Loading...
Searching...
No Matches
point_448.hxx
Go to the documentation of this file.
#ifndef __DECAF_POINT_448_HXX__
#define __DECAF_POINT_448_HXX__ 1
#ifndef _XOPEN_SOURCE
#define _XOPEN_SOURCE 600
#endif
#include <stdlib.h>
#include <string.h> /* for memcpy */
#include <decaf/point_448.h>
#include <decaf/ed448.h>
#include <decaf/secure_buffer.hxx>
#include <string>
#include <sys/types.h>
#include <limits.h>
#if __cplusplus >= 201103L
#define DECAF_NOEXCEPT noexcept
#else
#define DECAF_NOEXCEPT throw()
#endif
namespace decaf {
struct Ed448Goldilocks {
static inline const char *name() { return "Ed448-Goldilocks"; }
static inline int bits() { return 448; }
static const int REMOVED_COFACTOR = 4;
static const int FIELD_MODULUS_TYPE = 3;
class Point;
class Precomputed;
class Scalar : public Serializable<Scalar> {
public:
typedef decaf_448_scalar_t Wrapped;
static const size_t SER_BYTES = DECAF_448_SCALAR_BYTES;
Wrapped s;
inline Scalar(const NOINIT &) DECAF_NOEXCEPT {}
inline Scalar(uint64_t w) DECAF_NOEXCEPT { *this = w; }
inline Scalar(int64_t w) DECAF_NOEXCEPT { *this = w; }
inline Scalar(unsigned int w) DECAF_NOEXCEPT { *this = w; }
inline Scalar(int w) DECAF_NOEXCEPT { *this = w; }
inline explicit Scalar(Rng &rng) DECAF_NOEXCEPT {
FixedArrayBuffer<SER_BYTES + 16> sb(rng);
*this = sb;
}
inline Scalar(const Wrapped &t = decaf_448_scalar_zero) DECAF_NOEXCEPT { decaf_448_scalar_copy(s,t); }
inline Scalar(const Scalar &x) DECAF_NOEXCEPT { *this = x; }
inline Scalar(const Block &buffer) DECAF_NOEXCEPT { *this = buffer; }
inline size_t ser_size() const DECAF_NOEXCEPT { return SER_BYTES; }
inline void serialize_into(unsigned char *buffer) const DECAF_NOEXCEPT {
decaf_448_scalar_encode(buffer, s);
}
inline Scalar& operator=(const Scalar &x) DECAF_NOEXCEPT { decaf_448_scalar_copy(s,x.s); return *this; }
inline Scalar& operator=(uint64_t w) DECAF_NOEXCEPT { decaf_448_scalar_set_unsigned(s,w); return *this; }
inline Scalar& operator=(int64_t w) DECAF_NOEXCEPT {
#ifdef _MSC_VER
#pragma warning ( push)
#pragma warning ( disable : 4146)
#endif
Scalar t(-(uint64_t)INT_MIN);
#ifdef _MSC_VER
#pragma warning ( pop)
#endif
decaf_448_scalar_set_unsigned(s,(uint64_t)w - (uint64_t)INT_MIN);
*this -= t;
return *this;
}
inline Scalar& operator=(unsigned int w) DECAF_NOEXCEPT { return *this = (uint64_t)w; }
inline Scalar& operator=(int w) DECAF_NOEXCEPT { return *this = (int64_t)w; }
inline ~Scalar() DECAF_NOEXCEPT { decaf_448_scalar_destroy(s); }
inline Scalar &operator=(const Block &bl) DECAF_NOEXCEPT {
decaf_448_scalar_decode_long(s,bl.data(),bl.size()); return *this;
}
static inline decaf_error_t DECAF_WARN_UNUSED decode (
Scalar &sc, const FixedBlock<SER_BYTES> buffer
) DECAF_NOEXCEPT {
return decaf_448_scalar_decode(sc.s,buffer.data());
}
inline Scalar operator+ (const Scalar &q) const DECAF_NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_add(r.s,s,q.s); return r; }
inline Scalar &operator+=(const Scalar &q) DECAF_NOEXCEPT { decaf_448_scalar_add(s,s,q.s); return *this; }
inline Scalar operator- (const Scalar &q) const DECAF_NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,s,q.s); return r; }
inline Scalar &operator-=(const Scalar &q) DECAF_NOEXCEPT { decaf_448_scalar_sub(s,s,q.s); return *this; }
inline Scalar operator* (const Scalar &q) const DECAF_NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_mul(r.s,s,q.s); return r; }
inline Scalar &operator*=(const Scalar &q) DECAF_NOEXCEPT { decaf_448_scalar_mul(s,s,q.s); return *this; }
inline Scalar operator- () const DECAF_NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,decaf_448_scalar_zero,s); return r; }
inline Scalar inverse() const /*throw(CryptoException)*/ {
Scalar r;
if (DECAF_SUCCESS != decaf_448_scalar_invert(r.s,s)) {
throw CryptoException();
}
return r;
}
inline decaf_error_t DECAF_WARN_UNUSED
inverse_noexcept(Scalar &r) const DECAF_NOEXCEPT {
return decaf_448_scalar_invert(r.s,s);
}
inline Scalar operator/ (const Scalar &q) const /*throw(CryptoException)*/ { return *this * q.inverse(); }
inline Scalar &operator/=(const Scalar &q) /*throw(CryptoException)*/ { return *this *= q.inverse(); }
inline Scalar half() const { Scalar out; decaf_448_scalar_halve(out.s,s); return out; }
inline bool operator!=(const Scalar &q) const DECAF_NOEXCEPT { return !(*this == q); }
inline bool operator==(const Scalar &q) const DECAF_NOEXCEPT { return !!decaf_448_scalar_eq(s,q.s); }
inline Point operator* (const Point &q) const DECAF_NOEXCEPT { return q * (*this); }
inline Point operator* (const Precomputed &q) const DECAF_NOEXCEPT { return q * (*this); }
inline SecureBuffer direct_scalarmul (
const FixedBlock<SER_BYTES> &in,
decaf_bool_t allow_identity=DECAF_FALSE,
decaf_bool_t short_circuit=DECAF_TRUE
) const /*throw(CryptoException)*/;
inline decaf_error_t DECAF_WARN_UNUSED direct_scalarmul_noexcept(
FixedBuffer<SER_BYTES> &out,
const FixedBlock<SER_BYTES> &in,
decaf_bool_t allow_identity=DECAF_FALSE,
decaf_bool_t short_circuit=DECAF_TRUE
) const DECAF_NOEXCEPT;
};
class Point : public Serializable<Point> {
public:
typedef decaf_448_point_t Wrapped;
static const size_t SER_BYTES = DECAF_448_SER_BYTES;
static const size_t HASH_BYTES = DECAF_448_HASH_BYTES;
static const size_t EDDSA_BYTES = DECAF_EDDSA_448_PUBLIC_BYTES;
static const size_t LADDER_BYTES = DECAF_X448_PUBLIC_BYTES;
static const int EDDSA_ENCODE_RATIO = DECAF_448_EDDSA_ENCODE_RATIO;
static const int EDDSA_DECODE_RATIO = DECAF_448_EDDSA_DECODE_RATIO;
static const int LADDER_ENCODE_RATIO = DECAF_X448_ENCODE_RATIO;
static const size_t STEG_BYTES = HASH_BYTES * 2;
static const unsigned int INVERT_ELLIGATOR_WHICH_BITS = DECAF_448_INVERT_ELLIGATOR_WHICH_BITS;
Wrapped p;
inline Point(const NOINIT &) DECAF_NOEXCEPT {}
