/// <summary>
/// Decodes a point on the curve in accordance with §5.1.3 of RFC 8032.
/// </summary>
/// <param name="Encoded">Encoded point.</param>
/// <param name="Curve">Elliptic curve</param>
/// <returns>Point on curve.</returns>
public static PointOnCurve Decode(byte[] Encoded, EdwardsCurveBase Curve)
{
int ScalarBits = Curve.CoordinateBits;
int ScalarBytes = (ScalarBits + 9) >> 3;
if (Encoded.Length != ScalarBytes)
{
throw new ArgumentException("Not encoded properly.", nameof(Encoded));
}
bool x0 = (Encoded[ScalarBytes - 1] & 0x80) != 0;
if (x0)
{
Encoded[ScalarBytes - 1] &= 0x7f;
}
BigInteger y = EllipticCurve.ToInt(Encoded);
if (y >= Curve.Prime)
{
throw new ArgumentException("Not a valid point.", nameof(Encoded));
}
if (x0)
{
Encoded[ScalarBytes - 1] |= 0x80;
}
BigInteger x = Curve.GetX(y, x0);
return(new PointOnCurve(x, y));
}
/// <summary>
/// Verifies a signature of <paramref name="Data"/> made by the EdDSA algorithm.
/// </summary>
/// <param name="Data">Payload to sign.</param>
/// <param name="PublicKey">Public Key of the entity that generated the signature.</param>
/// <param name="HashFunction">Hash function to use.</param>
/// <param name="Curve">Elliptic curve</param>
/// <param name="Signature">Signature</param>
/// <returns>If the signature is valid.</returns>
public static bool Verify(Stream Data, byte[] PublicKey, HashFunctionStream HashFunction,
EdwardsCurveBase Curve, byte[] Signature)
{
try
{
int ScalarBytes = Signature.Length;
if ((ScalarBytes & 1) != 0)
{
return(false);
}
ScalarBytes >>= 1;
byte[] R = new byte[ScalarBytes];
Array.Copy(Signature, 0, R, 0, ScalarBytes);
PointOnCurve r = Decode(R, Curve);
byte[] S = new byte[ScalarBytes];
Array.Copy(Signature, ScalarBytes, S, 0, ScalarBytes);
BigInteger s = EllipticCurve.ToInt(S);
byte[] h;
if (s >= Curve.Order)
{
return(false);
}
using (TemporaryStream TempFile = new TemporaryStream()) // dom2(F, C) = blank string
{
TempFile.Write(R, 0, ScalarBytes);
TempFile.Write(PublicKey, 0, ScalarBytes);
Data.Position = 0;
Data.CopyTo(TempFile); // PH(M)=M
TempFile.Position = 0;
h = HashFunction(TempFile);
}
BigInteger k = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
PointOnCurve P1 = Curve.ScalarMultiplication(s, Curve.BasePoint, false);
PointOnCurve P2 = Curve.ScalarMultiplication(k, Curve.Decode(PublicKey), false);
Curve.AddTo(ref P2, r);
P1.Normalize(Curve);
P2.Normalize(Curve);
return(P1.Equals(P2));
}
catch (ArgumentException)
{
return(false);
}
}
/// <summary>
/// Verifies a signature of <paramref name="Data"/> made by the ECDSA algorithm.
