/// <summary>
/// Multily elliptic curve point and scalar.
/// </summary>
/// <remarks>
/// Y^2 = X^3 + A*X + B (mod p)
/// </remarks>
/// <param name="eccSize"></param>
/// <param name="p">Point to multiply</param>
/// <param name="n">Scalar to multiply</param>
/// <param name="N">Elliptic curve order.</param>
/// <param name="A"></param>
/// <param name="P">Prime number</param>
internal static GXEccPoint JacobianMultiply(GXEccPoint p, GXBigInteger n, GXBigInteger N, GXBigInteger A, GXBigInteger P)
{
GXBigInteger tmp;
if (p.y.IsZero || n.IsZero)
{
return(new GXEccPoint(0, 0, 1));
}
if (n.IsOne)
{
return(p);
}
if (n.Compare(0) == -1 || n.Compare(N) != -1)
{
tmp = new GXBigInteger(n);
tmp.Mod(N);
return(JacobianMultiply(p, tmp, N, A, P));
}
if (n.IsEven)
{
tmp = new GXBigInteger(n);
tmp.Rshift(1);
return(JacobianDouble(JacobianMultiply(p, tmp, N, A, P), A, P));
}
tmp = new GXBigInteger(n);
tmp.Rshift(1);
GXEccPoint p2 = JacobianDouble(JacobianMultiply(p, tmp, N, A, P), A, P);
JacobianAdd(p2, p, A, P);
return(p2);
}
private static void Multiply(GXEccPoint p, GXBigInteger n, GXBigInteger N, GXBigInteger A, GXBigInteger P)
{
GXEccPoint p2 = JacobianMultiply(p, n, N, A, P);
p.x = p2.x;
p.y = p2.y;
p.z = p2.z;
FromJacobian(p, P);
}
/// <summary>
/// Verify that signature matches the data.
/// </summary>
/// <param name="signature">Generated signature.</param>
/// <param name="data">Data to valuate.</param>
/// <returns></returns>
public bool Verify(byte[] signature, byte[] data)
{
GXBigInteger msg;
if (PublicKey == null)
{
if (PrivateKey == null)
{
throw new ArgumentNullException("Invalid private key.");
}
PublicKey = PrivateKey.GetPublicKey();
}
if (PublicKey.Scheme == Ecc.P256)
{
using (SHA256 sha = new SHA256CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
}
else
{
using (SHA384 sha = new SHA384CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
}
GXByteBuffer pk = new GXByteBuffer(PublicKey.RawValue);
GXByteBuffer bb = new GXByteBuffer(signature);
int size = SchemeSize(PublicKey.Scheme);
GXBigInteger sigR = new GXBigInteger(bb.SubArray(0, size));
GXBigInteger sigS = new GXBigInteger(bb.SubArray(size, size));
GXBigInteger inv = sigS;
inv.Inv(curve.N);
// Calculate u1 and u2.
GXEccPoint u1 = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
GXEccPoint u2 = new GXEccPoint(new GXBigInteger(pk.SubArray(1, size)),
new GXBigInteger(pk.SubArray(1 + size, size)), new GXBigInteger(1));
GXBigInteger n = msg;
n.Multiply(inv);
n.Mod(curve.N);
Multiply(u1, n, curve.N, curve.A, curve.P);
n = new GXBigInteger(sigR);
n.Multiply(inv);
n.Mod(curve.N);
Multiply(u2, n, curve.N, curve.A, curve.P);
u1.z = new GXBigInteger(1);
u2.z = new GXBigInteger(1);
JacobianAdd(u1, u2, curve.A, curve.P);
FromJacobian(u1, curve.P);
return(sigR.Compare(u1.x) == 0);
}
/// <summary>
/// Get ECC point from Jacobian coordinates.
