|
 |
56d343 |
--- libgo/Makefile.am.jj 2013-12-12 19:01:49.000000000 +0100
|
|
|
56d343 |
+++ libgo/Makefile.am 2014-02-18 17:31:54.798484657 +0100
|
|
|
56d343 |
@@ -1109,8 +1109,7 @@ go_crypto_dsa_files = \
|
|
|
56d343 |
go_crypto_ecdsa_files = \
|
|
|
56d343 |
go/crypto/ecdsa/ecdsa.go
|
|
|
56d343 |
go_crypto_elliptic_files = \
|
|
|
56d343 |
- go/crypto/elliptic/elliptic.go \
|
|
|
56d343 |
- go/crypto/elliptic/p224.go
|
|
|
56d343 |
+ go/crypto/elliptic/elliptic.go
|
|
|
56d343 |
go_crypto_hmac_files = \
|
|
|
56d343 |
go/crypto/hmac/hmac.go
|
|
|
56d343 |
go_crypto_md5_files = \
|
|
|
56d343 |
--- libgo/Makefile.in.jj 2013-12-12 19:01:49.000000000 +0100
|
|
|
56d343 |
+++ libgo/Makefile.in 2014-02-18 17:32:11.350389191 +0100
|
|
|
56d343 |
@@ -1274,8 +1274,7 @@ go_crypto_ecdsa_files = \
|
|
|
56d343 |
go/crypto/ecdsa/ecdsa.go
|
|
|
56d343 |
|
|
|
56d343 |
go_crypto_elliptic_files = \
|
|
|
56d343 |
- go/crypto/elliptic/elliptic.go \
|
|
|
56d343 |
- go/crypto/elliptic/p224.go
|
|
|
56d343 |
+ go/crypto/elliptic/elliptic.go
|
|
|
56d343 |
|
|
|
56d343 |
go_crypto_hmac_files = \
|
|
|
56d343 |
go/crypto/hmac/hmac.go
|
|
|
56d343 |
--- libgo/go/crypto/elliptic/elliptic.go.jj 2012-12-13 11:32:02.640039537 +0100
|
|
|
56d343 |
+++ libgo/go/crypto/elliptic/elliptic.go 2014-02-18 17:28:22.909692022 +0100
|
|
|
56d343 |
@@ -327,7 +327,6 @@ var p384 *CurveParams
|
|
|
56d343 |
var p521 *CurveParams
|
|
|
56d343 |
|
|
|
56d343 |
func initAll() {
|
|
|
56d343 |
- initP224()
|
|
|
56d343 |
initP256()
|
|
|
56d343 |
initP384()
|
|
|
56d343 |
initP521()
|
|
|
56d343 |
--- libgo/go/crypto/elliptic/elliptic_test.go.jj 2012-12-13 11:32:02.640039537 +0100
|
|
|
56d343 |
+++ libgo/go/crypto/elliptic/elliptic_test.go 2014-02-18 17:31:04.052774265 +0100
|
|
|
56d343 |
@@ -5,329 +5,14 @@
|
|
|
56d343 |
package elliptic
|
|
|
56d343 |
|
|
|
56d343 |
import (
|
|
|
56d343 |
- "crypto/rand"
|
|
|
56d343 |
- "encoding/hex"
|
|
|
56d343 |
- "fmt"
|
|
|
56d343 |
- "math/big"
|
|
|
56d343 |
"testing"
|
|
|
56d343 |
)
|
|
|
56d343 |
|
|
|
56d343 |
-func TestOnCurve(t *testing.T) {
|
|
|
56d343 |
- p224 := P224()
|
|
|
56d343 |
- if !p224.IsOnCurve(p224.Params().Gx, p224.Params().Gy) {
|
|
|
56d343 |
- t.Errorf("FAIL")
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-type baseMultTest struct {
|
|
|
56d343 |
- k string
|
|
|
56d343 |
- x, y string
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-var p224BaseMultTests = []baseMultTest{
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "1",
|
|
|
56d343 |
- "b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
|
|
|
56d343 |
- "bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "2",
|
|
|
56d343 |
- "706a46dc76dcb76798e60e6d89474788d16dc18032d268fd1a704fa6",
|
|
|
56d343 |
- "1c2b76a7bc25e7702a704fa986892849fca629487acf3709d2e4e8bb",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "3",
|
|
|
56d343 |
- "df1b1d66a551d0d31eff822558b9d2cc75c2180279fe0d08fd896d04",
|
|
|
56d343 |
- "a3f7f03cadd0be444c0aa56830130ddf77d317344e1af3591981a925",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "4",
|
|
|
56d343 |
- "ae99feebb5d26945b54892092a8aee02912930fa41cd114e40447301",
|
|
|
56d343 |
- "482580a0ec5bc47e88bc8c378632cd196cb3fa058a7114eb03054c9",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "5",
|
|
|
56d343 |
- "31c49ae75bce7807cdff22055d94ee9021fedbb5ab51c57526f011aa",
|
|
|
56d343 |
- "27e8bff1745635ec5ba0c9f1c2ede15414c6507d29ffe37e790a079b",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "6",
|
|
|
56d343 |
- "1f2483f82572251fca975fea40db821df8ad82a3c002ee6c57112408",
|
|
|
56d343 |
- "89faf0ccb750d99b553c574fad7ecfb0438586eb3952af5b4b153c7e",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "7",
|
|
|
56d343 |
- "db2f6be630e246a5cf7d99b85194b123d487e2d466b94b24a03c3e28",
|
|
|
56d343 |
- "f3a30085497f2f611ee2517b163ef8c53b715d18bb4e4808d02b963",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "8",
|
|
|
56d343 |
- "858e6f9cc6c12c31f5df124aa77767b05c8bc021bd683d2b55571550",
|
|
|
56d343 |
- "46dcd3ea5c43898c5c5fc4fdac7db39c2f02ebee4e3541d1e78047a",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "9",
|
|
|
56d343 |
- "2fdcccfee720a77ef6cb3bfbb447f9383117e3daa4a07e36ed15f78d",
|
|
|
56d343 |
- "371732e4f41bf4f7883035e6a79fcedc0e196eb07b48171697517463",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "10",
|
|
|
56d343 |
- "aea9e17a306517eb89152aa7096d2c381ec813c51aa880e7bee2c0fd",
|
|
|
56d343 |
- "39bb30eab337e0a521b6cba1abe4b2b3a3e524c14a3fe3eb116b655f",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "11",
|
|
|
56d343 |
- "ef53b6294aca431f0f3c22dc82eb9050324f1d88d377e716448e507c",
|
|
|
56d343 |
- "20b510004092e96636cfb7e32efded8265c266dfb754fa6d6491a6da",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "12",
|
|
|
56d343 |
- "6e31ee1dc137f81b056752e4deab1443a481033e9b4c93a3044f4f7a",
|
|
|
56d343 |
- "207dddf0385bfdeab6e9acda8da06b3bbef224a93ab1e9e036109d13",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13",
|
|
|
56d343 |
- "34e8e17a430e43289793c383fac9774247b40e9ebd3366981fcfaeca",
|
|
|
56d343 |
- "252819f71c7fb7fbcb159be337d37d3336d7feb963724fdfb0ecb767",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "14",
|
|
|
56d343 |
- "a53640c83dc208603ded83e4ecf758f24c357d7cf48088b2ce01e9fa",
|
|
|
56d343 |
- "d5814cd724199c4a5b974a43685fbf5b8bac69459c9469bc8f23ccaf",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "15",
|
|
|
56d343 |
- "baa4d8635511a7d288aebeedd12ce529ff102c91f97f867e21916bf9",
|
|
|
56d343 |
- "979a5f4759f80f4fb4ec2e34f5566d595680a11735e7b61046127989",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "16",
|
|
|
56d343 |
- "b6ec4fe1777382404ef679997ba8d1cc5cd8e85349259f590c4c66d",
|
|
|
56d343 |
- "3399d464345906b11b00e363ef429221f2ec720d2f665d7dead5b482",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "17",
|
|
|
56d343 |
- "b8357c3a6ceef288310e17b8bfeff9200846ca8c1942497c484403bc",
|
|
|
56d343 |
- "ff149efa6606a6bd20ef7d1b06bd92f6904639dce5174db6cc554a26",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "18",
|
|
|
56d343 |
- "c9ff61b040874c0568479216824a15eab1a838a797d189746226e4cc",
|
|
|
56d343 |
- "ea98d60e5ffc9b8fcf999fab1df7e7ef7084f20ddb61bb045a6ce002",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "19",
|
|
|
56d343 |
- "a1e81c04f30ce201c7c9ace785ed44cc33b455a022f2acdbc6cae83c",
|
|
|
56d343 |
- "dcf1f6c3db09c70acc25391d492fe25b4a180babd6cea356c04719cd",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "20",
|
|
|
56d343 |
- "fcc7f2b45df1cd5a3c0c0731ca47a8af75cfb0347e8354eefe782455",
|
|
|
56d343 |
- "d5d7110274cba7cdee90e1a8b0d394c376a5573db6be0bf2747f530",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "112233445566778899",
|
|
|
56d343 |
- "61f077c6f62ed802dad7c2f38f5c67f2cc453601e61bd076bb46179e",
|
|
|
56d343 |
- "2272f9e9f5933e70388ee652513443b5e289dd135dcc0d0299b225e4",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "112233445566778899112233445566778899",
|
|
|
56d343 |
- "29895f0af496bfc62b6ef8d8a65c88c613949b03668aab4f0429e35",
|
|
|
56d343 |
- "3ea6e53f9a841f2019ec24bde1a75677aa9b5902e61081c01064de93",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "6950511619965839450988900688150712778015737983940691968051900319680",
|
|
|
56d343 |
- "ab689930bcae4a4aa5f5cb085e823e8ae30fd365eb1da4aba9cf0379",
|
|
|
56d343 |
- "3345a121bbd233548af0d210654eb40bab788a03666419be6fbd34e7",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13479972933410060327035789020509431695094902435494295338570602119423",
|
|
|
56d343 |
