zyb
2 years ago
commit
82f8dd2c23
36 changed files with 5079 additions and 0 deletions
-
139.github/workflows/mikrotik_patch.yml
-
2.gitignore
-
15README.md
-
BINinstall.png
-
BINkeygen.exe
-
BINkeygen.png
-
213mikro.py
-
BINmikrotik.ico
-
297npk.py
-
111patch.py
-
BINrouteros.png
-
317sha256.py
-
188toyecc/ASN1.py
-
132toyecc/AffineCurvePoint.py
-
59toyecc/CRT.py
-
842toyecc/CurveDB.py
-
140toyecc/CurveOps.py
-
77toyecc/CurveQuirks.py
-
67toyecc/DivisionPolynomial.py
-
41toyecc/DocInherit.py
-
79toyecc/ECPrivateKey.py
-
44toyecc/ECPublicKey.py
-
202toyecc/EllipticCurve.py
-
34toyecc/Exceptions.py
-
249toyecc/FieldElement.py
-
164toyecc/MontgomeryCurve.py
-
258toyecc/PointOps.py
-
331toyecc/Polynomial.py
-
228toyecc/PrivKeyOps.py
-
166toyecc/PubKeyOps.py
-
48toyecc/Random.py
-
203toyecc/ShortWeierstrassCurve.py
-
69toyecc/Singleton.py
-
98toyecc/Tools.py
-
171toyecc/TwistedEdwardsCurve.py
-
95toyecc/__init__.py
@ -0,0 +1,139 @@ |
|||||
|
name: Patch Mikrotik RouterOS |
||||
|
on: |
||||
|
# push: |
||||
|
# branches: [ "main" ] |
||||
|
schedule: |
||||
|
- cron: "0 0 * * *" |
||||
|
workflow_dispatch: |
||||
|
|
||||
|
permissions: |
||||
|
contents: write |
||||
|
|
||||
|
jobs: |
||||
|
Patch_Mikrotik_RouterOS: |
||||
|
runs-on: ubuntu-latest |
||||
|
env: |
||||
|
TZ: 'Asia/Shanghai' |
||||
|
LATEST_STABLE_VERSION_URL: 'https://upgrade.mikrotik.com/routeros/NEWESTa7.stable' |
||||
|
LATEST_VERSION: "7.15" |
||||
|
CUSTOM_LICENSE_PRIVATE_KEY: ${{ secrets.CUSTOM_LICENSE_PRIVATE_KEY }} |
||||
|
CUSTOM_LICENSE_PUBLIC_KEY: ${{ secrets.CUSTOM_LICENSE_PUBLIC_KEY }} |
||||
|
CUSTOM_NPK_SIGN_PRIVATE_KEY: ${{ secrets.CUSTOM_NPK_SIGN_PRIVATE_KEY }} |
||||
|
CUSTOM_NPK_SIGN_PUBLIC_KEY: ${{ secrets.CUSTOM_NPK_SIGN_PUBLIC_KEY }} |
||||
|
MIKRO_LICENSE_PUBLIC_KEY: ${{ secrets.MIKRO_LICENSE_PUBLIC_KEY }} |
||||
|
MIKRO_NPK_SIGN_PUBLIC_LKEY: ${{ secrets.MIKRO_NPK_SIGN_PUBLIC_LKEY }} |
||||
|
steps: |
||||
|
- name: Checkout repository |
||||
|
uses: actions/checkout@v4 |
||||
|
|
||||
|
- name: Set up Python |
||||
|
uses: actions/setup-python@v5 |
||||
|
with: |
||||
|
python-version: '3.11' |
||||
|
- name: Get latest routeros stable version |
||||
|
run: | |
||||
|
echo $(uname -a) |
||||
|
LATEST_VERSION=$(wget -nv -O - $LATEST_STABLE_VERSION_URL | cut -d ' ' -f1) |
||||
|
echo Latest Stabel Version:$LATEST_VERSION |
||||
|
echo "LATEST_VERSION=${LATEST_VERSION}" >> $GITHUB_ENV |
||||
|
|
||||
|
- name: Create keygen |
||||
|
run: | |
||||
|
zip keygen.zip ./keygen.exe |
||||
|
|
||||
|
- name: Create squashfs for option npk |
||||
|
run: | |
||||
|
cd $GITHUB_WORKSPACE |
||||
|
sudo wget -O bash -nv https://busybox.net/downloads/binaries/1.31.0-i686-uclibc/busybox_ASH |
||||
|
sudo wget -O busybox -nv https://busybox.net/downloads/binaries/1.31.0-i686-uclibc/busybox |
||||
|
sudo chmod +x busybox |
||||
|
sudo chmod +x bash |
||||
|
sudo mkdir -p ./option-root/bin/ |
||||
|
sudo mv busybox ./option-root/bin/ |
||||
|
sudo mv bash ./option-root/bin/ |
||||
|
COMMANDS=$(./option-root/bin/busybox --list) |
||||
|
for cmd in $COMMANDS; do |
||||
|
sudo ln -sf /pckg/option/bin/busybox ./option-root/bin/$cmd |
||||
|
done |
||||
|
sudo rm -f option.sfs |
||||
|
sudo mksquashfs option-root option.sfs -quiet -comp xz -no-xattrs -b 256k |
||||
|
sudo rm -rf option-root |
||||
|
|
||||
|
- name: Get routeros-${{ env.LATEST_VERSION }}.npk |
||||
|
run: sudo wget -nv -O routeros-$LATEST_VERSION.npk https://download.mikrotik.com/routeros/$LATEST_VERSION/routeros-$LATEST_VERSION.npk |
||||
|
|
||||
|
- name: Patch routeros-${{ env.LATEST_VERSION }}.npk |
||||
|
run: sudo -E python3 patch.py routeros-$LATEST_VERSION.npk |
||||
|
|
||||
|
- name: Get mikrotik-${{ env.LATEST_VERSION }}.iso |
||||
|
run: sudo wget -nv -O mikrotik-$LATEST_VERSION.iso https://download.mikrotik.com/routeros/$LATEST_VERSION/mikrotik-$LATEST_VERSION.iso |
||||
|
|
||||
|
- name: Patch mikrotik-${{ env.LATEST_VERSION }}.iso |
||||
|
run: | |
||||
|
sudo apt-get install -y mkisofs > /dev/null |
||||
|
sudo mkdir ./iso |
||||
|
sudo mount -o loop,ro mikrotik-$LATEST_VERSION.iso ./iso |
||||
|
sudo mkdir ./new_iso |
||||
|
sudo cp -r ./iso/* ./new_iso/ |
||||
|
sudo rsync -a ./iso/ ./new_iso/ |
||||
|
sudo umount ./iso |
||||
|
sudo rm -rf ./iso |
||||
|
sudo rm -f mikrotik-$LATEST_VERSION.iso |
||||
|
sudo rm -rf ./new_iso/routeros-$LATEST_VERSION.npk |
||||
|
NPK_FILES=$(find ./new_iso/*.npk) |
||||
|
for file in $NPK_FILES; do |
||||
|
sudo -E python3 npk.py sign $file $file |
||||
|
done |
||||
|
sudo cp routeros-$LATEST_VERSION.npk ./new_iso/ |
||||
|
sudo -E python3 npk.py create ./new_iso/gps-$LATEST_VERSION.npk ./option.sfs ./option-$LATEST_VERSION.npk |
||||
|
sudo cp option-$LATEST_VERSION.npk ./new_iso/ |
||||
|
sudo cp linux ./new_iso/isolinux/ |
||||
|
sudo mkdir ./efiboot |
||||
|
sudo mount -o loop ./new_iso/efiboot.img ./efiboot |
||||
|
sudo cp linux ./efiboot/linux.x86_64 |
||||
|
sudo umount ./efiboot |
||||
|
sudo rm -rf ./efiboot |
||||
|
sudo mkisofs -o mikrotik-$LATEST_VERSION.iso \ |
||||
|
-V "MikroTik $LATEST_VERSION Patched" \ |
||||
|
-sysid "" -preparer "MiKroTiK" \ |
||||
|
-publisher "" -A "MiKroTiK RouterOS" \ |
||||
|
-b isolinux/isolinux.bin \ |
||||
|
-c isolinux/boot.cat \ |
||||
|
-no-emul-boot \ |
||||
|
-boot-load-size 4 \ |
||||
|
-boot-info-table \ |
||||
|
-eltorito-alt-boot \ |
||||
|
-e efiboot.img \ |
||||
|
-no-emul-boot \ |
||||
|
-R \ |
||||
|
./new_iso |
||||
|
sudo rm -rf ./new_iso |
||||
|
|
||||
|
- name: Delete Release tag ${{ env.LATEST_VERSION }} |
||||
|
run: | |
||||
|
HEADER="Authorization: token ${{ secrets.GITHUB_TOKEN }}" |
||||
|
RELEASE_INFO=$(curl -s -H $HEADER https://api.github.com/repos/${{ github.repository }}/releases/tags/${{ env.LATEST_VERSION }}) |
||||
|
RELEASE_ID=$(echo $RELEASE_INFO | jq -r '.id') |
||||
|
echo "Release ID: $RELEASE_ID" |
||||
|
if [ "$RELEASE_ID" != "null" ]; then |
||||
|
curl -X DELETE -H "$HEADER" https://api.github.com/repos/${{ github.repository }}/git/refs/tags/${{ env.LATEST_VERSION }} |
||||
|
echo "Tag ${{ env.LATEST_VERSION }} deleted successfully." |
||||
|
curl -X DELETE -H "$HEADER" https://api.github.com/repos/${{ github.repository }}/releases/$RELEASE_ID |
||||
|
echo "Release with tag ${{ env.LATEST_VERSION }} deleted successfully." |
||||
|
else |
||||
|
echo "Release not found for tag: ${{ env.LATEST_VERSION }})" |
||||
|
fi |
||||
|
|
||||
|
- name: Create Release tag ${{ env.LATEST_VERSION }} |
||||
|
uses: softprops/action-gh-release@v2 |
||||
|
with: |
||||
|
name: "MikroTik ${{ env.LATEST_VERSION }}" |
||||
|
body: "MikroTik ${{ env.LATEST_VERSION }}" |
||||
|
tag_name: ${{ env.LATEST_VERSION }} |
||||
|
make_latest: "true" |
||||
|
files: | |
||||
|
mikrotik-${{ env.LATEST_VERSION }}.iso |
||||
|
routeros-${{ env.LATEST_VERSION }}.npk |
||||
|
option-${{ env.LATEST_VERSION }}.npk |
||||
|
keygen.zip |
||||
|
|
||||
@ -0,0 +1,2 @@ |
|||||
|
__pycache__/ |
||||
|
venv/ |
||||
@ -0,0 +1,15 @@ |
|||||
|
# Patch MikroTik RouterOS |
||||
|
|
||||
|
### Download [Latest Patched](https://github.com/elseif/MikroTikPatch/releases/latest) iso file,install it and enjoy. |
||||
|
|
||||
|
 |
||||
|
 |
||||
|
|
||||
|
### Uses keygen to generate license key. |
||||
|
 |
||||
|
### all patches are applied automatically with [github workflow](https://github.com/elseif/MikroTikPatch/blob/main/.github/workflows/mikrotik_patch.yml). |
||||
|
|
||||
|
|
||||
|
|
||||
|
|
||||
|
|
||||
|
After Width: 639 | Height: 372 | Size: 18 KiB |
|
After Width: 523 | Height: 180 | Size: 17 KiB |
@ -0,0 +1,213 @@ |
|||||
|
|
||||
|
import struct |
||||
|
from sha256 import SHA256 |
||||
|
from toyecc import AffineCurvePoint, getcurvebyname, FieldElement,ECPrivateKey,ECPublicKey,Tools |
||||
|
from toyecc.Random import secure_rand_int_between |
||||
|
|
||||
|
MIKRO_LICENSE_HEADER = '-----BEGIN MIKROTIK SOFTWARE KEY------------' |
||||
|
MIKRO_LICENSE_FOOTER = '-----END MIKROTIK SOFTWARE KEY--------------' |
||||
|
MIKRO_BASE64_CHARACTER_TABLE = b'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/' |
||||
|
SOFTWARE_ID_CHARACTER_TABLE = b'TN0BYX18S5HZ4IA67DGF3LPCJQRUK9MW2VE' |
||||
|
|
||||
|
MIKRO_SHA256_K = ( |
||||
|
0x0548D563, 0x98308EAB, 0x37AF7CCC, 0xDFBC4E3C, |
||||
|
0xF125AAC9, 0xEC98ACB8, 0x8B540795, 0xD3E0EF0E, |
||||
|
0x4904D6E5, 0x0DA84981, 0x9A1F8452, 0x00EB7EAA, |
||||
|
0x96F8E3B3, 0xA6CDB655, 0xE7410F9E, 0x8EECB03D, |
||||
|
0x9C6A7C25, 0xD77B072F, 0x6E8F650A, 0x124E3640, |
||||
|
0x7E53785A, 0xE0150772, 0xC61EF4E0, 0xBC57E5E0, |
