feat(frost-ed448): add no_std support

.github/workflows/main.yml

@@ -66,10 +66,9 @@ jobs:
   build_no_std:
     name: build with no_std
     runs-on: ubuntu-latest
-    # Skip ed448 which does not support it.
     strategy:
       matrix:
-        crate: [ristretto255, ed25519, p256, secp256k1, rerandomized]
+        crate: [ed448, ristretto255, ed25519, p256, secp256k1, rerandomized]
     steps:
     - uses: actions/[email protected]
     - uses: dtolnay/rust-toolchain@master

frost-core/CHANGELOG.md

@@ -7,6 +7,8 @@ Entries are listed in reverse chronological order.
 * It is now possible to identify the culprit in `frost_core::keys::dkg::part3()`
   if an invalid secret share was sent by one of the participants (by calling
   frost_core::Error<C>::culprit()`).
+* Added no-std support for frost-ed448 crate. This became possible after migration to `ed448-goldilocks-plus` (fork of
+  `ed448-goldilocks`).
 
 ## 2.0.0
 

frost-ed448/Cargo.toml

@@ -23,7 +23,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
 document-features = "0.2.7"
-ed448-goldilocks = { version = "0.9.0" }
+ed448-goldilocks-plus = { version = "0.13.1", features = ["alloc"], default-features = false }
 frost-core = { path = "../frost-core", version = "2.0.0", default-features = false }
 frost-rerandomized = { path = "../frost-rerandomized", version = "2.0.0", default-features = false }
 rand_core = "0.6"

frost-ed448/src/lib.rs

@@ -1,3 +1,4 @@
+#![cfg_attr(not(feature = "std"), no_std)]
 #![allow(non_snake_case)]
 #![deny(missing_docs)]
 #![cfg_attr(docsrs, feature(doc_auto_cfg))]
@@ -7,11 +8,10 @@
 
 extern crate alloc;
 
-use std::collections::BTreeMap;
+use alloc::collections::BTreeMap;
 
-use ed448_goldilocks::{
-    curve::{edwards::CompressedEdwardsY, ExtendedPoint},
-    Scalar,
+use ed448_goldilocks_plus::{
+    CompressedEdwardsY, EdwardsPoint, Scalar, ScalarBytes, WideScalarBytes,
 };
 use frost_rerandomized::RandomizedCiphersuite;
 use rand_core::{CryptoRng, RngCore};
@@ -44,11 +44,11 @@ impl Field for Ed448ScalarField {
     type Serialization = [u8; 57];
 
     fn zero() -> Self::Scalar {
-        Scalar::zero()
+        Scalar::ZERO
     }
 
     fn one() -> Self::Scalar {
-        Scalar::one()
+        Scalar::ONE
     }
 
     fn invert(scalar: &Self::Scalar) -> Result<Self::Scalar, FieldError> {
@@ -64,11 +64,11 @@ impl Field for Ed448ScalarField {
     }
 
     fn serialize(scalar: &Self::Scalar) -> Self::Serialization {
-        scalar.to_bytes_rfc_8032()
+        scalar.to_bytes_rfc_8032().into()
     }
 
     fn deserialize(buf: &Self::Serialization) -> Result<Self::Scalar, FieldError> {
-        match Scalar::from_canonical_bytes(*buf) {
+        match Scalar::from_canonical_bytes(ScalarBytes::from_slice(buf)).into() {
             Some(s) => Ok(s),
             None => Err(FieldError::MalformedScalar),
         }
@@ -86,20 +86,20 @@ pub struct Ed448Group;
 impl Group for Ed448Group {
     type Field = Ed448ScalarField;
 
-    type Element = ExtendedPoint;
+    type Element = EdwardsPoint;
 
     type Serialization = [u8; 57];
 
     fn cofactor() -> <Self::Field as Field>::Scalar {
-        Scalar::one()
+        Scalar::ONE
     }
 
     fn identity() -> Self::Element {
-        Self::Element::identity()
+        Self::Element::IDENTITY
     }
 
     fn generator() -> Self::Element {
-        Self::Element::generator()
+        Self::Element::GENERATOR
     }
 
     fn serialize(element: &Self::Element) -> Result<Self::Serialization, GroupError> {
@@ -111,11 +111,11 @@ impl Group for Ed448Group {
 
     fn deserialize(buf: &Self::Serialization) -> Result<Self::Element, GroupError> {
         let compressed = CompressedEdwardsY(*buf);
-        match compressed.decompress() {
+        match compressed.decompress_unchecked().into_option() {
             Some(point) => {
                 if point == Self::identity() {
                     Err(GroupError::InvalidIdentityElement)
-                } else if point.is_torsion_free() {
+                } else if point.is_torsion_free().into() {
                     // decompress() does not check for canonicality, so we
                     // check by recompressing and comparing
                     if point.compress().0 != compressed.0 {
@@ -144,8 +144,9 @@ fn hash_to_array(inputs: &[&[u8]]) -> [u8; 114] {
 }
 
 fn hash_to_scalar(inputs: &[&[u8]]) -> Scalar {
-    let output = hash_to_array(inputs);
-    Scalar::from_bytes_mod_order_wide(&output)
+    let temp = hash_to_array(inputs);
+    let output = WideScalarBytes::from_slice(&temp);
+    Scalar::from_bytes_mod_order_wide(output)
 }
 
 /// Context string from the ciphersuite in the [spec]
@@ -230,7 +231,6 @@ pub type Identifier = frost::Identifier<E>;
 /// FROST(Ed448, SHAKE256) keys, key generation, key shares.
 pub mod keys {
     use super::*;
-    use std::collections::BTreeMap;
 
     /// The identifier list to use when generating key shares.
     pub type IdentifierList<'a> = frost::keys::IdentifierList<'a, E>;

frost-ed448/src/tests/deserialize.rs

@@ -1,10 +1,10 @@
 use crate::*;
-use ed448_goldilocks::curve::ExtendedPoint;
+use ed448_goldilocks_plus::EdwardsPoint;
 use frost_core::Ciphersuite;
 
 #[test]
 fn check_deserialize_non_canonical() {
-    let mut encoded_generator = ExtendedPoint::generator().compress().0;
+    let mut encoded_generator = EdwardsPoint::GENERATOR.compress().0;
 
     let r = <Ed448Shake256 as Ciphersuite>::Group::deserialize(&encoded_generator);
     assert!(r.is_ok());
@@ -35,7 +35,7 @@ fn check_deserialize_non_prime_order() {
 
 #[test]
 fn check_deserialize_identity() {
-    let encoded_identity = ExtendedPoint::identity().compress().0;
+    let encoded_identity = EdwardsPoint::IDENTITY.compress().0;
 
     let r = <Ed448Shake256 as Ciphersuite>::Group::deserialize(&encoded_identity);
     assert_eq!(r, Err(GroupError::InvalidIdentityElement));