diff --git a/src/public_include/decaf/decaf_255.hxx b/src/public_include/decaf/decaf_255.hxx index 1229fe7..4c3bbfb 100644 --- a/src/public_include/decaf/decaf_255.hxx +++ b/src/public_include/decaf/decaf_255.hxx @@ -24,7 +24,7 @@ /** This code uses posix_memalign. */ #ifndef _XOPEN_SOURCE -#define _XOPEN_SOURCE 600 +#define _XOPEN_SOURCE 600 #endif #include #include /* for memcpy */ @@ -49,7 +49,7 @@ namespace decaf { * @brief Curve25519/Decaf instantiation of group. */ struct IsoEd25519 { - + /** The name of the curve */ static inline const char *name() { return "IsoEd25519"; } @@ -73,52 +73,52 @@ class Scalar : public Serializable { private: /** @brief wrapped C type */ typedef decaf_255_scalar_t Wrapped; - + public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_255_SCALAR_BYTES; - + /** @brief access to the underlying scalar object */ Wrapped s; - + /** @brief Don't initialize. */ inline Scalar(const NOINIT &) NOEXCEPT {} - + /** @brief Set to an unsigned word */ inline Scalar(const decaf_word_t w) NOEXCEPT { *this = w; } /** @brief Set to a signed word */ - inline Scalar(const int w) NOEXCEPT { *this = w; } - + inline Scalar(const int w) NOEXCEPT { *this = w; } + /** @brief Construct from RNG */ inline explicit Scalar(Rng &rng) NOEXCEPT { FixedArrayBuffer sb(rng); *this = sb; } - + /** @brief Construct from decaf_scalar_t object. */ - inline Scalar(const Wrapped &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); } - + inline Scalar(const Wrapped &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); } + /** @brief Copy constructor. */ inline Scalar(const Scalar &x) NOEXCEPT { *this = x; } - + /** @brief Construct from arbitrary-length little-endian byte sequence. */ inline Scalar(const Block &buffer) NOEXCEPT { *this = buffer; } /** @brief Serializable instance */ inline size_t serSize() const NOEXCEPT { return SER_BYTES; } - + /** @brief Serializable instance */ inline void serializeInto(unsigned char *buffer) const NOEXCEPT { decaf_255_scalar_encode(buffer, s); } - + /** @brief Assignment. */ inline Scalar& operator=(const Scalar &x) NOEXCEPT { decaf_255_scalar_copy(s,x.s); return *this; } - + /** @brief Assign from unsigned word. */ inline Scalar& operator=(decaf_word_t w) NOEXCEPT { decaf_255_scalar_set_unsigned(s,w); return *this; } - + /** @brief Assign from signed int. */ inline Scalar& operator=(int w) NOEXCEPT { Scalar t(-(decaf_word_t)INT_MIN); @@ -126,15 +126,15 @@ public: *this -= t; return *this; } - + /** Destructor securely zeorizes the scalar. */ inline ~Scalar() NOEXCEPT { decaf_255_scalar_destroy(s); } - + /** @brief Assign from arbitrary-length little-endian byte sequence in a Block. */ inline Scalar &operator=(const Block &bl) NOEXCEPT { decaf_255_scalar_decode_long(s,bl.data(),bl.size()); return *this; } - + /** * @brief Decode from correct-length little-endian byte sequence. * @return DECAF_FAILURE if the scalar is greater than or equal to the group order q. @@ -144,28 +144,28 @@ public: ) NOEXCEPT { return decaf_255_scalar_decode(sc.s,buffer.data()); } - + /** Add. */ inline Scalar operator+ (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_add(r.s,s,q.s); return r; } - + /** Add to this. */ inline Scalar &operator+=(const Scalar &q) NOEXCEPT { decaf_255_scalar_add(s,s,q.s); return *this; } - + /** Subtract. */ inline Scalar operator- (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_sub(r.s,s,q.s); return r; } - + /** Subtract from this. */ inline Scalar &operator-=(const Scalar &q) NOEXCEPT { decaf_255_scalar_sub(s,s,q.s); return *this; } - + /** Multiply */ inline Scalar operator* (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_mul(r.s,s,q.s); return r; } - + /** Multiply into this. */ inline Scalar &operator*=(const Scalar &q) NOEXCEPT { decaf_255_scalar_mul(s,s,q.s); return *this; } - + /** Negate */ inline Scalar operator- () const NOEXCEPT { Scalar r((NOINIT())); decaf_255_scalar_sub(r.s,decaf_255_scalar_zero,s); return r; } - + /** @brief Invert with Fermat's Little Theorem (slow!). If *this == 0, return 0. */ inline Scalar inverse() const throw(CryptoException) { Scalar r; @@ -174,30 +174,30 @@ public: } return r; } - + /** @brief Divide by inverting q. If q == 0, return 0. */ inline Scalar operator/ (const Scalar &q) const throw(CryptoException) { return *this * q.inverse(); } - + /** @brief Divide by inverting q. If q == 0, return 0. */ inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); } - + /** @brief Compare in constant time */ inline bool operator!=(const Scalar &q) const NOEXCEPT { return !(*this == q); } - + /** @brief Compare in constant time */ inline bool operator==(const Scalar &q) const NOEXCEPT { return !!decaf_255_scalar_eq(s,q.s); } - + /** @brief Scalarmul with scalar on left. */ inline Point operator* (const Point &q) const NOEXCEPT { return q * (*this); } - + /** @brief Scalarmul-precomputed with scalar on left. */ inline Point operator* (const Precomputed &q) const NOEXCEPT { return q * (*this); } - + /** @brief Direct scalar multiplication. */ inline SecureBuffer direct_scalarmul( const Block &in, decaf_bool_t allow_identity=DECAF_FALSE, - decaf_bool_t short_circuit=DECAF_TRUE + decaf_bool_t short_circuit=DECAF_TRUE ) const throw(CryptoException); }; @@ -205,36 +205,38 @@ public: * @brief Element of prime-order group. */ class Point : public Serializable { -public: +private: + /** @brief wrapped C type */ typedef decaf_255_point_t Wrapped; +public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_255_SER_BYTES; - + /** @brief Bytes required for hash */ static const size_t HASH_BYTES = SER_BYTES; - + /** @brief Size of a stegged element */ static const size_t STEG_BYTES = HASH_BYTES * 2; - + /** The c-level object. */ Wrapped p; - + /** @brief Don't initialize. */ inline Point(const NOINIT &) NOEXCEPT {} - + /** @brief Constructor sets to identity by default. */ inline Point(const Wrapped &q = decaf_255_point_identity) NOEXCEPT { decaf_255_point_copy(p,q); } - + /** @brief Copy constructor. */ inline Point(const Point &q) NOEXCEPT { *this = q; } - + /** @brief Assignment. */ inline Point& operator=(const Point &q) NOEXCEPT { decaf_255_point_copy(p,q.p); return *this; } - + /** @brief Destructor securely zeorizes the point. */ inline ~Point() NOEXCEPT { decaf_255_point_destroy(p); } - + /** @brief Construct from RNG */ inline explicit Point(Rng &rng, bool uniform = true) NOEXCEPT { if (uniform) { @@ -245,7 +247,7 @@ public: set_to_hash(b); } } - + /** * @brief Initialize from a fixed-length byte string. * The all-zero string maps to the identity. @@ -267,13 +269,13 @@ public: * @retval DECAF_SUCCESS the string was successfully decoded. * @return DECAF_FAILURE the string was the wrong length, or wasn't the encoding of a point, * or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. - */ + */ static inline decaf_error_t __attribute__((warn_unused_result)) decode ( Point &p, const FixedBlock &buffer, decaf_bool_t allow_identity=DECAF_TRUE ) NOEXCEPT { return decaf_255_point_decode(p.p,buffer.data(),allow_identity); } - + /** * @brief Map uniformly to the curve from a hash buffer. * The empty or all-zero string maps to the identity, as does the string "\x01". @@ -306,70 +308,79 @@ public: } } + /** + * @brief Encode to string. The identity encodes to the all-zero string. + */ + inline operator SecureBuffer() const { + SecureBuffer buffer(SER_BYTES); + decaf_255_point_encode(buffer.data(), p); + return buffer; + } + /** @brief Serializable instance */ inline size_t serSize() const NOEXCEPT { return SER_BYTES; } - + /** @brief Serializable instance */ inline void serializeInto(unsigned char *buffer) const