/// </summary>
/// <param name="p"></param>
/// <param name="P"></param>
internal static void FromJacobian(GXEccPoint p, GXBigInteger P)
{
p.z.Inv(P);
p.x.Multiply(p.z);
p.x.Multiply(p.z);
p.x.Mod(P);
p.y.Multiply(p.z);
p.y.Multiply(p.z);
p.y.Multiply(p.z);
p.y.Mod(P);
p.z.Clear();
}
/// <summary>
/// Convert ECC point to Jacobian.
/// </summary>
/// <param name="p">ECC point.</param>
/// <param name="A"></param>
/// <param name="P">Prime number.</param>
/// <returns></returns>
private static GXEccPoint JacobianDouble(GXEccPoint p, GXBigInteger A, GXBigInteger P)
{
GXBigInteger ysq = new GXBigInteger(p.y);
ysq.Multiply(p.y);
ysq.Mod(P);
GXBigInteger S = new GXBigInteger(p.x);
S.Multiply(new GXBigInteger(4));
S.Multiply(ysq);
S.Mod(P);
GXBigInteger M = new GXBigInteger(p.x);
M.Multiply(p.x);
M.Multiply(new GXBigInteger(3));
GXBigInteger tmp = new GXBigInteger(p.z);
tmp.Multiply(p.z);
tmp.Multiply(p.z);
tmp.Multiply(p.z);
tmp.Multiply(A);
M.Add(tmp);
M.Mod(P);
//nx
GXBigInteger nx = new GXBigInteger(M);
nx.Multiply(M);
tmp = new GXBigInteger(S);
tmp.Multiply(new GXBigInteger(2));
nx.Sub(tmp);
nx.Mod(P);
//ny
GXBigInteger ny = new GXBigInteger(S);
ny.Sub(nx);
ny.Multiply(M);
tmp = new GXBigInteger(ysq);
tmp.Multiply(ysq);
tmp.Multiply(new GXBigInteger(8));
ny.Sub(tmp);
ny.Mod(P);
//nz
GXBigInteger nz = new GXBigInteger(p.y);
nz.Multiply(p.z);
nz.Multiply(new GXBigInteger(2));
nz.Mod(P);
return(new GXEccPoint(nx, ny, nz));
}
/// <summary>
/// Sign given data using public and private key.
/// </summary>
/// <param name="data">Data to sign.</param>
/// <returns>Signature</returns>
public byte[] Sign(byte[] data)
{
if (PrivateKey == null)
{
throw new ArgumentException("Invalid private key.");
}
GXBigInteger msg;
if (PrivateKey.Scheme == Ecc.P256)
{
using (SHA256 sha = new SHA256CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
}
else
{
using (SHA384 sha = new SHA384CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
}
GXBigInteger pk = new GXBigInteger(PrivateKey.RawValue);
GXEccPoint p;
GXBigInteger n;
GXBigInteger r;
GXBigInteger s;
do
{
n = GetRandomNumber(PrivateKey.Scheme);
p = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
Multiply(p, n, curve.N, curve.A, curve.P);
r = p.x;
r.Mod(curve.N);
n.Inv(curve.N);
//s
s = new GXBigInteger(r);
s.Multiply(pk);
s.Add(msg);
s.Multiply(n);
s.Mod(curve.N);
} while (r.IsZero || s.IsZero);
GXByteBuffer signature = new GXByteBuffer();
signature.Set(r.ToArray());
signature.Set(s.ToArray());
return(signature.Array());
}
/// <summary>
/// Get public key from private key.
/// </summary>
/// <param name="scheme">Used scheme.</param>
/// <param name="privateKey">Private key bytes.</param>
/// <returns>Public key.</returns>
public GXPublicKey GetPublicKey()
{
GXBigInteger secret = new GXBigInteger(RawValue);
GXCurve curve = new GXCurve(Scheme);
GXEccPoint p = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
p = GXEcdsa.JacobianMultiply(p, secret, curve.N, curve.A, curve.P);
GXEcdsa.FromJacobian(p, curve.P);
GXByteBuffer key = new GXByteBuffer(65);
//Public key is un-compressed format.
key.SetUInt8(4);
byte[] tmp = p.x.ToArray();
key.Set(tmp, tmp.Length % 32, 32);
tmp = p.y.ToArray();
key.Set(tmp, tmp.Length % 32, 32);
return(GXPublicKey.FromRawBytes(key.Array()));
}
/// <summary>
/// Constructor.