inline Point(const Wrapped &q = decaf_448_point_identity) DECAF_NOEXCEPT { decaf_448_point_copy(p,q); }
inline Point(const Point &q) DECAF_NOEXCEPT { *this = q; }
inline Point& operator=(const Point &q) DECAF_NOEXCEPT { decaf_448_point_copy(p,q.p); return *this; }
inline ~Point() DECAF_NOEXCEPT { decaf_448_point_destroy(p); }
inline explicit Point(Rng &rng, bool uniform = true) DECAF_NOEXCEPT {
if (uniform) {
FixedArrayBuffer<2*HASH_BYTES> b(rng);
set_to_hash(b);
} else {
FixedArrayBuffer<HASH_BYTES> b(rng);
set_to_hash(b);
}
}
inline explicit Point(const FixedBlock<SER_BYTES> &buffer, bool allow_identity=true)
/*throw(CryptoException)*/ {
if (DECAF_SUCCESS != decode(buffer,allow_identity)) {
throw CryptoException();
}
}
inline decaf_error_t DECAF_WARN_UNUSED decode (
const FixedBlock<SER_BYTES> &buffer, bool allow_identity=true
) DECAF_NOEXCEPT {
return decaf_448_point_decode(p,buffer.data(),allow_identity ? DECAF_TRUE : DECAF_FALSE);
}
inline decaf_error_t DECAF_WARN_UNUSED decode_like_eddsa_and_mul_by_ratio_noexcept (
const FixedBlock<DECAF_EDDSA_448_PUBLIC_BYTES> &buffer
) DECAF_NOEXCEPT {
return decaf_448_point_decode_like_eddsa_and_mul_by_ratio(p,buffer.data());
}
inline void decode_like_eddsa_and_mul_by_ratio(
const FixedBlock<DECAF_EDDSA_448_PUBLIC_BYTES> &buffer
) /*throw(CryptoException)*/ {
if (DECAF_SUCCESS != decode_like_eddsa_and_mul_by_ratio_noexcept(buffer)) throw(CryptoException());
}
inline SecureBuffer mul_by_ratio_and_encode_like_eddsa() const {
SecureBuffer ret(DECAF_EDDSA_448_PUBLIC_BYTES);
decaf_448_point_mul_by_ratio_and_encode_like_eddsa(ret.data(),p);
return ret;
}
inline void mul_by_ratio_and_encode_like_eddsa(
FixedBuffer<DECAF_EDDSA_448_PUBLIC_BYTES> &out
) const {
decaf_448_point_mul_by_ratio_and_encode_like_eddsa(out.data(),p);
}
inline SecureBuffer mul_by_ratio_and_encode_like_ladder() const {
SecureBuffer ret(LADDER_BYTES);
decaf_448_point_mul_by_ratio_and_encode_like_x448(ret.data(),p);
return ret;
}
inline void mul_by_ratio_and_encode_like_ladder(FixedBuffer<LADDER_BYTES> &out) const {
decaf_448_point_mul_by_ratio_and_encode_like_x448(out.data(),p);
}
static inline Point from_hash ( const Block &s ) DECAF_NOEXCEPT {
Point p((NOINIT())); p.set_to_hash(s); return p;
}
inline void set_to_hash( const Block &s ) DECAF_NOEXCEPT {
if (s.size() < HASH_BYTES) {
SecureBuffer b(HASH_BYTES);
memcpy(b.data(), s.data(), s.size());
decaf_448_point_from_hash_nonuniform(p,b.data());
} else if (s.size() == HASH_BYTES) {
decaf_448_point_from_hash_nonuniform(p,s.data());
} else if (s.size() < 2*HASH_BYTES) {
SecureBuffer b(2*HASH_BYTES);
memcpy(b.data(), s.data(), s.size());
decaf_448_point_from_hash_uniform(p,b.data());
} else {
decaf_448_point_from_hash_uniform(p,s.data());
}
}
inline operator SecureBuffer() const {
SecureBuffer buffer(SER_BYTES);
decaf_448_point_encode(buffer.data(), p);
return buffer;
}
inline size_t ser_size() const DECAF_NOEXCEPT { return SER_BYTES; }
inline void serialize_into(unsigned char *buffer) const DECAF_NOEXCEPT {
decaf_448_point_encode(buffer, p);
}
inline Point operator+ (const Point &q) const DECAF_NOEXCEPT { Point r((NOINIT())); decaf_448_point_add(r.p,p,q.p); return r; }
inline Point &operator+=(const Point &q) DECAF_NOEXCEPT { decaf_448_point_add(p,p,q.p); return *this; }
inline Point operator- (const Point &q) const DECAF_NOEXCEPT { Point r((NOINIT())); decaf_448_point_sub(r.p,p,q.p); return r; }
inline Point &operator-=(const Point &q) DECAF_NOEXCEPT { decaf_448_point_sub(p,p,q.p); return *this; }
inline Point operator- () const DECAF_NOEXCEPT { Point r((NOINIT())); decaf_448_point_negate(r.p,p); return r; }
inline Point times_two () const DECAF_NOEXCEPT { Point r((NOINIT())); decaf_448_point_double(r.p,p); return r; }
inline Point &double_in_place() DECAF_NOEXCEPT { decaf_448_point_double(p,p); return *this; }
inline bool operator!=(const Point &q) const DECAF_NOEXCEPT { return ! decaf_448_point_eq(p,q.p); }
inline bool operator==(const Point &q) const DECAF_NOEXCEPT { return !!decaf_448_point_eq(p,q.p); }
inline Point operator* (const Scalar &s) const DECAF_NOEXCEPT { Point r((NOINIT())); decaf_448_point_scalarmul(r.p,p,s.s); return r; }
inline Point &operator*=(const Scalar &s) DECAF_NOEXCEPT { decaf_448_point_scalarmul(p,p,s.s); return *this; }
inline Point operator/ (const Scalar &s) const /*throw(CryptoException)*/ { return (*this) * s.inverse(); }
inline Point &operator/=(const Scalar &s) /*throw(CryptoException)*/ { return (*this) *= s.inverse(); }
inline bool validate() const DECAF_NOEXCEPT { return decaf_448_point_valid(p); }
static inline Point double_scalarmul (
const Point &q, const Scalar &qs, const Point &r, const Scalar &rs
) DECAF_NOEXCEPT {
Point p((NOINIT())); decaf_448_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p;
}
inline void dual_scalarmul (
Point &q1, Point &q2, const Scalar &r1, const Scalar &r2
) const DECAF_NOEXCEPT {
decaf_448_point_dual_scalarmul(q1.p,q2.p,p,r1.s,r2.s);
}
static inline Point double_scalarmul (
const Scalar &qs, const Point &q, const Scalar &rs, const Point &r
) DECAF_NOEXCEPT {
return double_scalarmul(q,qs,r,rs);
}
inline Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) DECAF_NOEXCEPT {
Point r((NOINIT())); decaf_448_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r;
}
inline Point debugging_torque() const DECAF_NOEXCEPT {
Point q;
decaf_448_point_debugging_torque(q.p,p);
return q;
}
inline Point debugging_pscale(const FixedBlock<SER_BYTES> factor) const DECAF_NOEXCEPT {
Point q;
decaf_448_point_debugging_pscale(q.p,p,factor.data());
return q;
}
inline Point debugging_pscale(Rng &r) const DECAF_NOEXCEPT {
FixedArrayBuffer<SER_BYTES> sb(r);
return debugging_pscale(sb);
}
inline decaf_error_t invert_elligator (
Buffer buf, uint32_t hint
) const DECAF_NOEXCEPT {