- "bdb6a8817c1f89da1c2f3dd8e97feb4494f2ed302a4ce2bc7f5f4025",
|
|
|
56d343 |
- "4c7020d57c00411889462d77a5438bb4e97d177700bf7243a07f1680",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13479971751745682581351455311314208093898607229429740618390390702079",
|
|
|
56d343 |
- "d58b61aa41c32dd5eba462647dba75c5d67c83606c0af2bd928446a9",
|
|
|
56d343 |
- "d24ba6a837be0460dd107ae77725696d211446c5609b4595976b16bd",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13479972931865328106486971546324465392952975980343228160962702868479",
|
|
|
56d343 |
- "dc9fa77978a005510980e929a1485f63716df695d7a0c18bb518df03",
|
|
|
56d343 |
- "ede2b016f2ddffc2a8c015b134928275ce09e5661b7ab14ce0d1d403",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "11795773708834916026404142434151065506931607341523388140225443265536",
|
|
|
56d343 |
- "499d8b2829cfb879c901f7d85d357045edab55028824d0f05ba279ba",
|
|
|
56d343 |
- "bf929537b06e4015919639d94f57838fa33fc3d952598dcdbb44d638",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "784254593043826236572847595991346435467177662189391577090",
|
|
|
56d343 |
- "8246c999137186632c5f9eddf3b1b0e1764c5e8bd0e0d8a554b9cb77",
|
|
|
56d343 |
- "e80ed8660bc1cb17ac7d845be40a7a022d3306f116ae9f81fea65947",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13479767645505654746623887797783387853576174193480695826442858012671",
|
|
|
56d343 |
- "6670c20afcceaea672c97f75e2e9dd5c8460e54bb38538ebb4bd30eb",
|
|
|
56d343 |
- "f280d8008d07a4caf54271f993527d46ff3ff46fd1190a3f1faa4f74",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "205688069665150753842126177372015544874550518966168735589597183",
|
|
|
56d343 |
- "eca934247425cfd949b795cb5ce1eff401550386e28d1a4c5a8eb",
|
|
|
56d343 |
- "d4c01040dba19628931bc8855370317c722cbd9ca6156985f1c2e9ce",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "13479966930919337728895168462090683249159702977113823384618282123295",
|
|
|
56d343 |
- "ef353bf5c73cd551b96d596fbc9a67f16d61dd9fe56af19de1fba9cd",
|
|
|
56d343 |
- "21771b9cdce3e8430c09b3838be70b48c21e15bc09ee1f2d7945b91f",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "50210731791415612487756441341851895584393717453129007497216",
|
|
|
56d343 |
- "4036052a3091eb481046ad3289c95d3ac905ca0023de2c03ecd451cf",
|
|
|
56d343 |
- "d768165a38a2b96f812586a9d59d4136035d9c853a5bf2e1c86a4993",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368041",
|
|
|
56d343 |
- "fcc7f2b45df1cd5a3c0c0731ca47a8af75cfb0347e8354eefe782455",
|
|
|
56d343 |
- "f2a28eefd8b345832116f1e574f2c6b2c895aa8c24941f40d8b80ad1",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368042",
|
|
|
56d343 |
- "a1e81c04f30ce201c7c9ace785ed44cc33b455a022f2acdbc6cae83c",
|
|
|
56d343 |
- "230e093c24f638f533dac6e2b6d01da3b5e7f45429315ca93fb8e634",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368043",
|
|
|
56d343 |
- "c9ff61b040874c0568479216824a15eab1a838a797d189746226e4cc",
|
|
|
56d343 |
- "156729f1a003647030666054e208180f8f7b0df2249e44fba5931fff",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368044",
|
|
|
56d343 |
- "b8357c3a6ceef288310e17b8bfeff9200846ca8c1942497c484403bc",
|
|
|
56d343 |
- "eb610599f95942df1082e4f9426d086fb9c6231ae8b24933aab5db",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368045",
|
|
|
56d343 |
- "b6ec4fe1777382404ef679997ba8d1cc5cd8e85349259f590c4c66d",
|
|
|
56d343 |
- "cc662b9bcba6f94ee4ff1c9c10bd6ddd0d138df2d099a282152a4b7f",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368046",
|
|
|
56d343 |
- "baa4d8635511a7d288aebeedd12ce529ff102c91f97f867e21916bf9",
|
|
|
56d343 |
- "6865a0b8a607f0b04b13d1cb0aa992a5a97f5ee8ca1849efb9ed8678",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368047",
|
|
|
56d343 |
- "a53640c83dc208603ded83e4ecf758f24c357d7cf48088b2ce01e9fa",
|
|
|
56d343 |
- "2a7eb328dbe663b5a468b5bc97a040a3745396ba636b964370dc3352",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368048",
|
|
|
56d343 |
- "34e8e17a430e43289793c383fac9774247b40e9ebd3366981fcfaeca",
|
|
|
56d343 |
- "dad7e608e380480434ea641cc82c82cbc92801469c8db0204f13489a",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368049",
|
|
|
56d343 |
- "6e31ee1dc137f81b056752e4deab1443a481033e9b4c93a3044f4f7a",
|
|
|
56d343 |
- "df82220fc7a4021549165325725f94c3410ddb56c54e161fc9ef62ee",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368050",
|
|
|
56d343 |
- "ef53b6294aca431f0f3c22dc82eb9050324f1d88d377e716448e507c",
|
|
|
56d343 |
- "df4aefffbf6d1699c930481cd102127c9a3d992048ab05929b6e5927",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368051",
|
|
|
56d343 |
- "aea9e17a306517eb89152aa7096d2c381ec813c51aa880e7bee2c0fd",
|
|
|
56d343 |
- "c644cf154cc81f5ade49345e541b4d4b5c1adb3eb5c01c14ee949aa2",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368052",
|
|
|
56d343 |
- "2fdcccfee720a77ef6cb3bfbb447f9383117e3daa4a07e36ed15f78d",
|
|
|
56d343 |
- "c8e8cd1b0be40b0877cfca1958603122f1e6914f84b7e8e968ae8b9e",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368053",
|
|
|
56d343 |
- "858e6f9cc6c12c31f5df124aa77767b05c8bc021bd683d2b55571550",
|
|
|
56d343 |
- "fb9232c15a3bc7673a3a03b0253824c53d0fd1411b1cabe2e187fb87",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368054",
|
|
|
56d343 |
- "db2f6be630e246a5cf7d99b85194b123d487e2d466b94b24a03c3e28",
|
|
|
56d343 |
- "f0c5cff7ab680d09ee11dae84e9c1072ac48ea2e744b1b7f72fd469e",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368055",
|
|
|
56d343 |
- "1f2483f82572251fca975fea40db821df8ad82a3c002ee6c57112408",
|
|
|
56d343 |
- "76050f3348af2664aac3a8b05281304ebc7a7914c6ad50a4b4eac383",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368056",
|
|
|
56d343 |
- "31c49ae75bce7807cdff22055d94ee9021fedbb5ab51c57526f011aa",
|
|
|
56d343 |
- "d817400e8ba9ca13a45f360e3d121eaaeb39af82d6001c8186f5f866",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368057",
|
|
|
56d343 |
- "ae99feebb5d26945b54892092a8aee02912930fa41cd114e40447301",
|
|
|
56d343 |
- "fb7da7f5f13a43b81774373c879cd32d6934c05fa758eeb14fcfab38",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368058",
|
|
|
56d343 |
- "df1b1d66a551d0d31eff822558b9d2cc75c2180279fe0d08fd896d04",
|
|
|
56d343 |
- "5c080fc3522f41bbb3f55a97cfecf21f882ce8cbb1e50ca6e67e56dc",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368059",
|
|
|
56d343 |
- "706a46dc76dcb76798e60e6d89474788d16dc18032d268fd1a704fa6",
|
|
|
56d343 |
- "e3d4895843da188fd58fb0567976d7b50359d6b78530c8f62d1b1746",
|
|
|
56d343 |
- },
|
|
|
56d343 |
- {
|
|
|
56d343 |
- "26959946667150639794667015087019625940457807714424391721682722368060",
|
|
|
56d343 |
- "b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
|
|
|
56d343 |
- "42c89c774a08dc04b3dd201932bc8a5ea5f8b89bbb2a7e667aff81cd",
|
|
|
56d343 |
- },
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func TestBaseMult(t *testing.T) {
|
|
|
56d343 |
- p224 := P224()
|
|
|
56d343 |
- for i, e := range p224BaseMultTests {
|
|
|
56d343 |
- k, ok := new(big.Int).SetString(e.k, 10)
|
|
|
56d343 |
- if !ok {
|
|
|
56d343 |
- t.Errorf("%d: bad value for k: %s", i, e.k)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- x, y := p224.ScalarBaseMult(k.Bytes())
|
|
|
56d343 |
- if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {
|
|
|
56d343 |
- t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- if testing.Short() && i > 5 {
|
|
|
56d343 |
- break
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func TestGenericBaseMult(t *testing.T) {
|
|
|
56d343 |
- // We use the P224 CurveParams directly in order to test the generic implementation.
