fixup api breaks

Author: baloo

Cargo.lock

@@ -17,12 +17,12 @@ rust-version = "1.85"
 version = "0.17.0-pre.0"
 
 [dependencies]
-crypto-bigint = { version = "=0.7.0-pre.3", features = ["hybrid-array"], default-features = false }
-crypto_signature = { version = "=3.0.0-pre", default-features = false, features = ["digest", "rand_core"], optional = true, package = "signature" }
-elliptic-curve = { version = "0.14.0-rc.0", features = ["arithmetic", "bits", "hash2curve", "jwk", "pkcs8", "pem", "sec1"] }
+crypto-bigint = { version = "=0.7.0-pre.4", features = ["hybrid-array"], default-features = false }
+crypto_signature = { version = "3.0.0-rc.0", default-features = false, features = ["digest", "rand_core"], optional = true, package = "signature" }
+elliptic-curve = { version = "0.14.0-rc.3", features = ["arithmetic", "bits", "hash2curve", "jwk", "pkcs8", "pem", "sec1"] }
 rand_core = { version = "0.9", default-features = false }
 serdect = { version = "0.3.0", optional = true }
-sha3 = { version = "=0.11.0-pre.5", default-features = false }
+sha3 = { version = "0.11.0-rc.0", default-features = false }
 subtle = { version = "2.6", default-features = false }
 zeroize = { version = "1.8", default-features = false, optional = true }
 

ed448/Cargo.toml

@@ -1,6 +1,8 @@
 use crate::curve::edwards::EdwardsPoint;
 use crate::field::FieldElement;
 use crate::*;
+use core::ops::Mul;
+use elliptic_curve::{Error, Result, point::NonIdentity};
 use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
 
 #[cfg(feature = "zeroize")]
@@ -115,3 +117,35 @@ impl AffinePoint {
         self.y.to_bytes()
     }
 }
+
+impl From<NonIdentity<AffinePoint>> for AffinePoint {
+    fn from(affine: NonIdentity<AffinePoint>) -> Self {
+        affine.to_point()
+    }
+}
+
+impl TryFrom<AffinePoint> for NonIdentity<AffinePoint> {
+    type Error = Error;
+
+    fn try_from(affine_point: AffinePoint) -> Result<Self> {
+        NonIdentity::new(affine_point).into_option().ok_or(Error)
+    }
+}
+
+impl Mul<AffinePoint> for Scalar {
+    type Output = EdwardsPoint;
+
+    #[inline]
+    fn mul(self, rhs: AffinePoint) -> EdwardsPoint {
+        self * &rhs
+    }
+}
+
+impl Mul<&AffinePoint> for Scalar {
+    type Output = EdwardsPoint;
+
+    #[inline]
+    fn mul(self, rhs: &AffinePoint) -> EdwardsPoint {
+        rhs.to_edwards() * self
+    }
+}

ed448/src/curve/edwards/affine.rs

@@ -11,13 +11,13 @@ use crate::curve::twedwards::extended::ExtendedPoint as TwistedExtendedPoint;
 use crate::field::{FieldElement, Scalar};
 use crate::*;
 use elliptic_curve::{
-    array::{
-        typenum::{Unsigned, U56, U57, U84},
-        Array,
-    },
-    group::{cofactor::CofactorGroup, prime::PrimeGroup, Curve, Group, GroupEncoding},
+    Error,
+    array::{Array, typenum::Unsigned},
+    consts::{U28, U84},
+    group::{Curve, Group, GroupEncoding, cofactor::CofactorGroup, prime::PrimeGroup},
     hash2curve::{ExpandMsg, ExpandMsgXof, Expander, FromOkm},
     ops::LinearCombination,
+    point::NonIdentity,
 };
 use rand_core::TryRngCore;
 use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq, CtOption};
@@ -747,7 +747,7 @@ impl EdwardsPoint {
     ///
     /// Hash using the default domain separation tag and hash function
     pub fn hash_with_defaults(msg: &[u8]) -> Self {
-        Self::hash::<ExpandMsgXof<sha3::Shake256, U84>>(msg, DEFAULT_HASH_TO_CURVE_SUITE)
+        Self::hash::<ExpandMsgXof<sha3::Shake256>>(msg, DEFAULT_HASH_TO_CURVE_SUITE)
     }
 