unsigned char buf2[2*HASH_BYTES];
memset(buf2,0,sizeof(buf2));
memcpy(buf2,buf.data(),(buf.size() > 2*HASH_BYTES) ? 2*HASH_BYTES : buf.size());
decaf_bool_t ret;
if (buf.size() > HASH_BYTES) {
ret = decaf_successful(decaf_448_invert_elligator_uniform(buf2, p, hint));
} else {
ret = decaf_successful(decaf_448_invert_elligator_nonuniform(buf2, p, hint));
}
if (buf.size() < HASH_BYTES) {
ret &= decaf_memeq(&buf2[buf.size()], &buf2[HASH_BYTES], HASH_BYTES - buf.size());
}
for (size_t i=0; i<buf.size() && i<HASH_BYTES; i++) {
buf[i] = (buf[i] & ~ret) | (buf2[i] &ret);
}
decaf_bzero(buf2,sizeof(buf2));
return decaf_succeed_if(ret);
}
inline SecureBuffer steg_encode(Rng &rng) const /*throw(std::bad_alloc, LengthException)*/ {
SecureBuffer out(STEG_BYTES);
decaf_error_t done;
do {
rng.read(Buffer(out).slice(HASH_BYTES-4,STEG_BYTES-HASH_BYTES+4));
uint32_t hint = 0;
for (int i=0; i<4; i++) { hint |= uint32_t(out[HASH_BYTES-4+i])<<(8*i); }
done = invert_elligator(out, hint);
} while (!decaf_successful(done));
return out;
}
static inline const Point base() DECAF_NOEXCEPT { return Point(decaf_448_point_base); }
static inline const Point identity() DECAF_NOEXCEPT { return Point(decaf_448_point_identity); }
};
typedef decaf_448_precomputed_s Precomputed_U;
class Precomputed
: protected OwnedOrUnowned<Precomputed,Precomputed_U>
{
public:
inline ~Precomputed() DECAF_NOEXCEPT { clear(); }
inline Precomputed (
const Precomputed_U &yours = *decaf_448_precomputed_base
) DECAF_NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>(yours) {}
#if __cplusplus >= 201103L
inline Precomputed &operator=(Precomputed &&it) DECAF_NOEXCEPT {
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
inline Precomputed(Precomputed &&it) DECAF_NOEXCEPT : OwnedOrUnowned<Precomputed,Precomputed_U>() {
*this = it;
}
inline Precomputed &operator=(const Precomputed &it) DECAF_NOEXCEPT {
OwnedOrUnowned<Precomputed,Precomputed_U>::operator= (it);
return *this;
}
#endif
inline Precomputed &operator=(const Point &it) /*throw(std::bad_alloc)*/ {
alloc();
decaf_448_precompute(ours.mine,it.p);
return *this;
}
inline Precomputed(const Precomputed &it) /*throw(std::bad_alloc)*/
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
inline explicit Precomputed(const Point &it) /*throw(std::bad_alloc)*/
: OwnedOrUnowned<Precomputed,Precomputed_U>() { *this = it; }
inline Point operator* (const Scalar &s) const DECAF_NOEXCEPT { Point r; decaf_448_precomputed_scalarmul(r.p,get(),s.s); return r; }
inline Point operator/ (const Scalar &s) const /*throw(CryptoException)*/ { return (*this) * s.inverse(); }
static inline const Precomputed base() DECAF_NOEXCEPT { return Precomputed(); }
public:
friend class OwnedOrUnowned<Precomputed,Precomputed_U>;
static inline size_t size() DECAF_NOEXCEPT { return decaf_448_sizeof_precomputed_s; }
static inline size_t alignment() DECAF_NOEXCEPT { return decaf_448_alignof_precomputed_s; }
static inline const Precomputed_U * default_value() DECAF_NOEXCEPT { return decaf_448_precomputed_base; }
};
struct DhLadder {
public:
static const size_t PUBLIC_BYTES = DECAF_X448_PUBLIC_BYTES;
static const size_t PRIVATE_BYTES = DECAF_X448_PRIVATE_BYTES;
static const FixedBlock<PUBLIC_BYTES> base_point() DECAF_NOEXCEPT {
return FixedBlock<PUBLIC_BYTES>(decaf_x448_base_point);
}
static inline SecureBuffer shared_secret(
const FixedBlock<PUBLIC_BYTES> &pk,
const FixedBlock<PRIVATE_BYTES> &scalar
) /*throw(std::bad_alloc,CryptoException)*/ {
SecureBuffer out(PUBLIC_BYTES);
if (DECAF_SUCCESS != decaf_x448(out.data(), pk.data(), scalar.data())) {
throw CryptoException();
}
return out;
}
static inline decaf_error_t DECAF_WARN_UNUSED
shared_secret_noexcept (
FixedBuffer<PUBLIC_BYTES> &out,
const FixedBlock<PUBLIC_BYTES> &pk,
const FixedBlock<PRIVATE_BYTES> &scalar
) DECAF_NOEXCEPT {
return decaf_x448(out.data(), pk.data(), scalar.data());
}
static inline SecureBuffer DECAF_DEPRECATED("Renamed to derive_public_key")
generate_key(
const FixedBlock<PRIVATE_BYTES> &scalar
) /*throw(std::bad_alloc)*/ {
SecureBuffer out(PUBLIC_BYTES);
decaf_x448_derive_public_key(out.data(), scalar.data());
return out;
}
static inline SecureBuffer derive_public_key(
const FixedBlock<PRIVATE_BYTES> &scalar
) /*throw(std::bad_alloc)*/ {
SecureBuffer out(PUBLIC_BYTES);
decaf_x448_derive_public_key(out.data(), scalar.data());
return out;
}
static inline void
derive_public_key_noexcept (
FixedBuffer<PUBLIC_BYTES> &out,
const FixedBlock<PRIVATE_BYTES> &scalar
) DECAF_NOEXCEPT {
decaf_x448_derive_public_key(out.data(), scalar.data());
}
static inline void
DECAF_DEPRECATED("Renamed to derive_public_key_noexcept")
generate_key_noexcept (
FixedBuffer<PUBLIC_BYTES> &out,
const FixedBlock<PRIVATE_BYTES> &scalar
) DECAF_NOEXCEPT {
decaf_x448_derive_public_key(out.data(), scalar.data());
}
};
}; /* struct Ed448Goldilocks */
inline SecureBuffer Ed448Goldilocks::Scalar::direct_scalarmul (
const FixedBlock<Ed448Goldilocks::Point::SER_BYTES> &in,
decaf_bool_t allow_identity,
decaf_bool_t short_circuit
) const /*throw(CryptoException)*/ {
SecureBuffer out(Ed448Goldilocks::Point::SER_BYTES);
if (DECAF_SUCCESS !=
decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit)
) {
throw CryptoException();
}
return out;
}
inline decaf_error_t Ed448Goldilocks::Scalar::direct_scalarmul_noexcept (
FixedBuffer<Ed448Goldilocks::Point::SER_BYTES> &out,
const FixedBlock<Ed448Goldilocks::Point::SER_BYTES> &in,
decaf_bool_t allow_identity,
decaf_bool_t short_circuit
) const DECAF_NOEXCEPT {
return decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit);
}
#undef DECAF_NOEXCEPT
} /* namespace decaf */
#endif /* __DECAF_POINT_448_HXX__ */
decaf::Block
A reference to a block of data, which (when accessed through this base class) is const.
