mirror of
https://github.com/golang/go
synced 2024-11-26 07:27:59 -07:00
crypto/elliptic: import fiat-crypto P-521 field implementation
Fiat Cryptography (https://github.com/mit-plv/fiat-crypto) is a project that produces prime order field implementations (the code that does arithmetic modulo a prime number) based on a formally verified model. The formal verification covers some of the most subtle and hard to test parts of an elliptic curve implementation, like carry chains. It would probably have prevented #20040 and #43786. This CL imports a 64-bit implementation of the P-521 base field, replacing the horribly slow and catastrophically variable time big.Int CurveParams implementation. The code in p521_fiat64.go is generated reproducibly by fiat-crypto, building and running the Dockerfile according to the README. The code in fiat/p521.go is a thin and idiomatic wrapper around the fiat-crypto code. It includes an Invert method generated with the help of github.com/mmcloughlin/addchain. The code in elliptic/p521.go is a line-by-line port of the CurveParams implementation. Lsh(x, N) was replaced with repeated Add(x, x) calls. Mul(x, x) was replaced with Square(x). Mod calls were removed, as all operations are modulo P. Likewise, Add calls to bring values back to positive were removed. The ScalarMult ladder implementation is now constant time, copied from p224ScalarMult. Only other notable changes are adding a p512Point type to keep (x, y, z) together, and making addJacobian and doubleJacobian methods on that type, with the usual receiver semantics to save 4 allocations per step. This amounts to a proof of concept, and is far from a mature elliptic curve implementation. Here's a non-exhaustive list of things that need improvement, most of which are pre-existing issues with crypto/elliptic. Some of these can be fixed without API change, so can't. - Marshal and Unmarshal still use the slow, variable time big.Int arithmetic. The Curve interface does not expose field operations, so we'll have to make our own abstraction. - Point addition uses an incomplete Jacobian formula, which has variable time behaviors for points at infinity and equal points. There are better, complete formulae these days, but I wanted to keep this CL reviewable against the existing code. - The scalar multiplication ladder is still heavily variable time. This is easy to fix and I'll do it in a follow-up CL, but I wanted to keep this one easier to review. - Fundamentally, values have to go in and out of big.Int representation when they pass through the Curve interface, which is both slow and slightly variable-time. - There is no scalar field implementation, so crypto/ecdsa ends up using big.Int for signing. - Extending this to P-384 would involve either duplicating all P-521 code, or coming up with some lower-level interfaces for the base field. Even better, generics, which would maybe let us save heap allocations due to virtual calls. - The readability and idiomaticity of the autogenerated code can improve, although we have a clear abstraction and well-enforced contract, which makes it unlikely we'll have to resort to manually modifying the code. See mit-plv/fiat-crypto#949. - We could also have a 32-bit implementation, since it's almost free to have fiat-crypto generate one. Anyway, it's definitely better than CurveParams, and definitely faster. name old time/op new time/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 4.18ms ± 3% 0.86ms ± 2% -79.50% (p=0.000 n=10+9) ScalarMult/P521-8 4.17ms ± 2% 0.85ms ± 6% -79.68% (p=0.000 n=10+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 4.23ms ± 1% 0.94ms ± 0% -77.70% (p=0.000 n=9+8) Verify/P521-8 8.31ms ± 2% 1.75ms ± 4% -78.99% (p=0.000 n=9+10) GenerateKey/P521-8 4.15ms ± 2% 0.85ms ± 2% -79.49% (p=0.000 