Commit ed558bfbaa737b187d894eddb8573cde15a3fb33 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-15 08:38:44+02:00
committer	Andrew Kelley <andrew@ziglang.org> 2020-08-16 22:35:27-07:00
log	ed558bfbaa737b187d894eddb8573cde15a3fb33
tree	ea741ebad482cb9bfb1d5a13413d62bbc82fd428
parent	dd8f7b396c24d78168d9582364ab5b3b4606ccc5

Address @daurnimator feedback

7 files changed, 79 insertions(+), 106 deletions(-)

lib
- std
  - crypto
    25519
    curve25519.zig
    ed25519.zig
    edwards25519.zig
    field.zig
    ristretto255.zig
    scalar.zig
    x25519.zig

lib/std/crypto/25519/curve25519.zig+9-10

...	...	@@ -21,7 +21,7 @@ pub const Curve25519 = struct {
21	21
22	22	/// Return the Curve25519 base point.
23	23	pub inline fn basePoint() Curve25519 {
24		return .{ .x = Fe.curve25519BasePoint() };
	24	return .{ .x = Fe.curve25519BasePoint };
25	25	}
26	26
27	27	/// Check that the encoding of a Curve25519 point is canonical.
...	...	@@ -38,10 +38,10 @@ pub const Curve25519 = struct {
38	38
39	39	fn ladder(p: Curve25519, s: [32]u8, comptime bits: usize) !Curve25519 {
40	40	var x1 = p.x;
41		var x2 = Fe.one();
42		var z2 = Fe.zero();
	41	var x2 = Fe.one;
	42	var z2 = Fe.zero;
43	43	var x3 = x1;
44		var z3 = Fe.one();
	44	var z3 = Fe.one;
45	45	var swap: u8 = 0;
46	46	var pos: usize = bits - 1;
47	47	while (true) {
...	...	@@ -76,7 +76,7 @@ pub const Curve25519 = struct {
76	76	if (x2.isZero()) {
77	77	return error.IdentityElement;
78	78	}
79		return Curve25519 { .x = x2 };
	79	return Curve25519{ .x = x2 };
80	80	}
81	81
82	82	/// Multiply a Curve25519 point by a scalar after "clamping" it.
...	...	@@ -88,7 +88,7 @@ pub const Curve25519 = struct {
88	88	pub fn clampedMul(p: Curve25519, s: [32]u8) !Curve25519 {
89	89	var t: [32]u8 = s;
90	90	scalar.clamp(&t);
91		return ladder(p, t, 255);
	91	return try ladder(p, t, 255);
92	92	}
93	93
94	94	/// Multiply a Curve25519 point by a scalar without clamping it.
...	...	@@ -98,7 +98,7 @@ pub const Curve25519 = struct {
98	98	pub fn mul(p: Curve25519, s: [32]u8) !Curve25519 {
99	99	const cofactor = [_]u8{8} ++ [_]u8{0} ** 31;
100	100	_ = ladder(p, cofactor, 4) catch \|_\| return error.WeakPublicKey;
101		return ladder(p, s, 256);
	101	return try ladder(p, s, 256);
102	102	}
103	103	};
104	104
...	...	@@ -107,10 +107,9 @@ test "curve25519" {
107	107	const p = try Curve25519.basePoint().clampedMul(s);
108	108	try p.rejectIdentity();
109	109	var buf: [128]u8 = undefined;
110		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
111		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{p.toBytes()}), "E6F2A4D1C28EE5C7AD0329268255A468AD407D2672824C0C0EB30EA6EF450145");
	110	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{p.toBytes()}), "E6F2A4D1C28EE5C7AD0329268255A468AD407D2672824C0C0EB30EA6EF450145");
112	111	const q = try p.clampedMul(s);
113		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{q.toBytes()}), "3614E119FFE55EC55B87D6B19971A9F4CBC78EFE80BEC55B96392BABCC712537");
	112	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{q.toBytes()}), "3614E119FFE55EC55B87D6B19971A9F4CBC78EFE80BEC55B96392BABCC712537");
114	113
115	114	try Curve25519.rejectNonCanonical(s);
116	115	s[31] \|= 0x80;