/// </summary>
/// <param name="a">ECC curve a value.</param>
/// <param name="b">ECC curve b parameter.</param>
/// <param name="p">ECC curve p value.</param>
/// <param name="g">x and y-coordinate of base point G</param>
/// <param name="n">Order of point G in ECC curve.</param>
public GXCurve(Ecc scheme)
{
if (scheme == Ecc.P256)
{
//Table A. 1 – ECC_P256_Domain_Parameters
A = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0x00000001, 0x00000000, 0x00000000,
0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC });
G = new GXEccPoint(new GXBigInteger(new UInt32[] { 0x6B17D1F2, 0xE12C4247, 0xF8BCE6E5, 0x63A440F2,
0x77037D81, 0x2DEB33A0, 0xF4A13945, 0xD898C296 }),
new GXBigInteger(new UInt32[] { 0x4FE342E2, 0xFE1A7F9B, 0x8EE7EB4A, 0x7C0F9E16,
0x2BCE3357, 0x6B315ECE, 0xCBB64068, 0x37BF51F5 }), new GXBigInteger(1));
N = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0x00000000, 0xFFFFFFFF,
0xFFFFFFFF, 0xBCE6FAAD, 0xA7179E84, 0xF3B9CAC2, 0xFC632551 });
P = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0x00000001, 0x00000000,
0x00000000, 0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF });
B = new GXBigInteger(new UInt32[] { 0x5AC635D8, 0xAA3A93E7, 0xB3EBBD55, 0x769886BC,
0x651D06B0, 0xCC53B0F6, 0x3BCE3C3E, 0x27D2604B });
}
else if (scheme == Ecc.P384)
{
//Table A. 2 – ECC_P384_Domain_Parameters
A = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE,
0xFFFFFFFF, 0x00000000, 0x00000000, 0xFFFFFFFC });
G = new GXEccPoint(new GXBigInteger(new UInt32[] { 0xAA87CA22, 0xBE8B0537, 0x8EB1C71E, 0xF320AD74,
0x6E1D3B62, 0x8BA79B98, 0x59F741E0, 0x82542A38,
0x5502F25D, 0xBF55296C, 0x3A545E38, 0x72760AB7 }),
new GXBigInteger(new UInt32[] { 0x3617DE4A, 0x96262C6F, 0x5D9E98BF, 0x9292DC29,
0xF8F41DBD, 0x289A147C, 0xE9DA3113, 0xB5F0B8C0,
0x0A60B1CE, 0x1D7E819D, 0x7A431D7C, 0x90EA0E5F }), new GXBigInteger(1));
N = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
0xFFFFFFFF, 0xFFFFFFFF, 0xC7634D81, 0xF4372DDF,
0x581A0DB2, 0x48B0A77A, 0xECEC196A, 0xCCC52973 });
P = new GXBigInteger(new UInt32[] { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE,
0xFFFFFFFF, 0x00000000, 0x00000000, 0xFFFFFFFF });
B = new GXBigInteger(new UInt32[] { 0xB3312FA7, 0xE23EE7E4, 0x988E056B, 0xE3F82D19, 0x181D9C6E,
0xFE814112, 0x0314088F, 0x5013875A, 0xC656398D, 0x8A2ED19D, 0x2A85C8ED, 0xD3EC2AEF });
}
else
{
throw new ArgumentOutOfRangeException("Invalid scheme.");
}
}
/// <summary>
/// Get public key from private key.