n=10+9) name old alloc/op new alloc/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 3.06MB ± 3% 0.00MB ± 0% -99.97% (p=0.000 n=10+10) ScalarMult/P521-8 3.05MB ± 1% 0.00MB ± 0% -99.97% (p=0.000 n=9+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 3.03MB ± 0% 0.01MB ± 0% -99.74% (p=0.000 n=10+8) Verify/P521-8 6.06MB ± 1% 0.00MB ± 0% -99.93% (p=0.000 n=9+9) GenerateKey/P521-8 3.02MB ± 0% 0.00MB ± 0% -99.96% (p=0.000 n=9+10) name old allocs/op new allocs/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 19.8k ± 3% 0.0k ± 0% -99.95% (p=0.000 n=10+10) ScalarMult/P521-8 19.7k ± 1% 0.0k ± 0% -99.95% (p=0.000 n=9+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 19.6k ± 0% 0.1k ± 0% -99.63% (p=0.000 n=10+10) Verify/P521-8 39.2k ± 1% 0.1k ± 0% -99.84% (p=0.000 n=9+10) GenerateKey/P521-8 19.5k ± 0% 0.0k ± 0% -99.91% (p=0.000 n=9+10) Updates #40171 Change-Id: Ic898b09a2388382bf51ec007d9a79d72d44efe10 Reviewed-on: https://go-review.googlesource.com/c/go/+/315271 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Katie Hockman <katie@golang.org> Trust: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda
parent
ec4efa4208
commit
14c3d2aa59
@ -390,7 +390,6 @@ func UnmarshalCompressed(curve Curve, data []byte) (x, y *big.Int) {
|
|||||||
|
|
||||||
var initonce sync.Once
|
var initonce sync.Once
|
||||||
var p384 *CurveParams
|
var p384 *CurveParams
|
||||||
var p521 *CurveParams
|
|
||||||
|
|
||||||
func initAll() {
|
func initAll() {
|
||||||
initP224()
|
initP224()
|
||||||
@ -410,17 +409,6 @@ func initP384() {
|
|||||||
p384.BitSize = 384
|
p384.BitSize = 384
|
||||||
}
|
}
|
||||||
|
|
||||||
func initP521() {
|
|
||||||
// See FIPS 186-3, section D.2.5
|
|
||||||
p521 = &CurveParams{Name: "P-521"}
|
|
||||||
p521.P, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151", 10)
|
|
||||||
p521.N, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449", 10)
|
|
||||||
p521.B, _ = new(big.Int).SetString("051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00", 16)
|
|
||||||
p521.Gx, _ = new(big.Int).SetString("c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66", 16)
|
|
||||||
p521.Gy, _ = new(big.Int).SetString("11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650", 16)
|
|
||||||
p521.BitSize = 521
|
|
||||||
}
|
|
||||||
|
|
||||||
// P256 returns a Curve which implements NIST P-256 (FIPS 186-3, section D.2.3),
|
// P256 returns a Curve which implements NIST P-256 (FIPS 186-3, section D.2.3),
|
||||||
// also known as secp256r1 or prime256v1. The CurveParams.Name of this Curve is
|
// also known as secp256r1 or prime256v1. The CurveParams.Name of this Curve is
|
||||||
// "P-256".
|
// "P-256".
|
||||||
|
|||||||
12
src/crypto/elliptic/internal/fiat/Dockerfile
Normal file
12
src/crypto/elliptic/internal/fiat/Dockerfile
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
# Copyright 2021 The Go Authors. All rights reserved.
|
||||||
|
# Use of this source code is governed by a BSD-style
|
||||||
|
# license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
FROM coqorg/coq:8.13.2
|
||||||
|
|
||||||
|
RUN git clone https://github.com/mit-plv/fiat-crypto
|
||||||
|
RUN cd fiat-crypto && git checkout c076f3550bea2bb7f4cb5766a32594b9e67694f2
|
||||||
|
RUN cd fiat-crypto && git submodule update --init --recursive
|
||||||
|
RUN cd fiat-crypto && eval $(opam env) && make -j4 standalone-ocaml SKIP_BEDROCK2=1
|
||||||
|
|
||||||
|
ENTRYPOINT ["fiat-crypto/src/ExtractionOCaml/unsaturated_solinas"]
|
||||||
39
src/crypto/elliptic/internal/fiat/README
Normal file
39
src/crypto/elliptic/internal/fiat/README
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
The code in this package was autogenerated by the fiat-crypto project
|
||||||
|
at commit c076f3550 from a formally verified model.
