Black Lives Matter. Support the Equal Justice Initiative.

Source file src/vendor/golang.org/x/crypto/curve25519/curve25519.go

Documentation: vendor/golang.org/x/crypto/curve25519

     1  // Copyright 2019 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package curve25519 provides an implementation of the X25519 function, which
     6  // performs scalar multiplication on the elliptic curve known as Curve25519.
     7  // See RFC 7748.
     8  package curve25519 // import "golang.org/x/crypto/curve25519"
     9  
    10  import (
    11  	"crypto/subtle"
    12  	"fmt"
    13  )
    14  
    15  // ScalarMult sets dst to the product scalar * point.
    16  //
    17  // Deprecated: when provided a low-order point, ScalarMult will set dst to all
    18  // zeroes, irrespective of the scalar. Instead, use the X25519 function, which
    19  // will return an error.
    20  func ScalarMult(dst, scalar, point *[32]byte) {
    21  	scalarMult(dst, scalar, point)
    22  }
    23  
    24  // ScalarBaseMult sets dst to the product scalar * base where base is the
    25  // standard generator.
    26  //
    27  // It is recommended to use the X25519 function with Basepoint instead, as
    28  // copying into fixed size arrays can lead to unexpected bugs.
    29  func ScalarBaseMult(dst, scalar *[32]byte) {
    30  	ScalarMult(dst, scalar, &basePoint)
    31  }
    32  
    33  const (
    34  	// ScalarSize is the size of the scalar input to X25519.
    35  	ScalarSize = 32
    36  	// PointSize is the size of the point input to X25519.
    37  	PointSize = 32
    38  )
    39  
    40  // Basepoint is the canonical Curve25519 generator.
    41  var Basepoint []byte
    42  
    43  var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
    44  
    45  func init() { Basepoint = basePoint[:] }
    46  
    47  func checkBasepoint() {
    48  	if subtle.ConstantTimeCompare(Basepoint, []byte{
    49  		0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    50  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    51  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    52  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    53  	}) != 1 {
    54  		panic("curve25519: global Basepoint value was modified")
    55  	}
    56  }
    57  
    58  // X25519 returns the result of the scalar multiplication (scalar * point),
    59  // according to RFC 7748, Section 5. scalar, point and the return value are
    60  // slices of 32 bytes.
    61  //
    62  // scalar can be generated at random, for example with crypto/rand. point should
    63  // be either Basepoint or the output of another X25519 call.
    64  //
    65  // If point is Basepoint (but not if it's a different slice with the same
    66  // contents) a precomputed implementation might be used for performance.
    67  func X25519(scalar, point []byte) ([]byte, error) {
    68  	// Outline the body of function, to let the allocation be inlined in the
    69  	// caller, and possibly avoid escaping to the heap.
    70  	var dst [32]byte
    71  	return x25519(&dst, scalar, point)
    72  }
    73  
    74  func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
    75  	var in [32]byte
    76  	if l := len(scalar); l != 32 {
    77  		return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32)
    78  	}
    79  	if l := len(point); l != 32 {
    80  		return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32)
    81  	}
    82  	copy(in[:], scalar)
    83  	if &point[0] == &Basepoint[0] {
    84  		checkBasepoint()
    85  		ScalarBaseMult(dst, &in)
    86  	} else {
    87  		var base, zero [32]byte
    88  		copy(base[:], point)
    89  		ScalarMult(dst, &in, &base)
    90  		if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 {
    91  			return nil, fmt.Errorf("bad input point: low order point")
    92  		}
    93  	}
    94  	return dst[:], nil
    95  }
    96  

View as plain text