ed25519_heapless 0.6.0

Ed25519 signature verification and X25519 key exchange, generic over bigint backends
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

//! Factory for `modmath::FieldCt` over the Ed25519 scalar group order
//! `q = 2^252 + 27742317777372353535851937790883648493`.
//!
//! Sign computes `s = (r + k·a) mod q` where all three operands are
//! secret-derived, so the arithmetic runs on a `FieldCt<T>`. The
//! lifetime brand on `ResidueCt<'f, T>` prevents q-field residues from
//! flowing into a p-field operation — no separate type wrapper needed.
//!
//! `q` is odd and non-zero by construction; the `Odd<T>` typestate cut
//! discharges that proof once at the boundary so the `FieldCt`
//! constructor itself is infallible.

use crate::curve25519_field::{CurveSetupError, checked_odd_modulus};
use crate::{Q_BYTES, UnsignedModularInt};
use modmath::{CiosMontMulCt, FieldCt, Parity, WideMul};

pub fn curve25519_ct<T>() -> Result<FieldCt<T>, CurveSetupError>
where
    T: UnsignedModularInt
        + Copy
        + PartialEq
        + Parity
        + WideMul
        + CiosMontMulCt
        + subtle::ConditionallySelectable
        + subtle::ConstantTimeLess,
    for<'a> &'a T:
        const_num_traits::WrappingAdd<Output = T> + const_num_traits::WrappingSub<Output = T>,
{
    Ok(FieldCt::new_odd(checked_odd_modulus::<T>(&Q_BYTES)?))
}