NOEXCEPT { decaf_255_point_encode(buffer, p); } - + /** @brief Point add. */ inline Point operator+ (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_add(r.p,p,q.p); return r; } - + /** @brief Point add. */ inline Point &operator+=(const Point &q) NOEXCEPT { decaf_255_point_add(p,p,q.p); return *this; } - + /** @brief Point subtract. */ inline Point operator- (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_sub(r.p,p,q.p); return r; } - + /** @brief Point subtract. */ inline Point &operator-=(const Point &q) NOEXCEPT { decaf_255_point_sub(p,p,q.p); return *this; } - + /** @brief Point negate. */ inline Point operator- () const NOEXCEPT { Point r((NOINIT())); decaf_255_point_negate(r.p,p); return r; } - + /** @brief Double the point out of place. */ inline Point times_two () const NOEXCEPT { Point r((NOINIT())); decaf_255_point_double(r.p,p); return r; } - + /** @brief Double the point in place. */ inline Point &double_in_place() NOEXCEPT { decaf_255_point_double(p,p); return *this; } - + /** @brief Constant-time compare. */ inline bool operator!=(const Point &q) const NOEXCEPT { return ! decaf_255_point_eq(p,q.p); } /** @brief Constant-time compare. */ inline bool operator==(const Point &q) const NOEXCEPT { return !!decaf_255_point_eq(p,q.p); } - + /** @brief Scalar multiply. */ inline Point operator* (const Scalar &s) const NOEXCEPT { Point r((NOINIT())); decaf_255_point_scalarmul(r.p,p,s.s); return r; } - + /** @brief Scalar multiply in place. */ inline Point &operator*=(const Scalar &s) NOEXCEPT { decaf_255_point_scalarmul(p,p,s.s); return *this; } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ - inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); } - + inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); } + /** @brief Validate / sanity check */ inline bool validate() const NOEXCEPT { return decaf_255_point_valid(p); } - + /** @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. */ static inline Point double_scalarmul ( const Point &q, const Scalar &qs, const Point &r, const Scalar &rs ) NOEXCEPT { Point p((NOINIT())); decaf_255_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p; } - + /** @brief Dual-scalar multiply, equivalent to this*r1, this*r2 but faster. */ inline void dual_scalarmul ( Point &q1, Point &q2, const Scalar &r1, const Scalar &r2 ) const NOEXCEPT { decaf_255_point_dual_scalarmul(q1.p,q2.p,p,r1.s,r2.s); } - + /** * @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. * For those who like their scalars before the point. @@ -379,7 +390,7 @@ public: ) NOEXCEPT { return double_scalarmul(q,qs,r,rs); } - + /** * @brief Double-scalar multiply: this point by the first scalar and base by the second scalar. * @warning This function takes variable time, and may leak the scalars (or points, but currently @@ -388,22 +399,27 @@ public: inline Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) NOEXCEPT { Point r((NOINIT())); decaf_255_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r; } - + /** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */ inline Point debugging_torque() const NOEXCEPT { - Point q; decaf_255_point_debugging_torque(q.p,p); return q; + Point q; + decaf_255_point_debugging_torque(q.p,p); + return q; } - + /** @brief Return a point equal to *this, whose internal data has a modified representation. */ inline Point debugging_pscale(const FixedBlock factor) const NOEXCEPT { - Point q; decaf_255_point_debugging_pscale(q.p,p,factor.data()); return q; + Point q; + decaf_255_point_debugging_pscale(q.p,p,factor.data()); + return q; } - + /** @brief Return a point equal to *this, whose internal data has a randomized representation. */ inline Point debugging_pscale(Rng &r) const NOEXCEPT { - FixedArrayBuffer sb(r); return debugging_pscale(sb); + FixedArrayBuffer sb(r); + return