Edwards normal form - Revision history

Rational Point: /* Point group arithmetic */

2025-01-08T05:53:47Z

Point group arithmetic

← Older revision		Revision as of 05:53, 8 January 2025
Line 25:		Line 25:
	== Point group arithmetic ==		== Point group arithmetic ==
	[[Image:Ed448x-R.svg\|frame\|left\|The [[point group operation]] as defined here is plotted on the “untwisted” [[Ed448]] curve (with ''d''=-39081 and the twist parameter ''a''=1.) When the points indicated with hollow circles are “added,” the result point is shown with a filled-in circle.]]		[[Image:Ed448x-R.svg\|frame\|left\|The [[point group operation]] as defined here is plotted on the “untwisted” [[Ed448]] curve (with ''d''=-39081 and the twist parameter ''a''=1.) When the points indicated with hollow circles are “added,” the result point is shown with a filled-in circle.]]
	The [[point group operation]] on ~~a quartic curve in the twisted~~ Edwards ~~form as defined above~~ is defined as <ref>Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, and Christiane Peters. “Twisted Edwards Curves.” ''Cryptology ePrint Archive,'' vol. 2008, no. 013 https://eprint.iacr.org/2008/013.pdf</ref>		The [[point group operation]] on Edwards curves is defined in the primary sources <ref>Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, and Christiane Peters. “Twisted Edwards Curves.” ''Cryptology ePrint Archive,'' vol. 2008, no. 013 https://eprint.iacr.org/2008/013.pdf</ref> of the [[Ed25519]] and [[Ed448]] schemes (take or leave the twist parameter ''a'') as

	:<math>(x_1,y_1)\oplus(x_2,y_2) =		:<math>(x_1,y_1)\oplus(x_2,y_2) =
Line 33:		Line 33:


	Protestants find it offensive to refer to arithmetic or other ''operations'' as of some “law” or as works done through or under the “law” so to speak, although that term does appear as such in the original literature. It is something vaguely felt to be grammatically repulsive, almost as if in Spanish to imply, “bajo la ley” and not “sobre la ley” or above-board.		To the best of our knowledge, this resolves to a simple circle group over a conic section, and not to a proper [[quartic point group operation]].

			If <math>ax^2+y^2=dx^2y^2</math> then this can be rewritten as the conic section equation <math>aX+Y=dXY</math> by setting <math>X=x^2</math> and <math>Y=y^2</math>, and we have

			<math>(X_1,X_1)\oplus(X_2,X_2) =
			\left(\left[\frac{\sqrt{X_1Y_2}+\sqrt{Y_1X_2}}{1+d\sqrt{X_1X_2Y_1Y_2}}\right]^2,\left[
			\frac{\sqrt{Y_1Y_2}-a\sqrt{X_1X_2}}{1-d\sqrt{X_1X_2Y_1Y_2}}
			\right]^2\right)</math>.

			Protestants find it offensive to refer to arithmetic or other ''operations'' as of some “law” or as works done through or under the “law” so to speak, (and not the natural laws of mathematics,) although that term does appear as such in the original literature. It is something vaguely felt to be grammatically repulsive, almost as if in Spanish to imply, “bajo la ley” and not “sobre la ley” or above-board.

	The term “law” is normally reserved in mathematical contexts for a formal probability measure over an event space. The abuse of the term in the cryptologic literature (hint, hint, there’s an arbitrary “law” involved in a mathematical operation) cannot be a coincidence. The FBI under Christopher Wray has for many years, and under other directors as well, been demanding “lawful access” to break the aforementioned encryption at will, and as usual, it’s “for the children” <ref>Christopher Wray, Director		The term “law” is normally reserved in mathematical contexts for a formal probability measure over an event space. The abuse of the term in the cryptologic literature (hint, hint, there’s an arbitrary “law” involved in a mathematical operation) cannot be a coincidence. The FBI under Christopher Wray has for many years, and under other directors as well, been demanding “lawful access” to break the aforementioned encryption at will, and as usual, it’s “for the children” <ref>Christopher Wray, Director

