Viel neues
This commit is contained in:
Sven Steinert
217
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Base.php
Normal file
217
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Base.php
Normal file
@@ -0,0 +1,217 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Curve methods common to all curves
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2017 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Exception\RangeException;
|
||||
use phpseclib3\Exception\RuntimeException;
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\FiniteField\Integer;
|
||||
|
||||
/**
|
||||
* Base
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
abstract class Base
|
||||
{
|
||||
/**
|
||||
* The Order
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $order;
|
||||
|
||||
/**
|
||||
* Finite Field Integer factory
|
||||
*
|
||||
* @var Integer
|
||||
*/
|
||||
protected $factory;
|
||||
|
||||
/**
|
||||
* Returns a random integer
|
||||
*
|
||||
* @return object
|
||||
*/
|
||||
public function randomInteger()
|
||||
{
|
||||
return $this->factory->randomInteger();
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts a BigInteger to a \phpseclib3\Math\FiniteField\Integer integer
|
||||
*
|
||||
* @return object
|
||||
*/
|
||||
public function convertInteger(BigInteger $x)
|
||||
{
|
||||
return $this->factory->newInteger($x);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the length, in bytes, of the modulo
|
||||
*
|
||||
* @return Integer
|
||||
*/
|
||||
public function getLengthInBytes(): int
|
||||
{
|
||||
return $this->factory->getLengthInBytes();
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the length, in bits, of the modulo
|
||||
*
|
||||
* @return Integer
|
||||
*/
|
||||
public function getLength(): int
|
||||
{
|
||||
return $this->factory->getLength();
|
||||
}
|
||||
|
||||
/**
|
||||
* Multiply a point on the curve by a scalar
|
||||
*
|
||||
* Uses the montgomery ladder technique as described here:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Montgomery_ladder
|
||||
* https://github.com/phpecc/phpecc/issues/16#issuecomment-59176772
|
||||
*/
|
||||
public function multiplyPoint(array $p, BigInteger $d): array
|
||||
{
|
||||
$alreadyInternal = isset($p[2]);
|
||||
$r = $alreadyInternal ?
|
||||
[[], $p] :
|
||||
[[], $this->convertToInternal($p)];
|
||||
|
||||
$d = $d->toBits();
|
||||
for ($i = 0; $i < strlen($d); $i++) {
|
||||
$d_i = (int) $d[$i];
|
||||
$r[1 - $d_i] = $this->addPoint($r[0], $r[1]);
|
||||
$r[$d_i] = $this->doublePoint($r[$d_i]);
|
||||
}
|
||||
|
||||
return $alreadyInternal ? $r[0] : $this->convertToAffine($r[0]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a random scalar multiplier
|
||||
*/
|
||||
public function createRandomMultiplier(): BigInteger
|
||||
{
|
||||
static $one;
|
||||
if (!isset($one)) {
|
||||
$one = new BigInteger(1);
|
||||
}
|
||||
|
||||
return BigInteger::randomRange($one, $this->order->subtract($one));
|
||||
}
|
||||
|
||||
/**
|
||||
* Performs range check
|
||||
*/
|
||||
public function rangeCheck(BigInteger $x): void
|
||||
{
|
||||
static $zero;
|
||||
if (!isset($zero)) {
|
||||
$zero = new BigInteger();
|
||||
}
|
||||
|
||||
if (!isset($this->order)) {
|
||||
throw new RuntimeException('setOrder needs to be called before this method');
|
||||
}
|
||||
if ($x->compare($this->order) > 0 || $x->compare($zero) <= 0) {
|
||||
throw new RangeException('x must be between 1 and the order of the curve');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the Order
|
||||
*/
|
||||
public function setOrder(BigInteger $order): void
|
||||
{
|
||||
$this->order = $order;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the Order
|
||||
*/
|
||||
public function getOrder(): BigInteger
|
||||
{
|
||||
return $this->order;
|
||||
}
|
||||
|
||||
/**
|
||||
* Use a custom defined modular reduction function
|
||||
*
|
||||
* @return object
|
||||
*/
|
||||
public function setReduction(callable $func)
|
||||
{
|
||||
$this->factory->setReduction($func);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the affine point
|
||||
*
|
||||
* @return object[]
|
||||
*/
|
||||
public function convertToAffine(array $p): array
|
||||
{
|
||||
return $p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts an affine point to a jacobian coordinate
|
||||
*
|
||||
* @return object[]
|
||||
*/
|
||||
public function convertToInternal(array $p): array
|
||||
{
|
||||
return $p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Negates a point
|
||||
*
|
||||
* @return object[]
|
||||
*/
|
||||
public function negatePoint(array $p): array
|
||||
{
|
||||
$temp = [
|
||||
$p[0],
|
||||
$p[1]->negate(),
|
||||
];
|
||||
if (isset($p[2])) {
|
||||
$temp[] = $p[2];
|
||||
}
|
||||
return $temp;
|
||||
}
|
||||
|
||||
/**
|
||||
* Multiply and Add Points
|
||||
*
|
||||
* @return int[]
|
||||
*/
|
||||
public function multiplyAddPoints(array $points, array $scalars): array
|
||||
{
|
||||
$p1 = $this->convertToInternal($points[0]);
|
||||
$p2 = $this->convertToInternal($points[1]);
|
||||
$p1 = $this->multiplyPoint($p1, $scalars[0]);
|
||||
$p2 = $this->multiplyPoint($p2, $scalars[1]);
|
||||
$r = $this->addPoint($p1, $p2);
|
||||
return $this->convertToAffine($r);
|
||||
}
|
||||
}
|
||||
371
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Binary.php
Normal file
371
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Binary.php
Normal file
@@ -0,0 +1,371 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Curves over y^2 + x*y = x^3 + a*x^2 + b
|
||||
*
|
||||
* These are curves used in SEC 2 over prime fields: http://www.secg.org/SEC2-Ver-1.0.pdf
|
||||
* The curve is a weierstrass curve with a[3] and a[2] set to 0.
