Timeline for Curve used in Monero - A Subgroup of Ed25519?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 17, 2020 at 11:29 | comment | added | user679128 | Hi, I think it’s probably better to post this as a new question. Maybe on crypto.stackexchange if you make it general. One thing which does not look right to me, is that x is taken from F_q which I assume is the prime field 2^225-19 and not the scalar field. | |
| May 17, 2020 at 11:23 | comment | added | Suyash Bagad | For 100 runs of this expt, typically only 6-10 Monero add. seem to be have valid encoding in Ristretto. Now this confuses me how can we convert Monero add. to Ristretto points. Note that the byte-encoding of s is nothing but CompressedRistretto representation. So, for each example point P, let the byte encoding of P be s(P). Then I decompress this CompressedRistretto to get a Ristretto point using the function in Ristretto implementation. What am I missing here? | |
| May 17, 2020 at 10:59 | comment | added | Suyash Bagad | Thanks a lot for the detailed explanation of the small-subgroup attack as well as the idea of Ristretto. Your answer was a great start point for me to read literature on Ristretto and Edwards curve! I tried the following experiment: 1. Take a random scalar x in F_q, 2. Compute P = xG, G is basepoint of Ed25519 (P essentially becomes a Monero address), 3. Compute Encoding s of P as described here 4. Check if s is a valid encoding in Ristretto. For 100 runs of this expt, (...continued in next comment) | |
| May 10, 2020 at 7:26 | comment | added | user679128 | A lot of things were omitted or removed to shorten the explanation. I think that your comments are off topic in so far as allowing one to understand how Ristretto works. The cofactor part was more of a motivation for Ristretto. I should have made that clearer. | |
| May 5, 2020 at 21:51 | history | answered | user679128 | CC BY-SA 4.0 |