p521: field arithmetic implementation not working correctly

[tarcieri]

This is a tracking issue for promoting p521's wip-arithmetic-do-not-use feature to a working arithmetic feature.

Notably the base field implementation in p521 uses code generated by fiat-crypto specific to Solinas primes, which is different from the Montgomery representation which is easily supported using macros in the primeorder crate.

#945 fixed an issue where fiat_p521_tight_field_element uses a different limb representation than U576, however this was not sufficient to make the basic field arithmetic tests work: #946

[MasterAwesome]

What's remaining in terms of tests before promoting this into a sem-ver feature arithmetic?

[tarcieri]

When #951 lands we should basically be there, although I'd also like to wire up an ECDSA feature and add the Wycheproof test vectors for it

[MasterAwesome]

When #951 lands we should basically be there, although I'd also like to wire up an ECDSA feature and add the Wycheproof test vectors for it

I see, are you working on this or should I create a pull request?

[tarcieri]

I'm working on it. It's somewhat involved since the ecdsa crate assumes that the hash function output size is the same as the size of a serialized field element (it gets particularly hairy in the current RFC6979 implementation).

Fixing that will involve breaking changes to the ecdsa crate, but in the meantime I'm adding some newtypes to work around it.

[MasterAwesome]

I'm working on it. It's somewhat involved since the ecdsa crate assumes that the hash function output size is the same as the size of a serialized field element (it gets particularly hairy in the current RFC6979 implementation).

Fixing that will involve breaking changes to the ecdsa crate, but in the meantime I'm adding some newtypes to work around it.

Newtype for the curve's default hashing function that returns field element sized outputsize?

[tarcieri]

Newtypes for ecdsa::{SigningKey, VerifyingKey}

[MasterAwesome]

Newtypes for ecdsa::{SigningKey, VerifyingKey}

Ah I see, so this eventually will require a breaking change in ecdsa crate.

[tarcieri]

@MasterAwesome I was able to make the breaking changes in the ecdsa and rfc6979 crates:

• rfc6979: add generate_k_mut; remove digest bounds signatures#773
• ecdsa: remove OutputSize bounds on DigestPrimitive signatures#774

However, the rfc6979 crate still can't correctly generate a P-521 test vector for whatever reason:

• rfc6979: add P-521 + SHA-512 test vectors signatures#775
• p521: switch to upstream RFC6979-based ECDSA #1016