jmg
/
ed448goldilocks
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
Browse Source

trying to make C++ headers the same, for future unified generation

master
Michael Hamburg 9 years ago
parent
a3b094eb99
commit
6e95e69368
2 changed files with 237 additions and 205 deletions
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +107
    -91
      src/public_include/decaf/decaf_255.hxx
  2. +130
    -114
      src/public_include/decaf/decaf_448.hxx

+ 107
- 91
src/public_include/decaf/decaf_255.hxx View File

@@ -24,7 +24,7 @@

/** This code uses posix_memalign. */
#ifndef _XOPEN_SOURCE
#define _XOPEN_SOURCE 600
#define _XOPEN_SOURCE 600
#endif
#include <stdlib.h>
#include <string.h> /* for memcpy */
@@ -49,7 +49,7 @@ namespace decaf {
* @brief Curve25519/Decaf instantiation of group.
*/
struct IsoEd25519 {
/** The name of the curve */
static inline const char *name() { return "IsoEd25519"; }

@@ -73,52 +73,52 @@ class Scalar : public Serializable<Scalar> {
private:
/** @brief wrapped C type */
typedef decaf_255_scalar_t Wrapped;
public:
/** @brief Size of a serialized element */
static const size_t SER_BYTES = DECAF_255_SCALAR_BYTES;
/** @brief access to the underlying scalar object */
Wrapped s;
/** @brief Don't initialize. */
inline Scalar(const NOINIT &) NOEXCEPT {}
/** @brief Set to an unsigned word */
inline Scalar(const decaf_word_t w) NOEXCEPT { *this = w; }

/** @brief Set to a signed word */
inline Scalar(const int w) NOEXCEPT { *this = w; }
inline Scalar(const int w) NOEXCEPT { *this = w; }
/** @brief Construct from RNG */
inline explicit Scalar(Rng &rng) NOEXCEPT {
FixedArrayBuffer<SER_BYTES> sb(rng);
*this = sb;
}
/** @brief Construct from decaf_scalar_t object. */
inline Scalar(const Wrapped &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); }
inline Scalar(const Wrapped &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); }
/** @brief Copy constructor. */
inline Scalar(const Scalar &x) NOEXCEPT { *this = x; }
/** @brief Construct from arbitrary-length little-endian byte sequence. */
inline Scalar(const Block &buffer) NOEXCEPT { *this = buffer; }