Rational Point: "elliptic" - redundant designations

2025-01-04T00:59:56Z

"elliptic" - redundant designations

Rational Point: /* Point group arithmetic */ trivia

2025-01-02T07:14:07Z

Point group arithmetic: trivia

← Older revision		Revision as of 07:14, 2 January 2025
Line 25:		Line 25:
	== Point group arithmetic ==		== Point group arithmetic ==
	[[Image:Ed448x-R.svg\|frame\|left\|The [[point group operation]] as defined here is plotted on the “untwisted” [[Ed448]] curve (with ''d''=-39081 and the twist parameter ''a''=1.) When the points indicated with hollow circles are “added,” the result point is shown with a filled-in circle.]]		[[Image:Ed448x-R.svg\|frame\|left\|The [[point group operation]] as defined here is plotted on the “untwisted” [[Ed448]] curve (with ''d''=-39081 and the twist parameter ''a''=1.) When the points indicated with hollow circles are “added,” the result point is shown with a filled-in circle.]]
	The [[point group operation]] on ~~an elliptic~~ curve in the twisted Edwards form as defined above is defined as <ref>Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, and Christiane Peters. “Twisted Edwards Curves.” ''Cryptology ePrint Archive,'' vol. 2008, no. 013 https://eprint.iacr.org/2008/013.pdf</ref>		The [[point group operation]] on a quartic curve in the twisted Edwards form as defined above is defined as <ref>Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, and Christiane Peters. “Twisted Edwards Curves.” ''Cryptology ePrint Archive,'' vol. 2008, no. 013 https://eprint.iacr.org/2008/013.pdf</ref>

	:<math>(x_1,y_1)\oplus(x_2,y_2) =		:<math>(x_1,y_1)\oplus(x_2,y_2) =

Rational Point: caveat

2025-01-02T07:09:53Z

caveat

← Older revision		Revision as of 07:09, 2 January 2025
Line 1:		Line 1:
	[[Category:Normal forms]]		[[Category:Normal forms]]

			:Caveat emptor: ''"Edwards curves" are quartic curves, i.e. curves of degree four, and moreover trivally reducible to a degree of two, because the variables appear only with even powers in the equation of the normal form. They are not very interesting for cryptographic use, because any cryptographic properties of Edwards curve public key schemes such as [[Ed448]] or [[Ed25519]] depend solely on the prime numbers specified as moduli.''

	[[Image:Curve448.svg\|frame\|left\|<math>x^2 + y^2 = 1 - 39081x^2y^2</math><br>Elliptic curve known as [[Ed448]] “Goldilocks” in '''Edwards normal form''' with <math>d=-39081</math>]]		[[Image:Curve448.svg\|frame\|left\|<math>x^2 + y^2 = 1 - 39081x^2y^2</math><br>Elliptic curve known as [[Ed448]] “Goldilocks” in '''Edwards normal form''' with <math>d=-39081</math>]]
	~~An elliptic~~ curve is in '''Edwards normal form'''<ref>Harold M. Edwards. “A normal form for elliptic curves.” ''Bulletin of the American Mathematical Society,'' vol. 44, no. 3, Jul 2007, pp. 393–422. https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/</ref> if it can be described by the equation		A quartic curve is in '''Edwards normal form'''<ref>Harold M. Edwards. “A normal form for elliptic curves.” ''Bulletin of the American Mathematical Society,'' vol. 44, no. 3, Jul 2007, pp. 393–422. https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/</ref> if it can be described by the equation

	:<math>x^2 + y^2 = 1 + dx^2y^2</math>		:<math>x^2 + y^2 = 1 + dx^2y^2</math>

Rational Point: /* Group structure, identity and degree */ plot y^2 against x^2, and then take square roots

2025-01-02T03:10:46Z

Group structure, identity and degree: plot y^2 against x^2, and then take square roots

← Older revision		Revision as of 03:10, 2 January 2025
Line 69:		Line 69:
	The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on elliptic curves in Edwards form, normal or twisted.		The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on elliptic curves in Edwards form, normal or twisted.