|
||||
*
|
||||
* Uses Jacobian Coordinates for speed if able:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Jacobian_curve
|
||||
* https://en.wikibooks.org/wiki/Cryptography/Prime_Curve/Jacobian_Coordinates
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2017 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Exception\RuntimeException;
|
||||
use phpseclib3\Exception\UnexpectedValueException;
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\BinaryField;
|
||||
use phpseclib3\Math\BinaryField\Integer as BinaryInteger;
|
||||
use phpseclib3\Math\PrimeField\Integer;
|
||||
|
||||
/**
|
||||
* Curves over y^2 + x*y = x^3 + a*x^2 + b
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
class Binary extends Base
|
||||
{
|
||||
/**
|
||||
* Binary Field Integer factory
|
||||
*
|
||||
* @var BinaryField
|
||||
*/
|
||||
protected $factory;
|
||||
|
||||
/**
|
||||
* Cofficient for x^1
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $a;
|
||||
|
||||
/**
|
||||
* Cofficient for x^0
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $b;
|
||||
|
||||
/**
|
||||
* Base Point
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $p;
|
||||
|
||||
/**
|
||||
* The number one over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $one;
|
||||
|
||||
/**
|
||||
* The modulo
|
||||
*
|
||||
* @var array
|
||||
*/
|
||||
protected $modulo;
|
||||
|
||||
/**
|
||||
* The Order
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $order;
|
||||
|
||||
/**
|
||||
* Sets the modulo
|
||||
*/
|
||||
public function setModulo(int ...$modulo): void
|
||||
{
|
||||
$this->modulo = $modulo;
|
||||
$this->factory = new BinaryField(...$modulo);
|
||||
|
||||
$this->one = $this->factory->newInteger("\1");
|
||||
}
|
||||
|
||||
/**
|
||||
* Set coefficients a and b
|
||||
*/
|
||||
public function setCoefficients(string $a, string $b): void
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->a = $this->factory->newInteger(pack('H*', $a));
|
||||
$this->b = $this->factory->newInteger(pack('H*', $b));
|
||||
}
|
||||
|
||||
/**
|
||||
* Set x and y coordinates for the base point
|
||||
*
|
||||
* @param string|BinaryInteger $x
|
||||
* @param string|BinaryInteger $y
|
||||
*/
|
||||
public function setBasePoint($x, $y): void
|
||||
{
|
||||
switch (true) {
|
||||
case !is_string($x) && !$x instanceof BinaryInteger:
|
||||
throw new UnexpectedValueException('Argument 1 passed to Binary::setBasePoint() must be a string or an instance of BinaryField\Integer');
|
||||
case !is_string($y) && !$y instanceof BinaryInteger:
|
||||
throw new UnexpectedValueException('Argument 2 passed to Binary::setBasePoint() must be a string or an instance of BinaryField\Integer');
|
||||
}
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->p = [
|
||||
is_string($x) ? $this->factory->newInteger(pack('H*', $x)) : $x,
|
||||
is_string($y) ? $this->factory->newInteger(pack('H*', $y)) : $y,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the base point as an array
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getBasePoint()
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
/*
|
||||
if (!isset($this->p)) {
|
||||
throw new \phpseclib3\Exception\RuntimeException('setBasePoint needs to be called before this method');
|
||||
}
|
||||
*/
|
||||
return $this->p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds two points on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
public function addPoint(array $p, array $q): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
|
||||
if (!count($p) || !count($q)) {
|
||||
if (count($q)) {
|
||||
return $q;
|
||||
}
|
||||
if (count($p)) {
|
||||
return $p;
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
if (!isset($p[2]) || !isset($q[2])) {
|
||||
throw new RuntimeException('Affine coordinates need to be manually converted to "Jacobi" coordinates or vice versa');
|
||||
}
|
||||
|
||||
if ($p[0]->equals($q[0])) {
|
||||
return !$p[1]->equals($q[1]) ? [] : $this->doublePoint($p);
|
||||
}
|
||||
|
||||
// formulas from http://hyperelliptic.org/EFD/g12o/auto-shortw-jacobian.html
|
||||
|
||||
[$x1, $y1, $z1] = $p;
|
||||
[$x2, $y2, $z2] = $q;
|
||||
|
||||
$o1 = $z1->multiply($z1);
|
||||
$b = $x2->multiply($o1);
|
||||
|
||||
if ($z2->equals($this->one)) {
|
||||
$d = $y2->multiply($o1)->multiply($z1);
|
||||
$e = $x1->add($b);
|
||||
$f = $y1->add($d);
|
||||
$z3 = $e->multiply($z1);
|
||||
$h = $f->multiply($x2)->add($z3->multiply($y2));
|
||||
$i = $f->add($z3);
|
||||
$g = $z3->multiply($z3);
|
||||
$p1 = $this->a->multiply($g);
|
||||
$p2 = $f->multiply($i);
|
||||
$p3 = $e->multiply($e)->multiply($e);
|
||||
$x3 = $p1->add($p2)->add($p3);
|
||||
$y3 = $i->multiply($x3)->add($g->multiply($h));
|
||||
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
$o2 = $z2->multiply($z2);
|
||||
$a = $x1->multiply($o2);
|
||||
$c = $y1->multiply($o2)->multiply($z2);
|
||||
$d = $y2->multiply($o1)->multiply($z1);
|
||||
$e = $a->add($b);
|
||||
$f = $c->add($d);
|
||||
$g = $e->multiply($z1);
|
||||
$h = $f->multiply($x2)->add($g->multiply($y2));
|
||||
$z3 = $g->multiply($z2);
|
||||
$i = $f->add($z3);
|
||||
$p1 = $this->a->multiply($z3->multiply($z3));
|
||||
$p2 = $f->multiply($i);
|
||||
$p3 = $e->multiply($e)->multiply($e);
|
||||
$x3 = $p1->add($p2)->add($p3);
|
||||
$y3 = $i->multiply($x3)->add($g->multiply($g)->multiply($h));
|
||||
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a point on a curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
public function doublePoint(array $p): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
|
||||
if (!count($p)) {
|
||||
return [];
|
||||
}
|
||||
|
||||
if (!isset($p[2])) {
|
||||
throw new RuntimeException('Affine coordinates need to be manually converted to "Jacobi" coordinates or vice versa');
|
||||
}
|
||||
|
||||
// formulas from http://hyperelliptic.org/EFD/g12o/auto-shortw-jacobian.html
|
||||
|
||||
[$x1, $y1, $z1] = $p;
|
||||
|
||||
$a = $x1->multiply($x1);
|
||||
$b = $a->multiply($a);
|
||||
|
||||
if ($z1->equals($this->one)) {
|
||||
$x3 = $b->add($this->b);
|
||||
$z3 = clone $x1;
|
||||
$p1 = $a->add($y1)->add($z3)->multiply($this->b);
|
||||
$p2 = $a->add($y1)->multiply($b);
|
||||
$y3 = $p1->add($p2);
|
||||
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
$c = $z1->multiply($z1);
|
||||
$d = $c->multiply($c);
|
||||
$x3 = $b->add($this->b->multiply($d->multiply($d)));
|
||||
$z3 = $x1->multiply($c);
|
||||
$p1 = $b->multiply($z3);
|
||||
$p2 = $a->add($y1->multiply($z1))->add($z3)->multiply($x3);
|
||||
$y3 = $p1->add($p2);
|
||||
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the X coordinate and the derived Y coordinate
|
||||
*
|
||||
* Not supported because it is covered by patents.
|
||||
* Quoting https://www.openssl.org/docs/man1.1.0/apps/ecparam.html ,
|
||||
*
|
||||
* "Due to patent issues the compressed option is disabled by default for binary curves
|
||||
* and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at
|
||||
* compile time."
|
||||
*/
|
||||
public function derivePoint($m): array
|
||||
{
|
||||
throw new RuntimeException('Point compression on binary finite field elliptic curves is not supported');
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests whether or not the x / y values satisfy the equation
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function verifyPoint(array $p): bool
|
||||
{
|
||||
[$x, $y] = $p;
|
||||
$lhs = $y->multiply($y);
|
||||
$lhs = $lhs->add($x->multiply($y));
|
||||
$x2 = $x->multiply($x);
|
||||
$x3 = $x2->multiply($x);
|
||||
$rhs = $x3->add($this->a->multiply($x2))->add($this->b);
|
||||
|
||||
return $lhs->equals($rhs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the modulo
|
||||
*/
|
||||
public function getModulo(): array
|
||||
{
|
||||
return $this->modulo;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return Integer
|
||||
*/
|
||||
public function getA()
|
||||
{
|
||||
return $this->a;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return Integer
|
||||
*/
|
||||
public function getB()
|
||||
{
|
||||
return $this->b;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the affine point
|
||||
*
|
||||
* A Jacobian Coordinate is of the form (x, y, z).
|
||||
* To convert a Jacobian Coordinate to an Affine Point
|
||||
* you do (x / z^2, y / z^3)
|
||||
*
|
||||
* @return Integer[]
|
||||
*/
|
||||
public function convertToAffine(array $p): array
|
||||
{
|
||||
if (!isset($p[2])) {
|
||||
return $p;
|
||||
}
|
||||
[$x, $y, $z] = $p;
|
||||
$z = $this->one->divide($z);
|
||||
$z2 = $z->multiply($z);
|
||||
return [
|
||||
$x->multiply($z2),
|
||||
$y->multiply($z2)->multiply($z),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts an affine point to a jacobian coordinate
|
||||
*
|
||||
* @return Integer[]
|
||||
*/
|
||||
public function convertToInternal(array $p): array
|
||||
{
|
||||
if (isset($p[2])) {
|
||||
return $p;
|
||||
}
|
||||
|
||||
$p[2] = clone $this->one;
|
||||
$p['fresh'] = true;
|
||||
return $p;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,335 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Generalized Koblitz Curves over y^2 = x^3 + b.
|
||||
*
|
||||
* According to http://www.secg.org/SEC2-Ver-1.0.pdf Koblitz curves are over the GF(2**m)
|
||||
* finite field. Both the $a$ and $b$ coefficients are either 0 or 1. However, SEC2
|
||||
* generalizes the definition to include curves over GF(P) "which possess an efficiently
|
||||
* computable endomorphism".
|
||||
*
|
||||
* For these generalized Koblitz curves $b$ doesn't have to be 0 or 1. Whether or not $a$
|
||||
* has any restrictions on it is unclear, however, for all the GF(P) Koblitz curves defined
|
||||
* in SEC2 v1.0 $a$ is $0$ so all of the methods defined herein will assume that it is.
|
||||
*
|
||||
* I suppose we could rename the $b$ coefficient to $a$, however, the documentation refers
|
||||
* to $b$ so we'll just keep it.
|
||||
*
|
||||
* If a later version of SEC2 comes out wherein some $a$ values are non-zero we can create a
|
||||
* new method for those. eg. KoblitzA1Prime.php or something.