/** @brief Serializable instance */
inline size_t serSize() const NOEXCEPT { return SER_BYTES; }
/** @brief Serializable instance */
inline void serializeInto(unsigned char *buffer) const NOEXCEPT {
decaf_255_scalar_encode(buffer, s);
}
/** @brief Assignment. */
inline Scalar& operator=(const Scalar &x) NOEXCEPT { decaf_255_scalar_copy(s,x.s); return *this; }
/** @brief Assign from unsigned word. */
inline Scalar& operator=(decaf_word_t w) NOEXCEPT { decaf_255_scalar_set_unsigned(s,w); return *this; }
/** @brief Assign from signed int. */
inline Scalar& operator=(int w) NOEXCEPT {
Scalar t(-(decaf_word_t)INT_MIN);
@@ -126,15 +126,15 @@ public:
*this -= t;
return *this;
}
/** Destructor securely zeorizes the scalar. */
inline ~Scalar() NOEXCEPT { decaf_255_scalar_destroy(s); }
/** @brief Assign from arbitrary-length little-endian byte sequence in a Block. */
inline Scalar &operator=(const Block &bl) NOEXCEPT {
decaf_255_scalar_decode_long(s,bl.data(),bl.size()); return *this;
}
/**
* @brief Decode from correct-length little-endian byte sequence.
* @return DECAF_FAILURE if the scalar is greater than or equal to the group order q.
@@ -144,28 +144,28 @@ public:
) NOEXCEPT {
return decaf_255_scalar_decode(sc.s,buffer.data());
}
/** Add. */
inline Scalar operator+ (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_add(r.s,s,q.s); return r; }
/** Add to this. */
inline Scalar &operator+=(const Scalar &q) NOEXCEPT { decaf_255_scalar_add(s,s,q.s); return *this; }
/** Subtract. */
inline Scalar operator- (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_sub(r.s,s,q.s); return r; }
/** Subtract from this. */
inline Scalar &operator-=(const Scalar &q) NOEXCEPT { decaf_255_scalar_sub(s,s,q.s); return *this; }
/** Multiply */
inline Scalar operator* (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_mul(r.s,s,q.s); return r; }
/** Multiply into this. */
inline Scalar &operator*=(const Scalar &q) NOEXCEPT { decaf_255_scalar_mul(s,s,q.s); return *this; }
/** Negate */
inline Scalar operator- () const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_sub(r.s,decaf_255_scalar_zero,s); return r; }
/** @brief Invert with Fermat's Little Theorem (slow!). If *this == 0, return 0. */
inline Scalar inverse() const throw(CryptoException) {
Scalar r;
@@ -174,30 +174,30 @@ public:
}
return r;
}
/** @brief Divide by inverting q. If q == 0, return 0. */
inline Scalar operator/ (const Scalar &q) const throw(CryptoException) { return *this * q.inverse(); }
/** @brief Divide by inverting q. If q == 0, return 0. */
inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); }
/** @brief Compare in constant time */
inline bool operator!=(const Scalar &q) const NOEXCEPT { return !(*this == q); }
/** @brief Compare in constant time */
inline bool operator==(const Scalar &q) const NOEXCEPT { return !!decaf_255_scalar_eq(s,q.s); }
/** @brief Scalarmul with scalar on left. */
inline Point operator* (const Point &q) const NOEXCEPT { return q * (*this); }
/** @brief Scalarmul-precomputed with scalar on left. */
inline Point operator* (const Precomputed &q) const NOEXCEPT { return q * (*this); }
/** @brief Direct scalar multiplication. */
inline SecureBuffer direct_scalarmul(
const Block &in,
decaf_bool_t allow_identity=DECAF_FALSE,
decaf_bool_t short_circuit=DECAF_TRUE
decaf_bool_t short_circuit=DECAF_TRUE
) const throw(CryptoException);
};

@@ -205,36 +205,38 @@ public:
* @brief Element of prime-order group.
*/
class Point : public Serializable<Point> {
public:
private:
/** @brief wrapped C type */
typedef decaf_255_point_t Wrapped;
public:
/** @brief Size of a serialized element */
static const size_t SER_BYTES = DECAF_255_SER_BYTES;
/** @brief Bytes required for hash */
static const size_t HASH_BYTES = SER_BYTES;
/** @brief Size of a stegged element */
static const size_t STEG_BYTES = HASH_BYTES * 2;
/** The c-level object. */
Wrapped p;
/** @brief Don't initialize. */
inline Point(const NOINIT &) NOEXCEPT {}
/** @brief Constructor sets to identity by default. */
inline Point(const Wrapped &q = decaf_255_point_identity) NOEXCEPT { decaf_255_point_copy(p,q); }
/** @brief Copy constructor. */
inline Point(const Point &q) NOEXCEPT { *this = q; }
/** @brief Assignment. */
inline Point& operator=(const Point &q) NOEXCEPT { decaf_255_point_copy(p,q.p); return *this; }
/** @brief Destructor securely zeorizes the point. */
inline ~Point() NOEXCEPT { decaf_255_point_destroy(p); }
/** @brief Construct from RNG */
inline explicit Point(Rng &rng, bool uniform = true) NOEXCEPT {
if (uniform) {
@@ -245,7 +247,7 @@ public:
set_to_hash(b);
}
}
/**
* @brief Initialize from a fixed-length byte string.
* The all-zero string maps to the identity.
@@ -267,13 +269,13 @@ public:
* @retval DECAF_SUCCESS the string was successfully decoded.
* @return DECAF_FAILURE the string was the wrong length, or wasn't the encoding of a point,
* or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined.
*/
*/
static inline decaf_error_t __attribute__((warn_unused_result)) decode (
Point &p, const FixedBlock<SER_BYTES> &buffer, decaf_bool_t allow_identity=DECAF_TRUE
) NOEXCEPT {
return decaf_255_point_decode(p.p,buffer.data(),allow_identity);
}
/**
* @brief Map uniformly to the curve from a hash buffer.
* The empty or all-zero string maps to the identity, as does the string "\x01".
@@ -306,70 +308,79 @@ public:
}
}

