15#ifndef __DECAF_POINT_255_H__
16#define __DECAF_POINT_255_H__ 1
25#define DECAF_255_SCALAR_LIMBS ((253-1)/DECAF_WORD_BITS+1)
29#define DECAF_255_SCALAR_BITS 253
32#ifndef __DECAF_25519_GF_DEFINED__
33#define __DECAF_25519_GF_DEFINED__ 1
37} __attribute__((aligned(32)))
gf_25519_s, gf_25519_t[1];
42#define DECAF_255_SER_BYTES 32
47#define DECAF_255_HASH_BYTES 32
50#define DECAF_255_SCALAR_BYTES 32
53#define DECAF_255_INVERT_ELLIGATOR_WHICH_BITS 5
56#define DECAF_255_REMOVED_COFACTOR 8
59#define DECAF_X25519_ENCODE_RATIO 4
62#define DECAF_X25519_PUBLIC_BYTES 32
65#define DECAF_X25519_PRIVATE_BYTES 32
86 decaf_word_t limb[DECAF_255_SCALAR_LIMBS];
136decaf_error_t DECAF_API_VIS decaf_255_scalar_decode (
139) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
151 const unsigned char *ser,
153) DECAF_NONNULL DECAF_NOINLINE;
164) DECAF_NONNULL DECAF_NOINLINE DECAF_NOINLINE;
176) DECAF_NONNULL DECAF_NOINLINE;
188) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
200) DECAF_NONNULL DECAF_NOINLINE;
212) DECAF_NONNULL DECAF_NOINLINE;
222) DECAF_NONNULL DECAF_NOINLINE;
233) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
241static inline void DECAF_NONNULL decaf_255_scalar_copy (
267) DECAF_NONNULL DECAF_NOINLINE;
286 decaf_bool_t allow_identity
287) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
296static inline void DECAF_NONNULL decaf_255_point_copy (
315) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
382) DECAF_NONNULL DECAF_NOINLINE;
405 decaf_bool_t allow_identity,
406 decaf_bool_t short_circuit
407) DECAF_NONNULL DECAF_WARN_UNUSED DECAF_NOINLINE;
425) DECAF_NONNULL DECAF_WARN_UNUSED DECAF_NOINLINE;
473) DECAF_NONNULL DECAF_NOINLINE DECAF_DEPRECATED(
"Renamed to decaf_x25519_derive_public_key");
488) DECAF_NONNULL DECAF_NOINLINE;
504) DECAF_NONNULL DECAF_NOINLINE;
521) DECAF_NONNULL DECAF_NOINLINE;
542) DECAF_NONNULL DECAF_NOINLINE;
565) DECAF_NONNULL DECAF_NOINLINE;
587) DECAF_NONNULL DECAF_NOINLINE;
603) DECAF_NONNULL DECAF_NOINLINE;
619) DECAF_NONNULL DECAF_NOINLINE;
630) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE;
642) DECAF_NONNULL DECAF_NOINLINE;
657) DECAF_NONNULL DECAF_NOINLINE;
691) DECAF_NONNULL DECAF_NOINLINE;
704) DECAF_NONNULL DECAF_NOINLINE;
739) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED;
764) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED;
Common utility headers for Decaf library.
#define DECAF_WORD_BITS
The number of bits in a word.
Definition common.h:76
decaf_error_t
Another boolean type used to indicate success or failure.
Definition common.h:120
void DECAF_API_VIS decaf_255_point_scalarmul(decaf_255_point_t scaled, const decaf_255_point_t base, const decaf_255_scalar_t scalar) DECAF_NONNULL DECAF_NOINLINE
Multiply a base point by a scalar: scaled = scalar*base.
decaf_error_t DECAF_API_VIS decaf_255_direct_scalarmul(uint8_t scaled[DECAF_255_SER_BYTES], const uint8_t base[DECAF_255_SER_BYTES], const decaf_255_scalar_t scalar, decaf_bool_t allow_identity, decaf_bool_t short_circuit) DECAF_NONNULL DECAF_WARN_UNUSED DECAF_NOINLINE
Multiply a base point by a scalar: scaled = scalar*base.
void DECAF_API_VIS decaf_255_scalar_encode(unsigned char ser[DECAF_255_SCALAR_BYTES], const decaf_255_scalar_t s) DECAF_NONNULL DECAF_NOINLINE DECAF_NOINLINE
Serialize a scalar to wire format.
void DECAF_API_VIS decaf_255_point_cond_sel(decaf_255_point_t out, const decaf_255_point_t a, const decaf_255_point_t b, decaf_word_t pick_b) DECAF_NONNULL DECAF_NOINLINE
Constant-time decision between two points.
decaf_error_t DECAF_API_VIS decaf_255_scalar_invert(decaf_255_scalar_t out, const decaf_255_scalar_t a) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Invert a scalar.
decaf_error_t DECAF_API_VIS decaf_255_invert_elligator_uniform(unsigned char recovered_hash[2 *DECAF_255_HASH_BYTES], const decaf_255_point_t pt, uint32_t which) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED
Inverse of elligator-like hash to curve.
void DECAF_API_VIS decaf_255_point_double_scalarmul(decaf_255_point_t combo, const decaf_255_point_t base1, const decaf_255_scalar_t scalar1, const decaf_255_point_t base2, const decaf_255_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply two base points by two scalars: scaled = scalar1*base1 + scalar2*base2.
const uint8_t DECAF_API_VIS decaf_x25519_base_point[DECAF_X25519_PUBLIC_BYTES]
The base point for X25519 Diffie-Hellman.
