mirror of
https://github.com/taigrr/arduinolibs
synced 2025-01-18 04:33:12 -08:00
Update docs
This commit is contained in:
Rhys Weatherley
@@ -252,308 +252,307 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
||||
<div class="line"><a name="l00256"></a><span class="lineno"><a class="line" href="classEd25519.html#ab62bac52ed07f77f76f3ff0fccd71cb2"> 256</a></span> <span class="keywordtype">void</span> <a class="code" href="classEd25519.html#ab62bac52ed07f77f76f3ff0fccd71cb2">Ed25519::derivePublicKey</a>(uint8_t publicKey[32], <span class="keyword">const</span> uint8_t privateKey[32])</div>
|
||||
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span> {</div>
|
||||
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span>  <a class="code" href="classSHA512.html">SHA512</a> hash;</div>
|
||||
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>  uint8_t *buf = (uint8_t *)(hash.state.w);</div>
|
||||
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span>  Point ptA;</div>
|
||||
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span> </div>
|
||||
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>  <span class="comment">// Derive the secret scalar a from the private key.</span></div>
|
||||
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span>  deriveKeys(&hash, a, privateKey);</div>
|
||||
<div class="line"><a name="l00265"></a><span class="lineno"> 265</span> </div>
|
||||
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span>  <span class="comment">// Compute the point A = aB and encode it.</span></div>
|
||||
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span>  mul(ptA, a);</div>
|
||||
<div class="line"><a name="l00268"></a><span class="lineno"> 268</span>  encodePoint(publicKey, ptA);</div>
|
||||
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span> </div>
|
||||
<div class="line"><a name="l00270"></a><span class="lineno"> 270</span>  <span class="comment">// Clean up and exit.</span></div>
|
||||
<div class="line"><a name="l00271"></a><span class="lineno"> 271</span>  clean(a);</div>
|
||||
<div class="line"><a name="l00272"></a><span class="lineno"> 272</span>  clean(ptA);</div>
|
||||
<div class="line"><a name="l00273"></a><span class="lineno"> 273</span> }</div>
|
||||
<div class="line"><a name="l00274"></a><span class="lineno"> 274</span> </div>
|
||||
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span> <span class="keywordtype">void</span> Ed25519::reduceQFromBuffer(limb_t *result, <span class="keyword">const</span> uint8_t buf[64], limb_t *temp)</div>
|
||||
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span> {</div>
|
||||
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(temp, NUM_LIMBS_512BIT, buf, 64);</div>
|
||||
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>  temp[NUM_LIMBS_512BIT] = 0;</div>
|
||||
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span>  reduceQ(result, temp);</div>
|
||||
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span> }</div>
|
||||
<div class="line"><a name="l00290"></a><span class="lineno"> 290</span> </div>
|
||||
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span> <span class="keywordtype">void</span> Ed25519::reduceQ(limb_t *result, limb_t *r)</div>
|
||||
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span> {</div>
|
||||
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>  <span class="comment">// Algorithm from: http://en.wikipedia.org/wiki/Barrett_reduction</span></div>
|
||||
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>  <span class="comment">// We assume that r is less than or equal to (q - 1)^2.</span></div>
|
||||
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>  <span class="comment">// We want to compute result = r mod q. Find the smallest k such</span></div>
|
||||
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>  <span class="comment">// that 2^k > q. In our case, k = 253. Then set m = floor(4^k / q)</span></div>
|
||||
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>  <span class="comment">// and let r = r - q * floor(m * r / 4^k). This will be the result</span></div>
|
||||
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>  <span class="comment">// or it will be at most one subtraction of q away from the result.</span></div>
|
||||
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>  <span class="comment">// Note: 4^k = 4^253 = 2^506 = 2^512/2^6. We can more easily compute</span></div>
|
||||
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>  <span class="comment">// the result we want if we set m = floor(4^k * 2^6 / q) instead and</span></div>
|
||||
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>  <span class="comment">// then r = r - q * floor(m * r / 2^512). Because the slight extra</span></div>
|
||||
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>  <span class="comment">// precision in m, r is at most two subtractions of q away from the</span></div>
|
||||
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>  <span class="comment">// final result.</span></div>
|
||||
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>  <span class="keyword">static</span> limb_t <span class="keyword">const</span> numM[NUM_LIMBS_256BIT + 1] PROGMEM = {</div>
|
||||
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>  LIMB(0x0A2C131B), LIMB(0xED9CE5A3), LIMB(0x086329A7), LIMB(0x2106215D),</div>
|
||||
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>  LIMB(0xFFFFFFEB), LIMB(0xFFFFFFFF), LIMB(0xFFFFFFFF), LIMB(0xFFFFFFFF),</div>
|
||||
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>  0x0F</div>
|
||||
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>  };</div>
|
||||
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span>  limb_t temp[NUM_LIMBS_512BIT + NUM_LIMBS_256BIT + 1];</div>
|
||||
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span> </div>
|
||||
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>  <span class="comment">// Multiply r by m.</span></div>
|
||||
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, r, NUM_LIMBS_512BIT, numM, NUM_LIMBS_256BIT + 1);</div>
|
||||
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span> </div>
|
||||
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>  <span class="comment">// Multiply (m * r) / 2^512 by q and subtract it from r.</span></div>
|
||||
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>  <span class="comment">// We can ignore the high words of the subtraction result</span></div>
|
||||
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>  <span class="comment">// because they will all turn into zero after the subtraction.</span></div>
|
||||
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, temp + NUM_LIMBS_512BIT, NUM_LIMBS_256BIT + 1,</div>
|
||||
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>  numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span>  <a class="code" href="classBigNumberUtil.html#a6618e03bfcb3086961df508b40cc1e67">BigNumberUtil::sub</a>(r, r, temp, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span> </div>
|
||||
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>  <span class="comment">// Perform two subtractions of q from the result to reduce it.</span></div>
|
||||
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, r, numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, result, numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span> </div>
|
||||
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>  <span class="comment">// Clean up and exit.</span></div>
|
||||
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span>  clean(temp);</div>
|
||||
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span> }</div>
|
||||
<div class="line"><a name="l00343"></a><span class="lineno"> 343</span> </div>
|
||||
<div class="line"><a name="l00353"></a><span class="lineno"> 353</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, Point &p, <span class="keywordtype">bool</span> constTime)</div>
|
||||
<div class="line"><a name="l00354"></a><span class="lineno"> 354</span> {</div>
|
||||
<div class="line"><a name="l00355"></a><span class="lineno"> 355</span>  Point q;</div>
|
||||
<div class="line"><a name="l00356"></a><span class="lineno"> 356</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00357"></a><span class="lineno"> 357</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00358"></a><span class="lineno"> 358</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00359"></a><span class="lineno"> 359</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00360"></a><span class="lineno"> 360</span>  limb_t mask, select;</div>
|
||||
<div class="line"><a name="l00361"></a><span class="lineno"> 361</span>  uint8_t sposn, t;</div>
|
||||
<div class="line"><a name="l00362"></a><span class="lineno"> 362</span> </div>
|
||||
<div class="line"><a name="l00363"></a><span class="lineno"> 363</span>  <span class="comment">// Initialize the result to (0, 1, 1, 0).</span></div>
|
||||
<div class="line"><a name="l00364"></a><span class="lineno"> 364</span>  memset(&result, 0, <span class="keyword">sizeof</span>(Point));</div>
|
||||
<div class="line"><a name="l00365"></a><span class="lineno"> 365</span>  result.y[0] = 1;</div>
|
||||