/// </summary>
/// <param name="Data">Payload to sign.</param>
/// <param name="PublicKey">Public Key of the entity that generated the signature.</param>
/// <param name="HashFunction">Hash function to use.</param>
/// <param name="Curve">Elliptic curve</param>
/// <param name="ScalarBytes">Number of bytes to use for scalars.</param>
/// <param name="MsbMask">Mask for most significant byte.</param>
/// <param name="Signature">Signature</param>
/// <returns>If the signature is valid.</returns>
public static bool Verify(byte[] Data, byte[] PublicKey, HashFunction HashFunction,
int ScalarBytes, byte MsbMask, PrimeFieldCurve Curve, byte[] Signature)
{
int c = Signature.Length;
if (c != ScalarBytes << 1)
{
return(false);
}
c >>= 1;
byte[] Bin = new byte[c];
Array.Copy(Signature, 0, Bin, 0, c);
BigInteger r = EllipticCurve.ToInt(Bin);
Bin = new byte[c];
Array.Copy(Signature, c, Bin, 0, c);
BigInteger s = EllipticCurve.ToInt(Bin);
PointOnCurve PublicKeyPoint = Curve.Decode(PublicKey);
if (!PublicKeyPoint.NonZero || r.IsZero || s.IsZero || r >= Curve.Order || s >= Curve.Order)
{
return(false);
}
BigInteger e = CalcE(Data, HashFunction, ScalarBytes, MsbMask);
BigInteger w = Curve.ModulusN.Invert(s);
BigInteger u1 = Curve.ModulusN.Multiply(e, w);
BigInteger u2 = Curve.ModulusN.Multiply(r, w);
PointOnCurve P2 = Curve.ScalarMultiplication(u1, Curve.BasePoint, true);
PointOnCurve P3 = Curve.ScalarMultiplication(u2, PublicKeyPoint, true);
Curve.AddTo(ref P2, P3);
if (!P2.NonZero)
{
return(false);
}
P2.Normalize(Curve);
BigInteger Compare = BigInteger.Remainder(P2.X, Curve.Order);
if (Compare.Sign < 0)
{
Compare += Curve.Order;
}
return(Compare == r);
}
/// <summary>
/// Signs data using the EdDSA algorithm.
/// </summary>
/// <param name="Data">Data to be signed.</param>
/// <param name="PrivateKey">Private key.</param>
/// <param name="Prefix">Prefix</param>
/// <param name="HashFunction">Hash function to use</param>
/// <param name="Curve">Elliptic curve</param>
/// <returns>Signature</returns>
public static byte[] Sign(byte[] Data, byte[] PrivateKey, byte[] Prefix,
HashFunctionArray HashFunction, EdwardsCurveBase Curve)
{
// 5.1.6 of RFC 8032
int ScalarBytes = PrivateKey.Length;
if (Prefix.Length != ScalarBytes)
{
throw new ArgumentException("Invalid prefix.", nameof(Prefix));
}
BigInteger a = EllipticCurve.ToInt(PrivateKey);
PointOnCurve P = Curve.ScalarMultiplication(PrivateKey, Curve.BasePoint, true);
byte[] A = Encode(P, Curve);
int c = Data.Length;
byte[] Bin = new byte[ScalarBytes + c]; // dom2(F, C) = blank string
Array.Copy(Prefix, 0, Bin, 0, ScalarBytes); // prefix
Array.Copy(Data, 0, Bin, ScalarBytes, c); // PH(M)=M
byte[] h = HashFunction(Bin);
BigInteger r = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
PointOnCurve R = Curve.ScalarMultiplication(r, Curve.BasePoint, true);
byte[] Rs = Encode(R, Curve);
Bin = new byte[(ScalarBytes << 1) + c]; // dom2(F, C) = blank string
Array.Copy(Rs, 0, Bin, 0, ScalarBytes);
Array.Copy(A, 0, Bin, ScalarBytes, ScalarBytes);
Array.Copy(Data, 0, Bin, ScalarBytes << 1, c); // PH(M)=M
h = HashFunction(Bin);
BigInteger k = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
BigInteger s = Curve.ModulusN.Add(r, Curve.ModulusN.Multiply(k, a));
Bin = s.ToByteArray();
if (Bin.Length != ScalarBytes)
{
Array.Resize <byte>(ref Bin, ScalarBytes);
}
byte[] Signature = new byte[ScalarBytes << 1];
Array.Copy(Rs, 0, Signature, 0, ScalarBytes);
Array.Copy(Bin, 0, Signature, ScalarBytes, ScalarBytes);
return(Signature);
}
/// <summary>
/// Signs data using the ECDSA algorithm.
