~juju-qa/ubuntu/xenial/juju/2.0-rc2 : revision 175

src/golang.org/x/crypto/ed25519/ed25519.go

// Use of this source code is governed by a BSD-style

// license that can be found in the LICENSE file.

// Package ed25519 implements the Ed25519 signature algorithm. See

// http://ed25519.cr.yp.to/.

// These functions are also compatible with the “Ed25519” function defined in

// https://tools.ietf.org/html/draft-irtf-cfrg-eddsa-05.

package ed25519

// This code is a port of the public domain, “ref10” implementation of ed25519

// from SUPERCOP.

import (

"crypto"

cryptorand "crypto/rand"

"crypto/sha512"

"crypto/subtle"

"errors"

"io"

"strconv"

"golang.org/x/crypto/ed25519/internal/edwards25519"

)

const (

// PublicKeySize is the size, in bytes, of public keys as used in this package.

PublicKeySize = 32

// PrivateKeySize is the size, in bytes, of private keys as used in this package.

PrivateKeySize = 64

// SignatureSize is the size, in bytes, of signatures generated and verified by this package.

SignatureSize = 64

)

// PublicKey is the type of Ed25519 public keys.

type PublicKey []byte

// PrivateKey is the type of Ed25519 private keys. It implements crypto.Signer.

type PrivateKey []byte

// Public returns the PublicKey corresponding to priv.

func (priv PrivateKey) Public() crypto.PublicKey {

publicKey := make([]byte, PublicKeySize)

copy(publicKey, priv[32:])

return PublicKey(publicKey)

}

// Sign signs the given message with priv.

// Ed25519 performs two passes over messages to be signed and therefore cannot

// handle pre-hashed messages. Thus opts.HashFunc() must return zero to

// indicate the message hasn't been hashed. This can be achieved by passing

// crypto.Hash(0) as the value for opts.

func (priv PrivateKey) Sign(rand io.Reader, message []byte, opts crypto.SignerOpts) (signature []byte, err error) {

if opts.HashFunc() != crypto.Hash(0) {

return nil, errors.New("ed25519: cannot sign hashed message")

}

return Sign(priv, message), nil

}

// GenerateKey generates a public/private key pair using entropy from rand.

// If rand is nil, crypto/rand.Reader will be used.

func GenerateKey(rand io.Reader) (publicKey PublicKey, privateKey PrivateKey, err error) {

if rand == nil {

rand = cryptorand.Reader

}

privateKey = make([]byte, PrivateKeySize)

publicKey = make([]byte, PublicKeySize)

_, err = io.ReadFull(rand, privateKey[:32])

if err != nil {

return nil, nil, err

}

digest := sha512.Sum512(privateKey[:32])

digest[0] &= 248

digest[31] &= 127

digest[31] |= 64

var A edwards25519.ExtendedGroupElement

var hBytes [32]byte

copy(hBytes[:], digest[:])

edwards25519.GeScalarMultBase(&A, &hBytes)

var publicKeyBytes [32]byte

A.ToBytes(&publicKeyBytes)

copy(privateKey[32:], publicKeyBytes[:])

copy(publicKey, publicKeyBytes[:])

return publicKey, privateKey, nil

}

// Sign signs the message with privateKey and returns a signature. It will

// panic if len(privateKey) is not PrivateKeySize.

func Sign(privateKey PrivateKey, message []byte) []byte {

if l := len(privateKey); l != PrivateKeySize {

panic("ed25519: bad private key length: " + strconv.Itoa(l))

}

100

101

h := sha512.New()

102

h.Write(privateKey[:32])

103

104

var digest1, messageDigest, hramDigest [64]byte

105

var expandedSecretKey [32]byte

106

h.Sum(digest1[:0])

107

copy(expandedSecretKey[:], digest1[:])

108

expandedSecretKey[0] &= 248

109

expandedSecretKey[31] &= 63

110

expandedSecretKey[31] |= 64

111

112

h.Reset()

113

h.Write(digest1[32:])

114

h.Write(message)

115

h.Sum(messageDigest[:0])

116

117

var messageDigestReduced [32]byte

118

edwards25519.ScReduce(&messageDigestReduced, &messageDigest)

119

var R edwards25519.ExtendedGroupElement

120

edwards25519.GeScalarMultBase(&R, &messageDigestReduced)

121

122

var encodedR [32]byte

123

R.ToBytes(&encodedR)

124

125

h.Reset()

126

h.Write(encodedR[:])

127

h.Write(privateKey[32:])

128

h.Write(message)

129

h.Sum(hramDigest[:0])

130

var hramDigestReduced [32]byte

131

edwards25519.ScReduce(&hramDigestReduced, &hramDigest)

132

133

var s [32]byte

134

edwards25519.ScMulAdd(&s, &hramDigestReduced, &expandedSecretKey, &messageDigestReduced)

135

136

signature := make([]byte, SignatureSize)

137

copy(signature[:], encodedR[:])

138

copy(signature[32:], s[:])

139

140

return signature

141

}

142

143

// Verify reports whether sig is a valid signature of message by publicKey. It

144

// will panic if len(publicKey) is not PublicKeySize.

145

func Verify(publicKey PublicKey, message, sig []byte) bool {

146

if l := len(publicKey); l != PublicKeySize {

147

panic("ed25519: bad public key length: " + strconv.Itoa(l))

148

}

149

150

if len(sig) != SignatureSize || sig[63]&224 != 0 {

151

return false

152

}

153

154

var A edwards25519.ExtendedGroupElement

155

var publicKeyBytes [32]byte

156

copy(publicKeyBytes[:], publicKey)

157

if !A.FromBytes(&publicKeyBytes) {

158

return false

159

}

160

edwards25519.FeNeg(&A.X, &A.X)

161

edwards25519.FeNeg(&A.T, &A.T)

162

163

h := sha512.New()

164

h.Write(sig[:32])

165

h.Write(publicKey[:])

166

h.Write(message)

167

var digest [64]byte

168

h.Sum(digest[:0])

169

170

var hReduced [32]byte

171

edwards25519.ScReduce(&hReduced, &digest)

172

173

var R edwards25519.ProjectiveGroupElement

174

var b [32]byte

175

copy(b[:], sig[32:])

176

edwards25519.GeDoubleScalarMultVartime(&R, &hReduced, &A, &b)

177

178

var checkR [32]byte

179

R.ToBytes(&checkR)

180

return subtle.ConstantTimeCompare(sig[:32], checkR[:]) == 1

181

}

Older »