/**
* @brief Encode to string. The identity encodes to the all-zero string.
*/
inline operator SecureBuffer() const {
SecureBuffer buffer(SER_BYTES);
decaf_255_point_encode(buffer.data(), p);
return buffer;
}

/** @brief Serializable instance */
inline size_t serSize() const NOEXCEPT { return SER_BYTES; }
/** @brief Serializable instance */
inline void serializeInto(unsigned char *buffer) const NOEXCEPT {
decaf_255_point_encode(buffer, p);
}
/** @brief Point add. */
inline Point operator+ (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_add(r.p,p,q.p); return r; }
/** @brief Point add. */
inline Point &operator+=(const Point &q) NOEXCEPT { decaf_255_point_add(p,p,q.p); return *this; }
/** @brief Point subtract. */
inline Point operator- (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_sub(r.p,p,q.p); return r; }
/** @brief Point subtract. */
inline Point &operator-=(const Point &q) NOEXCEPT { decaf_255_point_sub(p,p,q.p); return *this; }
/** @brief Point negate. */
inline Point operator- () const NOEXCEPT { Point r((NOINIT())); decaf_255_point_negate(r.p,p); return r; }
/** @brief Double the point out of place. */
inline Point times_two () const NOEXCEPT { Point r((NOINIT())); decaf_255_point_double(r.p,p); return r; }
/** @brief Double the point in place. */
inline Point &double_in_place() NOEXCEPT { decaf_255_point_double(p,p); return *this; }
/** @brief Constant-time compare. */
inline bool operator!=(const Point &q) const NOEXCEPT { return ! decaf_255_point_eq(p,q.p); }

/** @brief Constant-time compare. */
inline bool operator==(const Point &q) const NOEXCEPT { return !!decaf_255_point_eq(p,q.p); }
/** @brief Scalar multiply. */
inline Point operator* (const Scalar &s) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_scalarmul(r.p,p,s.s); return r; }
/** @brief Scalar multiply in place. */
inline Point &operator*=(const Scalar &s) NOEXCEPT { decaf_255_point_scalarmul(p,p,s.s); return *this; }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); }
inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); }
/** @brief Validate / sanity check */
inline bool validate() const NOEXCEPT { return decaf_255_point_valid(p); }
/** @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. */
static inline Point double_scalarmul (
const Point &q, const Scalar &qs, const Point &r, const Scalar &rs
) NOEXCEPT {
Point p((NOINIT())); decaf_255_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p;
}
/** @brief Dual-scalar multiply, equivalent to this*r1, this*r2 but faster. */
inline void dual_scalarmul (
Point &q1, Point &q2, const Scalar &r1, const Scalar &r2
) const NOEXCEPT {
decaf_255_point_dual_scalarmul(q1.p,q2.p,p,r1.s,r2.s);
}
/**
* @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster.
* For those who like their scalars before the point.
@@ -379,7 +390,7 @@ public:
) NOEXCEPT {
return double_scalarmul(q,qs,r,rs);
}
/**
* @brief Double-scalar multiply: this point by the first scalar and base by the second scalar.
* @warning This function takes variable time, and may leak the scalars (or points, but currently
@@ -388,22 +399,27 @@ public:
inline Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) NOEXCEPT {
Point r((NOINIT())); decaf_255_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r;
}
/** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */
inline Point debugging_torque() const NOEXCEPT {
Point q; decaf_255_point_debugging_torque(q.p,p); return q;
Point q;
decaf_255_point_debugging_torque(q.p,p);
return q;
}
/** @brief Return a point equal to *this, whose internal data has a modified representation. */
inline Point debugging_pscale(const FixedBlock<SER_BYTES> factor) const NOEXCEPT {
Point q; decaf_255_point_debugging_pscale(q.p,p,factor.data()); return q;
Point q;
decaf_255_point_debugging_pscale(q.p,p,factor.data());
return q;
}
/** @brief Return a point equal to *this, whose internal data has a randomized representation. */
inline Point debugging_pscale(Rng &r) const NOEXCEPT {
FixedArrayBuffer<SER_BYTES> sb(r); return debugging_pscale(sb);
FixedArrayBuffer<SER_BYTES> sb(r);
return debugging_pscale(sb);
}
/**
* Modify buffer so that Point::from_hash(Buffer) == *this, and return DECAF_SUCCESS;
* or leave buf unmodified and return DECAF_FAILURE.
@@ -430,7 +446,7 @@ public:
decaf_bzero(buf2,sizeof(buf2));
return decaf_succeed_if(ret);
}
/** @brief Steganographically encode this */
inline SecureBuffer steg_encode(Rng &rng, size_t size=STEG_BYTES) const throw(std::bad_alloc, LengthException) {
if (size <= HASH_BYTES + 4 || size > 2*HASH_BYTES) throw LengthException();
@@ -438,14 +454,14 @@ public:
decaf_error_t done;
do {
rng.read(Buffer(out).slice(HASH_BYTES-1,STEG_BYTES-HASH_BYTES+1));
done = invert_elligator(out, out[HASH_BYTES-1]);
done = invert_elligator(out, out[HASH_BYTES-1]);
} while (!decaf_successful(done));
return out;
}
/** @brief Return the base point */
static inline const Point base() NOEXCEPT { return Point(decaf_255_point_base); }
/** @brief Return the identity point */
static inline const Point identity() NOEXCEPT { return Point(decaf_255_point_identity); }
};
@@ -466,10 +482,10 @@ class Precomputed
/** @endcond */
{
public:
/** Destructor securely zeorizes the memory. */
inline ~Precomputed() NOEXCEPT { clear(); }
/**
* @brief Initialize from underlying type, declared as a reference to prevent
* it from being called with 0, thereby breaking override.
@@ -480,11 +496,11 @@ public:
*
* @warning The empty initializer makes this equal to base, unlike the empty
* initializer for points which makes this equal to the identity.
*/
*/
inline Precomputed (
const Precomputed_U &yours = *defaultValue()
) NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>(yours) {}

