Consider using the add-2007-bl and dbl-2009-l formulae about pasta_curves HOT 5 OPEN

We use https://eprint.iacr.org/2015/1060 for bls12_381; we may as well use it here too.

from pasta_curves.

Also, looking at the code, we already use dbl-2009-l for Pallas and Vesta doubling (and dbl-2007-bl for the general doubling code for the Iso points).

from pasta_curves.

Reminded myself how https://eprint.iacr.org/2015/1060 works, and it uses homogeneous coordinates; we currently use Jacobian coordinates because of the tie-in with hash-to-curve. So I think using these addition formulas (which would be concretely faster than the Jacobian ones, per section 4.2 of that paper) is a good idea, as point addition is used significantly more.

from pasta_curves.

Reminded myself how https://eprint.iacr.org/2015/1060 works, and it uses homogeneous coordinates; we currently use Jacobian coordinates because of the tie-in with hash-to-curve. So I think using these addition formulas (which would be concretely faster than the Jacobian ones, per section 4.2 of that paper) is a good idea, as point addition is used significantly more.

you can still do Jacobian hash to curves/groups. The output is in affine anyway so it does not really matter right?

from pasta_curves.

I'd like to note the importance of this given the current addition function isn't constant time, enabling side channel attacks. While I can create a dedicated issue/PR for that, ideally that's handled with this IMO.

from pasta_curves.