/// </summary>
/// <param name="scheme">Used scheme.</param>
/// <param name="privateKey">Private key bytes.</param>
/// <returns>Public key.</returns>
public GXPublicKey GetPublicKey()
{
if (publicKey == null)
{
GXBigInteger pk = new GXBigInteger(RawValue);
GXCurve curve = new GXCurve(Scheme);
GXEccPoint p = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
p = GXEcdsa.JacobianMultiply(p, pk, curve.N, curve.A, curve.P);
GXEcdsa.FromJacobian(p, curve.P);
GXByteBuffer key = new GXByteBuffer(65);
//Public key is un-compressed format.
key.SetUInt8(4);
byte[] tmp = p.x.ToArray();
int size = Scheme == Ecc.P256 ? 32 : 48;
key.Set(tmp, tmp.Length % size, size);
tmp = p.y.ToArray();
key.Set(tmp, tmp.Length % size, size);
publicKey = GXPublicKey.FromRawBytes(key.Array());
}
return(publicKey);
}
/// <summary>
/// Verify that signature matches the data.
/// </summary>
/// <param name="signature">Generated signature.</param>
/// <param name="data">Data to valuate.</param>
/// <returns></returns>
public bool Verify(byte[] signature, byte[] data)
{
GXBigInteger msg;
using (SHA256 sha = new SHA256CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
if (PublicKey == null)
{
PublicKey = PrivateKey.GetPublicKey();
}
GXByteBuffer pk = new GXByteBuffer(PublicKey.RawValue);
GXByteBuffer bb = new GXByteBuffer(signature);
GXBigInteger sigR = new GXBigInteger(bb.SubArray(0, 32));
GXBigInteger sigS = new GXBigInteger(bb.SubArray(32, 32));
GXBigInteger inv = sigS;
inv.Inv(curve.N);
// Calculate u1 and u2.
GXEccPoint u1 = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
GXEccPoint u2 = new GXEccPoint(new GXBigInteger(pk.SubArray(1, 32)), new GXBigInteger(pk.SubArray(33, 32)), new GXBigInteger(1));
GXBigInteger n = msg;
n.Multiply(inv);
n.Mod(curve.N);
Multiply(u1, n, curve.N, curve.A, curve.P);
n = new GXBigInteger(sigR);
n.Multiply(inv);
n.Mod(curve.N);
Multiply(u2, n, curve.N, curve.A, curve.P);
// add = Math.add(u1, u2, P = curve.P, A = curve.A)
u1.z = new GXBigInteger(1);
u2.z = new GXBigInteger(1);
JacobianAdd(u1, u2, curve.A, curve.P);
FromJacobian(u1, curve.P);
return(sigR.Compare(u1.x) == 0);
}
/// <summary>
/// Generate shared secret from public and private key.
/// </summary>
/// <param name="publicKey">Public key.</param>
/// <returns>Generated secret.</returns>
public byte[] GenerateSecret(GXPublicKey publicKey)
{
if (PrivateKey == null)
{
throw new ArgumentNullException("Invalid private key.");
}
if (PrivateKey.Scheme != publicKey.Scheme)
{
throw new ArgumentNullException("Private key scheme is different than public key.");
}
GXByteBuffer bb = new GXByteBuffer();
bb.Set(publicKey.RawValue);
int size = SchemeSize(PrivateKey.Scheme);
GXBigInteger x = new GXBigInteger(bb.SubArray(1, size));
GXBigInteger y = new GXBigInteger(bb.SubArray(1 + size, size));
GXBigInteger pk = new GXBigInteger(PrivateKey.RawValue);
GXCurve curve = new GXCurve(PrivateKey.Scheme);
GXEccPoint p = new GXEccPoint(x, y, new GXBigInteger(1));
p = JacobianMultiply(p, pk, curve.N, curve.A, curve.P);
FromJacobian(p, curve.P);
return(p.x.ToArray());
}
/// <summary>
/// Sign given data using public and private key.