|
|
|
56d343 |
- p224 := P224().Params()
|
|
|
56d343 |
- for i, e := range p224BaseMultTests {
|
|
|
56d343 |
- k, ok := new(big.Int).SetString(e.k, 10)
|
|
|
56d343 |
- if !ok {
|
|
|
56d343 |
- t.Errorf("%d: bad value for k: %s", i, e.k)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- x, y := p224.ScalarBaseMult(k.Bytes())
|
|
|
56d343 |
- if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {
|
|
|
56d343 |
- t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- if testing.Short() && i > 5 {
|
|
|
56d343 |
- break
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
func TestInfinity(t *testing.T) {
|
|
|
56d343 |
tests := []struct {
|
|
|
56d343 |
name string
|
|
|
56d343 |
curve Curve
|
|
|
56d343 |
}{
|
|
|
56d343 |
- {"p224", P224()},
|
|
|
56d343 |
{"p256", P256()},
|
|
|
56d343 |
}
|
|
|
56d343 |
|
|
|
56d343 |
@@ -359,43 +44,3 @@ func TestInfinity(t *testing.T) {
|
|
|
56d343 |
}
|
|
|
56d343 |
}
|
|
|
56d343 |
}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func BenchmarkBaseMult(b *testing.B) {
|
|
|
56d343 |
- b.ResetTimer()
|
|
|
56d343 |
- p224 := P224()
|
|
|
56d343 |
- e := p224BaseMultTests[25]
|
|
|
56d343 |
- k, _ := new(big.Int).SetString(e.k, 10)
|
|
|
56d343 |
- b.StartTimer()
|
|
|
56d343 |
- for i := 0; i < b.N; i++ {
|
|
|
56d343 |
- p224.ScalarBaseMult(k.Bytes())
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func TestMarshal(t *testing.T) {
|
|
|
56d343 |
- p224 := P224()
|
|
|
56d343 |
- _, x, y, err := GenerateKey(p224, rand.Reader)
|
|
|
56d343 |
- if err != nil {
|
|
|
56d343 |
- t.Error(err)
|
|
|
56d343 |
- return
|
|
|
56d343 |
- }
|
|
|
56d343 |
- serialized := Marshal(p224, x, y)
|
|
|
56d343 |
- xx, yy := Unmarshal(p224, serialized)
|
|
|
56d343 |
- if xx == nil {
|
|
|
56d343 |
- t.Error("failed to unmarshal")
|
|
|
56d343 |
- return
|
|
|
56d343 |
- }
|
|
|
56d343 |
- if xx.Cmp(x) != 0 || yy.Cmp(y) != 0 {
|
|
|
56d343 |
- t.Error("unmarshal returned different values")
|
|
|
56d343 |
- return
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func TestP224Overflow(t *testing.T) {
|
|
|
56d343 |
- // This tests for a specific bug in the P224 implementation.
|
|
|
56d343 |
- p224 := P224()
|
|
|
56d343 |
- pointData, _ := hex.DecodeString("049B535B45FB0A2072398A6831834624C7E32CCFD5A4B933BCEAF77F1DD945E08BBE5178F5EDF5E733388F196D2A631D2E075BB16CBFEEA15B")
|
|
|
56d343 |
- x, y := Unmarshal(p224, pointData)
|
|
|
56d343 |
- if !p224.IsOnCurve(x, y) {
|
|
|
56d343 |
- t.Error("P224 failed to validate a correct point")
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
--- libgo/go/crypto/ecdsa/ecdsa_test.go.jj 2012-12-13 11:32:02.589039782 +0100
|
|
|
56d343 |
+++ libgo/go/crypto/ecdsa/ecdsa_test.go 2014-02-18 17:28:22.909692022 +0100
|
|
|
56d343 |
@@ -33,7 +33,6 @@ func testKeyGeneration(t *testing.T, c e
|
|
|
56d343 |
}
|
|
|
56d343 |
|
|
|
56d343 |
func TestKeyGeneration(t *testing.T) {
|
|
|
56d343 |
- testKeyGeneration(t, elliptic.P224(), "p224")
|
|
|
56d343 |
if testing.Short() {
|
|
|
56d343 |
return
|
|
|
56d343 |
}
|
|
|
56d343 |
@@ -63,7 +62,6 @@ func testSignAndVerify(t *testing.T, c e
|
|
|
56d343 |
}
|
|
|
56d343 |
|
|
|
56d343 |
func TestSignAndVerify(t *testing.T) {
|
|
|
56d343 |
- testSignAndVerify(t, elliptic.P224(), "p224")
|
|
|
56d343 |
if testing.Short() {
|
|
|
56d343 |
return
|
|
|
56d343 |
}
|
|
|
56d343 |
@@ -129,8 +127,6 @@ func TestVectors(t *testing.T) {
|
|
|
56d343 |
parts := strings.SplitN(line, ",", 2)
|
|
|
56d343 |
|
|
|
56d343 |
switch parts[0] {
|
|
|
56d343 |
- case "P-224":
|
|
|
56d343 |
- pub.Curve = elliptic.P224()
|
|
|
56d343 |
case "P-256":
|
|
|
56d343 |
pub.Curve = elliptic.P256()
|
|
|
56d343 |
case "P-384":
|
|
|
56d343 |
--- libgo/go/crypto/x509/x509.go.jj 2013-08-14 13:55:08.939843607 +0200
|
|
|
56d343 |
+++ libgo/go/crypto/x509/x509.go 2014-02-18 17:28:22.943691764 +0100
|
|
|
56d343 |
@@ -283,9 +283,6 @@ func getPublicKeyAlgorithmFromOID(oid as
|
|
|
56d343 |
|
|
|
56d343 |
// RFC 5480, 2.1.1.1. Named Curve
|
|
|
56d343 |
//
|
|
|
56d343 |
-// secp224r1 OBJECT IDENTIFIER ::= {
|
|
|
56d343 |
-// iso(1) identified-organization(3) certicom(132) curve(0) 33 }
|
|
|
56d343 |
-//
|
|
|
56d343 |
// secp256r1 OBJECT IDENTIFIER ::= {
|
|
|
56d343 |
// iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)
|
|
|
56d343 |
// prime(1) 7 }
|
|
|
56d343 |
@@ -298,7 +295,6 @@ func getPublicKeyAlgorithmFromOID(oid as
|
|
|
56d343 |
//
|
|
|
56d343 |
// NB: secp256r1 is equivalent to prime256v1
|
|
|
56d343 |
var (
|
|
|
56d343 |
- oidNamedCurveP224 = asn1.ObjectIdentifier{1, 3, 132, 0, 33}
|
|
|
56d343 |
oidNamedCurveP256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}
|
|
|
56d343 |
oidNamedCurveP384 = asn1.ObjectIdentifier{1, 3, 132, 0, 34}
|
|
|
56d343 |
oidNamedCurveP521 = asn1.ObjectIdentifier{1, 3, 132, 0, 35}
|
|
|
56d343 |
@@ -306,8 +302,6 @@ var (
|
|
|
56d343 |
|
|
|
56d343 |
func namedCurveFromOID(oid asn1.ObjectIdentifier) elliptic.Curve {
|
|
|
56d343 |
switch {
|
|
|
56d343 |
- case oid.Equal(oidNamedCurveP224):
|
|
|
56d343 |
- return elliptic.P224()
|
|
|
56d343 |
case oid.Equal(oidNamedCurveP256):
|
|
|
56d343 |
return elliptic.P256()
|
|
|
56d343 |
case oid.Equal(oidNamedCurveP384):
|
|
|
56d343 |
@@ -320,8 +314,6 @@ func namedCurveFromOID(oid asn1.ObjectId
|
|
|
56d343 |
|
|
|
56d343 |
func oidFromNamedCurve(curve elliptic.Curve) (asn1.ObjectIdentifier, bool) {
|
|
|
56d343 |
switch curve {
|
|
|
56d343 |
- case elliptic.P224():
|
|
|
56d343 |
- return oidNamedCurveP224, true
|
|
|
56d343 |
case elliptic.P256():
|
|
|
56d343 |
return oidNamedCurveP256, true
|
|
|
56d343 |
case elliptic.P384():
|
|
|
56d343 |
@@ -1212,7 +1204,7 @@ func CreateCertificate(rand io.Reader, t
|
|
|
56d343 |
hashFunc = crypto.SHA1
|
|
|
56d343 |
case *ecdsa.PrivateKey:
|
|
|
56d343 |
switch priv.Curve {
|
|
|
56d343 |
- case elliptic.P224(), elliptic.P256():
|
|
|
56d343 |
+ case elliptic.P256():
|
|
|
56d343 |
hashFunc = crypto.SHA256
|
|
|
56d343 |
signatureAlgorithm.Algorithm = oidSignatureECDSAWithSHA256
|
|
|
56d343 |
case elliptic.P384():
|
|
|
56d343 |
--- libgo/go/crypto/elliptic/p224.go.jj 2012-12-13 11:32:02.641039533 +0100
|
|
|
56d343 |
+++ libgo/go/crypto/elliptic/p224.go 2014-02-15 11:40:56.191557928 +0100
|
|
|
56d343 |
@@ -1,765 +0,0 @@
|
|
|
56d343 |
-// Copyright 2012 The Go Authors. All rights reserved.
