elliptic-curve: add Invert trait

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).

[tarcieri]

Add a trait for performing scalar/field inversions.

The main motivation for this is to allow for things like BlindedScalar type which use random blinding for either efficiency reasons (to allow a vartime inversion) and/or as a side-channel defense.

[tarcieri]

@nickray FYI, my intended use for this is to remove masking_scalar from the SignPrimitive API.

Instead we can have something like a BlindedScalar type constructed from a Scalar and a CryptoRng which supports an Into<Scalar> conversion, but whose Invert::invert() impl can use the vartime inversion. If we have that, it can be passed in lieu of a Scalar as the ephemeral_scalar.

I think if we prototype that in the p256 crate, we could potentially hoist it into this crate and have a generic BlindedScalar implementation that works with any curve.

[nickray]

The intended use is an interesting approach - I like it!

So far I never used any RNG traits (felt too implicit, I like to see exactly where entropy is consumed), but would be interested to see how you'd do this! Oh and my last attempt at field traits failed too 😅.

[nickray]

I wonder how, for practical purposes, this CtOption approach compares to restricting the domain of this trait to just invertible elements?

[tarcieri]

I didn't put a whole lot of thought into this trait and for me it's mostly it's a means to an end for implementing RustCrypto/elliptic-curves#99

It's mostly a trait extraction of what exists in the p256 and k256 codebases, for both Scalar and FieldElement. I only impl'd it on the former, since that's all I care about for RustCrypto/elliptic-curves#99

I'll make a note of it in RustCrypto/elliptic-curves#22 as I'm sure there's some prior art here I've overlooked (or potentially another crate we can source the trait from).