<div class="line"><a name="l00366"></a><span class="lineno"> 366</span>  result.z[0] = 1;</div>
|
||||
<div class="line"><a name="l00367"></a><span class="lineno"> 367</span> </div>
|
||||
<div class="line"><a name="l00368"></a><span class="lineno"> 368</span>  <span class="comment">// Iterate over the 255 bits of "s" to calculate "s * p".</span></div>
|
||||
<div class="line"><a name="l00369"></a><span class="lineno"> 369</span>  mask = 1;</div>
|
||||
<div class="line"><a name="l00370"></a><span class="lineno"> 370</span>  sposn = 0;</div>
|
||||
<div class="line"><a name="l00371"></a><span class="lineno"> 371</span>  <span class="keywordflow">for</span> (t = 255; t > 0; --t) {</div>
|
||||
<div class="line"><a name="l00372"></a><span class="lineno"> 372</span>  <span class="comment">// Add p to the result to produce q. The specification refers</span></div>
|
||||
<div class="line"><a name="l00373"></a><span class="lineno"> 373</span>  <span class="comment">// to temporary variables A to H. We can dispense with E to H</span></div>
|
||||
<div class="line"><a name="l00374"></a><span class="lineno"> 374</span>  <span class="comment">// by using B, D, q.z, and q.t to hold those values temporarily.</span></div>
|
||||
<div class="line"><a name="l00375"></a><span class="lineno"> 375</span>  select = s[sposn] & mask;</div>
|
||||
<div class="line"><a name="l00376"></a><span class="lineno"> 376</span>  <span class="keywordflow">if</span> (constTime || select) {</div>
|
||||
<div class="line"><a name="l00377"></a><span class="lineno"> 377</span>  Curve25519::sub(A, result.y, result.x);</div>
|
||||
<div class="line"><a name="l00378"></a><span class="lineno"> 378</span>  Curve25519::sub(C, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00379"></a><span class="lineno"> 379</span>  Curve25519::mul(A, A, C);</div>
|
||||
<div class="line"><a name="l00380"></a><span class="lineno"> 380</span>  Curve25519::add(B, result.y, result.x);</div>
|
||||
<div class="line"><a name="l00381"></a><span class="lineno"> 381</span>  Curve25519::add(C, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00382"></a><span class="lineno"> 382</span>  Curve25519::mul(B, B, C);</div>
|
||||
<div class="line"><a name="l00383"></a><span class="lineno"> 383</span>  Curve25519::mul(C, result.t, p.t);</div>
|
||||
<div class="line"><a name="l00384"></a><span class="lineno"> 384</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00385"></a><span class="lineno"> 385</span>  Curve25519::mul(D, result.z, p.z);</div>
|
||||
<div class="line"><a name="l00386"></a><span class="lineno"> 386</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span>  Curve25519::sub(q.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span>  Curve25519::sub(q.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00389"></a><span class="lineno"> 389</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00390"></a><span class="lineno"> 390</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00391"></a><span class="lineno"> 391</span>  <span class="keywordflow">if</span> (constTime) {</div>
|
||||
<div class="line"><a name="l00392"></a><span class="lineno"> 392</span>  <span class="comment">// Put the intermediate value into q.</span></div>
|
||||
<div class="line"><a name="l00393"></a><span class="lineno"> 393</span>  Curve25519::mul(q.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
||||
<div class="line"><a name="l00394"></a><span class="lineno"> 394</span>  Curve25519::mul(q.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
||||
<div class="line"><a name="l00395"></a><span class="lineno"> 395</span>  Curve25519::mul(q.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
||||
<div class="line"><a name="l00396"></a><span class="lineno"> 396</span>  Curve25519::mul(q.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
||||
<div class="line"><a name="l00397"></a><span class="lineno"> 397</span> </div>
|
||||
<div class="line"><a name="l00398"></a><span class="lineno"> 398</span>  <span class="comment">// Copy q into the result if the current bit of s is 1.</span></div>
|
||||
<div class="line"><a name="l00399"></a><span class="lineno"> 399</span>  Curve25519::cmove(select, result.x, q.x);</div>
|
||||
<div class="line"><a name="l00400"></a><span class="lineno"> 400</span>  Curve25519::cmove(select, result.y, q.y);</div>
|
||||
<div class="line"><a name="l00401"></a><span class="lineno"> 401</span>  Curve25519::cmove(select, result.z, q.z);</div>
|
||||
<div class="line"><a name="l00402"></a><span class="lineno"> 402</span>  Curve25519::cmove(select, result.t, q.t);</div>
|
||||
<div class="line"><a name="l00403"></a><span class="lineno"> 403</span>  } <span class="keywordflow">else</span> {</div>
|
||||
<div class="line"><a name="l00404"></a><span class="lineno"> 404</span>  <span class="comment">// Put the intermediate value directly into the result.</span></div>
|
||||
<div class="line"><a name="l00405"></a><span class="lineno"> 405</span>  Curve25519::mul(result.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
||||
<div class="line"><a name="l00406"></a><span class="lineno"> 406</span>  Curve25519::mul(result.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
||||
<div class="line"><a name="l00407"></a><span class="lineno"> 407</span>  Curve25519::mul(result.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
||||
<div class="line"><a name="l00408"></a><span class="lineno"> 408</span>  Curve25519::mul(result.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
||||
<div class="line"><a name="l00409"></a><span class="lineno"> 409</span>  }</div>
|
||||
<div class="line"><a name="l00410"></a><span class="lineno"> 410</span>  }</div>
|
||||
<div class="line"><a name="l00411"></a><span class="lineno"> 411</span> </div>
|
||||
<div class="line"><a name="l00412"></a><span class="lineno"> 412</span>  <span class="comment">// Double p for the next iteration.</span></div>
|
||||
<div class="line"><a name="l00413"></a><span class="lineno"> 413</span>  Curve25519::sub(A, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00414"></a><span class="lineno"> 414</span>  Curve25519::square(A, A);</div>
|
||||
<div class="line"><a name="l00415"></a><span class="lineno"> 415</span>  Curve25519::add(B, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00416"></a><span class="lineno"> 416</span>  Curve25519::square(B, B);</div>
|
||||
<div class="line"><a name="l00417"></a><span class="lineno"> 417</span>  Curve25519::square(C, p.t);</div>
|
||||
<div class="line"><a name="l00418"></a><span class="lineno"> 418</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00419"></a><span class="lineno"> 419</span>  Curve25519::square(D, p.z);</div>
|
||||
<div class="line"><a name="l00420"></a><span class="lineno"> 420</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00421"></a><span class="lineno"> 421</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00422"></a><span class="lineno"> 422</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00423"></a><span class="lineno"> 423</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00424"></a><span class="lineno"> 424</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00425"></a><span class="lineno"> 425</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
||||
<div class="line"><a name="l00426"></a><span class="lineno"> 426</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
||||
<div class="line"><a name="l00427"></a><span class="lineno"> 427</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
||||
<div class="line"><a name="l00428"></a><span class="lineno"> 428</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
||||
<div class="line"><a name="l00429"></a><span class="lineno"> 429</span> </div>
|
||||
<div class="line"><a name="l00430"></a><span class="lineno"> 430</span>  <span class="comment">// Move onto the next bit of s from lowest to highest.</span></div>
|
||||
<div class="line"><a name="l00431"></a><span class="lineno"> 431</span>  <span class="keywordflow">if</span> (mask != (((limb_t)1) << (LIMB_BITS - 1))) {</div>
|
||||
<div class="line"><a name="l00432"></a><span class="lineno"> 432</span>  mask <<= 1;</div>
|
||||
<div class="line"><a name="l00433"></a><span class="lineno"> 433</span>  } <span class="keywordflow">else</span> {</div>
|
||||
<div class="line"><a name="l00434"></a><span class="lineno"> 434</span>  ++sposn;</div>
|
||||
<div class="line"><a name="l00435"></a><span class="lineno"> 435</span>  mask = 1;</div>
|
||||
<div class="line"><a name="l00436"></a><span class="lineno"> 436</span>  }</div>
|
||||
<div class="line"><a name="l00437"></a><span class="lineno"> 437</span>  }</div>
|
||||
<div class="line"><a name="l00438"></a><span class="lineno"> 438</span> </div>
|
||||
<div class="line"><a name="l00439"></a><span class="lineno"> 439</span>  <span class="comment">// Clean up.</span></div>
|
||||
<div class="line"><a name="l00440"></a><span class="lineno"> 440</span>  clean(q);</div>
|
||||
<div class="line"><a name="l00441"></a><span class="lineno"> 441</span>  clean(A);</div>
|
||||
<div class="line"><a name="l00442"></a><span class="lineno"> 442</span>  clean(B);</div>
|
||||
<div class="line"><a name="l00443"></a><span class="lineno"> 443</span>  clean(C);</div>
|
||||
<div class="line"><a name="l00444"></a><span class="lineno"> 444</span>  clean(D);</div>
