1// Copyright 2019 The Go Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style
3// license that can be found in the LICENSE file.
4
5// Package curve25519 provides an implementation of the X25519 function, which
6// performs scalar multiplication on the elliptic curve known as Curve25519.
7// See RFC 7748.
8package curve25519 // import "golang.org/x/crypto/curve25519"
9
10import (
11	"crypto/subtle"
12	"fmt"
13)
14
15// ScalarMult sets dst to the product scalar * point.
16//
17// Deprecated: when provided a low-order point, ScalarMult will set dst to all
18// zeroes, irrespective of the scalar. Instead, use the X25519 function, which
19// will return an error.
20func ScalarMult(dst, scalar, point *[32]byte) {
21	scalarMult(dst, scalar, point)
22}
23
24// ScalarBaseMult sets dst to the product scalar * base where base is the
25// standard generator.
26//
27// It is recommended to use the X25519 function with Basepoint instead, as
28// copying into fixed size arrays can lead to unexpected bugs.
29func ScalarBaseMult(dst, scalar *[32]byte) {
30	ScalarMult(dst, scalar, &basePoint)
31}
32
33const (
34	// ScalarSize is the size of the scalar input to X25519.
35	ScalarSize = 32
36	// PointSize is the size of the point input to X25519.
37	PointSize = 32
38)
39
40// Basepoint is the canonical Curve25519 generator.
41var Basepoint []byte
42
43var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
44
45func init() { Basepoint = basePoint[:] }
46
47func checkBasepoint() {
48	if subtle.ConstantTimeCompare(Basepoint, []byte{
49		0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
50		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
51		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
52		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
53	}) != 1 {
54		panic("curve25519: global Basepoint value was modified")
55	}
56}
57
58// X25519 returns the result of the scalar multiplication (scalar * point),
59// according to RFC 7748, Section 5. scalar, point and the return value are
60// slices of 32 bytes.
61//
62// scalar can be generated at random, for example with crypto/rand. point should
63// be either Basepoint or the output of another X25519 call.
64//
65// If point is Basepoint (but not if it's a different slice with the same
66// contents) a precomputed implementation might be used for performance.
67func X25519(scalar, point []byte) ([]byte, error) {
68	// Outline the body of function, to let the allocation be inlined in the
69	// caller, and possibly avoid escaping to the heap.
70	var dst [32]byte
71	return x25519(&dst, scalar, point)
72}
73
74func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) {
75	var in [32]byte
76	if l := len(scalar); l != 32 {
77		return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32)
78	}
79	if l := len(point); l != 32 {
80		return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32)
81	}
82	copy(in[:], scalar)
83	if &point[0] == &Basepoint[0] {
84		checkBasepoint()
85		ScalarBaseMult(dst, &in)
86	} else {
87		var base, zero [32]byte
88		copy(base[:], point)
89		ScalarMult(dst, &in, &base)
90		if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 {
91			return nil, fmt.Errorf("bad input point: low order point")
92		}
93	}
94	return dst[:], nil
95}
96