debugging_pscale(sb); } - + /** * Modify buffer so that Point::from_hash(Buffer) == *this, and return DECAF_SUCCESS; * or leave buf unmodified and return DECAF_FAILURE. @@ -430,7 +446,7 @@ public: decaf_bzero(buf2,sizeof(buf2)); return decaf_succeed_if(ret); } - + /** @brief Steganographically encode this */ inline SecureBuffer steg_encode(Rng &rng, size_t size=STEG_BYTES) const throw(std::bad_alloc, LengthException) { if (size <= HASH_BYTES + 4 || size > 2*HASH_BYTES) throw LengthException(); @@ -438,14 +454,14 @@ public: decaf_error_t done; do { rng.read(Buffer(out).slice(HASH_BYTES-1,STEG_BYTES-HASH_BYTES+1)); - done = invert_elligator(out, out[HASH_BYTES-1]); + done = invert_elligator(out, out[HASH_BYTES-1]); } while (!decaf_successful(done)); return out; } - + /** @brief Return the base point */ static inline const Point base() NOEXCEPT { return Point(decaf_255_point_base); } - + /** @brief Return the identity point */ static inline const Point identity() NOEXCEPT { return Point(decaf_255_point_identity); } }; @@ -466,10 +482,10 @@ class Precomputed /** @endcond */ { public: - + /** Destructor securely zeorizes the memory. */ inline ~Precomputed() NOEXCEPT { clear(); } - + /** * @brief Initialize from underlying type, declared as a reference to prevent * it from being called with 0, thereby breaking override. @@ -480,11 +496,11 @@ public: * * @warning The empty initializer makes this equal to base, unlike the empty * initializer for points which makes this equal to the identity. - */ + */ inline Precomputed ( const Precomputed_U &yours = *defaultValue() ) NOEXCEPT : OwnedOrUnowned(yours) {} - + #if __cplusplus >= 201103L /** @brief Move-assign operator */ @@ -492,19 +508,19 @@ public: OwnedOrUnowned::operator= (it); return *this; } - + /** @brief Move constructor */ inline Precomputed(Precomputed &&it) NOEXCEPT : OwnedOrUnowned() { *this = it; } - + /** @brief Undelete copy operator */ inline Precomputed &operator=(const Precomputed &it) NOEXCEPT { OwnedOrUnowned::operator= (it); return *this; } #endif - + /** * @brief Initilaize from point. Must allocate memory, and may throw. */ @@ -513,25 +529,25 @@ public: decaf_255_precompute(ours.mine,it.p); return *this; } - + /** * @brief Copy constructor. */ - inline Precomputed(const Precomputed &it) throw(std::bad_alloc) + inline Precomputed(const Precomputed &it) throw(std::bad_alloc) : OwnedOrUnowned() { *this = it; } - + /** * @brief Constructor which initializes from point. */ inline explicit Precomputed(const Point &it) throw(std::bad_alloc) : OwnedOrUnowned() { *this = it; } - + /** @brief Fixed base scalarmul. */ inline Point operator* (const Scalar &s) const NOEXCEPT { Point r; decaf_255_precomputed_scalarmul(r.p,get(),s.s); return r; } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); } - + /** @brief Return the table for the base point. */ static inline const Precomputed base() NOEXCEPT { return Precomputed(); } diff --git a/src/public_include/decaf/decaf_448.hxx b/src/public_include/decaf/decaf_448.hxx index 3214565..af5bcba 100644 --- a/src/public_include/decaf/decaf_448.hxx +++ b/src/public_include/decaf/decaf_448.hxx @@ -49,7 +49,7 @@ namespace decaf { * @brief Ed448-Goldilocks/Decaf instantiation of group. */ struct Ed448Goldilocks { - + /** The name of the curve */ static inline const char *name() { return "Ed448-Goldilocks"; } @@ -72,44 +72,53 @@ class Scalar : public Serializable { private: /** @brief wrapped C type */ typedef decaf_448_scalar_t Wrapped; - + public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_448_SCALAR_BYTES; - + /** @brief access to the underlying scalar object */ Wrapped s; - + /** @brief Don't initialize. */ inline Scalar(const NOINIT &) NOEXCEPT {} - + /** @brief Set to an unsigned word */ inline Scalar(const decaf_word_t w) NOEXCEPT { *this = w; } /** @brief Set