|
||||
<div class="line"><a name="l00445"></a><span class="lineno"> 445</span> }</div>
|
||||
<div class="line"><a name="l00446"></a><span class="lineno"> 446</span> </div>
|
||||
<div class="line"><a name="l00455"></a><span class="lineno"> 455</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, <span class="keywordtype">bool</span> constTime)</div>
|
||||
<div class="line"><a name="l00456"></a><span class="lineno"> 456</span> {</div>
|
||||
<div class="line"><a name="l00457"></a><span class="lineno"> 457</span>  Point P;</div>
|
||||
<div class="line"><a name="l00458"></a><span class="lineno"> 458</span>  memcpy_P(P.x, numBx, <span class="keyword">sizeof</span>(P.x));</div>
|
||||
<div class="line"><a name="l00459"></a><span class="lineno"> 459</span>  memcpy_P(P.y, numBy, <span class="keyword">sizeof</span>(P.y));</div>
|
||||
<div class="line"><a name="l00460"></a><span class="lineno"> 460</span>  memcpy_P(P.z, numBz, <span class="keyword">sizeof</span>(P.z));</div>
|
||||
<div class="line"><a name="l00461"></a><span class="lineno"> 461</span>  memcpy_P(P.t, numBt, <span class="keyword">sizeof</span>(P.t));</div>
|
||||
<div class="line"><a name="l00462"></a><span class="lineno"> 462</span>  mul(result, s, P, constTime);</div>
|
||||
<div class="line"><a name="l00463"></a><span class="lineno"> 463</span>  clean(P);</div>
|
||||
<div class="line"><a name="l00464"></a><span class="lineno"> 464</span> }</div>
|
||||
<div class="line"><a name="l00465"></a><span class="lineno"> 465</span> </div>
|
||||
<div class="line"><a name="l00472"></a><span class="lineno"> 472</span> <span class="keywordtype">void</span> Ed25519::add(Point &p, <span class="keyword">const</span> Point &q)</div>
|
||||
<div class="line"><a name="l00473"></a><span class="lineno"> 473</span> {</div>
|
||||
<div class="line"><a name="l00474"></a><span class="lineno"> 474</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00475"></a><span class="lineno"> 475</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00476"></a><span class="lineno"> 476</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00477"></a><span class="lineno"> 477</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00478"></a><span class="lineno"> 478</span> </div>
|
||||
<div class="line"><a name="l00479"></a><span class="lineno"> 479</span>  Curve25519::sub(A, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00480"></a><span class="lineno"> 480</span>  Curve25519::sub(C, q.y, q.x);</div>
|
||||
<div class="line"><a name="l00481"></a><span class="lineno"> 481</span>  Curve25519::mul(A, A, C);</div>
|
||||
<div class="line"><a name="l00482"></a><span class="lineno"> 482</span>  Curve25519::add(B, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00483"></a><span class="lineno"> 483</span>  Curve25519::add(C, q.y, q.x);</div>
|
||||
<div class="line"><a name="l00484"></a><span class="lineno"> 484</span>  Curve25519::mul(B, B, C);</div>
|
||||
<div class="line"><a name="l00485"></a><span class="lineno"> 485</span>  Curve25519::mul(C, p.t, q.t);</div>
|
||||
<div class="line"><a name="l00486"></a><span class="lineno"> 486</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00487"></a><span class="lineno"> 487</span>  Curve25519::mul(D, p.z, q.z);</div>
|
||||
<div class="line"><a name="l00488"></a><span class="lineno"> 488</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00489"></a><span class="lineno"> 489</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00490"></a><span class="lineno"> 490</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00491"></a><span class="lineno"> 491</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00492"></a><span class="lineno"> 492</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00493"></a><span class="lineno"> 493</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
||||
<div class="line"><a name="l00494"></a><span class="lineno"> 494</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
||||
<div class="line"><a name="l00495"></a><span class="lineno"> 495</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
||||
<div class="line"><a name="l00496"></a><span class="lineno"> 496</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
||||
<div class="line"><a name="l00497"></a><span class="lineno"> 497</span> </div>
|
||||
<div class="line"><a name="l00498"></a><span class="lineno"> 498</span>  clean(A);</div>
|
||||
<div class="line"><a name="l00499"></a><span class="lineno"> 499</span>  clean(B);</div>
|
||||
<div class="line"><a name="l00500"></a><span class="lineno"> 500</span>  clean(C);</div>
|
||||
<div class="line"><a name="l00501"></a><span class="lineno"> 501</span>  clean(D);</div>
|
||||
<div class="line"><a name="l00502"></a><span class="lineno"> 502</span> }</div>
|
||||
<div class="line"><a name="l00503"></a><span class="lineno"> 503</span> </div>
|
||||
<div class="line"><a name="l00512"></a><span class="lineno"> 512</span> <span class="keywordtype">bool</span> Ed25519::equal(<span class="keyword">const</span> Point &p, <span class="keyword">const</span> Point &q)</div>
|
||||
<div class="line"><a name="l00513"></a><span class="lineno"> 513</span> {</div>
|
||||
<div class="line"><a name="l00514"></a><span class="lineno"> 514</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00515"></a><span class="lineno"> 515</span>  limb_t b[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00516"></a><span class="lineno"> 516</span>  <span class="keywordtype">bool</span> result = <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00517"></a><span class="lineno"> 517</span> </div>
|
||||
<div class="line"><a name="l00518"></a><span class="lineno"> 518</span>  Curve25519::mul(a, p.x, q.z);</div>
|
||||
<div class="line"><a name="l00519"></a><span class="lineno"> 519</span>  Curve25519::mul(b, q.x, p.z);</div>
|
||||
<div class="line"><a name="l00520"></a><span class="lineno"> 520</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
||||
<div class="line"><a name="l00521"></a><span class="lineno"> 521</span> </div>
|
||||
<div class="line"><a name="l00522"></a><span class="lineno"> 522</span>  Curve25519::mul(a, p.y, q.z);</div>
|
||||
<div class="line"><a name="l00523"></a><span class="lineno"> 523</span>  Curve25519::mul(b, q.y, p.z);</div>
|
||||
<div class="line"><a name="l00524"></a><span class="lineno"> 524</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
||||
<div class="line"><a name="l00525"></a><span class="lineno"> 525</span> </div>
|
||||
<div class="line"><a name="l00526"></a><span class="lineno"> 526</span>  clean(a);</div>
|
||||
<div class="line"><a name="l00527"></a><span class="lineno"> 527</span>  clean(b);</div>
|
||||
<div class="line"><a name="l00528"></a><span class="lineno"> 528</span>  <span class="keywordflow">return</span> result;</div>
|
||||
<div class="line"><a name="l00529"></a><span class="lineno"> 529</span> }</div>
|
||||
<div class="line"><a name="l00530"></a><span class="lineno"> 530</span> </div>
|
||||
<div class="line"><a name="l00540"></a><span class="lineno"> 540</span> <span class="keywordtype">void</span> Ed25519::encodePoint(uint8_t *buf, Point &point)</div>
|
||||
<div class="line"><a name="l00541"></a><span class="lineno"> 541</span> {</div>
|
||||
<div class="line"><a name="l00542"></a><span class="lineno"> 542</span>  <span class="comment">// Convert the homogeneous coordinates into plain (x, y) coordinates:</span></div>
|
||||
<div class="line"><a name="l00543"></a><span class="lineno"> 543</span>  <span class="comment">// zinv = z^(-1) mod p</span></div>
|
||||
<div class="line"><a name="l00544"></a><span class="lineno"> 544</span>  <span class="comment">// x = x * zinv mod p</span></div>
|
||||
<div class="line"><a name="l00545"></a><span class="lineno"> 545</span>  <span class="comment">// y = y * zinv mod p</span></div>
|
||||
<div class="line"><a name="l00546"></a><span class="lineno"> 546</span>  <span class="comment">// We don't need the t coordinate, so use that to store zinv temporarily.</span></div>
|
||||
<div class="line"><a name="l00547"></a><span class="lineno"> 547</span>  Curve25519::recip(point.t, point.z);</div>
|
||||
<div class="line"><a name="l00548"></a><span class="lineno"> 548</span>  Curve25519::mul(point.x, point.x, point.t);</div>
|
||||
<div class="line"><a name="l00549"></a><span class="lineno"> 549</span>  Curve25519::mul(point.y, point.y, point.t);</div>
|
||||
<div class="line"><a name="l00550"></a><span class="lineno"> 550</span> </div>
|
||||
<div class="line"><a name="l00551"></a><span class="lineno"> 551</span>  <span class="comment">// Copy the lowest bit of x to the highest bit of y.</span></div>
|
||||
<div class="line"><a name="l00552"></a><span class="lineno"> 552</span>  point.y[NUM_LIMBS_256BIT - 1] |= (point.x[0] << (LIMB_BITS - 1));</div>
|
||||
<div class="line"><a name="l00553"></a><span class="lineno"> 553</span> </div>
|
||||
<div class="line"><a name="l00554"></a><span class="lineno"> 554</span>  <span class="comment">// Convert y into little-endian in the return buffer.</span></div>
|
||||
<div class="line"><a name="l00555"></a><span class="lineno"> 555</span>  <a class="code" href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a>(buf, 32, point.y, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00556"></a><span class="lineno"> 556</span> }</div>
