435c0d9fc8
This PR switches the Nomad repository from using govendor to Go modules for managing dependencies. Aspects of the Nomad workflow remain pretty much the same. The usual Makefile targets should continue to work as they always did. The API submodule simply defers to the parent Nomad version on the repository, keeping the semantics of API versioning that currently exists.
96 lines
3.1 KiB
Go
96 lines
3.1 KiB
Go
// Copyright 2019 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// Package curve25519 provides an implementation of the X25519 function, which
|
|
// performs scalar multiplication on the elliptic curve known as Curve25519.
|
|
// See RFC 7748.
|
|
package curve25519 // import "golang.org/x/crypto/curve25519"
|
|
|
|
import (
|
|
"crypto/subtle"
|
|
"fmt"
|
|
)
|
|
|
|
// ScalarMult sets dst to the product scalar * point.
|
|
//
|
|
// Deprecated: when provided a low-order point, ScalarMult will set dst to all
|
|
// zeroes, irrespective of the scalar. Instead, use the X25519 function, which
|
|
// will return an error.
|
|
func ScalarMult(dst, scalar, point *[32]byte) {
|
|
scalarMult(dst, scalar, point)
|
|
}
|
|
|
|
// ScalarBaseMult sets dst to the product scalar * base where base is the
|
|
// standard generator.
|
|
//
|
|
// It is recommended to use the X25519 function with Basepoint instead, as
|
|
// copying into fixed size arrays can lead to unexpected bugs.
|
|
func ScalarBaseMult(dst, scalar *[32]byte) {
|
|
ScalarMult(dst, scalar, &basePoint)
|
|
}
|
|
|
|
const (
|
|
// ScalarSize is the size of the scalar input to X25519.
|
|
ScalarSize = 32
|
|
// PointSize is the size of the point input to X25519.
|
|
PointSize = 32
|
|
)
|
|
|
|
// Basepoint is the canonical Curve25519 generator.
|
|
var Basepoint []byte
|
|
|
|
var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
|
|
|
|
func init() { Basepoint = basePoint[:] }
|
|
|
|
func checkBasepoint() {
|
|
if subtle.ConstantTimeCompare(Basepoint, []byte{
|
|
0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
}) != 1 {
|
|
panic("curve25519: global Basepoint value was modified")
|
|
}
|
|
}
|
|
|
|
// X25519 returns the result of the scalar multiplication (scalar * point),
|
|
// according to RFC 7748, Section 5. scalar, point and the return value are
|
|
// slices of 32 bytes.
|
|
//
|
|
// scalar can be generated at random, for example with crypto/rand. point should
|
|
// be either Basepoint or the output of another X25519 call.
|
|
//
|
|
// If point is Basepoint (but not if it's a different slice with the same
|
|
// contents) a precomputed implementation might be used for performance.
|
|
func X25519(scalar, point []byte) ([]byte, error) {
|
|
// Outline the body of function, to let the allocation be inlined in the
|
|
// caller, and possibly avoid escaping to the heap.
|
|
var dst [32]byte
|
|
return x25519(&dst, scalar, point)
|
|
}
|
|
|
|
func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
|
|
var in [32]byte
|
|
if l := len(scalar); l != 32 {
|
|
return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32)
|
|
}
|
|
if l := len(point); l != 32 {
|
|
return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32)
|
|
}
|
|
copy(in[:], scalar)
|
|
if &point[0] == &Basepoint[0] {
|
|
checkBasepoint()
|
|
ScalarBaseMult(dst, &in)
|
|
} else {
|
|
var base, zero [32]byte
|
|
copy(base[:], point)
|
|
ScalarMult(dst, &in, &base)
|
|
if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 {
|
|
return nil, fmt.Errorf("bad input point: low order point")
|
|
}
|
|
}
|
|
return dst[:], nil
|
|
}
|