lib/std/crypto/25519/ed25519.zig+3-5

...	...	@@ -107,11 +107,10 @@ test "ed25519 key pair creation" {
107	107	try fmt.hexToBytes(seed[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");
108	108	const key_pair = try Ed25519.createKeyPair(seed);
109	109	var buf: [256]u8 = undefined;
110		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
111		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{key_pair}), "8052030376D47112BE7F73ED7A019293DD12AD910B654455798B4667D73DE1662D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
	110	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{key_pair}), "8052030376D47112BE7F73ED7A019293DD12AD910B654455798B4667D73DE1662D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
112	111
113	112	const public_key = Ed25519.publicKey(key_pair);
114		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{public_key}), "2D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
	113	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{public_key}), "2D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
115	114	}
116	115
117	116	test "ed25519 signature" {
...	...	@@ -121,8 +120,7 @@ test "ed25519 signature" {
121	120
122	121	const sig = try Ed25519.sign("test", key_pair, null);
123	122	var buf: [128]u8 = undefined;
124		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
125		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{sig}), "10A442B4A80CC4225B154F43BEF28D2472CA80221951262EB8E0DF9091575E2687CC486E77263C3418C757522D54F84B0359236ABBBD4ACD20DC297FDCA66808");
	123	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{sig}), "10A442B4A80CC4225B154F43BEF28D2472CA80221951262EB8E0DF9091575E2687CC486E77263C3418C757522D54F84B0359236ABBBD4ACD20DC297FDCA66808");
126	124	const public_key = Ed25519.publicKey(key_pair);
127	125	try Ed25519.verify(sig, "test", public_key);
128	126	std.testing.expectError(error.InvalidSignature, Ed25519.verify(sig, "TEST", public_key));

lib/std/crypto/25519/edwards25519.zig+9-10

...	...	@@ -17,10 +17,10 @@ pub const Edwards25519 = struct {
17	17
18	18	/// Decode an Edwards25519 point from its compressed (Y+sign) coordinates.
19	19	pub fn fromBytes(s: [32]u8) !Edwards25519 {
20		const z = Fe.one();
	20	const z = Fe.one;
21	21	const y = Fe.fromBytes(s);
22	22	var u = y.sq();
23		var v = u.mul(Fe.edwards25519d());
	23	var v = u.mul(Fe.edwards25519d);
24	24	u = u.sub(z);
25	25	v = v.add(z);
26	26	const v3 = v.sq().mul(v);
...	...	@@ -31,10 +31,10 @@ pub const Edwards25519 = struct {
31	31	if ((@boolToInt(has_m_root) \| @boolToInt(has_p_root)) == 0) {
32	32	return error.InvalidEncoding;
33	33	}
34		x.cMov(x.mul(Fe.sqrtm1()), 1 - @boolToInt(has_m_root));
	34	x.cMov(x.mul(Fe.sqrtm1), 1 - @boolToInt(has_m_root));
35	35	x.cMov(x.neg(), @boolToInt(x.isNegative()) ^ (s[31] >> 7));
36	36	const t = x.mul(y);
37		return Edwards25519 { .x = x, .y = y, .z = z, .t = t };
	37	return Edwards25519{ .x = x, .y = y, .z = z, .t = t };
38	38	}
39	39
40	40	/// Encode an Edwards25519 point.
...	...	@@ -55,14 +55,14 @@ pub const Edwards25519 = struct {
55	55	return .{
56	56	.x = Fe{ .limbs = .{ 3990542415680775, 3398198340507945, 4322667446711068, 2814063955482877, 2839572215813860 } },
57	57	.y = Fe{ .limbs = .{ 1801439850948184, 1351079888211148, 450359962737049, 900719925474099, 1801439850948198 } },
58		.z = Fe.one(),
	58	.z = Fe.one,
59	59	.t = Fe{ .limbs = .{ 1841354044333475, 16398895984059, 755974180946558, 900171276175154, 1821297809914039 } },
60	60	.is_base = true,
61	61	};
62	62	}
63	63
64	64	inline fn identityElement() Edwards25519 {
65		return .{ .x = Fe.zero(), .y = Fe.one(), .z = Fe.one(), .t = Fe.zero() };
	65	return .{ .x = Fe.zero, .y = Fe.one, .z = Fe.one, .t = Fe.zero };
66	66	}
67	67
68	68	/// Reject the neutral element.
...	...	@@ -98,7 +98,7 @@ pub const Edwards25519 = struct {
98	98	pub inline fn add(p: Edwards25519, q: Edwards25519) Edwards25519 {
99	99	const a = p.y.sub(p.x).mul(q.y.sub(q.x));
100	100	const b = p.x.add(p.y).mul(q.x.add(q.y));
101		const c = p.t.mul(q.t).mul(Fe.edwards25519d2());
	101	const c = p.t.mul(q.t).mul(Fe.edwards25519d2);
102	102	var d = p.z.mul(q.z);
103	103	d = d.add(d);
104	104	const x = b.sub(a);
...	...	@@ -124,7 +124,7 @@ pub const Edwards25519 = struct {
124	124	var t = Edwards25519.identityElement();
125	125	comptime var i: u8 = 0;
126	126	inline while (i < 16) : (i += 1) {
127		t.cMov(pc[i], ((@intCast(usize, (b ^ i)) -% 1) >> 8) & 1);
	127	t.cMov(pc[i], ((@as(usize, (b ^ i)) -% 1) >> 8) & 1);
128	128	}
129	129	return t;
130	130	}
...	...	@@ -191,8 +191,7 @@ test "edwards25519 packing/unpacking" {
191	191	var b = Edwards25519.basePoint();
192	192	const pk = try b.mul(s);
193	193	var buf: [128]u8 = undefined;
194		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
195		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{pk.toBytes()}), "074BC7E0FCBD587FDBC0969444245FADC562809C8F6E97E949AF62484B5B81A6");
	194	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{pk.toBytes()}), "074BC7E0FCBD587FDBC0969444245FADC562809C8F6E97E949AF62484B5B81A6");
196	195
197	196	const small_order_ss: [7][32]u8 = .{
198	197	.{