     /// Hash a message to a point on the curve
@@ -756,7 +756,7 @@ impl EdwardsPoint {
     /// see <https://datatracker.ietf.org/doc/rfc9380/>
     pub fn hash<X>(msg: &[u8], dst: &[u8]) -> Self
     where
-        X: for<'a> ExpandMsg<'a>,
+        X: ExpandMsg<U28>,
     {
         type RandomLen = U84;
         let mut random_bytes = Array::<u8, RandomLen>::default();
@@ -784,7 +784,7 @@ impl EdwardsPoint {
     ///
     /// Encode using the default domain separation tag and hash function
     pub fn encode_with_defaults(msg: &[u8]) -> Self {
-        Self::encode::<ExpandMsgXof<sha3::Shake256, U84>>(msg, DEFAULT_ENCODE_TO_CURVE_SUITE)
+        Self::encode::<ExpandMsgXof<sha3::Shake256>>(msg, DEFAULT_ENCODE_TO_CURVE_SUITE)
     }
 
     /// Encode a message to a point on the curve
@@ -793,7 +793,7 @@ impl EdwardsPoint {
     /// see <https://datatracker.ietf.org/doc/rfc9380/>
     pub fn encode<X>(msg: &[u8], dst: &[u8]) -> Self
     where
-        X: for<'a> ExpandMsg<'a>,
+        X: ExpandMsg<U28>,
     {
         type RandomLen = U84;
         let mut random_bytes = Array::<u8, RandomLen>::default();
@@ -814,6 +814,21 @@ impl EdwardsPoint {
     }
 }
 
+impl From<NonIdentity<EdwardsPoint>> for EdwardsPoint {
+    fn from(p: NonIdentity<EdwardsPoint>) -> Self {
+        p.to_point()
+    }
+}
+
+/// The constant-time alternative is available at [`NonIdentity::new()`].
+impl TryFrom<EdwardsPoint> for NonIdentity<EdwardsPoint> {
+    type Error = Error;
+
+    fn try_from(point: EdwardsPoint) -> Result<Self, Error> {
+        NonIdentity::new(point).into_option().ok_or(Error)
+    }
+}
+
 // ------------------------------------------------------------------------
 // Addition and Subtraction
 // ------------------------------------------------------------------------
@@ -1188,7 +1203,7 @@ mod tests {
         ];
 
         for (msg, x, y) in MSGS {
-            let p = EdwardsPoint::hash::<ExpandMsgXof<sha3::Shake256, U84>>(msg, DST);
+            let p = EdwardsPoint::hash::<ExpandMsgXof<sha3::Shake256>>(msg, DST);
             assert_eq!(p.is_on_curve().unwrap_u8(), 1u8);
             let p = p.to_affine();
             let mut xx = [0u8; 56];
@@ -1225,7 +1240,7 @@ mod tests {
         ];
 
         for (msg, x, y) in MSGS {
-            let p = EdwardsPoint::encode::<ExpandMsgXof<sha3::Shake256, U84>>(msg, DST);
+            let p = EdwardsPoint::encode::<ExpandMsgXof<sha3::Shake256>>(msg, DST);
             assert_eq!(p.is_on_curve().unwrap_u8(), 1u8);
             let p = p.to_affine();
             let mut xx = [0u8; 56];

ed448/src/curve/edwards/extended.rs

@@ -1,6 +1,8 @@
 use crate::curve::twedwards::affine::AffinePoint as InnerAffinePoint;
 use crate::field::FieldElement;
-use crate::{Decaf448FieldBytes, DecafPoint};
+use crate::{Decaf448FieldBytes, DecafPoint, Scalar};
+use core::ops::Mul;
+use elliptic_curve::{Error, point::NonIdentity};
 use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
 