|
||||||
|
|
||||||
|
docker build -t fiat-crypto:c076f3550 .
|
||||||
|
docker run fiat-crypto:c076f3550 --lang Go --no-wide-int --cmovznz-by-mul \
|
||||||
|
--internal-static --public-function-case camelCase --public-type-case camelCase \
|
||||||
|
--private-function-case camelCase --private-type-case camelCase \
|
||||||
|
--no-prefix-fiat --package-name fiat --doc-text-before-function-name '' \
|
||||||
|
--doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' \
|
||||||
|
--doc-newline-before-package-declaration p521 64 9 '2^521 - 1' \
|
||||||
|
carry_mul carry_square carry add sub to_bytes from_bytes selectznz \
|
||||||
|
> p521_fiat64.go
|
||||||
|
|
||||||
|
It comes under the following license.
|
||||||
|
|
||||||
|
Copyright (c) 2015-2020 The fiat-crypto Authors. All rights reserved.
|
||||||
|
|
||||||
|
Redistribution and use in source and binary forms, with or without
|
||||||
|
modification, are permitted provided that the following conditions are
|
||||||
|
met:
|
||||||
|
|
||||||
|
1. Redistributions of source code must retain the above copyright
|
||||||
|
notice, this list of conditions and the following disclaimer.
|
||||||
|
|
||||||
|
THIS SOFTWARE IS PROVIDED BY the fiat-crypto authors "AS IS"
|
||||||
|
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
|
||||||
|
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Berkeley Software Design,
|
||||||
|
Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
||||||
|
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||||
|
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
||||||
|
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||||
|
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
||||||
|
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||||
|
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
|
||||||
|
The authors are listed at
|
||||||
|
|
||||||
|
https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS
|
||||||
197
src/crypto/elliptic/internal/fiat/p521.go
Normal file
197
src/crypto/elliptic/internal/fiat/p521.go
Normal file
@ -0,0 +1,197 @@
|
|||||||
|
// Copyright 2021 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
// Package fiat implements prime order fields using formally verified algorithms
|
||||||
|
// from the Fiat Cryptography project.
|
||||||
|
package fiat
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/subtle"
|
||||||
|
"errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// P521Element is an integer modulo 2^521 - 1.
|
||||||
|
//
|
||||||
|
// The zero value is a valid zero element.
|
||||||
|
type P521Element struct {
|
||||||
|
// This element has the following bounds, which are tighter than
|
||||||
|
// the output bounds of some operations. Those operations must be
|
||||||
|
// followed by a carry.
|
||||||
|
//
|
||||||
|
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000],
|
||||||
|
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000],
|
||||||
|
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x200000000000000]
|
||||||
|
x [9]uint64
|
||||||
|
}
|
||||||
|
|
||||||
|
// One sets e = 1, and returns e.
|
||||||
|
func (e *P521Element) One() *P521Element {
|
||||||
|
*e = P521Element{}
|
||||||
|
e.x[0] = 1
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Equal returns 1 if e == t, and zero otherwise.
|
||||||
|
func (e *P521Element) Equal(t *P521Element) int {
|
||||||
|
eBytes := e.Bytes()
|
||||||
|
tBytes := t.Bytes()
|
||||||
|
return subtle.ConstantTimeCompare(eBytes, tBytes)
|
||||||
|
}
|
||||||
|
|
||||||
|
var p521ZeroEncoding = new(P521Element).Bytes()
|
||||||
|
|
||||||
|
// IsZero returns 1 if e == 0, and zero otherwise.
|
||||||
|
func (e *P521Element) IsZero() int {
|
||||||
|
eBytes := e.Bytes()
|
||||||
|
return subtle.ConstantTimeCompare(eBytes, p521ZeroEncoding)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Set sets e = t, and returns e.
|
||||||
|
func (e *P521Element) Set(t *P521Element) *P521Element {
|
||||||
|
e.x = t.x
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Bytes returns the 66-byte little-endian encoding of e.