|
|
|
56d343 |
-// Use of this source code is governed by a BSD-style
|
|
|
56d343 |
-// license that can be found in the LICENSE file.
|
|
|
56d343 |
-
|
|
|
56d343 |
-package elliptic
|
|
|
56d343 |
-
|
|
|
56d343 |
-// This is a constant-time, 32-bit implementation of P224. See FIPS 186-3,
|
|
|
56d343 |
-// section D.2.2.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
|
|
|
56d343 |
-
|
|
|
56d343 |
-import (
|
|
|
56d343 |
- "math/big"
|
|
|
56d343 |
-)
|
|
|
56d343 |
-
|
|
|
56d343 |
-var p224 p224Curve
|
|
|
56d343 |
-
|
|
|
56d343 |
-type p224Curve struct {
|
|
|
56d343 |
- *CurveParams
|
|
|
56d343 |
- gx, gy, b p224FieldElement
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func initP224() {
|
|
|
56d343 |
- // See FIPS 186-3, section D.2.2
|
|
|
56d343 |
- p224.CurveParams = new(CurveParams)
|
|
|
56d343 |
- p224.P, _ = new(big.Int).SetString("26959946667150639794667015087019630673557916260026308143510066298881", 10)
|
|
|
56d343 |
- p224.N, _ = new(big.Int).SetString("26959946667150639794667015087019625940457807714424391721682722368061", 10)
|
|
|
56d343 |
- p224.B, _ = new(big.Int).SetString("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4", 16)
|
|
|
56d343 |
- p224.Gx, _ = new(big.Int).SetString("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21", 16)
|
|
|
56d343 |
- p224.Gy, _ = new(big.Int).SetString("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34", 16)
|
|
|
56d343 |
- p224.BitSize = 224
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224FromBig(&p224.gx, p224.Gx)
|
|
|
56d343 |
- p224FromBig(&p224.gy, p224.Gy)
|
|
|
56d343 |
- p224FromBig(&p224.b, p224.B)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// P224 returns a Curve which implements P-224 (see FIPS 186-3, section D.2.2)
|
|
|
56d343 |
-func P224() Curve {
|
|
|
56d343 |
- initonce.Do(initAll)
|
|
|
56d343 |
- return p224
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (curve p224Curve) Params() *CurveParams {
|
|
|
56d343 |
- return curve.CurveParams
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (curve p224Curve) IsOnCurve(bigX, bigY *big.Int) bool {
|
|
|
56d343 |
- var x, y p224FieldElement
|
|
|
56d343 |
- p224FromBig(&x, bigX)
|
|
|
56d343 |
- p224FromBig(&y, bigY)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // y² = x³ - 3x + b
|
|
|
56d343 |
- var tmp p224LargeFieldElement
|
|
|
56d343 |
- var x3 p224FieldElement
|
|
|
56d343 |
- p224Square(&x3, &x, &tmp)
|
|
|
56d343 |
- p224Mul(&x3, &x3, &x, &tmp)
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- x[i] *= 3
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Sub(&x3, &x3, &x)
|
|
|
56d343 |
- p224Reduce(&x3)
|
|
|
56d343 |
- p224Add(&x3, &x3, &curve.b)
|
|
|
56d343 |
- p224Contract(&x3, &x3)
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224Square(&y, &y, &tmp)
|
|
|
56d343 |
- p224Contract(&y, &y)
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- if y[i] != x3[i] {
|
|
|
56d343 |
- return false
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
- return true
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (p224Curve) Add(bigX1, bigY1, bigX2, bigY2 *big.Int) (x, y *big.Int) {
|
|
|
56d343 |
- var x1, y1, z1, x2, y2, z2, x3, y3, z3 p224FieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224FromBig(&x1, bigX1)
|
|
|
56d343 |
- p224FromBig(&y1, bigY1)
|
|
|
56d343 |
- if bigX1.Sign() != 0 || bigY1.Sign() != 0 {
|
|
|
56d343 |
- z1[0] = 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224FromBig(&x2, bigX2)
|
|
|
56d343 |
- p224FromBig(&y2, bigY2)
|
|
|
56d343 |
- if bigX2.Sign() != 0 || bigY2.Sign() != 0 {
|
|
|
56d343 |
- z2[0] = 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224AddJacobian(&x3, &y3, &z3, &x1, &y1, &z1, &x2, &y2, &z2)
|
|
|
56d343 |
- return p224ToAffine(&x3, &y3, &z3)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (p224Curve) Double(bigX1, bigY1 *big.Int) (x, y *big.Int) {
|
|
|
56d343 |
- var x1, y1, z1, x2, y2, z2 p224FieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224FromBig(&x1, bigX1)
|
|
|
56d343 |
- p224FromBig(&y1, bigY1)
|
|
|
56d343 |
- z1[0] = 1
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224DoubleJacobian(&x2, &y2, &z2, &x1, &y1, &z1)
|
|
|
56d343 |
- return p224ToAffine(&x2, &y2, &z2)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (p224Curve) ScalarMult(bigX1, bigY1 *big.Int, scalar []byte) (x, y *big.Int) {
|
|
|
56d343 |
- var x1, y1, z1, x2, y2, z2 p224FieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224FromBig(&x1, bigX1)
|
|
|
56d343 |
- p224FromBig(&y1, bigY1)
|
|
|
56d343 |
- z1[0] = 1
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224ScalarMult(&x2, &y2, &z2, &x1, &y1, &z1, scalar)
|
|
|
56d343 |
- return p224ToAffine(&x2, &y2, &z2)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func (curve p224Curve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {
|
|
|
56d343 |
- var z1, x2, y2, z2 p224FieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- z1[0] = 1
|
|
|
56d343 |
- p224ScalarMult(&x2, &y2, &z2, &curve.gx, &curve.gy, &z1, scalar)
|
|
|
56d343 |
- return p224ToAffine(&x2, &y2, &z2)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// Field element functions.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// The field that we're dealing with is ℤ/pℤ where p = 2**224 - 2**96 + 1.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// Field elements are represented by a FieldElement, which is a typedef to an
|
|
|
56d343 |
-// array of 8 uint32's. The value of a FieldElement, a, is:
|
|
|
56d343 |
-// a[0] + 2**28·a[1] + 2**56·a[1] + ... + 2**196·a[7]
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// Using 28-bit limbs means that there's only 4 bits of headroom, which is less
|
|
|
56d343 |
-// than we would really like. But it has the useful feature that we hit 2**224
|
|
|
56d343 |
-// exactly, making the reflections during a reduce much nicer.
|
|
|
56d343 |
-type p224FieldElement [8]uint32
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224P is the order of the field, represented as a p224FieldElement.
|
|
|
56d343 |
-var p224P = [8]uint32{1, 0, 0, 0xffff000, 0xfffffff, 0xfffffff, 0xfffffff, 0xfffffff}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224IsZero returns 1 if a == 0 mod p and 0 otherwise.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// a[i] < 2**29
|
|
|
56d343 |
-func p224IsZero(a *p224FieldElement) uint32 {
|
|
|
56d343 |
- // Since a p224FieldElement contains 224 bits there are two possible
|
|
|
56d343 |
- // representations of 0: 0 and p.
|
|
|
56d343 |
- var minimal p224FieldElement
|
|
|
56d343 |
- p224Contract(&minimal, a)
|
|
|
56d343 |
-
|
|
|
56d343 |
- var isZero, isP uint32
|
|
|
56d343 |
- for i, v := range minimal {
|
|
|
56d343 |
- isZero |= v
|
|
|
56d343 |
- isP |= v - p224P[i]
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- // If either isZero or isP is 0, then we should return 1.
|
|
|
56d343 |
- isZero |= isZero >> 16
|
|
|
56d343 |
- isZero |= isZero >> 8
|
|
|
56d343 |
- isZero |= isZero >> 4
|
|
|
56d343 |
- isZero |= isZero >> 2
|
|
|
56d343 |
- isZero |= isZero >> 1
|
|
|
56d343 |
-
|
|
|
56d343 |
- isP |= isP >> 16
|
|
|
56d343 |
- isP |= isP >> 8
|
|
|
56d343 |
- isP |= isP >> 4
|
|
|
56d343 |
- isP |= isP >> 2
|
|
|
56d343 |
- isP |= isP >> 1
|
|
|
56d343 |
-
|
|
|
56d343 |
- // For isZero and isP, the LSB is 0 iff all the bits are zero.
