Module p521

NIST P-521 Elliptic Curve Primitives

This module implements the NIST P-521 elliptic curve operations in constant time. The curve equation is y² = x³ - 3x + b over the prime field F_p where:

• p = 2^521 - 1 (NIST P-521 prime, a Mersenne prime)
• The curve order n = 0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409

All operations are implemented to be constant-time to prevent timing attacks. The implementation uses:

• Mersenne reduction for field arithmetic (2^521 ≡ 1 mod p)
• Jacobian projective coordinates for efficient point operations
• Binary scalar multiplication with constant-time point selection

Structs

FieldElement

P-521 field element representing values in Fₚ (p = 2^521 − 1). Internally stored as 17 little-endian 32-bit limbs; only the low 9 bits of limb 16 are significant.

Point

P-521 elliptic curve point in affine coordinates (x, y)

Scalar

P-521 scalar value for use in elliptic curve operations. Represents integers modulo the curve order n. Used for private keys and scalar multiplication. Automatically zeroized on drop for security.

Enums

PointFormat

Format of a serialized elliptic curve point

Constants

P521_FIELD_ELEMENT_SIZE

Size of a P-521 field element in bytes (66 bytes)

P521_KEM_SHARED_SECRET_KDF_OUTPUT_SIZE

Size of the KDF output for P-521 ECDH-KEM shared secret derivation (e.g., for HKDF-SHA512)

P521_POINT_COMPRESSED_SIZE

Size of a compressed P-521 point in bytes: format byte (0x02/0x03) + x-coordinate

P521_POINT_UNCOMPRESSED_SIZE

Size of an uncompressed P-521 point in bytes: format byte (0x04) + x-coordinate + y-coordinate

P521_SCALAR_SIZE

Size of a P-521 scalar in bytes (66 bytes)

Functions

base_point_g

Get the standard base point G of the P-521 curve

generate_keypair

Generate a cryptographically secure ECDH keypair

kdf_hkdf_sha512_for_ecdh_kem

Key derivation function for ECDH shared secret using HKDF-SHA512

scalar_mult

General scalar multiplication: compute scalar * point

scalar_mult_base_g

Scalar multiplication with the base point: scalar * G