Commit b08d32ceb5aac5b1ba73c84449c6afee630710bb | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2022-05-26 01:38:32+02:00
committer	Jakub Konka <kubkon@jakubkonka.com> 2022-05-26 13:30:03+02:00
log	b08d32ceb5aac5b1ba73c84449c6afee630710bb
tree	f34db20cb2138a60ae57a2aac334cd6252e8d9c8
parent	01607b54fc21c5dfc0ee8bc21ef317c8c03868c2

crypto/25519: add scalar.random(), use CompressedScalar type

Add the ability to generate a random, canonical curve25519 scalar,
like we do for p256.

Also leverage the existing CompressedScalar type to represent these
scalars.

1 files changed, 60 insertions(+), 19 deletions(-)

lib
- std
  - crypto
    25519
    scalar.zig

lib/std/crypto/25519/scalar.zig+60-19

...	...	@@ -1,4 +1,5 @@
1	1	const std = @import("std");
	2	const crypto = std.crypto;
2	3	const mem = std.mem;
3	4
4	5	const NonCanonicalError = std.crypto.errors.NonCanonicalError;
...	...	@@ -15,7 +16,7 @@ pub const CompressedScalar = [32]u8;
15	16	pub const zero = [_]u8{0} ** 32;
16	17
17	18	/// Reject a scalar whose encoding is not canonical.
18		pub fn rejectNonCanonical(s: [32]u8) NonCanonicalError!void {
	19	pub fn rejectNonCanonical(s: CompressedScalar) NonCanonicalError!void {
19	20	var c: u8 = 0;
20	21	var n: u8 = 1;
21	22	var i: usize = 31;
...	...	@@ -32,34 +33,34 @@ pub fn rejectNonCanonical(s: [32]u8) NonCanonicalError!void {
32	33	}
33	34
34	35	/// Reduce a scalar to the field size.
35		pub fn reduce(s: [32]u8) [32]u8 {
	36	pub fn reduce(s: CompressedScalar) CompressedScalar {
36	37	return Scalar.fromBytes(s).toBytes();
37	38	}
38	39
39	40	/// Reduce a 64-bytes scalar to the field size.
40		pub fn reduce64(s: [64]u8) [32]u8 {
	41	pub fn reduce64(s: [64]u8) CompressedScalar {
41	42	return ScalarDouble.fromBytes64(s).toBytes();
42	43	}
43	44
44	45	/// Perform the X25519 "clamping" operation.
45	46	/// The scalar is then guaranteed to be a multiple of the cofactor.
46		pub inline fn clamp(s: *[32]u8) void {
	47	pub inline fn clamp(s: *CompressedScalar) void {
47	48	s[0] &= 248;
48	49	s[31] = (s[31] & 127) \| 64;
49	50	}
50	51
51	52	/// Return a*b (mod L)
52		pub fn mul(a: [32]u8, b: [32]u8) [32]u8 {
	53	pub fn mul(a: CompressedScalar, b: CompressedScalar) CompressedScalar {
53	54	return Scalar.fromBytes(a).mul(Scalar.fromBytes(b)).toBytes();
54	55	}
55	56
56	57	/// Return a*b+c (mod L)
57		pub fn mulAdd(a: [32]u8, b: [32]u8, c: [32]u8) [32]u8 {
	58	pub fn mulAdd(a: CompressedScalar, b: CompressedScalar, c: CompressedScalar) CompressedScalar {
58	59	return Scalar.fromBytes(a).mul(Scalar.fromBytes(b)).add(Scalar.fromBytes(c)).toBytes();
59	60	}
60	61
61	62	/// Return a*8 (mod L)
62		pub fn mul8(s: [32]u8) [32]u8 {
	63	pub fn mul8(s: CompressedScalar) CompressedScalar {
63	64	var x = Scalar.fromBytes(s);
64	65	x = x.add(x);
65	66	x = x.add(x);
...	...	@@ -68,12 +69,12 @@ pub fn mul8(s: [32]u8) [32]u8 {
68	69	}
69	70
70	71	/// Return a+b (mod L)
71		pub fn add(a: [32]u8, b: [32]u8) [32]u8 {
	72	pub fn add(a: CompressedScalar, b: CompressedScalar) CompressedScalar {
72	73	return Scalar.fromBytes(a).add(Scalar.fromBytes(b)).toBytes();
73	74	}
74	75
75	76	/// Return -s (mod L)
76		pub fn neg(s: [32]u8) [32]u8 {
	77	pub fn neg(s: CompressedScalar) CompressedScalar {
77	78	const fs: [64]u8 = field_size ++ [_]u8{0} ** 32;
78	79	var sx: [64]u8 = undefined;
79	80	mem.copy(u8, sx[0..32], s[0..]);
...	...	@@ -89,23 +90,33 @@ pub fn neg(s: [32]u8) [32]u8 {
89	90	}
90	91
91	92	/// Return (a-b) (mod L)
92		pub fn sub(a: [32]u8, b: [32]u8) [32]u8 {
	93	pub fn sub(a: CompressedScalar, b: CompressedScalar) CompressedScalar {
93	94	return add(a, neg(b));
94	95	}
95	96
	97	/// Return a random scalar < L
	98	pub fn random() CompressedScalar {
	99	return Scalar.random().toBytes();
	100	}
	101
96	102	/// A scalar in unpacked representation
97	103	pub const Scalar = struct {
98	104	const Limbs = [5]u64;
99	105	limbs: Limbs = undefined,
100	106
101	107	/// Unpack a 32-byte representation of a scalar