	Much of the trouble here is that these “Edwards curves” are not really elliptic curves at all, because their degree as defined is four, and not three. Furthermore, they are readily simplified on geometric considerations: they become simple [[conic section]]s when <math>~~\sqrt~~ y</math> is plotted against <math>~~\sqrt~~ x</math> and the degree is reduced to two. Taking square roots gives the point group operation as defined a much simpler geometric interpretation which is missing for curves in the fourth degree. In effect, a circle group with the simplest possible cyclic structure is yielded with [[birational equivalence]]s among the conic sections: hyperbolæ, parabolaæ, ellipses. We can’t really take the suggestions or recommendations of conic sections or the squares of coördinates of conic sections seriously for cryptography.		Much of the trouble here is that these “Edwards curves” are not really elliptic curves at all, because their degree as defined is four, and not three. Furthermore, they are readily simplified on geometric considerations: they become simple [[conic section]]s when <math>y^2</math> is plotted against <math>x^2</math> and the degree is reduced to two. Taking square roots then gives the point group operation as defined with a much simpler geometric interpretation which is missing for curves in the fourth degree. In effect, a circle group with the simplest possible cyclic structure is yielded with [[birational equivalence]]s among the conic sections: hyperbolæ, parabolaæ, ellipses. We can’t really take the suggestions or recommendations of conic sections or the squares of coördinates of conic sections seriously for cryptography.

	These simple conic section group operations of degree two are certainly more “efficient” to compute, and even more so when the coördinates are squared, than are the point group operations involving true ''elliptic'' curves of degree three in [[Weierstraß normal form]] or [[Montgomery normal form]] with an additional [[point at infinity]] which serves for those curves as the identity for a proper point group operation.		These simple conic section group operations of degree two are certainly more “efficient” to compute, and even more so when the coördinates are squared, than are the point group operations involving true ''elliptic'' curves of degree three in [[Weierstraß normal form]] or [[Montgomery normal form]] with an additional [[point at infinity]] which serves for those curves as the identity for a proper point group operation.

Rational Point: Conic section cryptography

2025-01-01T17:59:55Z

Conic section cryptography

← Older revision		Revision as of 17:59, 1 January 2025
Line 66:		Line 66:
	</syntaxhighlight>		</syntaxhighlight>

	== ~~The point group~~ identity ==		== Group structure, identity and degree ==
	The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on elliptic curves in Edwards form, normal or twisted.		The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on elliptic curves in Edwards form, normal or twisted.

			Much of the trouble here is that these “Edwards curves” are not really elliptic curves at all, because their degree as defined is four, and not three. Furthermore, they are readily simplified on geometric considerations: they become simple [[conic section]]s when <math>\sqrt y</math> is plotted against <math>\sqrt x</math> and the degree is reduced to two. Taking square roots gives the point group operation as defined a much simpler geometric interpretation which is missing for curves in the fourth degree. In effect, a circle group with the simplest possible cyclic structure is yielded with [[birational equivalence]]s among the conic sections: hyperbolæ, parabolaæ, ellipses. We can’t really take the suggestions or recommendations of conic sections or the squares of coördinates of conic sections seriously for cryptography.

			These simple conic section group operations of degree two are certainly more “efficient” to compute, and even more so when the coördinates are squared, than are the point group operations involving true ''elliptic'' curves of degree three in [[Weierstraß normal form]] or [[Montgomery normal form]] with an additional [[point at infinity]] which serves for those curves as the identity for a proper point group operation.

Rational Point: point group identity

2025-01-01T14:24:03Z

point group identity

← Older revision		Revision as of 14:24, 1 January 2025
Line 65:		Line 65:
	points(g(xp[1],yp[1],xp[2],yp[2]),h(xp[1],yp[1],xp[2],yp[2]),pch=19)		points(g(xp[1],yp[1],xp[2],yp[2]),h(xp[1],yp[1],xp[2],yp[2]),pch=19)
	</syntaxhighlight>		</syntaxhighlight>

			== The point group identity ==
			The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on elliptic curves in Edwards form, normal or twisted.

Rational Point: /* Example program in R */ possibly...

2024-12-31T14:17:53Z

Example program in R: possibly...

← Older revision		Revision as of 14:17, 31 December 2024
Line 40:		Line 40:


	The “sum” point as shown on this R plot appears at first glance to be the reflection through the origin of the point of intersection of the curve and the line segment (not shown) joining the two points which were ~~“added~~,” but there are many other cases to consider. This [https://www.r-project.org/ <big>'''R'''</big>] code picks two points on the [[Ed448]] curve at random and “sums” them.		The “sum” point as shown on this R plot appears at first glance to be the reflection through the origin of the point of intersection of the curve and the line segment (not shown) joining one of the two points which were “added” with the reflection across the ''x''-axis of the other, but there are many other cases to consider. This [https://www.r-project.org/ <big>'''R'''</big>] code picks two points on the [[Ed448]] curve at random and “sums” them.

