p256 about noble-secp256k1

[paulmillr]

No.

Jacobian point (xyz) multiplication is specific to curve with a=0 (secp256k1). You will need to adjust JacobianPoint#double and #add methods.

See hyperelliptic.org for those formulas. They should be fairly straightforward to implement.

https://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html

As soon as you adjust those, check if USE_ENDOMORPHISM is automatically set to false, because endomorphism is specific to koblitz curves. The code already supports no-endo case.

[sublimator]

Thanks, was looking like that might be the case.
Was thrown by this line: https://github.com/paulmillr/noble-secp256k1/blob/master/index.ts#L48
Nice article and lib! You thought of supporting some other curves for ecdsa ?

[paulmillr]

Right now i’m finalizing bls12-381, a nice pairing-friendly curve. It allows to verify 1000 signatures at a cost of verifying one signature, so it’s awesome.

It would be great to implement ed448, but haven’t had time to do this yet.

As for nist curves, they are implemented almost everywhere natively, so not seeing personal need for those.

[sublimator]

they are implemented almost everywhere natively

Right, I was porting https://github.com/privacypass/challenge-bypass-extension from sjcl to elliptic/bn.js as a way of learning more about the privacypass protocol and ECC.

Web crypto ("native" in the browser context) doesn't seem to expose any of the scalar multiplication primitives, only signing/verifying operations etc.

not seeing personal need for those

Fair :)

[paulmillr]

Nice! It’s very useful extension. I hate those captchas & cloudflare. What operations are required in privacypass? I guess, ECDH?

[sublimator]

I've just been translating the [protocol overview](https://privacypass.github.io/protocol/) into code to get my head around it: https://github.com/coilhq/web-monetization-projects/blob/34f7c6feb3f6b264e64f64cd5264b98773b7e7bf/packages/coil-privacypass-elliptic/test/jest/scenarios.test.ts It's WIP and haven't had anyone look at it yet, but you should be able to see what operations it's using. P * scalar multiplication for arbitrary P (not just G) and on ...

[sublimator]

https://github.com/privacypass/challenge-bypass-extension/blob/master/docs/HASH_TO_CURVE.md#affine-sswu-method

[paulmillr]

As for hash-to-curve, take a look at my bls12-381 repo. I have been working on applying the exact same standard to the curve for the last couple weeks. It can be reused for p256.

[sublimator]

Nice! Ugh, so I realized elliptic p256 computations are like ~4x slower than secp256k1

[paulmillr]

Do you have this working somewhere?

[sublimator]

No, I've moved onto other things for the moment. The existing sjcl impl is working so it's hard to justify the time just at the moment.

Do you have this working somewhere?

Do you ?? :)

[sublimator]

Elliptic seems too slow with p256 curve ops so it's either improve that or modify this. Both would need auditing by people more knowledgeable than me.

[paulmillr]

p256 is available in https://github.com/paulmillr/noble-curves