lib/std/crypto/25519/field.zig+9-24

...	...	@@ -7,34 +7,19 @@ pub const Fe = struct {
7	7
8	8	const MASK51: u64 = 0x7ffffffffffff;
9	9
10		pub inline fn zero() Fe {
11		return .{ .limbs = .{ 0, 0, 0, 0, 0 } };
12		}
	10	pub const zero = Fe{ .limbs = .{ 0, 0, 0, 0, 0 } };
13	11
14		pub inline fn one() Fe {
15		return .{ .limbs = .{ 1, 0, 0, 0, 0 } };
16		}
	12	pub const one = Fe{ .limbs = .{ 1, 0, 0, 0, 0 } };
17	13
18		pub inline fn sqrtm1() Fe {
19		return .{ .limbs = .{ 1718705420411056, 234908883556509, 2233514472574048, 2117202627021982, 765476049583133 } }; // sqrt(-1)
20		}
	14	pub const sqrtm1 = Fe{ .limbs = .{ 1718705420411056, 234908883556509, 2233514472574048, 2117202627021982, 765476049583133 } }; // sqrt(-1)
21	15
22		pub inline fn curve25519BasePoint() Fe {
23		return .{ .limbs = .{ 9, 0, 0, 0, 0 } };
24		}
	16	pub const curve25519BasePoint = Fe{ .limbs = .{ 9, 0, 0, 0, 0 } };
25	17
26		pub inline fn edwards25519d() Fe {
27		return .{ .limbs = .{ 929955233495203, 466365720129213, 1662059464998953, 2033849074728123, 1442794654840575 } }; // 37095705934669439343138083508754565189542113879843219016388785533085940283555
28		}
	18	pub const edwards25519d = Fe{ .limbs = .{ 929955233495203, 466365720129213, 1662059464998953, 2033849074728123, 1442794654840575 } }; // 37095705934669439343138083508754565189542113879843219016388785533085940283555
29	19
30		pub inline fn edwards25519d2() Fe {
31		return .{ .limbs = .{ 1859910466990425, 932731440258426, 1072319116312658, 1815898335770999, 633789495995903 } }; // 2d
32		}
	20	pub const edwards25519d2 = Fe{ .limbs = .{ 1859910466990425, 932731440258426, 1072319116312658, 1815898335770999, 633789495995903 } }; // 2d
33	21
34		// 1/sqrt(a-d)
35		pub inline fn edwards25519sqrtamd() Fe {
36		return .{ .limbs = .{ 278908739862762, 821645201101625, 8113234426968, 1777959178193151, 2118520810568447 } };
37		}
	22	pub const edwards25519sqrtamd = Fe{ .limbs = .{ 278908739862762, 821645201101625, 8113234426968, 1777959178193151, 2118520810568447 } }; // 1/sqrt(a-d)
38	23
39	24	pub inline fn isZero(fe: Fe) bool {
40	25	var reduced = fe;
...	...	@@ -77,7 +62,7 @@ pub const Fe = struct {
77	62	c \|= s[i] ^ 0xff;
78	63	}
79	64	c = (c -% 1) >> 8;
80		const d = (@intCast(u16, 0xed - 1) -% @intCast(u16, s[0])) >> 8;
	65	const d = (@as(u16, 0xed - 1) -% @as(u16, s[0])) >> 8;
81	66	const x = if (ignore_extra_bit) 0 else s[31] >> 7;
82	67	if ((((c & d) \| x) & 1) != 0) {
83	68	return error.NonCanonical;
...	...	@@ -148,7 +133,7 @@ pub const Fe = struct {
148	133	}
149	134
150	135	pub inline fn neg(a: Fe) Fe {
151		return zero().sub(a);
	136	return zero.sub(a);
152	137	}
153	138
154	139	pub inline fn isNegative(a: Fe) bool {

