1// Copyright 2019 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5// Package curve25519 provides an implementation of the X25519 function, which 6// performs scalar multiplication on the elliptic curve known as Curve25519. 7// See RFC 7748. 8package curve25519 // import "golang.org/x/crypto/curve25519" 9 10import ( 11 "crypto/subtle" 12 "fmt" 13) 14 15// ScalarMult sets dst to the product scalar * point. 16// 17// Deprecated: when provided a low-order point, ScalarMult will set dst to all 18// zeroes, irrespective of the scalar. Instead, use the X25519 function, which 19// will return an error. 20func ScalarMult(dst, scalar, point *[32]byte) { 21 scalarMult(dst, scalar, point) 22} 23 24// ScalarBaseMult sets dst to the product scalar * base where base is the 25// standard generator. 26// 27// It is recommended to use the X25519 function with Basepoint instead, as 28// copying into fixed size arrays can lead to unexpected bugs. 29func ScalarBaseMult(dst, scalar *[32]byte) { 30 ScalarMult(dst, scalar, &basePoint) 31} 32 33const ( 34 // ScalarSize is the size of the scalar input to X25519. 35 ScalarSize = 32 36 // PointSize is the size of the point input to X25519. 37 PointSize = 32 38) 39 40// Basepoint is the canonical Curve25519 generator. 41var Basepoint []byte 42 43var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} 44 45func init() { Basepoint = basePoint[:] } 46 47func checkBasepoint() { 48 if subtle.ConstantTimeCompare(Basepoint, []byte{ 49 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 50 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 51 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 52 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 53 }) != 1 { 54 panic("curve25519: global Basepoint value was modified") 55 } 56} 57 58// X25519 returns the result of the scalar multiplication (scalar * point), 59// according to RFC 7748, Section 5. scalar, point and the return value are 60// slices of 32 bytes. 61// 62// scalar can be generated at random, for example with crypto/rand. point should 63// be either Basepoint or the output of another X25519 call. 64// 65// If point is Basepoint (but not if it's a different slice with the same 66// contents) a precomputed implementation might be used for performance. 67func X25519(scalar, point []byte) ([]byte, error) { 68 // Outline the body of function, to let the allocation be inlined in the 69 // caller, and possibly avoid escaping to the heap. 70 var dst [32]byte 71 return x25519(&dst, scalar, point) 72} 73 74func x25519(dst *[32]byte, scalar, point []byte) ([]byte, error) { 75 var in [32]byte 76 if l := len(scalar); l != 32 { 77 return nil, fmt.Errorf("bad scalar length: %d, expected %d", l, 32) 78 } 79 if l := len(point); l != 32 { 80 return nil, fmt.Errorf("bad point length: %d, expected %d", l, 32) 81 } 82 copy(in[:], scalar) 83 if &point[0] == &Basepoint[0] { 84 checkBasepoint() 85 ScalarBaseMult(dst, &in) 86 } else { 87 var base, zero [32]byte 88 copy(base[:], point) 89 ScalarMult(dst, &in, &base) 90 if subtle.ConstantTimeCompare(dst[:], zero[:]) == 1 { 91 return nil, fmt.Errorf("bad input point: low order point") 92 } 93 } 94 return dst[:], nil 95} 96