||||
|
0xC0F9A285, 0xDB342856, 0x190834C7, 0xFBEB7D8E, |
||||
|
0x251BED34, 0x0E9F2AAD, 0x256AB901, 0x0A5B7890, |
||||
|
0x9F124F09, 0xD84A9151, 0x427AF67A, 0x8059C9AA, |
||||
|
0x13EAB029, 0x3153CDF1, 0x262D405D, 0xA2105D87, |
||||
|
0x9C745F15, 0xD1613847, 0x294CE135, 0x20FB0F3C, |
||||
|
0x8424D8ED, 0x8F4201B6, 0x12CA1EA7, 0x2054B091, |
||||
|
0x463D8288, 0xC83253C3, 0x33EA314A, 0x9696DC92, |
||||
|
0xD041CE9A, 0xE5477160, 0xC7656BE8, 0x5179FE33, |
||||
|
0x1F4726F1, 0x5F393AF0, 0x26E2D004, 0x6D020245, |
||||
|
0x85FDF6D7, 0xB0237C56, 0xFF5FBD94, 0xA8B3F534 |
||||
|
) |
||||
|
def mikro_softwareid_decode(software_id:str)->int: |
||||
|
assert(isinstance(software_id, str)) |
||||
|
software_id = software_id.replace('-', '') |
||||
|
ret = 0 |
||||
|
for i in reversed(range(len(software_id))): |
||||
|
ret *= len(SOFTWARE_ID_CHARACTER_TABLE) |
||||
|
ret += SOFTWARE_ID_CHARACTER_TABLE.index(ord(software_id[i])) |
||||
|
return ret |
||||
|
|
||||
|
def mikro_softwareid_encode(id:int)->str: |
||||
|
assert(isinstance(id, int)) |
||||
|
ret = '' |
||||
|
for i in range(8): |
||||
|
ret += chr(SOFTWARE_ID_CHARACTER_TABLE[id % 0x23]) |
||||
|
id //= 0x23 |
||||
|
if i == 3: |
||||
|
ret += '-' |
||||
|
return ret |
||||
|
|
||||
|
def to32bits(v): |
||||
|
return (v + (1 << 32)) % (1 << 32) |
||||
|
|
||||
|
def rotl(n, d): |
||||
|
return (n << d) | (n >> (32 - d)) |
||||
|
|
||||
|
def mikro_encode(s:bytes)->bytes: |
||||
|
s = list(struct.unpack('>' + 'I' * (len(s) // 4), s)) |
||||
|
for i in reversed(range(16)): |
||||
|
s[(i+0) % 4] = to32bits(rotl(s[(i+3) % 4], MIKRO_SHA256_K[i*4+3] & 0x0F) ^ (s[(i+0) % 4] - s[(i+3) % 4])) |
||||
|
s[(i+3) % 4] = to32bits(s[(i+3) % 4] + s[(i+1) % 4] + MIKRO_SHA256_K[i*4+3]) |
||||
|
|
||||
|
s[(i+1) % 4] = to32bits(rotl(s[(i+2) % 4], MIKRO_SHA256_K[i*4+2] & 0x0F) ^ (s[(i+1) % 4] - s[(i+2) % 4])) |
||||
|
s[(i+0) % 4] = to32bits(s[(i+0) % 4] + s[(i+2) % 4] + MIKRO_SHA256_K[i*4+2]) |
||||
|
|
||||
|
s[(i+2) % 4] = to32bits(rotl(s[(i+1) % 4], MIKRO_SHA256_K[i*4+1] & 0x0F) ^ (s[(i+2) % 4] - s[(i+1) % 4])) |
||||
|
s[(i+1) % 4] = to32bits(s[(i+1) % 4] + s[(i+3) % 4] + MIKRO_SHA256_K[i*4+1]) |
||||
|
|
||||
|
s[(i+3) % 4] = to32bits(rotl(s[(i+0) % 4], MIKRO_SHA256_K[i*4+0] & 0x0F) ^ (s[(i+3) % 4] - s[(i+0) % 4])) |
||||
|
s[(i+2) % 4] = to32bits(s[(i+2) % 4] + s[(i+0) % 4] + MIKRO_SHA256_K[i*4+0]) |
||||
|
|
||||
|
encodedLicensePayload = b'' |
||||
|
for x in s: |
||||
|
encodedLicensePayload += x.to_bytes(4, 'big') |
||||
|
return encodedLicensePayload |
||||
|
|
||||
|
def mikro_decode(s:bytes)->bytes: |
||||
|
s = list(struct.unpack('>'+'I'*(len(s) // 4), s)) |
||||
|
for i in range(16): |
||||
|
s[(i+2) % 4] = to32bits(s[(i+2) % 4] - s[(i+0) % 4] - MIKRO_SHA256_K[i*4+0]) |
||||
|
s[(i+3) % 4] = to32bits((rotl(s[(i+0) % 4], MIKRO_SHA256_K[i*4+0] & 0x0F) ^ s[(i+3) % 4]) + s[(i+0) % 4]) |
||||
|
|
||||
|
s[(i+1) % 4] = to32bits(s[(i+1) % 4] - s[(i+3) % 4] - MIKRO_SHA256_K[i*4+1]) |
||||
|
s[(i+2) % 4] = to32bits((rotl(s[(i+1) % 4], MIKRO_SHA256_K[i*4+1] & 0x0F) ^ s[(i+2) % 4]) + s[(i+1) % 4]) |
||||
|
|
||||
|
s[(i+0) % 4] = to32bits(s[(i+0) % 4] - s[(i+2) % 4] - MIKRO_SHA256_K[i*4+2]) |
||||
|
s[(i+1) % 4] = to32bits((rotl(s[(i+2) % 4], MIKRO_SHA256_K[i*4+2] & 0x0F) ^ s[(i+1) % 4]) + s[(i+2) % 4]) |
||||
|
|
||||
|
s[(i+3) % 4] = to32bits(s[(i+3) % 4] - s[(i+1) % 4] - MIKRO_SHA256_K[i*4+3]) |
||||
|
s[(i+0) % 4] = to32bits((rotl(s[(i+3) % 4], MIKRO_SHA256_K[i*4+3] & 0x0F) ^ s[(i+0) % 4]) + s[(i+3) % 4]) |
||||
|
|
||||
|
ret = b'' |
||||
|
for x in s: |
||||
|
ret += x.to_bytes(4, 'big') |
||||
|
|
||||
|
return ret |
||||
|
|
||||
|
|
||||
|
def mikro_base64_encode(data:bytes, pad = False)->str: |
||||
|
encoded = '' |
||||
|
left = 0 |
||||
|
for i in range(0, len(data)): |
||||
|
if left == 0: |
||||
|
encoded += chr(MIKRO_BASE64_CHARACTER_TABLE[data[i] & 0x3F]) |
||||
|
left = 2 |
||||
|
else: |
||||
|
if left == 6: |
||||
|
encoded += chr(MIKRO_BASE64_CHARACTER_TABLE[data[i - 1] >> 2]) |
||||
|
encoded += chr(MIKRO_BASE64_CHARACTER_TABLE[data[i] & 0x3F]) |
||||
|
left = 2 |
||||
|
else: |
||||
|
index1 = data[i - 1] >> (8 - left) |
||||
|
index2 = data[i] << (left) |
||||
|
encoded += chr(MIKRO_BASE64_CHARACTER_TABLE[(index1 | index2) & 0x3F]) |
||||
|
left += 2 |
||||
|
|
||||
|
if left != 0: |
||||
|
encoded += chr(MIKRO_BASE64_CHARACTER_TABLE[data[len(data) - 1] >> (8 - left)]) |
||||
|
|
||||
|
if pad: |
||||
|
for i in range(0, (4 - len(encoded) % 4) % 4): |
||||
|
encoded += '=' |
||||
|
|
||||
|
return encoded |
||||
|
def mikro_base64_decode(data:str)->bytes: |
||||
|
ret = b"" |
||||
|
data = data.replace("=", "").encode() |
||||
|
left = 0 |
||||
|
for i in range(0, len(data)): |
||||
|
if left == 0: |
||||
|
left = 6 |
||||
|
else: |
||||
|
value1 = MIKRO_BASE64_CHARACTER_TABLE.index(data[i - 1]) >> (6 - left) |
||||
|
value2 = MIKRO_BASE64_CHARACTER_TABLE.index(data[i]) & (2 ** (8 - left) - 1) |
||||
|
value = value1 | (value2 << left) |
||||
|
ret += bytes([value]) |
||||
|
left -= 2 |
||||
|
return ret |
||||
|
|
||||
|
class MikroSHA256(SHA256): |
||||
|
K = MIKRO_SHA256_K |
||||
|
INITIAL_STATE = SHA256.State( |
||||
|
0x5B653932, 0x7B145F8F, 0x71FFB291, 0x38EF925F, |
||||
|
0x03E1AAF9, 0x4A2057CC, 0x4CAF4DD9, 0x643CC9EA |
||||
|
) |
||||
|
|
||||
|
def mikro_sha256(data:bytes)->bytes: |
||||
|
return MikroSHA256(data).digest() |
||||
|
|
||||
|
def mikro_eddsa_sign(data:bytes,private_key:bytes)->bytes: |
||||
|
assert(isinstance(data, bytes)) |
||||
|
assert(isinstance(private_key, bytes)) |
||||
|
curve = getcurvebyname('Ed25519') |
||||
|
private_key = ECPrivateKey.eddsa_decode(curve,private_key) |
||||
|
return private_key.eddsa_sign(data).encode() |
||||
|
|
||||
|
def mikro_eddsa_verify(data:bytes,signature:bytes,public_key:bytes): |
||||
|
assert(isinstance(data, bytes)) |
||||
|
assert(isinstance(signature, bytes)) |
||||
|
assert(isinstance(public_key, bytes)) |
||||
|
curve = getcurvebyname('Ed25519') |
||||
|
public_key = ECPublicKey.eddsa_decode(curve,public_key) |
||||
|
signature = ECPrivateKey.EDDSASignature.decode(curve,signature) |
||||
|
return public_key.eddsa_verify(data,signature) |
||||
|
|
||||
|
def mikro_kcdsa_sign(data:bytes,private_key:bytes)->bytes: |
||||
|
assert(isinstance(data, bytes)) |
||||
|
assert(isinstance(private_key, bytes)) |
||||
|
curve = getcurvebyname('Curve25519') |
||||
|
private_key:ECPrivateKey = ECPrivateKey(Tools.bytestoint_le(private_key), curve) |
||||
|
public_key:ECPublicKey = private_key.pubkey |
||||
|
while True: |
||||
|
nonce_secret = secure_rand_int_between(1, curve.n - 1) |
||||
|
nonce_point = nonce_secret * curve.G |
||||
|
nonce = int(nonce_point.x) % curve.n |
||||
|
nonce_hash = mikro_sha256(Tools.inttobytes_le(nonce,32)) |
||||
|
data_hash = bytearray(mikro_sha256(data)) |
||||
|
for i in range(16): |
||||
|
data_hash[8+i] ^= nonce_hash[i] |
||||
|
data_hash[0] &= 0xF8 |
||||
|
data_hash[31] &= 0x7F |
||||
|
data_hash[31] |= 0x40 |
||||
|
data_hash = Tools.bytestoint_le(data_hash) |
||||
|
signature = pow(private_key.scalar, -1, curve.n) * (nonce_secret - data_hash) |
||||
|
signature %= curve.n |
||||
|
if int((public_key.point * signature + curve.G * data_hash).x) == nonce: |
||||
|
return bytes(nonce_hash[:16]+Tools.inttobytes_le(signature,32)) |
||||
|
|
||||
|
def mikro_kcdsa_verify(data:bytes, signature:bytes, public_key:bytes)->bool: |
||||
|
assert(isinstance(data, bytes)) |
||||
|
assert(isinstance(signature, bytes)) |
||||
|
assert(isinstance(public_key, bytes)) |
||||
|
curve = getcurvebyname('Curve25519') |
||||
|
#y^2 = x^3 + ax^2 + x |
||||
|
x = FieldElement(Tools.bytestoint_le(public_key), curve.p) |
||||
|
YY = ((x**3) + (curve.a * x**2) + x).sqrt() |
||||
|
public_keys = [] |
||||
|
for y in YY: |
||||
|
public_keys += [AffineCurvePoint(x, int(y), curve)] |
||||
|
|
||||
|
data_hash = bytearray(mikro_sha256(data)) |
||||
|
nonce_hash = signature[:16] |
||||
|
signature = signature[16:] |
||||
|
for i in range(16): |
||||
|
data_hash[8+i] ^= nonce_hash[i] |
||||
|
data_hash[0] &= 0xF8 |
||||
|
data_hash[31] &= 0x7F |
||||
|
data_hash[31] |= 0x40 |
||||
|
data_hash = Tools.bytestoint_le(data_hash) |
||||
|
signature = Tools.bytestoint_le(signature) |
||||
|
for public_key in public_keys: |
||||
|
nonce = int((public_key * signature + curve.G * data_hash).x) |
||||
|
if mikro_sha256(Tools.inttobytes_le(nonce,32))[:len(nonce_hash)] == nonce_hash: |
||||
|
return True |
||||
|
return False |
||||
@ -0,0 +1,297 @@ |
|||||
|
|
||||
|