/// </summary>
/// <param name="Data">Data to be signed.</param>
/// <param name="PrivateKey">Private key.</param>
/// <param name="HashFunction">Hash function to use</param>
/// <param name="ScalarBytes">Number of bytes to use for scalars.</param>
/// <param name="MsbMask">Mask for most significant byte.</param>
/// <param name="Curve">Elliptic curve</param>
/// <returns>Signature</returns>
public static byte[] Sign(byte[] Data, byte[] PrivateKey, HashFunction HashFunction,
int ScalarBytes, byte MsbMask, PrimeFieldCurve Curve)
{
BigInteger e = CalcE(Data, HashFunction, ScalarBytes, MsbMask);
BigInteger r, s, PrivateKeyInt = EllipticCurve.ToInt(PrivateKey);
PointOnCurve P1;
byte[] k;
do
{
do
{
k = Curve.GenerateSecret();
P1 = Curve.ScalarMultiplication(k, Curve.BasePoint, true);
}while (P1.IsXZero);
r = BigInteger.Remainder(P1.X, Curve.Order);
s = Curve.ModulusN.Divide(Curve.ModulusN.Add(e,
Curve.ModulusN.Multiply(r, PrivateKeyInt)), EllipticCurve.ToInt(k));
}while (s.IsZero);
if (r.Sign < 0)
{
r += Curve.Prime;
}
P1.Normalize(Curve);
byte[] Signature = new byte[ScalarBytes << 1];
byte[] S = r.ToByteArray();
if (S.Length != ScalarBytes)
{
Array.Resize <byte>(ref S, ScalarBytes);
}
Array.Copy(S, 0, Signature, 0, ScalarBytes);
S = s.ToByteArray();
if (S.Length != ScalarBytes)
{
Array.Resize <byte>(ref S, ScalarBytes);
}
Array.Copy(S, 0, Signature, ScalarBytes, ScalarBytes);
return(Signature);
}
private static BigInteger CalcE(byte[] Data, HashFunction HashFunction,
int ScalarBytes, byte MsbMask)
{
byte[] Hash = HashFunction(Data);
int c = Hash.Length;
if (c != ScalarBytes)
{
Array.Resize <byte>(ref Hash, ScalarBytes);
}
Hash[ScalarBytes - 1] &= MsbMask;
return(EllipticCurve.ToInt(Hash));
}
/// <summary>
/// Verifies a signature of <paramref name="Data"/> made by the EdDSA algorithm.
/// </summary>
/// <param name="Data">Payload to sign.</param>
/// <param name="PublicKey">Public Key of the entity that generated the signature.</param>
/// <param name="HashFunction">Hash function to use.</param>
/// <param name="Curve">Elliptic curve</param>
/// <param name="Signature">Signature</param>
/// <returns>If the signature is valid.</returns>
public static bool Verify(byte[] Data, byte[] PublicKey, HashFunctionArray HashFunction,
EdwardsCurveBase Curve, byte[] Signature)
{
try
{
int ScalarBytes = Signature.Length;
if ((ScalarBytes & 1) != 0)
{
return(false);
}
ScalarBytes >>= 1;
byte[] R = new byte[ScalarBytes];
Array.Copy(Signature, 0, R, 0, ScalarBytes);
PointOnCurve r = Decode(R, Curve);
byte[] S = new byte[ScalarBytes];
Array.Copy(Signature, ScalarBytes, S, 0, ScalarBytes);
BigInteger s = EllipticCurve.ToInt(S);
if (s >= Curve.Order)
{
return(false);
}
int c = Data.Length;
byte[] Bin = new byte[(ScalarBytes << 1) + c]; // dom2(F, C) = blank string
Array.Copy(R, 0, Bin, 0, ScalarBytes);
Array.Copy(PublicKey, 0, Bin, ScalarBytes, ScalarBytes);
Array.Copy(Data, 0, Bin, ScalarBytes << 1, c); // PH(M)=M
byte[] h = HashFunction(Bin);
BigInteger k = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
PointOnCurve P1 = Curve.ScalarMultiplication(s, Curve.BasePoint, false);
PointOnCurve P2 = Curve.ScalarMultiplication(k, Curve.Decode(PublicKey), false);
Curve.AddTo(ref P2, r);
P1.Normalize(Curve);
P2.Normalize(Curve);
return(P1.Equals(P2));
}
catch (ArgumentException)
{
return(false);
}
}
/// <summary>
/// Gets a shared key using the Elliptic Curve Diffie-Hellman (ECDH) algorithm.
