public static void crypto_sign2(Span <byte> sig, ReadOnlySpan <byte> m, ReadOnlySpan <byte> sk) { var hasher = new Sha512(); { hasher.Update(sk.Slice(0, 32)); Span <byte> az = stackalloc byte[64]; hasher.Finish(az); ScalarOperations.sc_clamp(az); hasher.Init(); hasher.Update(az.Slice(32, 32)); hasher.Update(m); Span <byte> r = stackalloc byte[64]; hasher.Finish(r); ScalarOperations.sc_reduce(r); GroupOperations.ge_scalarmult_base(out var R, r); GroupOperations.ge_p3_tobytes(sig, in R); hasher.Init(); hasher.Update(sig.Slice(0, 32)); hasher.Update(sk.Slice(32, 32)); hasher.Update(m); Span <byte> hram = stackalloc byte[64]; hasher.Finish(hram); ScalarOperations.sc_reduce(hram); ScalarOperations.sc_muladd(sig.Slice(32, 32), hram, az, r); } }
public static bool crypto_sign_verify(ReadOnlySpan <byte> sig, ReadOnlySpan <byte> m, ReadOnlySpan <byte> pk) { if ((sig[63] & 224) != 0) { return(false); } if (GroupOperations.ge_frombytes_negate_vartime(out var A, pk) != 0) { return(false); } var hasher = new Sha512(); hasher.Update(sig.Slice(0, 32)); hasher.Update(pk.Slice(0, 32)); hasher.Update(m); Span <byte> h = stackalloc byte[64]; hasher.Finish(h); ScalarOperations.sc_reduce(h); GroupOperations.ge_double_scalarmult_vartime(out var R, h, in A, sig.Slice(32, 32)); Span <byte> checkr = stackalloc byte[32]; GroupOperations.ge_tobytes(checkr, in R); var result = CryptoBytes.ConstantTimeEquals(checkr, sig, 32); CryptoBytes.Wipe(h); CryptoBytes.Wipe(checkr); return(result); }