import struct,zlib |
||||
|
from datetime import datetime |
||||
|
from dataclasses import dataclass |
||||
|
from enum import IntEnum |
||||
|
class NpkPartID(IntEnum): |
||||
|
NAME_INFO =0x01 # Package information: name, ver, etc. |
||||
|
DESCRIPTION =0x02 # Package description |
||||
|
DEPENDENCIES =0x03 # Package Dependencies |
||||
|
FILE_CONTAINER =0x04 # Files container zlib 1.2.3 |
||||
|
INSTALL_SCRIPT =0x07 # Install script |
||||
|
UNINSTALL_SCRIPT =0x08 # Uninstall script |
||||
|
SIGNATURE =0x09 # Package signature |
||||
|
ARCHITECTURE =0x10 # Package architecture (e.g. i386) |
||||
|
PKG_CONFLICTS =0x11 # Package conflicts |
||||
|
PKG_INFO =0x12 |
||||
|
FEATURES =0x13 |
||||
|
PKG_FEATURES =0x14 |
||||
|
SQUASHFS =0x15 # SquashFS |
||||
|
NULL_BLOCK =0X16 |
||||
|
GIT_COMMIT =0x17 # Git commit |
||||
|
CHANNEL =0x18 # Release type (e.g. stable, bugfix) |
||||
|
HEADER =0x19 |
||||
|
|
||||
|
@dataclass |
||||
|
class NpkPartItem: |
||||
|
id: NpkPartID |
||||
|
data: bytes|object |
||||
|
class NpkNameInfo: |
||||
|
_format = '<16s4sI12s' |
||||
|
def __init__(self,name:str,version:str,build_time=datetime.now(),_unknow=b'\x00'*12): |
||||
|
self._name = name[:16].encode().ljust(16,b'\x00') |
||||
|
self._version = self.encode_version(version) |
||||
|
self._build_time = int(build_time.timestamp()) |
||||
|
self._unknow = _unknow |
||||
|
def serialize(self)->bytes: |
||||
|
return struct.pack(self._format, self._name,self._version,self._build_time,self._unknow) |
||||
|
@staticmethod |
||||
|
def unserialize_from(data:bytes)->'NpkNameInfo': |
||||
|
assert len(data) == struct.calcsize(NpkNameInfo._format),'Invalid data length' |
||||
|
_name, _version,_build_time,_unknow = struct.unpack_from(NpkNameInfo._format,data) |
||||
|
return NpkNameInfo(_name.decode(),NpkNameInfo.decode_version(_version),datetime.fromtimestamp(_build_time),_unknow) |
||||
|
def __len__ (self)->int: |
||||
|
return struct.calcsize(self._format) |
||||
|
@property |
||||
|
def name(self)->str: |
||||
|
return self._name.decode().strip('\x00') |
||||
|
@name.setter |
||||
|
def name(self,value:str): |
||||
|
self._name = value[:16].encode().ljust(16,b'\x00') |
||||
|
@staticmethod |
||||
|
def decode_version(value:bytes): |
||||
|
revision,build,minor,major = struct.unpack_from('4B',value) |
||||
|
if build == 97: |
||||
|
build = 'alpha' |
||||
|
elif build == 98: |
||||
|
build = 'beta' |
||||
|
elif build == 99: |
||||
|
build = 'rc' |
||||
|
elif build == 102: |
||||
|
if revision & 0x80: |
||||
|
build = 'test' |
||||
|
revision &= 0x7f |
||||
|
else: |
||||
|
build = 'final' |
||||
|
else: |
||||
|
build = 'unknown' |
||||
|
return f'{major}.{minor}.{revision}.{build}' |
||||
|
@staticmethod |
||||
|
def encode_version(value:str): |
||||
|
s = value.split('.') |
||||
|
if 4 != len(s) and s[3] in [ 'alpha', 'beta', 'rc','final', 'test']: |
||||
|
raise ValueError('Invalid version string') |
||||
|
major = int(s[0]) |
||||
|
minor = int(s[1]) |
||||
|
revision = int(s[2]) |
||||
|
if s[3] == 'alpha': |
||||
|
build = 97 |
||||
|
elif s[3] == 'beta': |
||||
|
build = 98 |
||||
|
elif s[3] == 'rc': |
||||
|
build = 99 |
||||
|
elif s[3] == 'final': |
||||
|
build = 102 |
||||
|
revision &= 0x7f |
||||
|
else: #'test' |
||||
|
build = 102 |
||||
|
revision |= 0x80 |
||||
|
return struct.pack('4B',revision,build,minor,major) |
||||
|
@property |
||||
|
def version(self)->str: |
||||
|
return self.decode_version(self._version) |
||||
|
@version.setter |
||||
|
def version(self,value:str = '7.15.1.final'): |
||||
|
self._version = self.encode_version(value) |
||||
|
@property |
||||
|
def build_time(self): |
||||
|
return datetime.fromtimestamp(self._build_time) |
||||
|
@build_time.setter |
||||
|
def build_time(self,value:datetime): |
||||
|
self._build_time = int(value.timestamp()) |
||||
|
|
||||
|
class NpkFileContainer: |
||||
|
_format = '<BB6sIBBBBIIIH' |
||||
|
@dataclass |
||||
|
class NpkFileItem: |
||||
|
perm: int |
||||
|
type: int |
||||
|
usr_or_grp: int |
||||
|
modify_time: int |
||||
|
revision: int |
||||
|
rc: int |
||||
|
minor: int |
||||
|
major: int |
||||
|
create_time: int |
||||
|
unknow: int |
||||
|
name: bytes |
||||
|
data: bytes |
||||
|
def __init__(self,items:list['NpkFileContainer.NpkFileItem']=None): |
||||
|
self._items= items |
||||
|
def serialize(self)->bytes: |
||||
|
compressed_data = b'' |
||||
|
compressor = zlib.compressobj() |
||||
|
for item in self._items: |
||||
|
data = struct.pack(self._format, item.perm,item.type,item.usr_or_grp, item.modify_time,item.revision,item.rc,item.minor,item.major,item.create_time,item.unknow,len(item.data),len(item.name)) |
||||
|
data += item.name + item.data |
||||
|
compressed_data += compressor.compress(data) |
||||
|
return compressed_data + compressor.flush() |
||||
|
@staticmethod |
||||
|
def unserialize_from(data:bytes): |
||||
|
items:list['NpkFileContainer.NpkFileItem'] = [] |
||||
|
decompressed_data = zlib.decompress(data) |
||||
|
while len(decompressed_data): |
||||
|
offset = struct.calcsize(NpkFileContainer._format) |
||||
|
perm,type,usr_or_grp, modify_time,revision,rc,minor,major,create_time,unknow,data_size,name_size= struct.unpack_from(NpkFileContainer._format, decompressed_data) |
||||
|
name = decompressed_data[offset:offset+name_size] |
||||
|
data = decompressed_data[offset+name_size:offset+name_size+data_size] |
||||
|
items.append(NpkFileContainer.NpkFileItem(perm,type,usr_or_grp, modify_time,revision,rc,minor,major,create_time,unknow,name,data)) |
||||
|
decompressed_data = decompressed_data[offset+name_size+data_size:] |
||||
|
return NpkFileContainer(items) |
||||
|
|
||||
|
def __len__ (self)->int: |
||||
|
return len(self.serialize()) |
||||
|
def __getitem__(self,index:int)->'NpkFileContainer.NpkFileItem': |
||||
|
return self._items[index] |
||||
|
def __iter__(self): |
||||
|
for item in self._items: |
||||
|
yield item |
||||
|
|
||||
|
|
||||
|
class NovaPackage: |
||||
|
NPK_MAGIC = 0xbad0f11e |
||||
|
def __init__(self,data:bytes=b''): |
||||
|
self._parts:list[NpkPartItem] = [] |
||||
|
offset = 0 |
||||
|
while offset < len(data): |
||||
|
part_id,part_size = struct.unpack_from('<HI',data,offset) |
||||
|
offset += 6 |
||||
|
part_data = data[offset:offset+part_size] |
||||
|
offset += part_size |
||||
|
if part_id == NpkPartID.NAME_INFO: |
||||
|
self._parts.append(NpkPartItem(NpkPartID(part_id),NpkNameInfo.unserialize_from(part_data))) |
||||
|
# elif part_id == NpkPartID.FILE_CONTAINER: |
||||
|
# self._parts.append(NpkPartItem(NpkPartID(part_id),NpkFileContainer.unserialize_from(part_data))) |
||||
|
else: |
||||
|
self._parts.append(NpkPartItem(NpkPartID(part_id),part_data)) |
||||
|
|
||||
|
|
||||
|
def get_digest(self,hash_fnc)->bytes: |
||||
|
for part in self._parts: |
||||
|
data_header = struct.pack('<HI',part.id.value,len(part.data)) |
||||
|
if part.id == NpkPartID.HEADER: |
||||
|
continue |
||||
|
else: |
||||
|
hash_fnc.update(data_header) |
||||
|
if part.id == NpkPartID.SIGNATURE: |
||||
|
break |
||||
|
elif part.data: |
||||
|
if isinstance(part.data,bytes): |
||||
|
hash_fnc.update(part.data) |
||||
|
else: |
||||
|
hash_fnc.update(part.data.serialize()) |
||||
|
return hash_fnc.digest() |
||||
|
|
||||
|
def sign(self,kcdsa_private_key:bytes,eddsa_private_key:bytes): |
||||
|
import hashlib |
||||
|
from mikro import mikro_kcdsa_sign,mikro_eddsa_sign |
||||
|
self[NpkPartID.SIGNATURE].data = b'\0'*(20+48+64) |
||||
|
sha1_digest = self.get_digest(hashlib.new('SHA1')) |
||||
|
sha256_digest = self.get_digest(hashlib.new('SHA256')) |
||||
|
kcdsa_signature = mikro_kcdsa_sign(sha256_digest[:20],kcdsa_private_key) |
||||
|
eddsa_signature = mikro_eddsa_sign(sha256_digest,eddsa_private_key) |
||||
|
self[NpkPartID.SIGNATURE].data = sha1_digest + kcdsa_signature + eddsa_signature |
||||
|
|
||||
|
def verify(self,kcdsa_public_key:bytes,eddsa_public_key:bytes): |
||||
|
import hashlib |
||||
|
from mikro import mikro_kcdsa_verify,mikro_eddsa_verify |
||||
|
sha1_digest = self.get_digest(hashlib.new('SHA1')) |
||||
|
sha256_digest = self.get_digest(hashlib.new('SHA256')) |
||||
|
signature = self[NpkPartID.SIGNATURE].data |
||||
|
if sha1_digest != signature[:20]: |
||||
|
return False |
||||
|
if not mikro_kcdsa_verify(sha256_digest[:20],signature[20:68],kcdsa_public_key): |
||||
|
return False |
||||
|
if not mikro_eddsa_verify(sha256_digest,signature[68:132],eddsa_public_key): |
||||
|
return False |
||||
|
return True |
||||
|
|
||||
|
def __iter__(self): |