lib/std/crypto/25519/ristretto255.zig+16-17

...	...	@@ -18,11 +18,11 @@ pub const Ristretto255 = struct {
18	18	const vxx = x.sq().mul(v); // vx^2
19	19	const m_root_check = vxx.sub(u); // vx^2-u
20	20	const p_root_check = vxx.add(u); // vx^2+u
21		const f_root_check = u.mul(Fe.sqrtm1()).add(vxx); // vx^2+u*sqrt(-1)
	21	const f_root_check = u.mul(Fe.sqrtm1).add(vxx); // vx^2+u*sqrt(-1)
22	22	const has_m_root = m_root_check.isZero();
23	23	const has_p_root = p_root_check.isZero();
24	24	const has_f_root = f_root_check.isZero();
25		const x_sqrtm1 = x.mul(Fe.sqrtm1()); // x*sqrt(-1)
	25	const x_sqrtm1 = x.mul(Fe.sqrtm1); // x*sqrt(-1)
26	26	x.cMov(x_sqrtm1, @boolToInt(has_p_root) \| @boolToInt(has_f_root));
27	27	x = x.abs();
28	28	if ((@boolToInt(has_m_root) \| @boolToInt(has_p_root)) == 0) {
...	...	@@ -53,13 +53,13 @@ pub const Ristretto255 = struct {
53	53	try rejectNonCanonical(s);
54	54	const s_ = Fe.fromBytes(s);
55	55	const ss = s_.sq(); // s^2
56		const u1_ = Fe.one().sub(ss); // (1-s^2)
	56	const u1_ = Fe.one.sub(ss); // (1-s^2)
57	57	const u1u1 = u1_.sq(); // (1-s^2)^2
58		const u2_ = Fe.one().add(ss); // (1+s^2)
	58	const u2_ = Fe.one.add(ss); // (1+s^2)
59	59	const u2u2 = u2_.sq(); // (1+s^2)^2
60		const v = Fe.edwards25519d().mul(u1u1).neg().sub(u2u2); // -(d*u1^2)-u2^2
	60	const v = Fe.edwards25519d.mul(u1u1).neg().sub(u2u2); // -(d*u1^2)-u2^2
61	61	const v_u2u2 = v.mul(u2u2); // v*u2^2
62		const inv_sqrt = sqrtRatioM1(Fe.one(), v_u2u2) catch \|e\| {
	62	const inv_sqrt = sqrtRatioM1(Fe.one, v_u2u2) catch \|e\| {
63	63	return error.InvalidEncoding;
64	64	};
65	65	var x = inv_sqrt.mul(u2_);
...	...	@@ -73,10 +73,10 @@ pub const Ristretto255 = struct {
73	73	const p: Curve = .{
74	74	.x = x,
75	75	.y = y,
76		.z = Fe.one(),
	76	.z = Fe.one,
77	77	.t = t,
78	78	};
79		return Ristretto255 { .p = p };
	79	return Ristretto255{ .p = p };
80	80	}
81	81
82	82	/// Encode to a Ristretto255 representative.
...	...	@@ -87,13 +87,13 @@ pub const Ristretto255 = struct {
87	87	u1_ = u1_.mul(zmy); // (Z+Y)*(Z-Y)
88	88	const u2_ = p.x.mul(p.y); // X*Y
89	89	const u1_u2u2 = u2_.sq().mul(u1_); // u1*u2^2
90		const inv_sqrt = sqrtRatioM1(Fe.one(), u1_u2u2) catch unreachable;
	90	const inv_sqrt = sqrtRatioM1(Fe.one, u1_u2u2) catch unreachable;
