mirror of
https://github.com/serai-dex/serai.git
synced 2024-11-17 01:17:36 +00:00
93f7afec8b
The audit recommends checking failure cases for from_bytes, from_bytes_unechecked, and from_repr. This isn't feasible. from_bytes is allowed to have non-canonical values. [0xff; 32] may accordingly be a valid point for non-SEC1-encoded curves. from_bytes_unchecked doesn't have a defined failure mode, and by name, unchecked, shouldn't necessarily fail. The audit acknowledges the tests should test for whatever result is 'appropriate', yet any result which isn't a failure on a valid element is appropriate. from_repr must be canonical, yet for a binary field of 2^n where n % 8 == 0, a [0xff; n / 8] repr would be valid.
35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# Ciphersuite
|
|
|
|
Ciphersuites for elliptic curves premised on ff/group.
|
|
|
|
### Secp256k1/P-256
|
|
|
|
Secp256k1 and P-256 are offered via [k256](https://crates.io/crates/k256) and
|
|
[p256](https://crates.io/crates/p256), two libraries maintained by
|
|
[RustCrypto](https://github.com/RustCrypto).
|
|
|
|
Their `hash_to_F` is the
|
|
[IETF's hash to curve](https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html),
|
|
yet applied to their scalar field.
|
|
|
|
### Ed25519/Ristretto
|
|
|
|
Ed25519/Ristretto are offered via
|
|
[dalek-ff-group](https://crates.io/crates/dalek-ff-group), an ff/group wrapper
|
|
around [curve25519-dalek](https://crates.io/crates/curve25519-dalek).
|
|
|
|
Their `hash_to_F` is the wide reduction of SHA2-512, as used in
|
|
[RFC-8032](https://www.rfc-editor.org/rfc/rfc8032). This is also compliant with
|
|
the draft
|
|
[RFC-RISTRETTO](https://www.ietf.org/archive/id/draft-irtf-cfrg-ristretto255-decaf448-05.html).
|
|
The domain-separation tag is naively prefixed to the message.
|
|
|
|
### Ed448
|
|
|
|
Ed448 is offered via [minimal-ed448](https://crates.io/crates/minimal-ed448), an
|
|
explicitly not recommended, unaudited, incomplete Ed448 implementation, limited
|
|
to its prime-order subgroup.
|
|
|
|
Its `hash_to_F` is the wide reduction of SHAKE256, with a 114-byte output, as
|
|
used in [RFC-8032](https://www.rfc-editor.org/rfc/rfc8032). The
|
|
domain-separation tag is naively prefixed to the message.
|