#if __cplusplus >= 201103L
/** @brief Move-assign operator */
@@ -492,19 +508,19 @@ public:
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
/** @brief Move constructor */
inline Precomputed(Precomputed &&it) NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>() {
*this = it;
}
/** @brief Undelete copy operator */
inline Precomputed &operator=(const Precomputed &it) NOEXCEPT {
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
#endif
/**
* @brief Initilaize from point. Must allocate memory, and may throw.
*/
@@ -513,25 +529,25 @@ public:
decaf_255_precompute(ours.mine,it.p);
return *this;
}
/**
* @brief Copy constructor.
*/
inline Precomputed(const Precomputed &it) throw(std::bad_alloc)
inline Precomputed(const Precomputed &it) throw(std::bad_alloc)
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
/**
* @brief Constructor which initializes from point.
*/
inline explicit Precomputed(const Point &it) throw(std::bad_alloc)
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
/** @brief Fixed base scalarmul. */
inline Point operator* (const Scalar &s) const NOEXCEPT { Point r; decaf_255_precomputed_scalarmul(r.p,get(),s.s); return r; }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); }
/** @brief Return the table for the base point. */
static inline const Precomputed base() NOEXCEPT { return Precomputed(); }



+ 130
- 114
src/public_include/decaf/decaf_448.hxx View File

@@ -49,7 +49,7 @@ namespace decaf {
* @brief Ed448-Goldilocks/Decaf instantiation of group.
*/
struct Ed448Goldilocks {
/** The name of the curve */
static inline const char *name() { return "Ed448-Goldilocks"; }

@@ -72,44 +72,53 @@ class Scalar : public Serializable<Scalar> {
private:
/** @brief wrapped C type */
typedef decaf_448_scalar_t Wrapped;
public:
/** @brief Size of a serialized element */
static const size_t SER_BYTES = DECAF_448_SCALAR_BYTES;
/** @brief access to the underlying scalar object */
Wrapped s;
/** @brief Don't initialize. */
inline Scalar(const NOINIT &) NOEXCEPT {}
/** @brief Set to an unsigned word */
inline Scalar(const decaf_word_t w) NOEXCEPT { *this = w; }