91	91	const den1 = inv_sqrt.mul(u1_);
92	92	const den2 = inv_sqrt.mul(u2_);
93	93	const z_inv = den1.mul(den2).mul(p.t); // den1den2T
94		const ix = p.x.mul(Fe.sqrtm1()); // X*sqrt(-1)
95		const iy = p.y.mul(Fe.sqrtm1()); // Y*sqrt(-1)
96		const eden = den1.mul(Fe.edwards25519sqrtamd()); // den1/sqrt(a-d)
	94	const ix = p.x.mul(Fe.sqrtm1); // X*sqrt(-1)
	95	const iy = p.y.mul(Fe.sqrtm1); // Y*sqrt(-1)
	96	const eden = den1.mul(Fe.edwards25519sqrtamd); // den1/sqrt(a-d)
97	97	const t_z_inv = p.t.mul(z_inv); // T*z_inv
98	98
99	99	const rotate = @boolToInt(t_z_inv.isNegative());
...	...	@@ -125,23 +125,22 @@ pub const Ristretto255 = struct {
125	125	/// Return error.WeakPublicKey if the resulting element is
126	126	/// the identity element.
127	127	pub inline fn mul(p: Ristretto255, s: [32]u8) !Ristretto255 {
128		return Ristretto255 { .p = try p.p.mul(s) };
	128	return Ristretto255{ .p = try p.p.mul(s) };
129	129	}
130	130	};
131	131
132	132	test "ristretto255" {
133	133	const p = Ristretto255.basePoint();
134	134	var buf: [256]u8 = undefined;
135		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
136		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{p.toBytes()}), "E2F2AE0A6ABC4E71A884A961C500515F58E30B6AA582DD8DB6A65945E08D2D76");
	135	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{p.toBytes()}), "E2F2AE0A6ABC4E71A884A961C500515F58E30B6AA582DD8DB6A65945E08D2D76");
137	136
138	137	var r: [32]u8 = undefined;
139	138	try fmt.hexToBytes(r[0..], "6a493210f7499cd17fecb510ae0cea23a110e8d5b901f8acadd3095c73a3b919");
140	139	var q = try Ristretto255.fromBytes(r);
141	140	q = q.dbl().add(p);
142		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{q.toBytes()}), "E882B131016B52C1D3337080187CF768423EFCCBB517BB495AB812C4160FF44E");
	141	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{q.toBytes()}), "E882B131016B52C1D3337080187CF768423EFCCBB517BB495AB812C4160FF44E");
143	142
144	143	const s = [_]u8{15} ++ [_]u8{0} ** 31;
145	144	const w = try p.mul(s);
146		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{w.toBytes()}), "E0C418F7C8D9C4CDD7395B93EA124F3AD99021BB681DFC3302A9D99A2E53E64E");
	145	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{w.toBytes()}), "E0C418F7C8D9C4CDD7395B93EA124F3AD99021BB681DFC3302A9D99A2E53E64E");
147	146	}