to a signed word */ - inline Scalar(const int w) NOEXCEPT { *this = w; } - + inline Scalar(const int w) NOEXCEPT { *this = w; } + /** @brief Construct from RNG */ inline explicit Scalar(Rng &rng) NOEXCEPT { FixedArrayBuffer sb(rng); *this = sb; } - + /** @brief Construct from decaf_scalar_t object. */ - inline Scalar(const decaf_448_scalar_t &t = decaf_448_scalar_zero) NOEXCEPT { decaf_448_scalar_copy(s,t); } - + inline Scalar(const Wrapped &t = decaf_448_scalar_zero) NOEXCEPT { decaf_448_scalar_copy(s,t); } + /** @brief Copy constructor. */ inline Scalar(const Scalar &x) NOEXCEPT { *this = x; } - + /** @brief Construct from arbitrary-length little-endian byte sequence. */ inline Scalar(const Block &buffer) NOEXCEPT { *this = buffer; } - + + /** @brief Serializable instance */ + inline size_t serSize() const NOEXCEPT { return SER_BYTES; } + + /** @brief Serializable instance */ + inline void serializeInto(unsigned char *buffer) const NOEXCEPT { + decaf_448_scalar_encode(buffer, s); + } + /** @brief Assignment. */ inline Scalar& operator=(const Scalar &x) NOEXCEPT { decaf_448_scalar_copy(s,x.s); return *this; } - + /** @brief Assign from unsigned word. */ inline Scalar& operator=(decaf_word_t w) NOEXCEPT { decaf_448_scalar_set_unsigned(s,w); return *this; } - + + /** @brief Assign from signed int. */ inline Scalar& operator=(int w) NOEXCEPT { Scalar t(-(decaf_word_t)INT_MIN); @@ -117,15 +126,15 @@ public: *this -= t; return *this; } - + /** Destructor securely zeorizes the scalar. */ inline ~Scalar() NOEXCEPT { decaf_448_scalar_destroy(s); } - + /** @brief Assign from arbitrary-length little-endian byte sequence in a Block. */ inline Scalar &operator=(const Block &bl) NOEXCEPT { decaf_448_scalar_decode_long(s,bl.data(),bl.size()); return *this; } - + /** * @brief Decode from correct-length little-endian byte sequence. * @return DECAF_FAILURE if the scalar is greater than or equal to the group order q. @@ -135,36 +144,28 @@ public: ) NOEXCEPT { return decaf_448_scalar_decode(sc.s,buffer.data()); } - - /** @brief Serializable instance */ - inline size_t serSize() const NOEXCEPT { return SER_BYTES; } - - /** @brief Serializable instance */ - inline void serializeInto(unsigned char *buffer) const NOEXCEPT { - decaf_448_scalar_encode(buffer, s); - } - + /** Add. */ inline Scalar operator+ (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_add(r.s,s,q.s); return r; } - + /** Add to this. */ inline Scalar &operator+=(const Scalar &q) NOEXCEPT { decaf_448_scalar_add(s,s,q.s); return *this; } - + /** Subtract. */ inline Scalar operator- (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,s,q.s); return r; } - + /** Subtract from this. */ inline Scalar &operator-=(const Scalar &q) NOEXCEPT { decaf_448_scalar_sub(s,s,q.s); return *this; } - + /** Multiply */ inline Scalar operator* (const Scalar &q) const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_mul(r.s,s,q.s); return r; } - + /** Multiply into this. */ inline Scalar &operator*=(const Scalar &q) NOEXCEPT { decaf_448_scalar_mul(s,s,q.s); return *this; } - + /** Negate */ inline Scalar operator- () const NOEXCEPT { Scalar r((NOINIT())); decaf_448_scalar_sub(r.s,decaf_448_scalar_zero,s); return r; } - + /** @brief Invert with Fermat's Little Theorem (slow!). If *this == 0, return 0. */ inline Scalar inverse() const throw(CryptoException) { Scalar r; @@ -173,73 +174,69 @@ public: } return r; } - + /** @brief Divide by inverting q. If q == 0, return 0. */ inline Scalar operator/ (const Scalar &q) const throw(CryptoException) { return *this * q.inverse(); } - + /** @brief Divide by inverting q. If q == 0, return 0. */ - inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); } - + inline Scalar &operator/=(const Scalar &q) throw(CryptoException) { return *this *= q.inverse(); } + /** @brief Compare in constant time */ inline bool operator!