||||
|
for part in self._parts: |
||||
|
yield part |
||||
|
|
||||
|
def __getitem__(self, id:NpkPartID): |
||||
|
for part in self._parts: |
||||
|
if part.id == id: |
||||
|
return part |
||||
|
part = NpkPartItem(id,b'') |
||||
|
self._parts.append(part) |
||||
|
return part |
||||
|
|
||||
|
def save(self,file): |
||||
|
size = 0 |
||||
|
for part in self._parts: |
||||
|
size += 6 + len(part.data) |
||||
|
with open(file,'wb') as f: |
||||
|
f.write(struct.pack('<II', NovaPackage.NPK_MAGIC, size)) |
||||
|
for part in self._parts: |
||||
|
f.write(struct.pack('<HI',part.id.value ,len(part.data))) |
||||
|
if isinstance(part.data,bytes): |
||||
|
f.write(part.data) |
||||
|
else: |
||||
|
f.write(part.data.serialize()) |
||||
|
|
||||
|
@staticmethod |
||||
|
def load(file): |
||||
|
with open(file,'rb') as f: |
||||
|
data = f.read() |
||||
|
assert int.from_bytes(data[:4],'little') == NovaPackage.NPK_MAGIC, 'Invalid Nova Package Magic' |
||||
|
assert int.from_bytes(data[4:8],'little') == len(data) - 8, 'Invalid Nova Package Size' |
||||
|
return NovaPackage(data[8:]) |
||||
|
|
||||
|
def get_latest_version(channel:str) -> str: |
||||
|
import requests |
||||
|
response = requests.get(f'https://upgrade.mikrotik.com/routeros/NEWESTa7.{channel}') |
||||
|
return response.text.split(' ')[0] |
||||
|
|
||||
|
def create_option_npk(npk_file:str,squashfs_file:str)->NovaPackage: |
||||
|
|
||||
|
return option_npk |
||||
|
|
||||
|
if __name__=='__main__': |
||||
|
import argparse,os |
||||
|
parser = argparse.ArgumentParser(description='nova package creator and editor') |
||||
|
subparsers = parser.add_subparsers(dest="command") |
||||
|
sign_parser = subparsers.add_parser('sign',help='sign npk file') |
||||
|
sign_parser.add_argument('input',type=str, help='Input file') |
||||
|
sign_parser.add_argument('output',type=str,help='Output file') |
||||
|
verify_parser = subparsers.add_parser('verify',help='Verify npk file') |
||||
|
verify_parser.add_argument('input',type=str, help='Input file') |
||||
|
create_option_parser = subparsers.add_parser('create',help='Create option.npk file') |
||||
|
create_option_parser.add_argument('npk_file',type=str,help='From npk file') |
||||
|
create_option_parser.add_argument('squashfs',type=str,help='option squashfs file') |
||||
|
create_option_parser.add_argument('output',type=str,help='Output file') |
||||
|
|
||||
|
args = parser.parse_args() |
||||
|
if args.command =='sign': |
||||
|
print(f'Signing {args.input}') |
||||
|
npk = NovaPackage.load(args.input) |
||||
|
kcdsa_private_key = bytes.fromhex(os.environ['CUSTOM_LICENSE_PRIVATE_KEY']) |
||||
|
eddsa_private_key = bytes.fromhex(os.environ['CUSTOM_NPK_SIGN_PRIVATE_KEY']) |
||||
|
npk.sign(kcdsa_private_key,eddsa_private_key) |
||||
|
npk.save(args.output) |
||||
|
elif args.command == 'verify': |
||||
|
npk = NovaPackage.load(args.input) |
||||
|
print(f'Verifying {args.input} ',end="") |
||||
|
kcdsa_public_key = bytes.fromhex(os.environ['CUSTOM_LICENSE_PUBLIC_KEY']) |
||||
|
eddsa_public_key = bytes.fromhex(os.environ['CUSTOM_NPK_SIGN_PUBLIC_KEY']) |
||||
|
if npk.verify(kcdsa_public_key,eddsa_public_key): |
||||
|
print('Valid') |
||||
|
exit(0) |
||||
|
else: |
||||
|
print('Invalid') |
||||
|
exit(1) |
||||
|
elif args.command =='create': |
||||
|
print(f'Creating option.npk from {args.npk_file}') |
||||
|
kcdsa_private_key = bytes.fromhex(os.environ['CUSTOM_LICENSE_PRIVATE_KEY']) |
||||
|
eddsa_private_key = bytes.fromhex(os.environ['CUSTOM_NPK_SIGN_PRIVATE_KEY']) |
||||
|
option_npk = NovaPackage.load(args.npk_file) |
||||
|
option_npk[NpkPartID.NAME_INFO].data.name = 'option' |
||||
|
option_npk[NpkPartID.DESCRIPTION].data = b'option package has busybox ash' |
||||
|
option_npk[NpkPartID.NULL_BLOCK].data = b'' |
||||
|
option_npk[NpkPartID.SQUASHFS].data = open(args.squashfs,'rb').read() |
||||
|
option_npk.sign(kcdsa_private_key,eddsa_private_key) |
||||
|
option_npk.save(args.output) |
||||
|
print(f'Created {args.output}') |
||||
|
else: |
||||
|
parser.print_help() |
||||
@ -0,0 +1,111 @@ |
|||||
|
import subprocess,lzma |
||||
|
import struct,os |
||||
|
from npk import NovaPackage,NpkPartID,NpkFileContainer |
||||
|
|
||||
|
def patch_bzimage(data:bytes,key_dict:dict): |
||||
|
print(f'bzImage size : {len(data)}') |
||||
|
PE_TEXT_SECTION_OFFSET = 414 |
||||
|
HEADER_PAYLOAD_OFFSET = 584 |
||||
|
HEADER_PAYLOAD_LENGTH_OFFSET = HEADER_PAYLOAD_OFFSET + 4 |
||||
|
text_section_raw_data = struct.unpack_from('<I',data,PE_TEXT_SECTION_OFFSET)[0] |
||||
|
payload_offset = text_section_raw_data +struct.unpack_from('<I',data,HEADER_PAYLOAD_OFFSET)[0] |
||||
|
payload_length = struct.unpack_from('<I',data,HEADER_PAYLOAD_LENGTH_OFFSET)[0] |
||||
|
payload_length = payload_length - 4 #last 4 bytes is uncompressed size(z_output_len) |
||||
|
print(f'vmlinux xz offset : {payload_offset}') |
||||
|
print(f'vmlinux xz size : {payload_length}') |
||||
|
z_output_len = struct.unpack_from('<I',data,payload_offset+payload_length)[0] |
||||
|
print(f'z_output_len : {z_output_len}') |
||||
|
vmlinux_xz = data[payload_offset:payload_offset+payload_length] |
||||
|
vmlinux = lzma.decompress(vmlinux_xz) |
||||
|
print(f'vmlinux size : {len(vmlinux)}') |
||||
|
assert z_output_len == len(vmlinux), 'vmlinux size is not equal to expected' |
||||
|
CPIO_HEADER_MAGIC = b'07070100' |
||||
|
CPIO_FOOTER_MAGIC = b'TRAILER!!!\x00\x00\x00\x00' #545241494C455221212100000000 |
||||
|
cpio_offset1 = vmlinux.index(CPIO_HEADER_MAGIC) |
||||
|
initramfs = vmlinux[cpio_offset1:] |
||||
|
cpio_offset2 = initramfs.index(CPIO_FOOTER_MAGIC)+len(CPIO_FOOTER_MAGIC) |
||||
|
initramfs = initramfs[:cpio_offset2] |
||||
|
new_initramfs = initramfs |
||||
|
for old_public_key,new_public_key in key_dict.items(): |
||||
|
if old_public_key in new_initramfs: |
||||
|
print(f'initramfs public key patched {old_public_key[:16].hex().upper()}...') |
||||
|
new_initramfs = new_initramfs.replace(old_public_key,new_public_key) |
||||
|
new_vmlinux = vmlinux.replace(initramfs,new_initramfs) |
||||
|
new_vmlinux_xz = lzma.compress(new_vmlinux,check=lzma.CHECK_CRC32,filters=[ |
||||
|
{"id": lzma.FILTER_X86}, |
||||
|
{"id": lzma.FILTER_LZMA2, "preset": 8,'dict_size': 32*1024*1024}, |
||||
|
]) |
||||
|
new_payload_length = len(new_vmlinux_xz) |
||||
|
print(f'new vmlinux xz size : {new_payload_length}') |
||||
|
assert new_payload_length <= payload_length , 'new vmlinux.xz size is too big' |
||||
|
new_payload_length = new_payload_length + 4 #last 4 bytes is uncompressed size(z_output_len) |
||||
|
new_data = bytearray(data) |
||||
|
struct.pack_into('<I',new_data,HEADER_PAYLOAD_LENGTH_OFFSET,new_payload_length) |
||||
|
vmlinux_xz += struct.pack('<I',z_output_len) |
||||
|
new_vmlinux_xz += struct.pack('<I',z_output_len) |
||||
|
new_vmlinux_xz = new_vmlinux_xz.ljust(len(vmlinux_xz),b'\0') |
||||
|
new_data = new_data.replace(vmlinux_xz,new_vmlinux_xz) |
||||
|
print(f'new bzImage size : {len(new_data)}') |
||||
|
return new_data |
||||
|
|
||||
|
def run_shell_command(command): |
||||
|
process = subprocess.run(command, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) |
||||
|
return process.stdout, process.stderr |
||||
|
|
||||
|
def patch_squashfs(path,key_dict): |
||||
|
for root, dirs, files in os.walk(path): |
||||
|
for file in files: |
||||
|
file = os.path.join(root,file) |
||||
|
if os.path.isfile(file): |
||||
|
data = open(file,'rb').read() |
||||
|
for old_public_key,new_public_key in key_dict.items(): |
||||
|
if old_public_key in data: |
||||
|
print(f'{file} public key patched {old_public_key[:16].hex().upper()}...') |
||||
|
data = data.replace(old_public_key,new_public_key) |
||||
|
open(file,'wb').write(data) |
||||
|
|
||||
|
def patch_system_npk(npk_file,key_dict): |
||||
|
npk = NovaPackage.load(npk_file) |
||||
|
file_container = NpkFileContainer.unserialize_from(npk[NpkPartID.FILE_CONTAINER].data) |
||||
|
for item in file_container: |
||||
|
if item.name == b'boot/EFI/BOOT/BOOTX64.EFI': |
||||
|
print(f'patch {item.name} ...') |
||||
|
item.data = patch_bzimage(item.data,key_dict) |
||||
|
open('linux','wb').write(item.data) |
||||
|
break |
||||
|
npk[NpkPartID.FILE_CONTAINER].data = file_container.serialize() |
||||
|
try: |
||||
|
squashfs_file = 'squashfs.sfs' |
||||
|
extract_dir = 'squashfs-root' |
||||
|
open(squashfs_file,'wb').write(npk[NpkPartID.SQUASHFS].data) |
||||
|
print(f"extract {squashfs_file} ...") |
||||
|
_, stderr = run_shell_command(f"unsquashfs -d {extract_dir} {squashfs_file}") |
