Re: Accessing Point representation of Ed448 for ECDH implementation

Hi,

On Mon, 10 Jun 2019 12:37:33 +0700
Peter Dettman <[email protected]> wrote:

> On 9/6/19 11:03 pm, Danny van Heumen wrote:
> >> [...]
> > 
> > Agree. I don't see a big problem there, either. That is, given my
> > limited knowledge. (I found the scalarMultBaseEncoded function
> > before, and I believe that's just the basepoint scalar
> > multiplication, right?)  
> 
> Well, scalarMultBase is that, -Encoded also encodes the output point.

Well, yes, but also encoded in the right format, I believe.
I looked at scalarMultBase yesterday, but I'm not sure what
representation PointExt is. (And there was nothing documenting that
AFAICT.)

> >> [...]
> > 
> > What kind of expectations does Bouncy Castle have for such a scalar
> > multiplication implementation? What kind of guarantees are required
> > at minimum?  
> 
> Constant-time, then performance within reasonable complexity/clarity.

Okay, thank you. Good to know.

> > [...]
> 
> What I would suggest is that I put together a simple implementation
> that makes use of:
> 
>     private static void scalarMultStraussVar(int[] nb, int[] np,
> PointExt p, PointExt r)
> 
> That method calculates r = nb * basepoint + np * p, so by setting nb
> to 0 it should be usable to get correct answers. It is not
> constant-time (only used for verification) but it will serve for
> initial testing.

Wow, that would be great!

I currently have a class representing a Point, which requires the
following operations. I suspect you would already provide all of them,
but just to be explicit:

- Addition
- Multiplication
- Negation
- Encoding/Decoding to byte-representation (which I suspect will
  already be the default state for points as handled by the user of BC)

> I would then ask you to confirm that the changes are working
> (particularly interop tests), and I can then work on the constant-time
> implementation, for which I should have some time in a week or two.

The current code base already contains tests that verify explicitly
against my "amateur-implementation". So, simply replacing my
implementation with yours should be sufficient to do verification. (And
then figure out on which side the error is on.) It should be simple
enough.

I already managed to build BC libraries from the github mirror
(https://github.com/bcgit/bc-java.git), so just point me to a branch
when you are ready and I will build the binaries myself.

Again, I really appreciate the quick response/action.

Regards,
Danny