https://github.com/zcash/pasta

Generator and supporting evidence for security of the Pallas/Vesta pair of elliptic curves suitable for Halo
https://github.com/zcash/pasta

cryptography elliptic-curves mathematics sagemath

Last synced: 4 days ago
JSON representation

Generator and supporting evidence for security of the Pallas/Vesta pair of elliptic curves suitable for Halo

• Host: GitHub
• URL: https://github.com/zcash/pasta
• Owner: zcash
• License: mit
• Created: 2020-11-19T21:45:09.000Z (about 4 years ago)
• Default Branch: master
• Last Pushed: 2023-05-19T12:49:18.000Z (over 1 year ago)
• Last Synced: 2023-10-20T23:58:59.323Z (about 1 year ago)
• Topics: cryptography, elliptic-curves, mathematics, sagemath
• Language: Sage
• Homepage:
• Size: 5.95 MB
• Stars: 48
• Watchers: 12
• Forks: 6
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
Pallas/Vesta supporting evidence

--------------------------------

This repository contains supporting evidence that the amicable pair of

prime-order curves:

* Ep : y^2 = x^3 + 5 over GF(p) of order q, called Pallas;

* Eq : y^2 = x^3 + 5 over GF(q) of order p, called Vesta;

with

* p = 2^254 + 45560315531419706090280762371685220353

* q = 2^254 + 45560315531506369815346746415080538113

satisfy *some* of the [SafeCurves criteria](https://safecurves.cr.yp.to/index.html).

The criteria that are *not* satisfied are, in summary:

* large-magnitude CM discriminant (both curves have CM discriminant of absolute value 3,

  as a consequence of how they were constructed);

* completeness (complete formulae are possible, but not according to the Safe curves

  criterion);

* ladder support (not possible for prime-order curves);

* Elligator 2 support (indistinguishability is possible using

  [Elligator Squared](https://ifca.ai/pub/fc14/paper_25.pdf), but not using Elligator 2);

* twist security above 100 bits for Pallas.

Pallas/Vesta is the first cycle output by

``sage amicable.sage --sequential --requireisos --sortpq --ignoretwist --nearpowerof2 255 32``.

(The `--sequential` option makes the output completely deterministic and so resolves

ambiguity about which result is "first". For exploratory searches it is faster not to

use `--sequential`.)

Prerequisites:

* ``apt-get install sagemath``

Run ``sage verify.sage Ep`` and ``sage verify.sage Eq``; or ``./run.sh`` to run both

and also print out the results.

The output of ``amicable.sage`` with the above options includes isogenies of degree 3,

suitable for use with the "simplified SWU" method for hashing to an elliptic curve.

This is based on code from Appendix A of [Wahby and Boneh 2019](https://eprint.iacr.org/2019/403.pdf).

To check the correctness of the endomorphism optimization described in the Halo paper, run

``python3 injectivitylemma.py`` and ``python3 checksumsets.py``. To also generate animations

showing the minimum distances between multiples of ζ used in the proof, run ``./animation.sh``.

``animation.sh`` has the following prerequisites:

* ``apt-get install ffmpeg ffcvt``

* ``pip3 install bintrees Pillow``

``checksumsets.py`` on its own only requires the ``bintrees`` Python package.