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2017 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\PrimeField;
|
||||
|
||||
/**
|
||||
* Curves over y^2 = x^3 + b
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
class KoblitzPrime extends Prime
|
||||
{
|
||||
/**
|
||||
* Basis
|
||||
*
|
||||
* @var list<array{a: BigInteger, b: BigInteger}>
|
||||
*/
|
||||
public $basis;
|
||||
|
||||
/**
|
||||
* Beta
|
||||
*
|
||||
* @var PrimeField\Integer
|
||||
*/
|
||||
public $beta;
|
||||
|
||||
// don't overwrite setCoefficients() with one that only accepts one parameter so that
|
||||
// one might be able to switch between KoblitzPrime and Prime more easily (for benchmarking
|
||||
// purposes).
|
||||
|
||||
/**
|
||||
* Multiply and Add Points
|
||||
*
|
||||
* Uses a efficiently computable endomorphism to achieve a slight speedup
|
||||
*
|
||||
* Adapted from:
|
||||
* https://github.com/indutny/elliptic/blob/725bd91/lib/elliptic/curve/short.js#L219
|
||||
*
|
||||
* @return int[]
|
||||
*/
|
||||
public function multiplyAddPoints(array $points, array $scalars): array
|
||||
{
|
||||
static $zero, $one, $two;
|
||||
if (!isset($two)) {
|
||||
$two = new BigInteger(2);
|
||||
$one = new BigInteger(1);
|
||||
}
|
||||
|
||||
if (!isset($this->beta)) {
|
||||
// get roots
|
||||
$inv = $this->one->divide($this->two)->negate();
|
||||
$s = $this->three->negate()->squareRoot()->multiply($inv);
|
||||
$betas = [
|
||||
$inv->add($s),
|
||||
$inv->subtract($s),
|
||||
];
|
||||
$this->beta = $betas[0]->compare($betas[1]) < 0 ? $betas[0] : $betas[1];
|
||||
//echo strtoupper($this->beta->toHex(true)) . "\n"; exit;
|
||||
}
|
||||
|
||||
if (!isset($this->basis)) {
|
||||
$factory = new PrimeField($this->order);
|
||||
$tempOne = $factory->newInteger($one);
|
||||
$tempTwo = $factory->newInteger($two);
|
||||
$tempThree = $factory->newInteger(new BigInteger(3));
|
||||
|
||||
$inv = $tempOne->divide($tempTwo)->negate();
|
||||
$s = $tempThree->negate()->squareRoot()->multiply($inv);
|
||||
|
||||
$lambdas = [
|
||||
$inv->add($s),
|
||||
$inv->subtract($s),
|
||||
];
|
||||
|
||||
$lhs = $this->multiplyPoint($this->p, $lambdas[0])[0];
|
||||
$rhs = $this->p[0]->multiply($this->beta);
|
||||
$lambda = $lhs->equals($rhs) ? $lambdas[0] : $lambdas[1];
|
||||
|
||||
$this->basis = static::extendedGCD($lambda->toBigInteger(), $this->order);
|
||||
///*
|
||||
foreach ($this->basis as $basis) {
|
||||
echo strtoupper($basis['a']->toHex(true)) . "\n";
|
||||
echo strtoupper($basis['b']->toHex(true)) . "\n\n";
|
||||
}
|
||||
exit;
|
||||
//*/
|
||||
}
|
||||
|
||||
$npoints = $nscalars = [];
|
||||
for ($i = 0; $i < count($points); $i++) {
|
||||
$p = $points[$i];
|
||||
$k = $scalars[$i]->toBigInteger();
|
||||
|
||||
// begin split
|
||||
[$v1, $v2] = $this->basis;
|
||||
|
||||
$c1 = $v2['b']->multiply($k);
|
||||
[$c1, $r] = $c1->divide($this->order);
|
||||
if ($this->order->compare($r->multiply($two)) <= 0) {
|
||||
$c1 = $c1->add($one);
|
||||
}
|
||||
|
||||
$c2 = $v1['b']->negate()->multiply($k);
|
||||
[$c2, $r] = $c2->divide($this->order);
|
||||
if ($this->order->compare($r->multiply($two)) <= 0) {
|
||||
$c2 = $c2->add($one);
|
||||
}
|
||||
|
||||
$p1 = $c1->multiply($v1['a']);
|
||||
$p2 = $c2->multiply($v2['a']);
|
||||
$q1 = $c1->multiply($v1['b']);
|
||||
$q2 = $c2->multiply($v2['b']);
|
||||
|
||||
$k1 = $k->subtract($p1)->subtract($p2);
|
||||
$k2 = $q1->add($q2)->negate();
|
||||
// end split
|
||||
|
||||
$beta = [
|
||||
$p[0]->multiply($this->beta),
|
||||
$p[1],
|
||||
clone $this->one,
|
||||
];
|
||||
|
||||
if (isset($p['naf'])) {
|
||||
$beta['naf'] = array_map(function ($p) {
|
||||
return [
|
||||
$p[0]->multiply($this->beta),
|
||||
$p[1],
|
||||
clone $this->one,
|
||||
];
|
||||
}, $p['naf']);
|
||||
$beta['nafwidth'] = $p['nafwidth'];
|
||||
}
|
||||
|
||||
if ($k1->isNegative()) {
|
||||
$k1 = $k1->negate();
|
||||
$p = $this->negatePoint($p);
|
||||
}
|
||||
|
||||
if ($k2->isNegative()) {
|
||||
$k2 = $k2->negate();
|
||||
$beta = $this->negatePoint($beta);
|
||||
}
|
||||
|
||||
$pos = 2 * $i;
|
||||
$npoints[$pos] = $p;
|
||||
$nscalars[$pos] = $this->factory->newInteger($k1);
|
||||
|
||||
$pos++;
|
||||
$npoints[$pos] = $beta;
|
||||
$nscalars[$pos] = $this->factory->newInteger($k2);
|
||||
}
|
||||
|
||||
return parent::multiplyAddPoints($npoints, $nscalars);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the numerator and denominator of the slope
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function doublePointHelper(array $p): array
|
||||
{
|
||||
$numerator = $this->three->multiply($p[0])->multiply($p[0]);
|
||||
$denominator = $this->two->multiply($p[1]);
|
||||
return [$numerator, $denominator];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a jacobian coordinate on the curve
|
||||
*
|
||||
* See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianDoublePoint(array $p): array
|
||||
{
|
||||
[$x1, $y1, $z1] = $p;
|
||||
$a = $x1->multiply($x1);
|
||||
$b = $y1->multiply($y1);
|
||||
$c = $b->multiply($b);
|
||||
$d = $x1->add($b);
|
||||
$d = $d->multiply($d)->subtract($a)->subtract($c)->multiply($this->two);
|
||||
$e = $this->three->multiply($a);
|
||||
$f = $e->multiply($e);
|
||||
$x3 = $f->subtract($this->two->multiply($d));
|
||||
$y3 = $e->multiply($d->subtract($x3))->subtract(
|
||||
$this->eight->multiply($c)
|
||||
);
|
||||
$z3 = $this->two->multiply($y1)->multiply($z1);
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a "fresh" jacobian coordinate on the curve
|
||||
*
|
||||
* See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-mdbl-2007-bl
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianDoublePointMixed(array $p): array
|
||||
{
|
||||
[$x1, $y1] = $p;
|
||||
$xx = $x1->multiply($x1);
|
||||
$yy = $y1->multiply($y1);
|
||||
$yyyy = $yy->multiply($yy);
|
||||
$s = $x1->add($yy);
|
||||
$s = $s->multiply($s)->subtract($xx)->subtract($yyyy)->multiply($this->two);
|
||||
$m = $this->three->multiply($xx);
|
||||
$t = $m->multiply($m)->subtract($this->two->multiply($s));
|
||||
$x3 = $t;
|
||||
$y3 = $s->subtract($t);
|
||||
$y3 = $m->multiply($y3)->subtract($this->eight->multiply($yyyy));
|
||||
$z3 = $this->two->multiply($y1);
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests whether or not the x / y values satisfy the equation
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function verifyPoint(array $p): bool
|
||||
{
|
||||
[$x, $y] = $p;
|
||||
$lhs = $y->multiply($y);
|
||||
$temp = $x->multiply($x)->multiply($x);
|
||||
$rhs = $temp->add($this->b);
|
||||
|
||||
return $lhs->equals($rhs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculates the parameters needed from the Euclidean algorithm as discussed at
|
||||
* http://diamond.boisestate.edu/~liljanab/MATH308/GuideToECC.pdf#page=148
|
||||
*
|
||||
* @return BigInteger[]
|
||||
*/
|
||||
protected static function extendedGCD(BigInteger $u, BigInteger $v): array