|
||||
<div class="line"><a name="l00557"></a><span class="lineno"> 557</span> </div>
|
||||
<div class="line"><a name="l00570"></a><span class="lineno"> 570</span> <span class="keywordtype">bool</span> Ed25519::decodePoint(Point &point, <span class="keyword">const</span> uint8_t *buf)</div>
|
||||
<div class="line"><a name="l00571"></a><span class="lineno"> 571</span> {</div>
|
||||
<div class="line"><a name="l00572"></a><span class="lineno"> 572</span>  limb_t temp[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00573"></a><span class="lineno"> 573</span> </div>
|
||||
<div class="line"><a name="l00574"></a><span class="lineno"> 574</span>  <span class="comment">// Convert the input buffer from little-endian into the limbs of y.</span></div>
|
||||
<div class="line"><a name="l00575"></a><span class="lineno"> 575</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(point.y, NUM_LIMBS_256BIT, buf, 32);</div>
|
||||
<div class="line"><a name="l00576"></a><span class="lineno"> 576</span> </div>
|
||||
<div class="line"><a name="l00577"></a><span class="lineno"> 577</span>  <span class="comment">// The high bit of y is the sign bit for x.</span></div>
|
||||
<div class="line"><a name="l00578"></a><span class="lineno"> 578</span>  limb_t <a class="code" href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5">sign</a> = point.y[NUM_LIMBS_256BIT - 1] >> (LIMB_BITS - 1);</div>
|
||||
<div class="line"><a name="l00579"></a><span class="lineno"> 579</span>  point.y[NUM_LIMBS_256BIT - 1] &= ~(((limb_t)1) << (LIMB_BITS - 1));</div>
|
||||
<div class="line"><a name="l00580"></a><span class="lineno"> 580</span> </div>
|
||||
<div class="line"><a name="l00581"></a><span class="lineno"> 581</span>  <span class="comment">// Set z to 1.</span></div>
|
||||
<div class="line"><a name="l00582"></a><span class="lineno"> 582</span>  memcpy_P(point.z, numBz, <span class="keyword">sizeof</span>(point.z));</div>
|
||||
<div class="line"><a name="l00583"></a><span class="lineno"> 583</span> </div>
|
||||
<div class="line"><a name="l00584"></a><span class="lineno"> 584</span>  <span class="comment">// Compute t = (y * y - 1) * modinv(d * y * y + 1).</span></div>
|
||||
<div class="line"><a name="l00585"></a><span class="lineno"> 585</span>  Curve25519::square(point.t, point.y);</div>
|
||||
<div class="line"><a name="l00586"></a><span class="lineno"> 586</span>  Curve25519::sub(point.x, point.t, point.z);</div>
|
||||
<div class="line"><a name="l00587"></a><span class="lineno"> 587</span>  Curve25519::mul_P(point.t, point.t, numD);</div>
|
||||
<div class="line"><a name="l00588"></a><span class="lineno"> 588</span>  Curve25519::add(point.t, point.t, point.z);</div>
|
||||
<div class="line"><a name="l00589"></a><span class="lineno"> 589</span>  Curve25519::recip(temp, point.t);</div>
|
||||
<div class="line"><a name="l00590"></a><span class="lineno"> 590</span>  Curve25519::mul(point.t, point.x, temp);</div>
|
||||
<div class="line"><a name="l00591"></a><span class="lineno"> 591</span>  clean(temp);</div>
|
||||
<div class="line"><a name="l00592"></a><span class="lineno"> 592</span> </div>
|
||||
<div class="line"><a name="l00593"></a><span class="lineno"> 593</span>  <span class="comment">// Check for t = 0.</span></div>
|
||||
<div class="line"><a name="l00594"></a><span class="lineno"> 594</span>  limb_t check = point.t[0];</div>
|
||||
<div class="line"><a name="l00595"></a><span class="lineno"> 595</span>  <span class="keywordflow">for</span> (uint8_t posn = 1; posn < NUM_LIMBS_256BIT; ++posn)</div>
|
||||
<div class="line"><a name="l00596"></a><span class="lineno"> 596</span>  check |= point.t[posn];</div>
|
||||
<div class="line"><a name="l00597"></a><span class="lineno"> 597</span>  if (!check) {</div>
|
||||
<div class="line"><a name="l00598"></a><span class="lineno"> 598</span>  <span class="comment">// If the sign bit is set, then decoding has failed.</span></div>
|
||||
<div class="line"><a name="l00599"></a><span class="lineno"> 599</span>  <span class="comment">// Otherwise x is zero and we're done.</span></div>
|
||||
<div class="line"><a name="l00600"></a><span class="lineno"> 600</span>  <span class="keywordflow">if</span> (sign)</div>
|
||||
<div class="line"><a name="l00601"></a><span class="lineno"> 601</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
||||
<div class="line"><a name="l00602"></a><span class="lineno"> 602</span>  memset(point.x, 0, <span class="keyword">sizeof</span>(point.x));</div>
|
||||
<div class="line"><a name="l00603"></a><span class="lineno"> 603</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00604"></a><span class="lineno"> 604</span>  }</div>
|
||||
<div class="line"><a name="l00605"></a><span class="lineno"> 605</span> </div>
|
||||
<div class="line"><a name="l00606"></a><span class="lineno"> 606</span>  <span class="comment">// Recover x by taking the sqrt of t and flipping the sign if necessary.</span></div>
|
||||
<div class="line"><a name="l00607"></a><span class="lineno"> 607</span>  <span class="keywordflow">if</span> (!Curve25519::sqrt(point.x, point.t))</div>
|
||||
<div class="line"><a name="l00608"></a><span class="lineno"> 608</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
||||
<div class="line"><a name="l00609"></a><span class="lineno"> 609</span>  <span class="keywordflow">if</span> (sign != (point.x[0] & ((limb_t)1))) {</div>
|
||||
<div class="line"><a name="l00610"></a><span class="lineno"> 610</span>  <span class="comment">// The signs are different so we want the other square root.</span></div>
|
||||
<div class="line"><a name="l00611"></a><span class="lineno"> 611</span>  memset(point.t, 0, <span class="keyword">sizeof</span>(point.t));</div>
|
||||
<div class="line"><a name="l00612"></a><span class="lineno"> 612</span>  Curve25519::sub(point.x, point.t, point.x);</div>
|
||||
<div class="line"><a name="l00613"></a><span class="lineno"> 613</span>  }</div>
|
||||
<div class="line"><a name="l00614"></a><span class="lineno"> 614</span> </div>
|
||||
<div class="line"><a name="l00615"></a><span class="lineno"> 615</span>  <span class="comment">// Finally, t = x * y.</span></div>
|
||||
<div class="line"><a name="l00616"></a><span class="lineno"> 616</span>  Curve25519::mul(point.t, point.x, point.y);</div>
|
||||
<div class="line"><a name="l00617"></a><span class="lineno"> 617</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00618"></a><span class="lineno"> 618</span> }</div>
|
||||
<div class="line"><a name="l00619"></a><span class="lineno"> 619</span> </div>
|
||||
<div class="line"><a name="l00630"></a><span class="lineno"> 630</span> <span class="keywordtype">void</span> Ed25519::deriveKeys(<a class="code" href="classSHA512.html">SHA512</a> *hash, limb_t *a, <span class="keyword">const</span> uint8_t privateKey[32])</div>
|
||||
<div class="line"><a name="l00631"></a><span class="lineno"> 631</span> {</div>
|
||||
<div class="line"><a name="l00632"></a><span class="lineno"> 632</span>  <span class="comment">// Hash the private key to get the "a" scalar and the message prefix.</span></div>
|
||||
<div class="line"><a name="l00633"></a><span class="lineno"> 633</span>  uint8_t *buf = (uint8_t *)(hash->state.w); <span class="comment">// Reuse hash buffer to save memory.</span></div>
|
||||
<div class="line"><a name="l00634"></a><span class="lineno"> 634</span>  hash-><a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
||||
<div class="line"><a name="l00635"></a><span class="lineno"> 635</span>  hash-><a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(privateKey, 32);</div>
|
||||
<div class="line"><a name="l00636"></a><span class="lineno"> 636</span>  hash-><a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(buf, 0);</div>
|
||||
<div class="line"><a name="l00637"></a><span class="lineno"> 637</span>  buf[0] &= 0xF8;</div>
|
||||
<div class="line"><a name="l00638"></a><span class="lineno"> 638</span>  buf[31] &= 0x7F;</div>
|
||||
<div class="line"><a name="l00639"></a><span class="lineno"> 639</span>  buf[31] |= 0x40;</div>
|
||||
<div class="line"><a name="l00640"></a><span class="lineno"> 640</span> </div>
|
||||
<div class="line"><a name="l00641"></a><span class="lineno"> 641</span>  <span class="comment">// Unpack the first half of the hash value into "a".</span></div>
|
||||
<div class="line"><a name="l00642"></a><span class="lineno"> 642</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(a, NUM_LIMBS_256BIT, buf, 32);</div>
|
||||
<div class="line"><a name="l00643"></a><span class="lineno"> 643</span> }</div>
|
||||
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>  Point ptA;</div>
|
||||
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span> </div>
|
||||
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span>  <span class="comment">// Derive the secret scalar a from the private key.</span></div>
|
||||
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>  deriveKeys(&hash, a, privateKey);</div>
|
||||
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span> </div>
|
||||
<div class="line"><a name="l00265"></a><span class="lineno"> 265</span>  <span class="comment">// Compute the point A = aB and encode it.</span></div>
|
||||
