1
2
3
4
5 package elliptic
6
7 import (
8 "crypto/internal/nistec"
9 "errors"
10 "math/big"
11 )
12
13 var p224 = &nistCurve[*nistec.P224Point]{
14 newPoint: nistec.NewP224Point,
15 }
16
17 func initP224() {
18 p224.params = &CurveParams{
19 Name: "P-224",
20 BitSize: 224,
21
22 P: bigFromDecimal("26959946667150639794667015087019630673557916260026308143510066298881"),
23 N: bigFromDecimal("26959946667150639794667015087019625940457807714424391721682722368061"),
24 B: bigFromHex("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4"),
25 Gx: bigFromHex("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21"),
26 Gy: bigFromHex("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34"),
27 }
28 }
29
30 type p256Curve struct {
31 nistCurve[*nistec.P256Point]
32 }
33
34 var p256 = &p256Curve{nistCurve[*nistec.P256Point]{
35 newPoint: nistec.NewP256Point,
36 }}
37
38 func initP256() {
39 p256.params = &CurveParams{
40 Name: "P-256",
41 BitSize: 256,
42
43 P: bigFromDecimal("115792089210356248762697446949407573530086143415290314195533631308867097853951"),
44 N: bigFromDecimal("115792089210356248762697446949407573529996955224135760342422259061068512044369"),
45 B: bigFromHex("5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b"),
46 Gx: bigFromHex("6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296"),
47 Gy: bigFromHex("4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5"),
48 }
49 }
50
51 var p384 = &nistCurve[*nistec.P384Point]{
52 newPoint: nistec.NewP384Point,
53 }
54
55 func initP384() {
56 p384.params = &CurveParams{
57 Name: "P-384",
58 BitSize: 384,
59
60 P: bigFromDecimal("394020061963944792122790401001436138050797392704654" +
61 "46667948293404245721771496870329047266088258938001861606973112319"),
62 N: bigFromDecimal("394020061963944792122790401001436138050797392704654" +
63 "46667946905279627659399113263569398956308152294913554433653942643"),
64 B: bigFromHex("b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088" +
65 "f5013875ac656398d8a2ed19d2a85c8edd3ec2aef"),
66 Gx: bigFromHex("aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741" +
67 "e082542a385502f25dbf55296c3a545e3872760ab7"),
68 Gy: bigFromHex("3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da31" +
69 "13b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f"),
70 }
71 }
72
73 var p521 = &nistCurve[*nistec.P521Point]{
74 newPoint: nistec.NewP521Point,
75 }
76
77 func initP521() {
78 p521.params = &CurveParams{
79 Name: "P-521",
80 BitSize: 521,
81
82 P: bigFromDecimal("68647976601306097149819007990813932172694353001433" +
83 "0540939446345918554318339765605212255964066145455497729631139148" +
84 "0858037121987999716643812574028291115057151"),
85 N: bigFromDecimal("68647976601306097149819007990813932172694353001433" +
86 "0540939446345918554318339765539424505774633321719753296399637136" +
87 "3321113864768612440380340372808892707005449"),
88 B: bigFromHex("0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8" +
89 "b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef" +
90 "451fd46b503f00"),
91 Gx: bigFromHex("00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f8" +
92 "28af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf9" +
93 "7e7e31c2e5bd66"),
94 Gy: bigFromHex("011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817" +
95 "afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088" +
96 "be94769fd16650"),
97 }
98 }
99
100
101
102
103
104
105
106
107
108
109
110 type nistCurve[Point nistPoint[Point]] struct {
111 newPoint func() Point
112 params *CurveParams
113 }
114
115
116 type nistPoint[T any] interface {
117 Bytes() []byte
118 SetBytes([]byte) (T, error)
119 Add(T, T) T
120 Double(T) T
121 ScalarMult(T, []byte) (T, error)
122 ScalarBaseMult([]byte) (T, error)
123 }
124
125 func (curve *nistCurve[Point]) Params() *CurveParams {
126 return curve.params
127 }
128
129 func (curve *nistCurve[Point]) IsOnCurve(x, y *big.Int) bool {
130
131
132 if x.Sign() == 0 && y.Sign() == 0 {
133 return false
134 }
135 _, err := curve.pointFromAffine(x, y)
136 return err == nil
137 }
138
139 func (curve *nistCurve[Point]) pointFromAffine(x, y *big.Int) (p Point, err error) {
140 p = curve.newPoint()
141
142
143 if x.Sign() == 0 && y.Sign() == 0 {
144 return p, nil
145 }
146
147 if x.Sign() < 0 || y.Sign() < 0 {
148 return p, errors.New("negative coordinate")
