Struct EdwardsPoint 

pub struct EdwardsPoint {
    pub(crate) X: FieldElement51,
    pub(crate) Y: FieldElement51,
    pub(crate) Z: FieldElement51,
    pub(crate) T: FieldElement51,
}

An EdwardsPoint represents a point on the Edwards form of Curve25519.

Fields

X: FieldElement51

Y: FieldElement51

Z: FieldElement51

T: FieldElement51

Implementations

impl EdwardsPoint

pub(crate) fn as_projective_niels(&self) -> ProjectiveNielsPoint

Convert to a ProjectiveNielsPoint

pub(crate) const fn as_projective(&self) -> ProjectivePoint

Convert the representation of this point from extended coordinates to projective coordinates.

Free.

pub(crate) fn as_affine_niels(&self) -> AffineNielsPoint

Dehomogenize to a AffineNielsPoint. Mainly for testing.

pub(crate) fn to_affine(self) -> AffinePoint

Dehomogenize to AffinePoint.

pub fn to_montgomery(&self) -> MontgomeryPoint

Convert this EdwardsPoint on the Edwards model to the corresponding MontgomeryPoint on the Montgomery model.

This function has one exceptional case; the identity point of the Edwards curve is sent to the 2-torsion point \((0,0)\) on the Montgomery curve.

Note that this is a one-way conversion, since the Montgomery model does not retain sign information.

pub fn to_montgomery_batch(eds: &[Self]) -> Vec<MontgomeryPoint>

Converts a large batch of points to Edwards at once. This has the same behavior on identity elements as Self::to_montgomery.

pub fn compress(&self) -> CompressedEdwardsY

Compress this point to CompressedEdwardsY format.

pub fn compress_batch<const N: usize>( inputs: &[EdwardsPoint; N], ) -> [CompressedEdwardsY; N]

Compress several EdwardsPoints into CompressedEdwardsY format, using a batch inversion for a significant speedup.

pub fn compress_batch_alloc(inputs: &[EdwardsPoint]) -> Vec<CompressedEdwardsY>

Compress several EdwardsPoints into CompressedEdwardsY format, using a batch inversion for a significant speedup.

fn map_to_curve(fe: FieldElement51) -> EdwardsPoint

pub fn encode_to_curve<D>(bytes: &[&[u8]], domain_sep: &[&[u8]]) -> EdwardsPoint

where D: BlockSizeUser + Default + FixedOutput<OutputSize = U64> + HashMarker, D::BlockSize: IsGreater<D::OutputSize, Output = True>,

Perform encode to curve per RFC 9380, with explicit hash function and domain separator domain_sep, using the Twisted Edwards Elligator 2 method. The input is the concatenation of the elements of bytes. Likewise for the domain separator with domain_sep. At least one element of domain_sep, MUST be nonempty, and the concatenation MUST NOT exceed 255 bytes.

The specification names SHA-512 as an example of a secure hash to use with this function, but you may use any 512-bit hash within reason (see the spec for details).

Warning

encode_to_curve is a nonuniform encoding from byte strings to points in G. That is, the distribution of its output is not uniformly random in G: the set of possible outputs of encode_to_curve is only a fraction of the points in G, and some points in this set are more likely to be output than others.

If your application needs the distribution of the output to be statistically close to uniform in G, use Self::hash_to_curve instead.

Panics

Panics if domain_sep.collect().len() == 0 or > 255

pub fn hash_to_curve<D>(bytes: &[&[u8]], domain_sep: &[&[u8]]) -> EdwardsPoint

where D: BlockSizeUser + Default + FixedOutput<OutputSize = U64> + HashMarker, D::BlockSize: IsGreater<D::OutputSize, Output = True>,

Perform a hash to curve per RFC 9380, with explicit hash function and domain separator domain_sep, using the Twisted Edwards Elligator 2 method. The input is the concatenation of the elements of bytes. Likewise for the domain separator with domain_sep. At least one element of domain_sep, MUST be nonempty, and the concatenation MUST NOT exceed 255 bytes.

The specification names SHA-512 as an example of a secure hash to use with this function, but you may use any 512-bit hash within reason (see the spec for details).

