From 13190931b9ce7a7abdd7af57380124aaefbcc8be Mon Sep 17 00:00:00 2001 From: str4d Date: Sat, 10 Aug 2019 15:39:41 +0000 Subject: [PATCH] EdDSA: Reduce diff between vendored code and upstream Includes missing license information. --- LICENSE.txt | 3 + .../src/net/i2p/crypto/eddsa/EdDSAEngine.java | 13 +- .../src/net/i2p/crypto/eddsa/EdDSAKey.java | 16 +- .../net/i2p/crypto/eddsa/EdDSAPrivateKey.java | 133 +++---- .../net/i2p/crypto/eddsa/EdDSAPublicKey.java | 107 +++--- .../src/net/i2p/crypto/eddsa/KeyFactory.java | 11 + .../i2p/crypto/eddsa/KeyPairGenerator.java | 13 +- core/java/src/net/i2p/crypto/eddsa/Utils.java | 14 + .../net/i2p/crypto/eddsa/math/Constants.java | 11 + .../src/net/i2p/crypto/eddsa/math/Curve.java | 13 +- .../net/i2p/crypto/eddsa/math/Encoding.java | 31 +- .../src/net/i2p/crypto/eddsa/math/Field.java | 11 + .../i2p/crypto/eddsa/math/FieldElement.java | 17 +- .../i2p/crypto/eddsa/math/GroupElement.java | 345 +++++++++--------- .../net/i2p/crypto/eddsa/math/ScalarOps.java | 33 +- .../math/bigint/BigIntegerFieldElement.java | 11 + .../BigIntegerLittleEndianEncoding.java | 31 +- .../math/bigint/BigIntegerScalarOps.java | 11 + .../math/ed25519/Ed25519FieldElement.java | 89 +++-- .../ed25519/Ed25519LittleEndianEncoding.java | 99 +++-- .../eddsa/math/ed25519/Ed25519ScalarOps.java | 35 +- .../crypto/eddsa/math/ed25519/package.html | 2 +- .../net/i2p/crypto/eddsa/math/package.html | 2 +- .../eddsa/spec/EdDSAGenParameterSpec.java | 11 + .../eddsa/spec/EdDSANamedCurveSpec.java | 11 + .../eddsa/spec/EdDSANamedCurveTable.java | 11 + .../crypto/eddsa/spec/EdDSAParameterSpec.java | 21 +- .../eddsa/spec/EdDSAPrivateKeySpec.java | 11 + .../crypto/eddsa/spec/EdDSAPublicKeySpec.java | 19 +- .../i2p/crypto/eddsa/Ed25519TestVectors.java | 11 + .../net/i2p/crypto/eddsa/EdDSAEngineTest.java | 11 + .../junit/net/i2p/crypto/eddsa/UtilsTest.java | 16 + .../eddsa/math/AbstractFieldElementTest.java | 12 +- .../i2p/crypto/eddsa/math/ConstantsTest.java | 11 + .../crypto/eddsa/math/GroupElementTest.java | 11 + .../net/i2p/crypto/eddsa/math/MathUtils.java | 11 + .../eddsa/math/PrecomputationTestVectors.java | 11 + .../bigint/BigIntegerFieldElementTest.java | 11 + .../math/bigint/BigIntegerScalarOpsTest.java | 10 +- .../math/ed25519/Ed25519FieldElementTest.java | 11 + .../Ed25519LittleEndianEncodingTest.java | 11 + .../math/ed25519/Ed25519ScalarOpsTest.java | 10 +- .../eddsa/spec/EdDSAPrivateKeySpecTest.java | 15 +- history.txt | 3 + licenses/LICENSE-CC0-1.0-Universal.txt | 123 +++++++ 45 files changed, 1008 insertions(+), 415 deletions(-) create mode 100644 licenses/LICENSE-CC0-1.0-Universal.txt diff --git a/LICENSE.txt b/LICENSE.txt index 3de838b1d..fe5b52bd7 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -82,6 +82,9 @@ Public domain except as listed below: Copyright (c) 1998 by Aaron M. Renn (arenn@urbanophile.com) See licenses/LICENSE-LGPLv2.1.txt + EdDSA-Java: + See licenses/LICENSE-CC0-1.0-Universal.txt + HostnameVerifier: From Apache HttpClient 4.4.1 and HttpCore 4.4.1 See licenses/LICENSE-Apache2.0.txt diff --git a/core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java b/core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java index c55626a24..a237f22fe 100644 --- a/core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java +++ b/core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.io.ByteArrayOutputStream; @@ -153,7 +164,7 @@ public class EdDSAEngine extends Signature { } } else if (!key.getParams().getHashAlgorithm().equals(digest.getAlgorithm())) throw new InvalidKeyException("Key hash algorithm does not match chosen digest"); - } else if (publicKey.getClass().getName().equals("sun.security.x509.X509Key")) { + } else if (publicKey.getFormat().equals("X.509")) { // X509Certificate will sometimes contain an X509Key rather than the EdDSAPublicKey itself; the contained // key is valid but needs to be instanced as an EdDSAPublicKey before it can be used. EdDSAPublicKey parsedPublicKey; diff --git a/core/java/src/net/i2p/crypto/eddsa/EdDSAKey.java b/core/java/src/net/i2p/crypto/eddsa/EdDSAKey.java index 988045d9b..7475ffe91 100644 --- a/core/java/src/net/i2p/crypto/eddsa/EdDSAKey.java +++ b/core/java/src/net/i2p/crypto/eddsa/EdDSAKey.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec; @@ -7,18 +18,17 @@ import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec; * * @since 0.9.15 * @author str4d - * */ public interface EdDSAKey { /** * The reported key algorithm for all EdDSA keys * @since 0.9.36 */ - public String KEY_ALGORITHM = "EdDSA"; + String KEY_ALGORITHM = "EdDSA"; /** * @return a parameter specification representing the EdDSA domain * parameters for the key. */ - public EdDSAParameterSpec getParams(); + EdDSAParameterSpec getParams(); } diff --git a/core/java/src/net/i2p/crypto/eddsa/EdDSAPrivateKey.java b/core/java/src/net/i2p/crypto/eddsa/EdDSAPrivateKey.java index 36d88e193..a90931d2c 100644 --- a/core/java/src/net/i2p/crypto/eddsa/EdDSAPrivateKey.java +++ b/core/java/src/net/i2p/crypto/eddsa/EdDSAPrivateKey.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.security.PrivateKey; @@ -12,21 +23,16 @@ import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec; /** * An EdDSA private key. - *

- * Warning: Private key encoding is based on the current curdle WG draft, - * and is subject to change. See getEncoded(). - *

- * For compatibility with older releases, decoding supports both the old and new - * draft specifications. See decode(). - *

- * Ref: https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - *

- * Old Ref: https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-04 - *

+ *

+ * For compatibility with older releases, decoding supports both RFC 8410 and an + * older draft specifications. * * @since 0.9.15 * @author str4d - * + * @see RFC 8410 + * @see Older draft + * specification */ public class EdDSAPrivateKey implements EdDSAKey, PrivateKey { private static final long serialVersionUID = 23495873459878957L; @@ -72,62 +78,62 @@ public class EdDSAPrivateKey implements EdDSAKey, PrivateKey { /** * Returns the private key in its canonical encoding. - *

+ *

* This implements the following specs: - *

  • - * General encoding: https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - *
  • - * Key encoding: https://tools.ietf.org/html/rfc8032 - *
- *

- * This encodes the seed. It will return null if constructed from - * a spec which was directly constructed from H, in which case seed is null. - *

+ *

    + *
  • General encoding: https://tools.ietf.org/html/rfc8410
    • + *
  • Key encoding: https://tools.ietf.org/html/rfc8032
    • + *
+ *

+ * This encodes the seed. It will return null if constructed from a spec which + * was directly constructed from H, in which case seed is null. + *

* For keys in older formats, decoding and then re-encoding is sufficient to * migrate them to the canonical encoding. - *

+ *

* Relevant spec quotes: - *

+     *
+     * 
      *  OneAsymmetricKey ::= SEQUENCE {
      *    version Version,
      *    privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
      *    privateKey PrivateKey,
-     *    attributes [0] Attributes OPTIONAL,
+     *    attributes [0] IMPLICIT Attributes OPTIONAL,
      *    ...,
-     *    [[2: publicKey [1] PublicKey OPTIONAL ]],
+     *    [[2: publicKey [1] IMPLICIT PublicKey OPTIONAL ]],
      *    ...
      *  }
      *
      *  Version ::= INTEGER
      *  PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
      *  PrivateKey ::= OCTET STRING
-     *  PublicKey ::= OCTET STRING
+     *  PublicKey ::= BIT STRING
      *  Attributes ::= SET OF Attribute
-     *

+     *
* - *
+     * 
      *  ... when encoding a OneAsymmetricKey object, the private key is wrapped
      *  in a CurvePrivateKey object and wrapped by the OCTET STRING of the
-     *  'privateKey' field.
+     *  "privateKey" field.
      *
      *  CurvePrivateKey ::= OCTET STRING
-     *

+     *
* - *
+     * 
      *  AlgorithmIdentifier  ::=  SEQUENCE  {
      *    algorithm   OBJECT IDENTIFIER,
      *    parameters  ANY DEFINED BY algorithm OPTIONAL
      *  }
      *
      *  For all of the OIDs, the parameters MUST be absent.
-     *

+     *
* - *
+     * 
      *  id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }
-     *

+     *
* - * @return 48 bytes for Ed25519, null for other curves - * @since implemented in 0.9.25 + * @return 48 bytes for Ed25519, null for other curves + * @since implemented in 0.9.25 */ @Override public byte[] getEncoded() { @@ -171,22 +177,20 @@ public class EdDSAPrivateKey implements EdDSAKey, PrivateKey { /** * Extracts the private key bytes from the provided encoding. - *

- * This will decode data conforming to the current spec at - * https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - * or as inferred from the old spec at - * https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-04. - *

- * Contrary to draft-ietf-curdle-pkix-04, it WILL accept a parameter value - * of NULL, as it is required for interoperability with the default Java - * keystore. Other implementations MUST NOT copy this behaviour from here - * unless they also need to read keys from the default Java keystore. - *

+ *

+ * This will decode data conforming to RFC 8410 or as inferred from the older + * draft spec at https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-04. + *

+ * Per RFC 8410 section 3, this function WILL accept a parameter value of + * NULL, as it is required for interoperability with the default Java keystore. + * Other implementations MUST NOT copy this behaviour from here unless they also + * need to read keys from the default Java keystore. + *

