mirror of
https://github.com/luxfi/kms.git
synced 2026-11-02 08:13:51 +00:00
zeekay
cc986c328d
Squashes all pre-rewrite history into a single root commit. Previous tree: - 14506 commits including upstream Infisical fork history - Multiple merge chains carrying pre-purge content Force-rewrite per disk-space reclamation discipline. GHCR images (1.9.9, 1.9.11) remain immutable; their git lineage is no longer materialized.
112 lines
3.2 KiB
Go
112 lines
3.2 KiB
Go
package ff
|
|
|
|
// Cyclo6 represents an element of the 6th cyclotomic group.
|
|
type Cyclo6 Fp12
|
|
|
|
func (z Cyclo6) String() string { return (Fp12)(z).String() }
|
|
func (z Cyclo6) IsEqual(x *Cyclo6) int { return (Fp12)(z).IsEqual((*Fp12)(x)) }
|
|
func (z Cyclo6) IsIdentity() int { i := &Fp12{}; i.SetOne(); return z.IsEqual((*Cyclo6)(i)) }
|
|
func (z *Cyclo6) Frob(x *Cyclo6) { (*Fp12)(z).Frob((*Fp12)(x)) }
|
|
func (z *Cyclo6) Mul(x, y *Cyclo6) { (*Fp12)(z).Mul((*Fp12)(x), (*Fp12)(y)) }
|
|
func (z *Cyclo6) Inv(x *Cyclo6) { *z = *x; z[1].Neg() }
|
|
func (z *Cyclo6) exp(x *Cyclo6, n []byte) { (*Fp12)(z).Exp((*Fp12)(x), n) }
|
|
func (z *Cyclo6) Sqr(x *Cyclo6) {
|
|
// Method of Granger-Scott.
|
|
// Page 7 of "Faster Squaring in the Cyclotomic Subgroup of Sixth Degree Extensions"
|
|
// https://www.iacr.org/archive/pkc2010/60560212/60560212.pdf
|
|
var xx, zz Fp12Cubic
|
|
xx.FromFp12((*Fp12)(x))
|
|
|
|
a, b, c := &xx[0], &xx[1], &xx[2]
|
|
z0, z1, z2 := &zz[0], &zz[1], &zz[2]
|
|
|
|
var aa, bb, cc, tt Fp4
|
|
aa.Sqr(a)
|
|
bb.Sqr(b)
|
|
cc.Sqr(c)
|
|
cc.mulT(&cc)
|
|
|
|
z0.Add(&aa, &aa)
|
|
z0.Add(z0, &aa)
|
|
tt.Add(a, a)
|
|
tt.Cjg()
|
|
z0.Sub(z0, &tt)
|
|
|
|
z1.Add(&cc, &cc)
|
|
z1.Add(z1, &cc)
|
|
tt.Add(b, b)
|
|
tt.Cjg()
|
|
z1.Add(z1, &tt)
|
|
|
|
z2.Add(&bb, &bb)
|
|
z2.Add(z2, &bb)
|
|
tt.Add(c, c)
|
|
tt.Cjg()
|
|
z2.Sub(z2, &tt)
|
|
|
|
(*Fp12)(z).FromFp12Cubic(&zz)
|
|
}
|
|
|
|
// PowToX computes z = x^paramX, where paramX is the parameter of the BLS curve.
|
|
func (z *Cyclo6) PowToX(x *Cyclo6) {
|
|
t := new(Cyclo6)
|
|
*t = *x
|
|
const lenX = 64
|
|
for i := lenX - 2; i >= 0; i-- {
|
|
t.Sqr(t)
|
|
// paramX is -2 ^ 63 - 2 ^ 62 - 2 ^ 60 - 2 ^ 57 - 2 ^ 48 - 2 ^ 16
|
|
if (i == 62) || (i == 60) || (i == 57) || (i == 48) || (i == 16) {
|
|
t.Mul(t, x)
|
|
}
|
|
}
|
|
z.Inv(t)
|
|
}
|
|
|
|
// EasyExponentiation calculates g = f^(p^6-1)(p^2+1), where g becomes an
|
|
// element of the 6-th cyclotomic group.
|
|
func EasyExponentiation(g *Cyclo6, f *Fp12) {
|
|
var t0, t1, p Fp12
|
|
p.Frob(f) // p = f^(p)
|
|
p.Frob(&p) // p = f^(p^2)
|
|
t0.Mul(&p, f) // t0 = f^(p^2 + 1)
|
|
t1.Frob(&t0) // t1 = f^(p^2 + 1)*(p)
|
|
t1.Frob(&t1) // t1 = f^(p^2 + 1)*(p^2)
|
|
t1.Frob(&t1) // t1 = f^(p^2 + 1)*(p^3)
|
|
t1.Frob(&t1) // t1 = f^(p^2 + 1)*(p^4)
|
|
t1.Frob(&t1) // t1 = f^(p^2 + 1)*(p^5)
|
|
t1.Frob(&t1) // t1 = f^(p^2 + 1)*(p^6)
|
|
t0.Inv(&t0) // t0 = f^-(p^2 + 1)
|
|
t0.Mul(&t0, &t1) // t0 = f^(p^2 + 1)*(p^6 - 1)
|
|
|
|
*g = (Cyclo6)(t0)
|
|
}
|
|
|
|
// HardExponentiation calculates u = g^(Cy_6(p)/r), where u is a root of unity.
|
|
func HardExponentiation(u *URoot, g *Cyclo6) {
|
|
var t0, t1, _g, g3 Cyclo6
|
|
var c, a0, a1, a2, a3 Cyclo6
|
|
_g.Inv(g) // _g = g^-1
|
|
g3.Sqr(g) // g3 = g^2
|
|
g3.Mul(&g3, g) // g3 = g^3
|
|
t0.PowToX(g) // t0 = g^x
|
|
t0.Mul(&t0, &_g) // t0 = g^(x-1)
|
|
t1.PowToX(&t0) // t1 = g^(x-1)*x
|
|
t0.Inv(&t0) // t0 = g^-(x-1)
|
|
a3.Mul(&t1, &t0) // a3 = g^(x-1)*(x-1)
|
|
a2.Frob(&a3) // a2 = a3*p
|
|
a1.Frob(&a2) // a1 = a2*p = a3*p^2
|
|
t0.Inv(&a3) // t0 = -a3
|
|
a1.Mul(&a1, &t0) // a1 = a3*p^2-a3
|
|
a0.Frob(&a1) // a0 = a3*p^3-a3*p
|
|
a0.Mul(&a0, &g3) // a0 = a3*p^3-a3*p+3
|
|
|
|
c.PowToX(&a3) // c = g^(a3*x)
|
|
c.Mul(&c, &a2) // c = g^(a3*x+a2)
|
|
c.PowToX(&c) // c = g^(a3*x+a2)*x = g^(a3*x^2+a2*x)
|
|
c.Mul(&c, &a1) // c = g^(a3*x^2+a2*x+a1)
|
|
c.PowToX(&c) // c = g^(a3*x^2+a2*x+a1)*x = g^(a3*x^3+a2*x^2+a1*x)
|
|
c.Mul(&c, &a0) // c = g^(a3*x^3+a2*x^2+a1*x+a0)
|
|
|
|
*u = (URoot)(c)
|
|
}
|