Panics

Panics if domain_sep.collect().len() == 0 or > 255

impl EdwardsPoint

pub(crate) fn double(&self) -> EdwardsPoint

Add this point to itself.

impl EdwardsPoint

pub fn mul_base(scalar: &Scalar) -> Self

Fixed-base scalar multiplication by the Ed25519 base point.

Uses precomputed basepoint tables when the precomputed-tables feature is enabled, trading off increased code size for ~4x better performance.

pub fn mul_clamped(self, bytes: [u8; 32]) -> Self

Multiply this point by clamp_integer(bytes). For a description of clamping, see clamp_integer.

pub fn mul_base_clamped(bytes: [u8; 32]) -> Self

Multiply the basepoint by clamp_integer(bytes). For a description of clamping, see clamp_integer.

impl EdwardsPoint

pub fn vartime_double_scalar_mul_basepoint( a: &Scalar, A: &EdwardsPoint, b: &Scalar, ) -> EdwardsPoint

Compute \(aA + bB\) in variable time, where \(B\) is the Ed25519 basepoint.

impl EdwardsPoint

pub fn mul_by_cofactor(&self) -> EdwardsPoint

Multiply by the cofactor: return \([8]P\).

pub(crate) fn mul_by_pow_2(&self, k: u32) -> EdwardsPoint

Compute \([2^k] P \) by successive doublings. Requires \( k > 0 \).

pub fn is_small_order(&self) -> bool

Determine if this point is of small order.

Return

• true if self is in the torsion subgroup \( \mathcal E[8] \);
• false if self is not in the torsion subgroup \( \mathcal E[8] \).

Example

use curve25519_dalek::constants;

// Generator of the prime-order subgroup
let P = constants::ED25519_BASEPOINT_POINT;
// Generator of the torsion subgroup
let Q = constants::EIGHT_TORSION[1];

// P has large order
assert_eq!(P.is_small_order(), false);

// Q has small order
assert_eq!(Q.is_small_order(), true);

pub fn is_torsion_free(&self) -> bool

Determine if this point is “torsion-free”, i.e., is contained in the prime-order subgroup.

Return

• true if self has zero torsion component and is in the prime-order subgroup;
• false if self has a nonzero torsion component and is not in the prime-order subgroup.

Example

use curve25519_dalek::constants;

// Generator of the prime-order subgroup
let P = constants::ED25519_BASEPOINT_POINT;
// Generator of the torsion subgroup
let Q = constants::EIGHT_TORSION[1];

// P is torsion-free
assert_eq!(P.is_torsion_free(), true);

// P + Q is not torsion-free
assert_eq!((P+Q).is_torsion_free(), false);

Trait Implementations

impl<'a> Add<&'a AffineNielsPoint> for &EdwardsPoint

type Output = CompletedPoint

The resulting type after applying the + operator.

fn add(self, other: &'a AffineNielsPoint) -> CompletedPoint

Performs the + operation.

impl<'a> Add<&'a EdwardsPoint> for &EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the + operator.

fn add(self, other: &'a EdwardsPoint) -> EdwardsPoint

Performs the + operation.

impl<'b> Add<&'b EdwardsPoint> for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the + operator.

fn add(self, rhs: &'b EdwardsPoint) -> EdwardsPoint

Performs the + operation.

impl<'a> Add<&'a ProjectiveNielsPoint> for &EdwardsPoint

type Output = CompletedPoint

The resulting type after applying the + operator.

fn add(self, other: &'a ProjectiveNielsPoint) -> CompletedPoint

Performs the + operation.

impl<'a> Add<EdwardsPoint> for &'a EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the + operator.

fn add(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the + operation.

impl Add for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the + operator.

fn add(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the + operation.

impl<'a> AddAssign<&'a EdwardsPoint> for EdwardsPoint

fn add_assign(&mut self, _rhs: &'a EdwardsPoint)

Performs the += operation.

impl AddAssign for EdwardsPoint

fn add_assign(&mut self, rhs: EdwardsPoint)

Performs the += operation.