|
||||
{
|
||||
$one = new BigInteger(1);
|
||||
$zero = new BigInteger();
|
||||
|
||||
$a = clone $one;
|
||||
$b = clone $zero;
|
||||
$c = clone $zero;
|
||||
$d = clone $one;
|
||||
|
||||
$stop = $v->bitwise_rightShift($v->getLength() >> 1);
|
||||
|
||||
$a1 = clone $zero;
|
||||
$b1 = clone $zero;
|
||||
$a2 = clone $zero;
|
||||
$b2 = clone $zero;
|
||||
|
||||
$postGreatestIndex = 0;
|
||||
|
||||
while (!$v->equals($zero)) {
|
||||
[$q] = $u->divide($v);
|
||||
|
||||
$temp = $u;
|
||||
$u = $v;
|
||||
$v = $temp->subtract($v->multiply($q));
|
||||
|
||||
$temp = $a;
|
||||
$a = $c;
|
||||
$c = $temp->subtract($a->multiply($q));
|
||||
|
||||
$temp = $b;
|
||||
$b = $d;
|
||||
$d = $temp->subtract($b->multiply($q));
|
||||
|
||||
if ($v->compare($stop) > 0) {
|
||||
$a0 = $v;
|
||||
$b0 = $c;
|
||||
} else {
|
||||
$postGreatestIndex++;
|
||||
}
|
||||
|
||||
if ($postGreatestIndex == 1) {
|
||||
$a1 = $v;
|
||||
$b1 = $c->negate();
|
||||
}
|
||||
|
||||
if ($postGreatestIndex == 2) {
|
||||
$rhs = $a0->multiply($a0)->add($b0->multiply($b0));
|
||||
$lhs = $v->multiply($v)->add($b->multiply($b));
|
||||
if ($lhs->compare($rhs) <= 0) {
|
||||
$a2 = $a0;
|
||||
$b2 = $b0->negate();
|
||||
} else {
|
||||
$a2 = $v;
|
||||
$b2 = $c->negate();
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
['a' => $a1, 'b' => $b1],
|
||||
['a' => $a2, 'b' => $b2],
|
||||
];
|
||||
}
|
||||
}
|
||||
281
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Montgomery.php
Normal file
281
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Montgomery.php
Normal file
@@ -0,0 +1,281 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Curves over y^2 = x^3 + a*x + x
|
||||
*
|
||||
* Technically, a Montgomery curve has a coefficient for y^2 but for Curve25519 and Curve448 that
|
||||
* coefficient is 1.
|
||||
*
|
||||
* Curve25519 and Curve448 do not make use of the y coordinate, which makes it unsuitable for use
|
||||
* with ECDSA / EdDSA. A few other differences between Curve25519 and Ed25519 are discussed at
|
||||
* https://crypto.stackexchange.com/a/43058/4520
|
||||
*
|
||||
* More info:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Montgomery_curve
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2019 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Crypt\EC\Curves\Curve25519;
|
||||
use phpseclib3\Exception\RuntimeException;
|
||||
use phpseclib3\Exception\UnexpectedValueException;
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\PrimeField;
|
||||
use phpseclib3\Math\PrimeField\Integer as PrimeInteger;
|
||||
|
||||
/**
|
||||
* Curves over y^2 = x^3 + a*x + x
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
class Montgomery extends Base
|
||||
{
|
||||
/**
|
||||
* Prime Field Integer factory
|
||||
*
|
||||
* @var PrimeField
|
||||
*/
|
||||
protected $factory;
|
||||
|
||||
/**
|
||||
* Cofficient for x
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $a;
|
||||
|
||||
/**
|
||||
* Constant used for point doubling
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $a24;
|
||||
|
||||
/**
|
||||
* The Number Zero
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $zero;
|
||||
|
||||
/**
|
||||
* The Number One
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $one;
|
||||
|
||||
/**
|
||||
* Base Point
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $p;
|
||||
|
||||
/**
|
||||
* The modulo
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $modulo;
|
||||
|
||||
/**
|
||||
* The Order
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $order;
|
||||
|
||||
/**
|
||||
* Sets the modulo
|
||||
*/
|
||||
public function setModulo(BigInteger $modulo): void
|
||||
{
|
||||
$this->modulo = $modulo;
|
||||
$this->factory = new PrimeField($modulo);
|
||||
$this->zero = $this->factory->newInteger(new BigInteger());
|
||||
$this->one = $this->factory->newInteger(new BigInteger(1));
|
||||
}
|
||||
|
||||
/**
|
||||
* Set coefficients a
|
||||
*/
|
||||
public function setCoefficients(BigInteger $a): void
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->a = $this->factory->newInteger($a);
|
||||
$two = $this->factory->newInteger(new BigInteger(2));
|
||||
$four = $this->factory->newInteger(new BigInteger(4));
|
||||
$this->a24 = $this->a->subtract($two)->divide($four);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set x and y coordinates for the base point
|
||||
*
|
||||
* @param BigInteger|PrimeInteger $x
|
||||
* @param BigInteger|PrimeInteger $y
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function setBasePoint($x, $y): array
|
||||
{
|
||||
switch (true) {
|
||||
case !$x instanceof BigInteger && !$x instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 1 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
case !$y instanceof BigInteger && !$y instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 2 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
}
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->p = [
|
||||
$x instanceof BigInteger ? $this->factory->newInteger($x) : $x,
|
||||
$y instanceof BigInteger ? $this->factory->newInteger($y) : $y,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the base point as an array
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getBasePoint()
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
/*
|
||||
if (!isset($this->p)) {
|
||||
throw new \phpseclib3\Exception\RuntimeException('setBasePoint needs to be called before this method');
|
||||
}
|
||||
*/
|
||||
return $this->p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles and adds a point on a curve
|
||||
*
|
||||
* See https://tools.ietf.org/html/draft-ietf-tls-curve25519-01#appendix-A.1.3
|
||||
*
|
||||
* @return FiniteField[][]
|
||||
*/
|
||||
private function doubleAndAddPoint(array $p, array $q, PrimeInteger $x1): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
|
||||
if (!count($p) || !count($q)) {
|
||||
return [];
|
||||
}
|
||||
|
||||
if (!isset($p[1])) {
|
||||
throw new RuntimeException('Affine coordinates need to be manually converted to XZ coordinates');
|
||||
}
|
||||
|
||||
[$x2, $z2] = $p;
|
||||
[$x3, $z3] = $q;
|
||||
|
||||
$a = $x2->add($z2);
|
||||
$aa = $a->multiply($a);
|
||||
$b = $x2->subtract($z2);
|
||||
$bb = $b->multiply($b);
|
||||
$e = $aa->subtract($bb);
|
||||
$c = $x3->add($z3);
|
||||
$d = $x3->subtract($z3);
|
||||
$da = $d->multiply($a);
|
||||
$cb = $c->multiply($b);
|
||||
$temp = $da->add($cb);
|
||||
$x5 = $temp->multiply($temp);
|
||||
$temp = $da->subtract($cb);
|
||||
$z5 = $x1->multiply($temp->multiply($temp));
|
||||
$x4 = $aa->multiply($bb);
|
||||
$temp = static::class == Curve25519::class ? $bb : $aa;
|
||||
$z4 = $e->multiply($temp->add($this->a24->multiply($e)));
|
||||
|
||||
return [
|
||||
[$x4, $z4],
|
||||
[$x5, $z5],
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Multiply a point on the curve by a scalar
|
||||
*
|
||||