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span>  mul(ptA, a);</div>
|
||||
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span>  encodePoint(publicKey, ptA);</div>
|
||||
<div class="line"><a name="l00268"></a><span class="lineno"> 268</span> </div>
|
||||
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span>  <span class="comment">// Clean up and exit.</span></div>
|
||||
<div class="line"><a name="l00270"></a><span class="lineno"> 270</span>  clean(a);</div>
|
||||
<div class="line"><a name="l00271"></a><span class="lineno"> 271</span>  clean(ptA);</div>
|
||||
<div class="line"><a name="l00272"></a><span class="lineno"> 272</span> }</div>
|
||||
<div class="line"><a name="l00273"></a><span class="lineno"> 273</span> </div>
|
||||
<div class="line"><a name="l00283"></a><span class="lineno"> 283</span> <span class="keywordtype">void</span> Ed25519::reduceQFromBuffer(limb_t *result, <span class="keyword">const</span> uint8_t buf[64], limb_t *temp)</div>
|
||||
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span> {</div>
|
||||
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(temp, NUM_LIMBS_512BIT, buf, 64);</div>
|
||||
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>  temp[NUM_LIMBS_512BIT] = 0;</div>
|
||||
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>  reduceQ(result, temp);</div>
|
||||
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span> }</div>
|
||||
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span> </div>
|
||||
<div class="line"><a name="l00302"></a><span class="lineno"> 302</span> <span class="keywordtype">void</span> Ed25519::reduceQ(limb_t *result, limb_t *r)</div>
|
||||
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span> {</div>
|
||||
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span>  <span class="comment">// Algorithm from: http://en.wikipedia.org/wiki/Barrett_reduction</span></div>
|
||||
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>  <span class="comment">// We assume that r is less than or equal to (q - 1)^2.</span></div>
|
||||
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>  <span class="comment">// We want to compute result = r mod q. Find the smallest k such</span></div>
|
||||
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>  <span class="comment">// that 2^k > q. In our case, k = 253. Then set m = floor(4^k / q)</span></div>
|
||||
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>  <span class="comment">// and let r = r - q * floor(m * r / 4^k). This will be the result</span></div>
|
||||
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>  <span class="comment">// or it will be at most one subtraction of q away from the result.</span></div>
|
||||
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>  <span class="comment">//</span></div>
|
||||
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>  <span class="comment">// Note: 4^k = 4^253 = 2^506 = 2^512/2^6. We can more easily compute</span></div>
|
||||
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>  <span class="comment">// the result we want if we set m = floor(4^k * 2^6 / q) instead and</span></div>
|
||||
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>  <span class="comment">// then r = r - q * floor(m * r / 2^512). Because the slight extra</span></div>
|
||||
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>  <span class="comment">// precision in m, r is at most two subtractions of q away from the</span></div>
|
||||
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>  <span class="comment">// final result.</span></div>
|
||||
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>  <span class="keyword">static</span> limb_t <span class="keyword">const</span> numM[NUM_LIMBS_256BIT + 1] PROGMEM = {</div>
|
||||
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>  LIMB(0x0A2C131B), LIMB(0xED9CE5A3), LIMB(0x086329A7), LIMB(0x2106215D),</div>
|
||||
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>  LIMB(0xFFFFFFEB), LIMB(0xFFFFFFFF), LIMB(0xFFFFFFFF), LIMB(0xFFFFFFFF),</div>
|
||||
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>  0x0F</div>
|
||||
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>  };</div>
|
||||
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>  limb_t temp[NUM_LIMBS_512BIT + NUM_LIMBS_256BIT + 1];</div>
|
||||
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span> </div>
|
||||
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>  <span class="comment">// Multiply r by m.</span></div>
|
||||
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, r, NUM_LIMBS_512BIT, numM, NUM_LIMBS_256BIT + 1);</div>
|
||||
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span> </div>
|
||||
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>  <span class="comment">// Multiply (m * r) / 2^512 by q and subtract it from r.</span></div>
|
||||
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>  <span class="comment">// We can ignore the high words of the subtraction result</span></div>
|
||||
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>  <span class="comment">// because they will all turn into zero after the subtraction.</span></div>
|
||||
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, temp + NUM_LIMBS_512BIT, NUM_LIMBS_256BIT + 1,</div>
|
||||
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>  numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>  <a class="code" href="classBigNumberUtil.html#a6618e03bfcb3086961df508b40cc1e67">BigNumberUtil::sub</a>(r, r, temp, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span> </div>
|
||||
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span>  <span class="comment">// Perform two subtractions of q from the result to reduce it.</span></div>
|
||||
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, r, numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, result, numQ, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span> </div>
|
||||
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>  <span class="comment">// Clean up and exit.</span></div>
|
||||
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>  clean(temp);</div>
|
||||
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span> }</div>
|
||||
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span> </div>
|
||||
<div class="line"><a name="l00352"></a><span class="lineno"> 352</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, Point &p, <span class="keywordtype">bool</span> constTime)</div>
|
||||
<div class="line"><a name="l00353"></a><span class="lineno"> 353</span> {</div>
|
||||
<div class="line"><a name="l00354"></a><span class="lineno"> 354</span>  Point q;</div>
|
||||
<div class="line"><a name="l00355"></a><span class="lineno"> 355</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00356"></a><span class="lineno"> 356</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00357"></a><span class="lineno"> 357</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00358"></a><span class="lineno"> 358</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00359"></a><span class="lineno"> 359</span>  limb_t mask, select;</div>
|
||||
<div class="line"><a name="l00360"></a><span class="lineno"> 360</span>  uint8_t sposn, t;</div>
|
||||
<div class="line"><a name="l00361"></a><span class="lineno"> 361</span> </div>
|
||||
<div class="line"><a name="l00362"></a><span class="lineno"> 362</span>  <span class="comment">// Initialize the result to (0, 1, 1, 0).</span></div>
|
||||
<div class="line"><a name="l00363"></a><span class="lineno"> 363</span>  memset(&result, 0, <span class="keyword">sizeof</span>(Point));</div>
|
||||
<div class="line"><a name="l00364"></a><span class="lineno"> 364</span>  result.y[0] = 1;</div>
|
||||
<div class="line"><a name="l00365"></a><span class="lineno"> 365</span>  result.z[0] = 1;</div>
|
||||
<div class="line"><a name="l00366"></a><span class="lineno"> 366</span> </div>
|
||||
<div class="line"><a name="l00367"></a><span class="lineno"> 367</span>  <span class="comment">// Iterate over the 255 bits of "s" to calculate "s * p".</span></div>
|
||||
<div class="line"><a name="l00368"></a><span class="lineno"> 368</span>  mask = 1;</div>
|
||||
<div class="line"><a name="l00369"></a><span class="lineno"> 369</span>  sposn = 0;</div>
|
||||
<div class="line"><a name="l00370"></a><span class="lineno"> 370</span>  <span class="keywordflow">for</span> (t = 255; t > 0; --t) {</div>
|
||||
<div class="line"><a name="l00371"></a><span class="lineno"> 371</span>  <span class="comment">// Add p to the result to produce q. The specification refers</span></div>
|
||||
<div class="line"><a name="l00372"></a><span class="lineno"> 372</span>  <span class="comment">// to temporary variables A to H. We can dispense with E to H</span></div>
|
||||
<div class="line"><a name="l00373"></a><span class="lineno"> 373</span>  <span class="comment">// by using B, D, q.z, and q.t to hold those values temporarily.</span></div>
|
||||
<div class="line"><a name="l00374"></a><span class="lineno"> 374</span>  select = s[sposn] & mask;</div>
|
||||
<div class="line"><a name="l00375"></a><span class="lineno"> 375</span>  <span class="keywordflow">if</span> (constTime || select) {</div>
|
||||