/** @brief Set to a signed word */
inline Scalar(const int w) NOEXCEPT { *this = w; }
inline Scalar(const int w) NOEXCEPT { *this = w; }
/** @brief Construct from RNG */
inline explicit Scalar(Rng &rng) NOEXCEPT {
FixedArrayBuffer<SER_BYTES> sb(rng);
*this = sb;
}
/** @brief Construct from decaf_scalar_t object. */
inline Scalar(const decaf_448_scalar_t &t = decaf_448_scalar_zero) NOEXCEPT { decaf_448_scalar_copy(s,t); }
inline Scalar(const Wrapped &t = decaf_448_scalar_zero) NOEXCEPT { decaf_448_scalar_copy(s,t); }
/** @brief Copy constructor. */
inline Scalar(const Scalar &x) NOEXCEPT { *this = x; }
/** @brief Construct from arbitrary-length little-endian byte sequence. */
inline Scalar(const Block &buffer) NOEXCEPT { *this = buffer; }

/** @brief Serializable instance */
inline size_t serSize() const NOEXCEPT { return SER_BYTES; }

/** @brief Serializable instance */
inline void serializeInto(unsigned char *buffer) const NOEXCEPT {
decaf_448_scalar_encode(buffer, s);
}

/** @brief Assignment. */
inline Scalar& operator=(const Scalar &x) NOEXCEPT { decaf_448_scalar_copy(s,x.s); return *this; }
/** @brief Assign from unsigned word. */
inline Scalar& operator=(decaf_word_t w) NOEXCEPT { decaf_448_scalar_set_unsigned(s,w); return *this; }


/** @brief Assign from signed int. */
inline Scalar& operator=(int w) NOEXCEPT {
Scalar t(-(decaf_word_t)INT_MIN);
@@ -117,15 +126,15 @@ public:
*this -= t;
return *this;
}
/** Destructor securely zeorizes the scalar. */
inline ~Scalar() NOEXCEPT { decaf_448_scalar_destroy(s); }
/** @brief Assign from arbitrary-length little-endian byte sequence in a Block. */
inline Scalar &operator=(const Block &bl) NOEXCEPT {
decaf_448_scalar_decode_long(s,bl.data(),bl.size()); return *this;
}
/**
* @brief Decode from correct-length little-endian byte sequence.
* @return DECAF_FAILURE if the scalar is greater than or equal to the group order q.
@@ -135,36 +144,28 @@ public:
) NOEXCEPT {
return decaf_448_scalar_decode(sc.s,buffer.data());
}
/** @brief Serializable instance */
inline size_t serSize() const NOEXCEPT { return SER_BYTES; }
/** @brief Serializable instance */
inline void serializeInto(unsigned char *buffer) const NOEXCEPT {
decaf_448_scalar_encode(buffer, s);
}

/** Add. */
inline Scalar operator+ (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_add(r.s,s,q.s); return r; }

/** Add to this. */
inline Scalar &operator+=(const Scalar &q) NOEXCEPT { decaf_448_scalar_add(s,s,q.s); return *this; }