=(const Scalar &q) const NOEXCEPT { return !(*this == q); } - + /** @brief Compare in constant time */ inline bool operator==(const Scalar &q) const NOEXCEPT { return !!decaf_448_scalar_eq(s,q.s); } - + /** @brief Scalarmul with scalar on left. */ inline Point operator* (const Point &q) const NOEXCEPT { return q * (*this); } - + /** @brief Scalarmul-precomputed with scalar on left. */ inline Point operator* (const Precomputed &q) const NOEXCEPT { return q * (*this); } - + /** @brief Direct scalar multiplication. */ inline SecureBuffer direct_scalarmul( const Block &in, decaf_bool_t allow_identity=DECAF_FALSE, - decaf_bool_t short_circuit=DECAF_TRUE - ) const throw(CryptoException) { - SecureBuffer out(Point::SER_BYTES); - if (DECAF_SUCCESS != - decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit) - ) { - throw CryptoException(); - } - return out; - } + decaf_bool_t short_circuit=DECAF_TRUE + ) const throw(CryptoException); }; /** * @brief Element of prime-order group. */ class Point : public Serializable { +private: + /** @brief wrapped C type */ + typedef decaf_448_point_t Wrapped; + public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_448_SER_BYTES; - - /** @brief Size of a stegged element */ - static const size_t STEG_BYTES = DECAF_448_SER_BYTES + 8; - + /** @brief Bytes required for hash */ - static const size_t HASH_BYTES = DECAF_448_SER_BYTES; - + static const size_t HASH_BYTES = SER_BYTES; + + /** @brief Size of a stegged element */ + static const size_t STEG_BYTES = HASH_BYTES * 2; + /** The c-level object. */ - decaf_448_point_t p; - + Wrapped p; + /** @brief Don't initialize. */ inline Point(const NOINIT &) NOEXCEPT {} - + /** @brief Constructor sets to identity by default. */ - inline Point(const decaf_448_point_t &q = decaf_448_point_identity) NOEXCEPT { decaf_448_point_copy(p,q); } - + inline Point(const Wrapped &q = decaf_448_point_identity) NOEXCEPT { decaf_448_point_copy(p,q); } + /** @brief Copy constructor. */ inline Point(const Point &q) NOEXCEPT { *this = q; } - + /** @brief Assignment. */ inline Point& operator=(const Point &q) NOEXCEPT { decaf_448_point_copy(p,q.p); return *this; } - + /** @brief Destructor securely zeorizes the point. */ inline ~Point() NOEXCEPT { decaf_448_point_destroy(p); } - + /** @brief Construct from RNG */ inline explicit Point(Rng &rng, bool uniform = true) NOEXCEPT { if (uniform) { @@ -250,7 +247,7 @@ public: set_to_hash(b); } } - + /** * @brief Initialize from a fixed-length byte string. * The all-zero string maps to the identity. @@ -260,9 +257,11 @@ public: */ inline explicit Point(const FixedBlock &buffer, decaf_bool_t allow_identity=DECAF_TRUE) throw(CryptoException) { - if (DECAF_SUCCESS != decode(*this,buffer,allow_identity)) throw CryptoException(); + if (DECAF_SUCCESS != decode(*this,buffer,allow_identity)) { + throw CryptoException(); + } } - + /** * @brief Initialize from C++ fixed-length byte string. * The all-zero string maps to the identity. @@ -270,13 +269,13 @@ public: * @retval DECAF_SUCCESS the string was successfully decoded. * @return DECAF_FAILURE the string was the wrong length, or wasn't the encoding of a point, * or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. - */ + */ static inline decaf_error_t __attribute__((warn_unused_result)) decode ( Point &p, const FixedBlock &buffer, decaf_bool_t allow_identity=DECAF_TRUE ) NOEXCEPT { return decaf_448_point_decode(p.p,buffer.data(),allow_identity); } - + /** * @brief Map uniformly to the curve from a hash buffer. * The empty or all-zero string maps to the identity, as does the string "\x01". @@ -308,66 +307,66 @@ public: decaf_448_point_from_hash_uniform(p,s.data()); } } - + /** * @brief Encode to string. The identity encodes to the all-zero string. */ - inline operator