256 lines
7.2 KiB
Go
256 lines
7.2 KiB
Go
// Copyright 2010 The Go Authors. All rights reserved.
|
|
// Copyright 2011 ThePiachu. All rights reserved.
|
|
// Copyright 2013 Conformal Systems LLC. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package btcec
|
|
|
|
// This package operates, internally, on Jacobian coordinates. For a given
|
|
// (x, y) position on the curve, the Jacobian coordinates are (x1, y1, z1)
|
|
// where x = x1/z1² and y = y1/z1³. The greatest speedups come when the whole
|
|
// calculation can be performed within the transform (as in ScalarMult and
|
|
// ScalarBaseMult). But even for Add and Double, it's faster to apply and
|
|
// reverse the transform than to operate in affine coordinates.
|
|
|
|
import (
|
|
"crypto/elliptic"
|
|
"math/big"
|
|
"sync"
|
|
)
|
|
|
|
//TODO: examine if we need to care about EC optimization as descibed here
|
|
// https://bitcointalk.org/index.php?topic=155054.0;all
|
|
|
|
// KoblitzCurve supports a koblitz curve implementation that fits the ECC Curve
|
|
// interface.
|
|
type KoblitzCurve struct {
|
|
*elliptic.CurveParams
|
|
q *big.Int
|
|
}
|
|
|
|
func (curve *KoblitzCurve) Params() *elliptic.CurveParams {
|
|
return curve.CurveParams
|
|
}
|
|
|
|
// Return boolean if the point (x,y) is on the curve.
|
|
// Differs from normal curve algorithm since a = 0 not -3
|
|
func (curve *KoblitzCurve) IsOnCurve(x, y *big.Int) bool {
|
|
// y² = x³ + b
|
|
y2 := new(big.Int).Mul(y, y) //y²
|
|
y2.Mod(y2, curve.P) //y²%P
|
|
|
|
x3 := new(big.Int).Mul(x, x) //x²
|
|
x3.Mul(x3, x) //x³
|
|
|
|
x3.Add(x3, curve.B) //x³+B
|
|
x3.Mod(x3, curve.P) //(x³+B)%P
|
|
|
|
return x3.Cmp(y2) == 0
|
|
}
|
|
|
|
// zForAffine returns a Jacobian Z value for the affine point (x, y). If x and
|
|
// y are zero, it assumes that they represent the point at infinity because (0,
|
|
// 0) is not on the any of the curves handled here.
|
|
func zForAffine(x, y *big.Int) *big.Int {
|
|
z := new(big.Int)
|
|
if x.Sign() != 0 || y.Sign() != 0 {
|
|
z.SetInt64(1)
|
|
}
|
|
return z
|
|
}
|
|
|
|
// affineFromJacobian reverses the Jacobian transform. See the comment at the
|
|
// top of the file. If the point is ∞ it returns 0, 0.
|
|
func (curve *KoblitzCurve) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
|
|
if z.Sign() == 0 {
|
|
return new(big.Int), new(big.Int)
|
|
}
|
|
|
|
zinv := new(big.Int).ModInverse(z, curve.P)
|
|
zinvsq := new(big.Int).Mul(zinv, zinv)
|
|
|
|
xOut = new(big.Int).Mul(x, zinvsq)
|
|
xOut.Mod(xOut, curve.P)
|
|
zinvsq.Mul(zinvsq, zinv)
|
|
yOut = new(big.Int).Mul(y, zinvsq)
|
|
yOut.Mod(yOut, curve.P)
|
|
return
|
|
}
|
|
|
|
func (curve *KoblitzCurve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
|
|
z1 := zForAffine(x1, y1)
|
|
z2 := zForAffine(x2, y2)
|
|
return curve.affineFromJacobian(curve.addJacobian(x1, y1, z1, x2, y2, z2))
|
|
}
|
|
|
|
// addJacobian takes two points in Jacobian coordinates, (x1, y1, z1) and
|
|
// (x2, y2, z2) and returns their sum, also in Jacobian form.
|
|
func (curve *KoblitzCurve) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big.Int, *big.Int) {
|
|
// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl
|
|
x3, y3, z3 := new(big.Int), new(big.Int), new(big.Int)
|
|
if z1.Sign() == 0 {
|
|
x3.Set(x2)
|
|
y3.Set(y2)
|
|
z3.Set(z2)
|
|
return x3, y3, z3
|
|
}
|
|
if z2.Sign() == 0 {
|
|
x3.Set(x1)
|
|
y3.Set(y1)
|
|
z3.Set(z1)
|
|
return x3, y3, z3
|
|
}
|
|
|
|
z1z1 := new(big.Int).Mul(z1, z1)
|
|
z1z1.Mod(z1z1, curve.P)
|
|
z2z2 := new(big.Int).Mul(z2, z2)
|
|
z2z2.Mod(z2z2, curve.P)
|
|
|
|
u1 := new(big.Int).Mul(x1, z2z2)
|
|
u1.Mod(u1, curve.P)
|
|
u2 := new(big.Int).Mul(x2, z1z1)
|
|
u2.Mod(u2, curve.P)
|
|
h := new(big.Int).Sub(u2, u1)
|
|
xEqual := h.Sign() == 0
|
|
if h.Sign() == -1 {
|
|
h.Add(h, curve.P)
|
|
}
|
|
i := new(big.Int).Lsh(h, 1)
|
|
i.Mul(i, i)
|
|
j := new(big.Int).Mul(h, i)