/** Subtract. */
inline Scalar operator- (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,s,q.s); return r; }
/** Subtract from this. */
inline Scalar &operator-=(const Scalar &q) NOEXCEPT { decaf_448_scalar_sub(s,s,q.s); return *this; }
/** Multiply */
inline Scalar operator* (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_mul(r.s,s,q.s); return r; }
/** Multiply into this. */
inline Scalar &operator*=(const Scalar &q) NOEXCEPT { decaf_448_scalar_mul(s,s,q.s); return *this; }
/** Negate */
inline Scalar operator- () const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,decaf_448_scalar_zero,s); return r; }
/** @brief Invert with Fermat's Little Theorem (slow!). If *this == 0, return 0. */
inline Scalar inverse() const throw(CryptoException) {
Scalar r;
@@ -173,73 +174,69 @@ public:
}
return r;
}
/** @brief Divide by inverting q. If q == 0, return 0. */
inline Scalar operator/ (const Scalar &q) const throw(CryptoException) { return *this * q.inverse(); }
/** @brief Divide by inverting q. If q == 0, return 0. */
inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); }
inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); }
/** @brief Compare in constant time */
inline bool operator!=(const Scalar &q) const NOEXCEPT { return !(*this == q); }
/** @brief Compare in constant time */
inline bool operator==(const Scalar &q) const NOEXCEPT { return !!decaf_448_scalar_eq(s,q.s); }
/** @brief Scalarmul with scalar on left. */
inline Point operator* (const Point &q) const NOEXCEPT { return q * (*this); }
/** @brief Scalarmul-precomputed with scalar on left. */
inline Point operator* (const Precomputed &q) const NOEXCEPT { return q * (*this); }
/** @brief Direct scalar multiplication. */
inline SecureBuffer direct_scalarmul(
const Block &in,
decaf_bool_t allow_identity=DECAF_FALSE,
decaf_bool_t short_circuit=DECAF_TRUE
) const throw(CryptoException) {
SecureBuffer out(Point::SER_BYTES);
if (DECAF_SUCCESS !=
decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit)
) {
throw CryptoException();
}
return out;
}
decaf_bool_t short_circuit=DECAF_TRUE
) const throw(CryptoException);
};

/**
* @brief Element of prime-order group.
*/
class Point : public Serializable<Point> {
private:
/** @brief wrapped C type */
typedef decaf_448_point_t Wrapped;
public:
/** @brief Size of a serialized element */
static const size_t SER_BYTES = DECAF_448_SER_BYTES;
/** @brief Size of a stegged element */
static const size_t STEG_BYTES = DECAF_448_SER_BYTES + 8;

/** @brief Bytes required for hash */
static const size_t HASH_BYTES = DECAF_448_SER_BYTES;
static const size_t HASH_BYTES = SER_BYTES;

/** @brief Size of a stegged element */
static const size_t STEG_BYTES = HASH_BYTES * 2;

/** The c-level object. */
decaf_448_point_t p;
Wrapped p;
/** @brief Don't initialize. */
inline Point(const NOINIT &) NOEXCEPT {}
/** @brief Constructor sets to identity by default. */
inline Point(const decaf_448_point_t &q = decaf_448_point_identity) NOEXCEPT { decaf_448_point_copy(p,q); }
inline Point(const Wrapped &q = decaf_448_point_identity) NOEXCEPT { decaf_448_point_copy(p,q); }
/** @brief Copy constructor. */
inline Point(const Point &q) NOEXCEPT { *this = q; }
/** @brief Assignment. */
inline Point& operator=(const Point &q) NOEXCEPT { decaf_448_point_copy(p,q.p); return *this; }
/** @brief Destructor securely zeorizes the point. */
inline ~Point() NOEXCEPT { decaf_448_point_destroy(p); }
/** @brief Construct from RNG */
inline explicit Point(Rng &rng, bool uniform = true) NOEXCEPT {
if (uniform) {
@@ -250,7 +247,7 @@ public:
set_to_hash(b);
}
}
/**
* @brief Initialize from a fixed-length byte string.
* The all-zero string maps to the identity.
@@ -260,9 +257,11 @@ public:
*/
inline explicit Point(const FixedBlock<SER_BYTES> &buffer, decaf_bool_t allow_identity=DECAF_TRUE)
throw(CryptoException) {
if (DECAF_SUCCESS != decode(*this,buffer,allow_identity)) throw CryptoException();
if (DECAF_SUCCESS != decode(*this,buffer,allow_identity)) {
throw CryptoException();
}
}
/**
* @brief Initialize from C++ fixed-length byte string.
* The all-zero string maps to the identity.
@@ -270,13 +269,13 @@ public:
* @retval DECAF_SUCCESS the string was successfully decoded.
* @return DECAF_FAILURE the string was the wrong length, or wasn't the encoding of a point,
* or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined.
*/
*/
static inline decaf_error_t __attribute__((warn_unused_result)) decode (
Point &p, const FixedBlock<SER_BYTES> &buffer, decaf_bool_t allow_identity=DECAF_TRUE
) NOEXCEPT {
return decaf_448_point_decode(p.p,buffer.data(),allow_identity);
}
/**
* @brief Map uniformly to the curve from a hash buffer.
* The empty or all-zero string maps to the identity, as does the string "\x01".
@@ -308,66 +307,66 @@ public:
decaf_448_point_from_hash_uniform(p,s.data());
}
}
/**
* @brief Encode to string. The identity encodes to the all-zero string.
*/
inline operator SecureBuffer() const NOEXCEPT {
inline operator SecureBuffer() const {
SecureBuffer buffer(SER_BYTES);
decaf_448_point_encode(buffer.data(), p);
return buffer;
}
/** @brief Serializable instance */
inline size_t serSize() const NOEXCEPT { return SER_BYTES; }
/** @brief Serializable instance */
inline void serializeInto(unsigned char *buffer) const NOEXCEPT {
decaf_448_point_encode(buffer, p);
}
/** @brief Point add. */
inline Point operator+ (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_add(r.p,p,q.p); return r; }
/** @brief Point add. */
inline Point &operator+=(const Point &q) NOEXCEPT { decaf_448_point_add(p,p,q.p); return *this; }
/** @brief Point subtract. */
inline Point operator- (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_sub(r.p,p,q.p); return r; }
/** @brief Point subtract. */
inline Point &operator-=(const Point &q) NOEXCEPT { decaf_448_point_sub(p,p,q.p); return *this; }
/** @brief Point negate. */
inline Point operator- () const NOEXCEPT { Point r((NOINIT())); decaf_448_point_negate(r.p,p); return r; }
/** @brief Double the point out of place. */
inline Point times_two () const NOEXCEPT { Point r((NOINIT())); decaf_448_point_double(r.p,p); return r; }
/** @brief Double the point in place. */
inline Point &double_in_place() NOEXCEPT { decaf_448_point_double(p,p); return *this; }
/** @brief Constant-time compare. */
inline bool operator!=(const Point &q) const NOEXCEPT { return ! decaf_448_point_eq(p,q.p); }

