Add Nettle to libs.

2 files changed, 86 insertions, 24 deletions

diff --git a/docs/libraries.rst b/docs/libraries.rst
index 4455a11..b3733c8 100644
--- a/docs/libraries.rst
+++ b/docs/libraries.rst
@@ -684,7 +684,7 @@ libsecp256k1
 
 | Version: ``v0.4.0``
 | Repository: https://github.com/bitcoin-core/secp256k1
-| Docs: 
+| Docs:
 
 Primitives
 ----------
@@ -706,7 +706,7 @@ Derive:
  - Uses GLV decomposition and `interleaving with width-5 NAFs <https://github.com/bitcoin-core/secp256k1/blob/v0.4.0/src/ecmult_const_impl.h#L133>`__ via ``secp256k1_ecdh -> secp256k1_ecmult_const``.
  - Addition same as in Keygen.
  - `DBL <https://github.com/bitcoin-core/secp256k1/blob/v0.4.0/src/group_impl.h#L406>`__ (via ``secp256k1_gej_double``)::
-     
+
     Z3 = Y1*Z1
     S = Y1^2
     L = X1^2
@@ -735,13 +735,13 @@ Sign:
 Verify:
  - Split both scalars using GLV and then interleaving with width-5 NAFS on 4 scalars via ``secp256k1_ecdsa_verify -> secp256k1_ecdsa_sig_verify -> secp256k1_ecmult -> secp256k1_ecmult_strauss_wnaf``.
  - DBL same as in ECDH DERIVE. Two formulas for addition are implemented. For the generator part, same addition as in Keygen is used. For public key, the following::
-    
+
     assume iZ2 = 1/Z2
     az = Z_1*iZ2
     Z12 = az^2
     u1 = X1
     u2 = X2*Z12
-    s1 = Y1 
+    s1 = Y1
     s2 = Y2*Z12
     s2 = s2*az
     h = -u1
@@ -762,12 +762,73 @@ Verify:
     h3 = h3*s1
     Y3 = Y3+h3
 
- - Before the addition the Jacobian coordinates are mapped to an isomorphic curve. 
+ - Before the addition the Jacobian coordinates are mapped to an isomorphic curve.
 
 
 Nettle
 ======
 
+| Version: ``3.9.1``
+| Repository: https://git.lysator.liu.se/nettle/nettle
+| Docs: https://www.lysator.liu.se/~nisse/nettle/nettle.html
+
+Primitives
+----------
+
+ECDSA on P192, P224, P256, P384 and P521, also EdDSA on Curve25519, Curve448.
+
+.. csv-table:: Pippenger parameters
+    :header: "Curve", "K", "C"
+
+    P192, 8, 6
+    P224, 16, 7
+    P256, 11, 6
+    P384, 32, 6
+    P521, 44, 6
+    Curve25519, 11, 6
+
+ECDSA
+^^^^^
+
+KeyGen:
+ - Short-Weierstrass
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g.c?ref_type=tags#L44>`__ via ``ecdsa_generate_keypair -> ecc_curve.mul_g -> ecc_mul_g``.
+ - Jacobian
+ - `madd-2007-bl <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-add-jja.c?ref_type=tags#L53>`__, `dbl-2001-b <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-dup-jj.c?ref_type=tags#L46>`__
+
+Sign:
+ - Short-Weierstrass
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g.c?ref_type=tags#L44>`__ via ``ecc_ecdsa_sign -> ecc_mul_g``.
+ - Same as KeyGen.
+
+
+Verify:
+ - Short-Weierstrass
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g.c?ref_type=tags#L44>`__ and `4-bit Fixed Window <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-a.c?ref_type=tags#L52>`__ via ``ecc_ecdsa_verify -> ecc_mul_a + ecc_mul_g``.
+ - Jacobian
+ - `madd-2007-bl <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-add-jja.c?ref_type=tags#L53>`__, `dbl-2001-b <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-dup-jj.c?ref_type=tags#L46>`__,
+   also `add-2007-bl <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-add-jjj.c?ref_type=tags#L42>`__.
+
+Ed25519
+^^^^^^^
+
+KeyGen:
+ - Twisted Edwards
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g-eh.c?ref_type=tags#L44>`__ via ``ed25519_sha512_public_key -> _eddsa_public_key -> ecc_curve.mul_g -> ecc_mul_g_eh``.
+ - Projective
+ - `madd-2008-bbjlp <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-add-th.c?ref_type=tags#L42>`__, `add-2008-bbjlp <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-add-thh.c?ref_type=tags#L41>`__ and `dup-2008-bbjlp <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-dup-th.c?ref_type=tags#L41>`__.
+
+Sign:
+ - Twisted Edwards
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g-eh.c?ref_type=tags#L44>`__ via ``ed25519_sha512_sign -> _eddsa_sign -> ecc_curve.mul_g -> ecc_mul_g_eh``.
+ - Same as KeyGen.
+
+Verify:
+ - Twisted Edwards
+ - `Pippenger <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-g-eh.c?ref_type=tags#L44>`__ and `4-bit Fixed Window <https://git.lysator.liu.se/nettle/nettle/-/blob/nettle_3.9.1_release_20230601/ecc-mul-a-eh.c?ref_type=tags#L116>`__ via ``ed25519_sha512_verify -> _eddsa_verify -> ecc_curve.mul + ecc_curve.mul_g``.
+ - Same as KeyGen.
+
+
 mbedTLS
 =======
 
@@ -798,27 +859,27 @@ KeyGen:
  - `Left to right double-and-add-always <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=mpi/ec.c;h=c24921eea8bea8363a503d6d6071b116c176d8e5;hb=1c5cbacf3d88dded5063e959ee68678ff7d0fa56#l1824>`__ via ``gcry_pk_genkey -> _gcry_pk_genkey -> generate -> ecc_generate -> nist_generate_key -> _gcry_mpi_ec_mul_point``.
  - `ADD <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=mpi/ec.c;h=c24921eea8bea8363a503d6d6071b116c176d8e5;hb=1c5cbacf3d88dded5063e959ee68678ff7d0fa56#l1406>`__  (via ``_gcry_mpi_ec_add_points``)::
 
-     l1 = x1 z2^2  
-     l2 = x2 z1^2  
-     l3 = l1 - l2 
-     l4 = y1 z2^3  
-     l5 = y2 z1^3  
-     l6 = l4 - l5  
-     l7 = l1 + l2  
-     l8 = l4 + l5  
-     z3 = z1 z2 l3  
-     x3 = l6^2 - l7 l3^2  
-     l9 = l7 l3^2 - 2 x3  
-     y3 = (l9 l6 - l8 l3^3)/2 
+     l1 = x1 z2^2
+     l2 = x2 z1^2
+     l3 = l1 - l2
+     l4 = y1 z2^3
+     l5 = y2 z1^3
+     l6 = l4 - l5
+     l7 = l1 + l2
+     l8 = l4 + l5
+     z3 = z1 z2 l3
+     x3 = l6^2 - l7 l3^2
+     l9 = l7 l3^2 - 2 x3
+     y3 = (l9 l6 - l8 l3^3)/2
 
  - `DBL <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=mpi/ec.c;h=c24921eea8bea8363a503d6d6071b116c176d8e5;hb=1c5cbacf3d88dded5063e959ee68678ff7d0fa56#l1219>`__ (via ``_gcry_mpi_ec_dup_point``)::
-     
-     L1 = 3X^2 + aZ^4 
-     Z3 = 2YZ 
-     L2 = 4XY^2 
-     X3 = L1^2 - 2L2 
-     L3 = 8Y^4 
-     Y3 = L1(L2 - X3) - L3 
+
+     L1 = 3X^2 + aZ^4
+     Z3 = 2YZ
+     L2 = 4XY^2
+     X3 = L1^2 - 2L2
+     L3 = 8Y^4
+     Y3 = L1(L2 - X3) - L3
 
 
 Derive:
diff --git a/docs/references.rst b/docs/references.rst
index a805ce8..8945aa3 100644
--- a/docs/references.rst
+++ b/docs/references.rst
@@ -14,3 +14,4 @@ References
 .. [FFD] A formula for disaster: a unified approach to elliptic curve special-point-based attacks, https://eprint.iacr.org/2021/1595.pdf
 .. [MT1991] Mazur, B., & Tate, J. (1991). The `p`-adic sigma function. Duke Mathematical Journal, 62 (3), 663-688.
 .. [CO2002] Jean-Sébastien Coron. Resistance against Differential Power Analysis for Elliptic Curve Cryptosystems, https://link.springer.com/chapter/10.1007/3-540-48059-5_25
+.. [DJB02] D.J. Bernstein: Pippenger's Exponentiation Algorithm, https://cr.yp.to/papers/pippenger.pdf