|
||||||
|
func (e *P521Element) Bytes() []byte {
|
||||||
|
// This function must be inlined to move the allocation to the parent and
|
||||||
|
// save it from escaping to the heap.
|
||||||
|
var out [66]byte
|
||||||
|
p521ToBytes(&out, &e.x)
|
||||||
|
return out[:]
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetBytes sets e = v, where v is a little-endian 66-byte encoding, and returns
|
||||||
|
// e. If v is not 66 bytes or it encodes a value higher than 2^521 - 1, SetBytes
|
||||||
|
// returns nil and an error, and e is unchanged.
|
||||||
|
func (e *P521Element) SetBytes(v []byte) (*P521Element, error) {
|
||||||
|
if len(v) != 66 || v[65] > 1 {
|
||||||
|
return nil, errors.New("invalid P-521 field encoding")
|
||||||
|
}
|
||||||
|
var in [66]byte
|
||||||
|
copy(in[:], v)
|
||||||
|
p521FromBytes(&e.x, &in)
|
||||||
|
return e, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Add sets e = t1 + t2, and returns e.
|
||||||
|
func (e *P521Element) Add(t1, t2 *P521Element) *P521Element {
|
||||||
|
p521Add(&e.x, &t1.x, &t2.x)
|
||||||
|
p521Carry(&e.x, &e.x)
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Sub sets e = t1 - t2, and returns e.
|
||||||
|
func (e *P521Element) Sub(t1, t2 *P521Element) *P521Element {
|
||||||
|
p521Sub(&e.x, &t1.x, &t2.x)
|
||||||
|
p521Carry(&e.x, &e.x)
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Mul sets e = t1 * t2, and returns e.
|
||||||
|
func (e *P521Element) Mul(t1, t2 *P521Element) *P521Element {
|
||||||
|
p521CarryMul(&e.x, &t1.x, &t2.x)
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Square sets e = t * t, and returns e.
|
||||||
|
func (e *P521Element) Square(t *P521Element) *P521Element {
|
||||||
|
p521CarrySquare(&e.x, &t.x)
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
// Select sets e to a if cond == 1, and to b if cond == 0.
|
||||||
|
func (v *P521Element) Select(a, b *P521Element, cond int) *P521Element {
|
||||||
|
p521Selectznz(&v.x, p521Uint1(cond), &b.x, &a.x)
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
|
||||||
|
// Invert sets e = 1/t, and returns e.
|
||||||
|
//
|
||||||
|
// If t == 0, Invert returns e = 0.
|
||||||
|
func (e *P521Element) Invert(t *P521Element) *P521Element {
|
||||||
|
// Inversion is implemented as exponentiation with exponent p − 2.
|
||||||
|
// The sequence of multiplications and squarings was generated with
|
||||||
|
// github.com/mmcloughlin/addchain v0.2.0.
|
||||||
|
|
||||||
|
var t1, t2 = new(P521Element), new(P521Element)
|
||||||
|
|
||||||
|
// _10 = 2 * 1
|
||||||
|
t1.Square(t)
|
||||||
|
|
||||||
|
// _11 = 1 + _10
|
||||||
|
t1.Mul(t, t1)
|
||||||
|
|
||||||
|
// _1100 = _11 << 2
|
||||||
|
t2.Square(t1)
|
||||||
|
t2.Square(t2)
|
||||||
|
|
||||||
|
// _1111 = _11 + _1100
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// _11110000 = _1111 << 4
|
||||||
|
t2.Square(t1)
|
||||||
|
for i := 0; i < 3; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
|
||||||
|
// _11111111 = _1111 + _11110000
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x16 = _11111111<<8 + _11111111
|
||||||
|
t2.Square(t1)
|
||||||
|
for i := 0; i < 7; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x32 = x16<<16 + x16
|
||||||
|
t2.Square(t1)
|
||||||
|
for i := 0; i < 15; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x64 = x32<<32 + x32
|
||||||
|
t2.Square(t1)
|
||||||
|
for i := 0; i < 31; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x65 = 2*x64 + 1
|
||||||
|
t2.Square(t1)
|
||||||
|
t2.Mul(t2, t)
|
||||||
|
|
||||||
|
// x129 = x65<<64 + x64