* Uses the montgomery ladder technique as described here:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Montgomery_ladder
|
||||
* https://github.com/phpecc/phpecc/issues/16#issuecomment-59176772
|
||||
*/
|
||||
public function multiplyPoint(array $p, BigInteger $d): array
|
||||
{
|
||||
$p1 = [$this->one, $this->zero];
|
||||
$alreadyInternal = isset($x[1]);
|
||||
$p2 = $this->convertToInternal($p);
|
||||
$x = $p[0];
|
||||
|
||||
$b = $d->toBits();
|
||||
$b = str_pad($b, 256, '0', STR_PAD_LEFT);
|
||||
for ($i = 0; $i < strlen($b); $i++) {
|
||||
$b_i = (int) $b[$i];
|
||||
if ($b_i) {
|
||||
[$p2, $p1] = $this->doubleAndAddPoint($p2, $p1, $x);
|
||||
} else {
|
||||
[$p1, $p2] = $this->doubleAndAddPoint($p1, $p2, $x);
|
||||
}
|
||||
}
|
||||
|
||||
return $alreadyInternal ? $p1 : $this->convertToAffine($p1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts an affine point to an XZ coordinate
|
||||
*
|
||||
* From https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html
|
||||
*
|
||||
* XZ coordinates represent x y as X Z satsfying the following equations:
|
||||
*
|
||||
* x=X/Z
|
||||
*
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function convertToInternal(array $p): array
|
||||
{
|
||||
if (empty($p)) {
|
||||
return [clone $this->zero, clone $this->one];
|
||||
}
|
||||
|
||||
if (isset($p[1])) {
|
||||
return $p;
|
||||
}
|
||||
|
||||
$p[1] = clone $this->one;
|
||||
|
||||
return $p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the affine point
|
||||
*
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function convertToAffine(array $p): array
|
||||
{
|
||||
if (!isset($p[1])) {
|
||||
return $p;
|
||||
}
|
||||
[$x, $z] = $p;
|
||||
return [$x->divide($z)];
|
||||
}
|
||||
}
|
||||
785
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Prime.php
Normal file
785
qa-tool/htdocs/oidc/phpseclib/Crypt/EC/BaseCurves/Prime.php
Normal file
@@ -0,0 +1,785 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Curves over y^2 = x^3 + a*x + b
|
||||
*
|
||||
* These are curves used in SEC 2 over prime fields: http://www.secg.org/SEC2-Ver-1.0.pdf
|
||||
* The curve is a weierstrass curve with a[1], a[3] and a[2] set to 0.
|
||||
*
|
||||
* Uses Jacobian Coordinates for speed if able:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Jacobian_curve
|
||||
* https://en.wikibooks.org/wiki/Cryptography/Prime_Curve/Jacobian_Coordinates
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2017 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Common\Functions\Strings;
|
||||
use phpseclib3\Exception\RuntimeException;
|
||||
use phpseclib3\Exception\UnexpectedValueException;
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\Common\FiniteField\Integer;
|
||||
use phpseclib3\Math\PrimeField;
|
||||
use phpseclib3\Math\PrimeField\Integer as PrimeInteger;
|
||||
use phpseclib3\Math\PrimeFields;
|
||||
|
||||
/**
|
||||
* Curves over y^2 = x^3 + a*x + b
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
class Prime extends Base
|
||||
{
|
||||
/**
|
||||
* Prime Field Integer factory
|
||||
*
|
||||
* @var PrimeFields
|
||||
*/
|
||||
protected $factory;
|
||||
|
||||
/**
|
||||
* Cofficient for x^1
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $a;
|
||||
|
||||
/**
|
||||
* Cofficient for x^0
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $b;
|
||||
|
||||
/**
|
||||
* Base Point
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $p;
|
||||
|
||||
/**
|
||||
* The number one over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $one;
|
||||
|
||||
/**
|
||||
* The number two over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $two;
|
||||
|
||||
/**
|
||||
* The number three over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $three;
|
||||
|
||||
/**
|
||||
* The number four over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $four;
|
||||
|
||||
/**
|
||||
* The number eight over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $eight;
|
||||
|
||||
/**
|
||||
* The modulo
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $modulo;
|
||||
|
||||
/**
|
||||
* The Order
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $order;
|
||||
|
||||
/**
|
||||
* Sets the modulo
|
||||
*/
|
||||
public function setModulo(BigInteger $modulo): void
|
||||
{
|
||||
$this->modulo = $modulo;
|
||||
$this->factory = new PrimeField($modulo);
|
||||
$this->two = $this->factory->newInteger(new BigInteger(2));
|
||||
$this->three = $this->factory->newInteger(new BigInteger(3));
|
||||
// used by jacobian coordinates
|
||||
$this->one = $this->factory->newInteger(new BigInteger(1));
|
||||
$this->four = $this->factory->newInteger(new BigInteger(4));
|
||||
$this->eight = $this->factory->newInteger(new BigInteger(8));
|
||||
}
|
||||
|
||||
/**
|
||||
* Set coefficients a and b
|
||||
*/
|
||||
public function setCoefficients(BigInteger $a, BigInteger $b): void
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->a = $this->factory->newInteger($a);
|
||||
$this->b = $this->factory->newInteger($b);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set x and y coordinates for the base point
|
||||
*
|
||||
* @param BigInteger|PrimeInteger $x
|
||||
* @param BigInteger|PrimeInteger $y
|
||||
*/
|
||||
public function setBasePoint($x, $y): void
|
||||
{
|
||||
switch (true) {
|
||||
case !$x instanceof BigInteger && !$x instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 1 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
case !$y instanceof BigInteger && !$y instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 2 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
}
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->p = [
|
||||
$x instanceof BigInteger ? $this->factory->newInteger($x) : $x,
|
||||
$y instanceof BigInteger ? $this->factory->newInteger($y) : $y,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the base point as an array
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function getBasePoint()
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
/*
|
||||
if (!isset($this->p)) {
|
||||
throw new \phpseclib3\Exception\RuntimeException('setBasePoint needs to be called before this method');
|
||||
}
|
||||
*/
|
||||
return $this->p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds two "fresh" jacobian form on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianAddPointMixedXY(array $p, array $q): array
|
||||
{
|
||||
[$u1, $s1] = $p;
|
||||
[$u2, $s2] = $q;
|
||||
if ($u1->equals($u2)) {
|
||||
if (!$s1->equals($s2)) {
|
||||
return [];
|
||||
} else {
|
||||
return $this->doublePoint($p);
|
||||
}
|
||||
}
|
||||
$h = $u2->subtract($u1);
|
||||
$r = $s2->subtract($s1);
|
||||
$h2 = $h->multiply($h);
|
||||
$h3 = $h2->multiply($h);
|
||||
$v = $u1->multiply($h2);
|
||||
$x3 = $r->multiply($r)->subtract($h3)->subtract($v->multiply($this->two));
|
||||
$y3 = $r->multiply(
|
||||
$v->subtract($x3)
|
||||
)->subtract(
|
||||
$s1->multiply($h3)
|
||||
);
