Struct Point 

pub struct Point { /* private fields */ }

A point in extended twisted Edwards coordinates.

Implementations

impl Point

pub const IDENTITY: Point

The neutral element (0, 1).

pub fn add(&self, other: &Point) -> Point

The complete add-2008-hwcd-3 group law for a = -1.

pub fn double(&self) -> Point

Point doubling, dbl-2008-hwcd for a = -1.

Adding a point to itself works and was what this did, but the general addition costs nine multiplications and needs both operands’ T. The dedicated formula is four multiplications and four squarings, and does not read T at all – doubling is a function of X, Y and Z alone.

Worth the separate formula because scalar multiplication is doublings almost entirely: the non-adjacent form leaves about forty additions against two hundred and fifty-six doublings.

pub fn mul_scalar(&self, s: &[u8; 32]) -> Point

Scalar multiplication, constant-time in the scalar.

Every iteration performs a doubling and an addition, selecting between the two results with a conditional move, so the instruction trace is identical for every scalar.

pub fn mul_scalar_vartime(&self, scalar: &[u8; 32]) -> Point

Scalar multiplication that is not constant time.

When this is allowed

Only on values an attacker already has. Verification is the case: the signature, the public key and the message are all public, so there is no secret whose timing could leak, and the constant-time ladder buys nothing there but work. Signing must never call this – the scalar is derived from the seed.

What it does instead

A width-5 non-adjacent form. Recoding the scalar into signed odd digits leaves roughly one position in six non-zero, so the additions drop from one per bit to about forty in total; the doublings remain, because an arbitrary point has no precomputed table to take them away. Only odd multiples are stored, eight of them, since a negative digit negates on the way out.

The saving is real but bounded: the doublings dominate and they cannot be avoided here. The basepoint half of verification is the one that got a table.

pub fn compress(&self) -> [u8; 32]

Compress to the 32-byte RFC 8032 encoding.

pub fn decompress(bytes: &[u8; 32]) -> Option<Point>

Decompress a 32-byte encoding, rejecting non-curve points.

Trait Implementations

impl Clone for Point

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Point

impl Debug for Point

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.