|
||||||
|
for i := 0; i < 64; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x130 = 2*x129 + 1
|
||||||
|
t2.Square(t1)
|
||||||
|
t2.Mul(t2, t)
|
||||||
|
|
||||||
|
// x259 = x130<<129 + x129
|
||||||
|
for i := 0; i < 129; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// x260 = 2*x259 + 1
|
||||||
|
t2.Square(t1)
|
||||||
|
t2.Mul(t2, t)
|
||||||
|
|
||||||
|
// x519 = x260<<259 + x259
|
||||||
|
for i := 0; i < 259; i++ {
|
||||||
|
t2.Square(t2)
|
||||||
|
}
|
||||||
|
t1.Mul(t1, t2)
|
||||||
|
|
||||||
|
// return x519<<2 + 1
|
||||||
|
t1.Square(t1)
|
||||||
|
t1.Square(t1)
|
||||||
|
return e.Mul(t1, t)
|
||||||
|
}
|
||||||
1856
src/crypto/elliptic/internal/fiat/p521_fiat64.go
Normal file
1856
src/crypto/elliptic/internal/fiat/p521_fiat64.go
Normal file
File diff suppressed because it is too large
Load Diff
37
src/crypto/elliptic/internal/fiat/p521_test.go
Normal file
37
src/crypto/elliptic/internal/fiat/p521_test.go
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
// Copyright 2021 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package fiat_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/elliptic/internal/fiat"
|
||||||
|
"crypto/rand"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func p521Random(t *testing.T) *fiat.P521Element {
|
||||||
|
buf := make([]byte, 66)
|
||||||
|
if _, err := rand.Read(buf); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
buf[65] &= 1
|
||||||
|
e, err := new(fiat.P521Element).SetBytes(buf)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestP521Invert(t *testing.T) {
|
||||||
|
a := p521Random(t)
|
||||||
|
inv := new(fiat.P521Element).Invert(a)
|
||||||
|
one := new(fiat.P521Element).Mul(a, inv)
|
||||||
|
if new(fiat.P521Element).One().Equal(one) != 1 {
|
||||||
|
t.Errorf("a * 1/a != 1; got %x for %x", one.Bytes(), a.Bytes())
|
||||||
|
}
|
||||||
|
inv.Invert(new(fiat.P521Element))
|
||||||
|
if new(fiat.P521Element).Equal(inv) != 1 {
|
||||||
|
t.Errorf("1/0 != 0; got %x", inv.Bytes())
|
||||||
|
}
|
||||||
|
}
|
||||||
254
src/crypto/elliptic/p521.go
Normal file
254
src/crypto/elliptic/p521.go
Normal file
@ -0,0 +1,254 @@
|
|||||||
|
// Copyright 2013 The Go Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package elliptic
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/elliptic/internal/fiat"
|
||||||
|
"math/big"
|
||||||
|
)
|
||||||
|
|
||||||
|
type p521Curve struct {
|
||||||
|
*CurveParams
|
||||||
|
}
|
||||||
|
|
||||||
|
var p521 p521Curve
|
||||||
|
var p521Params *CurveParams
|
||||||
|
|
||||||
|
func initP521() {
|
||||||
|
// See FIPS 186-3, section D.2.5
|
||||||
|
p521.CurveParams = &CurveParams{Name: "P-521"}
|
||||||
|
p521.P, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151", 10)
|
||||||
|
p521.N, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449", 10)
|
||||||
|
p521.B, _ = new(big.Int).SetString("051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00", 16)
|
||||||
|
p521.Gx, _ = new(big.Int).SetString("c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66", 16)
|
||||||
|
p521.Gy, _ = new(big.Int).SetString("11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650", 16)
|
||||||
|
p521.BitSize = 521
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) Params() *CurveParams {
|
||||||
|
return curve.CurveParams
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) IsOnCurve(x, y *big.Int) bool {
|
||||||
|
x1 := bigIntToFiatP521(x)
|
||||||
|
y1 := bigIntToFiatP521(y)
|
||||||
|
b := bigIntToFiatP521(curve.B) // TODO: precompute this value.
