Documentation
¶
Overview ¶
Package bp256 implements constant-time arithmetic for the brainpoolP256r1 elliptic curve (RFC 5639 §3.4), used by the parent brainpool package for the secret-scalar operations that must resist timing side channels: ECDSA signing and ECDH.
The design mirrors the Go standard library's crypto/internal/fips140/nistec: the field layer (package fiat) is machine-checked code generated by Fiat Cryptography, point arithmetic uses the exception-free complete addition formulas of Renes–Costello–Batina (2016) over homogeneous projective coordinates, and scalar multiplication uses a constant-time Montgomery ladder.
brainpoolP256r1 is a prime-order curve (cofactor 1) with a general coefficient a (a ≠ −3), so the general complete formula (RCB 2016, Algorithm 1) is used rather than the a = −3 specialization that nistec uses for the NIST curves.
This package is internal: callers go through the parent brainpool package.
Index ¶
- func ECDH(d []byte, peer *Point) ([]byte, error)
- func SignDeterministic(d, prehash []byte) (r, s []byte, err error)
- func SignWithNonce(d, k, prehash []byte) (r, s []byte, err error)
- type Point
- func (q *Point) Add(p1, p2 *Point) *Point
- func (p *Point) Bytes() []byte
- func (p *Point) BytesX() ([]byte, error)
- func (q *Point) Double(p *Point) *Point
- func (p *Point) IsInfinity() int
- func (p *Point) Negate(q *Point) *Point
- func (q *Point) ScalarBaseMult(scalar []byte) *Point
- func (q *Point) ScalarMult(p *Point, scalar []byte) *Point
- func (p *Point) Select(a, b *Point, cond int) *Point
- func (p *Point) Set(q *Point) *Point
- func (p *Point) SetBytes(b []byte) (*Point, error)
- func (p *Point) SetGenerator() *Point
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ECDH ¶
ECDH computes the brainpoolP256r1 ECDH shared secret per BSI TR-03111 §3.5.1: the x-coordinate of d·peer, returned as a 32-byte big-endian value. d is the private scalar (32-byte big-endian, in [1, n-1]); peer is the validated peer public point. It returns an error if the result is the point at infinity (the caller must reject and retry per the spec).
func SignDeterministic ¶
SignDeterministic signs prehash with private scalar d using an RFC 6979 deterministic nonce, and applies low-s normalisation. This is the default software-signing path: no RNG is consumed, so a weak or broken RNG cannot leak the key.
func SignWithNonce ¶
SignWithNonce produces an ECDSA signature (r, s) over prehash using private scalar d and the supplied per-message nonce k (both 32-byte big-endian, in [1, n-1]). It performs the scalar arithmetic in constant time and normalises s to low-s. It returns errSignZero if r or s is zero (caller retries with a fresh nonce); callers using deterministic nonces effectively never hit this.
Types ¶
type Point ¶
type Point struct {
// contains filtered or unexported fields
}
Point is a brainpoolP256r1 point in homogeneous projective coordinates (X:Y:Z), where the affine point is (X/Z, Y/Z) and the point at infinity is (0:1:0). The zero value is NOT valid; use NewPoint.
func NewPoint ¶
func NewPoint() *Point
NewPoint returns a new Point set to the point at infinity (0:1:0).
func (*Point) Add ¶
Add sets q = p1 + p2 and returns q. The points may overlap. It uses the complete (exception-free) addition formula for general short-Weierstrass curves: Renes–Costello–Batina, "Complete addition formulas for prime order elliptic curves" (https://eprint.iacr.org/2015/1060), Algorithm 1. Constants a and b3 = 3b are the curve parameters. brainpoolP256r1 has a ≠ −3, so the general Algorithm 1 is required rather than the a = −3 specialisation.
func (*Point) Bytes ¶
Bytes returns the SEC 1 uncompressed encoding of p, or the single-byte infinity encoding.
func (*Point) BytesX ¶
BytesX returns the big-endian encoding of the affine x-coordinate of p, or an error if p is the point at infinity. Used for ECDH (BSI TR-03111 §3.5.1).
func (*Point) Double ¶
Double sets q = p + p and returns q. Because Add is complete (handles the doubling case correctly), doubling is a special case of addition; using it here avoids carrying a second hand-transcribed formula.
func (*Point) IsInfinity ¶
IsInfinity returns 1 if p is the point at infinity, 0 otherwise.
func (*Point) ScalarBaseMult ¶
ScalarBaseMult sets q = scalar·G and returns q.
func (*Point) ScalarMult ¶
ScalarMult sets q = scalar·p and returns q, in constant time with respect to the value of scalar. scalar is a big-endian integer; every bit position is processed, so callers pass a fixed-width (32-byte) scalar to keep the running time independent of the secret's magnitude.
The algorithm is the Montgomery ladder built on the complete (exception-free) addition formula, so it has no scalar-bit-dependent branches and no special cases — the property the legacy big.Int path lacks (see the package doc).
func (*Point) Select ¶
Select sets p to a if cond == 1, and to b if cond == 0, in constant time, and returns p.
func (*Point) SetBytes ¶
SetBytes sets p to the uncompressed or infinity point encoded in b, per SEC 1 v2.0 §2.3.4, validating that the point is on the curve. Compressed encodings are not accepted (gematik uses uncompressed points exclusively). On error the receiver is unchanged.
func (*Point) SetGenerator ¶
SetGenerator sets p to the curve generator G and returns p.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package fiat provides constant-time arithmetic in the brainpoolP256r1 base field (integers modulo the field prime p, RFC 5639 §3.4).
|
Package fiat provides constant-time arithmetic in the brainpoolP256r1 base field (integers modulo the field prime p, RFC 5639 §3.4). |
|
Package fiatn provides constant-time arithmetic in the brainpoolP256r1 scalar field, i.e.
|
Package fiatn provides constant-time arithmetic in the brainpoolP256r1 scalar field, i.e. |