||||
|
print(stderr.decode()) |
||||
|
patch_squashfs(extract_dir,key_dict) |
||||
|
print(f"pack {extract_dir} ...") |
||||
|
run_shell_command(f"rm -f {squashfs_file}") |
||||
|
_, stderr = run_shell_command(f"mksquashfs {extract_dir} {squashfs_file} -quiet -comp xz -no-xattrs -b 256k") |
||||
|
print(stderr.decode()) |
||||
|
except Exception as e: |
||||
|
print(e) |
||||
|
print(f"clean ...") |
||||
|
run_shell_command(f"rm -rf {extract_dir}") |
||||
|
npk[NpkPartID.SQUASHFS].data = open(squashfs_file,'rb').read() |
||||
|
run_shell_command(f"rm -f {squashfs_file}") |
||||
|
kcdsa_private_key = bytes.fromhex(os.environ['CUSTOM_LICENSE_PRIVATE_KEY']) |
||||
|
eddsa_private_key = bytes.fromhex(os.environ['CUSTOM_NPK_SIGN_PRIVATE_KEY']) |
||||
|
npk.sign(kcdsa_private_key,eddsa_private_key) |
||||
|
npk.save(npk_file) |
||||
|
|
||||
|
if __name__ == '__main__': |
||||
|
import os,sys |
||||
|
key_dict = { |
||||
|
bytes.fromhex(os.environ['MIKRO_LICENSE_PUBLIC_KEY']):bytes.fromhex(os.environ['CUSTOM_LICENSE_PUBLIC_KEY']), |
||||
|
bytes.fromhex(os.environ['MIKRO_NPK_SIGN_PUBLIC_LKEY']):bytes.fromhex(os.environ['CUSTOM_NPK_SIGN_PUBLIC_KEY']) |
||||
|
} |
||||
|
if len(sys.argv) == 2: |
||||
|
print(f'patching {sys.argv[1]} ...') |
||||
|
patch_system_npk(sys.argv[1],key_dict) |
||||
|
else: |
||||
|
print('usage: python patch.py npk_file') |
||||
|
|
||||
|
After Width: 1589 | Height: 836 | Size: 91 KiB |
@ -0,0 +1,317 @@ |
|||||
|
#!/usr/bin/env python |
||||
|
# |
||||
|
# Copyright (c) 2012 Dave Pifke. |
||||
|
# |
||||
|
# Permission is hereby granted, free of charge, to any person obtaining a copy |
||||
|
# of this software and associated documentation files (the "Software"), to |
||||
|
# deal in the Software without restriction, including without limitation the |
||||
|
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or |
||||
|
# sell copies of the Software, and to permit persons to whom the Software is |
||||
|
# furnished to do so, subject to the following conditions: |
||||
|
# |
||||
|
# The above copyright notice and this permission notice shall be included in |
||||
|
# all copies or substantial portions of the Software. |
||||
|
# |
||||
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||||
|
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||||
|
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
||||
|
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||||
|
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
||||
|
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS |
||||
|
# IN THE SOFTWARE. |
||||
|
# |
||||
|
|
||||
|
"""SHA256 (FIPS 180-3) implementation for experimentation.""" |
||||
|
|
||||
|
import binascii |
||||
|
import codecs |
||||
|
import collections |
||||
|
import struct |
||||
|
import sys |
||||
|
|
||||
|
if sys.version > '3': |
||||
|
long = int |
||||
|
|
||||
|
|
||||
|
class SHA256(object): |
||||
|
""" |
||||
|
SHA256 (FIPS 180-3) implementation for experimentation. |
||||
|
|
||||
|
This is an implementation of the hash function designed not for |
||||
|
efficiency, but for clarity and ability to experiment. The details |
||||
|
of the algorithm are abstracted out with subclassing in mind. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
# Container for the state registers between rounds: |
||||
|
State = collections.namedtuple('State', 'a b c d e f g h') |
||||
|
|
||||
|
# From FIPS 180-3 section 5.3.3 (page 15): |
||||
|
INITIAL_STATE = State( |
||||
|
0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, |
||||
|
0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19 |
||||
|
) |
||||
|
|
||||
|
# From FIPS 180-3 section 4.2.2 (page 11): |
||||
|
K = ( |
||||
|
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, |
||||
|
0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, |
||||
|
0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, |
||||
|
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, |
||||
|
0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, |
||||
|
0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, |
||||
|
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, |
||||
|
0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, |
||||
|
0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, |
||||
|
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, |
||||
|
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, |
||||
|
0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, |
||||
|
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, |
||||
|
0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, |
||||
|
0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, |
||||
|
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 |
||||
|
) |
||||
|
|
||||
|
# Abstract bitwise operations, which can be overridden to provide tracing |
||||
|
# or alternate implementations: |
||||
|
@staticmethod |
||||
|
def _sum_mod32(*args): |
||||
|
return sum(args) & 0xffffffff |
||||
|
@classmethod |
||||
|
def _xor(cls, *args): |
||||
|
if len(args) == 2: |
||||
|
return args[0] ^ args[1] |
||||
|
else: |
||||
|
return args[0] ^ cls._xor(*args[1:]) |
||||
|
_and = staticmethod(lambda x, y: x & y) |
||||
|
_invert = staticmethod(lambda x: ~x) |
||||
|
|
||||
|
# Operations defined by FIPS 180-3 section 3.2 (page 8): |
||||
|
_rrot = staticmethod(lambda x, n: ((x & 0xffffffff) >> n) | (x << (32 - n)) & 0xffffffff) |
||||
|
_shr = staticmethod(lambda x, n: (x & 0xffffffff) >> n) |
||||
|
|
||||
|
# Operations defined by FIPS 180-3 section 4.1.2 (page 10): |
||||
|
_ch = classmethod(lambda cls, x, y, z: cls._xor(cls._and(x, y), cls._and(cls._invert(x), z))) |
||||
|
_maj = classmethod(lambda cls, x, y, z: cls._xor(cls._and(x, y), cls._and(x, z), cls._and(y, z))) |
||||
|
_S0 = classmethod(lambda cls, x: cls._xor(cls._rrot(x, 2), cls._rrot(x, 13), cls._rrot(x, 22))) |
||||
|
_S1 = classmethod(lambda cls, x: cls._xor(cls._rrot(x, 6), cls._rrot(x, 11), cls._rrot(x, 25))) |
||||
|
_s0 = classmethod(lambda cls, x: cls._xor(cls._rrot(x, 7), cls._rrot(x, 18), cls._shr(x, 3))) |
||||
|
_s1 = classmethod(lambda cls, x: cls._xor(cls._rrot(x, 17), cls._rrot(x, 19), cls._shr(x, 10))) |
||||
|
|
||||
|
# Operations defined by FIPS 180-3 section 6.2.2 (page 22): |
||||
|
_T1 = classmethod(lambda cls, prev, w, k: cls._sum_mod32(cls._S1(prev.e), cls._ch(prev.e, prev.f, prev.g), prev.h, w, k)) |
||||
|
_T2 = classmethod(lambda cls, prev: cls._sum_mod32(cls._S0(prev.a), cls._maj(prev.a, prev.b, prev.c))) |
||||
|
|
||||
|
@classmethod |
||||
|
def _round(cls, number, w, prev=INITIAL_STATE): |
||||
|
""" |
||||
|
Performs one round of SHA256 message transformation, returning the new |
||||
|
message state. See FIPS 180-3 section 6.2.2 step 3 (pages 21-22). |
||||
|
|
||||
|
:param number: |
||||
|
The round number. |
||||
|
|
||||
|
:param w: |
||||
|
The expanded word of the input for this round. |
||||
|
|
||||
|
:param prev: |
||||
|
Named tuple containing the working state from the previous round. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
t1 = cls._T1(prev, w, cls.K[number % 64]) |
||||
|
return cls.State( |
||||
|
a=cls._sum_mod32(t1, cls._T2(prev)), |
||||
|
b=prev.a, |
||||
|
c=prev.b, |
||||
|
d=prev.c, |
||||
|
e=cls._sum_mod32(prev.d, t1), |
||||
|
f=prev.e, |
||||
|
g=prev.f, |
||||
|
h=prev.g |
||||
|
) |
||||
|
|
||||
|
@classmethod |
||||
|
def _finalize(cls, state, initial_state=INITIAL_STATE): |
||||
|
""" |
||||
|
Returns the intermediate state after the final round for a given block |
||||
|
is complete. See FIPS 180-3 section 6.2.2 step 4 (page 22). |
||||
|
|
||||
|
:param state: |
||||
|
The digest state after the final round. |
||||
|
|
||||
|
:param initial_state: |
||||
|
The digest state from before the first round. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
return cls.State( |
||||
|
a=cls._sum_mod32(state.a, initial_state.a), |
||||
|
b=cls._sum_mod32(state.b, initial_state.b), |
||||
|
c=cls._sum_mod32(state.c, initial_state.c), |
||||
|
d=cls._sum_mod32(state.d, initial_state.d), |
||||
|
e=cls._sum_mod32(state.e, initial_state.e), |
||||
|
f=cls._sum_mod32(state.f, initial_state.f), |
||||
|
g=cls._sum_mod32(state.g, initial_state.g), |
||||
|
h=cls._sum_mod32(state.h, initial_state.h) |
||||
|
) |
||||
|
|
||||
|
@classmethod |
||||
|
def _expand_message(cls, message): |
||||
|
""" |
||||
|
Returns a list of 64 32-bit words based upon 16 32-bit words from the |
||||
|
message block being hashed. See FIPS 180-3 section 6.2.2 step 1 |
||||
|
(page 21). |
||||
|
|
||||
|
:param message: |
||||
|
Array of 16 32-bit values (512 bits total). |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
assert len(message) == 16, '_expand_message() got %d words, expected 16' % len(message) |
||||
|
|
||||
|
w = list(message) |
||||
|
for i in range(16, 64): |
||||
|
w.append(cls._sum_mod32(w[i - 16], cls._s0(w[i - 15]), w[i - 7], cls._s1(w[i - 2]))) |
||||
|
|
||||
|
return w |
||||
|
|
||||
|
@classmethod |
||||
|
def _process_block(cls, message, state=INITIAL_STATE, round_offset=0): |
||||
|
""" |
||||
|
Processes a block of message data, returning the new digest state |
||||
|
(the intermediate hash value). See FIPS 180-3 section 6.2.2 (pages |
||||
|
21 and 22). |
||||
|
|
||||
|
:param message: |
||||
|
Byte string of length 64 containing the block data to hash. |
||||
|
|
||||
|
:param state: |
||||
|
The digest state from the previous block. |
||||
|
|
||||
|
:param round_offset: |
||||
|
The _round() method can be overridden to report intermediate hash |
||||
|
values, in which case it's useful to know how many rounds came |
||||
|
before. This argument allows the caller to specify as much. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
assert len(message) == 64, '_process_block() got %d bytes, expected 64' % len(message) |
||||
|
assert not round_offset % 64, 'round_offset should be a multiple of 64' |
||||
|
|
||||
|
w = cls._expand_message(struct.unpack('>LLLLLLLLLLLLLLLL', message)) |
||||
|
|
||||
|
midstate = state |
||||
|
for i in range(64): |
||||
|
midstate = cls._round(round_offset + i, w[i], midstate) |
||||
|
|
||||
|
return cls._finalize(midstate, state) |
||||
|
|
||||
|
@classmethod |
||||
|
def _pad_message(cls, message, length): |
||||
|
""" |
||||
|
Returns a list containing the final 1 or 2 message blocks, which |
||||
|
include the message padding per FIPS 180-3 section 5.1.1 (page 13). |
||||
|
|
||||
|
:param message: |
||||
|
Byte string containing the final block data to hash. Should be |
||||
|
less than a full block's worth (63 bytes or less). |
||||
|
|
||||
|
:param length: |
||||
|
Length of the message, in bits. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
assert len(message) < 64, 'Input to _pad_message() must be less than 512 bits' |
||||
|
|
||||
|
if len(message) <= 55: |
||||
|
# Append trailing 1 bit, then padding, then length |
||||
|
return [b''.join(( |
||||
|
message, |
||||
|
b'\x80', |
||||
|
b'\x00' * (55 - len(message)), |
||||
|
struct.pack('>LL', length >> 32, length & 0xffffffff), |
||||
|
))] |
||||
|
|
||||
|
else: |
||||
|
# Not enough room to append length, return two blocks: |
||||
|
return [ |
||||
|
# First is trailing 1 bit, then padding |
||||
|
b''.join(( |
||||
|
message, |
||||
|
b'\x80', |
||||
|
b'\x00' * (63 - len(message)), |
||||
|
)), |
||||
|
# Next is more padding, then length |
||||
|
b''.join(( |
||||
|
b'\x00' * 56, |
||||
|
struct.pack('>LL', length >> 32, length & 0xffffffff), |
||||
|
)), |
||||
|
] |
||||
|
|
||||
|
def __init__(self, message=b'', round_offset=0): |
||||
|
""" |
||||
|
Constructor. |
||||
|
|
||||
|
:param message: |
||||
|
Initial data to pass to update(). |
||||
|
|
||||
|
:param round_offset: |
||||
|
The _round() method can be overridden to report intermediate hash |
||||
|
values, in which case it's useful to know how many rounds came |
||||
|
before. For applications that perform double-hashing, you can |
||||
|
specify the number of rounds from the previous hash instance |
||||
|
using this parameter. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
self.state = self.INITIAL_STATE |
||||
|
self.length = long(0) |
||||
|
self.buffer = b'' |
||||
|
self.round_offset = round_offset |
||||
|
|
||||
|
self.update(message) |
||||
|
|
||||
|
def update(self, message): |
||||
|
""" |
||||
|
Updates the hash with the contents of *message*. |
||||
|
|
||||
|
Hashing uses 512-bit blocks, so the message is buffered until there's |
||||
|
enough data to process a complete block. When digest() is called, |
||||
|
any remaining data in the buffer will be padded and digested. |
||||
|
|
||||
|
:param message: |
||||
|
A byte string to digest. |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
message = bytes(message) |
||||
|
self.length += len(message) * 8 |
||||
|
self.buffer = b''.join((self.buffer, message)) |
||||
|
|
||||
|
while len(self.buffer) >= 64: |
||||
|
self.state = self._process_block(self.buffer[:64], self.state, self.round_offset) |
||||
|
self.buffer = self.buffer[64:] |
||||
|
self.round_offset += 64 |
||||
|
|
||||
|
def digest(self): |
||||
|
""" |
||||
|
Returns the SHA256 digest of the message. |
||||
|
|
||||
|
The hash is based on all data passed thus far via the constructor and |
||||
|
update(). Any buffered data will be processed (along with the |
||||
|
terminating length), however the internal state is not modified. This |
||||
|
means that update() can safely be used again after digest(). |
||||
|
|
||||
|
""" |
||||
|
|
||||
|
final_state = self.state |
||||
|
for block in self._pad_message(self.buffer, self.length): |
||||
|
final_state = self._process_block(block, final_state, self.round_offset) |
||||
|
|
||||
|
return struct.pack('>LLLLLLLL', *final_state) |
||||
|
|
||||
|
def hexdigest(self): |
||||
|
"""Like digest(), but returns a hexadecimal string.""" |
||||
|
|
||||
|
return binascii.hexlify(self.digest()) |
||||
@ -0,0 +1,188 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
try: |
||||
|
from pyasn1.type import univ, namedtype, tag |
||||
|
import pyasn1.codec.ber.decoder |
||||
|
|
||||
|
class ECPVer(univ.Integer): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
ECPVer ::= INTEGER {ecpVer1(1)} |
||||
|
""" |
||||
|
pass |
||||
|
|
||||
|
class FieldElement(univ.OctetString): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
FieldElement ::= OCTET STRING |
||||
|
""" |
||||
|
pass |
||||
|
|
||||
|
class ECPoint(univ.OctetString): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
ECPoint ::= OCTET STRING |
||||
|
""" |
||||
|
pass |
||||
|
|
||||
|
class Curve(univ.Sequence): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
Curve ::= SEQUENCE { |
||||
|
a FieldElement, |
||||
|
b FieldElement, |
||||
|
seed BIT STRING OPTIONAL |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("a", FieldElement()), |
||||
|
namedtype.NamedType("b", FieldElement()), |
||||
|
namedtype.OptionalNamedType("seed", univ.BitString()), |
||||
|
) |
||||
|
|
||||
|
class FieldID(univ.Sequence): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
FieldID ::= SEQUENCE { |
||||
|
fieldType OBJECT IDENTIFIER, |
||||
|
parameters ANY DEFINED BY fieldType |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("fieldType", univ.ObjectIdentifier()), |
||||
|
namedtype.NamedType("parameters", univ.Any()), |
||||
|
) |
||||
|
|
||||
|
class SpecifiedECDomain(univ.Sequence): |
||||
|
"""RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile |
||||
|
|
||||
|
ECParameters ::= SEQUENCE { |
||||
|
version ECPVer, -- version is always 1 |
||||
|
fieldID FieldID, -- identifies the finite field over which the curve is defined |
||||
|
curve Curve, -- coefficients a and b of the elliptic curve |
||||
|
base ECPoint, -- specifies the base point P on the elliptic curve |
||||
|
order INTEGER, -- the order n of the base point |
||||
|
cofactor INTEGER OPTIONAL -- The integer h = #E(Fq)/n |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("version", ECPVer()), |
||||
|
namedtype.NamedType("fieldID", FieldID()), |
||||
|
namedtype.NamedType("curve", Curve()), |
||||
|
namedtype.NamedType("base", ECPoint()), |
||||
|
namedtype.NamedType("order", univ.Integer()), |
||||
|
namedtype.OptionalNamedType("cofactor", univ.Integer()), |
||||
|
) |
||||
|
|
||||
|
class ECParameters(univ.Choice): |
||||
|
"""RFC 5480: Elliptic Curve Cryptography Subject Public Key Information |
||||
|
|
||||
|
ECParameters ::= CHOICE { |
||||
|
namedCurve OBJECT IDENTIFIER |
||||
|
implicitCurve NULL |
||||
|
specifiedCurve SpecifiedECDomain |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("namedCurve", univ.ObjectIdentifier()), |
||||
|
namedtype.NamedType("implicitCurve", univ.Null()), |
||||
|
namedtype.NamedType("specifiedCurve", SpecifiedECDomain()), |
||||
|
) |
||||
|
|
||||
|
|
||||
|
class ECPrivateKey(univ.Sequence): |
||||
|
"""RFC 5915: Elliptic Curve Private Key Structure |
||||
|
|
||||
|
ECPrivateKey ::= SEQUENCE { |
||||
|
version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1), |
||||
|