Definition secure_buffer.hxx:159
decaf::Block::data
const unsigned char * data() const DECAF_NOEXCEPT
Get const data.
Definition secure_buffer.hxx:199
decaf::Block::size
size_t size() const DECAF_NOEXCEPT
Get the size.
Definition secure_buffer.hxx:208
decaf::Buffer
A reference to a writable block of data.
Definition secure_buffer.hxx:270
decaf::CryptoException
An exception for when crypto (ie point decode) has failed.
Definition secure_buffer.hxx:119
decaf::Ed448Goldilocks::Point
Element of prime-order elliptic curve group.
Definition point_448.hxx:254
decaf::Ed448Goldilocks::Point::LADDER_ENCODE_RATIO
static const int LADDER_ENCODE_RATIO
Ratio due to ladder decoding.
Definition point_448.hxx:278
decaf::Ed448Goldilocks::Point::LADDER_BYTES
static const size_t LADDER_BYTES
Bytes required for EdDSA encoding.
Definition point_448.hxx:269
decaf::Ed448Goldilocks::Point::Point
Point(const Wrapped &q=decaf_448_point_identity) DECAF_NOEXCEPT
Constructor sets to identity by default.
Definition point_448.hxx:297
decaf::Ed448Goldilocks::Point::INVERT_ELLIGATOR_WHICH_BITS
static const unsigned int INVERT_ELLIGATOR_WHICH_BITS
Number of bits in invert_elligator which are actually used.
Definition point_448.hxx:286
decaf::Ed448Goldilocks::Point::double_scalarmul
static Point double_scalarmul(const Point &q, const Scalar &qs, const Point &r, const Scalar &rs) DECAF_NOEXCEPT
Double-scalar multiply, equivalent to q*qs + r*rs but faster.
Definition point_448.hxx:488
decaf::Ed448Goldilocks::Point::mul_by_ratio_and_encode_like_ladder
void mul_by_ratio_and_encode_like_ladder(FixedBuffer< LADDER_BYTES > &out) const
Multiply by LADDER_ENCODE_RATIO and encode like X25519/X448.
Definition point_448.hxx:394
decaf::Ed448Goldilocks::Point::Point
Point(const FixedBlock< SER_BYTES > &buffer, bool allow_identity=true)
Initialize from a fixed-length byte string.
Definition point_448.hxx:326
decaf::Ed448Goldilocks::Point::Wrapped
decaf_448_point_t Wrapped
Wrapped C type.
Definition point_448.hxx:257
decaf::Ed448Goldilocks::Point::Point
Point(Rng &rng, bool uniform=true) DECAF_NOEXCEPT
Construct from RNG.
Definition point_448.hxx:309
decaf::Ed448Goldilocks::Point::operator=
Point & operator=(const Point &q) DECAF_NOEXCEPT
Assignment.
Definition point_448.hxx:303
decaf::Ed448Goldilocks::Point::operator-
Point operator-() const DECAF_NOEXCEPT
Point negate.
Definition point_448.hxx:458
decaf::Ed448Goldilocks::Point::mul_by_ratio_and_encode_like_eddsa
void mul_by_ratio_and_encode_like_eddsa(FixedBuffer< DECAF_EDDSA_448_PUBLIC_BYTES > &out) const
Multiply by EDDSA_ENCODE_RATIO and encode like EdDSA.
Definition point_448.hxx:380
decaf::Ed448Goldilocks::Point::identity
static const Point identity() DECAF_NOEXCEPT
Return the identity point of the curve.
Definition point_448.hxx:583
decaf::Ed448Goldilocks::Point::decode_like_eddsa_and_mul_by_ratio_noexcept
decaf_error_t DECAF_WARN_UNUSED decode_like_eddsa_and_mul_by_ratio_noexcept(const FixedBlock< DECAF_EDDSA_448_PUBLIC_BYTES > &buffer) DECAF_NOEXCEPT
Initialize from C++ fixed-length byte string, like EdDSA.
Definition point_448.hxx:355
decaf::Ed448Goldilocks::Point::ser_size
size_t ser_size() const DECAF_NOEXCEPT
Serializable instance.
Definition point_448.hxx:438
decaf::Ed448Goldilocks::Point::debugging_pscale
Point debugging_pscale(const FixedBlock< SER_BYTES > factor) const DECAF_NOEXCEPT
Return a point equal to *this, whose internal data has a modified representation.
Definition point_448.hxx:528
decaf::Ed448Goldilocks::Point::decode_like_eddsa_and_mul_by_ratio
void decode_like_eddsa_and_mul_by_ratio(const FixedBlock< DECAF_EDDSA_448_PUBLIC_BYTES > &buffer)
Decode from EDDSA, multiply by EDDSA_DECODE_RATIO, and ignore any remaining cofactor information.
Definition point_448.hxx:366
decaf::Ed448Goldilocks::Point::steg_encode
SecureBuffer steg_encode(Rng &rng) const
Steganographically encode this.
Definition point_448.hxx:567
decaf::Ed448Goldilocks::Point::p
Wrapped p
The c-level object.
Definition point_448.hxx:289
decaf::Ed448Goldilocks::Point::debugging_torque
Point debugging_torque() const DECAF_NOEXCEPT
Return a point equal to *this, whose internal data is rotated by a torsion element.
Definition point_448.hxx:521
decaf::Ed448Goldilocks::Point::double_scalarmul
static Point double_scalarmul(const Scalar &qs, const Point &q, const Scalar &rs, const Point &r) DECAF_NOEXCEPT
Double-scalar multiply, equivalent to q*qs + r*rs but faster.
Definition point_448.hxx:505
decaf::Ed448Goldilocks::Point::times_two
Point times_two() const DECAF_NOEXCEPT
Double the point out of place.
Definition point_448.hxx:461
decaf::Ed448Goldilocks::Point::EDDSA_ENCODE_RATIO
static const int EDDSA_ENCODE_RATIO
Ratio due to EdDSA encoding.
Definition point_448.hxx:272
decaf::Ed448Goldilocks::Point::serialize_into
void serialize_into(unsigned char *buffer) const DECAF_NOEXCEPT
Serializable instance.
Definition point_448.hxx:441
decaf::Ed448Goldilocks::Point::operator+
Point operator+(const Point &q) const DECAF_NOEXCEPT
Point add.
Definition point_448.hxx:446
decaf::Ed448Goldilocks::Point::non_secret_combo_with_base
Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) DECAF_NOEXCEPT
Double-scalar multiply: this point by the first scalar and base by the second scalar.
Definition point_448.hxx:516
decaf::Ed448Goldilocks::Point::SER_BYTES
static const size_t SER_BYTES
Size of a serialized element.
Definition point_448.hxx:260
decaf::Ed448Goldilocks::Point::mul_by_ratio_and_encode_like_ladder
SecureBuffer mul_by_ratio_and_encode_like_ladder() const
Multiply by LADDER_ENCODE_RATIO and encode like X25519/X448.
Definition point_448.hxx:387
decaf::Ed448Goldilocks::Point::operator*=
Point & operator*=(const Scalar &s) DECAF_NOEXCEPT
Scalar multiply in place.
Definition point_448.hxx:476
decaf::Ed448Goldilocks::Point::double_in_place
Point & double_in_place() DECAF_NOEXCEPT
Double the point in place.
Definition point_448.hxx:464
decaf::Ed448Goldilocks::Point::debugging_pscale
Point debugging_pscale(Rng &r) const DECAF_NOEXCEPT
Return a point equal to *this, whose internal data has a randomized representation.