* This is really dumb for now. It does not use a general-purpose ASN.1 decoder. * See also getEncoded(). * - * @return 32 bytes for Ed25519, throws for other curves - * @since 0.9.25 + * @return 32 bytes for Ed25519, throws for other curves + * @since 0.9.25 */ private static byte[] decode(byte[] d) throws InvalidKeySpecException { try { @@ -244,13 +248,18 @@ public class EdDSAPrivateKey implements EdDSAKey, PrivateKey { } else { // Handle parameter value of NULL // - // Quote https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 : - // For all of the OIDs, the parameters MUST be absent. - // Regardless of the defect in the original 1997 syntax, - // implementations MUST NOT accept a parameters value of NULL. + // Quoting RFC 8410 section 3: + // > For all of the OIDs, the parameters MUST be absent. + // > + // > It is possible to find systems that require the parameters to be + // > present. This can be due to either a defect in the original 1997 + // > syntax or a programming error where developers never got input where + // > this was not true. The optimal solution is to fix these systems; + // > where this is not possible, the problem needs to be restricted to + // > that subsystem and not propagated to the Internet. // - // But Java's default keystore puts it in (when decoding as - // PKCS8 and then re-encoding to pass on), so we must accept it. + // Java's default keystore puts it in (when decoding as PKCS8 and then + // re-encoding to pass on), so we must accept it. if (idlen == 7) { if (d[idx++] != 0x05 || d[idx++] != 0) { @@ -281,36 +290,36 @@ public class EdDSAPrivateKey implements EdDSAKey, PrivateKey { } /** - * @return will be null if constructed from a spec which was - * directly constructed from H + * @return will be null if constructed from a spec which was directly + * constructed from H */ public byte[] getSeed() { return seed; } /** - * @return the hash of the seed + * @return the hash of the seed */ public byte[] getH() { return h; } /** - * @return the private key + * @return the private key */ public byte[] geta() { return a; } /** - * @return the public key + * @return the public key */ public GroupElement getA() { return A; } /** - * @return the public key + * @return the public key */ public byte[] getAbyte() { return Abyte; diff --git a/core/java/src/net/i2p/crypto/eddsa/EdDSAPublicKey.java b/core/java/src/net/i2p/crypto/eddsa/EdDSAPublicKey.java index 383d46a4a..00c247950 100644 --- a/core/java/src/net/i2p/crypto/eddsa/EdDSAPublicKey.java +++ b/core/java/src/net/i2p/crypto/eddsa/EdDSAPublicKey.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.security.PublicKey; @@ -12,26 +23,21 @@ import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec; /** * An EdDSA public key. - *

- * Warning: Public key encoding is is based on the current curdle WG draft, - * and is subject to change. See getEncoded(). - *

- * For compatibility with older releases, decoding supports both the old and new - * draft specifications. See decode(). - *

- * Ref: https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - *

- * Old Ref: https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-04 - *

+ *

+ * For compatibility with older releases, decoding supports both RFC 8410 and an + * older draft specification. * * @since 0.9.15 * @author str4d - * + * @see RFC 8410 + * @see Older draft + * specification */ public class EdDSAPublicKey implements EdDSAKey, PublicKey { private static final long serialVersionUID = 9837459837498475L; private final GroupElement A; - private GroupElement Aneg; + private GroupElement Aneg = null; private final byte[] Abyte; private final EdDSAParameterSpec edDsaSpec; @@ -67,19 +73,19 @@ public class EdDSAPublicKey implements EdDSAKey, PublicKey { /** * Returns the public key in its canonical encoding. - *

+ *

* This implements the following specs: - *

  • - * General encoding: https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - *
  • - * Key encoding: https://tools.ietf.org/html/rfc8032 - *
- *

+ *

    + *
  • General encoding: https://tools.ietf.org/html/rfc8410
    • + *
  • Key encoding: https://tools.ietf.org/html/rfc8032
    • + *
+ *

* For keys in older formats, decoding and then re-encoding is sufficient to * migrate them to the canonical encoding. - *

+ *

* Relevant spec quotes: - *

+     *
+     * 
      *  In the X.509 certificate, the subjectPublicKeyInfo field has the
      *  SubjectPublicKeyInfo type, which has the following ASN.1 syntax:
      *
@@ -87,23 +93,23 @@ public class EdDSAPublicKey implements EdDSAKey, PublicKey {
      *    algorithm         AlgorithmIdentifier,
      *    subjectPublicKey  BIT STRING
      *  }
-     *

+     *
* - *
+     * 
      *  AlgorithmIdentifier  ::=  SEQUENCE  {
      *    algorithm   OBJECT IDENTIFIER,
      *    parameters  ANY DEFINED BY algorithm OPTIONAL
      *  }
      *
      *  For all of the OIDs, the parameters MUST be absent.
-     *

+     *
* - *
+     * 
      *  id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }
-     *

+     *
* - * @return 44 bytes for Ed25519, null for other curves - * @since implemented in 0.9.25 + * @return 44 bytes for Ed25519, null for other curves + * @since implemented in 0.9.25 */ @Override public byte[] getEncoded() { @@ -137,23 +143,20 @@ public class EdDSAPublicKey implements EdDSAKey, PublicKey { /** * Extracts the public key bytes from the provided encoding. - *

- * This will decode data conforming to the current spec at - * https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 - * or the old spec at + *

+ * This will decode data conforming to RFC 8410 or the older draft spec at * https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-04. - *

- * Contrary to draft-ietf-curdle-pkix-04, it WILL accept a parameter value - * of NULL, as it is required for interoperability with the default Java - * keystore. Other implementations MUST NOT copy this behaviour from here - * unless they also need to read keys from the default Java keystore. - *

+ *

+ * Per RFC 8410 section 3, this function WILL accept a parameter value of + * NULL, as it is required for interoperability with the default Java keystore. + * Other implementations MUST NOT copy this behaviour from here unless they also + * need to read keys from the default Java keystore. + *

* This is really dumb for now. It does not use a general-purpose ASN.1 decoder. * See also getEncoded(). - *

* - * @return 32 bytes for Ed25519, throws for other curves - * @since 0.9.25 + * @return 32 bytes for Ed25519, throws for other curves + * @since 0.9.25 */ private static byte[] decode(byte[] d) throws InvalidKeySpecException { try { @@ -208,13 +211,18 @@ public class EdDSAPublicKey implements EdDSAKey, PublicKey { } else { // Handle parameter value of NULL // - // Quote https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 : - // For all of the OIDs, the parameters MUST be absent. - // Regardless of the defect in the original 1997 syntax, - // implementations MUST NOT accept a parameters value of NULL. + // Quoting RFC 8410 section 3: + // > For all of the OIDs, the parameters MUST be absent. + // > + // > It is possible to find systems that require the parameters to be + // > present. This can be due to either a defect in the original 1997 + // > syntax or a programming error where developers never got input where + // > this was not true. The optimal solution is to fix these systems; + // > where this is not possible, the problem needs to be restricted to + // > that subsystem and not propagated to the Internet. // - // But Java's default keystore puts it in (when decoding as - // PKCS8 and then re-encoding to pass on), so we must accept it. + // Java's default keystore puts it in (when decoding as PKCS8 and then + // re-encoding to pass on), so we must accept it. if (idlen == 7) { if (d[idx++] != 0x05 || d[idx++] != 0) { @@ -245,7 +253,8 @@ public class EdDSAPublicKey implements EdDSAKey, PublicKey { } public GroupElement getNegativeA() { - // Only read Aneg once, otherwise read re-ordering might occur between here and return. Requires all GroupElement's fields to be final. + // Only read Aneg once, otherwise read re-ordering might occur between + // here and return. Requires all GroupElement's fields to be final. GroupElement ourAneg = Aneg; if(ourAneg == null) { ourAneg = A.negate(); diff --git a/core/java/src/net/i2p/crypto/eddsa/KeyFactory.java b/core/java/src/net/i2p/crypto/eddsa/KeyFactory.java index 72fd03152..12ed96683 100644 --- a/core/java/src/net/i2p/crypto/eddsa/KeyFactory.java +++ b/core/java/src/net/i2p/crypto/eddsa/KeyFactory.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.security.InvalidKeyException; diff --git a/core/java/src/net/i2p/crypto/eddsa/KeyPairGenerator.java b/core/java/src/net/i2p/crypto/eddsa/KeyPairGenerator.java index 3480355cf..13958e272 100644 --- a/core/java/src/net/i2p/crypto/eddsa/KeyPairGenerator.java +++ b/core/java/src/net/i2p/crypto/eddsa/KeyPairGenerator.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.security.InvalidAlgorithmParameterException; @@ -32,7 +43,7 @@ public class KeyPairGenerator extends KeyPairGeneratorSpi { static { edParameters = new Hashtable(); - edParameters.put(Integer.valueOf(DEFAULT_KEYSIZE), new EdDSAGenParameterSpec(EdDSANamedCurveTable.ED_25519)); + edParameters.put(Integer.valueOf(256), new EdDSAGenParameterSpec(EdDSANamedCurveTable.ED_25519)); } public void initialize(int keysize, SecureRandom random) { diff --git a/core/java/src/net/i2p/crypto/eddsa/Utils.java b/core/java/src/net/i2p/crypto/eddsa/Utils.java index f4c4e7c36..e0c03246e 100644 --- a/core/java/src/net/i2p/crypto/eddsa/Utils.java +++ b/core/java/src/net/i2p/crypto/eddsa/Utils.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; /** @@ -65,6 +76,9 @@ public class Utils { */ public static byte[] hexToBytes(String s) { int len = s.length(); + if (len % 2 != 0) { + throw new IllegalArgumentException("Hex string must have an even length"); + } byte[] data = new byte[len / 2]; for (int i = 0; i < len; i += 2) { data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) diff --git a/core/java/src/net/i2p/crypto/eddsa/math/Constants.java b/core/java/src/net/i2p/crypto/eddsa/math/Constants.java index 3b67f240c..ebfcdc81e 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/Constants.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/Constants.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import net.i2p.crypto.eddsa.Utils; diff --git a/core/java/src/net/i2p/crypto/eddsa/math/Curve.java b/core/java/src/net/i2p/crypto/eddsa/math/Curve.java index 29a4a8a9f..2c50144fc 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/Curve.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/Curve.java @@ -1,10 +1,21 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.Serializable; /** * A twisted Edwards curve. - * Points on the curve satisfy -x^2 + y^2 = 1 + d x^2y^2 + * Points on the curve satisfy $-x^2 + y^2 = 1 + d x^2y^2$ * * @since 0.9.15 * @author str4d diff --git a/core/java/src/net/i2p/crypto/eddsa/math/Encoding.java b/core/java/src/net/i2p/crypto/eddsa/math/Encoding.java index a921d1192..088e42a8d 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/Encoding.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/Encoding.java @@ -1,9 +1,20 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.Serializable; /** - * Common interface for all (b-1)-bit encodings of elements + * Common interface for all $(b-1)$-bit encodings of elements * of EdDSA finite fields. * * @since 0.9.15 @@ -20,25 +31,27 @@ public abstract class Encoding implements Serializable { } /** - * Encode a FieldElement in its (b-1)-bit encoding. - * @return the (b-1)-bit encoding of this FieldElement. + * Encode a FieldElement in its $(b-1)$-bit encoding. + * @param x the FieldElement to encode + * @return the $(b-1)$-bit encoding of this FieldElement. */ public abstract byte[] encode(FieldElement x); /** - * Decode a FieldElement from its (b-1)-bit encoding. + * Decode a FieldElement from its $(b-1)$-bit encoding. * The highest bit is masked out. - * @param in the (b-1)-bit encoding of a FieldElement. + * @param in the $(b-1)$-bit encoding of a FieldElement. * @return the FieldElement represented by 'val'. */ public abstract FieldElement decode(byte[] in); /** * From the Ed25519 paper:
- * x is negative if the (b-1)-bit encoding of x is lexicographically larger - * than the (b-1)-bit encoding of -x. If q is an odd prime and the encoding - * is the little-endian representation of {0, 1,..., q-1} then the negative - * elements of F_q are {1, 3, 5,..., q-2}. + * $x$ is negative if the $(b-1)$-bit encoding of $x$ is lexicographically larger + * than the $(b-1)$-bit encoding of -x. If $q$ is an odd prime and the encoding + * is the little-endian representation of $\{0, 1,\dots, q-1\}$ then the negative + * elements of $F_q$ are $\{1, 3, 5,\dots, q-2\}$. + * @param x the FieldElement to check * @return true if negative */ public abstract boolean isNegative(FieldElement x); diff --git a/core/java/src/net/i2p/crypto/eddsa/math/Field.java b/core/java/src/net/i2p/crypto/eddsa/math/Field.java index dd8fceddf..15791fea1 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/Field.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/Field.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.Serializable; diff --git a/core/java/src/net/i2p/crypto/eddsa/math/FieldElement.java b/core/java/src/net/i2p/crypto/eddsa/math/FieldElement.java index 06e89493b..061dc4f4b 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/FieldElement.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/FieldElement.java @@ -1,13 +1,22 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.Serializable; /** - * * Note: concrete subclasses must implement hashCode() and equals() * * @since 0.9.15 - * */ public abstract class FieldElement implements Serializable { private static final long serialVersionUID = 1239527465875676L; @@ -22,8 +31,8 @@ public abstract class FieldElement implements Serializable { } /** - * Encode a FieldElement in its (b-1)-bit encoding. - * @return the (b-1)-bit encoding of this FieldElement. + * Encode a FieldElement in its $(b-1)$-bit encoding. + * @return the $(b-1)$-bit encoding of this FieldElement. */ public byte[] toByteArray() { return f.getEncoding().encode(this); diff --git a/core/java/src/net/i2p/crypto/eddsa/math/GroupElement.java b/core/java/src/net/i2p/crypto/eddsa/math/GroupElement.java index 11e925530..2fce698ae 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/GroupElement.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/GroupElement.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import net.i2p.crypto.eddsa.Utils; @@ -6,7 +17,7 @@ import java.io.Serializable; import java.util.Arrays; /** - * A point (x,y) on an EdDSA curve. + * A point $(x,y)$ on an EdDSA curve. *