149 }
150 if x.BitLen() > curve.params.BitSize || y.BitLen() > curve.params.BitSize {
151 return p, errors.New("overflowing coordinate")
152 }
153
154 byteLen := (curve.params.BitSize + 7) / 8
155 buf := make([]byte, 1+2*byteLen)
156 buf[0] = 4
157 x.FillBytes(buf[1 : 1+byteLen])
158 y.FillBytes(buf[1+byteLen : 1+2*byteLen])
159 return p.SetBytes(buf)
160 }
161
162 func (curve *nistCurve[Point]) pointToAffine(p Point) (x, y *big.Int) {
163 out := p.Bytes()
164 if len(out) == 1 && out[0] == 0 {
165
166
167 return new(big.Int), new(big.Int)
168 }
169 byteLen := (curve.params.BitSize + 7) / 8
170 x = new(big.Int).SetBytes(out[1 : 1+byteLen])
171 y = new(big.Int).SetBytes(out[1+byteLen:])
172 return x, y
173 }
174
175 func (curve *nistCurve[Point]) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
176 p1, err := curve.pointFromAffine(x1, y1)
177 if err != nil {
178 panic("crypto/elliptic: Add was called on an invalid point")
179 }
180 p2, err := curve.pointFromAffine(x2, y2)
181 if err != nil {
182 panic("crypto/elliptic: Add was called on an invalid point")
183 }
184 return curve.pointToAffine(p1.Add(p1, p2))
185 }
186
187 func (curve *nistCurve[Point]) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
188 p, err := curve.pointFromAffine(x1, y1)
189 if err != nil {
190 panic("crypto/elliptic: Double was called on an invalid point")
191 }
192 return curve.pointToAffine(p.Double(p))
193 }
194
195
196
197 func (curve *nistCurve[Point]) normalizeScalar(scalar []byte) []byte {
198 byteSize := (curve.params.N.BitLen() + 7) / 8
199 if len(scalar) == byteSize {
200 return scalar
201 }
202 s := new(big.Int).SetBytes(scalar)
203 if len(scalar) > byteSize {
204 s.Mod(s, curve.params.N)
205 }
206 out := make([]byte, byteSize)
207 return s.FillBytes(out)
208 }
209
210 func (curve *nistCurve[Point]) ScalarMult(Bx, By *big.Int, scalar []byte) (*big.Int, *big.Int) {
211 p, err := curve.pointFromAffine(Bx, By)
212 if err != nil {
213 panic("crypto/elliptic: ScalarMult was called on an invalid point")
214 }
215 scalar = curve.normalizeScalar(scalar)
216 p, err = p.ScalarMult(p, scalar)
217 if err != nil {
218 panic("crypto/elliptic: nistec rejected normalized scalar")
219 }
220 return curve.pointToAffine(p)
221 }
222
223 func (curve *nistCurve[Point]) ScalarBaseMult(scalar []byte) (*big.Int, *big.Int) {
224 scalar = curve.normalizeScalar(scalar)
225 p, err := curve.newPoint().ScalarBaseMult(scalar)
226 if err != nil {
227 panic("crypto/elliptic: nistec rejected normalized scalar")
228 }
229 return curve.pointToAffine(p)
230 }
231
232
233
234 func (curve *nistCurve[Point]) CombinedMult(Px, Py *big.Int, s1, s2 []byte) (x, y *big.Int) {
235 s1 = curve.normalizeScalar(s1)
236 q, err := curve.newPoint().ScalarBaseMult(s1)
237 if err != nil {
238 panic("crypto/elliptic: nistec rejected normalized scalar")
239 }
240 p, err := curve.pointFromAffine(Px, Py)
241 if err != nil {
242 panic("crypto/elliptic: CombinedMult was called on an invalid point")
243 }
244 s2 = curve.normalizeScalar(s2)
245 p, err = p.ScalarMult(p, s2)
246 if err != nil {
247 panic("crypto/elliptic: nistec rejected normalized scalar")
248 }
249 return curve.pointToAffine(p.Add(p, q))
250 }
251
252 func (curve *nistCurve[Point]) Unmarshal(data []byte) (x, y *big.Int) {
253 if len(data) == 0 || data[0] != 4 {
254 return nil, nil
255 }
256
257 _, err := curve.newPoint().SetBytes(data)
258 if err != nil {
259 return nil, nil
260 }
261
262
263
264 byteLen := (curve.params.BitSize + 7) / 8
265 x = new(big.Int).SetBytes(data[1 : 1+byteLen])
266 y = new(big.Int).SetBytes(data[1+byteLen:])
267 return x, y
268 }
269
270 func (curve *nistCurve[Point]) UnmarshalCompressed(data []byte) (x, y *big.Int) {
271 if len(data) == 0 || (data[0] != 2 && data[0] != 3) {
272 return nil, nil
273 }
274 p, err := curve.newPoint().SetBytes(data)
275 if err != nil {
276 return nil, nil
277 }
278 return curve.pointToAffine(p)
279 }
280
281 func bigFromDecimal(s string) *big.Int {
282 b, ok := new(big.Int).SetString(s, 10)
283 if !ok {
284 panic("crypto/elliptic: internal error: invalid encoding")
285 }
286 return b
287 }
288
289 func bigFromHex(s string) *big.Int {
290 b, ok := new(big.Int).SetString(s, 16)
291 if !ok {
292 panic("crypto/elliptic: internal error: invalid encoding")
293 }
294 return b
295 }
296
View as plain text