Definition point_448.hxx:535
decaf::Ed448Goldilocks::Point::set_to_hash
void set_to_hash(const Block &s) DECAF_NOEXCEPT
Map to the curve from a hash buffer.
Definition point_448.hxx:414
decaf::Ed448Goldilocks::Point::operator+=
Point & operator+=(const Point &q) DECAF_NOEXCEPT
Point add.
Definition point_448.hxx:449
decaf::Ed448Goldilocks::Point::operator*
Point operator*(const Scalar &s) const DECAF_NOEXCEPT
Scalar multiply.
Definition point_448.hxx:473
decaf::Ed448Goldilocks::Point::operator==
bool operator==(const Point &q) const DECAF_NOEXCEPT
Constant-time compare.
Definition point_448.hxx:470
decaf::Ed448Goldilocks::Point::EDDSA_BYTES
static const size_t EDDSA_BYTES
Bytes required for EdDSA encoding.
Definition point_448.hxx:266
decaf::Ed448Goldilocks::Point::operator/
Point operator/(const Scalar &s) const
Multiply by s.inverse().
Definition point_448.hxx:479
decaf::Ed448Goldilocks::Point::dual_scalarmul
void dual_scalarmul(Point &q1, Point &q2, const Scalar &r1, const Scalar &r2) const DECAF_NOEXCEPT
Dual-scalar multiply, equivalent to this*r1, this*r2 but faster.
Definition point_448.hxx:495
decaf::Ed448Goldilocks::Point::base
static const Point base() DECAF_NOEXCEPT
Return the base point of the curve.
Definition point_448.hxx:580
decaf::Ed448Goldilocks::Point::Point
Point(const Point &q) DECAF_NOEXCEPT
Copy constructor.
Definition point_448.hxx:300
decaf::Ed448Goldilocks::Point::~Point
~Point() DECAF_NOEXCEPT
Destructor securely zeorizes the point.
Definition point_448.hxx:306
decaf::Ed448Goldilocks::Point::decode
decaf_error_t DECAF_WARN_UNUSED decode(const FixedBlock< SER_BYTES > &buffer, bool allow_identity=true) DECAF_NOEXCEPT
Initialize from C++ fixed-length byte string.
Definition point_448.hxx:341
decaf::Ed448Goldilocks::Point::STEG_BYTES
static const size_t STEG_BYTES
Size of a steganographically-encoded curve element.
Definition point_448.hxx:283
decaf::Ed448Goldilocks::Point::EDDSA_DECODE_RATIO
static const int EDDSA_DECODE_RATIO
Ratio due to EdDSA decoding.
Definition point_448.hxx:275
decaf::Ed448Goldilocks::Point::from_hash
static Point from_hash(const Block &s) DECAF_NOEXCEPT
Map uniformly to the curve from a hash buffer.
Definition point_448.hxx:404
decaf::Ed448Goldilocks::Point::mul_by_ratio_and_encode_like_eddsa
SecureBuffer mul_by_ratio_and_encode_like_eddsa() const
Multiply by EDDSA_ENCODE_RATIO and encode like EdDSA.
Definition point_448.hxx:373
decaf::Ed448Goldilocks::Point::operator!=
bool operator!=(const Point &q) const DECAF_NOEXCEPT
Constant-time compare.
Definition point_448.hxx:467
decaf::Ed448Goldilocks::Point::HASH_BYTES
static const size_t HASH_BYTES
Bytes required for hash.
Definition point_448.hxx:263
decaf::Ed448Goldilocks::Point::validate
bool validate() const DECAF_NOEXCEPT
Validate / sanity check.
Definition point_448.hxx:485
decaf::Ed448Goldilocks::Point::invert_elligator
decaf_error_t invert_elligator(Buffer buf, uint32_t hint) const DECAF_NOEXCEPT
Modify buffer so that Point::from_hash(Buffer) == *this, and return DECAF_SUCCESS; or leave buf unmod...
Definition point_448.hxx:544
decaf::Ed448Goldilocks::Point::operator-=
Point & operator-=(const Point &q) DECAF_NOEXCEPT
Point subtract.
Definition point_448.hxx:455
decaf::Ed448Goldilocks::Point::operator/=
Point & operator/=(const Scalar &s)
Multiply by s.inverse().
Definition point_448.hxx:482
decaf::Ed448Goldilocks::Precomputed
Precomputed table of points.
Definition point_448.hxx:600
decaf::Ed448Goldilocks::Precomputed::base
static const Precomputed base() DECAF_NOEXCEPT
Return the table for the base point.
Definition point_448.hxx:669
decaf::Ed448Goldilocks::Precomputed::Precomputed
Precomputed(const Precomputed &it)
Copy constructor.
Definition point_448.hxx:653
decaf::Ed448Goldilocks::Precomputed::operator/
Point operator/(const Scalar &s) const
Multiply by s.inverse().
Definition point_448.hxx:666
decaf::Ed448Goldilocks::Precomputed::Precomputed
Precomputed(const Point &it)
Constructor which initializes from point.
Definition point_448.hxx:659
decaf::Ed448Goldilocks::Precomputed::~Precomputed
~Precomputed() DECAF_NOEXCEPT
Destructor securely zeorizes the memory.
Definition point_448.hxx:604
decaf::Ed448Goldilocks::Precomputed::operator=
Precomputed & operator=(const Point &it)
Initilaize from point.
Definition point_448.hxx:644
decaf::Ed448Goldilocks::Precomputed::Precomputed
Precomputed(const Precomputed_U &yours= *decaf_448_precomputed_base) DECAF_NOEXCEPT
Initialize from underlying type, declared as a reference to prevent it from being called with 0,...
Definition point_448.hxx:617
decaf::Ed448Goldilocks::Precomputed::operator*
Point operator*(const Scalar &s) const DECAF_NOEXCEPT
Fixed base scalarmul.
Definition point_448.hxx:663
decaf::Ed448Goldilocks::Scalar
A scalar modulo the curve order.
Definition point_448.hxx:78
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(const Block &buffer) DECAF_NOEXCEPT
Construct from arbitrary-length little-endian byte sequence.
Definition point_448.hxx:119
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(uint64_t w) DECAF_NOEXCEPT
Assign from unsigned 64-bit integer.
Definition point_448.hxx:133
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(int64_t w) DECAF_NOEXCEPT
Set to a signed word.
Definition point_448.hxx:98
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(unsigned int w) DECAF_NOEXCEPT
Assign from unsigned int.
Definition point_448.hxx:152
decaf::Ed448Goldilocks::Scalar::operator-=
Scalar & operator-=(const Scalar &q) DECAF_NOEXCEPT
Subtract from this.
Definition point_448.hxx:185
decaf::Ed448Goldilocks::Scalar::ser_size
size_t ser_size() const DECAF_NOEXCEPT
Serializable instance.
Definition point_448.hxx:122
decaf::Ed448Goldilocks::Scalar::SER_BYTES
static const size_t SER_BYTES
Size of a serialized element.
Definition point_448.hxx:84
decaf::Ed448Goldilocks::Scalar::half
Scalar half() const
Return half this scalar.
Definition point_448.hxx:221
decaf::Ed448Goldilocks::Scalar::operator/
Scalar operator/(const Scalar &q) const
Return this/q.
Definition point_448.hxx:215
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(int w) DECAF_NOEXCEPT
Assign from signed int.
