Documentation
¶
Overview ¶
Package ec implements the Edwards curves used by Olvid (spec Section 12): Curve25519 and MDC. All arithmetic is done with math/big; points are represented by their (x, y) affine coordinates, and a point whose x is unknown carries a nil X (the spec's "⊥").
Index ¶
- Constants
- func BigInt(rnd prng.PRNG, n *big.Int) (*big.Int, error)
- type Curve
- func (c *Curve) ByteLen() int
- func (c *Curve) Card() *big.Int
- func (c *Curve) D() *big.Int
- func (c *Curve) Equal(o *Curve) bool
- func (c *Curve) G() *Point
- func (c *Curve) GenerateRandomScalarAndPoint(rnd prng.PRNG) (lambda *big.Int, Q *Point, err error)
- func (c *Curve) IsOnCurve(x, y *big.Int) bool
- func (c *Curve) MulAdd(a *big.Int, p1 *Point, b *big.Int, p2 *Point) (Q, Qp *Point, err error)
- func (c *Curve) Name() string
- func (c *Curve) Nu() *big.Int
- func (c *Curve) P() *big.Int
- func (c *Curve) PointAddition(p1, p2 *Point) *Point
- func (c *Curve) Q() *big.Int
- func (c *Curve) ScalarMultiplication(n, y *big.Int) *big.Int
- func (c *Curve) ScalarMultiplicationWithX(n *big.Int, p *Point) (*Point, error)
- func (c *Curve) XCoordinatesFromY(y *big.Int) (x1, x2 *big.Int, err error)
- type Error
- type Point
Constants ¶
const ( // ErrNotOnCurve is returned when a point is not on the curve. ErrNotOnCurve = Error("point is not on the curve") // ErrNoSquareRoot is returned when a y-coordinate has no matching x. ErrNoSquareRoot = Error("no square root modulo p") )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Curve ¶
type Curve struct {
// contains filtered or unexported fields
}
Curve is an Edwards curve instance (a concrete subtype of the spec's EdwardsCurve abstract type).
func (*Curve) GenerateRandomScalarAndPoint ¶
GenerateRandomScalarAndPoint draws a scalar λ ∈ [2, q-1] and returns (λ, λ*G) (spec §12, curve.generateRandomScalarAndPoint).
NB: the spec writes λ = 2 + prng.bigInt(q-2); the reference implementation (and hence the test vectors) instead uses rejection sampling `do { λ = bigInt(q) } while λ ∈ {0, 1}`. We follow the implementation so the PRNG stream is consumed identically.
func (*Curve) IsOnCurve ¶
IsOnCurve reports whether (x, y) lies on the curve (spec §12):
x2 + y2 == 1 + d*x2*y2 (mod p) where x2 = x^2, y2 = y^2.
func (*Curve) MulAdd ¶
MulAdd computes Q = a*P1 + b*P2 (spec §12, curve.mulAdd). When p2.X is nil, only p2.Y is known and there are two candidates for Q, both returned. When p2.X is present, Q == Qp. Fails if a point is not on the curve or p2.Y is not a valid y-coordinate.
func (*Curve) PointAddition ¶
PointAddition returns P1 + P2 on the curve (spec §12, curve.pointAddition). It does NOT check that the inputs are on the curve.
func (*Curve) ScalarMultiplication ¶
ScalarMultiplication returns the y-coordinate of nP given only the y-coordinate of P (spec §12, curve.scalarMultiplication).
The negation of an Edwards-curve point is (x, y) -> (-x, y), so P and its two x-roots (x, -x) are negatives of each other and nP, n(-P) share the same y-coordinate. We therefore recover any x for y and reuse the full Montgomery ladder; the result y is independent of the chosen sign. Returns nil when y is not a valid curve y-coordinate (no x exists).
func (*Curve) ScalarMultiplicationWithX ¶
ScalarMultiplicationWithX returns both coordinates of nP using a Montgomery ladder over point additions (spec §12, curve.scalarMultiplicationWithX). It fails if P is not on the curve.
func (*Curve) XCoordinatesFromY ¶
XCoordinatesFromY returns the two possible x-coordinates (x, -x mod p) for a point on the curve given its y-coordinate, or an error when y is not the y-coordinate of any curve point (spec §12, curve.xCoordinatesFromY).
Source Files