|
||||||
|
|
||||||
|
// x³ - 3x + b.
|
||||||
|
x3 := new(fiat.P521Element).Square(x1)
|
||||||
|
x3.Mul(x3, x1)
|
||||||
|
|
||||||
|
threeX := new(fiat.P521Element).Add(x1, x1)
|
||||||
|
threeX.Add(threeX, x1)
|
||||||
|
|
||||||
|
x3.Sub(x3, threeX)
|
||||||
|
x3.Add(x3, b)
|
||||||
|
|
||||||
|
// y² = x³ - 3x + b
|
||||||
|
y2 := new(fiat.P521Element).Square(y1)
|
||||||
|
|
||||||
|
return x3.Equal(y2) == 1
|
||||||
|
}
|
||||||
|
|
||||||
|
type p512Point struct {
|
||||||
|
x, y, z *fiat.P521Element
|
||||||
|
}
|
||||||
|
|
||||||
|
func fiatP521ToBigInt(x *fiat.P521Element) *big.Int {
|
||||||
|
xBytes := x.Bytes()
|
||||||
|
for i := range xBytes[:len(xBytes)/2] {
|
||||||
|
xBytes[i], xBytes[len(xBytes)-i-1] = xBytes[len(xBytes)-i-1], xBytes[i]
|
||||||
|
}
|
||||||
|
return new(big.Int).SetBytes(xBytes)
|
||||||
|
}
|
||||||
|
|
||||||
|
// affineFromJacobian brings a point in Jacobian coordinates back to affine
|
||||||
|
// coordinates, with (0, 0) representing infinity by convention. It also goes
|
||||||
|
// back to big.Int values to match the exposed API.
|
||||||
|
func (curve p521Curve) affineFromJacobian(p *p512Point) (x, y *big.Int) {
|
||||||
|
if p.z.IsZero() == 1 {
|
||||||
|
return new(big.Int), new(big.Int)
|
||||||
|
}
|
||||||
|
|
||||||
|
zinv := new(fiat.P521Element).Invert(p.z)
|
||||||
|
zinvsq := new(fiat.P521Element).Mul(zinv, zinv)
|
||||||
|
|
||||||
|
xx := new(fiat.P521Element).Mul(p.x, zinvsq)
|
||||||
|
zinvsq.Mul(zinvsq, zinv)
|
||||||
|
yy := new(fiat.P521Element).Mul(p.y, zinvsq)
|
||||||
|
|
||||||
|
return fiatP521ToBigInt(xx), fiatP521ToBigInt(yy)
|
||||||
|
}
|
||||||
|
|
||||||
|
func bigIntToFiatP521(x *big.Int) *fiat.P521Element {
|
||||||
|
xBytes := new(big.Int).Mod(x, p521.P).FillBytes(make([]byte, 66))
|
||||||
|
for i := range xBytes[:len(xBytes)/2] {
|
||||||
|
xBytes[i], xBytes[len(xBytes)-i-1] = xBytes[len(xBytes)-i-1], xBytes[i]
|
||||||
|
}
|
||||||
|
x1, err := new(fiat.P521Element).SetBytes(xBytes)
|
||||||
|
if err != nil {
|
||||||
|
// The input is reduced modulo P and encoded in a fixed size bytes
|
||||||
|
// slice, this should be impossible.
|
||||||
|
panic("internal error: bigIntToFiatP521")
|
||||||
|
}
|
||||||
|
return x1
|
||||||
|
}
|
||||||
|
|
||||||
|
// jacobianFromAffine converts (x, y) affine coordinates into (x, y, z) Jacobian
|
||||||
|
// coordinates. It also converts from big.Int to fiat, which is necessarily a
|
||||||
|
// messy and variable-time operation, which we can't avoid due to the exposed API.