Definition point_448.hxx:155
decaf::Ed448Goldilocks::Scalar::direct_scalarmul_noexcept
decaf_error_t DECAF_WARN_UNUSED direct_scalarmul_noexcept(FixedBuffer< SER_BYTES > &out, const FixedBlock< SER_BYTES > &in, decaf_bool_t allow_identity=DECAF_FALSE, decaf_bool_t short_circuit=DECAF_TRUE) const DECAF_NOEXCEPT
Direct scalar multiplication.
decaf::Ed448Goldilocks::Scalar::operator/=
Scalar & operator/=(const Scalar &q)
Set this to this/q.
Definition point_448.hxx:218
decaf::Ed448Goldilocks::Scalar::~Scalar
~Scalar() DECAF_NOEXCEPT
Destructor securely zeorizes the scalar.
Definition point_448.hxx:158
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(const Scalar &x) DECAF_NOEXCEPT
Assignment.
Definition point_448.hxx:130
decaf::Ed448Goldilocks::Scalar::direct_scalarmul
SecureBuffer direct_scalarmul(const FixedBlock< SER_BYTES > &in, decaf_bool_t allow_identity=DECAF_FALSE, decaf_bool_t short_circuit=DECAF_TRUE) const
Direct scalar multiplication.
decaf::Ed448Goldilocks::Scalar::inverse
Scalar inverse() const
Return 1/this.
Definition point_448.hxx:199
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(const Scalar &x) DECAF_NOEXCEPT
Copy constructor.
Definition point_448.hxx:116
decaf::Ed448Goldilocks::Scalar::operator*
Scalar operator*(const Scalar &q) const DECAF_NOEXCEPT
Multiply.
Definition point_448.hxx:188
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(const Block &bl) DECAF_NOEXCEPT
Assign from arbitrary-length little-endian byte sequence in a Block.
Definition point_448.hxx:161
decaf::Ed448Goldilocks::Scalar::inverse_noexcept
decaf_error_t DECAF_WARN_UNUSED inverse_noexcept(Scalar &r) const DECAF_NOEXCEPT
Invert with Fermat's Little Theorem (slow!).
Definition point_448.hxx:210
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(Rng &rng) DECAF_NOEXCEPT
Construct from RNG.
Definition point_448.hxx:107
decaf::Ed448Goldilocks::Scalar::operator==
bool operator==(const Scalar &q) const DECAF_NOEXCEPT
Compare in constant time.
Definition point_448.hxx:227
decaf::Ed448Goldilocks::Scalar::operator*=
Scalar & operator*=(const Scalar &q) DECAF_NOEXCEPT
Multiply into this.
Definition point_448.hxx:191
decaf::Ed448Goldilocks::Scalar::operator=
Scalar & operator=(int64_t w) DECAF_NOEXCEPT
Assign from signed int.
Definition point_448.hxx:137
decaf::Ed448Goldilocks::Scalar::operator+
Scalar operator+(const Scalar &q) const DECAF_NOEXCEPT
Add.
Definition point_448.hxx:176
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(uint64_t w) DECAF_NOEXCEPT
Set to an unsigned word.
Definition point_448.hxx:95
decaf::Ed448Goldilocks::Scalar::operator!=
bool operator!=(const Scalar &q) const DECAF_NOEXCEPT
Compare in constant time.
Definition point_448.hxx:224
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(unsigned int w) DECAF_NOEXCEPT
Set to an unsigned word.
Definition point_448.hxx:101
decaf::Ed448Goldilocks::Scalar::operator-
Scalar operator-() const DECAF_NOEXCEPT
Negate.
Definition point_448.hxx:194
decaf::Ed448Goldilocks::Scalar::decode
static decaf_error_t DECAF_WARN_UNUSED decode(Scalar &sc, const FixedBlock< SER_BYTES > buffer) DECAF_NOEXCEPT
Decode from correct-length little-endian byte sequence.
Definition point_448.hxx:169
decaf::Ed448Goldilocks::Scalar::s
Wrapped s
access to the underlying scalar object
Definition point_448.hxx:87
decaf::Ed448Goldilocks::Scalar::Wrapped
decaf_448_scalar_t Wrapped
wrapped C type
Definition point_448.hxx:81
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(int w) DECAF_NOEXCEPT
Set to a signed word.
Definition point_448.hxx:104
decaf::Ed448Goldilocks::Scalar::serialize_into
void serialize_into(unsigned char *buffer) const DECAF_NOEXCEPT
Serializable instance.
Definition point_448.hxx:125
decaf::Ed448Goldilocks::Scalar::operator+=
Scalar & operator+=(const Scalar &q) DECAF_NOEXCEPT
Add to this.
Definition point_448.hxx:179
decaf::Ed448Goldilocks::Scalar::Scalar
Scalar(const Wrapped &t=decaf_448_scalar_zero) DECAF_NOEXCEPT
Construct from decaf_scalar_t object.
Definition point_448.hxx:113
decaf::FixedBlock
A fixed-size block.
Definition secure_buffer.hxx:253
decaf::FixedBuffer
A fixed-size block.
Definition secure_buffer.hxx:310
decaf::Rng
Prototype of a random number generator.
Definition secure_buffer.hxx:138
decaf::Serializable
Base class of objects which support serialization.
Definition secure_buffer.hxx:89
decaf_bzero
void DECAF_API_VIS decaf_bzero(void *data, size_t size) DECAF_NONNULL
Overwrite data with zeros.
decaf_memeq
decaf_bool_t DECAF_API_VIS decaf_memeq(const void *data1, const void *data2, size_t size) DECAF_NONNULL DECAF_WARN_UNUSED
Compare two buffers, returning DECAF_TRUE if they are equal.
decaf_error_t
decaf_error_t
Another boolean type used to indicate success or failure.
Definition common.h:120
DECAF_SUCCESS
@ DECAF_SUCCESS
The operation succeeded.
Definition common.h:121
ed448.h
A group of prime order p, based on Ed448-Goldilocks.
DECAF_448_EDDSA_ENCODE_RATIO
#define DECAF_448_EDDSA_ENCODE_RATIO
EdDSA encoding ratio.
Definition ed448.h:57
DECAF_EDDSA_448_PUBLIC_BYTES
#define DECAF_EDDSA_448_PUBLIC_BYTES
Number of bytes in an EdDSA public key.
Definition ed448.h:27
decaf_448_point_decode_like_eddsa_and_mul_by_ratio
decaf_error_t DECAF_API_VIS decaf_448_point_decode_like_eddsa_and_mul_by_ratio(decaf_448_point_t p, const uint8_t enc[DECAF_EDDSA_448_PUBLIC_BYTES]) DECAF_NONNULL DECAF_NOINLINE
EdDSA point decoding.
DECAF_448_EDDSA_DECODE_RATIO
#define DECAF_448_EDDSA_DECODE_RATIO
EdDSA decoding ratio.
Definition ed448.h:60
decaf_448_point_mul_by_ratio_and_encode_like_eddsa
void DECAF_API_VIS decaf_448_point_mul_by_ratio_and_encode_like_eddsa(uint8_t enc[DECAF_EDDSA_448_PUBLIC_BYTES], const decaf_448_point_t p) DECAF_NONNULL DECAF_NOINLINE
EdDSA point encoding.
decaf_x448_base_point
const uint8_t decaf_x448_base_point[DECAF_X448_PUBLIC_BYTES]
The base point for X448 Diffie-Hellman.
Definition decaf.c:66
decaf
Namespace for all C++ decaf objects.
Definition decaf.hxx:22
decaf::SecureBuffer
std::vector< unsigned char, SanitizingAllocator< unsigned char, 0 > > SecureBuffer
A variant of std::vector which securely zerozes its state when destructed.