102		pub fn fromBytes(bytes: [32]u8) Scalar {
	108	pub fn fromBytes(bytes: CompressedScalar) Scalar {
103	109	return ScalarDouble.fromBytes32(bytes).reduce(5);
104	110	}
105	111
	112	/// Unpack a 64-byte representation of a scalar
	113	pub fn fromBytes64(bytes: [64]u8) Scalar {
	114	return ScalarDouble.fromBytes64(bytes).reduce(5);
	115	}
	116
106	117	/// Pack a scalar into bytes
107		pub fn toBytes(expanded: *const Scalar) [32]u8 {
108		var bytes: [32]u8 = undefined;
	118	pub fn toBytes(expanded: *const Scalar) CompressedScalar {
	119	var bytes: CompressedScalar = undefined;
109	120	var i: usize = 0;
110	121	while (i < 4) : (i += 1) {
111	122	mem.writeIntLittle(u64, bytes[i * 7 ..][0..8], expanded.limbs[i]);
...	...	@@ -114,7 +125,13 @@ pub const Scalar = struct {
114	125	return bytes;
115	126	}
116	127
117		/// Return x+y (mod l)
	128	/// Return true if the scalar is zero
	129	pub fn isZero(n: Scalar) bool {
	130	const limbs = n.limbs;
	131	return (limbs[0] \| limbs[1] \| limbs[2] \| limbs[3] \| limbs[4]) == 0;
	132	}
	133
	134	/// Return x+y (mod L)
118	135	pub fn add(x: Scalar, y: Scalar) Scalar {
119	136	const carry0 = (x.limbs[0] + y.limbs[0]) >> 56;
120	137	const t0 = (x.limbs[0] + y.limbs[0]) & 0xffffffffffffff;
...	...	@@ -171,7 +188,7 @@ pub const Scalar = struct {
171	188	return Scalar{ .limbs = .{ z00, z10, z20, z30, z40 } };
172	189	}
173	190
174		/// Return x*r (mod l)
	191	/// Return x*r (mod L)
175	192	pub fn mul(x: Scalar, y: Scalar) Scalar {
176	193	const xy000 = @as(u128, x.limbs[0]) * @as(u128, y.limbs[0]);
177	194	const xy010 = @as(u128, x.limbs[0]) * @as(u128, y.limbs[1]);
...	...	@@ -483,7 +500,7 @@ pub const Scalar = struct {
483	500	return Scalar{ .limbs = .{ z04, z14, z24, z34, z44 } };
484	501	}
485	502
486		/// Return x^2 (mod l)
	503	/// Return x^2 (mod L)
487	504	pub fn sq(x: Scalar) Scalar {
488	505	return x.mul(x);
489	506	}
...	...	@@ -503,7 +520,7 @@ pub const Scalar = struct {
503	520	return x.sqn(n).mul(y);
504	521	}
505	522
506		/// Return the inverse of a scalar (mod l), or 0 if x=0.
	523	/// Return the inverse of a scalar (mod L), or 0 if x=0.
507	524	pub fn invert(x: Scalar) Scalar {
508	525	const _10 = x.sq();
509	526	const _11 = x.mul(_10);
...	...	@@ -533,6 +550,18 @@ pub const Scalar = struct {
533	550	.sqn_mul(9, _1101011).sqn_mul(6, _1011).sqn_mul(14, _10010011).sqn_mul(10, _1100011)
534	551	.sqn_mul(9, _10010111).sqn_mul(10, _11110101).sqn_mul(8, _11010011).sqn_mul(8, _11101011);
535	552	}
	553
	554	/// Return a random scalar < L.
	555	pub fn random() Scalar {
	556	var s: [64]u8 = undefined;
	557	while (true) {
	558	crypto.random.bytes(&s);
	559	const n = Scalar.fromBytes64(s);
	560	if (!n.isZero()) {
	561	return n;
	562	}
	563	}
	564	}
536	565	};
537	566
538	567	const ScalarDouble = struct {
...	...	@@ -549,7 +578,7 @@ const ScalarDouble = struct {
549	578	return ScalarDouble{ .limbs = limbs };
550	579	}
551	580
552		fn fromBytes32(bytes: [32]u8) ScalarDouble {
	581	fn fromBytes32(bytes: CompressedScalar) ScalarDouble {
553	582	var limbs: Limbs = undefined;
554	583	var i: usize = 0;
555	584	while (i < 4) : (i += 1) {
...	...	@@ -560,7 +589,7 @@ const ScalarDouble = struct {
560	589	return ScalarDouble{ .limbs = limbs };
561	590	}
562	591
563		fn toBytes(expanded_double: *ScalarDouble) [32]u8 {
	592	fn toBytes(expanded_double: *ScalarDouble) CompressedScalar {
564	593	return expanded_double.reduce(10).toBytes();
565	594	}
566	595
...	...	@@ -840,3 +869,15 @@ test "scalar field inversion" {
840	869	const recovered_x = inv.invert();
841	870	try std.testing.expectEqualSlices(u8, &bytes, &recovered_x.toBytes());
842	871	}
	872
	873	test "random scalar" {
	874	const s1 = random();
	875	const s2 = random();
	876	try std.testing.expect(!mem.eql(u8, &s1, &s2));
	877	}
	878
	879	test "64-bit reduction" {
	880	const bytes = field_size ++ [_]u8{0} ** 32;
	881	const x = Scalar.fromBytes64(bytes);
	882	try std.testing.expect(x.isZero());
	883	}