Implement AffineCoordinates::from_coordinates (#1405)

Implementation of RustCrypto/traits#1996

Addresses RustCrypto/traits#1994

Author: daxpedda

Cargo.lock

@@ -23,6 +23,8 @@ opt-level = 2
 
 [patch.crates-io]
 ed448-goldilocks = { path = "ed448-goldilocks" }
+# https://github.com/RustCrypto/traits/pull/1996
+elliptic-curve = { git = "https://github.com/RustCrypto/traits" }
 hash2curve = { path = "hash2curve" }
 primefield = { path = "primefield" }
 primeorder = { path = "primeorder" }

Cargo.toml

@@ -1,7 +1,7 @@
 #![allow(dead_code)]
 use crate::curve::twedwards::{extended::ExtendedPoint, extensible::ExtensiblePoint};
 use crate::field::FieldElement;
-use subtle::{Choice, ConditionallySelectable};
+use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
 
 /// This point representation is not a part of the API.
 ///
@@ -31,11 +31,11 @@ impl AffinePoint {
     };
 
     /// Checks if the AffinePoint is on the TwistedEdwards curve
-    fn is_on_curve(&self) -> bool {
+    pub(crate) fn is_on_curve(&self) -> Choice {
         let xx = self.x.square();
         let yy = self.y.square();
 
-        yy - xx == FieldElement::ONE + (FieldElement::TWISTED_D * xx * yy)
+        (yy - xx).ct_eq(&(FieldElement::ONE + (FieldElement::TWISTED_D * xx * yy)))
     }
 
     // Negates an AffinePoint
@@ -142,7 +142,7 @@ mod tests {
     fn test_negation() {
         use crate::TWISTED_EDWARDS_BASE_POINT;
         let a = TWISTED_EDWARDS_BASE_POINT.to_extensible().to_affine();
-        assert!(a.is_on_curve());
+        assert_eq!(a.is_on_curve().unwrap_u8(), 1);
 
         let neg_a = a.negate();
         let got = neg_a.add(&a);

ed448-goldilocks/src/curve/twedwards/affine.rs

@@ -1,13 +1,13 @@
 use crate::curve::twedwards::affine::AffinePoint as InnerAffinePoint;
 use crate::field::FieldElement;
-use crate::{Decaf448FieldBytes, DecafPoint, DecafScalar};
+use crate::{Decaf448FieldBytes, DecafPoint, DecafScalar, ORDER};
 use core::ops::Mul;
 use elliptic_curve::{
     Error,
     point::{AffineCoordinates, NonIdentity},
     zeroize::DefaultIsZeroes,
 };
-use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
+use subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption};
 
 /// Affine point on the twisted curve
 #[derive(Copy, Clone, Debug, Default)]
@@ -39,6 +39,18 @@ impl Eq for AffinePoint {}
 impl AffineCoordinates for AffinePoint {
     type FieldRepr = Decaf448FieldBytes;
 
+    fn from_coordinates(x: &Self::FieldRepr, y: &Self::FieldRepr) -> CtOption<Self> {
+        let point = Self(InnerAffinePoint {
+            x: FieldElement::from_bytes(&x.0),
+            y: FieldElement::from_bytes(&y.0),
+        });
+
+        CtOption::new(
+            point,
+            point.0.is_on_curve() & (point * DecafScalar::new(*ORDER)).ct_eq(&DecafPoint::IDENTITY),
+        )
+    }
+
     fn x(&self) -> Self::FieldRepr {
         Decaf448FieldBytes::from(self.x())
     }

ed448-goldilocks/src/decaf/affine.rs

@@ -45,6 +45,15 @@ impl Eq for AffinePoint {}
 impl elliptic_curve::point::AffineCoordinates for AffinePoint {
     type FieldRepr = Ed448FieldBytes;
 
+    fn from_coordinates(x: &Self::FieldRepr, y: &Self::FieldRepr) -> CtOption<Self> {
+        let point = Self {
+            x: FieldElement::from_bytes_extended(&x.0),
+            y: FieldElement::from_bytes_extended(&y.0),
+        };
+
+        CtOption::new(point, point.is_on_curve())
+    }
+
     fn x(&self) -> Self::FieldRepr {
         Ed448FieldBytes::from(self.x.to_bytes_extended())
     }

ed448-goldilocks/src/edwards/affine.rs

@@ -363,6 +363,10 @@ impl FieldElement {
         Self(ConstMontyType::new(&U448::from_le_slice(bytes)))
     }
 
