Constructing a Fast Prime-Order Group
summary
Construction by Mike Hamburg builds a prime-order group by encoding elements on a Jacobi quartic and transporting that encoding along isogenies to Edwards or Montgomery models, producing a canonical, non-malleable encoding that rejects noncanonical bitstrings. It avoids subgroup-check costs and supplies a single hash-to-group plus canonical representatives; ristretto255 (used with curve25519/ed25519 via the Montgomery ↔ Edwards path) is implemented in Rust dalek and claims up to 4x faster than secp under favorable benchmarks. Circuit use notes: sign checks are expensive, Montgomery formulas give fewer constraints.
AI-written summary · about
chapters (11)
- 0:00what kind of elliptic curve?
- 3:14tweaks cause subtle "features"
- 4:29what are decaf & ristretto?
- 5:26montgomery curves
- 6:45edwards curves
- 7:54jacobi quartic curves
- 8:43encoding on the jacobi quartic
- 10:06linking curves with isogenies
- 11:50encoding with isogenies
- 14:27decaf vs ristretto
- 16:10ristretto 255 status
