ed448

package module
v0.0.0-...-a338597 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 17, 2022 License: GPL-3.0 Imports: 13 Imported by: 10

README

ed448-goldilocks

Build Status Go Report Card

This is an implementation of the Edwards elliptic curve with a field size of 448, as described by Mike Hamburg in his paper "Ed448-Goldilocks, a new elliptic curve".

API Documentation

GoDoc

Funding

The work made hare was partially supported by the NlNet Foundation. Find information here.

Disclaimer

This code is provided as is and does not have any warranty. Use it at your own risk.

This code is still under constant development so you might want to wait for a future release in order to use it.

This code is a proof of concept of various experiments. Do not use in production. I mainly use it to play with some ideas. Do not use in production.

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	// Cofactor is the ratio between the order of the group (p) and the one
	// from the subgroup (q).
	Cofactor = byte(4)

	//ScalarQ is the prime order of the curve (q).
	ScalarQ = &scalar{
		0xab5844f3, 0x2378c292, 0x8dc58f55, 0x216cc272,
		0xaed63690, 0xc44edb49, 0x7cca23e9, 0xffffffff,
		0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff,
		0xffffffff, 0x3fffffff,
	}

	//BasePoint is the base point of the curve.
	BasePoint = &twExtendedPoint{
		&bigNumber{
			0x0ffffffe, 0x0fffffff, 0x0fffffff, 0x0fffffff,
			0x0fffffff, 0x0fffffff, 0x0fffffff, 0x0fffffff,
			0x00000003, 0x00000000, 0x00000000, 0x00000000,
			0x00000000, 0x00000000, 0x00000000, 0x00000000,
		},
		&bigNumber{
			0x0f752992, 0x081e6d37, 0x01c28721, 0x03078ead,
			0x0394666c, 0x0135cfd2, 0x00506061, 0x041149c5,
			0x0f5490b3, 0x031d30e4, 0x090dc141, 0x09020149,
			0x04c1e328, 0x052341b0, 0x03c10a1b, 0x01423785,
		},
		&bigNumber{
			0x0ffffffb, 0x0fffffff, 0x0fffffff, 0x0fffffff,
			0x0fffffff, 0x0fffffff, 0x0fffffff, 0x0fffffff,
			0x0ffffffe, 0x0fffffff, 0x0fffffff, 0x0fffffff,
			0x0fffffff, 0x0fffffff, 0x0fffffff, 0x0fffffff,
		},
		&bigNumber{
			0x00660415, 0x08f205b7, 0x0fd3824f, 0x0881c60c,
			0x0d08500d, 0x0377a638, 0x04672615, 0x08c66d5d,
			0x08e08e13, 0x0e52fa55, 0x01b6983d, 0x087770ae,
			0x0a0aa7ff, 0x04388f55, 0x05cf1a91, 0x0b4d9a78,
		},
	}
)
View Source
var Basepoint []byte

Basepoint is the generator for curve448 in montgomery form

Functions

func AddOnlyX

func AddOnlyX(x1, x2 *big.Int) (*big.Int, *big.Int)

Add adds two points in montgomery with only the x Just for demostration purposes

func DSASign

func DSASign(sym [57]byte, pub Point, msg []byte) [114]byte

DSASign implements EdDSA style signing for Ed448 - equivalent of goldilocks_ed448_sign

func DSAVerify

func DSAVerify(sig [114]byte, pub Point, msg []byte) bool

DSAVerify implements EdDSA style verifying for Ed448 equivalent of goldilocks_ed48_verify

func LadderScalarBaseMult

func LadderScalarBaseMult(curve GoldilocksCurve, k []byte) (*big.Int, *big.Int)

LadderScalarBaseMult returns k*G, where G is the base point of the group and k is an integer in big-endian form.

func LadderScalarMult

func LadderScalarMult(curve GoldilocksCurve, x1, y1 *big.Int, k []byte) (*big.Int, *big.Int)

