Skip to main content

STARKs

Curve

Cheetah is Topos’s STARK-friendly elliptic curve defined over a sextic extension of p=262+256+255+1p = 2^{62} + 2^{56} + 2^{55} + 1 and defined as follows:

E(Fp6):y2=x3+x+BE(\mathbb{F}_{p^6}): y^2 = x^3 + x + B

where:

  • Fp2:=Fp[X]/(X22X2)   ={a+b.u(a,b)(Fp)2, u22u2=0}\mathbb{F}_{p^2} \vcentcolon= \mathbb{F}_p[X]/(X^2 - 2X - 2) \\ \quad\ \ \ = \left\lbrace a + b.u \mid (a,b) \in (\mathbb{F}_p)^2,\ u^2 - 2u - 2 = 0\right\rbrace
  • Fp6:=Fp2[X]/(X3+X+1)   ={a+b.v+c.v2(a,b,c)(Fp2)3, v2+v+1=0}\mathbb{F}_{p^6} \vcentcolon=\mathbb{F}_{p^2}[X]/(X^3 + X + 1) \\ \quad\ \ \ = \left\lbrace a + b.v + c.v^2 \mid (a,b,c) \in (\mathbb{F}_{p^2})^3,\ v^2 + v + 1 = 0\right\rbrace
  • B=(1200866201009650596u+1935817186716799185).v2+(3999205700308519553u+3518137720867787056).v+2508413708960025374u+1526905369741321712B = (1200866201009650596 u + 1935817186716799185).v^2\\\qquad \quad + (3999205700308519553u + 3518137720867787056).v\\ \qquad \qquad + 2508413708960025374u + 1526905369741321712
  • q=17278877126736494933592566161653303514319447234579276854188469089485337225893q = 17278877126736494933592566161653303514319447234579276854188469089485337225893 (prime order of the curve)

The curve defines a large group of 373 bits, containing a 254-bit prime order qq subgroup on which we perform all our curve operations, including our Schnorr signature scheme.

The base point of the curve, is defined as:

G=(Gx:Gy:Gz), with:Gx=(288076929228681448u+2633256936270674947).v2+(1056103921720638754u+3052857668015466949).v+4508025770867562887u+2398517019392108645Gy=(3289504647774244396u+4227116334258416103).v2+(3024200307602630234u+1961556908722893436)v+1225290585625954719u+3894155704139868264Gz=1G = (G_x:G_y:G_z),\ \mathrm{with:}\\{ }\\ G_x = (288076929228681448u + 2633256936270674947).v^2 + (1056103921720638754u + 3052857668015466949).v + 4508025770867562887u + 2398517019392108645\\{ }\\G_y = (3289504647774244396u + 4227116334258416103).v^2 + (3024200307602630234u + 1961556908722893436)v + 1225290585625954719u + 3894155704139868264\\{ }\\G_z = 1