/** @brief Constant-time compare. */
inline bool operator==(const Point &q) const NOEXCEPT { return !!decaf_448_point_eq(p,q.p); }
/** @brief Scalar multiply. */
inline Point operator* (const Scalar &s) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_scalarmul(r.p,p,s.s); return r; }
/** @brief Scalar multiply in place. */
inline Point &operator*=(const Scalar &s) NOEXCEPT { decaf_448_point_scalarmul(p,p,s.s); return *this; }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); }
/** @brief Validate / sanity check */
inline bool validate() const NOEXCEPT { return decaf_448_point_valid(p); }
/** @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. */
static inline Point double_scalarmul (
const Point &q, const Scalar &qs, const Point &r, const Scalar &rs
@@ -381,7 +380,7 @@ public:
) const NOEXCEPT {
decaf_448_point_dual_scalarmul(q1.p,q2.p,p,r1.s,r2.s);
}
/**
* @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster.
* For those who like their scalars before the point.
@@ -389,9 +388,9 @@ public:
static inline Point double_scalarmul (
const Scalar &qs, const Point &q, const Scalar &rs, const Point &r
) NOEXCEPT {
Point p((NOINIT())); decaf_448_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p;
return double_scalarmul(q,qs,r,rs);
}
/**
* @brief Double-scalar multiply: this point by the first scalar and base by the second scalar.
* @warning This function takes variable time, and may leak the scalars (or points, but currently
@@ -400,27 +399,27 @@ public:
inline Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) NOEXCEPT {
Point r((NOINIT())); decaf_448_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r;
}
/** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */
inline Point debugging_torque() const NOEXCEPT {
Point q;
decaf_448_point_debugging_torque(q.p,p);
return q;
}
/** @brief Return a point equal to *this, whose internal data has a modified representation. */
inline Point debugging_pscale(const FixedBlock<SER_BYTES> factor) const NOEXCEPT {
Point q;
decaf_448_point_debugging_pscale(q.p,p,factor.data());
return q;
}
/** @brief Return a point equal to *this, whose internal data has a randomized representation. */
inline Point debugging_pscale(Rng &r) const NOEXCEPT {
FixedArrayBuffer<SER_BYTES> sb(r);
return debugging_pscale(sb);
}
/**
* Modify buffer so that Point::from_hash(Buffer) == *this, and return DECAF_SUCCESS;
* or leave buf unmodified and return DECAF_FAILURE.
@@ -447,21 +446,22 @@ public:
decaf_bzero(buf2,sizeof(buf2));
return decaf_succeed_if(ret);
}
/** @brief Steganographically encode this */
inline SecureBuffer steg_encode(Rng &rng) const throw(std::bad_alloc) {
inline SecureBuffer steg_encode(Rng &rng, size_t size=STEG_BYTES) const throw(std::bad_alloc, LengthException) {
if (size <= HASH_BYTES + 4 || size > 2*HASH_BYTES) throw LengthException();
SecureBuffer out(STEG_BYTES);
decaf_error_t done;
do {
rng.read(Buffer(out).slice(HASH_BYTES-1,STEG_BYTES-HASH_BYTES+1));
done = invert_elligator(out, out[HASH_BYTES-1]);
done = invert_elligator(out, out[HASH_BYTES-1]);
} while (!decaf_successful(done));
return out;
}
/** @brief Return the base point */
static inline const Point base() NOEXCEPT { return Point(decaf_448_point_base); }
/** @brief Return the identity point */
static inline const Point identity() NOEXCEPT { return Point(decaf_448_point_identity); }
};
@@ -482,10 +482,10 @@ class Precomputed
/** @endcond */
{
public:
/** Destructor securely zeorizes the memory. */
inline ~Precomputed() NOEXCEPT { clear(); }
/**
* @brief Initialize from underlying type, declared as a reference to prevent
* it from being called with 0, thereby breaking override.
@@ -496,11 +496,11 @@ public:
*
* @warning The empty initializer makes this equal to base, unlike the empty
* initializer for points which makes this equal to the identity.
*/
*/
inline Precomputed (
const Precomputed_U &yours = *defaultValue()
) NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>(yours) {}