+    pub fn from_bytes_extended(bytes: &[u8; 57]) -> Self {
+        Self(ConstMontyType::new(&U448::from_le_slice(&bytes[..56])))
+    }
+
     pub fn from_repr(bytes: &[u8; 56]) -> CtOption<Self> {
         let integer = U448::from_le_slice(bytes);
         let is_some = integer.ct_lt(MODULUS::PARAMS.modulus());

ed448-goldilocks/src/field/element.rs

@@ -127,6 +127,21 @@ impl PrimeCurveAffine for AffinePoint {
 impl AffineCoordinates for AffinePoint {
     type FieldRepr = FieldBytes;
 
+    fn from_coordinates(x: &Self::FieldRepr, y: &Self::FieldRepr) -> CtOption<Self> {
+        let x = FieldElement::from_bytes(x);
+        let y = FieldElement::from_bytes(y);
+
+        x.and_then(|x| {
+            y.and_then(|y| {
+                // Check that the point is on the curve
+                let lhs = (y * &y).negate(1);
+                let rhs = x * &x * &x + &CURVE_EQUATION_B;
+                let point = Self::new(x, y);
+                CtOption::new(point, (lhs + &rhs).normalizes_to_zero())
+            })
+        })
+    }
+
     fn x(&self) -> FieldBytes {
         self.x.to_bytes()
     }
@@ -276,20 +291,7 @@ impl FromEncodedPoint<Secp256k1> for AffinePoint {
             sec1::Coordinates::Compressed { x, y_is_odd } => {
                 AffinePoint::decompress(x, Choice::from(y_is_odd as u8))
             }
-            sec1::Coordinates::Uncompressed { x, y } => {
-                let x = FieldElement::from_bytes(x);
-                let y = FieldElement::from_bytes(y);
-
-                x.and_then(|x| {
-                    y.and_then(|y| {
-                        // Check that the point is on the curve
-                        let lhs = (y * &y).negate(1);
-                        let rhs = x * &x * &x + &CURVE_EQUATION_B;
-                        let point = Self::new(x, y);
-                        CtOption::new(point, (lhs + &rhs).normalizes_to_zero())
-                    })
-                })
-            }
+            sec1::Coordinates::Uncompressed { x, y } => Self::from_coordinates(x, y),
         }
     }
 }

k256/src/arithmetic/affine.rs

@@ -103,9 +103,20 @@ where
 impl<C> AffineCoordinates for AffinePoint<C>
 where
     C: PrimeCurveParams,
+    FieldBytes<C>: Copy,
 {
     type FieldRepr = FieldBytes<C>;
 
+    fn from_coordinates(x: &Self::FieldRepr, y: &Self::FieldRepr) -> CtOption<Self> {
+        C::FieldElement::from_repr(*y).and_then(|y| {
+            C::FieldElement::from_repr(*x).and_then(|x| {
+                let lhs = y * &y;
+                let rhs = x * &x * &x + &(C::EQUATION_A * &x) + &C::EQUATION_B;
+                CtOption::new(Self { x, y, infinity: 0 }, lhs.ct_eq(&rhs))
+            })
+        })
+    }
+
     fn x(&self) -> FieldBytes<C> {
         self.x.to_repr()
     }
@@ -212,15 +223,7 @@ where
             sec1::Coordinates::Compressed { x, y_is_odd } => {
                 Self::decompress(x, Choice::from(y_is_odd as u8))
             }
-            sec1::Coordinates::Uncompressed { x, y } => {
-                C::FieldElement::from_repr(*y).and_then(|y| {
-                    C::FieldElement::from_repr(*x).and_then(|x| {
-                        let lhs = y * &y;
-                        let rhs = x * &x * &x + &(C::EQUATION_A * &x) + &C::EQUATION_B;
-                        CtOption::new(Self { x, y, infinity: 0 }, lhs.ct_eq(&rhs))
-                    })
-                })
-            }
+            sec1::Coordinates::Uncompressed { x, y } => Self::from_coordinates(x, y),
         }
     }
 }