lib/std/crypto/25519/scalar.zig+16-23

...	...	@@ -1,20 +1,17 @@
1	1	const std = @import("std");
2	2	const mem = std.mem;
3	3
4		inline fn fieldSize() [32]u8 {
5		return .{
6		0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, // 2^252+27742317777372353535851937790883648493
7		};
8		}
	4	const field_size = [32]u8{
	5	0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, // 2^252+27742317777372353535851937790883648493
	6	};
9	7
10	8	const ScalarExpanded = struct {
11		const L = fieldSize();
12	9	limbs: [64]i64 = [_]i64{0} ** 64,
13	10
14	11	fn fromBytes(s: [32]u8) ScalarExpanded {
15	12	var limbs: [64]i64 = undefined;
16	13	for (s) \|x, idx\| {
17		limbs[idx] = @intCast(i64, x);
	14	limbs[idx] = @as(i64, x);
18	15	}
19	16	mem.set(i64, limbs[32..], 0);
20	17	return .{ .limbs = limbs };
...	...	@@ -23,7 +20,7 @@ const ScalarExpanded = struct {
23	20	fn fromBytes64(s: [64]u8) ScalarExpanded {
24	21	var limbs: [64]i64 = undefined;
25	22	for (s) \|x, idx\| {
26		limbs[idx] = @intCast(i64, x);
	23	limbs[idx] = @as(i64, x);
27	24	}
28	25	return .{ .limbs = limbs };
29	26	}
...	...	@@ -38,7 +35,7 @@ const ScalarExpanded = struct {
38	35	const xi = limbs[i];
39	36	var j = i - 32;
40	37	while (j < k) : (j += 1) {
41		const xj = limbs[j] + carry - 16 * xi * @intCast(i64, L[j - (i - 32)]);
	38	const xj = limbs[j] + carry - 16 * xi * @as(i64, field_size[j - (i - 32)]);
42	39	carry = (xj + 128) >> 8;
43	40	limbs[j] = xj - carry * 256;
44	41	}
...	...	@@ -48,13 +45,13 @@ const ScalarExpanded = struct {
48	45	carry = 0;
49	46	comptime var j: usize = 0;
50	47	inline while (j < 32) : (j += 1) {
51		const xi = limbs[j] + carry - (limbs[31] >> 4) * @intCast(i64, L[j]);
	48	const xi = limbs[j] + carry - (limbs[31] >> 4) * @as(i64, field_size[j]);
52	49	carry = xi >> 8;
53	50	limbs[j] = xi & 255;
54	51	}
55	52	j = 0;
56	53	inline while (j < 32) : (j += 1) {
57		limbs[j] -= carry * @intCast(i64, L[j]);
	54	limbs[j] -= carry * @as(i64, field_size[j]);
58	55	}
59	56	j = 0;
60	57	inline while (j < 32) : (j += 1) {
...	...	@@ -116,15 +113,14 @@ const ScalarExpanded = struct {
116	113
117	114	/// Reject a scalar whose encoding is not canonical.
118	115	pub fn rejectNonCanonical(s: [32]u8) !void {
119		const L = fieldSize();
120	116	var c: u8 = 0;
121	117	var n: u8 = 1;
122	118	var i: usize = 31;
123	119	while (true) {
124		const xs = @intCast(u16, s[i]);
125		const xL = @intCast(u16, L[i]);
126		c \|= @intCast(u8, ((xs -% xL) >> 8) & n);
127		n &= @intCast(u8, ((xs ^ xL) -% 1) >> 8);
	120	const xs = @as(u16, s[i]);
	121	const xfield_size = @as(u16, field_size[i]);
	122	c \|= @intCast(u8, ((xs -% xfield_size) >> 8) & n);
	123	n &= @intCast(u8, ((xs ^ xfield_size) -% 1) >> 8);
128	124	if (i == 0) break;
129	125	i -= 1;
130	126	}
...	...	@@ -161,12 +157,10 @@ test "scalar25519" {
161	157	var y = x.toBytes();
162	158	try rejectNonCanonical(y);
163	159	var buf: [128]u8 = undefined;
164		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
165		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{y}), "1E979B917937F3DE71D18077F961F6CEFF01030405060708010203040506070F");
	160	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{y}), "1E979B917937F3DE71D18077F961F6CEFF01030405060708010203040506070F");
166	161
167		const field_size = fieldSize();
168	162	const reduced = reduce(field_size);
169		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{reduced}), "0000000000000000000000000000000000000000000000000000000000000000");
	163	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{reduced}), "0000000000000000000000000000000000000000000000000000000000000000");
170	164	}
171	165
172	166	test "non-canonical scalar25519" {
...	...	@@ -174,12 +168,11 @@ test "non-canonical scalar25519" {
174	168	std.testing.expectError(error.NonCanonical, rejectNonCanonical(too_targe));
175	169	}
176	170
177		test "scalar25519 mulAdd overflow check" {
	171	test "mulAdd overflow check" {
178	172	const a: [32]u8 = [_]u8{0xff} ** 32;
179	173	const b: [32]u8 = [_]u8{0xff} ** 32;
180	174	const c: [32]u8 = [_]u8{0xff} ** 32;
181	175	const x = mulAdd(a, b, c);
182	176	var buf: [128]u8 = undefined;
183		const alloc = &std.heap.FixedBufferAllocator.init(&buf).allocator;
184		std.testing.expectEqualStrings(try std.fmt.allocPrint(alloc, "{X}", .{x}), "D14DF91389432C25AD60FF9791B9FD1D67BEF517D273ECCE3D9A307C1B419903");
	177	std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{x}), "D14DF91389432C25AD60FF9791B9FD1D67BEF517D273ECCE3D9A307C1B419903");
185	178	}