#if __cplusplus >= 201103L
/** @brief Move-assign operator */
@@ -508,19 +508,19 @@ public:
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
/** @brief Move constructor */
inline Precomputed(Precomputed &&it) NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>() {
*this = it;
}
/** @brief Undelete copy operator */
inline Precomputed &operator=(const Precomputed &it) NOEXCEPT {
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
#endif
/**
* @brief Initilaize from point. Must allocate memory, and may throw.
*/
@@ -529,25 +529,25 @@ public:
decaf_448_precompute(ours.mine,it.p);
return *this;
}
/**
* @brief Copy constructor.
*/
inline Precomputed(const Precomputed &it) throw(std::bad_alloc)
inline Precomputed(const Precomputed &it) throw(std::bad_alloc)
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
/**
* @brief Constructor which initializes from point.
*/
inline explicit Precomputed(const Point &it) throw(std::bad_alloc)
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
/** @brief Fixed base scalarmul. */
inline Point operator* (const Scalar &s) const NOEXCEPT { Point r; decaf_448_precomputed_scalarmul(r.p,get(),s.s); return r; }
/** @brief Multiply by s.inverse(). If s=0, maps to the identity. */
inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); }
/** @brief Return the table for the base point. */
static inline const Precomputed base() NOEXCEPT { return Precomputed(); }

@@ -560,7 +560,23 @@ public:
/** @endcond */
};

}; /* struct Decaf448 */
}; /* struct Ed448Goldilocks */

/** @cond internal */
inline SecureBuffer Ed448Goldilocks::Scalar::direct_scalarmul (
const Block &in,
decaf_bool_t allow_identity,
decaf_bool_t short_circuit
) const throw(CryptoException) {
SecureBuffer out(Ed448Goldilocks::Point::SER_BYTES);
if (DECAF_SUCCESS !=
decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit)
) {
throw CryptoException();
}
return out;
}
/** endcond */

#undef NOEXCEPT
} /* namespace decaf */


Write Preview
Loading…
Cancel
Save