* Reviewed/commented by Bloody Rookie (nemproject@gmx.de) *

@@ -20,36 +31,36 @@ import java.util.Arrays; * * @since 0.9.15 * @author str4d - * */ public class GroupElement implements Serializable { private static final long serialVersionUID = 2395879087349587L; /** * Available representations for a group element. - *

    - *
  • P2: Projective representation (X:Y:Z) satisfying x=X/Z, y=Y/Z. - *
  • P3: Extended projective representation (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT. - *
  • P1P1: Completed representation ((X:Z), (Y:T)) satisfying x=X/Z, y=Y/T. - *
  • PRECOMP: Precomputed representation (y+x, y-x, 2dxy). - *
  • CACHED: Cached representation (Y+X, Y-X, Z, 2dT) + *
      + *
    • P2: Projective representation $(X:Y:Z)$ satisfying $x=X/Z, y=Y/Z$. + *
    • P3: Extended projective representation $(X:Y:Z:T)$ satisfying $x=X/Z, y=Y/Z, XY=ZT$. + *
    • P3PrecomputedDouble: P3 but with dblPrecmp populated. + *
    • P1P1: Completed representation $((X:Z), (Y:T))$ satisfying $x=X/Z, y=Y/T$. + *
    • PRECOMP: Precomputed representation $(y+x, y-x, 2dxy)$. + *
    • CACHED: Cached representation $(Y+X, Y-X, Z, 2dT)$ *
    */ public enum Representation { - /** Projective (P^2): (X:Y:Z) satisfying x=X/Z, y=Y/Z */ + /** Projective ($P^2$): $(X:Y:Z)$ satisfying $x=X/Z, y=Y/Z$ */ P2, - /** Extended (P^3): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT */ + /** Extended ($P^3$): $(X:Y:Z:T)$ satisfying $x=X/Z, y=Y/Z, XY=ZT$ */ P3, /** * Can only be requested. Results in P3 representation but also populates dblPrecmp. * @since 0.9.36 */ P3PrecomputedDouble, - /** Completed (P x P): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T */ + /** Completed ($P \times P$): $((X:Z),(Y:T))$ satisfying $x=X/Z, y=Y/T$ */ P1P1, - /** Precomputed (Duif): (y+x,y-x,2dxy) */ + /** Precomputed (Duif): $(y+x,y-x,2dxy)$ */ PRECOMP, - /** Cached: (Y+X,Y-X,Z,2dT) */ + /** Cached: $(Y+X,Y-X,Z,2dT)$ */ CACHED } @@ -57,9 +68,9 @@ public class GroupElement implements Serializable { * Creates a new group element in P2 representation. * * @param curve The curve. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. * @return The group element in P2 representation. */ public static GroupElement p2( @@ -71,13 +82,13 @@ public class GroupElement implements Serializable { } /** - * Creates a new group element in P3 representation. + * Creates a new group element in P3 representation, without pre-computation. * * @param curve The curve. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. - * @param T The T coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. + * @param T The $T$ coordinate. * @return The group element in P3 representation. */ public static GroupElement p3( @@ -93,10 +104,10 @@ public class GroupElement implements Serializable { * Creates a new group element in P3 representation, potentially with pre-computation. * * @param curve The curve. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. - * @param T The T coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. + * @param T The $T$ coordinate. * @param precomputeDoubleOnly If true, populate dblPrecmp, else set to null. * @return The group element in P3 representation. * @since 0.9.36 @@ -115,10 +126,10 @@ public class GroupElement implements Serializable { * Creates a new group element in P1P1 representation. * * @param curve The curve. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. - * @param T The T coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. + * @param T The $T$ coordinate. * @return The group element in P1P1 representation. */ public static GroupElement p1p1( @@ -134,9 +145,9 @@ public class GroupElement implements Serializable { * Creates a new group element in PRECOMP representation. * * @param curve The curve. - * @param ypx The y + x value. - * @param ymx The y - x value. - * @param xy2d The 2 * d * x * y value. + * @param ypx The $y + x$ value. + * @param ymx The $y - x$ value. + * @param xy2d The $2 * d * x * y$ value. * @return The group element in PRECOMP representation. */ public static GroupElement precomp( @@ -151,10 +162,10 @@ public class GroupElement implements Serializable { * Creates a new group element in CACHED representation. * * @param curve The curve. - * @param YpX The Y + X value. - * @param YmX The Y - X value. - * @param Z The Z coordinate. - * @param T2d The 2 * d * T value. + * @param YpX The $Y + X$ value. + * @param YmX The $Y - X$ value. + * @param Z The $Z$ coordinate. + * @param T2d The $2 * d * T$ value. * @return The group element in CACHED representation. */ public static GroupElement cached( @@ -217,10 +228,10 @@ public class GroupElement implements Serializable { * * @param curve The curve. * @param repr The representation used to represent the group element. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. - * @param T The T coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. + * @param T The $T$ coordinate. */ public GroupElement( final Curve curve, @@ -237,10 +248,10 @@ public class GroupElement implements Serializable { * * @param curve The curve. * @param repr The representation used to represent the group element. - * @param X The X coordinate. - * @param Y The Y coordinate. - * @param Z The Z coordinate. - * @param T The T coordinate. + * @param X The $X$ coordinate. + * @param Y The $Y$ coordinate. + * @param Z The $Z$ coordinate. + * @param T The $T$ coordinate. * @param precomputeDouble If true, populate dblPrecmp, else set to null. * @since 0.9.36 */ @@ -263,16 +274,16 @@ public class GroupElement implements Serializable { } /** - * Creates a group element for a curve from a given encoded point. + * Creates a group element for a curve from a given encoded point. No pre-computation. *

    - * A point (x,y) is encoded by storing y in bit 0 to bit 254 and the sign of x in bit 255. - * x is recovered in the following way: + * A point $(x,y)$ is encoded by storing $y$ in bit 0 to bit 254 and the sign of $x$ in bit 255. + * $x$ is recovered in the following way: *

      - *
    • x = sign(x) * sqrt((y^2 - 1) / (d * y^2 + 1)) = sign(x) * sqrt(u / v) with u = y^2 - 1 and v = d * y^2 + 1. - *
    • Setting = (u * v^3) * (u * v^7)^((q - 5) / 8) one has ^2 = +-(u / v). - *
    • If v * = -u multiply with i=sqrt(-1). - *
    • Set x := . - *
    • If sign(x) != bit 255 of s then negate x. + *
    • $x = sign(x) * \sqrt{(y^2 - 1) / (d * y^2 + 1)} = sign(x) * \sqrt{u / v}$ with $u = y^2 - 1$ and $v = d * y^2 + 1$. + *
    • Setting $β = (u * v^3) * (u * v^7)^{((q - 5) / 8)}$ one has $β^2 = \pm(u / v)$. + *
    • If $v * β = -u$ multiply $β$ with $i=\sqrt{-1}$. + *
    • Set $x := β$. + *
    • If $sign(x) \ne$ bit 255 of $s$ then negate $x$. *
    * * @param curve The curve. @@ -285,14 +296,14 @@ public class GroupElement implements Serializable { /** * Creates a group element for a curve from a given encoded point. With optional pre-computation. *

    - * A point (x,y) is encoded by storing y in bit 0 to bit 254 and the sign of x in bit 255. - * x is recovered in the following way: + * A point $(x,y)$ is encoded by storing $y$ in bit 0 to bit 254 and the sign of $x$ in bit 255. + * $x$ is recovered in the following way: *