|
|
|
|
s1 := new(big.Int).Mul(y1, z2)
|
|
s1.Mul(s1, z2z2)
|
|
s1.Mod(s1, curve.P)
|
|
s2 := new(big.Int).Mul(y2, z1)
|
|
s2.Mul(s2, z1z1)
|
|
s2.Mod(s2, curve.P)
|
|
r := new(big.Int).Sub(s2, s1)
|
|
if r.Sign() == -1 {
|
|
r.Add(r, curve.P)
|
|
}
|
|
yEqual := r.Sign() == 0
|
|
if xEqual && yEqual {
|
|
return curve.doubleJacobian(x1, y1, z1)
|
|
}
|
|
r.Lsh(r, 1)
|
|
v := new(big.Int).Mul(u1, i)
|
|
|
|
x3.Set(r)
|
|
x3.Mul(x3, x3)
|
|
x3.Sub(x3, j)
|
|
x3.Sub(x3, v)
|
|
x3.Sub(x3, v)
|
|
x3.Mod(x3, curve.P)
|
|
|
|
y3.Set(r)
|
|
v.Sub(v, x3)
|
|
y3.Mul(y3, v)
|
|
s1.Mul(s1, j)
|
|
s1.Lsh(s1, 1)
|
|
y3.Sub(y3, s1)
|
|
y3.Mod(y3, curve.P)
|
|
|
|
z3.Add(z1, z2)
|
|
z3.Mul(z3, z3)
|
|
z3.Sub(z3, z1z1)
|
|
z3.Sub(z3, z2z2)
|
|
z3.Mul(z3, h)
|
|
z3.Mod(z3, curve.P)
|
|
|
|
return x3, y3, z3
|
|
}
|
|
|
|
func (curve *KoblitzCurve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
|
|
z1 := zForAffine(x1, y1)
|
|
return curve.affineFromJacobian(curve.doubleJacobian(x1, y1, z1))
|
|
}
|
|
|
|
// doubleJacobian takes a point in Jacobian coordinates, (x, y, z), and
|
|
// returns its double, also in Jacobian form.
|
|
func (curve *KoblitzCurve) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.Int) {
|
|
// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
|
|
|
|
a := new(big.Int).Mul(x, x) //X1²
|
|
b := new(big.Int).Mul(y, y) //Y1²
|
|
c := new(big.Int).Mul(b, b) //B²
|
|
|
|
d := new(big.Int).Add(x, b) //X1+B
|
|
d.Mul(d, d) //(X1+B)²
|
|
d.Sub(d, a) //(X1+B)²-A
|
|
d.Sub(d, c) //(X1+B)²-A-C
|
|
d.Mul(d, big.NewInt(2)) //2*((X1+B)²-A-C)
|
|
|
|
e := new(big.Int).Mul(big.NewInt(3), a) //3*A
|
|
f := new(big.Int).Mul(e, e) //E²
|
|
|
|
x3 := new(big.Int).Mul(big.NewInt(2), d) //2*D
|
|
x3.Sub(f, x3) //F-2*D
|
|
x3.Mod(x3, curve.P)
|
|
|
|
y3 := new(big.Int).Sub(d, x3) //D-X3
|
|
y3.Mul(e, y3) //E*(D-X3)
|
|
y3.Sub(y3, new(big.Int).Mul(big.NewInt(8), c)) //E*(D-X3)-8*C
|
|
y3.Mod(y3, curve.P)
|
|
|
|
z3 := new(big.Int).Mul(y, z) //Y1*Z1
|
|
z3.Mul(big.NewInt(2), z3) //3*Y1*Z1
|
|
z3.Mod(z3, curve.P)
|
|
|
|
return x3, y3, z3
|
|
}
|
|
|
|
func (curve *KoblitzCurve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
|
|
Bz := new(big.Int).SetInt64(1)
|
|
x, y, z := new(big.Int), new(big.Int), new(big.Int)
|
|
|
|
for _, byte := range k {
|
|
for bitNum := 0; bitNum < 8; bitNum++ {
|
|
x, y, z = curve.doubleJacobian(x, y, z)
|
|
if byte&0x80 == 0x80 {
|
|
x, y, z = curve.addJacobian(Bx, By, Bz, x, y, z)
|
|
}
|
|
byte <<= 1
|
|
}
|
|
}
|
|
|
|
return curve.affineFromJacobian(x, y, z)
|
|
}
|
|
|
|
func (curve *KoblitzCurve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
|
|
return curve.ScalarMult(curve.Gx, curve.Gy, k)
|
|
}
|
|
|
|
func (curve *KoblitzCurve) QPlus1Div4() *big.Int {
|
|
if curve.q == nil {
|
|
curve.q = new(big.Int).Div(new(big.Int).Add(secp256k1.P, big.NewInt(1)), big.NewInt(4))
|
|
}
|
|
return curve.q
|
|
}
|
|
|
|
//curve parameters taken from:
|
|
//http://www.secg.org/collateral/sec2_final.pdf
|
|
var initonce sync.Once
|
|
var secp256k1 KoblitzCurve
|
|
|
|
func initAll() {
|
|
initS256()
|
|
}
|
|
|
|
func initS256() {
|
|
// See SEC 2 section 2.7.1
|
|
secp256k1.CurveParams = new(elliptic.CurveParams)
|
|
secp256k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 16)
|
|
secp256k1.N, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 16)
|
|
secp256k1.B, _ = new(big.Int).SetString("0000000000000000000000000000000000000000000000000000000000000007", 16)
|
|
secp256k1.Gx, _ = new(big.Int).SetString("79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 16)
|
|
secp256k1.Gy, _ = new(big.Int).SetString("483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 16)
|
|
secp256k1.BitSize = 256
|
|
}
|
|
|
|
// P521 returns a Curve which implements P-521 (see FIPS 186-3, section D.2.5)
|
|
func S256() *KoblitzCurve {
|
|
initonce.Do(initAll)
|
|
return &secp256k1
|
|
}
|