<div class="line"><a name="l00376"></a><span class="lineno"> 376</span>  Curve25519::sub(A, result.y, result.x);</div>
|
||||
<div class="line"><a name="l00377"></a><span class="lineno"> 377</span>  Curve25519::sub(C, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00378"></a><span class="lineno"> 378</span>  Curve25519::mul(A, A, C);</div>
|
||||
<div class="line"><a name="l00379"></a><span class="lineno"> 379</span>  Curve25519::add(B, result.y, result.x);</div>
|
||||
<div class="line"><a name="l00380"></a><span class="lineno"> 380</span>  Curve25519::add(C, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00381"></a><span class="lineno"> 381</span>  Curve25519::mul(B, B, C);</div>
|
||||
<div class="line"><a name="l00382"></a><span class="lineno"> 382</span>  Curve25519::mul(C, result.t, p.t);</div>
|
||||
<div class="line"><a name="l00383"></a><span class="lineno"> 383</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00384"></a><span class="lineno"> 384</span>  Curve25519::mul(D, result.z, p.z);</div>
|
||||
<div class="line"><a name="l00385"></a><span class="lineno"> 385</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00386"></a><span class="lineno"> 386</span>  Curve25519::sub(q.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span>  Curve25519::sub(q.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00389"></a><span class="lineno"> 389</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00390"></a><span class="lineno"> 390</span>  <span class="keywordflow">if</span> (constTime) {</div>
|
||||
<div class="line"><a name="l00391"></a><span class="lineno"> 391</span>  <span class="comment">// Put the intermediate value into q.</span></div>
|
||||
<div class="line"><a name="l00392"></a><span class="lineno"> 392</span>  Curve25519::mul(q.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
||||
<div class="line"><a name="l00393"></a><span class="lineno"> 393</span>  Curve25519::mul(q.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
||||
<div class="line"><a name="l00394"></a><span class="lineno"> 394</span>  Curve25519::mul(q.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
||||
<div class="line"><a name="l00395"></a><span class="lineno"> 395</span>  Curve25519::mul(q.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
||||
<div class="line"><a name="l00396"></a><span class="lineno"> 396</span> </div>
|
||||
<div class="line"><a name="l00397"></a><span class="lineno"> 397</span>  <span class="comment">// Copy q into the result if the current bit of s is 1.</span></div>
|
||||
<div class="line"><a name="l00398"></a><span class="lineno"> 398</span>  Curve25519::cmove(select, result.x, q.x);</div>
|
||||
<div class="line"><a name="l00399"></a><span class="lineno"> 399</span>  Curve25519::cmove(select, result.y, q.y);</div>
|
||||
<div class="line"><a name="l00400"></a><span class="lineno"> 400</span>  Curve25519::cmove(select, result.z, q.z);</div>
|
||||
<div class="line"><a name="l00401"></a><span class="lineno"> 401</span>  Curve25519::cmove(select, result.t, q.t);</div>
|
||||
<div class="line"><a name="l00402"></a><span class="lineno"> 402</span>  } <span class="keywordflow">else</span> {</div>
|
||||
<div class="line"><a name="l00403"></a><span class="lineno"> 403</span>  <span class="comment">// Put the intermediate value directly into the result.</span></div>
|
||||
<div class="line"><a name="l00404"></a><span class="lineno"> 404</span>  Curve25519::mul(result.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
||||
<div class="line"><a name="l00405"></a><span class="lineno"> 405</span>  Curve25519::mul(result.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
||||
<div class="line"><a name="l00406"></a><span class="lineno"> 406</span>  Curve25519::mul(result.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
||||
<div class="line"><a name="l00407"></a><span class="lineno"> 407</span>  Curve25519::mul(result.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
||||
<div class="line"><a name="l00408"></a><span class="lineno"> 408</span>  }</div>
|
||||
<div class="line"><a name="l00409"></a><span class="lineno"> 409</span>  }</div>
|
||||
<div class="line"><a name="l00410"></a><span class="lineno"> 410</span> </div>
|
||||
<div class="line"><a name="l00411"></a><span class="lineno"> 411</span>  <span class="comment">// Double p for the next iteration.</span></div>
|
||||
<div class="line"><a name="l00412"></a><span class="lineno"> 412</span>  Curve25519::sub(A, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00413"></a><span class="lineno"> 413</span>  Curve25519::square(A, A);</div>
|
||||
<div class="line"><a name="l00414"></a><span class="lineno"> 414</span>  Curve25519::add(B, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00415"></a><span class="lineno"> 415</span>  Curve25519::square(B, B);</div>
|
||||
<div class="line"><a name="l00416"></a><span class="lineno"> 416</span>  Curve25519::square(C, p.t);</div>
|
||||
<div class="line"><a name="l00417"></a><span class="lineno"> 417</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00418"></a><span class="lineno"> 418</span>  Curve25519::square(D, p.z);</div>
|
||||
<div class="line"><a name="l00419"></a><span class="lineno"> 419</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00420"></a><span class="lineno"> 420</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00421"></a><span class="lineno"> 421</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00422"></a><span class="lineno"> 422</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00423"></a><span class="lineno"> 423</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00424"></a><span class="lineno"> 424</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
||||
<div class="line"><a name="l00425"></a><span class="lineno"> 425</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
||||
<div class="line"><a name="l00426"></a><span class="lineno"> 426</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
||||
<div class="line"><a name="l00427"></a><span class="lineno"> 427</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
||||
<div class="line"><a name="l00428"></a><span class="lineno"> 428</span> </div>
|
||||
<div class="line"><a name="l00429"></a><span class="lineno"> 429</span>  <span class="comment">// Move onto the next bit of s from lowest to highest.</span></div>
|
||||
<div class="line"><a name="l00430"></a><span class="lineno"> 430</span>  <span class="keywordflow">if</span> (mask != (((limb_t)1) << (LIMB_BITS - 1))) {</div>
|
||||
<div class="line"><a name="l00431"></a><span class="lineno"> 431</span>  mask <<= 1;</div>
|
||||
<div class="line"><a name="l00432"></a><span class="lineno"> 432</span>  } <span class="keywordflow">else</span> {</div>
|
||||
<div class="line"><a name="l00433"></a><span class="lineno"> 433</span>  ++sposn;</div>
|
||||
<div class="line"><a name="l00434"></a><span class="lineno"> 434</span>  mask = 1;</div>
|
||||
<div class="line"><a name="l00435"></a><span class="lineno"> 435</span>  }</div>
|
||||
<div class="line"><a name="l00436"></a><span class="lineno"> 436</span>  }</div>
|
||||
<div class="line"><a name="l00437"></a><span class="lineno"> 437</span> </div>
|
||||
<div class="line"><a name="l00438"></a><span class="lineno"> 438</span>  <span class="comment">// Clean up.</span></div>
|
||||
<div class="line"><a name="l00439"></a><span class="lineno"> 439</span>  clean(q);</div>
|
||||
<div class="line"><a name="l00440"></a><span class="lineno"> 440</span>  clean(A);</div>
|
||||
<div class="line"><a name="l00441"></a><span class="lineno"> 441</span>  clean(B);</div>
|
||||
<div class="line"><a name="l00442"></a><span class="lineno"> 442</span>  clean(C);</div>
|
||||
<div class="line"><a name="l00443"></a><span class="lineno"> 443</span>  clean(D);</div>
|
||||
<div class="line"><a name="l00444"></a><span class="lineno"> 444</span> }</div>
|
||||
<div class="line"><a name="l00445"></a><span class="lineno"> 445</span> </div>
|
||||
<div class="line"><a name="l00454"></a><span class="lineno"> 454</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, <span class="keywordtype">bool</span> constTime)</div>
|
||||
<div class="line"><a name="l00455"></a><span class="lineno"> 455</span> {</div>
|
||||
<div class="line"><a name="l00456"></a><span class="lineno"> 456</span>  Point P;</div>
|
||||
<div class="line"><a name="l00457"></a><span class="lineno"> 457</span>  memcpy_P(P.x, numBx, <span class="keyword">sizeof</span>(P.x));</div>
|
||||
<div class="line"><a name="l00458"></a><span class="lineno"> 458</span>  memcpy_P(P.y, numBy, <span class="keyword">sizeof</span>(P.y));</div>
|
||||
<div class="line"><a name="l00459"></a><span class="lineno"> 459</span>  memcpy_P(P.z, numBz, <span class="keyword">sizeof</span>(P.z));</div>
|
||||
<div class="line"><a name="l00460"></a><span class="lineno"> 460</span>  memcpy_P(P.t, numBt, <span class="keyword">sizeof</span>(P.t));</div>
|
||||
<div class="line"><a name="l00461"></a><span class="lineno"> 461</span>  mul(result, s, P, constTime);</div>
|
||||
<div class="line"><a name="l00462"></a><span class="lineno"> 462</span>  clean(P);</div>
|
||||
<div class="line"><a name="l00463"></a><span class="lineno"> 463</span> }</div>
|
||||
<div class="line"><a name="l00464"></a><span class="lineno"> 464</span> </div>
|
||||