	<syntaxhighlight lang="r" line>		<syntaxhighlight lang="r" line>

Rational Point: /* Example program in R */ explanation of example

2024-12-31T09:00:53Z

Example program in R: explanation of example

← Older revision		Revision as of 09:00, 31 December 2024
Line 39:		Line 39:
	The point group “sum” of any two points on the curve should be derivable from geometric considerations of lines intersecting the curve and reflecting across axes as in the case of the [[Weierstraß normal form]], but the precise rules seem a little bit more complicated, exactly which reflections to take where with so many axes of symmetry.		The point group “sum” of any two points on the curve should be derivable from geometric considerations of lines intersecting the curve and reflecting across axes as in the case of the [[Weierstraß normal form]], but the precise rules seem a little bit more complicated, exactly which reflections to take where with so many axes of symmetry.

	The [https://www.r-project.org/ <big>'''R'''</big>] code ~~here~~ picks two points on the [[Ed448]] curve at random and “sums” them.
			The “sum” point as shown on this R plot appears at first glance to be the reflection through the origin of the point of intersection of the curve and the line segment (not shown) joining the two points which were “added,” but there are many other cases to consider. This [https://www.r-project.org/ <big>'''R'''</big>] code picks two points on the [[Ed448]] curve at random and “sums” them.

	<syntaxhighlight lang="r" line>		<syntaxhighlight lang="r" line>

Rational Point: r code

2024-12-31T08:35:43Z

r code

@@ Line 21: / Line 21: @@
 == Point group arithmetic ==
+[[Image:Ed448x-R.svg|frame|left|The [[point group operation]] as defined here is plotted on the “untwisted” [[Ed448]] curve (with ''d''=-39081 and the twist parameter ''a''=1.) When the points indicated with hollow circles are “added,” the result point is shown with a filled-in circle.]]
 The [[point group operation]] on an elliptic curve in the twisted Edwards form as defined above is defined as <ref>Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, and Christiane Peters. “Twisted Edwards Curves.” ''Cryptology ePrint Archive,'' vol. 2008, no. 013 https://eprint.iacr.org/2008/013.pdf</ref>
@@ Line 28: / Line 28: @@
 \frac{y_1y_2-ax_1x_2}{1-dx_1x_2y_1y_2}
 \right)</math>.
 Protestants find it offensive to refer to arithmetic or other ''operations'' as of some “law” or as works done through or under the “law” so to speak, although that term does appear as such in the original literature. It is something vaguely felt to be grammatically repulsive, almost as if in Spanish to imply, “bajo la ley” and not “sobre la ley” or above-board.
@@ Line 34: / Line 35: @@
 Federal Bureau of Investigation. “Finding a Way Forward on Lawful Access: Bringing Child Predators out of the Shadows:
 Remarks as delivered.” ''Department of Justice Lawful Access Summit,'' Washington, D.C. October 4, 2019. https://www.fbi.gov/news/speeches/finding-a-way-forward-on-lawful-access</ref><ref>Zack Whittaker. “US attorney general William Barr says Americans should accept security risks of encryption backdoors.” ''TechCrunch,'' July 23, 2019. https://techcrunch.com/2019/07/23/william-barr-consumers-security-risks-backdoors/</ref>.

← Older revision		Revision as of 00:59, 4 January 2025
Line 3:		Line 3:
	:Caveat emptor: ''"Edwards curves" are quartic curves, i.e. curves of degree four, and moreover trivally reducible to a degree of two, because the variables appear only with even powers in the equation of the normal form. They are not very interesting for cryptographic use, because any cryptographic properties of Edwards curve public key schemes such as [[Ed448]] or [[Ed25519]] depend solely on the prime numbers specified as moduli.''		:Caveat emptor: ''"Edwards curves" are quartic curves, i.e. curves of degree four, and moreover trivally reducible to a degree of two, because the variables appear only with even powers in the equation of the normal form. They are not very interesting for cryptographic use, because any cryptographic properties of Edwards curve public key schemes such as [[Ed448]] or [[Ed25519]] depend solely on the prime numbers specified as moduli.''