|
||||
return [$x3, $y3, $h];
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds one "fresh" jacobian form on the curve
|
||||
*
|
||||
* The second parameter should be the "fresh" one
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianAddPointMixedX(array $p, array $q): array
|
||||
{
|
||||
[$u1, $s1, $z1] = $p;
|
||||
[$x2, $y2] = $q;
|
||||
|
||||
$z12 = $z1->multiply($z1);
|
||||
|
||||
$u2 = $x2->multiply($z12);
|
||||
$s2 = $y2->multiply($z12->multiply($z1));
|
||||
if ($u1->equals($u2)) {
|
||||
if (!$s1->equals($s2)) {
|
||||
return [];
|
||||
} else {
|
||||
return $this->doublePoint($p);
|
||||
}
|
||||
}
|
||||
$h = $u2->subtract($u1);
|
||||
$r = $s2->subtract($s1);
|
||||
$h2 = $h->multiply($h);
|
||||
$h3 = $h2->multiply($h);
|
||||
$v = $u1->multiply($h2);
|
||||
$x3 = $r->multiply($r)->subtract($h3)->subtract($v->multiply($this->two));
|
||||
$y3 = $r->multiply(
|
||||
$v->subtract($x3)
|
||||
)->subtract(
|
||||
$s1->multiply($h3)
|
||||
);
|
||||
$z3 = $h->multiply($z1);
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds two jacobian coordinates on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianAddPoint(array $p, array $q): array
|
||||
{
|
||||
[$x1, $y1, $z1] = $p;
|
||||
[$x2, $y2, $z2] = $q;
|
||||
|
||||
$z12 = $z1->multiply($z1);
|
||||
$z22 = $z2->multiply($z2);
|
||||
|
||||
$u1 = $x1->multiply($z22);
|
||||
$u2 = $x2->multiply($z12);
|
||||
$s1 = $y1->multiply($z22->multiply($z2));
|
||||
$s2 = $y2->multiply($z12->multiply($z1));
|
||||
if ($u1->equals($u2)) {
|
||||
if (!$s1->equals($s2)) {
|
||||
return [];
|
||||
} else {
|
||||
return $this->doublePoint($p);
|
||||
}
|
||||
}
|
||||
$h = $u2->subtract($u1);
|
||||
$r = $s2->subtract($s1);
|
||||
$h2 = $h->multiply($h);
|
||||
$h3 = $h2->multiply($h);
|
||||
$v = $u1->multiply($h2);
|
||||
$x3 = $r->multiply($r)->subtract($h3)->subtract($v->multiply($this->two));
|
||||
$y3 = $r->multiply(
|
||||
$v->subtract($x3)
|
||||
)->subtract(
|
||||
$s1->multiply($h3)
|
||||
);
|
||||
$z3 = $h->multiply($z1)->multiply($z2);
|
||||
return [$x3, $y3, $z3];
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds two points on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
public function addPoint(array $p, array $q): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
|
||||
if (!count($p) || !count($q)) {
|
||||
if (count($q)) {
|
||||
return $q;
|
||||
}
|
||||
if (count($p)) {
|
||||
return $p;
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
// use jacobian coordinates
|
||||
if (isset($p[2]) && isset($q[2])) {
|
||||
if (isset($p['fresh']) && isset($q['fresh'])) {
|
||||
return $this->jacobianAddPointMixedXY($p, $q);
|
||||
}
|
||||
if (isset($p['fresh'])) {
|
||||
return $this->jacobianAddPointMixedX($q, $p);
|
||||
}
|
||||
if (isset($q['fresh'])) {
|
||||
return $this->jacobianAddPointMixedX($p, $q);
|
||||
}
|
||||
return $this->jacobianAddPoint($p, $q);
|
||||
}
|
||||
|
||||
if (isset($p[2]) || isset($q[2])) {
|
||||
throw new RuntimeException('Affine coordinates need to be manually converted to Jacobi coordinates or vice versa');
|
||||
}
|
||||
|
||||
if ($p[0]->equals($q[0])) {
|
||||
if (!$p[1]->equals($q[1])) {
|
||||
return [];
|
||||
} else { // eg. doublePoint
|
||||
[$numerator, $denominator] = $this->doublePointHelper($p);
|
||||
}
|
||||
} else {
|
||||
$numerator = $q[1]->subtract($p[1]);
|
||||
$denominator = $q[0]->subtract($p[0]);
|
||||
}
|
||||
$slope = $numerator->divide($denominator);
|
||||
$x = $slope->multiply($slope)->subtract($p[0])->subtract($q[0]);
|
||||
$y = $slope->multiply($p[0]->subtract($x))->subtract($p[1]);
|
||||
|
||||
return [$x, $y];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the numerator and denominator of the slope
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function doublePointHelper(array $p): array
|
||||
{
|
||||
$numerator = $this->three->multiply($p[0])->multiply($p[0])->add($this->a);
|
||||
$denominator = $this->two->multiply($p[1]);
|
||||
return [$numerator, $denominator];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a jacobian coordinate on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianDoublePoint(array $p): array
|
||||
{
|
||||
[$x, $y, $z] = $p;
|
||||
$x2 = $x->multiply($x);
|
||||
$y2 = $y->multiply($y);
|
||||
$z2 = $z->multiply($z);
|
||||
$s = $this->four->multiply($x)->multiply($y2);
|
||||
$m1 = $this->three->multiply($x2);
|
||||
$m2 = $this->a->multiply($z2->multiply($z2));
|
||||
$m = $m1->add($m2);
|
||||
$x1 = $m->multiply($m)->subtract($this->two->multiply($s));
|
||||
$y1 = $m->multiply($s->subtract($x1))->subtract(
|
||||
$this->eight->multiply($y2->multiply($y2))
|
||||
);
|
||||
$z1 = $this->two->multiply($y)->multiply($z);
|
||||
return [$x1, $y1, $z1];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a "fresh" jacobian coordinate on the curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
protected function jacobianDoublePointMixed(array $p): array
|
||||
{
|
||||
[$x, $y] = $p;
|
||||
$x2 = $x->multiply($x);
|
||||
$y2 = $y->multiply($y);
|
||||
$s = $this->four->multiply($x)->multiply($y2);
|
||||
$m1 = $this->three->multiply($x2);
|
||||
$m = $m1->add($this->a);
|
||||
$x1 = $m->multiply($m)->subtract($this->two->multiply($s));
|
||||
$y1 = $m->multiply($s->subtract($x1))->subtract(
|
||||
$this->eight->multiply($y2->multiply($y2))
|
||||
);
|
||||
$z1 = $this->two->multiply($y);
|
||||
return [$x1, $y1, $z1];
|
||||
}
|
||||
|
||||
/**
|
||||
* Doubles a point on a curve
|
||||
*
|
||||
* @return FiniteField[]
|
||||
*/
|
||||
public function doublePoint(array $p): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
|
||||
if (!count($p)) {
|
||||
return [];
|
||||
}
|
||||
|
||||
// use jacobian coordinates
|
||||
if (isset($p[2])) {
|
||||
if (isset($p['fresh'])) {
|
||||
return $this->jacobianDoublePointMixed($p);
|
||||
}
|
||||
return $this->jacobianDoublePoint($p);
|
||||
}
|
||||
|
||||
[$numerator, $denominator] = $this->doublePointHelper($p);
|
||||
|
||||
$slope = $numerator->divide($denominator);
|
||||
|
||||
$x = $slope->multiply($slope)->subtract($p[0])->subtract($p[0]);
|
||||
$y = $slope->multiply($p[0]->subtract($x))->subtract($p[1]);
|
||||
|
||||
return [$x, $y];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the X coordinate and the derived Y coordinate
|
||||
*/
|
||||
public function derivePoint($m): array
|
||||
{
|
||||
$y = ord(Strings::shift($m));
|
||||
$x = new BigInteger($m, 256);
|
||||
$xp = $this->convertInteger($x);
|
||||
switch ($y) {
|
||||
case 2:
|
||||
$ypn = false;
|
||||
break;
|
||||
case 3:
|
||||
$ypn = true;
|
||||
break;
|
||||
default:
|
||||
throw new RuntimeException('Coordinate not in recognized format');
|
||||
}
|
||||
$temp = $xp->multiply($this->a);
|
||||
$temp = $xp->multiply($xp)->multiply($xp)->add($temp);
|
||||
$temp = $temp->add($this->b);
|
||||
$b = $temp->squareRoot();
|
||||
if (!$b) {
|
||||
throw new RuntimeException('Unable to derive Y coordinate');
