libsodium_crypto_core_ristretto255 (libsodium v3.0.1)
View SourceLow-level arithmetic on the ristretto255 prime-order group (RFC 9496) and on scalars modulo its order L, for building custom protocols.
Ristretto255 is built on edwards25519 but has no cofactor: every valid
bytes/0 byte encoding is canonical and represents a distinct group
element, so there are no small-order points to reject. Encodings of
edwards25519 points are not interchangeable with ristretto255 encodings.
Scalars are scalarbytes/0 byte little-endian integers and are used as
given (no clamping). from_hash/1 maps hashbytes/0 bytes of uniform
data (such as a SHA-512 digest) to a group element, and scalar_reduce/1
reduces a nonreducedscalarbytes/0 byte value modulo L.
P = libsodium_crypto_core_ristretto255:random(),
Q = libsodium_crypto_core_ristretto255:from_hash(libsodium_randombytes:buf(64)),
1 = libsodium_crypto_core_ristretto255:is_valid_point(Q),
R = libsodium_crypto_core_ristretto255:add(P, Q),
P = libsodium_crypto_core_ristretto255:sub(R, Q),
S = libsodium_crypto_core_ristretto255:scalar_random(),
One = libsodium_crypto_core_ristretto255:scalar_mul(S, libsodium_crypto_core_ristretto255:scalar_invert(S)),
One = <<1, 0:248>>.Summary
Types
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_HASHBYTES (64-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_NONREDUCEDSCALARBYTES (64-byte) binary.
A crypto_core_ristretto255_BYTES (32-byte) binary.
A crypto_core_ristretto255_BYTES (32-byte) binary.
A crypto_core_ristretto255_BYTES (32-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
Functions
Return the element P + Q, or -1 when either input is not a valid encoding.
Return crypto_core_ristretto255_bytes(), in bytes.
Map the hashbytes/0 byte uniform string H (such as a SHA-512
digest) to a group element.
Return crypto_core_ristretto255_hashbytes(), in bytes.
Return 1 when P is a valid canonical ristretto255 encoding, otherwise 0.
Return crypto_core_ristretto255_nonreducedscalarbytes(), in bytes.
Return a random group element.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
Return a random scalar in [0, L).
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
Return crypto_core_ristretto255_scalarbytes(), in bytes.
Return the element P - Q, or -1 when either input is not a valid encoding.
Types
-type comp() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type h() :: <<_:512>>.
A crypto_core_ristretto255_HASHBYTES (64-byte) binary.
-type neg() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type nonreduced_scalar() :: <<_:512>>.
A crypto_core_ristretto255_NONREDUCEDSCALARBYTES (64-byte) binary.
-type p() :: <<_:256>>.
A crypto_core_ristretto255_BYTES (32-byte) binary.
-type q() :: <<_:256>>.
A crypto_core_ristretto255_BYTES (32-byte) binary.
-type r() :: <<_:256>>.
A crypto_core_ristretto255_BYTES (32-byte) binary.
-type recip() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type s() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type x() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type y() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
-type z() :: <<_:256>>.
A crypto_core_ristretto255_SCALARBYTES (32-byte) binary.
Functions
Return the element P + Q, or -1 when either input is not a valid encoding.
-spec bytes() -> Result when Result :: 32.
Return crypto_core_ristretto255_bytes(), in bytes.
Map the hashbytes/0 byte uniform string H (such as a SHA-512
digest) to a group element.
-spec hashbytes() -> Result when Result :: 64.
Return crypto_core_ristretto255_hashbytes(), in bytes.
-spec is_valid_point(P) -> Result when P :: p(), Result :: 0 | 1.
Return 1 when P is a valid canonical ristretto255 encoding, otherwise 0.
-spec nonreducedscalarbytes() -> Result when Result :: 64.
Return crypto_core_ristretto255_nonreducedscalarbytes(), in bytes.
-spec random() -> Result when Result :: p().
Return a random group element.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
-spec scalar_random() -> Result when Result :: r().
Return a random scalar in [0, L).
-spec scalar_reduce(S) -> Result when S :: nonreduced_scalar(), Result :: r().
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
-spec scalarbytes() -> Result when Result :: 32.
Return crypto_core_ristretto255_scalarbytes(), in bytes.
Return the element P - Q, or -1 when either input is not a valid encoding.