Definition decaf.c:66
void DECAF_API_VIS decaf_255_point_encode(uint8_t ser[DECAF_255_SER_BYTES], const decaf_255_point_t pt) DECAF_NONNULL DECAF_NOINLINE
Encode a point as a sequence of bytes.
#define DECAF_255_SER_BYTES
Number of bytes in a serialized point.
Definition point_255.h:42
struct decaf_255_precomputed_s decaf_255_precomputed_s
Precomputed table based on a point.
Definition point_255.h:78
DECAF_API_VIS const struct decaf_255_precomputed_s * decaf_255_precomputed_base
Precomputed table of multiples of the base point on the curve.
void DECAF_API_VIS decaf_255_precompute(decaf_255_precomputed_s *a, const decaf_255_point_t b) DECAF_NONNULL DECAF_NOINLINE
Precompute a table for fast scalar multiplication.
decaf_error_t DECAF_API_VIS decaf_255_point_decode(decaf_255_point_t pt, const uint8_t ser[DECAF_255_SER_BYTES], decaf_bool_t allow_identity) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Decode a point from a sequence of bytes.
void DECAF_API_VIS decaf_255_scalar_add(decaf_255_scalar_t out, const decaf_255_scalar_t a, const decaf_255_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Add two scalars.
void DECAF_API_VIS decaf_255_point_debugging_pscale(decaf_255_point_t q, const decaf_255_point_t p, const unsigned char factor[DECAF_255_SER_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Projectively scale a point, for debugging purposes.
void DECAF_API_VIS decaf_255_point_destroy(decaf_255_point_t point) DECAF_NONNULL
Securely erase a point by overwriting it with zeros.
struct decaf_255_point_s decaf_255_point_t[1]
Representation of a point on the elliptic curve.
decaf_bool_t DECAF_API_VIS decaf_255_scalar_eq(const decaf_255_scalar_t a, const decaf_255_scalar_t b) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Compare two scalars.
void DECAF_API_VIS decaf_x25519_derive_public_key(uint8_t out[DECAF_X25519_PUBLIC_BYTES], const uint8_t scalar[DECAF_X25519_PRIVATE_BYTES]) DECAF_NONNULL DECAF_NOINLINE
RFC 7748 Diffie-Hellman base point scalarmul.
struct decaf_255_scalar_s decaf_255_scalar_t[1]
Representation of an element of the scalar field.
decaf_error_t DECAF_API_VIS decaf_x25519(uint8_t shared[DECAF_X25519_PUBLIC_BYTES], const uint8_t base[DECAF_X25519_PUBLIC_BYTES], const uint8_t scalar[DECAF_X25519_PRIVATE_BYTES]) DECAF_NONNULL DECAF_WARN_UNUSED DECAF_NOINLINE
RFC 7748 Diffie-Hellman scalarmul, used to compute shared secrets.
void DECAF_API_VIS decaf_255_point_negate(decaf_255_point_t nega, const decaf_255_point_t a) DECAF_NONNULL
Negate a point to produce another point.
void DECAF_API_VIS decaf_255_scalar_destroy(decaf_255_scalar_t scalar) DECAF_NONNULL
Securely erase a scalar.
void DECAF_API_VIS decaf_255_scalar_set_unsigned(decaf_255_scalar_t out, uint64_t a) DECAF_NONNULL
Set a scalar to an unsigned 64-bit integer.
#define DECAF_X25519_PRIVATE_BYTES
Number of bytes in an x25519 private key.
Definition point_255.h:65
void DECAF_API_VIS decaf_255_precomputed_scalarmul(decaf_255_point_t scaled, const decaf_255_precomputed_s *base, const decaf_255_scalar_t scalar) DECAF_NONNULL DECAF_NOINLINE
Multiply a precomputed base point by a scalar: scaled = scalar*base.
#define DECAF_X25519_PUBLIC_BYTES
Number of bytes in an x25519 public key.
Definition point_255.h:62
void DECAF_API_VIS decaf_255_point_from_hash_uniform(decaf_255_point_t pt, const unsigned char hashed_data[2 *DECAF_255_HASH_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Indifferentiable hash function encoding to curve.
#define DECAF_255_SCALAR_BYTES
Number of bytes in a serialized scalar.
Definition point_255.h:50
void DECAF_API_VIS decaf_255_scalar_mul(decaf_255_scalar_t out, const decaf_255_scalar_t a, const decaf_255_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Multiply two scalars.
