Re: [CFRG] hash_to_field requires implementing a new 25519 field op

"Riad S. Wahby" <> Wed, 21 July 2021 22:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BD9913A2D3D for <>; Wed, 21 Jul 2021 15:41:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.649
X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ROBrEwRS9oZ6 for <>; Wed, 21 Jul 2021 15:41:16 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 992EB3A2D38 for <>; Wed, 21 Jul 2021 15:41:16 -0700 (PDT)
Received: by with SMTP id m68so3674085qke.7 for <>; Wed, 21 Jul 2021 15:41:16 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=yikmW2MeXFq2gsfd+hi3OEL/WBTXdCAe4K9a6vfhtHA=; b=tshm/1sKy72KHaxhNRlxmj8gqZOawaiXoQXq8ALFtii6hJVPKxSPFteNJfVP7LdZjg dKJw6PsG5Qgm9dbv7/c/c8w+g75PrNvh+YurX7GJiwzqNBgzS5Ayi34KZL4SaQNDRpd8 ziWbxopTf4pCev+8SeT3Q1atZwrZ+7fx85dA4vRcFNyRsFRSongd2FrxmphBY34UJwIm Km7R0MpH4oNwwElo5x53lSy3cGLzAzfHS37t5bPScgASG7TbG7Fua1Ofkq92KHYQNss7 2FFqx0ZS9kvgKHl92GzRdIbz6cEcU7Un7ofqc5FtvVRrfnWrXWhkvAAHcfExgPNWyRnM Xahw==
X-Gm-Message-State: AOAM5315ZNmCzivxeYyBNMKM8VG16tWzJrCMDo3e4xRbY93X6zXN0N8o jnasVHeNlbk7m+Krs2OSouQ=
X-Google-Smtp-Source: ABdhPJxnz41D75Z3FYy+SdycX5CAo0SBraSmv7aHlYcNsgw2WdJHEsohUey4mdaCRP4/z8qA8ueikQ==
X-Received: by 2002:a37:92c6:: with SMTP id u189mr36174119qkd.237.1626907275387; Wed, 21 Jul 2021 15:41:15 -0700 (PDT)
Received: from localhost ( []) by with ESMTPSA id e2sm12200186qkn.69.2021. (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Wed, 21 Jul 2021 15:41:14 -0700 (PDT)
Date: Wed, 21 Jul 2021 18:41:13 -0400
From: "Riad S. Wahby" <>
To: Loup Vaillant-David <>
Cc: Filippo Valsorda <>,
Message-ID: <20210721224113.qvbezr3pqbdy5bck@kaon.local>
References: <> <20210721191123.i3f33p3qvkwxlbtl@kaon.local> <>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <>
Archived-At: <>
Subject: Re: [CFRG] hash_to_field requires implementing a new 25519 field op
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 21 Jul 2021 22:41:23 -0000

Hello Loup,

Loup Vaillant-David <> wrote:
> Wait a minute, that reduction is not *nearly* as large as you make it
> out to be.  Let's take a look at Curve25519's ref10 implementation on
> SUPERCOP. You would think that because the result of the multiplication
> (before carry propagation) is stored in 10 64-bit signed integers, the
> number they represent easily exceeds 2^512, or even approaches 2^640.

Our messages crossed, but in general the product of two residues mod p
will be as large as p^2 - 2p + 1, which is roughly log2(p^2) bits as I
claimed. The code you link does some of that reduction implicitly, but
the same trick can be used on a 384-bit number. See my message from ~5
minutes ago to Filippo.

Or, as Rene points out in parallel, if we do not demand absolutely the
fastest reduction we can implement it using field operations directly,
which is what I did in the pairing-plus crate, for example: