Trait P256Arith 

pub trait P256Arith {
    type Point: Copy + Send + Sync;

    // Required methods
    fn scalar_add(a: &P256Scalar, b: &P256Scalar) -> P256Scalar;
    fn scalar_sub(a: &P256Scalar, b: &P256Scalar) -> P256Scalar;
    fn scalar_mul(a: &P256Scalar, b: &P256Scalar) -> P256Scalar;
    fn scalar_invert(a: &P256Scalar) -> P256Scalar;
    fn point_identity() -> Self::Point;
    fn point_from_affine(p: &P256Point) -> Option<Self::Point>;
    fn point_from_affine_unchecked(p: &P256Point) -> Self::Point;
    fn point_to_affine(p: &Self::Point) -> Option<P256Point>;
    fn point_is_identity(p: &Self::Point) -> bool;
    fn point_neg(p: &Self::Point) -> Self::Point;
    fn point_add(p: &Self::Point, q: &Self::Point) -> Self::Point;
    fn point_mul(k: &P256Scalar, p: &Self::Point) -> Self::Point;
    fn point_mul_base(k: &P256Scalar) -> Self::Point;
    fn point_lincomb(
        a: &P256Scalar,
        p: &Self::Point,
        b: &P256Scalar,
        q: &Self::Point,
    ) -> Self::Point;
    fn point_lincomb_vartime(
        a: &P256Scalar,
        p: &Self::Point,
        b: &P256Scalar,
        q: &Self::Point,
    ) -> Self::Point;
}

P-256 (secp256r1) scalar and point arithmetic driver.

Contract

• Scalars are canonical, in [0, n); results are canonical too.
• All operations must be constant-time, except those with a _vartime suffix.

Required Associated Types

type Point: Copy + Send + Sync

Opaque storage for the implementation’s point representation.

Implementations pick whatever their arithmetic works in (projective or Jacobian coordinates, …), so a chain of operations pays for the conversion to affine coordinates once, in point_to_affine.

Required Methods

fn scalar_add(a: &P256Scalar, b: &P256Scalar) -> P256Scalar

a + b mod n.

fn scalar_sub(a: &P256Scalar, b: &P256Scalar) -> P256Scalar

a - b mod n.

fn scalar_mul(a: &P256Scalar, b: &P256Scalar) -> P256Scalar

a * b mod n.

fn scalar_invert(a: &P256Scalar) -> P256Scalar

a^-1 mod n. a is nonzero.

fn point_identity() -> Self::Point

The identity (the point at infinity).

fn point_from_affine(p: &P256Point) -> Option<Self::Point>

Import an affine point, checking that it is on the curve.

Returns None if p is not on the curve.

fn point_from_affine_unchecked(p: &P256Point) -> Self::Point

Import an affine point without checking that it is on the curve.

p must be a valid point on the curve. Passing an invalid point may panic, hang, or produce wrong results, including ones that compromise security.

fn point_to_affine(p: &Self::Point) -> Option<P256Point>

The affine coordinates of p, or None for the identity.

fn point_is_identity(p: &Self::Point) -> bool

Whether p is the identity.

fn point_neg(p: &Self::Point) -> Self::Point

-p.

fn point_add(p: &Self::Point, q: &Self::Point) -> Self::Point

p + q, for any p and q: equal, opposite or the identity included.

fn point_mul(k: &P256Scalar, p: &Self::Point) -> Self::Point

k * p.

fn point_mul_base(k: &P256Scalar) -> Self::Point

k * G for the curve’s base point G.

fn point_lincomb( a: &P256Scalar, p: &Self::Point, b: &P256Scalar, q: &Self::Point, ) -> Self::Point

a * p + b * q.

Scalars may be secret. Implementations may share the doublings between the terms (Strauss’s algorithm) as long as the timing does not depend on the scalars.

fn point_lincomb_vartime( a: &P256Scalar, p: &Self::Point, b: &P256Scalar, q: &Self::Point, ) -> Self::Point

a * p + b * q for public values.

What ECDSA verification needs. Implementations may use variable-time algorithms (Shamir’s trick with a signed-digit recoding, …).

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors