doc: users list

[Michael McLoughlin]

Add a list of users to README or elsewhere.

• crypto/elliptic P-521 (CL 315271, tweet)
• Don't forget the constant-time in CSURF (preprint, source code)
• cloudflare/circl ted448 implementation (ref)

[Frank Denis]

• Libsodium (here, here)
• Wasm-crypto (here)
• ZIg (here, here, here)

[Michael McLoughlin]

• Libsodium (here, here)
• Wasm-crypto (here)
• ZIg (here, here, here)

Awesome! I had no idea :)

[Michael McLoughlin]

mratsim/constantine BLS12-381 sqrt (comment, code)

[Mamy Ratsimbazafy]

Not only that:

• BLS12-377 inversion (code
• BLS12-377 Tonelli-Shanks sqrt (code)
• BLS12-381 inversion (code)
• BLS12-381 invsqrt (code)
• BN254-Nogami inversion (code)
• BN254-Nogami invsqrt (code)
• BN254-Snarks (Ethereum / Zcash) inversion (code)
• BN254-Snarks invsqrt (code)
• BW6-761 inversion (code)
• BW6-761 invsqrt (code)

In the future inversion will likely be replaced by either Bernstein-Yang fast inversion or Pornin's fast inversion but the addition chain will stay as a benchmark reference point.

[Michael McLoughlin]

Not only that:

• BLS12-377 inversion (code
• BLS12-377 Tonelli-Shanks sqrt (code)
• BLS12-381 inversion (code)
• BLS12-381 invsqrt (code)
• BN254-Nogami inversion (code)
• BN254-Nogami invsqrt (code)
• BN254-Snarks (Ethereum / Zcash) inversion (code)
• BN254-Snarks invsqrt (code)
• BW6-761 inversion (code)
• BW6-761 invsqrt (code)

In the future inversion will likely be replaced by either Bernstein-Yang fast inversion or Pornin's fast inversion but the addition chain will stay as a benchmark reference point.

Wow that's awesome, thanks for sharing.

Curious if you had any script to convert addchain output into code. See #94.

[Michael McLoughlin]

Cloudflare CIRCL also using for BLS12-381 prime field.

#95 (comment)
cloudflare/circl#296

cc @armfazh

[Gautam Botrel]

can add gnark (well, gnark-crypto) to the list. For Sqrt methods so far, but it may be useful in other places 👍

See this pr .

[Michael McLoughlin]

can add gnark (well, gnark-crypto) to the list. For Sqrt methods so far, but it may be useful in other places

Awesome thanks @gbotrel !

[Michael McLoughlin]

Cited in: https://eprint.iacr.org/2022/748

[Michael McLoughlin]

Anemoi: Exploiting the Link between Arithmetization-Orientation and CCZ-Equivalence https://eprint.iacr.org/2022/840

[Michael McLoughlin]

Pairings in Rank-1 Constraint Systems https://eprint.iacr.org/2022/1162

[Michael McLoughlin]

@Yawning https://github.com/Yawning/secp256k1-voi