LadderScalarMult returns k*(Bx,By) where k is a number in little-endian form. This uses the montgomery ladder

func ToMontgomeryCurve

func ToMontgomeryCurve(x, y *big.Int) (*big.Int, *big.Int)

ToMontgomeryCurve converts from Weierstrass to Montgomery

func ToWeierstrassCurve

func ToWeierstrassCurve(p, u, v *big.Int) (*big.Int, *big.Int, *big.Int)

ToWeierstrassCurve converts from Montgomery form to Weierstrass

Types

type Curve

type Curve interface {
	GenerateKeys() (priv [privKeyBytes]byte, pub [pubKeyBytes]byte, ok bool)
	Sign(priv [privKeyBytes]byte, message []byte) (signature [signatureBytes]byte, ok bool)
	Verify(signature [signatureBytes]byte, message []byte, pub [pubKeyBytes]byte) (valid bool)
	ComputeSecret(private [privKeyBytes]byte, public [pubKeyBytes]byte) (secret [sha512.Size]byte)
}

Curve is the interface that wraps the basic curve methods. TODO It would be better with the use of privateKey and publicKey types.

func NewCurve

func NewCurve() Curve

NewCurve returns a Curve.

type Curve25519

type Curve25519 interface {
	elliptic.Curve
}

A Curve25519 represents the curve25519.

func CurveP25519

func CurveP25519() Curve25519

CurveP25519 returns a Curve which implements curve448

type Curve25519Params

type Curve25519Params struct {
	// contains filtered or unexported fields
}

Curve25519Params contains the parameters of an elliptic curve and also provides a generic, non-constant time implementation of Curve. These are the Montgomery params.

func (*Curve25519Params) Add

func (curve *Curve25519Params) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int)

Add adds two points in montgomery x3 = ((y2-y1)^2/(x2-x1)^2)-A-x1-x2 y3 = (2*x1+x2+a)*(y2-y1)/(x2-x1)-b*(y2-y1)3/(x2-x1)3-y1 See: https://www.hyperelliptic.org/EFD/g1p/auto-montgom.html

func (*Curve25519Params) Double

func (curve *Curve25519Params) Double(x1, y1 *big.Int) (*big.Int, *big.Int)

Double doubles two points in montgomery x3 = b*(3*x12+2*a*x1+1)2/(2*b*y1)2-a-x1-x1 y3 = (2*x1+x1+a)*(3*x12+2*a*x1+1)/(2*b*y1)-b*(3*x12+2*a*x1+1)3/(2*b*y1)3-y1 See: https://www.hyperelliptic.org/EFD/g1p/auto-montgom.html

func (*Curve25519Params) IsOnCurve

func (curve *Curve25519Params) IsOnCurve(x, y *big.Int) bool

IsOnCurve verifies if a given point in montgomery is valid v^2 = u^3 + A*u^2 + u

func (*Curve25519Params) Params

func (curve *Curve25519Params) Params() *elliptic.CurveParams

Params returns the parameters for the curve.

func (*Curve25519Params) ScalarBaseMult

func (curve *Curve25519Params) ScalarBaseMult(k []byte) (*big.Int, *big.Int)

ScalarBaseMult returns k*(Bx,By) where k is a number in little-endian form.

func (*Curve25519Params) ScalarMult

func (curve *Curve25519Params) ScalarMult(x1, y1 *big.Int, k []byte) (*big.Int, *big.Int)

ScalarMult returns k*(Bx,By) where k is a number in little-endian form.

type CurveParams

type CurveParams struct {
	// contains filtered or unexported fields
}

CurveParams contains the parameters of an elliptic curve and also provides a generic, non-constant time implementation of Curve. These are the Montgomery params.

func (*CurveParams) Add

func (curve *CurveParams) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int)