      - *
    • x = sign(x) * \sqrt{(y^2 - 1) / (d * y^2 + 1)} = sign(x) * \sqrt{u / v} with u = y^2 - 1 and v = d * y^2 + 1. - *
    • Setting β = (u * v^3) * (u * v^7)^((q - 5) / 8) one has β^2 = +-(u / v). - *
    • If v * β = -u multiply β with i=sqrt(-1). - *
    • Set x := β. - *
    • If sign(x) != bit 255 of s then negate x. + *
    • $x = sign(x) * \sqrt{(y^2 - 1) / (d * y^2 + 1)} = sign(x) * \sqrt{u / v}$ with $u = y^2 - 1$ and $v = d * y^2 + 1$. + *
    • Setting $β = (u * v^3) * (u * v^7)^{((q - 5) / 8)}$ one has $β^2 = \pm(u / v)$. + *
    • If $v * β = -u$ multiply $β$ with $i=\sqrt{-1}$. + *
    • Set $x := β$. + *
    • If $sign(x) \ne$ bit 255 of $s$ then negate $x$. *
    * * @param curve The curve. @@ -305,7 +316,7 @@ public class GroupElement implements Serializable { y = curve.getField().fromByteArray(s); yy = y.square(); - // u = y^2-1 + // u = y^2-1 u = yy.subtractOne(); // v = dy^2+1 @@ -371,40 +382,40 @@ public class GroupElement implements Serializable { } /** - * Gets the X value of the group element. - * This is for most representation the projective X coordinate. + * Gets the $X$ value of the group element. + * This is for most representation the projective $X$ coordinate. * - * @return The X value. + * @return The $X$ value. */ public FieldElement getX() { return this.X; } /** - * Gets the Y value of the group element. - * This is for most representation the projective Y coordinate. + * Gets the $Y$ value of the group element. + * This is for most representation the projective $Y$ coordinate. * - * @return The Y value. + * @return The $Y$ value. */ public FieldElement getY() { return this.Y; } /** - * Gets the Z value of the group element. - * This is for most representation the projective Z coordinate. + * Gets the $Z$ value of the group element. + * This is for most representation the projective $Z$ coordinate. * - * @return The Z value. + * @return The $Z$ value. */ public FieldElement getZ() { return this.Z; } /** - * Gets the T value of the group element. - * This is for most representation the projective T coordinate. + * Gets the $T$ value of the group element. + * This is for most representation the projective $T$ coordinate. * - * @return The T value. + * @return The $T$ value. */ public FieldElement getT() { return this.T; @@ -470,14 +481,14 @@ public class GroupElement implements Serializable { /** * Convert a GroupElement from one Representation to another. * TODO-CR: Add additional conversion? - * r = p + * $r = p$ *

    * Supported conversions: - *

      - *
    • P3 -> P2 - *
    • P3 -> CACHED (1 multiply, 1 add, 1 subtract) - *
    • P1P1 -> P2 (3 multiply) - *
    • P1P1 -> P3 (4 multiply) + *

        + *
      • P3 $\rightarrow$ P2 + *
      • P3 $\rightarrow$ CACHED (1 multiply, 1 add, 1 subtract) + *
      • P1P1 $\rightarrow$ P2 (3 multiply) + *
      • P1P1 $\rightarrow$ P3 (4 multiply) * * @param repr The representation to convert to. * @return A new group element in the given representation. @@ -573,33 +584,35 @@ public class GroupElement implements Serializable { } /** - * Doubles a given group element p in P^2 or P^3 representation and returns the result in P x P representation. - * r = 2 * p where p = (X : Y : Z) or p = (X : Y : Z : T) + * Doubles a given group element $p$ in $P^2$ or $P^3$ representation and returns the result in $P \times P$ representation. + * $r = 2 * p$ where $p = (X : Y : Z)$ or $p = (X : Y : Z : T)$ *

        - * r in P x P representation: + * $r$ in $P \times P$ representation: *

        - * r = ((X' : Z'), (Y' : T')) where + * $r = ((X' : Z'), (Y' : T'))$ where *

          - *
        • X' = (X + Y)^2 - (Y^2 + X^2) - *
        • Y' = Y^2 + X^2 - *
        • Z' = y^2 - X^2 - *
        • T' = 2 * Z^2 - (y^2 - X^2) + *
        • $X' = (X + Y)^2 - (Y^2 + X^2)$ + *
        • $Y' = Y^2 + X^2$ + *
        • $Z' = y^2 - X^2$ + *
        • $T' = 2 * Z^2 - (y^2 - X^2)$ *

        - * r converted from P x P to P^2 representation: + * $r$ converted from $P \times P$ to $P^2$ representation: *

        - * r = (X'' : Y'' : Z'') where + * $r = (X'' : Y'' : Z'')$ where *

          - *
        • X'' = X' * Z' = ((X + Y)^2 - Y^2 - X^2) * (2 * Z^2 - (y^2 - X^2)) - *
        • Y'' = Y' * T' = (Y^2 + X^2) * (2 * Z^2 - (y^2 - X^2)) - *
        • Z'' = Z' * T' = (y^2 - X^2) * (2 * Z^2 - (y^2 - X^2)) + *
        • $X'' = X' * Z' = ((X + Y)^2 - Y^2 - X^2) * (2 * Z^2 - (y^2 - X^2))$ + *
        • $Y'' = Y' * T' = (Y^2 + X^2) * (2 * Z^2 - (y^2 - X^2))$ + *
        • $Z'' = Z' * T' = (y^2 - X^2) * (2 * Z^2 - (y^2 - X^2))$ *

        - * Formula for the P^2 representation is in agreement with the formula given in [4] page 12 (with a = -1) + * Formula for the $P^2$ representation is in agreement with the formula given in [4] page 12 (with $a = -1$) * up to a common factor -1 which does not matter: *

        - * B = (X + Y)^2; C = X^2; D = Y^2; E = -C = -X^2; F := E + D = Y^2 - X^2; H = Z^2; J = F − 2 * H; - * X3 = (B − C − D) · J = X' * (-T'); - * Y3 = F · (E − D) = Z' * (-Y'); + * $$ + * B = (X + Y)^2; C = X^2; D = Y^2; E = -C = -X^2; F := E + D = Y^2 - X^2; H = Z^2; J = F − 2 * H; \\ + * X3 = (B − C − D) · J = X' * (-T'); \\ + * Y3 = F · (E − D) = Z' * (-Y'); \\ * Z3 = F · J = Z' * (-T'). + * $$ * * @return The P1P1 representation */ @@ -625,41 +638,43 @@ public class GroupElement implements Serializable { * GroupElement addition using the twisted Edwards addition law with * extended coordinates (Hisil2008). *

        - * this must be in P^3 representation and q in PRECOMP representation. - * r = p + q where p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z) = (Y2/Z2 + X2/Z2, Y2/Z2 - X2/Z2, 2 * d * X2/Z2 * Y2/Z2) + * this must be in $P^3$ representation and $q$ in PRECOMP representation. + * $r = p + q$ where $p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z) = (Y2/Z2 + X2/Z2, Y2/Z2 - X2/Z2, 2 * d * X2/Z2 * Y2/Z2)$ *

        - * r in P x P representation: + * $r$ in $P \times P$ representation: *

        - * r = ((X' : Z'), (Y' : T')) where - *

          - *
        • X' = (Y1 + X1) * q.X - (Y1 - X1) * q.Y = ((Y1 + X1) * (Y2 + X2) - (Y1 - X1) * (Y2 - X2)) * 1/Z2 - *
        • Y' = (Y1 + X1) * q.X + (Y1 - X1) * q.Y = ((Y1 + X1) * (Y2 + X2) + (Y1 - X1) * (Y2 - X2)) * 1/Z2 - *
        • Z' = 2 * Z1 + T1 * q.Z = 2 * Z1 + T1 * 2 * d * X2 * Y2 * 1/Z2^2 = (2 * Z1 * Z2 + 2 * d * T1 * T2) * 1/Z2 - *
        • T' = 2 * Z1 - T1 * q.Z = 2 * Z1 - T1 * 2 * d * X2 * Y2 * 1/Z2^2 = (2 * Z1 * Z2 - 2 * d * T1 * T2) * 1/Z2 + * $r = ((X' : Z'), (Y' : T'))$ where + *

            + *
          • $X' = (Y1 + X1) * q.X - (Y1 - X1) * q.Y = ((Y1 + X1) * (Y2 + X2) - (Y1 - X1) * (Y2 - X2)) * 1/Z2$ + *
          • $Y' = (Y1 + X1) * q.X + (Y1 - X1) * q.Y = ((Y1 + X1) * (Y2 + X2) + (Y1 - X1) * (Y2 - X2)) * 1/Z2$ + *
          • $Z' = 2 * Z1 + T1 * q.Z = 2 * Z1 + T1 * 2 * d * X2 * Y2 * 1/Z2^2 = (2 * Z1 * Z2 + 2 * d * T1 * T2) * 1/Z2$ + *
          • $T' = 2 * Z1 - T1 * q.Z = 2 * Z1 - T1 * 2 * d * X2 * Y2 * 1/Z2^2 = (2 * Z1 * Z2 - 2 * d * T1 * T2) * 1/Z2$ *

          - * Setting A = (Y1 - X1) * (Y2 - X2), B = (Y1 + X1) * (Y2 + X2), C = 2 * d * T1 * T2, D = 2 * Z1 * Z2 we get - *

            - *
          • X' = (B - A) * 1/Z2 - *
          • Y' = (B + A) * 1/Z2 - *
          • Z' = (D + C) * 1/Z2 - *
          • T' = (D - C) * 1/Z2 + * Setting $A = (Y1 - X1) * (Y2 - X2), B = (Y1 + X1) * (Y2 + X2), C = 2 * d * T1 * T2, D = 2 * Z1 * Z2$ we get + *

              + *
            • $X' = (B - A) * 1/Z2$ + *
            • $Y' = (B + A) * 1/Z2$ + *
            • $Z' = (D + C) * 1/Z2$ + *
            • $T' = (D - C) * 1/Z2$ *

            - * r converted from P x P to P^2 representation: + * $r$ converted from $P \times P$ to $P^2$ representation: *

            - * r = (X'' : Y'' : Z'' : T'') where - *

              - *
            • X'' = X' * Z' = (B - A) * (D + C) * 1/Z2^2 - *
            • Y'' = Y' * T' = (B + A) * (D - C) * 1/Z2^2 - *
            • Z'' = Z' * T' = (D + C) * (D - C) * 1/Z2^2 - *
            • T'' = X' * Y' = (B - A) * (B + A) * 1/Z2^2 + * $r = (X'' : Y'' : Z'' : T'')$ where + *