privateKey OCTET STRING, |
||||
|
parameters [0] ECParameters {{ NamedCurve }} OPTIONAL, |
||||
|
publicKey [1] BIT STRING OPTIONAL |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("version", univ.Integer()), |
||||
|
namedtype.NamedType("privateKey", univ.OctetString()), |
||||
|
namedtype.OptionalNamedType("parameters", ECParameters().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), |
||||
|
namedtype.OptionalNamedType("publicKey", univ.BitString().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), |
||||
|
) |
||||
|
|
||||
|
class AlgorithmIdentifier(univ.Sequence): |
||||
|
"""RFC 5480: Elliptic Curve Cryptography Subject Public Key Information |
||||
|
|
||||
|
AlgorithmIdentifier ::= SEQUENCE { |
||||
|
algorithm OBJECT IDENTIFIER, |
||||
|
parameters ANY DEFINED BY algorithm OPTIONAL |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("algorithm", univ.ObjectIdentifier()), |
||||
|
namedtype.NamedType("parameters", ECParameters()), |
||||
|
) |
||||
|
|
||||
|
class ECPublicKey(univ.Sequence): |
||||
|
"""RFC 5480: Elliptic Curve Cryptography Subject Public Key Information |
||||
|
|
||||
|
SubjectPublicKeyInfo ::= SEQUENCE { |
||||
|
algorithm AlgorithmIdentifier, |
||||
|
subjectPublicKey BIT STRING |
||||
|
} |
||||
|
""" |
||||
|
componentType = namedtype.NamedTypes( |
||||
|
namedtype.NamedType("algorithm", AlgorithmIdentifier()), |
||||
|
namedtype.NamedType("subjectPublicKey", univ.BitString()), |
||||
|
) |
||||
|
|
||||
|
class FieldFPParameters(univ.Integer): |
||||
|
"""For F_P fields, the field parameters is just the integer P.""" |
||||
|
pass |
||||
|
|
||||
|
__have_asn1 = True |
||||
|
except ImportError: |
||||
|
__have_asn1 = False |
||||
|
|
||||
|
def have_asn1_support(): |
||||
|
return __have_asn1 |
||||
|
|
||||
|
def __assert_asn1_support(): |
||||
|
if not have_asn1_support(): |
||||
|
raise Exception("ASN.1 support is required, but the pyasn1 library could not be imported. Functionality not available.") |
||||
|
|
||||
|
def parse_asn1_field_params_fp(derdata): |
||||
|
"""Parse an ASN.1 DER encoded field parameter for fields in F_P.""" |
||||
|
__assert_asn1_support() |
||||
|
(parsed, tail) = pyasn1.codec.ber.decoder.decode(derdata, asn1Spec = FieldFPParameters()) |
||||
|
return parsed |
||||
|
|
||||
|
def parse_asn1_public_key(derdata): |
||||
|
"""Parse an ASN.1 DER encoded EC public key.""" |
||||
|
__assert_asn1_support() |
||||
|
(parsed, tail) = pyasn1.codec.ber.decoder.decode(derdata, asn1Spec = ECPublicKey()) |
||||
|
return parsed |
||||
|
|
||||
|
def parse_asn1_private_key(derdata): |
||||
|
"""Parse an ASN.1 DER encoded EC private key.""" |
||||
|
__assert_asn1_support() |
||||
|
(parsed, tail) = pyasn1.codec.ber.decoder.decode(derdata, asn1Spec = ECPrivateKey()) |
||||
|
return parsed |
||||
@ -0,0 +1,132 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import math |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
from .PointOps import PointOpEDDSAEncoding, PointOpCurveConversion, PointOpNaiveOrderCalculation, PointOpSerialization, PointOpScalarMultiplicationXOnly |
||||
|
|
||||
|
class AffineCurvePoint(PointOpEDDSAEncoding, PointOpCurveConversion, PointOpNaiveOrderCalculation, PointOpSerialization, PointOpScalarMultiplicationXOnly): |
||||
|
"""Represents a point on a curve in affine (x, y) representation.""" |
||||
|
|
||||
|
def __init__(self, x, y, curve): |
||||
|
"""Generate a curve point (x, y) on the curve 'curve'. x and y have to |
||||
|
be integers. If the neutral element of the group O (for some curves, |
||||
|
this is a point at infinity) should be created, use the static method |
||||
|
'neutral', since representations of O differ on various curves (e.g. in |
||||
|
short Weierstrass curves, they have no explicit notation in affine |
||||
|
space while on twisted Edwards curves they do.""" |
||||
|
# Either x and y are None (Point at Infty) or both are defined |
||||
|
assert(((x is None) and (y is None)) or ((x is not None) and (y is not None))) |
||||
|
assert((x is None) or isinstance(x, int)) |
||||
|
assert((y is None) or isinstance(y, int)) |
||||
|
if x is None: |
||||
|
# Point at infinity |
||||
|
self._x = None |
||||
|
self._y = None |
||||
|
else: |
||||
|
self._x = FieldElement(x, curve.p) |
||||
|
self._y = FieldElement(y, curve.p) |
||||
|
self._curve = curve |
||||
|
|
||||
|
@staticmethod |
||||
|
def neutral(curve): |
||||
|
"""Returns the neutral element of the curve group.""" |
||||
|
return curve.neutral() |
||||
|
|
||||
|
@property |
||||
|
def is_neutral(self): |
||||
|
"""Indicates if the point is the neutral element O of the curve (point |
||||
|
at infinity for some curves).""" |
||||
|
return self.curve.is_neutral(self) |
||||
|
|
||||
|
@property |
||||
|
def x(self): |
||||
|
"""Affine X component of the point, field element of p.""" |
||||
|
return self._x |
||||
|
|
||||
|
@property |
||||
|
def y(self): |
||||
|
"""Affine Y component of the point, field element of p.""" |
||||
|
return self._y |
||||
|
|
||||
|
@property |
||||
|
def curve(self): |
||||
|
"""Curve that the point is located on.""" |
||||
|
return self._curve |
||||
|
|
||||
|
def __add__(self, other): |
||||
|
"""Returns the point addition.""" |
||||
|
assert(isinstance(other, AffineCurvePoint)) |
||||
|
return self.curve.point_addition(self, other) |
||||
|
|
||||
|
def __rmul__(self, other): |
||||
|
return self * other |
||||
|
|
||||
|
def __neg__(self): |
||||
|
"""Returns the conjugated point.""" |
||||
|
return self.curve.point_conjugate(self) |
||||
|
|
||||
|
def __mul__(self, scalar): |
||||
|
"""Returns the scalar point multiplication. The scalar needs to be an |
||||
|
integer value.""" |
||||
|
assert(isinstance(scalar, int)) |
||||
|
assert(scalar >= 0) |
||||
|
|
||||
|
result = self.curve.neutral() |
||||
|
n = self |
||||
|
if scalar > 0: |
||||
|
for bit in range(scalar.bit_length()): |
||||
|
if (scalar & (1 << bit)): |
||||
|
result = result + n |
||||
|
n = n + n |
||||
|
#assert(result.oncurve()) |
||||
|
return result |
||||
|
|
||||
|
def __eq__(self, other): |
||||
|
return (self.x, self.y) == (other.x, other.y) |
||||
|
|
||||
|
def __ne__(self, other): |
||||
|
return not (self == other) |
||||
|
|
||||
|
def __hash__(self): |
||||
|
return hash((self.x, self.y)) |
||||
|
|
||||
|
def oncurve(self): |
||||
|
"""Indicates if the given point is satisfying the curve equation (i.e. |
||||
|
if it is a point on the curve).""" |
||||
|
return self.curve.oncurve(self) |
||||
|
|
||||
|
def compress(self): |
||||
|
"""Returns the compressed point format (if this is possible on the |
||||
|
given curve).""" |
||||
|
return self.curve.compress(self) |
||||
|
|
||||
|
def __repr__(self): |
||||
|
return str(self) |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self.is_neutral: |
||||
|
return "(neutral)" |
||||
|
else: |
||||
|
return "(0x%x, 0x%x)" % (int(self.x), int(self.y)) |
||||
@ -0,0 +1,59 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
|
||||
|
class CRT(): |
||||
|
"""Implements the Chinese Remainder Theorem algorithm where a number of |
||||
|
modular congruences are given that all need to be satisfied.""" |
||||
|
def __init__(self): |
||||
|
self._moduli = { } |
||||
|
|
||||
|
def add(self, value, modulus): |
||||
|
"""Adds a value that shall be returned when the result is taken modulo |
||||
|
the given modulus.""" |
||||
|
assert(modulus not in self._moduli) |
||||
|
assert(isinstance(value, int)) |
||||
|
assert(isinstance(modulus, int)) |
||||
|
self._moduli[modulus] = value |
||||
|
return self |
||||
|
|
||||
|
def solve(self): |
||||
|
"""Solve the Chinese Remainder Theorem for the given values and |
||||
|
moduli.""" |
||||
|
# Calculate product of all moduli |
||||
|
product = 1 |
||||
|
for modulus in self._moduli.keys(): |
||||
|
product *= modulus |
||||
|
|
||||
|
# Then determine the solution |
||||
|
solution = 0 |
||||
|
for modulus in self._moduli.keys(): |
||||
|
if self._moduli[modulus] == 0: |
||||
|
continue |
||||
|
|
||||
|
rem_product = product // modulus |
||||
|
one_value = int(FieldElement(rem_product, modulus).inverse()) |
||||
|
solution += rem_product * one_value * self._moduli[modulus] |
||||
|
|
||||
|
return solution % product |
||||
@ -0,0 +1,842 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import enum |
||||
|
import collections |
||||
|
from .ShortWeierstrassCurve import ShortWeierstrassCurve |
||||
|
from .MontgomeryCurve import MontgomeryCurve |
||||
|
from .TwistedEdwardsCurve import TwistedEdwardsCurve |
