Struct curve25519_dalek::edwards::EdwardsBasepointTableRadix256

pub struct EdwardsBasepointTableRadix256(_);

A precomputed table of multiples of a basepoint, for accelerating fixed-base scalar multiplication. One table, for the Ed25519 basepoint, is provided in the constants module.

The basepoint tables are reasonably large, so they should probably be boxed.

The sizes for the tables and the number of additions required for one scalar multiplication are as follows:

• EdwardsBasepointTableRadix16: 30KB, 64A (this is the default size, and is used for [ED25519_BASEPOINT_TABLE])
• EdwardsBasepointTableRadix64: 120KB, 43A
• EdwardsBasepointTableRadix128: 240KB, 37A
• EdwardsBasepointTableRadix256: 480KB, 33A

Why 33 additions for radix-256?

Normally, the radix-256 tables would allow for only 32 additions per scalar multiplication. However, due to the fact that standardised definitions of legacy protocols—such as x25519—require allowing unreduced 255-bit scalar invariants, when converting such an unreduced scalar’s representation to radix-\(2^{8}\), we cannot guarantee the carry bit will fit in the last coefficient (the coefficients are i8s). When, \(w\), the power-of-2 of the radix, is \(w < 8\), we can fold the final carry onto the last coefficient, \(d\), because \(d < 2^{w/2}\), so $$ d + carry \cdot 2^{w} = d + 1 \cdot 2^{w} < 2^{w+1} < 2^{8} $$ When \(w = 8\), we can’t fit \(carry \cdot 2^{w}\) into an i8, so we add the carry bit onto an additional coefficient.

Trait Implementations

impl BasepointTable for EdwardsBasepointTableRadix256

type Point = EdwardsPoint

The type of point contained within this table.

fn create(basepoint: &EdwardsPoint) -> EdwardsBasepointTableRadix256

Create a table of precomputed multiples of basepoint.

fn basepoint(&self) -> EdwardsPoint

Get the basepoint for this table as an EdwardsPoint.

fn basepoint_mul(&self, scalar: &Scalar) -> EdwardsPoint

The computation uses Pippeneger’s algorithm, as described for the specific case of radix-16 on page 13 of the Ed25519 paper.

Piggenger’s Algorithm Generalised

Write the scalar \(a\) in radix-\(w\), where \(w\) is a power of 2, with coefficients in \([\frac{-w}{2},\frac{w}{2})\), i.e., $$ a = a_0 + a_1 w^1 + \cdots + a_{x} w^{x}, $$ with $$ \frac{-w}{2} \leq a_i < \frac{w}{2}, \cdots, \frac{-w}{2} \leq a_{x} \leq \frac{w}{2} $$ and the number of additions, \(x\), is given by \(x = \lceil \frac{256}{w} \rceil\). Then $$ a B = a_0 B + a_1 w^1 B + \cdots + a_{x-1} w^{x-1} B. $$ Grouping even and odd coefficients gives $$ \begin{aligned} a B = \quad a_0 w^0 B +& a_2 w^2 B + \cdots + a_{x-2} w^{x-2} B \\ + a_1 w^1 B +& a_3 w^3 B + \cdots + a_{x-1} w^{x-1} B \\ = \quad(a_0 w^0 B +& a_2 w^2 B + \cdots + a_{x-2} w^{x-2} B) \\ + w(a_1 w^0 B +& a_3 w^2 B + \cdots + a_{x-1} w^{x-2} B). \\ \end{aligned} $$ For each \(i = 0 \ldots 31\), we create a lookup table of $$ [w^{2i} B, \ldots, \frac{w}{2}\cdotw^{2i} B], $$ and use it to select \( y \cdot w^{2i} \cdot B \) in constant time.

The radix-\(w\) representation requires that the scalar is bounded by \(2^{255}\), which is always the case.

The above algorithm is trivially generalised to other powers-of-2 radices.

impl Clone for EdwardsBasepointTableRadix256

fn clone(&self) -> EdwardsBasepointTableRadix256

Returns a copy of the value.

pub fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EdwardsBasepointTableRadix256

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> From<&'a EdwardsBasepointTableRadix128> for EdwardsBasepointTableRadix256

fn from(
    table: &'a EdwardsBasepointTableRadix128
) -> EdwardsBasepointTableRadix256

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix16> for EdwardsBasepointTableRadix256

fn from(
    table: &'a EdwardsBasepointTableRadix16
) -> EdwardsBasepointTableRadix256

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix256> for EdwardsBasepointTableRadix16

fn from(
    table: &'a EdwardsBasepointTableRadix256
) -> EdwardsBasepointTableRadix16

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix256> for EdwardsBasepointTableRadix32

fn from(
    table: &'a EdwardsBasepointTableRadix256
) -> EdwardsBasepointTableRadix32

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix256> for EdwardsBasepointTableRadix64

fn from(
    table: &'a EdwardsBasepointTableRadix256
) -> EdwardsBasepointTableRadix64

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix256> for EdwardsBasepointTableRadix128

fn from(
    table: &'a EdwardsBasepointTableRadix256
) -> EdwardsBasepointTableRadix128

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix32> for EdwardsBasepointTableRadix256

fn from(
    table: &'a EdwardsBasepointTableRadix32
) -> EdwardsBasepointTableRadix256

Performs the conversion.

impl<'a> From<&'a EdwardsBasepointTableRadix64> for EdwardsBasepointTableRadix256

fn from(
    table: &'a EdwardsBasepointTableRadix64
) -> EdwardsBasepointTableRadix256

Performs the conversion.

impl<'a, 'b> Mul<&'a EdwardsBasepointTableRadix256> for &'b Scalar

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, basepoint_table: &'a EdwardsBasepointTableRadix256) -> EdwardsPoint

Construct an EdwardsPoint from a Scalar \(a\) by computing the multiple \(aB\) of this basepoint \(B\).

impl<'a, 'b> Mul<&'b Scalar> for &'a EdwardsBasepointTableRadix256

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, scalar: &'b Scalar) -> EdwardsPoint

Construct an EdwardsPoint from a Scalar \(a\) by computing the multiple \(aB\) of this basepoint \(B\).