Definition secure_buffer.hxx:79
point_448.h
A group of prime order p, based on Ed448-Goldilocks.
decaf_448_scalar_halve
void DECAF_API_VIS decaf_448_scalar_halve(decaf_448_scalar_t out, const decaf_448_scalar_t a) DECAF_NONNULL DECAF_NOINLINE
Halve a scalar.
DECAF_X448_PUBLIC_BYTES
#define DECAF_X448_PUBLIC_BYTES
Number of bytes in an x448 public key.
Definition point_448.h:62
decaf_448_point_negate
void DECAF_API_VIS decaf_448_point_negate(decaf_448_point_t nega, const decaf_448_point_t a) DECAF_NONNULL
Negate a point to produce another point.
decaf_448_point_sub
void DECAF_API_VIS decaf_448_point_sub(decaf_448_point_t diff, const decaf_448_point_t a, const decaf_448_point_t b) DECAF_NONNULL
Subtract two points to produce a third point.
decaf_448_point_mul_by_ratio_and_encode_like_x448
void DECAF_API_VIS decaf_448_point_mul_by_ratio_and_encode_like_x448(uint8_t out[DECAF_X448_PUBLIC_BYTES], const decaf_448_point_t p) DECAF_NONNULL
Multiply a point by DECAF_X448_ENCODE_RATIO, then encode it like RFC 7748.
decaf_448_point_encode
void DECAF_API_VIS decaf_448_point_encode(uint8_t ser[DECAF_448_SER_BYTES], const decaf_448_point_t pt) DECAF_NONNULL DECAF_NOINLINE
Encode a point as a sequence of bytes.
decaf_448_base_double_scalarmul_non_secret
void DECAF_API_VIS decaf_448_base_double_scalarmul_non_secret(decaf_448_point_t combo, const decaf_448_scalar_t scalar1, const decaf_448_point_t base2, const decaf_448_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply two base points by two scalars: scaled = scalar1*decaf_448_point_base + scalar2*base2.
decaf_448_invert_elligator_nonuniform
decaf_error_t DECAF_API_VIS decaf_448_invert_elligator_nonuniform(unsigned char recovered_hash[DECAF_448_HASH_BYTES], const decaf_448_point_t pt, uint32_t which) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED
Inverse of elligator-like hash to curve.
decaf_448_point_t
struct decaf_448_point_s decaf_448_point_t[1]
Representation of a point on the elliptic curve.
DECAF_448_INVERT_ELLIGATOR_WHICH_BITS
#define DECAF_448_INVERT_ELLIGATOR_WHICH_BITS
Number of bits in the "which" field of an elligator inverse.
Definition point_448.h:53
decaf_448_scalar_eq
decaf_bool_t DECAF_API_VIS decaf_448_scalar_eq(const decaf_448_scalar_t a, const decaf_448_scalar_t b) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Compare two scalars.
decaf_448_point_valid
decaf_bool_t DECAF_API_VIS decaf_448_point_valid(const decaf_448_point_t to_test) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Test that a point is valid, for debugging purposes.
decaf_448_point_destroy
void DECAF_API_VIS decaf_448_point_destroy(decaf_448_point_t point) DECAF_NONNULL
Securely erase a point by overwriting it with zeros.
DECAF_X448_ENCODE_RATIO
#define DECAF_X448_ENCODE_RATIO
X448 encoding ratio.
Definition point_448.h:59
decaf_448_point_from_hash_nonuniform
void DECAF_API_VIS decaf_448_point_from_hash_nonuniform(decaf_448_point_t pt, const unsigned char hashed_data[DECAF_448_HASH_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Almost-Elligator-like hash to curve.
DECAF_448_SCALAR_BYTES
#define DECAF_448_SCALAR_BYTES
Number of bytes in a serialized scalar.
Definition point_448.h:50
decaf_448_scalar_decode_long
void DECAF_API_VIS decaf_448_scalar_decode_long(decaf_448_scalar_t out, const unsigned char *ser, size_t ser_len) DECAF_NONNULL DECAF_NOINLINE
Read a scalar from wire format or from bytes.
decaf_448_point_debugging_torque
void DECAF_API_VIS decaf_448_point_debugging_torque(decaf_448_point_t q, const decaf_448_point_t p) DECAF_NONNULL DECAF_NOINLINE
Torque a point, for debugging purposes.
decaf_448_point_double_scalarmul
void DECAF_API_VIS decaf_448_point_double_scalarmul(decaf_448_point_t combo, const decaf_448_point_t base1, const decaf_448_scalar_t scalar1, const decaf_448_point_t base2, const decaf_448_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply two base points by two scalars: scaled = scalar1*base1 + scalar2*base2.
decaf_448_point_add
void DECAF_API_VIS decaf_448_point_add(decaf_448_point_t sum, const decaf_448_point_t a, const decaf_448_point_t b) DECAF_NONNULL
Add two points to produce a third point.
decaf_448_point_eq
decaf_bool_t DECAF_API_VIS decaf_448_point_eq(const decaf_448_point_t a, const decaf_448_point_t b) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Test whether two points are equal.
decaf_448_direct_scalarmul
decaf_error_t DECAF_API_VIS decaf_448_direct_scalarmul(uint8_t scaled[DECAF_448_SER_BYTES], const uint8_t base[DECAF_448_SER_BYTES], const decaf_448_scalar_t scalar, decaf_bool_t allow_identity, decaf_bool_t short_circuit) DECAF_NONNULL DECAF_WARN_UNUSED DECAF_NOINLINE
Multiply a base point by a scalar: scaled = scalar*base.
decaf_448_point_from_hash_uniform
void DECAF_API_VIS decaf_448_point_from_hash_uniform(decaf_448_point_t pt, const unsigned char hashed_data[2 *DECAF_448_HASH_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Indifferentiable hash function encoding to curve.
decaf_448_scalar_destroy
void DECAF_API_VIS decaf_448_scalar_destroy(decaf_448_scalar_t scalar) DECAF_NONNULL
Securely erase a scalar.
decaf_448_scalar_decode
decaf_error_t DECAF_API_VIS decaf_448_scalar_decode(decaf_448_scalar_t out, const unsigned char ser[DECAF_448_SCALAR_BYTES]) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Read a scalar from wire format or from bytes.
decaf_448_point_debugging_pscale
void DECAF_API_VIS decaf_448_point_debugging_pscale(decaf_448_point_t q, const decaf_448_point_t p, const unsigned char factor[DECAF_448_SER_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Projectively scale a point, for debugging purposes.
decaf_448_scalar_t
struct decaf_448_scalar_s decaf_448_scalar_t[1]
Representation of an element of the scalar field.
decaf_448_scalar_set_unsigned
void DECAF_API_VIS decaf_448_scalar_set_unsigned(decaf_448_scalar_t out, uint64_t a) DECAF_NONNULL
Set a scalar to an unsigned 64-bit integer.
decaf_448_point_dual_scalarmul
void DECAF_API_VIS decaf_448_point_dual_scalarmul(decaf_448_point_t a1, decaf_448_point_t a2, const decaf_448_point_t base1, const decaf_448_scalar_t scalar1, const decaf_448_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply one base point by two scalars:
decaf_448_precompute
void DECAF_API_VIS decaf_448_precompute(decaf_448_precomputed_s *a, const decaf_448_point_t b) DECAF_NONNULL DECAF_NOINLINE
Precompute a table for fast scalar multiplication.
decaf_448_scalar_mul
void DECAF_API_VIS decaf_448_scalar_mul(decaf_448_scalar_t out, const decaf_448_scalar_t a, const decaf_448_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Multiply two scalars.
decaf_448_scalar_sub
void DECAF_API_VIS decaf_448_scalar_sub(decaf_448_scalar_t out, const decaf_448_scalar_t a, const decaf_448_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Subtract two scalars.
decaf_448_point_scalarmul
void DECAF_API_VIS decaf_448_point_scalarmul(decaf_448_point_t scaled, const decaf_448_point_t base, const decaf_448_scalar_t scalar) DECAF_NONNULL DECAF_NOINLINE
Multiply a base point by a scalar: scaled = scalar*base.
decaf_448_point_double
void DECAF_API_VIS decaf_448_point_double(decaf_448_point_t two_a, const decaf_448_point_t a) DECAF_NONNULL
Double a point.