Add adds two points in montgomery x3 = ((y2-y1)^2/(x2-x1)^2)-A-x1-x2 y3 = (2*x1+x2+a)*(y2-y1)/(x2-x1)-b*(y2-y1)3/(x2-x1)3-y1 See: https://www.hyperelliptic.org/EFD/g1p/auto-montgom.html

func (*CurveParams) Double

func (curve *CurveParams) Double(x1, y1 *big.Int) (*big.Int, *big.Int)

Double doubles two points in montgomery x3 = b*(3*x12+2*a*x1+1)2/(2*b*y1)2-a-x1-x1 y3 = (2*x1+x1+a)*(3*x12+2*a*x1+1)/(2*b*y1)-b*(3*x12+2*a*x1+1)3/(2*b*y1)3-y1 See: https://www.hyperelliptic.org/EFD/g1p/auto-montgom.html

func (*CurveParams) IsOnCurve

func (curve *CurveParams) IsOnCurve(x, y *big.Int) bool

IsOnCurve verifies if a given point in montgomery is valid v^2 = u^3 + A*u^2 + u

func (*CurveParams) MapToCurve

func (curve *CurveParams) MapToCurve(u *big.Int) (*big.Int, *big.Int)

MapToCurve calculates a point on the elliptic curve from an element of the finite field F. This implements Elligator2, according to https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-05, section 6.7.1.1.

func (*CurveParams) Params

func (curve *CurveParams) Params() *elliptic.CurveParams

Params returns the parameters for the curve.

func (*CurveParams) ScalarBaseMult

func (curve *CurveParams) ScalarBaseMult(k []byte) (*big.Int, *big.Int)

ScalarBaseMult returns k*G, where G is the base point of the group and k is an integer in big-endian form.

func (*CurveParams) ScalarMult

func (curve *CurveParams) ScalarMult(x1, y1 *big.Int, k []byte) (*big.Int, *big.Int)

ScalarMult returns k*(Bx,By) where k is a number in little-endian form. This uses the double and add method

type DecafCurve

type DecafCurve interface {
	GenerateKeys() (priv [privKeyBytes]byte, pub [pubKeyBytes]byte, ok bool)
	Sign(priv [privKeyBytes]byte, message []byte) (signature [signatureBytes]byte, ok bool)
	Verify(signature [signatureBytes]byte, message []byte, pub [pubKeyBytes]byte) (valid bool, err error)
}

DecafCurve is the interface that wraps the basic curve methods in decaf. TODO: change this name

func NewDecafCurve

func NewDecafCurve() DecafCurve

NewDecafCurve returns a Curve.

type EdwardsCurveParams

type EdwardsCurveParams struct {
	P       *big.Int // the order of the underlying finite field
	N       *big.Int // the prime order of the base point
	D       *big.Int // the non-zero element
	Gx, Gy  *big.Int // (x,y) of the base point
	BitSize int      // the size of the underlying field
	Name    string   // the canonical name of the curve
}

EdwardsCurveParams contains the parameters of an elliptic curve and also provides a generic, non-constant time implementation of Curve. These are the Edwards params.

func (*EdwardsCurveParams) Add

func (curve *EdwardsCurveParams) Add(p, q Point) Point

Add gives the sum of two points (p, q) and produces a third point (p).

func (*EdwardsCurveParams) Double

func (curve *EdwardsCurveParams) Double(p Point) Point

Double gives the doubling of a point (p).

func (*EdwardsCurveParams) IsOnCurve

func (curve *EdwardsCurveParams) IsOnCurve(p Point) bool

IsOnCurve reports whether the given point (p) lies on the curve.

func (*EdwardsCurveParams) Params

func (curve *EdwardsCurveParams) Params() *EdwardsCurveParams

Params returns the parameters for the curve.

type GoldilocksCurve

type GoldilocksCurve interface {
	elliptic.Curve
}

A GoldilocksCurve represents the curve448.