|
||||||
|
func (curve p521Curve) jacobianFromAffine(x, y *big.Int) *p512Point {
|
||||||
|
// (0, 0) is by convention the point at infinity, which can't be represented
|
||||||
|
// in affine coordinates, but is (0, 0, 0) in Jacobian.
|
||||||
|
if x.Sign() == 0 && y.Sign() == 0 {
|
||||||
|
return &p512Point{
|
||||||
|
x: new(fiat.P521Element),
|
||||||
|
y: new(fiat.P521Element),
|
||||||
|
z: new(fiat.P521Element),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return &p512Point{
|
||||||
|
x: bigIntToFiatP521(x),
|
||||||
|
y: bigIntToFiatP521(y),
|
||||||
|
z: new(fiat.P521Element).One(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
|
||||||
|
p1 := curve.jacobianFromAffine(x1, y1)
|
||||||
|
p2 := curve.jacobianFromAffine(x2, y2)
|
||||||
|
return curve.affineFromJacobian(p1.addJacobian(p1, p2))
|
||||||
|
}
|
||||||
|
|
||||||
|
// addJacobian sets q = p1 + p2, and returns q. The points may overlap.
|
||||||
|
func (q *p512Point) addJacobian(p1, p2 *p512Point) *p512Point {
|
||||||
|
// https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
|
||||||
|
if p1.z.IsZero() == 1 {
|
||||||
|
q.x.Set(p2.x)
|
||||||
|
q.y.Set(p2.y)
|
||||||
|
q.z.Set(p2.z)
|
||||||
|
return q
|
||||||
|
}
|
||||||
|
if p2.z.IsZero() == 1 {
|
||||||
|
q.x.Set(p1.x)
|
||||||
|
q.y.Set(p1.y)
|
||||||
|
q.z.Set(p1.z)
|
||||||
|
return q
|
||||||
|
}
|
||||||
|
|
||||||
|
z1z1 := new(fiat.P521Element).Square(p1.z)
|
||||||
|
z2z2 := new(fiat.P521Element).Square(p2.z)
|
||||||
|
|
||||||
|
u1 := new(fiat.P521Element).Mul(p1.x, z2z2)
|
||||||
|
u2 := new(fiat.P521Element).Mul(p2.x, z1z1)
|
||||||
|
h := new(fiat.P521Element).Sub(u2, u1)
|
||||||
|
xEqual := h.IsZero() == 1
|
||||||
|
i := new(fiat.P521Element).Add(h, h)
|
||||||
|
i.Square(i)
|
||||||
|
j := new(fiat.P521Element).Mul(h, i)
|
||||||
|
|
||||||
|
s1 := new(fiat.P521Element).Mul(p1.y, p2.z)
|
||||||
|
s1.Mul(s1, z2z2)
|
||||||
|
s2 := new(fiat.P521Element).Mul(p2.y, p1.z)
|
||||||
|
s2.Mul(s2, z1z1)
|
||||||
|
r := new(fiat.P521Element).Sub(s2, s1)
|
||||||
|
yEqual := r.IsZero() == 1
|
||||||
|
if xEqual && yEqual {
|
||||||
|
return q.doubleJacobian(p1)
|
||||||
|
}
|
||||||
|
r.Add(r, r)
|
||||||
|
v := new(fiat.P521Element).Mul(u1, i)
|
||||||
|
|
||||||
|
q.x.Set(r)
|
||||||
|
q.x.Square(q.x)
|
||||||
|
q.x.Sub(q.x, j)
|
||||||
|
q.x.Sub(q.x, v)
|
||||||
|
q.x.Sub(q.x, v)
|
||||||
|
|
||||||
|
q.y.Set(r)
|
||||||
|
v.Sub(v, q.x)
|
||||||
|
q.y.Mul(q.y, v)
|
||||||
|
s1.Mul(s1, j)
|
||||||
|
s1.Add(s1, s1)
|
||||||
|
q.y.Sub(q.y, s1)
|
||||||
|
|
||||||
|
q.z.Add(p1.z, p2.z)
|
||||||
|
q.z.Square(q.z)
|
||||||
|
q.z.Sub(q.z, z1z1)
|
||||||
|
q.z.Sub(q.z, z2z2)
|
||||||
|
q.z.Mul(q.z, h)
|
||||||
|
|
||||||
|
return q
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
|
||||||
|
p := curve.jacobianFromAffine(x1, y1)
|
||||||
|
return curve.affineFromJacobian(p.doubleJacobian(p))
|
||||||
|
}
|
||||||
|
|
||||||
|
// doubleJacobian sets q = p + p, and returns q. The points may overlap.