/// </summary>
/// <param name="data">Data to sign.</param>
/// <returns>Signature</returns>
public byte[] Sign(byte[] data)
{
if (PrivateKey == null)
{
throw new ArgumentException("Invalid private key.");
}
GXBigInteger msg;
using (SHA256 sha = new SHA256CryptoServiceProvider())
{
msg = new GXBigInteger(sha.ComputeHash(data));
}
GXBigInteger pk = new GXBigInteger(PrivateKey.RawValue);
GXEccPoint p;
GXBigInteger n = new GXBigInteger(10);
GXBigInteger r;
GXBigInteger s;
do
{
if (CustomRandomNumber != null)
{
n = CustomRandomNumber;
}
else
{
n = GetRandomNumber(PrivateKey.Scheme);
}
p = new GXEccPoint(curve.G.x, curve.G.y, new GXBigInteger(1));
Multiply(p, n, curve.N, curve.A, curve.P);
r = p.x;
r.Mod(curve.N);
n.Inv(curve.N);
//s
s = new GXBigInteger(r);
s.Multiply(pk);
s.Add(msg);
s.Multiply(n);
s.Mod(curve.N);
} while (r.IsZero || s.IsZero);
byte recoveryId;
if (p.y.IsOne)
{
recoveryId = 1;
}
else
{
recoveryId = 0;
}
if (p.y.Compare(curve.N) == 1)
{
recoveryId += 2;
}
GXByteBuffer signature = new GXByteBuffer();
signature.Set(r.ToArray());
signature.Set(s.ToArray());
return(signature.Array());
}
/// <summary>
/// Y^2 = X^3 + A*X + B (mod p)
/// </summary>
/// <param name="p"></param>
/// <param name="q"></param>
/// <param name="A"></param>
/// <param name="P">Prime number</param>
private static void JacobianAdd(GXEccPoint p, GXEccPoint q, GXBigInteger A, GXBigInteger P)
{
if (!(p.y.IsZero || q.y.IsZero))
{
GXBigInteger U1 = new GXBigInteger(p.x);
U1.Multiply(q.z);
U1.Multiply(q.z);
U1.Mod(P);
GXBigInteger U2 = new GXBigInteger(p.z);
U2.Multiply(p.z);
U2.Multiply(q.x);
U2.Mod(P);
GXBigInteger S1 = new GXBigInteger(p.y);
S1.Multiply(q.z);
S1.Multiply(q.z);
S1.Multiply(q.z);
S1.Mod(P);
GXBigInteger S2 = new GXBigInteger(q.y);
S2.Multiply(p.z);
S2.Multiply(p.z);
S2.Multiply(p.z);
S2.Mod(P);
if (U1.Compare(U2) == 0)
{
if (S1.Compare(S2) != 0)
{
p.x = p.y = new GXBigInteger(0);
p.z = new GXBigInteger(1);
}
else
{
p.x = A;
p.y = P;
}
}
//H
GXBigInteger H = U2;
H.Sub(U1);
//R
GXBigInteger R = S2;
R.Sub(S1);
GXBigInteger H2 = new GXBigInteger(H);
H2.Multiply(H);
H2.Mod(P);
GXBigInteger H3 = new GXBigInteger(H);
H3.Multiply(H2);
H3.Mod(P);
GXBigInteger U1H2 = new GXBigInteger(U1);
U1H2.Multiply(H2);
U1H2.Mod(P);
GXBigInteger tmp = new GXBigInteger(2);
tmp.Multiply(U1H2);
//nx
GXBigInteger nx = new GXBigInteger(R);
nx.Multiply(R);
nx.Sub(H3);
nx.Sub(tmp);
nx.Mod(P);
//ny
GXBigInteger ny = R;
tmp = new GXBigInteger(U1H2);
tmp.Sub(nx);
ny.Multiply(tmp);
tmp = new GXBigInteger(S1);
tmp.Multiply(H3);
ny.Sub(tmp);
ny.Mod(P);
//nz
GXBigInteger nz = H;
nz.Multiply(p.z);
nz.Multiply(q.z);
nz.Mod(P);
p.x = nx;
p.y = ny;
p.z = nz;
}
}