                + *
              • $X'' = X' * Z' = (B - A) * (D + C) * 1/Z2^2$ + *
              • $Y'' = Y' * T' = (B + A) * (D - C) * 1/Z2^2$ + *
              • $Z'' = Z' * T' = (D + C) * (D - C) * 1/Z2^2$ + *
              • $T'' = X' * Y' = (B - A) * (B + A) * 1/Z2^2$ *

              - * TODO-CR BR: Formula for the P^2 representation is not in agreement with the formula given in [2] page 6
              - * TODO-CR BR: (the common factor 1/Z2^2 does not matter):
              - * E = B - A, F = D - C, G = D + C, H = B + A
              - * X3 = E * F = (B - A) * (D - C); - * Y3 = G * H = (D + C) * (B + A); - * Z3 = F * G = (D - C) * (D + C); + * TODO-CR BR: Formula for the $P^2$ representation is not in agreement with the formula given in [2] page 6
              + * TODO-CR BR: (the common factor $1/Z2^2$ does not matter):
              + * $$ + * E = B - A, F = D - C, G = D + C, H = B + A \\ + * X3 = E * F = (B - A) * (D - C); \\ + * Y3 = G * H = (D + C) * (B + A); \\ + * Z3 = F * G = (D - C) * (D + C); \\ * T3 = E * H = (B - A) * (B + A); + * $$ * * @param q the PRECOMP representation of the GroupElement to add. * @return the P1P1 representation of the result. @@ -684,10 +699,10 @@ public class GroupElement implements Serializable { * GroupElement subtraction using the twisted Edwards addition law with * extended coordinates (Hisil2008). *

              - * this must be in P^3 representation and q in PRECOMP representation. - * r = p - q where p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z) = (Y2/Z2 + X2/Z2, Y2/Z2 - X2/Z2, 2 * d * X2/Z2 * Y2/Z2) + * this must be in $P^3$ representation and $q$ in PRECOMP representation. + * $r = p - q$ where $p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z) = (Y2/Z2 + X2/Z2, Y2/Z2 - X2/Z2, 2 * d * X2/Z2 * Y2/Z2)$ *

              - * Negating q means negating the value of X2 and T2 (the latter is irrelevant here). + * Negating $q$ means negating the value of $X2$ and $T2$ (the latter is irrelevant here). * The formula is in accordance to {@link #madd the above addition}. * * @param q the PRECOMP representation of the GroupElement to subtract. @@ -713,22 +728,22 @@ public class GroupElement implements Serializable { * GroupElement addition using the twisted Edwards addition law with * extended coordinates (Hisil2008). *

              - * this must be in P^3 representation and q in CACHED representation. - * r = p + q where p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z, q.T) = (Y2 + X2, Y2 - X2, Z2, 2 * d * T2) + * this must be in $P^3$ representation and $q$ in CACHED representation. + * $r = p + q$ where $p = this = (X1 : Y1 : Z1 : T1), q = (q.X, q.Y, q.Z, q.T) = (Y2 + X2, Y2 - X2, Z2, 2 * d * T2)$ *

              - * r in P x P representation: + * $r$ in $P \times P$ representation: *

                - *
              • X' = (Y1 + X1) * (Y2 + X2) - (Y1 - X1) * (Y2 - X2) - *
              • Y' = (Y1 + X1) * (Y2 + X2) + (Y1 - X1) * (Y2 - X2) - *
              • Z' = 2 * Z1 * Z2 + 2 * d * T1 * T2 - *
              • T' = 2 * Z1 * T2 - 2 * d * T1 * T2 + *
              • $X' = (Y1 + X1) * (Y2 + X2) - (Y1 - X1) * (Y2 - X2)$ + *
              • $Y' = (Y1 + X1) * (Y2 + X2) + (Y1 - X1) * (Y2 - X2)$ + *
              • $Z' = 2 * Z1 * Z2 + 2 * d * T1 * T2$ + *
              • $T' = 2 * Z1 * T2 - 2 * d * T1 * T2$ *

              - * Setting A = (Y1 - X1) * (Y2 - X2), B = (Y1 + X1) * (Y2 + X2), C = 2 * d * T1 * T2, D = 2 * Z1 * Z2 we get + * Setting $A = (Y1 - X1) * (Y2 - X2), B = (Y1 + X1) * (Y2 + X2), C = 2 * d * T1 * T2, D = 2 * Z1 * Z2$ we get *

                - *
              • X' = (B - A) - *
              • Y' = (B + A) - *
              • Z' = (D + C) - *
              • T' = (D - C) + *
              • $X' = (B - A)$ + *
              • $Y' = (B + A)$ + *
              • $Z' = (D + C)$ + *
              • $T' = (D - C)$ *

              * Same result as in {@link #madd} (up to a common factor which does not matter). * @@ -756,9 +771,9 @@ public class GroupElement implements Serializable { * GroupElement subtraction using the twisted Edwards addition law with * extended coordinates (Hisil2008). *

              - * r = p - q + * $r = p - q$ *

              - * Negating q means negating the value of the coordinate X2 and T2. + * Negating $q$ means negating the value of the coordinate $X2$ and $T2$. * The formula is in accordance to {@link #add the above addition}. * * @param q the PRECOMP representation of the GroupElement to subtract. @@ -784,7 +799,7 @@ public class GroupElement implements Serializable { /** * Negates this group element by subtracting it from the neutral group element. *

              - * TODO-CR BR: why not simply negate the coordinates X and T? + * TODO-CR BR: why not simply negate the coordinates $X$ and $T$? * * @return The negative of this group element. */ @@ -852,7 +867,7 @@ public class GroupElement implements Serializable { *

              * Method is package private only so that tests run. * - * @param a = a[0]+256*a[1]+...+256^31 a[31] + * @param a $= a[0]+256*a[1]+...+256^{31} a[31]$ * @return 64 bytes, each between -8 and 7 */ static byte[] toRadix16(final byte[] a) { @@ -880,21 +895,21 @@ public class GroupElement implements Serializable { /** * Constant-time conditional move. *

              - * Replaces this with u if b == 1.
              - * Replaces this with this if b == 0. + * Replaces this with $u$ if $b == 1$.
              + * Replaces this with this if $b == 0$. *

              * Method is package private only so that tests run. * - * @param u The group element to return if b == 1. - * @param b in {0, 1} - * @return u if b == 1; this if b == 0; Results undefined if b is not in {0, 1}. + * @param u The group element to return if $b == 1$. + * @param b in $\{0, 1\}$ + * @return $u$ if $b == 1$; this if $b == 0$. Results undefined if $b$ is not in $\{0, 1\}$. */ GroupElement cmov(final GroupElement u, final int b) { return precomp(curve, X.cmov(u.X, b), Y.cmov(u.Y, b), Z.cmov(u.Z, b)); } /** - * Look up 16^i r_i B in the precomputed table. + * Look up $16^i r_i B$ in the precomputed table. *

              * No secret array indices, no secret branching. * Constant time. @@ -903,8 +918,8 @@ public class GroupElement implements Serializable { *

              * Method is package private only so that tests run. * - * @param pos = i/2 for i in {0, 2, 4,..., 62} - * @param b = r_i + * @param pos $= i/2$ for $i$ in $\{0, 2, 4,..., 62\}$ + * @param b $= r_i$ * @return the GroupElement */ GroupElement select(final int pos, final int b) { @@ -930,14 +945,14 @@ public class GroupElement implements Serializable { } /** - * h = a * B where a = a[0]+256*a[1]+...+256^31 a[31] and - * B is this point. If its lookup table has not been precomputed, it - * will be at the start of the method (and cached for later calls). + * $h = a * B$ where $a = a[0]+256*a[1]+\dots+256^{31} a[31]$ and + * $B$ is this point. If its lookup table has not been precomputed, it + * will be at the start of the method (and cached for later calls). * Constant time. *

              * Preconditions: (TODO: Check this applies here) - * a[31] <= 127 - * @param a = a[0]+256*a[1]+...+256^31 a[31] + * $a[31] \le 127$ + * @param a $= a[0]+256*a[1]+\dots+256^{31} a[31]$ * @return the GroupElement */ public GroupElement scalarMultiply(final byte[] a) { @@ -963,16 +978,16 @@ public class GroupElement implements Serializable { } /** - * Calculates a sliding-windows base 2 representation for a given value a. + * Calculates a sliding-windows base 2 representation for a given value $a$. * To learn more about it see [6] page 8. *

              - * Output: r which satisfies - * a = r0 * 2^0 + r1 * 2^1 + ... + r255 * 2^255 with ri in {-15, -13, -11, -9, -7, -5, -3, -1, 0, 1, 3, 5, 7, 9, 11, 13, 15} + * Output: $r$ which satisfies + * $a = r0 * 2^0 + r1 * 2^1 + \dots + r255 * 2^{255}$ with $ri$ in $\{-15, -13, -11, -9, -7, -5, -3, -1, 0, 1, 3, 5, 7, 9, 11, 13, 15\}$ *

              * Method is package private only so that tests run. * - * @param a = a[0]+256*a[1]+...+256^31 a[31]. - * @return The byte array r in the above described form. + * @param a $= a[0]+256*a[1]+\dots+256^{31} a[31]$. + * @return The byte array $r$ in the above described form. */ static byte[] slide(final byte[] a) { byte[] r = new byte[256]; @@ -1011,14 +1026,14 @@ public class GroupElement implements Serializable { } /** - * r = a * A + b * B where a = a[0]+256*a[1]+...+256^31 a[31], - * b = b[0]+256*b[1]+...+256^31 b[31] and B is this point. + * $r = a * A + b * B$ where $a = a[0]+256*a[1]+\dots+256^{31} a[31]$, + * $b = b[0]+256*b[1]+\dots+256^{31} b[31]$ and $B$ is this point. *

              - * A must have been previously precomputed. + * $A$ must have been previously precomputed. * * @param A in P3 representation. - * @param a = a[0]+256*a[1]+...+256^31 a[31] - * @param b = b[0]+256*b[1]+...+256^31 b[31] + * @param a $= a[0]+256*a[1]+\dots+256^{31} a[31]$ + * @param b $= b[0]+256*b[1]+\dots+256^{31} b[31]$ * @return the GroupElement */ public GroupElement doubleScalarMultiplyVariableTime(final GroupElement A, final byte[] a, final byte[] b) { diff --git a/core/java/src/net/i2p/crypto/eddsa/math/ScalarOps.java b/core/java/src/net/i2p/crypto/eddsa/math/ScalarOps.java index 2243969c7..627ef6e41 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/ScalarOps.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/ScalarOps.java @@ -1,30 +1,39 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.Serializable; /** - * * @since 0.9.15 - * */ public interface ScalarOps extends Serializable { /** - * Reduce the given scalar mod l. + * Reduce the given scalar mod $l$. *