	[[Image:Curve448.svg\|frame\|left\|<math>x^2 + y^2 = 1 - 39081x^2y^2</math><br>~~Elliptic curve~~ known as [[Ed448]] “Goldilocks” in '''Edwards normal form''' with <math>d=-39081</math>]]		[[Image:Curve448.svg\|frame\|left\|<math>x^2 + y^2 = 1 - 39081x^2y^2</math><br>Curve known as [[Ed448]] “Goldilocks” in '''Edwards normal form''' with <math>d=-39081</math>]]
	A quartic curve is in '''Edwards normal form'''<ref>Harold M. Edwards. “A normal form for elliptic curves.” ''Bulletin of the American Mathematical Society,'' vol. 44, no. 3, Jul 2007, pp. 393–422. https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/</ref> if it can be described by the equation		A quartic curve is in '''Edwards normal form'''<ref>Harold M. Edwards. “A normal form for elliptic curves.” ''Bulletin of the American Mathematical Society,'' vol. 44, no. 3, Jul 2007, pp. 393–422. https://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/</ref> if it can be described by the equation

Line 16:		Line 16:
	== The twist ==		== The twist ==
	[[Image:Ed25519.svg\|frame\|left\|<math>-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2</math><br>		[[Image:Ed25519.svg\|frame\|left\|<math>-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2</math><br>
	This ~~elliptic~~ curve in a so-called '''twisted Edwards form''' is the one used in the [[Ed25519]] digital signature scheme <ref>Wikipedia: EdDSA https://en.wikipedia.org/wiki/EdDSA#Ed25519</ref>.]]		This curve in a so-called '''twisted Edwards form''' is the one used in the [[Ed25519]] digital signature scheme <ref>Wikipedia: EdDSA https://en.wikipedia.org/wiki/EdDSA#Ed25519</ref>.]]
	There is also a “twisted” Edwards form		There is also a “twisted” Edwards form

Line 70:		Line 70:

	== Group structure, identity and degree ==		== Group structure, identity and degree ==
	The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on ~~elliptic~~ curves in Edwards form, normal or twisted.		The point (0,1) serves as an identity for the [[point group operation]] as defined by Bernstein et al. on curves in Edwards form, normal or twisted.

	Much of the trouble here is that these “Edwards curves” are not really elliptic curves at all, because their degree as defined is four, and not three. Furthermore, they are readily simplified on geometric considerations: they become simple [[conic section]]s when <math>y^2</math> is plotted against <math>x^2</math> and the degree is reduced to two. Taking square roots then gives the point group operation as defined with a much simpler geometric interpretation which is missing for curves in the fourth degree. In effect, a circle group with the simplest possible cyclic structure is yielded with [[birational equivalence]]s among the conic sections: hyperbolæ, parabolaæ, ellipses. We can’t really take the suggestions or recommendations of conic sections or the squares of coördinates of conic sections seriously for cryptography.		Much of the trouble here is that these “Edwards curves” are not really elliptic curves at all, because their degree as defined is four, and not three. Furthermore, they are readily simplified on geometric considerations: they become simple [[conic section]]s when <math>y^2</math> is plotted against <math>x^2</math> and the degree is reduced to two. Taking square roots then gives the point group operation as defined with a much simpler geometric interpretation which is missing for curves in the fourth degree. In effect, a circle group with the simplest possible cyclic structure is yielded with [[birational equivalence]]s among the conic sections: hyperbolæ, parabolaæ, ellipses. We can’t really take the suggestions or recommendations of conic sections or the squares of coördinates of conic sections seriously for cryptography.

	These simple conic section group operations of degree two are certainly more “efficient” to compute, and even more so when the coördinates are squared, than are the point group operations involving true ''elliptic'' curves of degree three in [[Weierstraß normal form]] or [[Montgomery normal form]] with an additional [[point at infinity]] which serves for those curves as the identity for a proper point group operation.		These simple conic section group operations of degree two are certainly more “efficient” to compute, and even more so when the coördinates are squared, than are the point group operations involving true ''elliptic'' curves of degree three in [[Weierstraß normal form]] or [[Montgomery normal form]] with an additional [[point at infinity]] which serves for those curves as the identity for a proper point group operation.