 #[cfg(feature = "zeroize")]
@@ -70,3 +72,72 @@ impl AffinePoint {
         self.0.y.to_bytes()
     }
 }
+
+/// The constant-time alternative is available at [`NonIdentity::new()`].
+impl TryFrom<AffinePoint> for NonIdentity<AffinePoint> {
+    type Error = Error;
+
+    fn try_from(affine_point: AffinePoint) -> Result<Self, Error> {
+        NonIdentity::new(affine_point).into_option().ok_or(Error)
+    }
+}
+
+impl From<NonIdentity<AffinePoint>> for AffinePoint {
+    fn from(affine: NonIdentity<AffinePoint>) -> Self {
+        affine.to_point()
+    }
+}
+
+impl Mul<Scalar> for AffinePoint {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, scalar: Scalar) -> DecafPoint {
+        &self * scalar
+    }
+}
+
+impl Mul<Scalar> for &AffinePoint {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, scalar: Scalar) -> DecafPoint {
+        self * &scalar
+    }
+}
+
+impl Mul<&Scalar> for AffinePoint {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, scalar: &Scalar) -> DecafPoint {
+        &self * scalar
+    }
+}
+
+impl Mul<&Scalar> for &AffinePoint {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, scalar: &Scalar) -> DecafPoint {
+        self.to_decaf() * scalar
+    }
+}
+
+impl Mul<AffinePoint> for Scalar {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, point: AffinePoint) -> DecafPoint {
+        point * self
+    }
+}
+
+impl Mul<&AffinePoint> for Scalar {
+    type Output = DecafPoint;
+
+    #[inline]
+    fn mul(self, point: &AffinePoint) -> DecafPoint {
+        point * self
+    }
+}

ed448/src/decaf/affine.rs

@@ -4,13 +4,13 @@ use crate::field::FieldElement;
 use crate::*;
 
 use elliptic_curve::{
-    array::{
-        Array,
-    },
+    Error, Group,
+    array::{Array, typenum::Unsigned},
+    consts::{U32, U56, U84},
     group::{Curve, GroupEncoding, cofactor::CofactorGroup, prime::PrimeGroup},
     hash2curve::{ExpandMsg, Expander, FromOkm},
     ops::LinearCombination,
-    Group,
+    point::NonIdentity,
 };
 
 use core::fmt::{Display, Formatter, LowerHex, Result as FmtResult, UpperHex};
@@ -356,7 +356,7 @@ impl DecafPoint {
     /// separation tag.
     pub fn hash<X>(msg: &[u8], dst: &[u8]) -> Self
     where
-        X: for<'a> ExpandMsg<'a>,
+        X: ExpandMsg<U32>,
     {
         type RandomLen = U84;
         let dst = [dst];
@@ -605,6 +605,21 @@ impl CompressedDecaf {
     }
 }
 
+/// The constant-time alternative is available at [`NonIdentity::new()`].
+impl TryFrom<DecafPoint> for NonIdentity<DecafPoint> {
+    type Error = Error;
+
+    fn try_from(point: DecafPoint) -> Result<Self, Error> {
+        NonIdentity::new(point).into_option().ok_or(Error)
+    }
+}
+
+impl From<NonIdentity<DecafPoint>> for DecafPoint {
+    fn from(decaf: NonIdentity<DecafPoint>) -> Self {
+        decaf.to_point()
+    }
+}
+
 #[cfg(test)]
 mod test {
     use super::*;
@@ -761,8 +776,7 @@ mod test {
         use elliptic_curve::hash2curve::ExpandMsgXof;
 
         let msg = b"Hello, world!";
-        let point =
-            DecafPoint::hash::<ExpandMsgXof<sha3::Shake256, U84>>(msg, b"test_hash_to_curve");
+        let point = DecafPoint::hash::<ExpandMsgXof<sha3::Shake256>>(msg, b"test_hash_to_curve");
         assert_eq!(point.0.is_on_curve().unwrap_u8(), 1u8);
         assert_ne!(point, DecafPoint::IDENTITY);
         assert_ne!(point, DecafPoint::GENERATOR);