|
|
|
56d343 |
- result := isZero & isP
|
|
|
56d343 |
- result = (^result) & 1
|
|
|
56d343 |
-
|
|
|
56d343 |
- return result
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224Add computes *out = a+b
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// a[i] + b[i] < 2**32
|
|
|
56d343 |
-func p224Add(out, a, b *p224FieldElement) {
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- out[i] = a[i] + b[i]
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-const two31p3 = 1<<31 + 1<<3
|
|
|
56d343 |
-const two31m3 = 1<<31 - 1<<3
|
|
|
56d343 |
-const two31m15m3 = 1<<31 - 1<<15 - 1<<3
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224ZeroModP31 is 0 mod p where bit 31 is set in all limbs so that we can
|
|
|
56d343 |
-// subtract smaller amounts without underflow. See the section "Subtraction" in
|
|
|
56d343 |
-// [1] for reasoning.
|
|
|
56d343 |
-var p224ZeroModP31 = []uint32{two31p3, two31m3, two31m3, two31m15m3, two31m3, two31m3, two31m3, two31m3}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224Sub computes *out = a-b
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// a[i], b[i] < 2**30
|
|
|
56d343 |
-// out[i] < 2**32
|
|
|
56d343 |
-func p224Sub(out, a, b *p224FieldElement) {
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- out[i] = a[i] + p224ZeroModP31[i] - b[i]
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// LargeFieldElement also represents an element of the field. The limbs are
|
|
|
56d343 |
-// still spaced 28-bits apart and in little-endian order. So the limbs are at
|
|
|
56d343 |
-// 0, 28, 56, ..., 392 bits, each 64-bits wide.
|
|
|
56d343 |
-type p224LargeFieldElement [15]uint64
|
|
|
56d343 |
-
|
|
|
56d343 |
-const two63p35 = 1<<63 + 1<<35
|
|
|
56d343 |
-const two63m35 = 1<<63 - 1<<35
|
|
|
56d343 |
-const two63m35m19 = 1<<63 - 1<<35 - 1<<19
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224ZeroModP63 is 0 mod p where bit 63 is set in all limbs. See the section
|
|
|
56d343 |
-// "Subtraction" in [1] for why.
|
|
|
56d343 |
-var p224ZeroModP63 = [8]uint64{two63p35, two63m35, two63m35, two63m35, two63m35m19, two63m35, two63m35, two63m35}
|
|
|
56d343 |
-
|
|
|
56d343 |
-const bottom12Bits = 0xfff
|
|
|
56d343 |
-const bottom28Bits = 0xfffffff
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224Mul computes *out = a*b
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// a[i] < 2**29, b[i] < 2**30 (or vice versa)
|
|
|
56d343 |
-// out[i] < 2**29
|
|
|
56d343 |
-func p224Mul(out, a, b *p224FieldElement, tmp *p224LargeFieldElement) {
|
|
|
56d343 |
- for i := 0; i < 15; i++ {
|
|
|
56d343 |
- tmp[i] = 0
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- for j := 0; j < 8; j++ {
|
|
|
56d343 |
- tmp[i+j] += uint64(a[i]) * uint64(b[j])
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224ReduceLarge(out, tmp)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// Square computes *out = a*a
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// a[i] < 2**29
|
|
|
56d343 |
-// out[i] < 2**29
|
|
|
56d343 |
-func p224Square(out, a *p224FieldElement, tmp *p224LargeFieldElement) {
|
|
|
56d343 |
- for i := 0; i < 15; i++ {
|
|
|
56d343 |
- tmp[i] = 0
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- for j := 0; j <= i; j++ {
|
|
|
56d343 |
- r := uint64(a[i]) * uint64(a[j])
|
|
|
56d343 |
- if i == j {
|
|
|
56d343 |
- tmp[i+j] += r
|
|
|
56d343 |
- } else {
|
|
|
56d343 |
- tmp[i+j] += r << 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224ReduceLarge(out, tmp)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// ReduceLarge converts a p224LargeFieldElement to a p224FieldElement.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// in[i] < 2**62
|
|
|
56d343 |
-func p224ReduceLarge(out *p224FieldElement, in *p224LargeFieldElement) {
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- in[i] += p224ZeroModP63[i]
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Eliminate the coefficients at 2**224 and greater.
|
|
|
56d343 |
- for i := 14; i >= 8; i-- {
|
|
|
56d343 |
- in[i-8] -= in[i]
|
|
|
56d343 |
- in[i-5] += (in[i] & 0xffff) << 12
|
|
|
56d343 |
- in[i-4] += in[i] >> 16
|
|
|
56d343 |
- }
|
|
|
56d343 |
- in[8] = 0
|
|
|
56d343 |
- // in[0..8] < 2**64
|
|
|
56d343 |
-
|
|
|
56d343 |
- // As the values become small enough, we start to store them in |out|
|
|
|
56d343 |
- // and use 32-bit operations.
|
|
|
56d343 |
- for i := 1; i < 8; i++ {
|
|
|
56d343 |
- in[i+1] += in[i] >> 28
|
|
|
56d343 |
- out[i] = uint32(in[i] & bottom28Bits)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- in[0] -= in[8]
|
|
|
56d343 |
- out[3] += uint32(in[8]&0xffff) << 12
|
|
|
56d343 |
- out[4] += uint32(in[8] >> 16)
|
|
|
56d343 |
- // in[0] < 2**64
|
|
|
56d343 |
- // out[3] < 2**29
|
|
|
56d343 |
- // out[4] < 2**29
|
|
|
56d343 |
- // out[1,2,5..7] < 2**28
|
|
|
56d343 |
-
|
|
|
56d343 |
- out[0] = uint32(in[0] & bottom28Bits)
|
|
|
56d343 |
- out[1] += uint32((in[0] >> 28) & bottom28Bits)
|
|
|
56d343 |
- out[2] += uint32(in[0] >> 56)
|
|
|
56d343 |
- // out[0] < 2**28
|
|
|
56d343 |
- // out[1..4] < 2**29
|
|
|
56d343 |
- // out[5..7] < 2**28
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// Reduce reduces the coefficients of a to smaller bounds.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// On entry: a[i] < 2**31 + 2**30
|
|
|
56d343 |
-// On exit: a[i] < 2**29
|
|
|
56d343 |
-func p224Reduce(a *p224FieldElement) {
|
|
|
56d343 |
- for i := 0; i < 7; i++ {
|
|
|
56d343 |
- a[i+1] += a[i] >> 28
|
|
|
56d343 |
- a[i] &= bottom28Bits
|
|
|
56d343 |
- }
|
|
|
56d343 |
- top := a[7] >> 28
|
|
|
56d343 |
- a[7] &= bottom28Bits
|
|
|
56d343 |
-
|
|
|
56d343 |
- // top < 2**4
|
|
|
56d343 |
- mask := top
|
|
|
56d343 |
- mask |= mask >> 2
|
|
|
56d343 |
- mask |= mask >> 1
|
|
|
56d343 |
- mask <<= 31
|
|
|
56d343 |
- mask = uint32(int32(mask) >> 31)
|
|
|
56d343 |
- // Mask is all ones if top != 0, all zero otherwise
|
|
|
56d343 |
-
|
|
|
56d343 |
- a[0] -= top
|
|
|
56d343 |
- a[3] += top << 12
|
|
|
56d343 |
-
|
|
|
56d343 |
- // We may have just made a[0] negative but, if we did, then we must
|
|
|
56d343 |
- // have added something to a[3], this it's > 2**12. Therefore we can
|
|
|
56d343 |
- // carry down to a[0].
|
|
|
56d343 |
- a[3] -= 1 & mask
|
|
|
56d343 |
- a[2] += mask & (1<<28 - 1)
|
|
|
56d343 |
- a[1] += mask & (1<<28 - 1)
|
|
|
56d343 |
- a[0] += mask & (1 << 28)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224Invert calculates *out = in**-1 by computing in**(2**224 - 2**96 - 1),
|
|
|
56d343 |
-// i.e. Fermat's little theorem.
