module edwards25519 const ( // d is a constant in the curve equation. d_bytes = [u8(0xa3), 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75, 0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00, 0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c, 0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52] id_bytes = [u8(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] gen_bytes = [u8(0x58), 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66] d_const = d_const_generate() or { panic(err) } d2_const = d2_const_generate() or { panic(err) } // id_point is the point at infinity. id_point = id_point_generate() or { panic(err) } // generator point gen_point = generator() or { panic(err) } ) fn d_const_generate() ?Element { mut v := Element{} v.set_bytes(edwards25519.d_bytes) ? return v } fn d2_const_generate() ?Element { mut v := Element{} v.add(edwards25519.d_const, edwards25519.d_const) return v } // id_point_generate is the point at infinity. fn id_point_generate() ?Point { mut p := Point{} p.set_bytes(edwards25519.id_bytes) ? return p } // generator is the canonical curve basepoint. See TestGenerator for the // correspondence of this encoding with the values in RFC 8032. fn generator() ?Point { mut p := Point{} p.set_bytes(edwards25519.gen_bytes) ? return p } // Point types. struct ProjectiveP1 { mut: x Element y Element z Element t Element } struct ProjectiveP2 { mut: x Element y Element z Element } // Point represents a point on the edwards25519 curve. // // This type works similarly to math/big.Int, and all arguments and receivers // are allowed to alias. // // The zero value is NOT valid, and it may be used only as a receiver. pub struct Point { mut: // The point is internally represented in extended coordinates (x, y, z, T) // where x = x/z, y = y/z, and xy = T/z per https://eprint.iacr.org/2008/522. x Element y Element z Element t Element // Make the type not comparable (i.e. used with == or as a map key), as // equivalent points can be represented by different values. // _ incomparable } fn check_initialized(points ...Point) { for _, p in points { if p.x == fe_zero && p.y == fe_zero { panic('edwards25519: use of uninitialized Point') } } } struct ProjectiveCached { mut: ypx Element // y + x ymx Element // y - x z Element t2d Element } struct AffineCached { mut: ypx Element // y + x ymx Element // y - x t2d Element } fn (mut v ProjectiveP2) zero() ProjectiveP2 { v.x.zero() v.y.one() v.z.one() return v } // set_bytes sets v = x, where x is a 32-byte encoding of v. If x does not // represent a valid point on the curve, set_bytes returns an error and // the receiver is unchanged. Otherwise, set_bytes returns v. // // Note that set_bytes accepts all non-canonical encodings of valid points. // That is, it follows decoding rules that match most implementations in // the ecosystem rather than RFC 8032. pub fn (mut v Point) set_bytes(x []u8) ?Point { // Specifically, the non-canonical encodings that are accepted are // 1) the ones where the edwards25519 element is not reduced (see the // (*edwards25519.Element).set_bytes docs) and // 2) the ones where the x-coordinate is zero and the sign bit is set. // // This is consistent with crypto/ed25519/internal/edwards25519. Read more // at https://hdevalence.ca/blog/2020-10-04-its-25519am, specifically the // "Canonical A, R" section. mut el0 := Element{} y := el0.set_bytes(x) or { return error('edwards25519: invalid point encoding length') } // -x² + y² = 1 + dx²y² // x² + dx²y² = x²(dy² + 1) = y² - 1 // x² = (y² - 1) / (dy² + 1) // u = y² - 1 mut el1 := Element{} y2 := el1.square(y) mut el2 := Element{} u := el2.subtract(y2, fe_one) // v = dy² + 1 mut el3 := Element{} mut vv := el3.multiply(y2, edwards25519.d_const) vv = vv.add(vv, fe_one) // x = +√(u/v) mut el4 := Element{} mut xx, was_square := el4.sqrt_ratio(u, vv) if was_square == 0 { return error('edwards25519: invalid point encoding') } // selected the negative square root if the sign bit is set. mut el5 := Element{} xx_neg := el5.negate(xx) xx.selected(xx_neg, xx, int(x[31] >> 7)) v.x.set(xx) v.y.set(y) v.z.one() v.t.multiply(xx, y) // xy = T / z return v } // set sets v = u, and returns v. pub fn (mut v Point) set(u Point) Point { v = u return v } // new_identity_point returns a new Point set to the identity. pub fn new_identity_point() Point { mut p := Point{} return p.set(edwards25519.id_point) } // new_generator_point returns a new Point set to the canonical generator. pub fn new_generator_point() Point { mut p := Point{} return p.set(edwards25519.gen_point) } fn (mut v ProjectiveCached) zero() ProjectiveCached { v.ypx.one() v.ymx.one() v.z.one() v.t2d.zero() return v } fn (mut v AffineCached) zero() AffineCached { v.ypx.one() v.ymx.one() v.t2d.zero() return v } // Encoding. // bytes returns the canonical 32-byte encoding of v, according to RFC 8032, // Section 5.1.2. pub fn (mut v Point) bytes() []u8 { // This function is outlined to make the allocations inline in the caller // rather than happen on the heap. mut buf := [32]u8{} return v.bytes_generic(mut buf) } fn (mut v Point) bytes_generic(mut buf [32]u8) []u8 { check_initialized(v) mut zinv := Element{} mut x := Element{} mut y := Element{} zinv.invert(v.z) // zinv = 1 / z x.multiply(v.x, zinv) // x = x / z y.multiply(v.y, zinv) // y = y / z mut out := copy_field_element(mut buf, mut y) unsafe { // out[31] |= u8(x.is_negative() << 7) //original one out[31] |= u8(x.is_negative() * 128) // x << 7 == x * 2^7 } return out } fn copy_field_element(mut buf [32]u8, mut v Element) []u8 { // this fail in test /* copy(mut buf[..], v.bytes()) return buf[..] */ // this pass the test mut out := []u8{len: 32} for i := 0; i <= buf.len - 1; i++ { out[i] = v.bytes()[i] } return out } // Conversions. fn (mut v ProjectiveP2) from_p1(p ProjectiveP1) ProjectiveP2 { v.x.multiply(p.x, p.t) v.y.multiply(p.y, p.z) v.z.multiply(p.z, p.t) return v } fn (mut v ProjectiveP2) from_p3(p Point) ProjectiveP2 { v.x.set(p.x) v.y.set(p.y) v.z.set(p.z) return v } fn (mut v Point) from_p1(p ProjectiveP1) Point { v.x.multiply(p.x, p.t) v.y.multiply(p.y, p.z) v.z.multiply(p.z, p.t) v.t.multiply(p.x, p.y) return v } fn (mut v Point) from_p2(p ProjectiveP2) Point { v.x.multiply(p.x, p.z) v.y.multiply(p.y, p.z) v.z.square(p.z) v.t.multiply(p.x, p.y) return v } fn (mut v ProjectiveCached) from_p3(p Point) ProjectiveCached { v.ypx.add(p.y, p.x) v.ymx.subtract(p.y, p.x) v.z.set(p.z) v.t2d.multiply(p.t, edwards25519.d2_const) return v } fn (mut v AffineCached) from_p3(p Point) AffineCached { v.ypx.add(p.y, p.x) v.ymx.subtract(p.y, p.x) v.t2d.multiply(p.t, edwards25519.d2_const) mut invz := Element{} invz.invert(p.z) v.ypx.multiply(v.ypx, invz) v.ymx.multiply(v.ymx, invz) v.t2d.multiply(v.t2d, invz) return v } // (Re)addition and subtraction. // add sets v = p + q, and returns v. pub fn (mut v Point) add(p Point, q Point) Point { check_initialized(p, q) mut pc := ProjectiveCached{} mut p1 := ProjectiveP1{} qcached := pc.from_p3(q) result := p1.add(p, qcached) return v.from_p1(result) } // subtract sets v = p - q, and returns v. pub fn (mut v Point) subtract(p Point, q Point) Point { check_initialized(p, q) mut pc := ProjectiveCached{} mut p1 := ProjectiveP1{} qcached := pc.from_p3(q) result := p1.sub(p, qcached) return v.from_p1(result) } fn (mut v ProjectiveP1) add(p Point, q ProjectiveCached) ProjectiveP1 { // var ypx, ymx, pp, mm, tt2d, zz2 edwards25519.Element mut ypx := Element{} mut ymx := Element{} mut pp := Element{} mut mm := Element{} mut tt2d := Element{} mut zz2 := Element{} ypx.add(p.y, p.x) ymx.subtract(p.y, p.x) pp.multiply(ypx, q.ypx) mm.multiply(ymx, q.ymx) tt2d.multiply(p.t, q.t2d) zz2.multiply(p.z, q.z) zz2.add(zz2, zz2) v.x.subtract(pp, mm) v.y.add(pp, mm) v.z.add(zz2, tt2d) v.t.subtract(zz2, tt2d) return v } fn (mut v ProjectiveP1) sub(p Point, q ProjectiveCached) ProjectiveP1 { mut ypx := Element{} mut ymx := Element{} mut pp := Element{} mut mm := Element{} mut tt2d := Element{} mut zz2 := Element{} ypx.add(p.y, p.x) ymx.subtract(p.y, p.x) pp.multiply(&ypx, q.ymx) // flipped