impl Clone for EdwardsPoint

fn clone(&self) -> EdwardsPoint

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ConditionallySelectable for EdwardsPoint

fn conditional_select( a: &EdwardsPoint, b: &EdwardsPoint, choice: Choice, ) -> EdwardsPoint

Select a or b according to choice.

fn conditional_assign(&mut self, other: &Self, choice: Choice)

Conditionally assign other to self, according to choice.

fn conditional_swap(a: &mut Self, b: &mut Self, choice: Choice)

Conditionally swap self and other if choice == 1; otherwise, reassign both unto themselves.

impl ConstantTimeEq for EdwardsPoint

fn ct_eq(&self, other: &EdwardsPoint) -> Choice

Determine if two items are equal.

fn ct_ne(&self, other: &Self) -> Choice

Determine if two items are NOT equal.

impl Debug for EdwardsPoint

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EdwardsPoint

fn default() -> EdwardsPoint

Returns the “default value” for a type.

impl<'a> From<&'a EdwardsPoint> for LookupTable<AffineNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl From<&EdwardsPoint> for LookupTable<CachedPoint>

fn from(point: &EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTable<ProjectiveNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix128<AffineNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix128<ProjectiveNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix256<AffineNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix256<ProjectiveNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix32<AffineNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix32<ProjectiveNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix64<AffineNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for LookupTableRadix64<ProjectiveNielsPoint>

fn from(P: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for NafLookupTable5<AffineNielsPoint>

fn from(A: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl From<&EdwardsPoint> for NafLookupTable5<CachedPoint>

fn from(point: &EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for NafLookupTable5<ProjectiveNielsPoint>

fn from(A: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for NafLookupTable8<AffineNielsPoint>

Available on crate features precomputed-tables or alloc only.

fn from(A: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl From<&EdwardsPoint> for NafLookupTable8<CachedPoint>

fn from(point: &EdwardsPoint) -> Self

Converts to this type from the input type.

impl<'a> From<&'a EdwardsPoint> for NafLookupTable8<ProjectiveNielsPoint>

Available on crate features precomputed-tables or alloc only.

fn from(A: &'a EdwardsPoint) -> Self

Converts to this type from the input type.

impl From<EdwardsPoint> for ExtendedPoint

fn from(P: EdwardsPoint) -> ExtendedPoint

Converts to this type from the input type.

impl From<ExtendedPoint> for EdwardsPoint

fn from(P: ExtendedPoint) -> EdwardsPoint

Converts to this type from the input type.

impl Identity for EdwardsPoint

fn identity() -> EdwardsPoint

Returns the identity element of the curve. Can be used as a constructor.

impl<'a> Mul<&'a EdwardsPoint> for &Scalar

fn mul(self, point: &'a EdwardsPoint) -> EdwardsPoint

Scalar multiplication: compute scalar * self.

For scalar multiplication of a basepoint, EdwardsBasepointTable is approximately 4x faster.

type Output = EdwardsPoint

The resulting type after applying the * operator.

impl<'b> Mul<&'b EdwardsPoint> for Scalar

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: &'b EdwardsPoint) -> EdwardsPoint

Performs the * operation.

impl<'a> Mul<&'a Scalar> for &EdwardsPoint

fn mul(self, scalar: &'a Scalar) -> EdwardsPoint

Scalar multiplication: compute scalar * self.

For scalar multiplication of a basepoint, EdwardsBasepointTable is approximately 4x faster.

type Output = EdwardsPoint

The resulting type after applying the * operator.

impl<'b> Mul<&'b Scalar> for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: &'b Scalar) -> EdwardsPoint

Performs the * operation.

impl<'a> Mul<EdwardsPoint> for &'a Scalar

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the * operation.

impl Mul<EdwardsPoint> for Scalar

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the * operation.

impl<'a> Mul<Scalar> for &'a EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: Scalar) -> EdwardsPoint

Performs the * operation.

impl Mul<Scalar> for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the * operator.

fn mul(self, rhs: Scalar) -> EdwardsPoint

Performs the * operation.

impl<'a> MulAssign<&'a Scalar> for EdwardsPoint

fn mul_assign(&mut self, scalar: &'a Scalar)