|
|
|
56d343 |
-func p224Invert(out, in *p224FieldElement) {
|
|
|
56d343 |
- var f1, f2, f3, f4 p224FieldElement
|
|
|
56d343 |
- var c p224LargeFieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224Square(&f1, in, &c) // 2
|
|
|
56d343 |
- p224Mul(&f1, &f1, in, &c) // 2**2 - 1
|
|
|
56d343 |
- p224Square(&f1, &f1, &c) // 2**3 - 2
|
|
|
56d343 |
- p224Mul(&f1, &f1, in, &c) // 2**3 - 1
|
|
|
56d343 |
- p224Square(&f2, &f1, &c) // 2**4 - 2
|
|
|
56d343 |
- p224Square(&f2, &f2, &c) // 2**5 - 4
|
|
|
56d343 |
- p224Square(&f2, &f2, &c) // 2**6 - 8
|
|
|
56d343 |
- p224Mul(&f1, &f1, &f2, &c) // 2**6 - 1
|
|
|
56d343 |
- p224Square(&f2, &f1, &c) // 2**7 - 2
|
|
|
56d343 |
- for i := 0; i < 5; i++ { // 2**12 - 2**6
|
|
|
56d343 |
- p224Square(&f2, &f2, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f2, &f2, &f1, &c) // 2**12 - 1
|
|
|
56d343 |
- p224Square(&f3, &f2, &c) // 2**13 - 2
|
|
|
56d343 |
- for i := 0; i < 11; i++ { // 2**24 - 2**12
|
|
|
56d343 |
- p224Square(&f3, &f3, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f2, &f3, &f2, &c) // 2**24 - 1
|
|
|
56d343 |
- p224Square(&f3, &f2, &c) // 2**25 - 2
|
|
|
56d343 |
- for i := 0; i < 23; i++ { // 2**48 - 2**24
|
|
|
56d343 |
- p224Square(&f3, &f3, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f3, &f3, &f2, &c) // 2**48 - 1
|
|
|
56d343 |
- p224Square(&f4, &f3, &c) // 2**49 - 2
|
|
|
56d343 |
- for i := 0; i < 47; i++ { // 2**96 - 2**48
|
|
|
56d343 |
- p224Square(&f4, &f4, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f3, &f3, &f4, &c) // 2**96 - 1
|
|
|
56d343 |
- p224Square(&f4, &f3, &c) // 2**97 - 2
|
|
|
56d343 |
- for i := 0; i < 23; i++ { // 2**120 - 2**24
|
|
|
56d343 |
- p224Square(&f4, &f4, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f2, &f4, &f2, &c) // 2**120 - 1
|
|
|
56d343 |
- for i := 0; i < 6; i++ { // 2**126 - 2**6
|
|
|
56d343 |
- p224Square(&f2, &f2, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&f1, &f1, &f2, &c) // 2**126 - 1
|
|
|
56d343 |
- p224Square(&f1, &f1, &c) // 2**127 - 2
|
|
|
56d343 |
- p224Mul(&f1, &f1, in, &c) // 2**127 - 1
|
|
|
56d343 |
- for i := 0; i < 97; i++ { // 2**224 - 2**97
|
|
|
56d343 |
- p224Square(&f1, &f1, &c)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(out, &f1, &f3, &c) // 2**224 - 2**96 - 1
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224Contract converts a FieldElement to its unique, minimal form.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// On entry, in[i] < 2**29
|
|
|
56d343 |
-// On exit, in[i] < 2**28
|
|
|
56d343 |
-func p224Contract(out, in *p224FieldElement) {
|
|
|
56d343 |
- copy(out[:], in[:])
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 7; i++ {
|
|
|
56d343 |
- out[i+1] += out[i] >> 28
|
|
|
56d343 |
- out[i] &= bottom28Bits
|
|
|
56d343 |
- }
|
|
|
56d343 |
- top := out[7] >> 28
|
|
|
56d343 |
- out[7] &= bottom28Bits
|
|
|
56d343 |
-
|
|
|
56d343 |
- out[0] -= top
|
|
|
56d343 |
- out[3] += top << 12
|
|
|
56d343 |
-
|
|
|
56d343 |
- // We may just have made out[i] negative. So we carry down. If we made
|
|
|
56d343 |
- // out[0] negative then we know that out[3] is sufficiently positive
|
|
|
56d343 |
- // because we just added to it.
|
|
|
56d343 |
- for i := 0; i < 3; i++ {
|
|
|
56d343 |
- mask := uint32(int32(out[i]) >> 31)
|
|
|
56d343 |
- out[i] += (1 << 28) & mask
|
|
|
56d343 |
- out[i+1] -= 1 & mask
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- // We might have pushed out[3] over 2**28 so we perform another, partial,
|
|
|
56d343 |
- // carry chain.
|
|
|
56d343 |
- for i := 3; i < 7; i++ {
|
|
|
56d343 |
- out[i+1] += out[i] >> 28
|
|
|
56d343 |
- out[i] &= bottom28Bits
|
|
|
56d343 |
- }
|
|
|
56d343 |
- top = out[7] >> 28
|
|
|
56d343 |
- out[7] &= bottom28Bits
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Eliminate top while maintaining the same value mod p.
|
|
|
56d343 |
- out[0] -= top
|
|
|
56d343 |
- out[3] += top << 12
|
|
|
56d343 |
-
|
|
|
56d343 |
- // There are two cases to consider for out[3]:
|
|
|
56d343 |
- // 1) The first time that we eliminated top, we didn't push out[3] over
|
|
|
56d343 |
- // 2**28. In this case, the partial carry chain didn't change any values
|
|
|
56d343 |
- // and top is zero.
|
|
|
56d343 |
- // 2) We did push out[3] over 2**28 the first time that we eliminated top.
|
|
|
56d343 |
- // The first value of top was in [0..16), therefore, prior to eliminating
|
|
|
56d343 |
- // the first top, 0xfff1000 <= out[3] <= 0xfffffff. Therefore, after
|
|
|
56d343 |
- // overflowing and being reduced by the second carry chain, out[3] <=
|
|
|
56d343 |
- // 0xf000. Thus it cannot have overflowed when we eliminated top for the
|
|
|
56d343 |
- // second time.
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Again, we may just have made out[0] negative, so do the same carry down.
|
|
|
56d343 |
- // As before, if we made out[0] negative then we know that out[3] is
|
|
|
56d343 |
- // sufficiently positive.
|
|
|
56d343 |
- for i := 0; i < 3; i++ {
|
|
|
56d343 |
- mask := uint32(int32(out[i]) >> 31)
|
|
|
56d343 |
- out[i] += (1 << 28) & mask
|
|
|
56d343 |
- out[i+1] -= 1 & mask
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Now we see if the value is >= p and, if so, subtract p.
|
|
|
56d343 |
-
|
|
|
56d343 |
- // First we build a mask from the top four limbs, which must all be
|
|
|
56d343 |
- // equal to bottom28Bits if the whole value is >= p. If top4AllOnes
|
|
|
56d343 |
- // ends up with any zero bits in the bottom 28 bits, then this wasn't
|
|
|
56d343 |
- // true.
|
|
|
56d343 |
- top4AllOnes := uint32(0xffffffff)
|
|
|
56d343 |
- for i := 4; i < 8; i++ {
|
|
|
56d343 |
- top4AllOnes &= out[i]
|
|
|
56d343 |
- }
|
|
|
56d343 |
- top4AllOnes |= 0xf0000000
|
|
|
56d343 |
- // Now we replicate any zero bits to all the bits in top4AllOnes.
|
|
|
56d343 |
- top4AllOnes &= top4AllOnes >> 16
|
|
|
56d343 |
- top4AllOnes &= top4AllOnes >> 8
|
|
|
56d343 |
- top4AllOnes &= top4AllOnes >> 4
|
|
|
56d343 |
- top4AllOnes &= top4AllOnes >> 2
|
|
|
56d343 |
- top4AllOnes &= top4AllOnes >> 1
|
|
|
56d343 |
- top4AllOnes = uint32(int32(top4AllOnes<<31) >> 31)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Now we test whether the bottom three limbs are non-zero.
|
|
|
56d343 |
- bottom3NonZero := out[0] | out[1] | out[2]
|
|
|
56d343 |
- bottom3NonZero |= bottom3NonZero >> 16
|
|
|
56d343 |
- bottom3NonZero |= bottom3NonZero >> 8
|
|
|
56d343 |
- bottom3NonZero |= bottom3NonZero >> 4
|
|
|
56d343 |
- bottom3NonZero |= bottom3NonZero >> 2
|
|
|
56d343 |
- bottom3NonZero |= bottom3NonZero >> 1
|
|
|
56d343 |
- bottom3NonZero = uint32(int32(bottom3NonZero<<31) >> 31)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Everything depends on the value of out[3].
|
|
|
56d343 |
- // If it's > 0xffff000 and top4AllOnes != 0 then the whole value is >= p
|
|
|
56d343 |
- // If it's = 0xffff000 and top4AllOnes != 0 and bottom3NonZero != 0,
|
|
|
56d343 |
- // then the whole value is >= p
|
|
|
56d343 |
- // If it's < 0xffff000, then the whole value is < p
|
|
|
56d343 |
- n := out[3] - 0xffff000
|
|
|
56d343 |
- out3Equal := n
|
|
|
56d343 |
- out3Equal |= out3Equal >> 16
|
|
|
56d343 |
- out3Equal |= out3Equal >> 8
|
|
|
56d343 |
- out3Equal |= out3Equal >> 4
|
|
|
56d343 |
- out3Equal |= out3Equal >> 2
|
|
|
56d343 |
- out3Equal |= out3Equal >> 1
|
|
|
56d343 |
- out3Equal = ^uint32(int32(out3Equal<<31) >> 31)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // If out[3] > 0xffff000 then n's MSB will be zero.
|
|
|
56d343 |
- out3GT := ^uint32(int32(n) >> 31)
|
|
|
56d343 |
-
|
|
|
56d343 |
- mask := top4AllOnes & ((out3Equal & bottom3NonZero) | out3GT)
|
|
|
56d343 |
- out[0] -= 1 & mask
|
|
|
56d343 |
- out[3] -= 0xffff000 & mask
|
|
|
56d343 |
- out[4] -= 0xfffffff & mask
|
|
|
56d343 |
- out[5] -= 0xfffffff & mask
|
|
|
56d343 |
- out[6] -= 0xfffffff & mask
|
|
|
56d343 |
- out[7] -= 0xfffffff & mask
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// Group element functions.
|
|
|
56d343 |
-//
|
|
|
56d343 |
-// These functions deal with group elements. The group is an elliptic curve
|
|
|
56d343 |
-// group with a = -3 defined in FIPS 186-3, section D.2.2.