SecureBuffer() const NOEXCEPT { + inline operator SecureBuffer() const { SecureBuffer buffer(SER_BYTES); decaf_448_point_encode(buffer.data(), p); return buffer; } - + /** @brief Serializable instance */ inline size_t serSize() const NOEXCEPT { return SER_BYTES; } - + /** @brief Serializable instance */ inline void serializeInto(unsigned char *buffer) const NOEXCEPT { decaf_448_point_encode(buffer, p); } - + /** @brief Point add. */ inline Point operator+ (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_add(r.p,p,q.p); return r; } - + /** @brief Point add. */ inline Point &operator+=(const Point &q) NOEXCEPT { decaf_448_point_add(p,p,q.p); return *this; } - + /** @brief Point subtract. */ inline Point operator- (const Point &q) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_sub(r.p,p,q.p); return r; } - + /** @brief Point subtract. */ inline Point &operator-=(const Point &q) NOEXCEPT { decaf_448_point_sub(p,p,q.p); return *this; } - + /** @brief Point negate. */ inline Point operator- () const NOEXCEPT { Point r((NOINIT())); decaf_448_point_negate(r.p,p); return r; } - + /** @brief Double the point out of place. */ inline Point times_two () const NOEXCEPT { Point r((NOINIT())); decaf_448_point_double(r.p,p); return r; } - + /** @brief Double the point in place. */ inline Point &double_in_place() NOEXCEPT { decaf_448_point_double(p,p); return *this; } - + /** @brief Constant-time compare. */ inline bool operator!=(const Point &q) const NOEXCEPT { return ! decaf_448_point_eq(p,q.p); } /** @brief Constant-time compare. */ inline bool operator==(const Point &q) const NOEXCEPT { return !!decaf_448_point_eq(p,q.p); } - + /** @brief Scalar multiply. */ inline Point operator* (const Scalar &s) const NOEXCEPT { Point r((NOINIT())); decaf_448_point_scalarmul(r.p,p,s.s); return r; } - + /** @brief Scalar multiply in place. */ inline Point &operator*=(const Scalar &s) NOEXCEPT { decaf_448_point_scalarmul(p,p,s.s); return *this; } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ inline Point &operator/=(const Scalar &s) throw(CryptoException) { return (*this) *= s.inverse(); } - + /** @brief Validate / sanity check */ inline bool validate() const NOEXCEPT { return decaf_448_point_valid(p); } - + /** @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. */ static inline Point double_scalarmul ( const Point &q, const Scalar &qs, const Point &r, const Scalar &rs @@ -381,7 +380,7 @@ public: ) const NOEXCEPT { decaf_448_point_dual_scalarmul(q1.p,q2.p,p,r1.s,r2.s); } - + /** * @brief Double-scalar multiply, equivalent to q*qs + r*rs but faster. * For those who like their scalars before the point. @@ -389,9 +388,9 @@ public: static inline Point double_scalarmul ( const Scalar &qs, const Point &q, const Scalar &rs, const Point &r ) NOEXCEPT { - Point p((NOINIT())); decaf_448_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p; + return double_scalarmul(q,qs,r,rs); } - + /** * @brief Double-scalar multiply: this point by the first scalar and base by the second scalar. * @warning This function takes variable time, and may leak the scalars (or points, but currently @@ -400,27 +399,27 @@ public: inline Point non_secret_combo_with_base(const Scalar &s, const Scalar &s_base) NOEXCEPT { Point r((NOINIT())); decaf_448_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r; } - + /** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */ inline Point debugging_torque() const NOEXCEPT { Point q; decaf_448_point_debugging_torque(q.p,p); return q; } - + /** @brief Return a point equal to *this, whose internal data has a modified representation. */ inline Point debugging_pscale(const FixedBlock factor) const NOEXCEPT { Point q; decaf_448_point_debugging_pscale(q.p,p,factor.data()); return q; } - + /** @brief Return a point equal to *this, whose internal data has a randomized