public static int curve25519_verify(ISha512 sha512provider, byte[] signature, byte[] curve25519_pubkey, byte[] msg, int msg_len) { int[] mont_x = new int[10]; int[] mont_x_minus_one = new int[10]; int[] mont_x_plus_one = new int[10]; int[] inv_mont_x_plus_one = new int[10]; int[] one = new int[10]; int[] ed_y = new int[10]; byte[] ed_pubkey = new byte[32]; long some_retval = 0; byte[] verifybuf = new byte[msg_len + 64]; /* working buffer */ byte[] verifybuf2 = new byte[msg_len + 64]; /* working buffer #2 */ /* Convert the Curve25519 public key into an Ed25519 public key. In * particular, convert Curve25519's "montgomery" x-coordinate into an * Ed25519 "edwards" y-coordinate: * * ed_y = (mont_x - 1) / (mont_x + 1) * * NOTE: mont_x=-1 is converted to ed_y=0 since fe_invert is mod-exp * * Then move the sign bit into the pubkey from the signature. */ Fe_frombytes.fe_frombytes(mont_x, curve25519_pubkey); Fe_1.fe_1(one); Fe_sub.fe_sub(mont_x_minus_one, mont_x, one); Fe_add.fe_add(mont_x_plus_one, mont_x, one); Fe_invert.fe_invert(inv_mont_x_plus_one, mont_x_plus_one); Fe_mul.fe_mul(ed_y, mont_x_minus_one, inv_mont_x_plus_one); Fe_tobytes.fe_tobytes(ed_pubkey, ed_y); /* Copy the sign bit, and remove it from signature */ ed_pubkey[31] &= 0x7F; /* bit should be zero already, but just in case */ ed_pubkey[31] |= (byte)(signature[63] & 0x80); Array.Copy(signature, 0, verifybuf, 0, 64); verifybuf[63] &= 0x7F; Array.Copy(msg, 0, verifybuf, 64, (int)msg_len); /* Then perform a normal Ed25519 verification, return 0 on success */ /* The below call has a strange API: */ /* verifybuf = R || S || message */ /* verifybuf2 = java to next call gets a copy of verifybuf, S gets * replaced with pubkey for hashing, then the whole thing gets zeroized * (if bad sig), or contains a copy of msg (good sig) */ return(Open.crypto_sign_open(sha512provider, verifybuf2, some_retval, verifybuf, 64 + msg_len, ed_pubkey)); }
public static void elligator(int[] u, int[] r) { /* r = input * x = -A/(1+2r^2) # 2 is nonsquare * e = (x^3 + Ax^2 + x)^((q-1)/2) # legendre symbol * if e == 1 (square) or e == 0 (because x == 0 and 2r^2 + 1 == 0) * u = x * if e == -1 (nonsquare) * u = -x - A */ int[] A = new int[10]; int[] one = new int[10]; int[] twor2 = new int[10]; int[] twor2plus1 = new int[10]; int[] twor2plus1inv = new int[10]; int[] x = new int[10]; int[] e = new int[10]; int[] Atemp = new int[10]; int[] uneg = new int[10]; int nonsquare; Fe_1.fe_1(one); Fe_0.fe_0(A); A[0] = 486662; /* A = 486662 */ Fe_sq2.fe_sq2(twor2, r); /* 2r^2 */ Fe_add.fe_add(twor2plus1, twor2, one); /* 1+2r^2 */ Fe_invert.fe_invert(twor2plus1inv, twor2plus1); /* 1/(1+2r^2) */ Fe_mul.fe_mul(x, twor2plus1inv, A); /* A/(1+2r^2) */ Fe_neg.fe_neg(x, x); /* x = -A/(1+2r^2) */ Fe_mont_rhs.fe_mont_rhs(e, x); /* e = x^3 + Ax^2 + x */ nonsquare = legendre_is_nonsquare(e); Fe_0.fe_0(Atemp); Fe_cmov.fe_cmov(Atemp, A, nonsquare); /* 0, or A if nonsquare */ Fe_add.fe_add(u, x, Atemp); /* x, or x+A if nonsquare */ Fe_neg.fe_neg(uneg, u); /* -x, or -x-A if nonsquare */ Fe_cmov.fe_cmov(u, uneg, nonsquare); /* x, or -x-A if nonsquare */ }