<div class="line"><a name="l00471"></a><span class="lineno"> 471</span> <span class="keywordtype">void</span> Ed25519::add(Point &p, <span class="keyword">const</span> Point &q)</div>
|
||||
<div class="line"><a name="l00472"></a><span class="lineno"> 472</span> {</div>
|
||||
<div class="line"><a name="l00473"></a><span class="lineno"> 473</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00474"></a><span class="lineno"> 474</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00475"></a><span class="lineno"> 475</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00476"></a><span class="lineno"> 476</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00477"></a><span class="lineno"> 477</span> </div>
|
||||
<div class="line"><a name="l00478"></a><span class="lineno"> 478</span>  Curve25519::sub(A, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00479"></a><span class="lineno"> 479</span>  Curve25519::sub(C, q.y, q.x);</div>
|
||||
<div class="line"><a name="l00480"></a><span class="lineno"> 480</span>  Curve25519::mul(A, A, C);</div>
|
||||
<div class="line"><a name="l00481"></a><span class="lineno"> 481</span>  Curve25519::add(B, p.y, p.x);</div>
|
||||
<div class="line"><a name="l00482"></a><span class="lineno"> 482</span>  Curve25519::add(C, q.y, q.x);</div>
|
||||
<div class="line"><a name="l00483"></a><span class="lineno"> 483</span>  Curve25519::mul(B, B, C);</div>
|
||||
<div class="line"><a name="l00484"></a><span class="lineno"> 484</span>  Curve25519::mul(C, p.t, q.t);</div>
|
||||
<div class="line"><a name="l00485"></a><span class="lineno"> 485</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
||||
<div class="line"><a name="l00486"></a><span class="lineno"> 486</span>  Curve25519::mul(D, p.z, q.z);</div>
|
||||
<div class="line"><a name="l00487"></a><span class="lineno"> 487</span>  Curve25519::add(D, D, D);</div>
|
||||
<div class="line"><a name="l00488"></a><span class="lineno"> 488</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
||||
<div class="line"><a name="l00489"></a><span class="lineno"> 489</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
||||
<div class="line"><a name="l00490"></a><span class="lineno"> 490</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
||||
<div class="line"><a name="l00491"></a><span class="lineno"> 491</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
||||
<div class="line"><a name="l00492"></a><span class="lineno"> 492</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
||||
<div class="line"><a name="l00493"></a><span class="lineno"> 493</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
||||
<div class="line"><a name="l00494"></a><span class="lineno"> 494</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
||||
<div class="line"><a name="l00495"></a><span class="lineno"> 495</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
||||
<div class="line"><a name="l00496"></a><span class="lineno"> 496</span> </div>
|
||||
<div class="line"><a name="l00497"></a><span class="lineno"> 497</span>  clean(A);</div>
|
||||
<div class="line"><a name="l00498"></a><span class="lineno"> 498</span>  clean(B);</div>
|
||||
<div class="line"><a name="l00499"></a><span class="lineno"> 499</span>  clean(C);</div>
|
||||
<div class="line"><a name="l00500"></a><span class="lineno"> 500</span>  clean(D);</div>
|
||||
<div class="line"><a name="l00501"></a><span class="lineno"> 501</span> }</div>
|
||||
<div class="line"><a name="l00502"></a><span class="lineno"> 502</span> </div>
|
||||
<div class="line"><a name="l00511"></a><span class="lineno"> 511</span> <span class="keywordtype">bool</span> Ed25519::equal(<span class="keyword">const</span> Point &p, <span class="keyword">const</span> Point &q)</div>
|
||||
<div class="line"><a name="l00512"></a><span class="lineno"> 512</span> {</div>
|
||||
<div class="line"><a name="l00513"></a><span class="lineno"> 513</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00514"></a><span class="lineno"> 514</span>  limb_t b[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00515"></a><span class="lineno"> 515</span>  <span class="keywordtype">bool</span> result = <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00516"></a><span class="lineno"> 516</span> </div>
|
||||
<div class="line"><a name="l00517"></a><span class="lineno"> 517</span>  Curve25519::mul(a, p.x, q.z);</div>
|
||||
<div class="line"><a name="l00518"></a><span class="lineno"> 518</span>  Curve25519::mul(b, q.x, p.z);</div>
|
||||
<div class="line"><a name="l00519"></a><span class="lineno"> 519</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
||||
<div class="line"><a name="l00520"></a><span class="lineno"> 520</span> </div>
|
||||
<div class="line"><a name="l00521"></a><span class="lineno"> 521</span>  Curve25519::mul(a, p.y, q.z);</div>
|
||||
<div class="line"><a name="l00522"></a><span class="lineno"> 522</span>  Curve25519::mul(b, q.y, p.z);</div>
|
||||
<div class="line"><a name="l00523"></a><span class="lineno"> 523</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
||||
<div class="line"><a name="l00524"></a><span class="lineno"> 524</span> </div>
|
||||
<div class="line"><a name="l00525"></a><span class="lineno"> 525</span>  clean(a);</div>
|
||||
<div class="line"><a name="l00526"></a><span class="lineno"> 526</span>  clean(b);</div>
|
||||
<div class="line"><a name="l00527"></a><span class="lineno"> 527</span>  <span class="keywordflow">return</span> result;</div>
|
||||
<div class="line"><a name="l00528"></a><span class="lineno"> 528</span> }</div>
|
||||
<div class="line"><a name="l00529"></a><span class="lineno"> 529</span> </div>
|
||||
<div class="line"><a name="l00539"></a><span class="lineno"> 539</span> <span class="keywordtype">void</span> Ed25519::encodePoint(uint8_t *buf, Point &point)</div>
|
||||
<div class="line"><a name="l00540"></a><span class="lineno"> 540</span> {</div>
|
||||
<div class="line"><a name="l00541"></a><span class="lineno"> 541</span>  <span class="comment">// Convert the homogeneous coordinates into plain (x, y) coordinates:</span></div>
|
||||
<div class="line"><a name="l00542"></a><span class="lineno"> 542</span>  <span class="comment">// zinv = z^(-1) mod p</span></div>
|
||||
<div class="line"><a name="l00543"></a><span class="lineno"> 543</span>  <span class="comment">// x = x * zinv mod p</span></div>
|
||||
<div class="line"><a name="l00544"></a><span class="lineno"> 544</span>  <span class="comment">// y = y * zinv mod p</span></div>
|
||||
<div class="line"><a name="l00545"></a><span class="lineno"> 545</span>  <span class="comment">// We don't need the t coordinate, so use that to store zinv temporarily.</span></div>
|
||||
<div class="line"><a name="l00546"></a><span class="lineno"> 546</span>  Curve25519::recip(point.t, point.z);</div>
|
||||
<div class="line"><a name="l00547"></a><span class="lineno"> 547</span>  Curve25519::mul(point.x, point.x, point.t);</div>
|
||||
<div class="line"><a name="l00548"></a><span class="lineno"> 548</span>  Curve25519::mul(point.y, point.y, point.t);</div>
|
||||
<div class="line"><a name="l00549"></a><span class="lineno"> 549</span> </div>
|
||||
<div class="line"><a name="l00550"></a><span class="lineno"> 550</span>  <span class="comment">// Copy the lowest bit of x to the highest bit of y.</span></div>
|
||||
<div class="line"><a name="l00551"></a><span class="lineno"> 551</span>  point.y[NUM_LIMBS_256BIT - 1] |= (point.x[0] << (LIMB_BITS - 1));</div>
|
||||
<div class="line"><a name="l00552"></a><span class="lineno"> 552</span> </div>
|
||||
<div class="line"><a name="l00553"></a><span class="lineno"> 553</span>  <span class="comment">// Convert y into little-endian in the return buffer.</span></div>
|
||||
<div class="line"><a name="l00554"></a><span class="lineno"> 554</span>  <a class="code" href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a>(buf, 32, point.y, NUM_LIMBS_256BIT);</div>
|
||||
<div class="line"><a name="l00555"></a><span class="lineno"> 555</span> }</div>
|
||||
<div class="line"><a name="l00556"></a><span class="lineno"> 556</span> </div>
|
||||
<div class="line"><a name="l00569"></a><span class="lineno"> 569</span> <span class="keywordtype">bool</span> Ed25519::decodePoint(Point &point, <span class="keyword">const</span> uint8_t *buf)</div>
|
||||
<div class="line"><a name="l00570"></a><span class="lineno"> 570</span> {</div>
|
||||
<div class="line"><a name="l00571"></a><span class="lineno"> 571</span>  limb_t temp[NUM_LIMBS_256BIT];</div>
|
||||
<div class="line"><a name="l00572"></a><span class="lineno"> 572</span> </div>
|
||||
<div class="line"><a name="l00573"></a><span class="lineno"> 573</span>  <span class="comment">// Convert the input buffer from little-endian into the limbs of y.</span></div>
|
||||
<div class="line"><a name="l00574"></a><span class="lineno"> 574</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(point.y, NUM_LIMBS_256BIT, buf, 32);</div>
|
||||
<div class="line"><a name="l00575"></a><span class="lineno"> 575</span> </div>
|
||||
<div class="line"><a name="l00576"></a><span class="lineno"> 576</span>  <span class="comment">// The high bit of y is the sign bit for x.</span></div>
|
||||