representation. */ inline Point debugging_pscale(Rng &r) const NOEXCEPT { FixedArrayBuffer sb(r); return debugging_pscale(sb); } - + /** * Modify buffer so that Point::from_hash(Buffer) == *this, and return DECAF_SUCCESS; * or leave buf unmodified and return DECAF_FAILURE. @@ -447,21 +446,22 @@ public: decaf_bzero(buf2,sizeof(buf2)); return decaf_succeed_if(ret); } - + /** @brief Steganographically encode this */ - inline SecureBuffer steg_encode(Rng &rng) const throw(std::bad_alloc) { + inline SecureBuffer steg_encode(Rng &rng, size_t size=STEG_BYTES) const throw(std::bad_alloc, LengthException) { + if (size <= HASH_BYTES + 4 || size > 2*HASH_BYTES) throw LengthException(); SecureBuffer out(STEG_BYTES); decaf_error_t done; do { rng.read(Buffer(out).slice(HASH_BYTES-1,STEG_BYTES-HASH_BYTES+1)); - done = invert_elligator(out, out[HASH_BYTES-1]); + done = invert_elligator(out, out[HASH_BYTES-1]); } while (!decaf_successful(done)); return out; } - + /** @brief Return the base point */ static inline const Point base() NOEXCEPT { return Point(decaf_448_point_base); } - + /** @brief Return the identity point */ static inline const Point identity() NOEXCEPT { return Point(decaf_448_point_identity); } }; @@ -482,10 +482,10 @@ class Precomputed /** @endcond */ { public: - + /** Destructor securely zeorizes the memory. */ inline ~Precomputed() NOEXCEPT { clear(); } - + /** * @brief Initialize from underlying type, declared as a reference to prevent * it from being called with 0, thereby breaking override. @@ -496,11 +496,11 @@ public: * * @warning The empty initializer makes this equal to base, unlike the empty * initializer for points which makes this equal to the identity. - */ + */ inline Precomputed ( const Precomputed_U &yours = *defaultValue() ) NOEXCEPT : OwnedOrUnowned(yours) {} - + #if __cplusplus >= 201103L /** @brief Move-assign operator */ @@ -508,19 +508,19 @@ public: OwnedOrUnowned::operator= (it); return *this; } - + /** @brief Move constructor */ inline Precomputed(Precomputed &&it) NOEXCEPT : OwnedOrUnowned() { *this = it; } - + /** @brief Undelete copy operator */ inline Precomputed &operator=(const Precomputed &it) NOEXCEPT { OwnedOrUnowned::operator= (it); return *this; } #endif - + /** * @brief Initilaize from point. Must allocate memory, and may throw. */ @@ -529,25 +529,25 @@ public: decaf_448_precompute(ours.mine,it.p); return *this; } - + /** * @brief Copy constructor. */ - inline Precomputed(const Precomputed &it) throw(std::bad_alloc) + inline Precomputed(const Precomputed &it) throw(std::bad_alloc) : OwnedOrUnowned() { *this = it; } - + /** * @brief Constructor which initializes from point. */ inline explicit Precomputed(const Point &it) throw(std::bad_alloc) : OwnedOrUnowned() { *this = it; } - + /** @brief Fixed base scalarmul. */ inline Point operator* (const Scalar &s) const NOEXCEPT { Point r; decaf_448_precomputed_scalarmul(r.p,get(),s.s); return r; } - + /** @brief Multiply by s.inverse(). If s=0, maps to the identity. */ inline Point operator/ (const Scalar &s) const throw(CryptoException) { return (*this) * s.inverse(); } - + /** @brief Return the table for the base point. */ static inline const Precomputed base() NOEXCEPT { return Precomputed(); } @@ -560,7 +560,23 @@ public: /** @endcond */ }; -}; /* struct Decaf448 */ +}; /* struct Ed448Goldilocks */ + +/** @cond internal */ +inline SecureBuffer Ed448Goldilocks::Scalar::direct_scalarmul ( + const Block &in, + decaf_bool_t allow_identity, + decaf_bool_t short_circuit +) const throw(CryptoException) { + SecureBuffer out(Ed448Goldilocks::Point::SER_BYTES); + if (DECAF_SUCCESS != + decaf_448_direct_scalarmul(out.data(), in.data(), s, allow_identity, short_circuit) + ) { + throw CryptoException(); + } + return out; +} +/** endcond */ #undef NOEXCEPT } /* namespace decaf */