do255e

package
v0.0.0-...-33e5fd3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 12, 2020 License: MIT Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Do255eCheckPoint 

func Do255eCheckPoint(src []byte) int

Test whether a given chunk of 32 bytes is a valid representation of a do255e group element. This is faster than actually decoding it. Returned value is: 

 1   valid encoding of a non-neutral group element
 0   valid encoding of the neutral point N
-1   invalid encoding

func Do255eKeyExchange 

func Do255eKeyExchange(sk *Do255ePrivateKey, peer_pk []byte, secretLen int) (secret []byte, ok int)

Key exchange with do255e: given our private key, and the public key from the peer, a shared secret of length 'len' bytes is produced. The peer's public key is provided encoded; it should have length exactly 32 bytes. If the provided sequence of bytes has not length exactly 32 bytes, or if it is not otherwise a valid do255e point encoding, then the key exchange fails. On failure, a byte sequence of the requested length is still generated; that byte sequence is not predictable by outsiders, and cannot be distinguished from the output of a successful ECDH exchange by outsiders. This is meant to support rare protocols where exchanged keys are not public, and the exchange should not have any validation semantics. The 'ok' returned value has value 1 on success, 0 on error (an 'int' is used to promote constant-time processing).

Types

type Do255ePoint 

type Do255ePoint struct {
	// contains filtered or unexported fields
}

Do255ePoint is the type for a do255e point.

Default value for a point structure is not valid. The NewDo255ePoint() function makes sure to return only initialized structures. If allocating a point structure manually, make sure to properly set it to a valid point before using it as source.

func Do255eHashToCurve 

func Do255eHashToCurve(data []byte, opts crypto.SignerOpts) (*Do255ePoint, error)

Hash some input data into a curve point. The input data ('data') is either raw or pre-hashed, as identified by the opts parameter. If the hash function identifier is not recognized, then an error is returned. Otherwise, the output point is returned.

func NewDo255ePoint 

func NewDo255ePoint() *Do255ePoint

Create a new point. The point is set to the group neutral element (N).

func (*Do255ePoint) Add 

func (P *Do255ePoint) Add(P1, P2 *Do255ePoint) *Do255ePoint

Set this point to the sum of the two provided points. A pointer to this structure (P) is returned.

func (*Do255ePoint) Bytes 

func (P *Do255ePoint) Bytes() [32]byte

Encode a point into exactly 32 bytes.

func (*Do255ePoint) Decode 

func (P *Do255ePoint) Decode(src []byte) int

Decode a point from exactly 32 bytes. Returned value is 1 if the point could be successfully decoded into a non-neutral group element, 0 if it could be successfully decoded as the neutral point N, or -1 if it could not be decoded. If the decoding was not successful, then the destination structure is set to the neutral N.

This function is constant-time with regard to the decoded value and also with regard to the validity status (timing-based side channels do not leak whether the value was found to be a valid point).

Returned value is: 

 1   valid encoding of a non-neutral group element
 0   valid encoding of the neutral point N
-1   invalid encoding

func (*Do255ePoint) Double 

func (P *Do255ePoint) Double(Q *Do255ePoint) *Do255ePoint

Set this point (P) to the double of the provided point Q. A pointer to this structure (P) is returned.

func (*Do255ePoint) DoubleX 

func (P *Do255ePoint) DoubleX(Q *Do255ePoint, n uint) *Do255ePoint

Set this point (P) to (2^n)*Q (i.e. perform n successive doublings). This function is constant-time with regard to the point values, but not to the number of doublings (n); computation time is proportional to n. A pointer to this structure (P) is returned.

func (*Do255ePoint) Encode 

func (P *Do255ePoint) Encode(dst []byte) []byte

Encode a point into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity.

func (*Do255ePoint) EncodeSquaredW 

func (P *Do255ePoint) EncodeSquaredW(dst []byte) []byte

Encode the square of the w coordinate of a point into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity. This function is meant to support ECDH.

func (*Do255ePoint) Equal 

func (P *Do255ePoint) Equal(Q *Do255ePoint) int

Test whether this structure (P) represents the same point as the provided other structure (Q). Returned value is 1 if both points are the same, 0 otherwise.

func (*Do255ePoint) Generator 

func (P *Do255ePoint) Generator() *Do255ePoint

Set the point P to the conventional generator (G). A pointer to this structure is returned.

func (*Do255ePoint) IsNeutral 

func (P *Do255ePoint) IsNeutral() int

Test whether a point is the neutral element N. Returned value is 1 for the neutral, 0 otherwise.

func (*Do255ePoint) MapBytes 

func (P *Do255ePoint) MapBytes(bb []byte) *Do255ePoint

Map a sequence of bytes into a curve element. The mapping is not injective or surjective, and not uniform among possible outputs; however, any given point has only a limited number of possible pre-images by the map. A hash-to-curve process can be built on top of this map, as follows:

  • Hash some input data in 64 bytes, with a secure hash function or XOF (e.g. SHAKE).
  • Split these 64 bytes into two halves, and map each of them to a point with this map.
  • Add the two points together.

func (*Do255ePoint) Mul 

func (P *Do255ePoint) Mul(Q *Do255ePoint, n *Do255eScalar) *Do255ePoint

Multiply a point Q by a given scalar n. A pointer to this structure (P) is returned.

func (*Do255ePoint) MulGen 

func (P *Do255ePoint) MulGen(n *Do255eScalar) *Do255ePoint

Multiply the conventional generator by a given scalar n. This is functionally equivalent (but faster) to P.Generator().Mul(&P, n). A pointer to this structure (P) is returned.

func (*Do255ePoint) Neg 

func (P *Do255ePoint) Neg(Q *Do255ePoint) *Do255ePoint

Set P to the opposite of point Q. A pointer to this structure (P) is returned.

func (*Do255ePoint) Neutral 

func (P *Do255ePoint) Neutral() *Do255ePoint

Set the point P to the neutral element (N). A pointer to this structure is returned.

func (*Do255ePoint) Select 

func (P *Do255ePoint) Select(P1, P2 *Do255ePoint, ctl int)

If ctl == 1, then copy point Q1 into P. If ctl == 0, then copy point Q2 into P. ctl MUST be 0 or 1. This is a constant-time selection primitive.

func (*Do255ePoint) Set 

func (P *Do255ePoint) Set(Q *Do255ePoint) *Do255ePoint

Copy a point structure into another. A pointer to this structure is returned.

func (*Do255ePoint) Sub 

func (P *Do255ePoint) Sub(P1, P2 *Do255ePoint) *Do255ePoint

Set this point to the difference of the two provided points (P1 - P2). A pointer to this structure (P) is returned.

func (*Do255ePoint) VerifyHelper 

func (P *Do255ePoint) VerifyHelper(k0, k1 *Do255eScalar, encR []byte) int

Alternate helper function for signature verification; this returns 1 if k0*G + k1*P yields a point whose encoding is exactly equal to the first 32 bytes of encR; otherwise, it returns 0. This function is usually slower than VerifyHelperVartime(), but it is constant-time.

func (*Do255ePoint) VerifyHelperVartime 

func (P *Do255ePoint) VerifyHelperVartime(k0, k1 *Do255eScalar, encR []byte) bool

Check whether k0*G + k1*P (with G being the conventional generator) yields a point which would encode to the specified sequence of bytes encR. This function is meant to support signature verification. IT IS NOT CONSTANT-TIME; thus, it should be used only on public elements (which is normally the case when verifying signatures). Returned value is true on match, false otherwise.

type Do255ePrivateKey 

type Do255ePrivateKey struct {
	// contains filtered or unexported fields
}

A private key structure contains a private key, i.e. a non-zero scalar for do255e. For efficiency reasons, it internally caches a copy of the public key as well.

func Do255eDecodePrivateKey 

func Do255eDecodePrivateKey(src []byte) (*Do255ePrivateKey, error)

Decode a private key from bytes. This function expects exactly 32 bytes. If the provided slice does not have length exactly 32, or if what it contains is not the canonical encoding of a valid non-zero scalar for do255e, then this function returns nil and an error.

func Do255eGenerateKeyPair 

func Do255eGenerateKeyPair(rand io.Reader) (*Do255ePrivateKey, error)

Key pair generation with do255e: from a random source 'rand', a private key (a scalar value) and the corresponding public key (group element) are generated. The random source MUST be cryptographically secure. If 'rand' is nil, then crypto/rand.Reader is used (this is the recommended way).

func (*Do255ePrivateKey) Encode 

func (sk *Do255ePrivateKey) Encode(dst []byte) []byte

Encode a private key into bytes. The private key (exactly 32 bytes) is appended to the provided slice. If 'dst' has enough capacity, then it is returned; otherwise, a new slice is allocated, and receives the concatenation of the current contents of 'dst' and the encoded private key.

func (*Do255ePrivateKey) Public 

func (sk *Do255ePrivateKey) Public() *Do255ePublicKey

Get the public key corresponding to a given private key.

func (*Do255ePrivateKey) Sign 

func (sk *Do255ePrivateKey) Sign(rand io.Reader, data []byte, opts crypto.SignerOpts) (signature []byte, err error)

Schnorr signature with do255e. The data to sign ('data') may be either raw data, or a hash value. The 'opts' parameter specifies the hash function that was used to pre-hash the data (use crypto.Hash(0) for raw data).

If 'rand' is nil, then the signature is deterministic (this is safe). If 'rand' is not nil, then 32 bytes are read from it and used to complement the internal per-signature nonce generation process, making the signature non-deterministic, in case a specific protocol requires this property. Non-deterministic signatures might also improve implementation robustness against some kinds of physical attacks (in particular fault attacks). It is not necessary that the extra randomness returned by 'rand' has high quality; the security of the signature will be maintained in all case, even if that data is fully predictable.

The signature is returned as a newly allocated slice. Its length is exactly 64 bytes. An error is reported if 'rand' is not nil but a read attempt returns an error. An error is also reported if the hash function identified by 'opts' is not known.

type Do255ePublicKey 

type Do255ePublicKey struct {
	// contains filtered or unexported fields
}

A public key structure contains a non-neutral group element.

func Do255eDecodePublicKey 

func Do255eDecodePublicKey(src []byte) (*Do255ePublicKey, error)

Decode a public key from bytes. This function expects exactly 32 bytes. If the provided slice does not have length exactly 32, or if what it contains is not the canonical encoding of a valid non-neutral do255e element, then this function returns nil and an error.

func (*Do255ePublicKey) Encode 

func (pk *Do255ePublicKey) Encode(dst []byte) []byte

Encode a public key into bytes. The public key (exactly 32 bytes) is appended to the provided slice. If 'dst' has enough capacity, then it is returned; otherwise, a new slice is allocated, and receives the concatenation of the current contents of 'dst' and the encoded public key.

func (Do255ePublicKey) Equal 

func (pk Do255ePublicKey) Equal(other crypto.PublicKey) bool

Test whether a public key is equal to another.

func (*Do255ePublicKey) VerifyVartime 

func (pk *Do255ePublicKey) VerifyVartime(data []byte, opts crypto.SignerOpts, sig []byte) bool

Verify a signature on a message, relatively to a public key.

The message data is provided in 'data'. This is interpreted as raw data if opts is crypto.Hash(0)); otherwise, it will be considered to be pre-hashed data, processed with the hash function identified by opts.

Returned value is true if the hash function is recognized, and the signature is valid relatively to the provided public key. In all other cases, false is returned.

This function is not constant-time, under the assumption that public keys and signatures are public data.

type Do255eScalar 

type Do255eScalar [4]uint64

Do255eScalar is the type for an integer modulo the prime order of the do255e group. Default value is zero.

func (*Do255eScalar) Add 

func (s *Do255eScalar) Add(a, b *Do255eScalar) *Do255eScalar

Scalar addition: s is set to a + b (mod r). A pointer to s is returned.

func (*Do255eScalar) Bytes 

func (s *Do255eScalar) Bytes() [32]byte

Encode a scalar into exactly 32 bytes.

func (*Do255eScalar) Decode 

func (s *Do255eScalar) Decode(src []byte) int

Decode a scalar from exactly 32 bytes. Returned value is: 

 1   scalar properly decoded, value is not zero
 0   scalar properly decoded, value is zero
-1   source bytes were not a valid scalar encoding

If the decoding fails, then the scalar value is forced to zero.

func (*Do255eScalar) DecodeReduce 

func (s *Do255eScalar) DecodeReduce(src []byte)

Decode a scalar from some bytes. All provided bytes are read and interpreted as an integer in unsigned little endian convention, which is reduced modulo the curve subgroup order. This process cannot fail.

func (*Do255eScalar) Encode 

func (s *Do255eScalar) Encode(dst []byte) []byte

Encode a scalar into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity.

func (*Do255eScalar) Equal 

func (s *Do255eScalar) Equal(a *Do255eScalar) int

Compare two scalars together. Returned value is 1 if the scalars are equal to each other, 0 otherwise.

func (*Do255eScalar) IsZero 

func (s *Do255eScalar) IsZero() int

Compare a scalar with zero. Returned value is 1 if the scalar is zero, 0 otherwise.

func (*Do255eScalar) Mul 

func (s *Do255eScalar) Mul(a, b *Do255eScalar) *Do255eScalar

Scalar multiplication: s is set to a*b (mod r). A pointer to s is returned.

func (*Do255eScalar) Neg 

func (s *Do255eScalar) Neg(a *Do255eScalar) *Do255eScalar

Scalar negation: s is set to -a (mod r). A pointer to s is returned.

func (*Do255eScalar) SplitMu 

func (k *Do255eScalar) SplitMu(k0, k1 *[2]uint64)

Split scalar k (256 bits) into k0 and k1 (128 bits each, signed), such that k = k0 + k1*mu mod r, where mu is a square root of -1 modulo r.

func (*Do255eScalar) Sub 

func (s *Do255eScalar) Sub(a, b *Do255eScalar) *Do255eScalar

Scalar subtraction: s is set to a - b (mod r). A pointer to s is returned.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.