Performs the *= operation.

impl MulAssign<Scalar> for EdwardsPoint

fn mul_assign(&mut self, rhs: Scalar)

Performs the *= operation.

impl MultiscalarMul for EdwardsPoint

Available on crate feature alloc only.

type Point = EdwardsPoint

The type of point being multiplied, e.g., RistrettoPoint.

fn multiscalar_mul<I, J>(scalars: I, points: J) -> EdwardsPoint

where I: IntoIterator, I::Item: Borrow<Scalar>, J: IntoIterator, J::Item: Borrow<EdwardsPoint>,

Given an iterator of (possibly secret) scalars and an iterator of public points, compute $$ Q = c_1 P_1 + \cdots + c_n P_n. $$

impl Neg for &EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn neg(self) -> EdwardsPoint

Performs the unary - operation.

impl Neg for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn neg(self) -> EdwardsPoint

Performs the unary - operation.

impl PartialEq for EdwardsPoint

fn eq(&self, other: &EdwardsPoint) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'a> Sub<&'a AffineNielsPoint> for &EdwardsPoint

type Output = CompletedPoint

The resulting type after applying the - operator.

fn sub(self, other: &'a AffineNielsPoint) -> CompletedPoint

Performs the - operation.

impl<'a> Sub<&'a EdwardsPoint> for &EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn sub(self, other: &'a EdwardsPoint) -> EdwardsPoint

Performs the - operation.

impl<'b> Sub<&'b EdwardsPoint> for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn sub(self, rhs: &'b EdwardsPoint) -> EdwardsPoint

Performs the - operation.

impl<'a> Sub<&'a ProjectiveNielsPoint> for &EdwardsPoint

type Output = CompletedPoint

The resulting type after applying the - operator.

fn sub(self, other: &'a ProjectiveNielsPoint) -> CompletedPoint

Performs the - operation.

impl<'a> Sub<EdwardsPoint> for &'a EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn sub(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the - operation.

impl Sub for EdwardsPoint

type Output = EdwardsPoint

The resulting type after applying the - operator.

fn sub(self, rhs: EdwardsPoint) -> EdwardsPoint

Performs the - operation.

impl<'a> SubAssign<&'a EdwardsPoint> for EdwardsPoint

fn sub_assign(&mut self, _rhs: &'a EdwardsPoint)

Performs the -= operation.

impl SubAssign for EdwardsPoint

fn sub_assign(&mut self, rhs: EdwardsPoint)

Performs the -= operation.

impl<T> Sum<T> for EdwardsPoint

where T: Borrow<EdwardsPoint>,

fn sum<I>(iter: I) -> Self

where I: Iterator<Item = T>,

Takes an iterator and generates Self from the elements by “summing up” the items.

impl ValidityCheck for EdwardsPoint

fn is_valid(&self) -> bool

Checks whether the point is on the curve. Not CT.

impl VartimeMultiscalarMul for EdwardsPoint

Available on crate feature alloc only.

type Point = EdwardsPoint

The type of point being multiplied, e.g., RistrettoPoint.

fn optional_multiscalar_mul<I, J>(scalars: I, points: J) -> Option<EdwardsPoint>

where I: IntoIterator, I::Item: Borrow<Scalar>, J: IntoIterator<Item = Option<EdwardsPoint>>,

Given an iterator of public scalars and an iterator of Options of points, compute either Some(Q), where $$ Q = c_1 P_1 + \cdots + c_n P_n, $$ if all points were Some(P_i), or else return None.

fn vartime_multiscalar_mul<I, J>(scalars: I, points: J) -> Self::Point

where I: IntoIterator, I::Item: Borrow<Scalar>, J: IntoIterator, J::Item: Borrow<Self::Point>, Self::Point: Clone,

Given an iterator of public scalars and an iterator of public points, compute $$ Q = c_1 P_1 + \cdots + c_n P_n, $$ using variable-time operations.

impl Zeroize for EdwardsPoint

Available on crate feature zeroize only.

fn zeroize(&mut self)

Reset this EdwardsPoint to the identity element.

impl Copy for EdwardsPoint

impl Eq for EdwardsPoint