              * From the Ed25519 paper:
              - * Here we interpret 2b-bit strings in little-endian form as integers in - * {0, 1,..., 2^(2b)-1}. - * @param s - * @return s mod l + * Here we interpret $2b$-bit strings in little-endian form as integers in + * $\{0, 1,..., 2^{(2b)}-1\}$. + * @param s the scalar to reduce + * @return $s \bmod l$ */ public byte[] reduce(byte[] s); /** - * r = (a * b + c) mod l - * @param a - * @param b - * @param c - * @return (a*b + c) mod l + * $r = (a * b + c) \bmod l$ + * @param a a scalar + * @param b a scalar + * @param c a scalar + * @return $(a*b + c) \bmod l$ */ public byte[] multiplyAndAdd(byte[] a, byte[] b, byte[] c); } diff --git a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java index 8d856263d..db8d18a3f 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElement.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.bigint; import java.io.Serializable; diff --git a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java index 3924b5b68..6badc5d41 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerLittleEndianEncoding.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.bigint; import java.io.Serializable; @@ -25,10 +36,11 @@ public class BigIntegerLittleEndianEncoding extends Encoding implements Serializ } /** - * Convert x to little endian. + * Convert $x$ to little endian. * Constant time. * - * @return array of length b/8 + * @param x the BigInteger value to encode + * @return array of length $b/8$ * @throws IllegalStateException if field not set */ public byte[] encode(BigInteger x) { @@ -46,10 +58,10 @@ public class BigIntegerLittleEndianEncoding extends Encoding implements Serializ } /** - * Decode a FieldElement from its (b-1)-bit encoding. + * Decode a FieldElement from its $(b-1)$-bit encoding. * The highest bit is masked out. * - * @param in the (b-1)-bit encoding of a FieldElement. + * @param in the $(b-1)$-bit encoding of a FieldElement. * @return the FieldElement represented by 'val'. * @throws IllegalStateException if field not set * @throws IllegalArgumentException if encoding is invalid @@ -64,6 +76,9 @@ public class BigIntegerLittleEndianEncoding extends Encoding implements Serializ /** * Convert in to big endian + * + * @param in the $(b-1)$-bit encoding of a FieldElement. + * @return the decoded value as a BigInteger */ public BigInteger toBigInteger(byte[] in) { byte[] out = new byte[in.length]; @@ -75,10 +90,10 @@ public class BigIntegerLittleEndianEncoding extends Encoding implements Serializ /** * From the Ed25519 paper:
              - * x is negative if the (b-1)-bit encoding of x is lexicographically larger - * than the (b-1)-bit encoding of -x. If q is an odd prime and the encoding - * is the little-endian representation of {0, 1,..., q-1} then the negative - * elements of F_q are {1, 3, 5,..., q-2}. + * $x$ is negative if the $(b-1)$-bit encoding of $x$ is lexicographically larger + * than the $(b-1)$-bit encoding of $-x$. If $q$ is an odd prime and the encoding + * is the little-endian representation of $\{0, 1,\dots, q-1\}$ then the negative + * elements of $F_q$ are $\{1, 3, 5,\dots, q-2\}$. * @return true if negative */ public boolean isNegative(FieldElement x) { diff --git a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java index 5e199791a..68169dc89 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOps.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.bigint; import java.math.BigInteger; diff --git a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java index 3b56bbf3b..bf3fbdc1c 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElement.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.ed25519; import net.i2p.crypto.eddsa.Utils; @@ -6,11 +17,11 @@ import net.i2p.crypto.eddsa.math.*; import java.util.Arrays; /** - * Class to represent a field element of the finite field p=2^255-19 elements. + * Class to represent a field element of the finite field $p = 2^{255} - 19$ elements. *

              - * An element t, entries t[0]...t[9], represents the integer - * t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9]. - * Bounds on each t[i] vary depending on context. + * An element $t$, entries $t[0] \dots t[9]$, represents the integer + * $t[0]+2^{26} t[1]+2^{51} t[2]+2^{77} t[3]+2^{102} t[4]+\dots+2^{230} t[9]$. + * Bounds on each $t[i]$ vary depending on context. *

              * Reviewed/commented by Bloody Rookie (nemproject@gmx.de) */ @@ -23,8 +34,8 @@ public class Ed25519FieldElement extends FieldElement { /** * Creates a field element. * - * @param f The underlying field, must be the finite field with p = 2^255 - 19 elements - * @param t The 2^25.5 bit representation of the field element. + * @param f The underlying field, must be the finite field with $p = 2^{255} - 19$ elements + * @param t The $2^{25.5}$ bit representation of the field element. */ public Ed25519FieldElement(Field f, int[] t) { super(f); @@ -46,18 +57,18 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = f + g + * $h = f + g$ *

              - * TODO-CR BR: h is allocated via new, probably not a good idea. Do we need the copying into temp variables if we do that? + * TODO-CR BR: $h$ is allocated via new, probably not a good idea. Do we need the copying into temp variables if we do that? *

              * Preconditions: *

                - *
              • |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. - *
              • |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. + *
              • $|f|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. + *
              • $|g|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc. + *
              • $|h|$ bounded by $1.1*2^{26},1.1*2^{25},1.1*2^{26},1.1*2^{25},$ etc. *
              * * @param val The field element to add. @@ -73,20 +84,20 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = f - g + * $h = f - g$ *

              - * Can overlap h with f or g. + * Can overlap $h$ with $f$ or $g$. *

              * TODO-CR BR: See above. *

              * Preconditions: *

                - *
              • |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. - *
              • |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. + *
              • $|f|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. + *
              • $|g|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc. + *
              • $|h|$ bounded by $1.1*2^{26},1.1*2^{25},1.1*2^{26},1.1*2^{25},$ etc. *
              * * @param val The field element to subtract. @@ -102,17 +113,17 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = -f + * $h = -f$ *

              * TODO-CR BR: see above. *

              * Preconditions: *

                - *
              • |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. + *
              • $|f|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc. + *
              • $|h|$ bounded by $1.1*2^{25},1.1*2^{24},1.1*2^{25},1.1*2^{24},$ etc. *
              * * @return The field element (-1) * this. @@ -126,21 +137,21 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = f * g + * $h = f * g$ *

              - * Can overlap h with f or g. + * Can overlap $h$ with $f$ or $g$. *

              * Preconditions: *

                - *
              • |f| bounded by - * 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc. - *
              • |g| bounded by - * 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc. + *
              • $|f|$ bounded by + * $1.65*2^{26},1.65*2^{25},1.65*2^{26},1.65*2^{25},$ etc. + *
              • $|g|$ bounded by + * $1.65*2^{26},1.65*2^{25},1.65*2^{26},1.65*2^{25},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by - * 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc. + *
              • $|h|$ bounded by + * $1.01*2^{25},1.01*2^{24},1.01*2^{25},1.01*2^{24},$ etc. *

              * Notes on implementation strategy: *

              @@ -377,17 +388,17 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = f * f + * $h = f * f$ *

              - * Can overlap h with f. + * Can overlap $h$ with $f$. *

              * Preconditions: *

                - *
              • |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc. + *
              • $|f|$ bounded by $1.65*2^{26},1.65*2^{25},1.65*2^{26},1.65*2^{25},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc. + *
              • $|h|$ bounded by $1.01*2^{25},1.01*2^{24},1.01*2^{25},1.01*2^{24},$ etc. *

              * See {@link #multiply(FieldElement)} for discussion * of implementation strategy. @@ -533,17 +544,17 @@ public class Ed25519FieldElement extends FieldElement { } /** - * h = 2 * f * f + * $h = 2 * f * f$ *

              - * Can overlap h with f. + * Can overlap $h$ with $f$. *

              * Preconditions: *

                - *
              • |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc. + *
              • $|f|$ bounded by $1.65*2^{26},1.65*2^{25},1.65*2^{26},1.65*2^{25},$ etc. *

              * Postconditions: *

                - *
              • |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc. + *
              • $|h|$ bounded by $1.01*2^{25},1.01*2^{24},1.01*2^{25},1.01*2^{24},$ etc. *

              * See {@link #multiply(FieldElement)} for discussion * of implementation strategy. @@ -698,7 +709,7 @@ public class Ed25519FieldElement extends FieldElement { * Invert this field element. *

              * The inverse is found via Fermat's little theorem:
              - * a^p congruent a mod p and therefore a^(p-2) congruent a^-1 mod p + * $a^p \cong a \mod p$ and therefore $a^{(p-2)} \cong a^{-1} \mod p$ * * @return The inverse of this field element. */ @@ -816,12 +827,12 @@ public class Ed25519FieldElement extends FieldElement { } /** - * Gets this field element to the power of (2^252 - 3). + * Gets this field element to the power of $(2^{252} - 3)$. * This is a helper function for calculating the square root. *

              * TODO-CR BR: I think it makes sense to have a sqrt function. * - * @return This field element to the power of (2^252 - 3). + * @return This field element to the power of $(2^{252} - 3)$. */ public FieldElement pow22523() { FieldElement t0, t1, t2; @@ -941,7 +952,7 @@ public class Ed25519FieldElement extends FieldElement { * * @param val the other field element. * @param b must be 0 or 1, otherwise results are undefined. - * @return a copy of this if b == 0, or a copy of val if b == 1. + * @return a copy of this if $b == 0$, or a copy of val if $b == 1$. * @since 0.9.36 */ @Override diff --git a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java index f5f0c3260..126b638bb 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncoding.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.ed25519; import net.i2p.crypto.eddsa.math.*; @@ -9,40 +20,60 @@ import net.i2p.crypto.eddsa.math.*; */ public class Ed25519LittleEndianEncoding extends Encoding { /** - * Encodes a given field element in its 32 byte representation. This is done in TWO steps. - * Step 1: Reduce the value of the field element modulo p. - * Step 2: Convert the field element to the 32 byte representation. - *

              - * The idea for the modulo p reduction algorithm is as follows: - *

              - * Assumption: - *

                - *
              • p = 2^255 - 19 - *
              • h = h0 + 2^25 * h1 + 2^(26+25) * h2 + ... + 2^230 * h9 where 0 <= |hi| < 2^27 for all i=0,...,9. - *
              • h congruent r modulo p, i.e. h = r + q * p for some suitable 0 <= r < p and an integer q. + * Encodes a given field element in its 32 byte representation. This is done in two steps: + *
                  + *
                1. Reduce the value of the field element modulo $p$. + *
                2. Convert the field element to the 32 byte representation. + *

                + * The idea for the modulo $p$ reduction algorithm is as follows: + *

                + *

                Assumption:

                + *
                  + *
                • $p = 2^{255} - 19$ + *
                • $h = h_0 + 2^{25} * h_1 + 2^{(26+25)} * h_2 + \dots + 2^{230} * h_9$ where $0 \le |h_i| \lt 2^{27}$ for all $i=0,\dots,9$. + *
                • $h \cong r \mod p$, i.e. $h = r + q * p$ for some suitable $0 \le r \lt p$ and an integer $q$. *

                - * Then q = [2^-255 * (h + 19 * 2^-25 * h9 + 1/2)] where [x] = floor(x). - *

                - * Proof: + * Then $q = [2^{-255} * (h + 19 * 2^{-25} * h_9 + 1/2)]$ where $[x] = floor(x)$. + *

                + *

                Proof:

                *

                * We begin with some very raw estimation for the bounds of some expressions: - * 

                |h| < 2^230 * 2^30 = 2^260 ==> |r + q * p| < 2^260 ==> |q| < 2^10.
-     * ==> -1/4 <= a := 19^2 * 2^-255 * q < 1/4.
-     * |h - 2^230 * h9| = |h0 + ... + 2^204 * h8| < 2^204 * 2^30 = 2^234.
-     * ==> -1/4 <= b := 19 * 2^-255 * (h - 2^230 * h9) < 1/4
                - * Therefore 0 < 1/2 - a - b < 1. *

                - * Set x := r + 19 * 2^-255 * r + 1/2 - a - b then - * 0 <= x < 255 - 20 + 19 + 1 = 2^255 ==> 0 <= 2^-255 * x < 1. Since q is an integer we have - * - * 

                [q + 2^-255 * x] = q        (1)
                + * $$ + * \begin{equation} + * |h| \lt 2^{230} * 2^{30} = 2^{260} \Rightarrow |r + q * p| \lt 2^{260} \Rightarrow |q| \lt 2^{10}. \\ + * \Rightarrow -1/4 \le a := 19^2 * 2^{-255} * q \lt 1/4. \\ + * |h - 2^{230} * h_9| = |h_0 + \dots + 2^{204} * h_8| \lt 2^{204} * 2^{30} = 2^{234}. \\ + * \Rightarrow -1/4 \le b := 19 * 2^{-255} * (h - 2^{230} * h_9) \lt 1/4 + * \end{equation} + * $$ *

                - * Have a closer look at x: - * 

                x = h - q * (2^255 - 19) + 19 * 2^-255 * (h - q * (2^255 - 19)) + 1/2 - 19^2 * 2^-255 * q - 19 * 2^-255 * (h - 2^230 * h9)
-     *   = h - q * 2^255 + 19 * q + 19 * 2^-255 * h - 19 * q + 19^2 * 2^-255 * q + 1/2 - 19^2 * 2^-255 * q - 19 * 2^-255 * h + 19 * 2^-25 * h9
-     *   = h + 19 * 2^-25 * h9 + 1/2 - q^255.
                + * Therefore $0 \lt 1/2 - a - b \lt 1$. *

                - * Inserting the expression for x into (1) we get the desired expression for q. + * Set $x := r + 19 * 2^{-255} * r + 1/2 - a - b$. Then: + *

                + * $$ + * 0 \le x \lt 255 - 20 + 19 + 1 = 2^{255} \\ + * \Rightarrow 0 \le 2^{-255} * x \lt 1. + * $$ + *

                + * Since $q$ is an integer we have + *

                + * $$ + * [q + 2^{-255} * x] = q \quad (1) + * $$ + *

                + * Have a closer look at $x$: + *

                + * $$ + * \begin{align} + * x &= h - q * (2^{255} - 19) + 19 * 2^{-255} * (h - q * (2^{255} - 19)) + 1/2 - 19^2 * 2^{-255} * q - 19 * 2^{-255} * (h - 2^{230} * h_9) \\ + * &= h - q * 2^{255} + 19 * q + 19 * 2^{-255} * h - 19 * q + 19^2 * 2^{-255} * q + 1/2 - 19^2 * 2^{-255} * q - 19 * 2^{-255} * h + 19 * 2^{-25} * h_9 \\ + * &= h + 19 * 2^{-25} * h_9 + 1/2 - q^{255}. + * \end{align} + * $$ + *

                + * Inserting the expression for $x$ into $(1)$ we get the desired expression for $q$. */ public byte[] encode(FieldElement x) { int[] h = ((Ed25519FieldElement)x).t; @@ -150,10 +181,10 @@ public class Ed25519LittleEndianEncoding extends Encoding { } /** - * Decodes a given field element in its 10 byte 2^25.5 representation. + * Decodes a given field element in its 10 byte $2^{25.5}$ representation. * * @param in The 32 byte representation. - * @return The field element in its 2^25.5 bit representation. + * @return The field element in its $2^{25.5}$ bit representation. */ public FieldElement decode(byte[] in) { long h0 = load_4(in, 0); @@ -207,15 +238,15 @@ public class Ed25519LittleEndianEncoding extends Encoding { /** * Is the FieldElement negative in this encoding? *

                - * Return true if x is in {1,3,5,...,q-2}
                - * Return false if x is in {0,2,4,...,q-1} + * Return true if $x$ is in $\{1,3,5,\dots,q-2\}$
                + * Return false if $x$ is in $\{0,2,4,\dots,q-1\}$ *

                * Preconditions: *

                  - *
                • |x| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc. + *
                • $|x|$ bounded by $1.1*2^{26},1.1*2^{25},1.1*2^{26},1.1*2^{25}$, etc. *
                * - * @return true if x is in {1,3,5,...,q-2}, false otherwise. + * @return true if $x$ is in $\{1,3,5,\dots,q-2\}$, false otherwise. */ public boolean isNegative(FieldElement x) { byte[] s = encode(x); diff --git a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java index 9fe59e692..55b51731a 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java +++ b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOps.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.ed25519; import net.i2p.crypto.eddsa.math.ScalarOps; @@ -8,21 +19,21 @@ import static net.i2p.crypto.eddsa.math.ed25519.Ed25519LittleEndianEncoding.load * Class for reducing a huge integer modulo the group order q and * doing a combined multiply plus add plus reduce operation. *

                - * q = 2^252 + 27742317777372353535851937790883648493. + * $q = 2^{252} + 27742317777372353535851937790883648493$. *

                * Reviewed/commented by Bloody Rookie (nemproject@gmx.de) */ public class Ed25519ScalarOps implements ScalarOps { /** - * Reduction modulo the group order q. + * Reduction modulo the group order $q$. *

                * Input: - * s[0]+256*s[1]+...+256^63*s[63] = s + * $s[0]+256*s[1]+\dots+256^{63}*s[63] = s$ *

                * Output: - * s[0]+256*s[1]+...+256^31*s[31] = s mod q - * where q = 2^252 + 27742317777372353535851937790883648493. + * $s[0]+256*s[1]+\dots+256^{31}*s[31] = s \bmod q$ + * where $q = 2^{252} + 27742317777372353535851937790883648493$. */ public byte[] reduce(byte[] s) { // s0,..., s22 have 21 bits, s23 has 29 bits @@ -313,15 +324,17 @@ public class Ed25519ScalarOps implements ScalarOps { /** + * $(ab+c) \bmod q$ + *

                * Input: - *

                  - *
                • a[0]+256*a[1]+...+256^31*a[31] = a - *
                • b[0]+256*b[1]+...+256^31*b[31] = b - *
                • c[0]+256*c[1]+...+256^31*c[31] = c + *

                    + *
                  • $a[0]+256*a[1]+\dots+256^{31}*a[31] = a$ + *
                  • $b[0]+256*b[1]+\dots+256^{31}*b[31] = b$ + *
                  • $c[0]+256*c[1]+\dots+256^{31}*c[31] = c$ *

                  * Output: - * result[0]+256*result[1]+...+256^31*result[31] = (ab+c) mod q - * where q = 2^252 + 27742317777372353535851937790883648493. + * $result[0]+256*result[1]+\dots+256^{31}*result[31] = (ab+c) \bmod q$ + * where $q = 2^{252} + 27742317777372353535851937790883648493$. *

                  * See the comments in {@link #reduce(byte[])} for an explanation of the algorithm. */ diff --git a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/package.html b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/package.html index 58e980f45..553122db9 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/ed25519/package.html +++ b/core/java/src/net/i2p/crypto/eddsa/math/ed25519/package.html @@ -1,6 +1,6 @@

                  - Low-level, optimized implementation using Radix 2^51 for Curve 25519. + Low-level, optimized implementation using Radix $2^{51}$ for Curve 25519. See the bigint implementation for other curves.

                  diff --git a/core/java/src/net/i2p/crypto/eddsa/math/package.html b/core/java/src/net/i2p/crypto/eddsa/math/package.html index 282a352c5..f227f2c12 100644 --- a/core/java/src/net/i2p/crypto/eddsa/math/package.html +++ b/core/java/src/net/i2p/crypto/eddsa/math/package.html @@ -4,6 +4,6 @@ the mathematical operaions on them.

                  Low-level implementation is in bigint for any curve using BigIntegers, - and in ed25519 for Curve 25519 using Radix 2^51. + and in ed25519 for Curve 25519 using Radix $2^{51}$.