DECAF_API_VIS const decaf_255_point_t decaf_255_point_base
An arbitrarily-chosen base point on the curve.
void DECAF_API_VIS decaf_255_scalar_halve(decaf_255_scalar_t out, const decaf_255_scalar_t a) DECAF_NONNULL DECAF_NOINLINE
Halve a scalar.
void DECAF_API_VIS decaf_255_point_sub(decaf_255_point_t diff, const decaf_255_point_t a, const decaf_255_point_t b) DECAF_NONNULL
Subtract two points to produce a third point.
DECAF_API_VIS const decaf_255_scalar_t decaf_255_scalar_one
The scalar 1.
void DECAF_API_VIS decaf_255_point_dual_scalarmul(decaf_255_point_t a1, decaf_255_point_t a2, const decaf_255_point_t base1, const decaf_255_scalar_t scalar1, const decaf_255_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply one base point by two scalars:
void DECAF_API_VIS decaf_255_point_debugging_torque(decaf_255_point_t q, const decaf_255_point_t p) DECAF_NONNULL DECAF_NOINLINE
Torque a point, for debugging purposes.
decaf_bool_t DECAF_API_VIS decaf_255_point_eq(const decaf_255_point_t a, const decaf_255_point_t b) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Test whether two points are equal.
DECAF_API_VIS const decaf_255_point_t decaf_255_point_identity
The identity (zero) point on the curve.
void DECAF_API_VIS decaf_255_scalar_sub(decaf_255_scalar_t out, const decaf_255_scalar_t a, const decaf_255_scalar_t b) DECAF_NONNULL DECAF_NOINLINE
Subtract two scalars.
void DECAF_API_VIS decaf_255_point_mul_by_ratio_and_encode_like_x25519(uint8_t out[DECAF_X25519_PUBLIC_BYTES], const decaf_255_point_t p) DECAF_NONNULL
Multiply a point by DECAF_X25519_ENCODE_RATIO, then encode it like RFC 7748.
decaf_bool_t DECAF_API_VIS decaf_255_point_valid(const decaf_255_point_t to_test) DECAF_WARN_UNUSED DECAF_NONNULL DECAF_NOINLINE
Test that a point is valid, for debugging purposes.
DECAF_API_VIS const size_t decaf_255_sizeof_precomputed_s
Size and alignment of precomputed point tables.
decaf_error_t DECAF_API_VIS decaf_255_invert_elligator_nonuniform(unsigned char recovered_hash[DECAF_255_HASH_BYTES], const decaf_255_point_t pt, uint32_t which) DECAF_NONNULL DECAF_NOINLINE DECAF_WARN_UNUSED
Inverse of elligator-like hash to curve.
void DECAF_API_VIS decaf_255_point_add(decaf_255_point_t sum, const decaf_255_point_t a, const decaf_255_point_t b) DECAF_NONNULL
Add two points to produce a third point.
void DECAF_API_VIS decaf_x25519_generate_key(uint8_t out[DECAF_X25519_PUBLIC_BYTES], const uint8_t scalar[DECAF_X25519_PRIVATE_BYTES]) DECAF_NONNULL DECAF_NOINLINE DECAF_DEPRECATED("Renamed to decaf_x25519_derive_public_key")
RFC 7748 Diffie-Hellman base point scalarmul.
void DECAF_API_VIS decaf_255_point_double(decaf_255_point_t two_a, const decaf_255_point_t a) DECAF_NONNULL
Double a point.
#define DECAF_255_HASH_BYTES
Number of bytes in an elligated point.
Definition point_255.h:47
void DECAF_API_VIS decaf_255_scalar_cond_sel(decaf_255_scalar_t out, const decaf_255_scalar_t a, const decaf_255_scalar_t b, decaf_word_t pick_b) DECAF_NONNULL DECAF_NOINLINE
Constant-time decision between two scalars.
void DECAF_API_VIS decaf_255_base_double_scalarmul_non_secret(decaf_255_point_t combo, const decaf_255_scalar_t scalar1, const decaf_255_point_t base2, const decaf_255_scalar_t scalar2) DECAF_NONNULL DECAF_NOINLINE
Multiply two base points by two scalars: scaled = scalar1*decaf_255_point_base + scalar2*base2.
DECAF_API_VIS const decaf_255_scalar_t decaf_255_scalar_zero
The scalar 0.
void DECAF_API_VIS decaf_255_precomputed_destroy(decaf_255_precomputed_s *pre) DECAF_NONNULL
Securely erase a precomputed table by overwriting it with zeros.
void DECAF_API_VIS decaf_255_scalar_decode_long(decaf_255_scalar_t out, const unsigned char *ser, size_t ser_len) DECAF_NONNULL DECAF_NOINLINE
Read a scalar from wire format or from bytes.
void DECAF_API_VIS decaf_255_point_from_hash_nonuniform(decaf_255_point_t pt, const unsigned char hashed_data[DECAF_255_HASH_BYTES]) DECAF_NONNULL DECAF_NOINLINE
Almost-Elligator-like hash to curve.
Representation of a point on the elliptic curve.
Definition point_255.h:68
Representation of an element of the scalar field.
Definition point_255.h:84