Skip to main content

STARKs

Curve

Cheetah is Topos’s STARK-friendly elliptic curve defined over a sextic extension of p=264−232+1p = 2^{64} - 2^{32} + 1 and defined as follows:

E(Fp6):y2=x3+x+BE(\mathbb{F}_{p^6}): y^2 = x^3 + x + B

where:

  • Fp6:=Fp[X]/(X6−7)   ={a+b.u+c.u2+d.u3+e.u4+f.u5∣(a,b,c,d,e,f)∈(Fp)6, u6−7=0}\mathbb{F}_{p^6} \vcentcolon=\mathbb{F}_{p}[X]/(X^6 - 7) \\ \quad\ \ \ = \left\lbrace a + b.u + c.u^2 + d.u^3 + e.u^4 + f.u^5 \mid (a,b,c,d,e,f) \in (\mathbb{F}_{p})^6,\ u^6 - 7 = 0\right\rbrace
  • B=u+395B = u + 395
  • q=55610362957290864006699123731285679659474893560816383126640993521607086746831q = 55610362957290864006699123731285679659474893560816383126640993521607086746831 (prime order of the curve's subgroup)
  • h=708537115134665106932687062569690615370h = 708537115134665106932687062569690615370 (cofactor of the curve)

The curve defines a large group of 384 bits, containing a 255-bit prime order qq subgroup on which we perform all our curve operations, including our Schnorr signature scheme.

The base point of the curve, obtained by applying the SSWU hash-to-curve algorithm to the "Cheetah" ASCII string, is defined as:

G=(Gx:Gy:Gz), with:Gx=12938930721685970739.u5+375185138577093320.u4+4830863958577994148.u3+10526511002404673680.u2+8599518745794843693.u+2754611494552410273Gy=9990732138772505951.u5+13187678623570541764.u4+10708493419890101954.u3+14375303400746062753.u2+2774812795997841935.u+15384029202802550068Gz=1G = (G_x:G_y:G_z),\ \mathrm{with:}\\{ }\\ G_x = 12938930721685970739.u^5 + 375185138577093320.u^4 + 4830863958577994148.u^3 + 10526511002404673680.u^2 + 8599518745794843693.u + 2754611494552410273\\{ }\\G_y = 9990732138772505951.u^5 + 13187678623570541764.u^4 + 10708493419890101954.u^3 + 14375303400746062753.u^2 + 2774812795997841935.u + 15384029202802550068\\{ }\\G_z = 1