lib/std/crypto/25519/x25519.zig+17-17

...	...	@@ -56,32 +56,32 @@ test "x25519 public key calculation from secret key" {
56	56	}
57	57
58	58	test "x25519 rfc7748 vector1" {
59		const secret_key = "\xa5\x46\xe3\x6b\xf0\x52\x7c\x9d\x3b\x16\x15\x4b\x82\x46\x5e\xdd\x62\x14\x4c\x0a\xc1\xfc\x5a\x18\x50\x6a\x22\x44\xba\x44\x9a\xc4";
60		const public_key = "\xe6\xdb\x68\x67\x58\x30\x30\xdb\x35\x94\xc1\xa4\x24\xb1\x5f\x7c\x72\x66\x24\xec\x26\xb3\x35\x3b\x10\xa9\x03\xa6\xd0\xab\x1c\x4c";
	59	const secret_key = [32]u8{ 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d, 0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd, 0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18, 0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4 };
	60	const public_key = [32]u8{ 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb, 0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c, 0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b, 0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c };
61	61
62		const expected_output = "\xc3\xda\x55\x37\x9d\xe9\xc6\x90\x8e\x94\xea\x4d\xf2\x8d\x08\x4f\x32\xec\xcf\x03\x49\x1c\x71\xf7\x54\xb4\x07\x55\x77\xa2\x85\x52";
	62	const expected_output = [32]u8{ 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90, 0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f, 0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7, 0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 };
63	63
64	64	var output: [32]u8 = undefined;
65	65
66		std.testing.expect(X25519.create(output[0..], secret_key, public_key));
67		std.testing.expect(std.mem.eql(u8, &output, expected_output));
	66	std.testing.expect(X25519.create(output[0..], secret_key[0..], public_key[0..]));
	67	std.testing.expect(std.mem.eql(u8, &output, expected_output[0..]));
68	68	}
69	69
70	70	test "x25519 rfc7748 vector2" {
71		const secret_key = "\x4b\x66\xe9\xd4\xd1\xb4\x67\x3c\x5a\xd2\x26\x91\x95\x7d\x6a\xf5\xc1\x1b\x64\x21\xe0\xea\x01\xd4\x2c\xa4\x16\x9e\x79\x18\xba\x0d";
72		const public_key = "\xe5\x21\x0f\x12\x78\x68\x11\xd3\xf4\xb7\x95\x9d\x05\x38\xae\x2c\x31\xdb\xe7\x10\x6f\xc0\x3c\x3e\xfc\x4c\xd5\x49\xc7\x15\xa4\x93";
	71	const secret_key = [32]u8{ 0x4b, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c, 0x5a, 0xd2, 0x26, 0x91, 0x95, 0x7d, 0x6a, 0xf5, 0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea, 0x01, 0xd4, 0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x0d };
	72	const public_key = [32]u8{ 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3, 0xf4, 0xb7, 0x95, 0x9d, 0x05, 0x38, 0xae, 0x2c, 0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0, 0x3c, 0x3e, 0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x93 };
73	73
74		const expected_output = "\x95\xcb\xde\x94\x76\xe8\x90\x7d\x7a\xad\xe4\x5c\xb4\xb8\x73\xf8\x8b\x59\x5a\x68\x79\x9f\xa1\x52\xe6\xf8\xf7\x64\x7a\xac\x79\x57";
	74	const expected_output = [32]u8{ 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d, 0x7a, 0xad, 0xe4, 0x5c, 0xb4, 0xb8, 0x73, 0xf8, 0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f, 0xa1, 0x52, 0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 };