sign mm.multiply(&ymx, q.ypx) // flipped sign tt2d.multiply(p.t, q.t2d) zz2.multiply(p.z, q.z) zz2.add(zz2, zz2) v.x.subtract(pp, mm) v.y.add(pp, mm) v.z.subtract(zz2, tt2d) // flipped sign v.t.add(zz2, tt2d) // flipped sign return v } fn (mut v ProjectiveP1) add_affine(p Point, q AffineCached) ProjectiveP1 { mut ypx := Element{} mut ymx := Element{} mut pp := Element{} mut mm := Element{} mut tt2d := Element{} mut z2 := Element{} ypx.add(p.y, p.x) ymx.subtract(p.y, p.x) pp.multiply(&ypx, q.ypx) mm.multiply(&ymx, q.ymx) tt2d.multiply(p.t, q.t2d) z2.add(p.z, p.z) v.x.subtract(pp, mm) v.y.add(pp, mm) v.z.add(z2, tt2d) v.t.subtract(z2, tt2d) return v } fn (mut v ProjectiveP1) sub_affine(p Point, q AffineCached) ProjectiveP1 { mut ypx := Element{} mut ymx := Element{} mut pp := Element{} mut mm := Element{} mut tt2d := Element{} mut z2 := Element{} ypx.add(p.y, p.x) ymx.subtract(p.y, p.x) pp.multiply(ypx, q.ymx) // flipped sign mm.multiply(ymx, q.ypx) // flipped sign tt2d.multiply(p.t, q.t2d) z2.add(p.z, p.z) v.x.subtract(pp, mm) v.y.add(pp, mm) v.z.subtract(z2, tt2d) // flipped sign v.t.add(z2, tt2d) // flipped sign return v } // Doubling. fn (mut v ProjectiveP1) double(p ProjectiveP2) ProjectiveP1 { // var xx, yy, zz2, xplusysq edwards25519.Element mut xx := Element{} mut yy := Element{} mut zz2 := Element{} mut xplusysq := Element{} xx.square(p.x) yy.square(p.y) zz2.square(p.z) zz2.add(zz2, zz2) xplusysq.add(p.x, p.y) xplusysq.square(xplusysq) v.y.add(yy, xx) v.z.subtract(yy, xx) v.x.subtract(xplusysq, v.y) v.t.subtract(zz2, v.z) return v } // Negation. // negate sets v = -p, and returns v. pub fn (mut v Point) negate(p Point) Point { check_initialized(p) v.x.negate(p.x) v.y.set(p.y) v.z.set(p.z) v.t.negate(p.t) return v } // equal returns 1 if v is equivalent to u, and 0 otherwise. pub fn (mut v Point) equal(u Point) int { check_initialized(v, u) mut t1 := Element{} mut t2 := Element{} mut t3 := Element{} mut t4 := Element{} t1.multiply(v.x, u.z) t2.multiply(u.x, v.z) t3.multiply(v.y, u.z) t4.multiply(u.y, v.z) return t1.equal(t2) & t3.equal(t4) } // Constant-time operations // selected sets v to a if cond == 1 and to b if cond == 0. fn (mut v ProjectiveCached) selected(a ProjectiveCached, b ProjectiveCached, cond int) ProjectiveCached { v.ypx.selected(a.ypx, b.ypx, cond) v.ymx.selected(a.ymx, b.ymx, cond) v.z.selected(a.z, b.z, cond) v.t2d.selected(a.t2d, b.t2d, cond) return v } // selected sets v to a if cond == 1 and to b if cond == 0. fn (mut v AffineCached) selected(a AffineCached, b AffineCached, cond int) AffineCached { v.ypx.selected(a.ypx, b.ypx, cond) v.ymx.selected(a.ymx, b.ymx, cond) v.t2d.selected(a.t2d, b.t2d, cond) return v } // cond_neg negates v if cond == 1 and leaves it unchanged if cond == 0. fn (mut v ProjectiveCached) cond_neg(cond int) ProjectiveCached { mut el := Element{} v.ypx.swap(mut v.ymx, cond) v.t2d.selected(el.negate(v.t2d), v.t2d, cond) return v } // cond_neg negates v if cond == 1 and leaves it unchanged if cond == 0. fn (mut v AffineCached) cond_neg(cond int) AffineCached { mut el := Element{} v.ypx.swap(mut v.ymx, cond) v.t2d.selected(el.negate(v.t2d), v.t2d, cond) return v } fn check_on_curve(points ...Point) bool { for p in points { mut xx := Element{} mut yy := Element{} mut zz := Element{} mut zzzz := Element{} xx.square(p.x) yy.square(p.y) zz.square(p.z) zzzz.square(zz) // -x² + y² = 1 + dx²y² // -(X/Z)² + (Y/Z)² = 1 + d(X/Z)²(Y/Z)² // (-X² + Y²)/Z² = 1 + (dX²Y²)/Z⁴ // (-X² + Y²)*Z² = Z⁴ + dX²Y² mut lhs := Element{} mut rhs := Element{} lhs.subtract(yy, xx) lhs.multiply(lhs, zz) rhs.multiply(edwards25519.d_const, xx) rhs.multiply(rhs, yy) rhs.add(rhs, zzzz) if lhs.equal(rhs) != 1 { return false } /* if lhs.equal(rhs) != 1 { lg.error('X, Y, and Z do not specify a point on the curve\nX = $p.x \nY = $p.y\nZ = $p.z') }*/ // xy = T/Z lhs.multiply(p.x, p.y) rhs.multiply(p.z, p.t) /* if lhs.equal(rhs) != 1 { lg.error('point $i is not valid\nX = $p.x\nY = $p.y\nZ = $p.z') }*/ if lhs.equal(rhs) != 1 { return false } } return true }