func Curve448

func Curve448() GoldilocksCurve

Curve448 returns a Curve which implements curve448

type GoldilocksEdCurve

type GoldilocksEdCurve interface {
	// Params returns the parameters for the curve.
	Params() *EdwardsCurveParams
	// IsOnCurveEdwards reports whether the given p lies on the curve.
	IsOnCurve(p Point) bool
	// AddEdwards returns the sum of p and q
	Add(p, q Point) Point
	// DoubleEdwards returns 2*p
	Double(p Point) Point
	// ScalarMultEdwards returns k*(p) where k is an scalar.
	ScalarMult(p Point, k Scalar) Point
	// ScalarBaseMultEdwards returns k*G, where G is the base point of the group
	// and k is an scalar
	ScalarBaseMult(k Scalar) Point
}

A GoldilocksEdCurve represents Goldilocks edwards448. This uses the decaf technique

type Point

type Point interface {
	IsOnCurve() bool
	Equals(q Point) bool
	EqualsMask(q Point) uint32
	Copy() Point
	Add(q, r Point)
	Sub(q, r Point)
	Double() Point
	Encode() []byte
	Decode(src []byte, identity bool) (bool, error)
	EdDSAEncode() []byte
	EdDSADecode(src []byte) bool
}

Point is a interface of a Ed448 point

func ConstantTimeSelectPoint

func ConstantTimeSelectPoint(bfalse, btrue Point, mask uint32) Point

ConstantTimeSelectPoint will use constant time select to choose either the left or right point, depending on if the mask is either all zeroes, or all ones

func NewPoint

func NewPoint(a [nLimbs]uint32, b [nLimbs]uint32, c [nLimbs]uint32, d [nLimbs]uint32) Point

NewPoint returns an Ed448 point from 4 arrays of 16 uint32.

func NewPointFromBytes

func NewPointFromBytes(in ...[]byte) Point

NewPointFromBytes returns an Ed448 point from a byte slice.

func PointDoubleScalarMul

func PointDoubleScalarMul(q, r Point, a, b Scalar) Point

PointDoubleScalarMul returns the addition of two multiplications: a given point (q) by a given scalar (a) and a given point (r) by a given scalar (b): q * a + r * b.

func PointDoubleScalarMulNonsecret

func PointDoubleScalarMulNonsecret(q Point, a, b Scalar) Point

PointDoubleScalarMulNonsecret returns the addition of two multiplications: a given point (q) by a given scalar (b) and the base point of the curve by a given scalar (a): q * b + basePoint * a. @warning: This function takes variable time, and may leak the scalars used. It is designed for signature verification.

func PointScalarMul

func PointScalarMul(q Point, a Scalar) Point

PointScalarMul returns the multiplication of a given point (p) by a given scalar (a): q * a.

func PrecomputedScalarMul

func PrecomputedScalarMul(a Scalar) Point

PrecomputedScalarMul returns the multiplication of a given scalar (a) by the precomputed base point of the curve: basePoint * a.

func ScalarBaseMult

func ScalarBaseMult(k Scalar) Point

ScalarBaseMult returns the multiplication of a given scalar (k) by the precomputed base point of the curve: basePoint * k.

func ScalarMult

func ScalarMult(p Point, k Scalar) Point

ScalarMult returns the multiplication of a given point (p) by a given scalar (a): p * k.

type Scalar

type Scalar interface {
	Equals(a Scalar) bool
	EqualsMask(a Scalar) uint32
	Copy() Scalar
	Add(a, b Scalar)
	Sub(a, b Scalar)
	Mul(a, b Scalar)
	Halve(a Scalar)
	Invert() bool
	Encode() []byte
	BarretDecode(src []byte) error
	Decode(src []byte)
}

Scalar is a interface of a Ed448 scalar

func ConstantTimeSelectScalar

func ConstantTimeSelectScalar(bfalse, btrue Scalar, mask uint32) Scalar

ConstantTimeSelectScalar will use constant time select to choose either the left or right scalar, depending on if the mask is either all zeroes, or all ones

func NewScalar

func NewScalar(in ...[]byte) Scalar

NewScalar returns a Scalar in Ed448 with decaf

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL