Black Lives Matter. Support the Equal Justice Initiative.

# Source file src/vendor/golang.org/x/crypto/curve25519/curve25519.go

## Documentation: vendor/golang.org/x/crypto/curve25519

```     1  // Copyright 2019 The Go Authors. All rights reserved.
2  // Use of this source code is governed by a BSD-style
4
5  // Package curve25519 provides an implementation of the X25519 function, which
6  // performs scalar multiplication on the elliptic curve known as Curve25519.
7  // See RFC 7748.
8  package curve25519 // import "golang.org/x/crypto/curve25519"
9
10  import (
11  	"crypto/subtle"
12  	"fmt"
13  )
14
15  // ScalarMult sets dst to the product scalar * point.
16  //
17  // Deprecated: when provided a low-order point, ScalarMult will set dst to all
18  // zeroes, irrespective of the scalar. Instead, use the X25519 function, which
19  // will return an error.
20  func ScalarMult(dst, scalar, point *[32]byte) {
21  	scalarMult(dst, scalar, point)
22  }
23
24  // ScalarBaseMult sets dst to the product scalar * base where base is the
25  // standard generator.
26  //
27  // It is recommended to use the X25519 function with Basepoint instead, as
28  // copying into fixed size arrays can lead to unexpected bugs.
29  func ScalarBaseMult(dst, scalar *[32]byte) {
30  	ScalarMult(dst, scalar, &basePoint)
31  }
32
33  const (
34  	// ScalarSize is the size of the scalar input to X25519.
35  	ScalarSize = 32
36  	// PointSize is the size of the point input to X25519.
37  	PointSize = 32
38  )
39
40  // Basepoint is the canonical Curve25519 generator.
41  var Basepoint []byte
42
43  var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
44
45  func init() { Basepoint = basePoint[:] }
46
47  func checkBasepoint() {
48  	if subtle.ConstantTimeCompare(Basepoint, []byte{
49  		0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
50  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
51  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
52  		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
53  	}) != 1 {
54  		panic("curve25519: global Basepoint value was modified")
55  	}
56  }
57
58  // X25519 returns the result of the scalar multiplication (scalar * point),
59  // according to RFC 7748, Section 5. scalar, point and the return value are
60  // slices of 32 bytes.
61  //
62  // scalar can be generated at random, for example with crypto/rand. point should
63  // be either Basepoint or the output of another X25519 call.
64  //
65  // If point is Basepoint (but not if it's a different slice with the same
66  // contents) a precomputed implementation might be used for performance.
67  func X25519(scalar, point []byte) ([]byte, error) {
68  	// Outline the body of function, to let the allocation be inlined in the
69  	// caller, and possibly avoid escaping to the heap.
70  	var dst [32]byte
71  	return x25519(&dst, scalar, point)
72  }
73
74  func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
75  	var in [32]byte
76  	if l := len(scalar); l != 32 {
77  		return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32)
78  	}
79  	if l := len(point); l != 32 {
80  		return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32)
81  	}
82  	copy(in[:], scalar)
83  	if &point[0] == &Basepoint[0] {
84  		checkBasepoint()
85  		ScalarBaseMult(dst, &in)
86  	} else {
87  		var base, zero [32]byte
88  		copy(base[:], point)
89  		ScalarMult(dst, &in, &base)
90  		if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 {
91  			return nil, fmt.Errorf("bad input point: low order point")
92  		}
93  	}
94  	return dst[:], nil
95  }
96
```

View as plain text