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224AddJacobian computes *out = a+b where a != b.
|
|
|
56d343 |
-func p224AddJacobian(x3, y3, z3, x1, y1, z1, x2, y2, z2 *p224FieldElement) {
|
|
|
56d343 |
- // See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-p224Add-2007-bl
|
|
|
56d343 |
- var z1z1, z2z2, u1, u2, s1, s2, h, i, j, r, v p224FieldElement
|
|
|
56d343 |
- var c p224LargeFieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- z1IsZero := p224IsZero(z1)
|
|
|
56d343 |
- z2IsZero := p224IsZero(z2)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Z1Z1 = Z1²
|
|
|
56d343 |
- p224Square(&z1z1, z1, &c)
|
|
|
56d343 |
- // Z2Z2 = Z2²
|
|
|
56d343 |
- p224Square(&z2z2, z2, &c)
|
|
|
56d343 |
- // U1 = X1*Z2Z2
|
|
|
56d343 |
- p224Mul(&u1, x1, &z2z2, &c)
|
|
|
56d343 |
- // U2 = X2*Z1Z1
|
|
|
56d343 |
- p224Mul(&u2, x2, &z1z1, &c)
|
|
|
56d343 |
- // S1 = Y1*Z2*Z2Z2
|
|
|
56d343 |
- p224Mul(&s1, z2, &z2z2, &c)
|
|
|
56d343 |
- p224Mul(&s1, y1, &s1, &c)
|
|
|
56d343 |
- // S2 = Y2*Z1*Z1Z1
|
|
|
56d343 |
- p224Mul(&s2, z1, &z1z1, &c)
|
|
|
56d343 |
- p224Mul(&s2, y2, &s2, &c)
|
|
|
56d343 |
- // H = U2-U1
|
|
|
56d343 |
- p224Sub(&h, &u2, &u1)
|
|
|
56d343 |
- p224Reduce(&h)
|
|
|
56d343 |
- xEqual := p224IsZero(&h)
|
|
|
56d343 |
- // I = (2*H)²
|
|
|
56d343 |
- for j := 0; j < 8; j++ {
|
|
|
56d343 |
- i[j] = h[j] << 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Reduce(&i)
|
|
|
56d343 |
- p224Square(&i, &i, &c)
|
|
|
56d343 |
- // J = H*I
|
|
|
56d343 |
- p224Mul(&j, &h, &i, &c)
|
|
|
56d343 |
- // r = 2*(S2-S1)
|
|
|
56d343 |
- p224Sub(&r, &s2, &s1)
|
|
|
56d343 |
- p224Reduce(&r)
|
|
|
56d343 |
- yEqual := p224IsZero(&r)
|
|
|
56d343 |
- if xEqual == 1 && yEqual == 1 && z1IsZero == 0 && z2IsZero == 0 {
|
|
|
56d343 |
- p224DoubleJacobian(x3, y3, z3, x1, y1, z1)
|
|
|
56d343 |
- return
|
|
|
56d343 |
- }
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- r[i] <<= 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Reduce(&r)
|
|
|
56d343 |
- // V = U1*I
|
|
|
56d343 |
- p224Mul(&v, &u1, &i, &c)
|
|
|
56d343 |
- // Z3 = ((Z1+Z2)²-Z1Z1-Z2Z2)*H
|
|
|
56d343 |
- p224Add(&z1z1, &z1z1, &z2z2)
|
|
|
56d343 |
- p224Add(&z2z2, z1, z2)
|
|
|
56d343 |
- p224Reduce(&z2z2)
|
|
|
56d343 |
- p224Square(&z2z2, &z2z2, &c)
|
|
|
56d343 |
- p224Sub(z3, &z2z2, &z1z1)
|
|
|
56d343 |
- p224Reduce(z3)
|
|
|
56d343 |
- p224Mul(z3, z3, &h, &c)
|
|
|
56d343 |
- // X3 = r²-J-2*V
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- z1z1[i] = v[i] << 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Add(&z1z1, &j, &z1z1)
|
|
|
56d343 |
- p224Reduce(&z1z1)
|
|
|
56d343 |
- p224Square(x3, &r, &c)
|
|
|
56d343 |
- p224Sub(x3, x3, &z1z1)
|
|
|
56d343 |
- p224Reduce(x3)
|
|
|
56d343 |
- // Y3 = r*(V-X3)-2*S1*J
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- s1[i] <<= 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Mul(&s1, &s1, &j, &c)
|
|
|
56d343 |
- p224Sub(&z1z1, &v, x3)
|
|
|
56d343 |
- p224Reduce(&z1z1)
|
|
|
56d343 |
- p224Mul(&z1z1, &z1z1, &r, &c)
|
|
|
56d343 |
- p224Sub(y3, &z1z1, &s1)
|
|
|
56d343 |
- p224Reduce(y3)
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224CopyConditional(x3, x2, z1IsZero)
|
|
|
56d343 |
- p224CopyConditional(x3, x1, z2IsZero)
|
|
|
56d343 |
- p224CopyConditional(y3, y2, z1IsZero)
|
|
|
56d343 |
- p224CopyConditional(y3, y1, z2IsZero)
|
|
|
56d343 |
- p224CopyConditional(z3, z2, z1IsZero)
|
|
|
56d343 |
- p224CopyConditional(z3, z1, z2IsZero)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224DoubleJacobian computes *out = a+a.
|
|
|
56d343 |
-func p224DoubleJacobian(x3, y3, z3, x1, y1, z1 *p224FieldElement) {
|
|
|
56d343 |
- var delta, gamma, beta, alpha, t p224FieldElement
|
|
|
56d343 |
- var c p224LargeFieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224Square(&delta, z1, &c)
|
|
|
56d343 |
- p224Square(&gamma, y1, &c)
|
|
|
56d343 |
- p224Mul(&beta, x1, &gamma, &c)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // alpha = 3*(X1-delta)*(X1+delta)
|
|
|
56d343 |
- p224Add(&t, x1, &delta)
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- t[i] += t[i] << 1
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Reduce(&t)
|
|
|
56d343 |
- p224Sub(&alpha, x1, &delta)
|
|
|
56d343 |
- p224Reduce(&alpha)
|
|
|
56d343 |
- p224Mul(&alpha, &alpha, &t, &c)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Z3 = (Y1+Z1)²-gamma-delta
|
|
|
56d343 |
- p224Add(z3, y1, z1)
|
|
|
56d343 |
- p224Reduce(z3)
|
|
|
56d343 |
- p224Square(z3, z3, &c)
|
|
|
56d343 |
- p224Sub(z3, z3, &gamma)
|
|
|
56d343 |
- p224Reduce(z3)
|
|
|
56d343 |
- p224Sub(z3, z3, &delta)
|
|
|
56d343 |
- p224Reduce(z3)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // X3 = alpha²-8*beta
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- delta[i] = beta[i] << 3
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Reduce(&delta)
|
|
|
56d343 |
- p224Square(x3, &alpha, &c)
|
|
|
56d343 |
- p224Sub(x3, x3, &delta)
|
|
|
56d343 |
- p224Reduce(x3)
|
|
|
56d343 |
-
|
|
|
56d343 |
- // Y3 = alpha*(4*beta-X3)-8*gamma²
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- beta[i] <<= 2
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Sub(&beta, &beta, x3)
|
|
|
56d343 |
- p224Reduce(&beta)
|
|
|
56d343 |
- p224Square(&gamma, &gamma, &c)
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- gamma[i] <<= 3
|
|
|
56d343 |
- }
|
|
|
56d343 |
- p224Reduce(&gamma)
|
|
|
56d343 |
- p224Mul(y3, &alpha, &beta, &c)
|
|
|
56d343 |
- p224Sub(y3, y3, &gamma)
|
|
|
56d343 |
- p224Reduce(y3)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224CopyConditional sets *out = *in iff the least-significant-bit of control
|
|
|
56d343 |
-// is true, and it runs in constant time.
|
|
|
56d343 |
-func p224CopyConditional(out, in *p224FieldElement, control uint32) {
|
|
|
56d343 |
- control <<= 31
|
|
|
56d343 |
- control = uint32(int32(control) >> 31)
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- out[i] ^= (out[i] ^ in[i]) & control
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func p224ScalarMult(outX, outY, outZ, inX, inY, inZ *p224FieldElement, scalar []byte) {
|
|
|
56d343 |
- var xx, yy, zz p224FieldElement
|
|
|
56d343 |
- for i := 0; i < 8; i++ {
|
|
|
56d343 |
- outX[i] = 0
|
|
|
56d343 |
- outY[i] = 0
|
|
|
56d343 |
- outZ[i] = 0
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- for _, byte := range scalar {
|
|
|
56d343 |
- for bitNum := uint(0); bitNum < 8; bitNum++ {
|
|
|
56d343 |
- p224DoubleJacobian(outX, outY, outZ, outX, outY, outZ)
|
|
|
56d343 |
- bit := uint32((byte >> (7 - bitNum)) & 1)
|
|
|
56d343 |
- p224AddJacobian(&xx, &yy, &zz, inX, inY, inZ, outX, outY, outZ)
|
|
|
56d343 |
- p224CopyConditional(outX, &xx, bit)
|
|
|
56d343 |
- p224CopyConditional(outY, &yy, bit)
|
|
|
56d343 |
- p224CopyConditional(outZ, &zz, bit)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224ToAffine converts from Jacobian to affine form.