<div class="line"><a name="l00577"></a><span class="lineno"> 577</span>  limb_t <a class="code" href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5">sign</a> = point.y[NUM_LIMBS_256BIT - 1] >> (LIMB_BITS - 1);</div>
|
||||
<div class="line"><a name="l00578"></a><span class="lineno"> 578</span>  point.y[NUM_LIMBS_256BIT - 1] &= ~(((limb_t)1) << (LIMB_BITS - 1));</div>
|
||||
<div class="line"><a name="l00579"></a><span class="lineno"> 579</span> </div>
|
||||
<div class="line"><a name="l00580"></a><span class="lineno"> 580</span>  <span class="comment">// Set z to 1.</span></div>
|
||||
<div class="line"><a name="l00581"></a><span class="lineno"> 581</span>  memcpy_P(point.z, numBz, <span class="keyword">sizeof</span>(point.z));</div>
|
||||
<div class="line"><a name="l00582"></a><span class="lineno"> 582</span> </div>
|
||||
<div class="line"><a name="l00583"></a><span class="lineno"> 583</span>  <span class="comment">// Compute t = (y * y - 1) * modinv(d * y * y + 1).</span></div>
|
||||
<div class="line"><a name="l00584"></a><span class="lineno"> 584</span>  Curve25519::square(point.t, point.y);</div>
|
||||
<div class="line"><a name="l00585"></a><span class="lineno"> 585</span>  Curve25519::sub(point.x, point.t, point.z);</div>
|
||||
<div class="line"><a name="l00586"></a><span class="lineno"> 586</span>  Curve25519::mul_P(point.t, point.t, numD);</div>
|
||||
<div class="line"><a name="l00587"></a><span class="lineno"> 587</span>  Curve25519::add(point.t, point.t, point.z);</div>
|
||||
<div class="line"><a name="l00588"></a><span class="lineno"> 588</span>  Curve25519::recip(temp, point.t);</div>
|
||||
<div class="line"><a name="l00589"></a><span class="lineno"> 589</span>  Curve25519::mul(point.t, point.x, temp);</div>
|
||||
<div class="line"><a name="l00590"></a><span class="lineno"> 590</span>  clean(temp);</div>
|
||||
<div class="line"><a name="l00591"></a><span class="lineno"> 591</span> </div>
|
||||
<div class="line"><a name="l00592"></a><span class="lineno"> 592</span>  <span class="comment">// Check for t = 0.</span></div>
|
||||
<div class="line"><a name="l00593"></a><span class="lineno"> 593</span>  limb_t check = point.t[0];</div>
|
||||
<div class="line"><a name="l00594"></a><span class="lineno"> 594</span>  <span class="keywordflow">for</span> (uint8_t posn = 1; posn < NUM_LIMBS_256BIT; ++posn)</div>
|
||||
<div class="line"><a name="l00595"></a><span class="lineno"> 595</span>  check |= point.t[posn];</div>
|
||||
<div class="line"><a name="l00596"></a><span class="lineno"> 596</span>  if (!check) {</div>
|
||||
<div class="line"><a name="l00597"></a><span class="lineno"> 597</span>  <span class="comment">// If the sign bit is set, then decoding has failed.</span></div>
|
||||
<div class="line"><a name="l00598"></a><span class="lineno"> 598</span>  <span class="comment">// Otherwise x is zero and we're done.</span></div>
|
||||
<div class="line"><a name="l00599"></a><span class="lineno"> 599</span>  <span class="keywordflow">if</span> (sign)</div>
|
||||
<div class="line"><a name="l00600"></a><span class="lineno"> 600</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
||||
<div class="line"><a name="l00601"></a><span class="lineno"> 601</span>  memset(point.x, 0, <span class="keyword">sizeof</span>(point.x));</div>
|
||||
<div class="line"><a name="l00602"></a><span class="lineno"> 602</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00603"></a><span class="lineno"> 603</span>  }</div>
|
||||
<div class="line"><a name="l00604"></a><span class="lineno"> 604</span> </div>
|
||||
<div class="line"><a name="l00605"></a><span class="lineno"> 605</span>  <span class="comment">// Recover x by taking the sqrt of t and flipping the sign if necessary.</span></div>
|
||||
<div class="line"><a name="l00606"></a><span class="lineno"> 606</span>  <span class="keywordflow">if</span> (!Curve25519::sqrt(point.x, point.t))</div>
|
||||
<div class="line"><a name="l00607"></a><span class="lineno"> 607</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
||||
<div class="line"><a name="l00608"></a><span class="lineno"> 608</span>  <span class="keywordflow">if</span> (sign != (point.x[0] & ((limb_t)1))) {</div>
|
||||
<div class="line"><a name="l00609"></a><span class="lineno"> 609</span>  <span class="comment">// The signs are different so we want the other square root.</span></div>
|
||||
<div class="line"><a name="l00610"></a><span class="lineno"> 610</span>  memset(point.t, 0, <span class="keyword">sizeof</span>(point.t));</div>
|
||||
<div class="line"><a name="l00611"></a><span class="lineno"> 611</span>  Curve25519::sub(point.x, point.t, point.x);</div>
|
||||
<div class="line"><a name="l00612"></a><span class="lineno"> 612</span>  }</div>
|
||||
<div class="line"><a name="l00613"></a><span class="lineno"> 613</span> </div>
|
||||
<div class="line"><a name="l00614"></a><span class="lineno"> 614</span>  <span class="comment">// Finally, t = x * y.</span></div>
|
||||
<div class="line"><a name="l00615"></a><span class="lineno"> 615</span>  Curve25519::mul(point.t, point.x, point.y);</div>
|
||||
<div class="line"><a name="l00616"></a><span class="lineno"> 616</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
||||
<div class="line"><a name="l00617"></a><span class="lineno"> 617</span> }</div>
|
||||
<div class="line"><a name="l00618"></a><span class="lineno"> 618</span> </div>
|
||||
<div class="line"><a name="l00629"></a><span class="lineno"> 629</span> <span class="keywordtype">void</span> Ed25519::deriveKeys(<a class="code" href="classSHA512.html">SHA512</a> *hash, limb_t *a, <span class="keyword">const</span> uint8_t privateKey[32])</div>
|
||||
<div class="line"><a name="l00630"></a><span class="lineno"> 630</span> {</div>
|
||||
<div class="line"><a name="l00631"></a><span class="lineno"> 631</span>  <span class="comment">// Hash the private key to get the "a" scalar and the message prefix.</span></div>
|
||||
<div class="line"><a name="l00632"></a><span class="lineno"> 632</span>  uint8_t *buf = (uint8_t *)(hash->state.w); <span class="comment">// Reuse hash buffer to save memory.</span></div>
|
||||
<div class="line"><a name="l00633"></a><span class="lineno"> 633</span>  hash-><a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
||||
<div class="line"><a name="l00634"></a><span class="lineno"> 634</span>  hash-><a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(privateKey, 32);</div>
|
||||
<div class="line"><a name="l00635"></a><span class="lineno"> 635</span>  hash-><a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(buf, 0);</div>
|
||||
<div class="line"><a name="l00636"></a><span class="lineno"> 636</span>  buf[0] &= 0xF8;</div>
|
||||
<div class="line"><a name="l00637"></a><span class="lineno"> 637</span>  buf[31] &= 0x7F;</div>
|
||||
<div class="line"><a name="l00638"></a><span class="lineno"> 638</span>  buf[31] |= 0x40;</div>
|
||||
<div class="line"><a name="l00639"></a><span class="lineno"> 639</span> </div>
|
||||
<div class="line"><a name="l00640"></a><span class="lineno"> 640</span>  <span class="comment">// Unpack the first half of the hash value into "a".</span></div>
|
||||
<div class="line"><a name="l00641"></a><span class="lineno"> 641</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(a, NUM_LIMBS_256BIT, buf, 32);</div>
|
||||
<div class="line"><a name="l00642"></a><span class="lineno"> 642</span> }</div>
|
||||
<div class="ttc" id="classBigNumberUtil_html_a00c9cde0b626788a60552a6bc9ce058b"><div class="ttname"><a href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a></div><div class="ttdeci">static void reduceQuick_P(limb_t *result, const limb_t *x, const limb_t *y, size_t size)</div><div class="ttdoc">Reduces x modulo y using subtraction where y is in program memory. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00620">BigNumberUtil.cpp:620</a></div></div>
|
||||
<div class="ttc" id="classEd25519_html_ab8be5115ac5adc8a556dbac7d7e90d2e"><div class="ttname"><a href="classEd25519.html#ab8be5115ac5adc8a556dbac7d7e90d2e">Ed25519::generatePrivateKey</a></div><div class="ttdeci">static void generatePrivateKey(uint8_t privateKey[32])</div><div class="ttdoc">Generates a private key for Ed25519 signing operations. </div><div class="ttdef"><b>Definition:</b> <a href="Ed25519_8cpp_source.html#l00243">Ed25519.cpp:243</a></div></div>
|
||||
<div class="ttc" id="classBigNumberUtil_html_aa6904b2727af6b767fe041b1b7f27414"><div class="ttname"><a href="classBigNumberUtil.html#aa6904b2727af6b767fe041b1b7f27414">BigNumberUtil::add</a></div><div class="ttdeci">static limb_t add(limb_t *result, const limb_t *x, const limb_t *y, size_t size)</div><div class="ttdoc">Adds two big numbers. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00381">BigNumberUtil.cpp:381</a></div></div>
|
||||
@@ -572,7 +571,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
||||
</div><!-- fragment --></div><!-- contents -->
|
||||
<!-- start footer part -->
|
||||
<hr class="footer"/><address class="footer"><small>
|
||||
Generated on Sun Mar 13 2016 08:28:00 for ArduinoLibs by  <a href="http://www.doxygen.org/index.html">
|
||||
Generated on Wed Mar 23 2016 19:08:46 for ArduinoLibs by  <a href="http://www.doxygen.org/index.html">
|
||||
<img class="footer" src="doxygen.png" alt="doxygen"/>
|
||||
</a> 1.8.6
|
||||
</small></address>
|
||||
|
||||
Reference in New Issue
Block a user