do255s

package
v0.0.0-...-33e5fd3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 12, 2020 License: MIT Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Do255sCheckPoint 

func Do255sCheckPoint(src []byte) int

Test whether a given chunk of 32 bytes is a valid representation of do255s group element. This is faster than actually decoding it. Returned value is: 

 1   valid encoding of a non-neutral group element
 0   valid encoding of the neutral point N
-1   invalid encoding

func Do255sKeyExchange 

func Do255sKeyExchange(sk *Do255sPrivateKey, peer_pk []byte, secretLen int) (secret []byte, ok int)

Key exchange with do255s: given our private key, and the public key from the peer, a shared secret of length 'len' bytes is produced. The peer's public key is provided encoded; it should have length exactly 32 bytes. If the provided sequence of bytes has not length exactly 32 bytes, or if it is not otherwise a valid do255s point encoding, then the key exchange fails. On failure, a byte sequence of the requested length is still generated; that byte sequence is not predictable by outsiders, and cannot be distinguished from the output of a successful ECDH exchange by outsiders. This is meant to support rare protocols where exchanged keys are not public, and the exchange should not have any validation semantics. The 'ok' returned value has value 1 on success, 0 on error (an 'int' is used to promote constant-time processing).

Types

type Do255sPoint 

type Do255sPoint struct {
	// contains filtered or unexported fields
}

Do255sPoint is the type for a do255s point.

Default value for a point structure is not valid. The NewDo255sPoint() function makes sure to return only initialized structures. If allocating a point structure manually, make sure to properly set it to a valid point before using it as source.

func Do255sHashToCurve 

func Do255sHashToCurve(data []byte, opts crypto.SignerOpts) (*Do255sPoint, error)

Hash some input data into a curve point. The input data ('data') is either raw or pre-hashed, as identified by the opts parameter. If the hash function identifier is not recognized, then an error is returned. Otherwise, the output point is returned.

func NewDo255sPoint 

func NewDo255sPoint() *Do255sPoint

Create a new point. The point is set to the group neutral element (N).

func (*Do255sPoint) Add 

func (P *Do255sPoint) Add(P1, P2 *Do255sPoint) *Do255sPoint

Set this point to the sum of the two provided points. A pointer to this structure (P) is returned.

func (*Do255sPoint) Bytes 

func (P *Do255sPoint) Bytes() [32]byte

Encode a point into exactly 32 bytes.

func (*Do255sPoint) Decode 

func (P *Do255sPoint) Decode(src []byte) int

Decode a point from exactly 32 bytes. Returned value is 1 if the point could be successfully decoded into a non-neutral group element, 0 if it could be successfully decoded as the neutral point N, or -1 if it could not be decoded. If the decoding was not successful, then the destination structure is set to the neutral N.

This function is constant-time with regard to the decoded value and also with regard to the validity status (timing-based side channels do not leak whether the value was found to be a valid point).

Returned value is: 

 1   valid encoding of a non-neutral group element
 0   valid encoding of the neutral point N
-1   invalid encoding

func (*Do255sPoint) Double 

func (P *Do255sPoint) Double(Q *Do255sPoint) *Do255sPoint

Set this point (P) to the double of the provided point Q. A pointer to this structure (P) is returned.

func (*Do255sPoint) DoubleX 

func (P *Do255sPoint) DoubleX(Q *Do255sPoint, n uint) *Do255sPoint

Set this point (P) to (2^n)*Q (i.e. perform n successive doublings). This function is constant-time with regard to the point values, but not to the number of doublings (n); computation time is proportional to n. A pointer to this structure (P) is returned.

func (*Do255sPoint) Encode 

func (P *Do255sPoint) Encode(dst []byte) []byte

Encode a point into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity.

func (*Do255sPoint) EncodeSquaredW 

func (P *Do255sPoint) EncodeSquaredW(dst []byte) []byte

Encode the square of the w coordinate of a point into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity. This function is meant to support ECDH.

func (*Do255sPoint) Equal 

func (P *Do255sPoint) Equal(Q *Do255sPoint) int

Test whether this structure (P) represents the same point as the provided other structure (Q). Returned value is true if both points are the same, false otherwise.

func (*Do255sPoint) Generator 

func (P *Do255sPoint) Generator() *Do255sPoint

Set the point P to the conventional generator (G). A pointer to this structure is returned.

func (*Do255sPoint) IsNeutral 

func (P *Do255sPoint) IsNeutral() int

Test whether a point is the neutral element N. Returned value is 1 for the neutral, 0 otherwise.

func (*Do255sPoint) MapBytes 

func (P *Do255sPoint) MapBytes(bb []byte) *Do255sPoint

Map a sequence of bytes into a curve element. The mapping is not injective or surjective, and not uniform among possible outputs; however, any given point has only a limited number of possible pre-images by the map. A hash-to-curve process can be built on top of this map, as follows:

  • Hash some input data in 64 bytes, with a secure hash function or XOF (e.g. SHAKE).
  • Split these 64 bytes into two halves, and map each of them to a point with this map.
  • Add the two points together.

func (*Do255sPoint) Mul 

func (P *Do255sPoint) Mul(Q *Do255sPoint, n *Do255sScalar) *Do255sPoint

Multiply a point Q by a given scalar n. A pointer to this structure (P) is returned.

func (*Do255sPoint) MulGen 

func (P *Do255sPoint) MulGen(n *Do255sScalar) *Do255sPoint

Multiply the conventional generator by a given scalar n. This is functionally equivalent (but faster) to P.Generator().Mul(&P, n). A pointer to this structure (P) is returned.

func (*Do255sPoint) Neg 

func (P *Do255sPoint) Neg(Q *Do255sPoint) *Do255sPoint

Set P to the opposite of point Q. A pointer to this structure (P) is returned.

func (*Do255sPoint) Neutral 

func (P *Do255sPoint) Neutral() *Do255sPoint

Set the point P to the neutral element (N). A pointer to this structure is returned.

func (*Do255sPoint) Select 

func (P *Do255sPoint) Select(P1, P2 *Do255sPoint, ctl int)

If ctl == 1, then copy point Q1 into P. If ctl == 0, then copy point Q2 into P. ctl MUST be 0 or 1. This is a constant-time selection primitive.

func (*Do255sPoint) Set 

func (P *Do255sPoint) Set(Q *Do255sPoint) *Do255sPoint

Copy a point structure into another. A pointer to this structure is returned.

func (*Do255sPoint) Sub 

func (P *Do255sPoint) Sub(P1, P2 *Do255sPoint) *Do255sPoint

Set this point to the difference of the two provided points (P1 - P2). A pointer to this structure (P) is returned.

func (*Do255sPoint) VerifyHelper 

func (P *Do255sPoint) VerifyHelper(k0, k1 *Do255sScalar, encR []byte) int

Alternate helper function for signature verification; this returns 1 if k0*G + k1*P yields a point whose encoding is exactly equal to the first 32 bytes of encR; otherwise, it returns 0. This function is usually slower than VerifyHelperVartime(), but it is constant-time.

func (*Do255sPoint) VerifyHelperVartime 

func (P *Do255sPoint) VerifyHelperVartime(k0, k1 *Do255sScalar, encR []byte) bool

Check whether k0*G + k1*P (with G being the conventional generator) yields a point which would encode to the specified sequence of bytes encR. This function is meant to support signature verification. IT IS NOT CONSTANT-TIME; thus, it should be used only on public elements (which is normally the case when verifying signatures). Returned value is true on match, false otherwise.

type Do255sPrivateKey 

type Do255sPrivateKey struct {
	// contains filtered or unexported fields
}

A private key structure contains a private key, i.e. a non-zero scalar for do255s. For efficiency reasons, it internally caches a copy of the public key as well.

func Do255sDecodePrivateKey 

func Do255sDecodePrivateKey(src []byte) (*Do255sPrivateKey, error)

Decode a private key from bytes. This function expects exactly 32 bytes. If the provided slice does not have length exactly 32, or if what it contains is not the canonical encoding of a valid non-zero scalar for do255s, then this function returns nil and an error.

func Do255sGenerateKeyPair 

func Do255sGenerateKeyPair(rand io.Reader) (*Do255sPrivateKey, error)

Key pair generation with do255s: from a random source 'rand', a private key (a scalar value) and the corresponding public key (group element) are generated. The random source MUST be cryptographically secure. If 'rand' is nil, then crypto/rand.Reader is used (this is the recommended way).

func (*Do255sPrivateKey) Encode 

func (sk *Do255sPrivateKey) Encode(dst []byte) []byte

Encode a private key into bytes. The private key (exactly 32 bytes) is appended to the provided slice. If 'dst' has enough capacity, then it is returned; otherwise, a new slice is allocated, and receives the concatenation of the current contents of 'dst' and the encoded private key.

func (*Do255sPrivateKey) Public 

func (sk *Do255sPrivateKey) Public() *Do255sPublicKey

Get the public key corresponding to a given private key.

func (*Do255sPrivateKey) Sign 

func (sk *Do255sPrivateKey) Sign(rand io.Reader, data []byte, opts crypto.SignerOpts) (signature []byte, err error)

Schnorr signature with do255s. The data to sign ('data') may be either raw data, or a hash value. The 'opts' parameter specifies the hash function that was used to pre-hash the data (use crypto.Hash(0) for raw data).

If 'rand' is nil, then the signature is deterministic (this is safe). If 'rand' is not nil, then 32 bytes are read from it and used to complement the internal per-signature nonce generation process, making the signature non-deterministic, in case a specific protocol requires this property. Non-deterministic signatures might also improve implementation robustness against some kinds of physical attacks (in particular fault attacks). It is not necessary that the extra randomness returned by 'rand' has high quality; the security of the signature will be maintained in all case, even if that data is fully predictable.

