Re: Accessing Point representation of Ed448 for ECDH implementation

On 9/6/19 11:03 pm, Danny van Heumen wrote:
>> Please refer to the core implementation class in
>> org.bouncycastle.math.ec.rfc8032.Ed448.
>>
>> IIUC, the generateECDH() method described in otrv4.md would just be a
>> slight adaptation of these methods from Ed448:
>>
>>     public static void generatePrivateKey(SecureRandom random, byte[]
>>     public static void generatePublicKey(byte[] sk, int skOff, byte[]
>> pk, int pkOff)
> 
> Agree. I don't see a big problem there, either. That is, given my
> limited knowledge. (I found the scalarMultBaseEncoded function before,
> and I believe that's just the basepoint scalar multiplication, right?)

Well, scalarMultBase is that, -Encoded also encodes the output point.


>> X448 key generation is already delegated to Ed448 and X448 shared
>> secret calculation is intended to eventually also be delegated, which
>> would involve adding to Ed448 exactly the non-basepoint scalar
>> multiplication that appears to be needed here; but we do not have it
>> yet.
> 
> What kind of expectations does Bouncy Castle have for such a scalar
> multiplication implementation? What kind of guarantees are required at
> minimum?

Constant-time, then performance within reasonable complexity/clarity.


> I'm willing to invest some time into looking into the scalar
> multiplication, but I have limited knowledge of such low-level
> implementations. I could do a naive one and with help from the community
> see if we can improve. Or alternative, if one knows of suitable
> reference material, I can try diving into the more complicated
> implementations.
> 
> Would that be a possibility?

What I would suggest is that I put together a simple implementation that
makes use of:

    private static void scalarMultStraussVar(int[] nb, int[] np,
PointExt p, PointExt r)

That method calculates r = nb * basepoint + np * p, so by setting nb to
0 it should be usable to get correct answers. It is not constant-time
(only used for verification) but it will serve for initial testing.

I would then ask you to confirm that the changes are working
(particularly interop tests), and I can then work on the constant-time
implementation, for which I should have some time in a week or two.

Regards,
Pete Dettman