMQV? Is this patented?
  54. * What low-level APIs to expose?
  55. * Edwards points with add, sub, scalarmul, =, ==, ser/deser?
  56. * Portability: test and make clean with other compilers
  57. * Using a fair amount of __attribute__ code.
  58. * [DONE] Should work for GCC now.
  59. * Portability: try to make the vector code as portable as possible
  60. * Currently using clang ext_vector_length.
  61. * I can't get a simple for-loop to autovectorize :-/
  62. * SAGE tool?
  63. * Portability: make the inner layers of the code 32-bit clean.
  64. * Write new versions of the field code.
  65. * [DONE] 28-bit limbs give less headroom for carries.
  66. * [DONE] Now have a vectorless ARM version; need NEON.
  67. * Improve speed of 32-bit field code.
  68. * [DONE] Run through the SAGE tool to generate new bias & bound.
  69. * [DONE] Portability: make the outer layers of the code 32-bit clean.
  70. * [DONE] Performance/flexibility: decide which parameters should be hard-coded.
  71. * Perhaps useful for comb precomputation.
  72. * Performance: Improve SHA512.
  73. * [DONE?] Improve portability.
  74. * Improve speed.
  75. * Except not, because this adds too much code size.
  76. * Link OpenSSL if a fast SHA is desired.
  77. * Protocol:
  78. * Decide what things to stir into hashes for various functions.
  79. * Performance: improve the Barrett field code.
  80. * Support other primes?
  81. * Capture prime shape into a struct instead of passing 3 params.
  82. * [DONE] Make 32-bit clean.
  83. * Automation:
  84. * Improve the SAGE tool to cover more cases
  85. * Real SSA classes to cover branching and looping
  86. * Constant-time selection
  87. * Intrinsics code
  88. * Field code?
  89. * SAGE tool is impossibly slow on 32-bit
  90. * Currently stuck on Elligator after 19 hours.
  91. * [FIXED] at least for now.
  92. * Vector-mul-chains
  93. * Negation "bubble pushing" optimization
  94. * Clear other TODO/FIXME/HACK/PERF items in the code
  95. * [DONE?] Submit to SUPERCOP