/// </summary>
/// <param name="LocalPrivateKey">Local private key.</param>
/// <param name="RemotePublicKey">Public key of the remote party.</param>
/// <param name="HashFunction">A Hash function is applied to the derived key to generate the shared secret.
/// The derived key, as a byte array of equal size as the order of the prime field, ordered by most significant byte first,
/// is passed on to the hash function before being returned as the shared key.</param>
/// <param name="Curve">Elliptic curve used.</param>
/// <returns>Shared secret.</returns>
public static byte[] GetSharedKey(byte[] LocalPrivateKey, byte[] RemotePublicKey,
HashFunctionArray HashFunction, EllipticCurve Curve)
{
PointOnCurve PublicKey = Curve.Decode(RemotePublicKey);
PointOnCurve P = Curve.ScalarMultiplication(LocalPrivateKey, PublicKey, true);
byte[] B = P.X.ToByteArray();
if (B.Length != Curve.OrderBytes)
{
Array.Resize <byte>(ref B, Curve.OrderBytes);
}
Array.Reverse(B); // Most significant byte first.
return(HashFunction(B));
}
/// <summary>
/// Signs data using the EdDSA algorithm.
/// </summary>
/// <param name="Data">Data to be signed.</param>
/// <param name="PrivateKey">Private key.</param>
/// <param name="Prefix">Prefix</param>
/// <param name="HashFunction">Hash function to use</param>
/// <param name="Curve">Elliptic curve</param>
/// <returns>Signature</returns>
public static byte[] Sign(Stream Data, byte[] PrivateKey, byte[] Prefix,
HashFunctionStream HashFunction, EdwardsCurveBase Curve)
{
// 5.1.6 of RFC 8032
int ScalarBytes = PrivateKey.Length;
if (Prefix.Length != ScalarBytes)
{
throw new ArgumentException("Invalid prefix.", nameof(Prefix));
}
BigInteger a = EllipticCurve.ToInt(PrivateKey);
PointOnCurve P = Curve.ScalarMultiplication(PrivateKey, Curve.BasePoint, true);
byte[] A = Encode(P, Curve);
byte[] h;
using (TemporaryStream TempFile = new TemporaryStream()) // dom2(F, C) = blank string
{
TempFile.Write(Prefix, 0, ScalarBytes); // prefix
Data.Position = 0;
Data.CopyTo(TempFile); // PH(M)=M
TempFile.Position = 0;
h = HashFunction(TempFile);
}
BigInteger r = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
PointOnCurve R = Curve.ScalarMultiplication(r, Curve.BasePoint, true);
byte[] Rs = Encode(R, Curve);
using (TemporaryStream TempFile = new TemporaryStream()) // dom2(F, C) = blank string
{
TempFile.Write(Rs, 0, ScalarBytes);
TempFile.Write(A, 0, ScalarBytes);
Data.Position = 0;
Data.CopyTo(TempFile); // PH(M)=M
TempFile.Position = 0;
h = HashFunction(TempFile);
}
BigInteger k = BigInteger.Remainder(EllipticCurve.ToInt(h), Curve.Order);
BigInteger s = Curve.ModulusN.Add(r, Curve.ModulusN.Multiply(k, a));
byte[] Bin = s.ToByteArray();
if (Bin.Length != ScalarBytes)
{
Array.Resize <byte>(ref Bin, ScalarBytes);
}
byte[] Signature = new byte[ScalarBytes << 1];
Array.Copy(Rs, 0, Signature, 0, ScalarBytes);
Array.Copy(Bin, 0, Signature, ScalarBytes, ScalarBytes);
return(Signature);
}