75	75
76	76	var output: [32]u8 = undefined;
77	77
78		std.testing.expect(X25519.create(output[0..], secret_key, public_key));
79		std.testing.expect(std.mem.eql(u8, &output, expected_output));
	78	std.testing.expect(X25519.create(output[0..], secret_key[0..], public_key[0..]));
	79	std.testing.expect(std.mem.eql(u8, &output, expected_output[0..]));
80	80	}
81	81
82	82	test "x25519 rfc7748 one iteration" {
83		const initial_value = "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".*;
84		const expected_output = "\x42\x2c\x8e\x7a\x62\x27\xd7\xbc\xa1\x35\x0b\x3e\x2b\xb7\x27\x9f\x78\x97\xb8\x7b\xb6\x85\x4b\x78\x3c\x60\xe8\x03\x11\xae\x30\x79";
	83	const initial_value = [32]u8{ 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
	84	const expected_output = [32]u8{ 0x42, 0x2c, 0x8e, 0x7a, 0x62, 0x27, 0xd7, 0xbc, 0xa1, 0x35, 0x0b, 0x3e, 0x2b, 0xb7, 0x27, 0x9f, 0x78, 0x97, 0xb8, 0x7b, 0xb6, 0x85, 0x4b, 0x78, 0x3c, 0x60, 0xe8, 0x03, 0x11, 0xae, 0x30, 0x79 };
85	85
86	86	var k: [32]u8 = initial_value;
87	87	var u: [32]u8 = initial_value;
...	...	@@ -95,7 +95,7 @@ test "x25519 rfc7748 one iteration" {
95	95	std.mem.copy(u8, k[0..], output[0..]);
96	96	}
97	97
98		std.testing.expect(std.mem.eql(u8, k[0..], expected_output));
	98	std.testing.expect(std.mem.eql(u8, k[0..], expected_output[0..]));
99	99	}
100	100
101	101	test "x25519 rfc7748 1,000 iterations" {
...	...	@@ -104,8 +104,8 @@ test "x25519 rfc7748 1,000 iterations" {
104	104	return error.SkipZigTest;
105	105	}
106	106
107		const initial_value = "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
108		const expected_output = "\x68\x4c\xf5\x9b\xa8\x33\x09\x55\x28\x00\xef\x56\x6f\x2f\x4d\x3c\x1c\x38\x87\xc4\x93\x60\xe3\x87\x5f\x2e\xb9\x4d\x99\x53\x2c\x51";
	107	const initial_value = [32]u8{ 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
	108	const expected_output = [32]u8{ 0x68, 0x4c, 0xf5, 0x9b, 0xa8, 0x33, 0x09, 0x55, 0x28, 0x00, 0xef, 0x56, 0x6f, 0x2f, 0x4d, 0x3c, 0x1c, 0x38, 0x87, 0xc4, 0x93, 0x60, 0xe3, 0x87, 0x5f, 0x2e, 0xb9, 0x4d, 0x99, 0x53, 0x2c, 0x51 };
109	109
110	110	var k: [32]u8 = initial_value.*;
111	111	var u: [32]u8 = initial_value.*;
...	...	@@ -127,8 +127,8 @@ test "x25519 rfc7748 1,000,000 iterations" {
127	127	return error.SkipZigTest;
128	128	}
129	129
130		const initial_value = "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
131		const expected_output = "\x7c\x39\x11\xe0\xab\x25\x86\xfd\x86\x44\x97\x29\x7e\x57\x5e\x6f\x3b\xc6\x01\xc0\x88\x3c\x30\xdf\x5f\x4d\xd2\xd2\x4f\x66\x54\x24";
	130	const initial_value = [32]u8{ 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
	131	const expected_output = [32]u8{ 0x7c, 0x39, 0x11, 0xe0, 0xab, 0x25, 0x86, 0xfd, 0x86, 0x44, 0x97, 0x29, 0x7e, 0x57, 0x5e, 0x6f, 0x3b, 0xc6, 0x01, 0xc0, 0x88, 0x3c, 0x30, 0xdf, 0x5f, 0x4d, 0xd2, 0xd2, 0x4f, 0x66, 0x54, 0x24 };
132	132
133	133	var k: [32]u8 = initial_value.*;
134	134	var u: [32]u8 = initial_value.*;