                  diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java index 2b3bfcd93..fb8d92f25 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAGenParameterSpec.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import java.security.spec.AlgorithmParameterSpec; diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java index e51f27738..e16bdc501 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveSpec.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import net.i2p.crypto.eddsa.math.Curve; diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java index 7704693e7..81b4c268a 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSANamedCurveTable.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import java.util.HashMap; diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java index 2d021db84..a502242a9 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAParameterSpec.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import java.security.MessageDigest; @@ -25,11 +36,11 @@ public class EdDSAParameterSpec implements AlgorithmParameterSpec, Serializable private final GroupElement B; /** - * @param curve the curve - * @param hashAlgo the JCA string for the hash algorithm - * @param sc the parameter L represented as ScalarOps - * @param B the parameter B - * @throws IllegalArgumentException if hash algorithm is unsupported or length is wrong + * @param curve the curve + * @param hashAlgo the JCA string for the hash algorithm + * @param sc the parameter L represented as ScalarOps + * @param B the parameter B + * @throws IllegalArgumentException if hash algorithm is unsupported or length is wrong */ public EdDSAParameterSpec(Curve curve, String hashAlgo, ScalarOps sc, GroupElement B) { diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java index 1f583037a..b78fbaa8a 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpec.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import java.security.MessageDigest; diff --git a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java index adc7db596..0127d95b2 100644 --- a/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java +++ b/core/java/src/net/i2p/crypto/eddsa/spec/EdDSAPublicKeySpec.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import java.security.spec.KeySpec; @@ -12,13 +23,13 @@ import net.i2p.crypto.eddsa.math.GroupElement; */ public class EdDSAPublicKeySpec implements KeySpec { private final GroupElement A; - private GroupElement Aneg; + private GroupElement Aneg = null; private final EdDSAParameterSpec spec; /** - * @param pk the public key - * @param spec the parameter specification for this key - * @throws IllegalArgumentException if key length is wrong + * @param pk the public key + * @param spec the parameter specification for this key + * @throws IllegalArgumentException if key length is wrong */ public EdDSAPublicKeySpec(byte[] pk, EdDSAParameterSpec spec) { if (pk.length != spec.getCurve().getField().getb()/8) diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/Ed25519TestVectors.java b/core/java/test/junit/net/i2p/crypto/eddsa/Ed25519TestVectors.java index fd0e2ba3d..b309f0cd1 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/Ed25519TestVectors.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/Ed25519TestVectors.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import java.io.BufferedReader; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/EdDSAEngineTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/EdDSAEngineTest.java index bd75f18f2..e39281838 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/EdDSAEngineTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/EdDSAEngineTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import static org.hamcrest.Matchers.equalTo; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/UtilsTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/UtilsTest.java index b354b153a..e04cf1d31 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/UtilsTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/UtilsTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa; import org.hamcrest.core.IsEqual; @@ -105,6 +116,11 @@ public class UtilsTest { assertThat(Utils.bit(new byte[] {1, 2, 3}, 16), is(1)); } + @Test(expected = IllegalArgumentException.class) + public void hexToBytesThrowsOnInvalidLengthHexString() { + Utils.hexToBytes("bad"); + } + @Test public void hexToBytesReturnsCorrectByteArray() { Assert.assertThat(Utils.hexToBytes(hex1), IsEqual.equalTo(bytes1)); diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/AbstractFieldElementTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/AbstractFieldElementTest.java index 120747159..091afa04e 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/AbstractFieldElementTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/AbstractFieldElementTest.java @@ -1,6 +1,16 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; -import net.i2p.crypto.eddsa.math.*; import org.hamcrest.core.*; import org.junit.*; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/ConstantsTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/ConstantsTest.java index 1a54158e4..0054eaf08 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/ConstantsTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/ConstantsTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import static org.hamcrest.Matchers.equalTo; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/GroupElementTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/GroupElementTest.java index 06f3bc6cc..29297f6b5 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/GroupElementTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/GroupElementTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import net.i2p.crypto.eddsa.*; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/MathUtils.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/MathUtils.java index 0b45b7765..3e75952e7 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/MathUtils.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/MathUtils.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import net.i2p.crypto.eddsa.Utils; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/PrecomputationTestVectors.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/PrecomputationTestVectors.java index c956270ca..62bb8d898 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/PrecomputationTestVectors.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/PrecomputationTestVectors.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math; import java.io.BufferedReader; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElementTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElementTest.java index 12666f0a3..fdd443c49 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElementTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerFieldElementTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.bigint; import static org.hamcrest.Matchers.*; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOpsTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOpsTest.java index 3b8ae6edc..8e8040e40 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOpsTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/bigint/BigIntegerScalarOpsTest.java @@ -1,5 +1,13 @@ /** - * + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * */ package net.i2p.crypto.eddsa.math.bigint; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElementTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElementTest.java index 77db4937e..0c2bacfaf 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElementTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519FieldElementTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.ed25519; import net.i2p.crypto.eddsa.math.*; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncodingTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncodingTest.java index 2cb92d830..4bf39a74d 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncodingTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519LittleEndianEncodingTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.math.ed25519; import net.i2p.crypto.eddsa.math.*; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOpsTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOpsTest.java index ee0b976c6..cc01942f3 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOpsTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/math/ed25519/Ed25519ScalarOpsTest.java @@ -1,5 +1,13 @@ /** - * + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * */ package net.i2p.crypto.eddsa.math.ed25519; diff --git a/core/java/test/junit/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpecTest.java b/core/java/test/junit/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpecTest.java index 9eb0a5562..262e5e1a9 100644 --- a/core/java/test/junit/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpecTest.java +++ b/core/java/test/junit/net/i2p/crypto/eddsa/spec/EdDSAPrivateKeySpecTest.java @@ -1,3 +1,14 @@ +/** + * EdDSA-Java by str4d + * + * To the extent possible under law, the person who associated CC0 with + * EdDSA-Java has waived all copyright and related or neighboring rights + * to EdDSA-Java. + * + * You should have received a copy of the CC0 legalcode along with this + * work. If not, see . + * + */ package net.i2p.crypto.eddsa.spec; import static org.hamcrest.Matchers.*; @@ -38,7 +49,7 @@ public class EdDSAPrivateKeySpecTest { public void incorrectSeedLengthThrows() { exception.expect(IllegalArgumentException.class); exception.expectMessage("seed length is wrong"); - EdDSAPrivateKeySpec key = new EdDSAPrivateKeySpec(new byte[2], ed25519); + new EdDSAPrivateKeySpec(new byte[2], ed25519); } /** @@ -56,6 +67,6 @@ public class EdDSAPrivateKeySpecTest { public void incorrectHashLengthThrows() { exception.expect(IllegalArgumentException.class); exception.expectMessage("hash length is wrong"); - EdDSAPrivateKeySpec key = new EdDSAPrivateKeySpec(ed25519, new byte[2]); + new EdDSAPrivateKeySpec(ed25519, new byte[2]); } } diff --git a/history.txt b/history.txt index 4b5c1c536..af93bd1bb 100644 --- a/history.txt +++ b/history.txt @@ -1,3 +1,6 @@ +2019-08-10 str4d: + * EdDSA: Reduce diff between vendored code and upstream + 2019-08-05 zzz * i2ptunnel: - Add configs to override user agent diff --git a/licenses/LICENSE-CC0-1.0-Universal.txt b/licenses/LICENSE-CC0-1.0-Universal.txt new file mode 100644 index 000000000..bb127922f --- /dev/null +++ b/licenses/LICENSE-CC0-1.0-Universal.txt @@ -0,0 +1,123 @@ +Creative Commons Legal Code + +CC0 1.0 Universal + + CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE + LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN + ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS + INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES + REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS + PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM + THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED + HEREUNDER. + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer +exclusive Copyright and Related Rights (defined below) upon the creator +and subsequent owner(s) (each and all, an "owner") of an original work of +authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for +the purpose of contributing to a commons of creative, cultural and +scientific works ("Commons") that the public can reliably and without fear +of later claims of infringement build upon, modify, incorporate in other +works, reuse and redistribute as freely as possible in any form whatsoever +and for any purposes, including without limitation commercial purposes. +These owners may contribute to the Commons to promote the ideal of a free +culture and the further production of creative, cultural and scientific +works, or to gain reputation or greater distribution for their Work in +part through the use and efforts of others. + +For these and/or other purposes and motivations, and without any +expectation of additional consideration or compensation, the person +associating CC0 with a Work (the "Affirmer"), to the extent that he or she +is an owner of Copyright and Related Rights in the Work, voluntarily +elects to apply CC0 to the Work and publicly distribute the Work under its +terms, with knowledge of his or her Copyright and Related Rights in the +Work and the meaning and intended legal effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be +protected by copyright and related or neighboring rights ("Copyright and +Related Rights"). Copyright and Related Rights include, but are not +limited to, the following: + + i. the right to reproduce, adapt, distribute, perform, display, + communicate, and translate a Work; + ii. moral rights retained by the original author(s) and/or performer(s); +iii. publicity and privacy rights pertaining to a person's image or + likeness depicted in a Work; + iv. rights protecting against unfair competition in regards to a Work, + subject to the limitations in paragraph 4(a), below; + v. rights protecting the extraction, dissemination, use and reuse of data + in a Work; + vi. database rights (such as those arising under Directive 96/9/EC of the + European Parliament and of the Council of 11 March 1996 on the legal + protection of databases, and under any national implementation + thereof, including any amended or successor version of such + directive); and +vii. other similar, equivalent or corresponding rights throughout the + world based on applicable law or treaty, and any national + implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention +of, applicable law, Affirmer hereby overtly, fully, permanently, +irrevocably and unconditionally waives, abandons, and surrenders all of +Affirmer's Copyright and Related Rights and associated claims and causes +of action, whether now known or unknown (including existing as well as +future claims and causes of action), in the Work (i) in all territories +worldwide, (ii) for the maximum duration provided by applicable law or +treaty (including future time extensions), (iii) in any current or future +medium and for any number of copies, and (iv) for any purpose whatsoever, +including without limitation commercial, advertising or promotional +purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each +member of the public at large and to the detriment of Affirmer's heirs and +successors, fully intending that such Waiver shall not be subject to +revocation, rescission, cancellation, termination, or any other legal or +equitable action to disrupt the quiet enjoyment of the Work by the public +as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason +be judged legally invalid or ineffective under applicable law, then the +Waiver shall be preserved to the maximum extent permitted taking into +account Affirmer's express Statement of Purpose. In addition, to the +extent the Waiver is so judged Affirmer hereby grants to each affected +person a royalty-free, non transferable, non sublicensable, non exclusive, +irrevocable and unconditional license to exercise Affirmer's Copyright and +Related Rights in the Work (i) in all territories worldwide, (ii) for the +maximum duration provided by applicable law or treaty (including future +time extensions), (iii) in any current or future medium and for any number +of copies, and (iv) for any purpose whatsoever, including without +limitation commercial, advertising or promotional purposes (the +"License"). The License shall be deemed effective as of the date CC0 was +applied by Affirmer to the Work. Should any part of the License for any +reason be judged legally invalid or ineffective under applicable law, such +partial invalidity or ineffectiveness shall not invalidate the remainder +of the License, and in such case Affirmer hereby affirms that he or she +will not (i) exercise any of his or her remaining Copyright and Related +Rights in the Work or (ii) assert any associated claims and causes of +action with respect to the Work, in either case contrary to Affirmer's +express Statement of Purpose. + +4. Limitations and Disclaimers. + + a. No trademark or patent rights held by Affirmer are waived, abandoned, + surrendered, licensed or otherwise affected by this document. + b. Affirmer offers the Work as-is and makes no representations or + warranties of any kind concerning the Work, express, implied, + statutory or otherwise, including without limitation warranties of + title, merchantability, fitness for a particular purpose, non + infringement, or the absence of latent or other defects, accuracy, or + the present or absence of errors, whether or not discoverable, all to + the greatest extent permissible under applicable law. + c. Affirmer disclaims responsibility for clearing rights of other persons + that may apply to the Work or any use thereof, including without + limitation any person's Copyright and Related Rights in the Work. + Further, Affirmer disclaims responsibility for obtaining any necessary + consents, permissions or other rights required for any use of the + Work. + d. Affirmer understands and acknowledges that Creative Commons is not a + party to this document and has no duty or obligation with respect to + this CC0 or use of the Work. + +For more information, please see https://creativecommons.org/publicdomain/zero/1.0/