DECAF_448_SER_BYTES
#define DECAF_448_SER_BYTES
Number of bytes in a serialized point.
Definition point_448.h:42
decaf_448_point_identity
DECAF_API_VIS const decaf_448_point_t decaf_448_point_identity
The identity (zero) point on the curve.
decaf_448_point_base
DECAF_API_VIS const decaf_448_point_t decaf_448_point_base
An arbitrarily-chosen base point on the curve.
decaf_448_precomputed_scalarmul
void DECAF_API_VIS decaf_448_precomputed_scalarmul(decaf_448_point_t scaled, const decaf_448_precomputed_s *base, const decaf_448_scalar_t scalar) DECAF_NONNULL DECAF_NOINLINE
Multiply a precomputed base point by a scalar: scaled = scalar*base.
decaf_448_scalar_add
void DECAF_API_VIS decaf_448_scalar_add(decaf_448_scalar_t out, const decaf_448_scalar_t a, const decaf_448_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Add two scalars.
DECAF_448_HASH_BYTES
#define DECAF_448_HASH_BYTES
Number of bytes in an elligated point.
Definition point_448.h:47
DECAF_X448_PRIVATE_BYTES
#define DECAF_X448_PRIVATE_BYTES
Number of bytes in an x448 private key.
Definition point_448.h:65
decaf_448_precomputed_base
DECAF_API_VIS const struct decaf_448_precomputed_s * decaf_448_precomputed_base
Precomputed table of multiples of the base point on the curve.
decaf_448_scalar_zero
DECAF_API_VIS const decaf_448_scalar_t decaf_448_scalar_zero
The scalar 0.
decaf_448_point_decode
decaf_error_t DECAF_API_VIS decaf_448_point_decode(decaf_448_point_t pt, const uint8_t ser[DECAF_448_SER_BYTES], decaf_bool_t allow_identity) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Decode a point from a sequence of bytes.
decaf_448_invert_elligator_uniform
decaf_error_t DECAF_API_VIS decaf_448_invert_elligator_uniform(unsigned char recovered_hash[2 *DECAF_448_HASH_BYTES], const decaf_448_point_t pt, uint32_t which) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED
Inverse of elligator-like hash to curve.
decaf_448_scalar_encode
void DECAF_API_VIS decaf_448_scalar_encode(unsigned char ser[DECAF_448_SCALAR_BYTES], const decaf_448_scalar_t s) DECAF_NONNULL DECAF_NOINLINE DECAF_NOINLINE
Serialize a scalar to wire format.
decaf_448_sizeof_precomputed_s
DECAF_API_VIS const size_t decaf_448_sizeof_precomputed_s
Size and alignment of precomputed point tables.
decaf_448_precomputed_s
struct decaf_448_precomputed_s decaf_448_precomputed_s
Precomputed table based on a point.
Definition point_448.h:78
decaf_448_scalar_invert
decaf_error_t DECAF_API_VIS decaf_448_scalar_invert(decaf_448_scalar_t out, const decaf_448_scalar_t a) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Invert a scalar.
secure_buffer.hxx
C++ self-zeroizing buffer.
decaf::Ed448Goldilocks::DhLadder
X-only Diffie-Hellman ladder functions.
Definition point_448.hxx:681
decaf::Ed448Goldilocks::DhLadder::shared_secret_noexcept
static decaf_error_t DECAF_WARN_UNUSED shared_secret_noexcept(FixedBuffer< PUBLIC_BYTES > &out, const FixedBlock< PUBLIC_BYTES > &pk, const FixedBlock< PRIVATE_BYTES > &scalar) DECAF_NOEXCEPT
Calculate and write into out a shared secret with public key, noexcept version.
Definition point_448.hxx:708
decaf::Ed448Goldilocks::DhLadder::derive_public_key
static SecureBuffer derive_public_key(const FixedBlock< PRIVATE_BYTES > &scalar)
Calculate and return a public key; equivalent to shared_secret(base_point(),scalar) but possibly fast...
Definition point_448.hxx:732
decaf::Ed448Goldilocks::DhLadder::derive_public_key_noexcept
static void derive_public_key_noexcept(FixedBuffer< PUBLIC_BYTES > &out, const FixedBlock< PRIVATE_BYTES > &scalar) DECAF_NOEXCEPT
Calculate and return a public key into a fixed buffer; equivalent to shared_secret(base_point(),...
Definition point_448.hxx:744
decaf::Ed448Goldilocks::DhLadder::PRIVATE_BYTES
static const size_t PRIVATE_BYTES
Bytes in an X448 private key.
Definition point_448.hxx:687
decaf::Ed448Goldilocks::DhLadder::PUBLIC_BYTES
static const size_t PUBLIC_BYTES
Bytes in an X448 public key.
Definition point_448.hxx:684
decaf::Ed448Goldilocks::DhLadder::DECAF_DEPRECATED
static SecureBuffer DECAF_DEPRECATED("Renamed to derive_public_key") generate_key(const FixedBlock< PRIVATE_BYTES > &scalar)
Calculate and return a public key; equivalent to shared_secret(base_point(),scalar) but possibly fast...
Definition point_448.hxx:720
decaf::Ed448Goldilocks::DhLadder::generate_key_noexcept
static void generate_key_noexcept(FixedBuffer< PUBLIC_BYTES > &out, const FixedBlock< PRIVATE_BYTES > &scalar) DECAF_NOEXCEPT
Calculate and return a public key into a fixed buffer; equivalent to shared_secret(base_point(),...
Definition point_448.hxx:757
decaf::Ed448Goldilocks::DhLadder::base_point
static const FixedBlock< PUBLIC_BYTES > base_point() DECAF_NOEXCEPT
Base point for a scalar multiplication.
Definition point_448.hxx:690
decaf::Ed448Goldilocks::DhLadder::shared_secret
static SecureBuffer shared_secret(const FixedBlock< PUBLIC_BYTES > &pk, const FixedBlock< PRIVATE_BYTES > &scalar)
Calculate and return a shared secret with public key.
Definition point_448.hxx:695
decaf::Ed448Goldilocks
Ed448-Goldilocks/Decaf instantiation of group.
Definition point_448.hxx:55
decaf::Ed448Goldilocks::REMOVED_COFACTOR
static const int REMOVED_COFACTOR
The curve's cofactor (removed, but useful for testing)
Definition point_448.hxx:64
decaf::Ed448Goldilocks::FIELD_MODULUS_TYPE
static const int FIELD_MODULUS_TYPE
Residue class of field modulus: p == this mod 2*(this-1)
Definition point_448.hxx:67
decaf::Ed448Goldilocks::bits
static int bits()
The name of the curve.
Definition point_448.hxx:61
decaf::Ed448Goldilocks::name
static const char * name()
The name of the curve.
Definition point_448.hxx:58
decaf::NOINIT
Passed to constructors to avoid (conservative) initialization.
Definition secure_buffer.hxx:133