|
||||
}
|
||||
$bn = $b->isOdd();
|
||||
$yp = $ypn == $bn ? $b : $b->negate();
|
||||
return [$xp, $yp];
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests whether or not the x / y values satisfy the equation
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function verifyPoint(array $p): bool
|
||||
{
|
||||
[$x, $y] = $p;
|
||||
$lhs = $y->multiply($y);
|
||||
$temp = $x->multiply($this->a);
|
||||
$temp = $x->multiply($x)->multiply($x)->add($temp);
|
||||
$rhs = $temp->add($this->b);
|
||||
|
||||
return $lhs->equals($rhs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the modulo
|
||||
*/
|
||||
public function getModulo(): BigInteger
|
||||
{
|
||||
return $this->modulo;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return PrimeInteger
|
||||
*/
|
||||
public function getA()
|
||||
{
|
||||
return $this->a;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return PrimeInteger
|
||||
*/
|
||||
public function getB()
|
||||
{
|
||||
return $this->b;
|
||||
}
|
||||
|
||||
/**
|
||||
* Multiply and Add Points
|
||||
*
|
||||
* Adapted from:
|
||||
* https://github.com/indutny/elliptic/blob/725bd91/lib/elliptic/curve/base.js#L125
|
||||
*
|
||||
* @return int[]
|
||||
*/
|
||||
public function multiplyAddPoints(array $points, array $scalars): array
|
||||
{
|
||||
$length = count($points);
|
||||
|
||||
foreach ($points as &$point) {
|
||||
$point = $this->convertToInternal($point);
|
||||
}
|
||||
|
||||
$wnd = [$this->getNAFPoints($points[0], 7)];
|
||||
$wndWidth = [$points[0]['nafwidth'] ?? 7];
|
||||
for ($i = 1; $i < $length; $i++) {
|
||||
$wnd[] = $this->getNAFPoints($points[$i], 1);
|
||||
$wndWidth[] = $points[$i]['nafwidth'] ?? 1;
|
||||
}
|
||||
|
||||
$naf = [];
|
||||
|
||||
// comb all window NAFs
|
||||
|
||||
$max = 0;
|
||||
for ($i = $length - 1; $i >= 1; $i -= 2) {
|
||||
$a = $i - 1;
|
||||
$b = $i;
|
||||
if ($wndWidth[$a] != 1 || $wndWidth[$b] != 1) {
|
||||
$naf[$a] = $scalars[$a]->getNAF($wndWidth[$a]);
|
||||
$naf[$b] = $scalars[$b]->getNAF($wndWidth[$b]);
|
||||
$max = max(count($naf[$a]), count($naf[$b]), $max);
|
||||
continue;
|
||||
}
|
||||
|
||||
$comb = [
|
||||
$points[$a], // 1
|
||||
null, // 3
|
||||
null, // 5
|
||||
$points[$b], // 7
|
||||
];
|
||||
|
||||
$comb[1] = $this->addPoint($points[$a], $points[$b]);
|
||||
$comb[2] = $this->addPoint($points[$a], $this->negatePoint($points[$b]));
|
||||
|
||||
$index = [
|
||||
-3, /* -1 -1 */
|
||||
-1, /* -1 0 */
|
||||
-5, /* -1 1 */
|
||||
-7, /* 0 -1 */
|
||||
0, /* 0 -1 */
|
||||
7, /* 0 1 */
|
||||
5, /* 1 -1 */
|
||||
1, /* 1 0 */
|
||||
3, /* 1 1 */
|
||||
];
|
||||
|
||||
$jsf = self::getJSFPoints($scalars[$a], $scalars[$b]);
|
||||
|
||||
$max = max(count($jsf[0]), $max);
|
||||
if ($max > 0) {
|
||||
$naf[$a] = array_fill(0, $max, 0);
|
||||
$naf[$b] = array_fill(0, $max, 0);
|
||||
} else {
|
||||
$naf[$a] = [];
|
||||
$naf[$b] = [];
|
||||
}
|
||||
|
||||
for ($j = 0; $j < $max; $j++) {
|
||||
$ja = $jsf[0][$j] ?? 0;
|
||||
$jb = $jsf[1][$j] ?? 0;
|
||||
|
||||
$naf[$a][$j] = $index[3 * ($ja + 1) + $jb + 1];
|
||||
$naf[$b][$j] = 0;
|
||||
$wnd[$a] = $comb;
|
||||
}
|
||||
}
|
||||
|
||||
$acc = [];
|
||||
$temp = [0, 0, 0, 0];
|
||||
for ($i = $max; $i >= 0; $i--) {
|
||||
$k = 0;
|
||||
while ($i >= 0) {
|
||||
$zero = true;
|
||||
for ($j = 0; $j < $length; $j++) {
|
||||
$temp[$j] = $naf[$j][$i] ?? 0;
|
||||
if ($temp[$j] != 0) {
|
||||
$zero = false;
|
||||
}
|
||||
}
|
||||
if (!$zero) {
|
||||
break;
|
||||
}
|
||||
$k++;
|
||||
$i--;
|
||||
}
|
||||
|
||||
if ($i >= 0) {
|
||||
$k++;
|
||||
}
|
||||
while ($k--) {
|
||||
$acc = $this->doublePoint($acc);
|
||||
}
|
||||
|
||||
if ($i < 0) {
|
||||
break;
|
||||
}
|
||||
|
||||
for ($j = 0; $j < $length; $j++) {
|
||||
$z = $temp[$j];
|
||||
$p = null;
|
||||
if ($z == 0) {
|
||||
continue;
|
||||
}
|
||||
$p = $z > 0 ?
|
||||
$wnd[$j][($z - 1) >> 1] :
|
||||
$this->negatePoint($wnd[$j][(-$z - 1) >> 1]);
|
||||
$acc = $this->addPoint($acc, $p);
|
||||
}
|
||||
}
|
||||
|
||||
return $this->convertToAffine($acc);
|
||||
}
|
||||
|
||||
/**
|
||||
* Precomputes NAF points
|
||||
*
|
||||
* Adapted from:
|
||||
* https://github.com/indutny/elliptic/blob/725bd91/lib/elliptic/curve/base.js#L351
|
||||
*
|
||||
* @return list<array>
|
||||
*/
|
||||
private function getNAFPoints(array $point, int $wnd): array
|
||||
{
|
||||
if (isset($point['naf'])) {
|
||||
return $point['naf'];
|
||||
}
|
||||
|
||||
$res = [$point];
|
||||
$max = (1 << $wnd) - 1;
|
||||
$dbl = $max == 1 ? null : $this->doublePoint($point);
|
||||
for ($i = 1; $i < $max; $i++) {
|
||||
$res[] = $this->addPoint($res[$i - 1], $dbl);
|
||||
}
|
||||
|
||||
$point['naf'] = $res;
|
||||
|
||||
/*
|
||||
$str = '';
|
||||
foreach ($res as $re) {
|
||||
$re[0] = bin2hex($re[0]->toBytes());
|
||||
$re[1] = bin2hex($re[1]->toBytes());
|
||||
$str.= " ['$re[0]', '$re[1]'],\r\n";
|
||||
}
|
||||
file_put_contents('temp.txt', $str);
|
||||
exit;
|
||||
*/
|
||||
|
||||
return $res;
|
||||
}
|
||||
|
||||
/**
|
||||
* Precomputes points in Joint Sparse Form
|
||||
*
|
||||
* Adapted from:
|
||||
* https://github.com/indutny/elliptic/blob/725bd91/lib/elliptic/utils.js#L96
|
||||
*
|
||||
* @return int[]
|
||||
*/
|
||||
private static function getJSFPoints(Integer $k1, Integer $k2): array
|
||||
{
|
||||
static $three;
|
||||
if (!isset($three)) {
|
||||
$three = new BigInteger(3);
|
||||
}
|
||||
|
||||
$jsf = [[], []];
|
||||
$k1 = $k1->toBigInteger();
|
||||
$k2 = $k2->toBigInteger();
|
||||
$d1 = 0;
|
||||
$d2 = 0;
|
||||
|
||||
while ($k1->compare(new BigInteger(-$d1)) > 0 || $k2->compare(new BigInteger(-$d2)) > 0) {
|
||||
// first phase
|
||||
$m14 = $k1->testBit(0) + 2 * $k1->testBit(1);
|
||||
$m14 += $d1;
|
||||
$m14 &= 3;
|
||||
|
||||
$m24 = $k2->testBit(0) + 2 * $k2->testBit(1);
|
||||
$m24 += $d2;
|
||||
$m24 &= 3;
|
||||
|
||||
if ($m14 == 3) {
|
||||
$m14 = -1;
|
||||
}
|
||||
if ($m24 == 3) {
|
||||
$m24 = -1;
|
||||
}
|
||||
|
||||
$u1 = 0;
|
||||
if ($m14 & 1) { // if $m14 is odd
|
||||
$m8 = $k1->testBit(0) + 2 * $k1->testBit(1) + 4 * $k1->testBit(2);
|
||||
$m8 += $d1;
|
||||
$m8 &= 7;
|
||||
$u1 = ($m8 == 3 || $m8 == 5) && $m24 == 2 ? -$m14 : $m14;
|
||||
}
|
||||
$jsf[0][] = $u1;
|
||||
|
||||
$u2 = 0;
|
||||
if ($m24 & 1) { // if $m24 is odd
|
||||
$m8 = $k2->testBit(0) + 2 * $k2->testBit(1) + 4 * $k2->testBit(2);
|
||||
$m8 += $d2;
|
||||
$m8 &= 7;
|
||||
$u2 = ($m8 == 3 || $m8 == 5) && $m14 == 2 ? -$m24 : $m24;
|
||||
}
|
||||
$jsf[1][] = $u2;
|
||||
|
||||
// second phase
|
||||
if (2 * $d1 == $u1 + 1) {
|
||||
$d1 = 1 - $d1;
|
||||
}
|
||||
if (2 * $d2 == $u2 + 1) {
|
||||
$d2 = 1 - $d2;
|
||||
}
|
||||
$k1 = $k1->bitwise_rightShift(1);
|
||||
$k2 = $k2->bitwise_rightShift(1);
|
||||
}
|
||||
|
||||
return $jsf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the affine point
|
||||
*
|
||||
* A Jacobian Coordinate is of the form (x, y, z).