The signature is returned as a newly allocated slice. Its length is exactly 64 bytes. An error is reported if 'rand' is not nil but a read attempt returns an error. An error is also reported if the hash function identified by 'opts' is not known.

type Do255sPublicKey 

type Do255sPublicKey struct {
	// contains filtered or unexported fields
}

A public key structure contains a non-neutral group element.

func Do255sDecodePublicKey 

func Do255sDecodePublicKey(src []byte) (*Do255sPublicKey, error)

Decode a public key from bytes. This function expects exactly 32 bytes. If the provided slice does not have length exactly 32, or if what it contains is not the canonical encoding of a valid non-neutral do255s element, then this function returns nil and an error.

func (*Do255sPublicKey) Encode 

func (pk *Do255sPublicKey) Encode(dst []byte) []byte

Encode a public key into bytes. The public key (exactly 32 bytes) is appended to the provided slice. If 'dst' has enough capacity, then it is returned; otherwise, a new slice is allocated, and receives the concatenation of the current contents of 'dst' and the encoded public key.

func (Do255sPublicKey) Equal 

func (pk Do255sPublicKey) Equal(other crypto.PublicKey) bool

Test whether a public key is equal to another.

func (*Do255sPublicKey) VerifyVartime 

func (pk *Do255sPublicKey) VerifyVartime(data []byte, opts crypto.SignerOpts, sig []byte) bool

Verify a signature on a message, relatively to a public key.

The message data is provided in 'data'. This is interpreted as raw data if opts is crypto.Hash(0)); otherwise, it will be considered to be pre-hashed data, processed with the hash function identified by opts.

Returned value is true if the hash function is recognized, and the signature is valid relatively to the provided public key. In all other cases, false is returned.

This function is not constant-time, under the assumption that public keys and signatures are public data.

type Do255sScalar 

type Do255sScalar [4]uint64

Do255sScalar is the type for an integer modulo the prime order of the do255s group. Default value is zero.

func (*Do255sScalar) Add 

func (s *Do255sScalar) Add(a, b *Do255sScalar) *Do255sScalar

Scalar addition: s is set to a + b (mod r). A pointer to s is returned.

func (*Do255sScalar) Bytes 

func (s *Do255sScalar) Bytes() [32]byte

Encode a scalar into exactly 32 bytes; the newly allocated slice is returned.

func (*Do255sScalar) Decode 

func (s *Do255sScalar) Decode(src []byte) int

Decode a scalar from exactly 32 bytes. Returned value is: 

 1   scalar properly decoded, value is not zero
 0   scalar properly decoded, value is zero
-1   source bytes were not a valid scalar encoding

If the decoding fails, then the scalar value is forced to zero.

func (*Do255sScalar) DecodeReduce 

func (s *Do255sScalar) DecodeReduce(src []byte)

Decode a scalar from some bytes. All provided bytes are read and interpreted as an integer in unsigned little endian convention, which is reduced modulo the curve subgroup order. This process cannot fail.

func (*Do255sScalar) Encode 

func (s *Do255sScalar) Encode(dst []byte) []byte

Encode a scalar into exactly 32 bytes. The bytes are appended to the provided slice; the new slice is returned. The extension is done in place if the provided slice has enough capacity.

func (*Do255sScalar) Equal 

func (s *Do255sScalar) Equal(a *Do255sScalar) int

Compare two scalars together. Returned value is 1 if the scalars are equal to each other, 0 otherwise.

func (*Do255sScalar) IsZero 

func (s *Do255sScalar) IsZero() int

Compare a scalar with zero. Returned value is 1 if the scalar is zero, 0 otherwise.

func (*Do255sScalar) Mul 

func (s *Do255sScalar) Mul(a, b *Do255sScalar) *Do255sScalar

Scalar multiplication: s is set to a*b (mod r). A pointer to s is returned.

func (*Do255sScalar) Neg 

func (s *Do255sScalar) Neg(a *Do255sScalar) *Do255sScalar

Scalar negation: s is set to -a (mod r). A pointer to s is returned.

func (*Do255sScalar) ReduceBasisVartime 

func (k *Do255sScalar) ReduceBasisVartime(c0, c1 *[2]uint64) (negc0 bool, negc1 bool)

Split an input scalar k into shorter integers c0 and c1 such that k = c0/c1 mod r, with |c0| < 2^128 and |c1| < 2^128. The absolute values of c0 and c1 are returned in c0 and c1, respectively, while the signs of c0 and c1 are the returned values (true for negative, false for nonnegative). THIS IS NOT CONSTANT-TIME.

func (*Do255sScalar) Sub 

func (s *Do255sScalar) Sub(a, b *Do255sScalar) *Do255sScalar

Scalar subtraction: s is set to a - b (mod r). A pointer to s is returned.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.