Crypto.ECC.Edwards25519

Arithmetic primitives over curve edwards25519.

Twisted Edwards curves are a familly of elliptic curves allowing complete addition formulas without any special case and no point at infinity. Curve edwards25519 is based on prime 2^255 - 19 for efficient implementation. Equation and parameters are given in RFC 7748.

This module provides types and primitive operations that are useful to implement cryptographic schemes based on curve edwards25519:

• arithmetic functions for point addition, doubling, negation, scalar multiplication with an arbitrary point, with the base point, etc.

• arithmetic functions dealing with scalars modulo the prime order L of the base point

All functions run in constant time unless noted otherwise.

Warnings:

1. Curve edwards25519 has a cofactor h = 8 so the base point does not generate the entire curve and points with order 2, 4, 8 exist. When implementing cryptographic algorithms, special care must be taken using one of the following methods:

   • points must be checked for membership in the prime-order subgroup

   • or cofactor must be cleared by multiplying points by 8

   Utility functions are provided to implement this. Testing subgroup membership with pointHasPrimeOrder is 50-time slower than call pointMulByCofactor.

2. Scalar arithmetic is always reduced modulo L, allowing fixed length and constant execution time, but this reduction is valid only when points are in the prime-order subgroup.

3. Because of modular reduction in this implementation it is not possible to multiply points directly by scalars like 8.s or L. This has to be decomposed into several steps.