|
||||||
|
func (q *p512Point) doubleJacobian(p *p512Point) *p512Point {
|
||||||
|
// https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
|
||||||
|
delta := new(fiat.P521Element).Square(p.z)
|
||||||
|
gamma := new(fiat.P521Element).Square(p.y)
|
||||||
|
alpha := new(fiat.P521Element).Sub(p.x, delta)
|
||||||
|
alpha2 := new(fiat.P521Element).Add(p.x, delta)
|
||||||
|
alpha.Mul(alpha, alpha2)
|
||||||
|
alpha2.Set(alpha)
|
||||||
|
alpha.Add(alpha, alpha)
|
||||||
|
alpha.Add(alpha, alpha2)
|
||||||
|
|
||||||
|
beta := alpha2.Mul(p.x, gamma)
|
||||||
|
|
||||||
|
q.x.Square(alpha)
|
||||||
|
beta8 := new(fiat.P521Element).Add(beta, beta)
|
||||||
|
beta8.Add(beta8, beta8)
|
||||||
|
beta8.Add(beta8, beta8)
|
||||||
|
q.x.Sub(q.x, beta8)
|
||||||
|
|
||||||
|
q.z.Add(p.y, p.z)
|
||||||
|
q.z.Square(q.z)
|
||||||
|
q.z.Sub(q.z, gamma)
|
||||||
|
q.z.Sub(q.z, delta)
|
||||||
|
|
||||||
|
beta.Add(beta, beta)
|
||||||
|
beta.Add(beta, beta)
|
||||||
|
beta.Sub(beta, q.x)
|
||||||
|
q.y.Mul(alpha, beta)
|
||||||
|
|
||||||
|
gamma.Square(gamma)
|
||||||
|
gamma.Add(gamma, gamma)
|
||||||
|
gamma.Add(gamma, gamma)
|
||||||
|
gamma.Add(gamma, gamma)
|
||||||
|
|
||||||
|
q.y.Sub(q.y, gamma)
|
||||||
|
|
||||||
|
return q
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
|
||||||
|
B := curve.jacobianFromAffine(Bx, By)
|
||||||
|
p := &p512Point{
|
||||||
|
x: new(fiat.P521Element),
|
||||||
|
y: new(fiat.P521Element),
|
||||||
|
z: new(fiat.P521Element),
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, byte := range k {
|
||||||
|
for bitNum := 0; bitNum < 8; bitNum++ {
|
||||||
|
p.doubleJacobian(p)
|
||||||
|
if byte&0x80 == 0x80 {
|
||||||
|
p.addJacobian(B, p)
|
||||||
|
}
|
||||||
|
byte <<= 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return curve.affineFromJacobian(p)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (curve p521Curve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
|
||||||
|
return curve.ScalarMult(curve.Gx, curve.Gy, k)
|
||||||
|
}
|
||||||
@ -392,6 +392,7 @@ var depsRules = `
|
|||||||
< crypto
|
< crypto
|
||||||
< crypto/subtle
|
< crypto/subtle
|
||||||
< crypto/internal/subtle
|
< crypto/internal/subtle
|
||||||
|
< crypto/elliptic/internal/fiat
|
||||||
< crypto/ed25519/internal/edwards25519/field
|
< crypto/ed25519/internal/edwards25519/field
|
||||||
< crypto/ed25519/internal/edwards25519
|
< crypto/ed25519/internal/edwards25519
|
||||||
< crypto/cipher
|
< crypto/cipher
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user