10 releases
0.8.3  Jan 31, 2022 

0.8.2  Feb 7, 2021 
0.7.2  Feb 7, 2021 
0.7.0  May 30, 2020 
0.4.0  May 9, 2020 
#119 in Cryptography
2,056 downloads per month
Used in 2 crates
(via x448)
235KB
3K
SLoC
THIS CODE HAS NOT BEEN AUDITED OR REVIEWED. USE AT YOUR OWN RISK.
Field Choice
The field size is a Solinas trinomial prime 2^448  2^224 1. This prime is called the Goldilocks prime.
Curves
This repository implements three curves explicitly and another curve implicitly.
The three explicitly implemented curves are:

Ed448Goldilocks

Curve448

TwistedGoldilocks
Ed448Goldilocks Curve
 The goldilocks curve is an Edwards curve with affine equation x^2 + y^2 = 1  39081x^2y^2 .
 This curve was defined by Mike Hamburg in https://eprint.iacr.org/2015/625.pdf .
 The cofactor of this curve over the goldilocks prime is 4.
TwistedGoldilocks Curve
 The twisted goldilocks curve is a Twisted Edwards curve with affine equation y^2  x^2 = 1  39082x^2y^2 .
 This curve is also defined in https://eprint.iacr.org/2015/625.pdf .
 The cofactor of this curve over the goldilocks prime is 4.
Isogeny
 This curve is 2isogenous to Ed448Goldilocks. Details of the isogeny can be found here: https://www.shiftleft.org/papers/isogeny/isogeny.pdf
Curve448
This curve is 2isogenous to Ed448Goldilocks. Details of Curve448 can be found here: https://tools.ietf.org/html/rfc7748
The main usage of this curve is for X448.
N.B. In that document there is an Edwards curve that is birationally equivalent to Curve448, with a large d
value. This curve is not implemented and to my knowledge, has no utility.
Strategy
The main strategy for group arithmetic on Ed448Goldilocks is to perform the 2isogeny to map the point to the TwistedGoldilocks curve, then use the faster Twisted Edwards formulas to perform scalar multiplication. Computing the 2isogeny then the dual isogeny will pick up a factor of 4 once we map the point back to the Ed448Goldilocks curve, so the scalar must be adjusted by a factor of 4. Adjusting the scalar is dependent on the point and the scalar. More details can be found in the 2isogenous paper.
Decaf
The Decaf strategy [link paper] is used to build a group of prime order from the Twisted Goldilocks curve. The Twisted Goldilocks curve is used as it has faster formulas. We can also use Curve448 or Ed448Goldilocks. Decaf takes advantage of an isogeny with a Jacobi Quartic curve which is not explicitly defined. Details of this can be found here: https://www.shiftleft.org/papers/decaf/decaf.pdf However, to my knowledge there is no documentation for the Decaf protocol implemented in this repository, which is a tweaked version of the original decaf protocol linked in the paper.
Completed Point vs Extensible Point
Deviating from Curve25519Dalek, this library will implement Extensible points instead of Completed Points. Due to the following observation:
 There is a cost of 3/4 Field multiplications to switch from the CompletedPoint. So if we were to perform repeated doubling, this would add an extra cost for each doubling in projective form. More details on the ExtensiblePoint can be found here [3.2]: https://www.shiftleft.org/papers/fff/fff.pdf
Credits
The library design was taken from Dalek's design of Curve25519. The code for Montgomery curve arithmetic was also taken from Dalek's library.
The golang implementation of Ed448 and libdecaf were used as references.
Special thanks to Mike Hamburg for answering all of the questions asked regarding Decaf and goldilocks.
Dependencies
~0–1MB
~22K SLoC