|
||||
* To convert a Jacobian Coordinate to an Affine Point
|
||||
* you do (x / z^2, y / z^3)
|
||||
*
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function convertToAffine(array $p): array
|
||||
{
|
||||
if (!isset($p[2])) {
|
||||
return $p;
|
||||
}
|
||||
[$x, $y, $z] = $p;
|
||||
$z = $this->one->divide($z);
|
||||
$z2 = $z->multiply($z);
|
||||
return [
|
||||
$x->multiply($z2),
|
||||
$y->multiply($z2)->multiply($z),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts an affine point to a jacobian coordinate
|
||||
*
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function convertToInternal(array $p): array
|
||||
{
|
||||
if (isset($p[2])) {
|
||||
return $p;
|
||||
}
|
||||
|
||||
$p[2] = clone $this->one;
|
||||
$p['fresh'] = true;
|
||||
return $p;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,215 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Curves over a*x^2 + y^2 = 1 + d*x^2*y^2
|
||||
*
|
||||
* http://www.secg.org/SEC2-Ver-1.0.pdf provides for curves with custom parameters.
|
||||
* ie. the coefficients can be arbitrary set through specially formatted keys, etc.
|
||||
* As such, Prime.php is built very generically and it's not able to take full
|
||||
* advantage of curves with 0 coefficients to produce simplified point doubling,
|
||||
* point addition. Twisted Edwards curves, in contrast, do not have a way, currently,
|
||||
* to customize them. As such, we can omit the super generic stuff from this class
|
||||
* and let the named curves (Ed25519 and Ed448) define their own custom tailored
|
||||
* point addition and point doubling methods.
|
||||
*
|
||||
* More info:
|
||||
*
|
||||
* https://en.wikipedia.org/wiki/Twisted_Edwards_curve
|
||||
*
|
||||
* PHP version 5 and 7
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
* @copyright 2017 Jim Wigginton
|
||||
* @license http://www.opensource.org/licenses/mit-license.html MIT License
|
||||
* @link http://pear.php.net/package/Math_BigInteger
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace phpseclib3\Crypt\EC\BaseCurves;
|
||||
|
||||
use phpseclib3\Exception\RuntimeException;
|
||||
use phpseclib3\Exception\UnexpectedValueException;
|
||||
use phpseclib3\Math\BigInteger;
|
||||
use phpseclib3\Math\PrimeField;
|
||||
use phpseclib3\Math\PrimeField\Integer as PrimeInteger;
|
||||
|
||||
/**
|
||||
* Curves over a*x^2 + y^2 = 1 + d*x^2*y^2
|
||||
*
|
||||
* @author Jim Wigginton <terrafrost@php.net>
|
||||
*/
|
||||
class TwistedEdwards extends Base
|
||||
{
|
||||
/**
|
||||
* The modulo
|
||||
*
|
||||
* @var BigInteger
|
||||
*/
|
||||
protected $modulo;
|
||||
|
||||
/**
|
||||
* Cofficient for x^2
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $a;
|
||||
|
||||
/**
|
||||
* Cofficient for x^2*y^2
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $d;
|
||||
|
||||
/**
|
||||
* Base Point
|
||||
*
|
||||
* @var object[]
|
||||
*/
|
||||
protected $p;
|
||||
|
||||
/**
|
||||
* The number zero over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $zero;
|
||||
|
||||
/**
|
||||
* The number one over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $one;
|
||||
|
||||
/**
|
||||
* The number two over the specified finite field
|
||||
*
|
||||
* @var object
|
||||
*/
|
||||
protected $two;
|
||||
|
||||
/**
|
||||
* Sets the modulo
|
||||
*/
|
||||
public function setModulo(BigInteger $modulo): void
|
||||
{
|
||||
$this->modulo = $modulo;
|
||||
$this->factory = new PrimeField($modulo);
|
||||
$this->zero = $this->factory->newInteger(new BigInteger(0));
|
||||
$this->one = $this->factory->newInteger(new BigInteger(1));
|
||||
$this->two = $this->factory->newInteger(new BigInteger(2));
|
||||
}
|
||||
|
||||
/**
|
||||
* Set coefficients a and b
|
||||
*/
|
||||
public function setCoefficients(BigInteger $a, BigInteger $d): void
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->a = $this->factory->newInteger($a);
|
||||
$this->d = $this->factory->newInteger($d);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set x and y coordinates for the base point
|
||||
*/
|
||||
public function setBasePoint($x, $y): void
|
||||
{
|
||||
switch (true) {
|
||||
case !$x instanceof BigInteger && !$x instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 1 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
case !$y instanceof BigInteger && !$y instanceof PrimeInteger:
|
||||
throw new UnexpectedValueException('Argument 2 passed to Prime::setBasePoint() must be an instance of either BigInteger or PrimeField\Integer');
|
||||
}
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
$this->p = [
|
||||
$x instanceof BigInteger ? $this->factory->newInteger($x) : $x,
|
||||
$y instanceof BigInteger ? $this->factory->newInteger($y) : $y,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return PrimeInteger
|
||||
*/
|
||||
public function getA()
|
||||
{
|
||||
return $this->a;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the a coefficient
|
||||
*
|
||||
* @return PrimeInteger
|
||||
*/
|
||||
public function getD()
|
||||
{
|
||||
return $this->d;
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve the base point as an array
|
||||
*/
|
||||
public function getBasePoint(): array
|
||||
{
|
||||
if (!isset($this->factory)) {
|
||||
throw new RuntimeException('setModulo needs to be called before this method');
|
||||
}
|
||||
/*
|
||||
if (!isset($this->p)) {
|
||||
throw new \phpseclib3\Exception\RuntimeException('setBasePoint needs to be called before this method');
|
||||
}
|
||||
*/
|
||||
return $this->p;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the affine point
|
||||
*
|
||||
* @return PrimeInteger[]
|
||||
*/
|
||||
public function convertToAffine(array $p): array
|
||||
{
|
||||
if (!isset($p[2])) {
|
||||
return $p;
|
||||
}
|
||||
[$x, $y, $z] = $p;
|
||||
$z = $this->one->divide($z);
|
||||
return [
|
||||
$x->multiply($z),
|
||||
$y->multiply($z),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the modulo
|
||||
*/
|
||||
public function getModulo(): BigInteger
|
||||
{
|
||||
return $this->modulo;
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests whether or not the x / y values satisfy the equation
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function verifyPoint(array $p): bool
|
||||
{
|
||||
[$x, $y] = $p;
|
||||
$x2 = $x->multiply($x);
|
||||
$y2 = $y->multiply($y);
|
||||
|
||||
$lhs = $this->a->multiply($x2)->add($y2);
|
||||
$rhs = $this->d->multiply($x2)->multiply($y2)->add($this->one);
|
||||
|
||||
return $lhs->equals($rhs);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user