|
|
|
56d343 |
-func p224ToAffine(x, y, z *p224FieldElement) (*big.Int, *big.Int) {
|
|
|
56d343 |
- var zinv, zinvsq, outx, outy p224FieldElement
|
|
|
56d343 |
- var tmp p224LargeFieldElement
|
|
|
56d343 |
-
|
|
|
56d343 |
- if isPointAtInfinity := p224IsZero(z); isPointAtInfinity == 1 {
|
|
|
56d343 |
- return new(big.Int), new(big.Int)
|
|
|
56d343 |
- }
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224Invert(&zinv, z)
|
|
|
56d343 |
- p224Square(&zinvsq, &zinv, &tmp)
|
|
|
56d343 |
- p224Mul(x, x, &zinvsq, &tmp)
|
|
|
56d343 |
- p224Mul(&zinvsq, &zinvsq, &zinv, &tmp)
|
|
|
56d343 |
- p224Mul(y, y, &zinvsq, &tmp)
|
|
|
56d343 |
-
|
|
|
56d343 |
- p224Contract(&outx, x)
|
|
|
56d343 |
- p224Contract(&outy, y)
|
|
|
56d343 |
- return p224ToBig(&outx), p224ToBig(&outy)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// get28BitsFromEnd returns the least-significant 28 bits from buf>>shift,
|
|
|
56d343 |
-// where buf is interpreted as a big-endian number.
|
|
|
56d343 |
-func get28BitsFromEnd(buf []byte, shift uint) (uint32, []byte) {
|
|
|
56d343 |
- var ret uint32
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := uint(0); i < 4; i++ {
|
|
|
56d343 |
- var b byte
|
|
|
56d343 |
- if l := len(buf); l > 0 {
|
|
|
56d343 |
- b = buf[l-1]
|
|
|
56d343 |
- // We don't remove the byte if we're about to return and we're not
|
|
|
56d343 |
- // reading all of it.
|
|
|
56d343 |
- if i != 3 || shift == 4 {
|
|
|
56d343 |
- buf = buf[:l-1]
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
- ret |= uint32(b) << (8 * i) >> shift
|
|
|
56d343 |
- }
|
|
|
56d343 |
- ret &= bottom28Bits
|
|
|
56d343 |
- return ret, buf
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224FromBig sets *out = *in.
|
|
|
56d343 |
-func p224FromBig(out *p224FieldElement, in *big.Int) {
|
|
|
56d343 |
- bytes := in.Bytes()
|
|
|
56d343 |
- out[0], bytes = get28BitsFromEnd(bytes, 0)
|
|
|
56d343 |
- out[1], bytes = get28BitsFromEnd(bytes, 4)
|
|
|
56d343 |
- out[2], bytes = get28BitsFromEnd(bytes, 0)
|
|
|
56d343 |
- out[3], bytes = get28BitsFromEnd(bytes, 4)
|
|
|
56d343 |
- out[4], bytes = get28BitsFromEnd(bytes, 0)
|
|
|
56d343 |
- out[5], bytes = get28BitsFromEnd(bytes, 4)
|
|
|
56d343 |
- out[6], bytes = get28BitsFromEnd(bytes, 0)
|
|
|
56d343 |
- out[7], bytes = get28BitsFromEnd(bytes, 4)
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-// p224ToBig returns in as a big.Int.
|
|
|
56d343 |
-func p224ToBig(in *p224FieldElement) *big.Int {
|
|
|
56d343 |
- var buf [28]byte
|
|
|
56d343 |
- buf[27] = byte(in[0])
|
|
|
56d343 |
- buf[26] = byte(in[0] >> 8)
|
|
|
56d343 |
- buf[25] = byte(in[0] >> 16)
|
|
|
56d343 |
- buf[24] = byte(((in[0] >> 24) & 0x0f) | (in[1]<<4)&0xf0)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[23] = byte(in[1] >> 4)
|
|
|
56d343 |
- buf[22] = byte(in[1] >> 12)
|
|
|
56d343 |
- buf[21] = byte(in[1] >> 20)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[20] = byte(in[2])
|
|
|
56d343 |
- buf[19] = byte(in[2] >> 8)
|
|
|
56d343 |
- buf[18] = byte(in[2] >> 16)
|
|
|
56d343 |
- buf[17] = byte(((in[2] >> 24) & 0x0f) | (in[3]<<4)&0xf0)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[16] = byte(in[3] >> 4)
|
|
|
56d343 |
- buf[15] = byte(in[3] >> 12)
|
|
|
56d343 |
- buf[14] = byte(in[3] >> 20)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[13] = byte(in[4])
|
|
|
56d343 |
- buf[12] = byte(in[4] >> 8)
|
|
|
56d343 |
- buf[11] = byte(in[4] >> 16)
|
|
|
56d343 |
- buf[10] = byte(((in[4] >> 24) & 0x0f) | (in[5]<<4)&0xf0)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[9] = byte(in[5] >> 4)
|
|
|
56d343 |
- buf[8] = byte(in[5] >> 12)
|
|
|
56d343 |
- buf[7] = byte(in[5] >> 20)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[6] = byte(in[6])
|
|
|
56d343 |
- buf[5] = byte(in[6] >> 8)
|
|
|
56d343 |
- buf[4] = byte(in[6] >> 16)
|
|
|
56d343 |
- buf[3] = byte(((in[6] >> 24) & 0x0f) | (in[7]<<4)&0xf0)
|
|
|
56d343 |
-
|
|
|
56d343 |
- buf[2] = byte(in[7] >> 4)
|
|
|
56d343 |
- buf[1] = byte(in[7] >> 12)
|
|
|
56d343 |
- buf[0] = byte(in[7] >> 20)
|
|
|
56d343 |
-
|
|
|
56d343 |
- return new(big.Int).SetBytes(buf[:])
|
|
|
56d343 |
-}
|
|
|
56d343 |
--- libgo/go/crypto/elliptic/p224_test.go.jj 2014-02-18 18:03:31.615598561 +0100
|
|
|
56d343 |
+++ libgo/go/crypto/elliptic/p224_test.go 2014-02-15 11:40:56.191557928 +0100
|
|
|
56d343 |
@@ -1,47 +0,0 @@
|
|
|
56d343 |
-// Copyright 2012 The Go Authors. All rights reserved.
|
|
|
56d343 |
-// Use of this source code is governed by a BSD-style
|
|
|
56d343 |
-// license that can be found in the LICENSE file.
|
|
|
56d343 |
-
|
|
|
56d343 |
-package elliptic
|
|
|
56d343 |
-
|
|
|
56d343 |
-import (
|
|
|
56d343 |
- "math/big"
|
|
|
56d343 |
- "testing"
|
|
|
56d343 |
-)
|
|
|
56d343 |
-
|
|
|
56d343 |
-var toFromBigTests = []string{
|
|
|
56d343 |
- "0",
|
|
|
56d343 |
- "1",
|
|
|
56d343 |
- "23",
|
|
|
56d343 |
- "b70e0cb46bb4bf7f321390b94a03c1d356c01122343280d6105c1d21",
|
|
|
56d343 |
- "706a46d476dcb76798e6046d89474788d164c18032d268fd10704fa6",
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func p224AlternativeToBig(in *p224FieldElement) *big.Int {
|
|
|
56d343 |
- ret := new(big.Int)
|
|
|
56d343 |
- tmp := new(big.Int)
|
|
|
56d343 |
-
|
|
|
56d343 |
- for i := uint(0); i < 8; i++ {
|
|
|
56d343 |
- tmp.SetInt64(int64(in[i]))
|
|
|
56d343 |
- tmp.Lsh(tmp, 28*i)
|
|
|
56d343 |
- ret.Add(ret, tmp)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- ret.Mod(ret, p224.P)
|
|
|
56d343 |
- return ret
|
|
|
56d343 |
-}
|
|
|
56d343 |
-
|
|
|
56d343 |
-func TestToFromBig(t *testing.T) {
|
|
|
56d343 |
- for i, test := range toFromBigTests {
|
|
|
56d343 |
- n, _ := new(big.Int).SetString(test, 16)
|
|
|
56d343 |
- var x p224FieldElement
|
|
|
56d343 |
- p224FromBig(&x, n)
|
|
|
56d343 |
- m := p224ToBig(&x)
|
|
|
56d343 |
- if n.Cmp(m) != 0 {
|
|
|
56d343 |
- t.Errorf("#%d: %x != %x", i, n, m)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- q := p224AlternativeToBig(&x)
|
|
|
56d343 |
- if n.Cmp(q) != 0 {
|
|
|
56d343 |
- t.Errorf("#%d: %x != %x (alternative)", i, n, m)
|
|
|
56d343 |
- }
|
|
|
56d343 |
- }
|
|
|
56d343 |
-}
|