||||
|
from .Singleton import singleton |
||||
|
from .FieldElement import FieldElement |
||||
|
from .Exceptions import DuplicateCurveException, NoSuchCurveException, UnsupportedFieldException |
||||
|
from .ASN1 import parse_asn1_field_params_fp |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .CurveQuirks import CurveQuirkEdDSASetPrivateKeyMSB, CurveQuirkEdDSAEnsurePrimeOrderSubgroup, CurveQuirkSigningHashFunction |
||||
|
from . import Tools |
||||
|
|
||||
|
@singleton |
||||
|
class CurveDB(object): |
||||
|
def __init__(self): |
||||
|
self._entries = { } |
||||
|
self._primary_names = set() |
||||
|
self._taken_names = set() |
||||
|
|
||||
|
def _checknames(self, curvenames): |
||||
|
if len(curvenames & self._taken_names) > 0: |
||||
|
taken_names = ", ".join(sorted(list(curvenames & self._taken_names))) |
||||
|
raise DuplicateCurveException("Curve(s) named %s already registered in curve DB." % (taken_names)) |
||||
|
|
||||
|
def register(self, entry): |
||||
|
"""Registers a curve in the curve database.""" |
||||
|
all_names = set(name.lower() for name in entry.all_aliases) |
||||
|
self._checknames(all_names) |
||||
|
self._taken_names |= all_names |
||||
|
self._primary_names.add(entry.name) |
||||
|
|
||||
|
self._entries[entry.primary_name.lower()] = entry |
||||
|
for aliasname in entry.aliases: |
||||
|
clone = entry.clone(secondary_name = aliasname) |
||||
|
self._entries[aliasname.lower()] = clone |
||||
|
|
||||
|
def curvenames(self): |
||||
|
"""Returns the primary names of all curves in the DB.""" |
||||
|
return (curve.name for curve in self._entries.values() if (curve.is_aka is False)) |
||||
|
|
||||
|
def allcurvenames(self): |
||||
|
"""Returns all names of all curves in the DB. This includes duplicate |
||||
|
AKAs such as secp224r1 which is also known as wap-wsg-idm-ecid-wtls12 |
||||
|
albeit under a different OID.""" |
||||
|
return (curve.name for curve in self._entries.values()) |
||||
|
|
||||
|
def find_duplicate_curves(self): |
||||
|
"""Returns curves in which the domain parameters (including the |
||||
|
coordinates of the generator point G) are identical. This can happen if |
||||
|
identical curves are registered under the same name.""" |
||||
|
params = collections.defaultdict(list) |
||||
|
for curve in self: |
||||
|
params[tuple(sorted(curve.domain_params))].append(curve.name) |
||||
|
return [ curves for (param, curves) in params.items() if (len(curves) > 1) ] |
||||
|
|
||||
|
def getentry(self, name): |
||||
|
"""Returns a specific curve entry by its case-insensitive name.""" |
||||
|
name = name.lower() |
||||
|
if name not in self._entries: |
||||
|
raise KeyError("Curve named '%s' is not known in curve database." % (name)) |
||||
|
return self._entries[name] |
||||
|
|
||||
|
def get_curve_from_asn1(self, asn1): |
||||
|
"""This function will take a parsed ASN.1 ECParameters class as input |
||||
|
and try to return the curve specified within. If the ECParameters |
||||
|
specify a named curve by its's OID then a lookup is performed against |
||||
|
the curve database and that named curve returned on success if |
||||
|
non-ambiguous. If the parameters are exclicitly stated, then an unnamed |
||||
|
ShortWeierstrassCurve is constructed.""" |
||||
|
|
||||
|
if asn1["namedCurve"] is not None: |
||||
|
# Curve is encoded as OID, look up from curve DB |
||||
|
curve_oid = str(asn1["namedCurve"]) |
||||
|
entries = [ entry for entry in self if (entry.oid == curve_oid) ] |
||||
|
if len(entries) == 0: |
||||
|
raise NoSuchCurveException("Trying to load curve with OID %s from curve DB, but no such curve is present in database." % (curve_oid)) |
||||
|
elif len(entries) > 1: |
||||
|
raise Exception("Trying to load curve with OID %s from curve DB, but found %d curves (refuse to guess in the face of ambiguity)." % (curve_oid, len(entries))) |
||||
|
curve = entries[0]() |
||||
|
elif asn1["specifiedCurve"] is not None: |
||||
|
field_type_oid = str(asn1["specifiedCurve"]["fieldID"]["fieldType"]) |
||||
|
if field_type_oid == "1.2.840.10045.1.1": |
||||
|
# F_P curve is encoded in explicit form |
||||
|
p = int(parse_asn1_field_params_fp(asn1["specifiedCurve"]["fieldID"]["parameters"])) |
||||
|
a = Tools.bytestoint(asn1["specifiedCurve"]["curve"]["a"]) |
||||
|
b = Tools.bytestoint(asn1["specifiedCurve"]["curve"]["b"]) |
||||
|
G = bytes(asn1["specifiedCurve"]["base"]) |
||||
|
(Gx, Gy) = AffineCurvePoint.deserialize_uncompressed(G) |
||||
|
n = int(asn1["specifiedCurve"]["order"]) |
||||
|
h = int(asn1["specifiedCurve"]["cofactor"]) |
||||
|
curve = ShortWeierstrassCurve(p = p, a = a, b = b, n = n, h = h, Gx = Gx, Gy = Gy) |
||||
|
else: |
||||
|
# Maybe F_2^N curve or some other, unsupported type |
||||
|
raise UnsupportedFieldException("Only supports elliptic curves in F_P are supported, but the requested field type OID was %s." % (field_type_oid)) |
||||
|
else: |
||||
|
raise NoSuchCurveException("Cannot load implicit curve.") |
||||
|
return curve |
||||
|
|
||||
|
def __iter__(self): |
||||
|
"""Iterates over the curve DB entries.""" |
||||
|
for name in self.curvenames(): |
||||
|
yield self._entries[name.lower()] |
||||
|
|
||||
|
def __getitem__(self, name): |
||||
|
"""Returns a curve (not a curve DB entry) by its name.""" |
||||
|
return self.getentry(name)() |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "CurveDB<%d unique curves, %d total>" % (len(self._primary_names), len(self._entries)) |
||||
|
|
||||
|
|
||||
|
class _CurveDBEntry(object): |
||||
|
def __init__(self, primary_name, curve_class, domain_params, **kwargs): |
||||
|
allowed_kwargs = set(("oid", "alt_oids", "aliases", "origin", "secure", "quirks")) |
||||
|
wrong_args = kwargs.keys() - allowed_kwargs |
||||
|
if len(wrong_args) > 0: |
||||
|
raise Exception("Illegal keyword arguments: %s" % (", ".join(sorted(wrong_args)))) |
||||
|
|
||||
|
assert(primary_name is not None) |
||||
|
self._primary_name = primary_name |
||||
|
self._secondary_name = None |
||||
|
self._curve_class = curve_class |
||||
|
self._domain_params = domain_params |
||||
|
self._oid = kwargs.get("oid") |
||||
|
self._alt_oids = kwargs.get("alt_oids") |
||||
|
self._aliases = kwargs.get("aliases") |
||||
|
self._origin = kwargs.get("origin") |
||||
|
self._secure = kwargs.get("secure", True) |
||||
|
self._quirks = kwargs.get("quirks", [ ]) |
||||
|
self._instance = None |
||||
|
|
||||
|
def clone(self, secondary_name = None): |
||||
|
clone = _CurveDBEntry(primary_name = self._primary_name, curve_class = self._curve_class, domain_params = self._domain_params, oid = self._oid, alt_oids = self._alt_oids, aliases = self._aliases, origin = self._origin, secure = self._secure) |
||||
|
clone._instance = self._instance |
||||
|
clone._secondary_name = secondary_name |
||||
|
return clone |
||||
|
|
||||
|
@property |
||||
|
def is_aka(self): |
||||
|
"""Returns if this curve entry is an AKA ('also known as') for a |
||||
|
different curve (but maybe with a different OID). Example: prime192v1 |
||||
|
and secp192r1 refer to identical curves, but 'prime192v1' is the |
||||
|
internally considered primary name while 'secp192r1' is considered to |
||||
|
be an AKA.""" |
||||
|
return self._secondary_name is not None |
||||
|
|
||||
|
@property |
||||
|
def primary_name(self): |
||||
|
return self._primary_name |
||||
|
|
||||
|
@property |
||||
|
def name(self): |
||||
|
if self._secondary_name is not None: |
||||
|
return self._secondary_name |
||||
|
else: |
||||
|
return self._primary_name |
||||
|
|
||||
|
@property |
||||
|
def fieldsize_bits(self): |
||||
|
return self._domain_params["p"].bit_length() |
||||
|
|
||||
|
@property |
||||
|
def secure(self): |
||||
|
return self._secure |
||||
|
|
||||
|
@property |
||||
|
def origin(self): |
||||
|
return self._origin |
||||
|
|
||||
|
@property |
||||
|
def bits_security_estimate(self): |
||||
|
if not self.secure: |
||||
|
return 0 |
||||
|
else: |
||||
|
# Require instanciation of the class |
||||
|
self() |
||||
|
return self._instance.security_bit_estimate |
||||
|
|
||||
|
def get_alternative_oid(self, name): |
||||
|
"""Returns the alternative OID if it has one.""" |
||||
|
if self._alt_oids is not None: |
||||
|
return self._alt_oids.get(name) |
||||
|
|
||||
|
@property |
||||
|
def oid(self): |
||||
|
if (self._alt_oids is not None) and (self.name in self._alt_oids): |
||||
|
return self._alt_oids[self.name] |
||||
|
else: |
||||
|
return self._oid |
||||
|
|
||||
|
@property |
||||
|
def aliases(self): |
||||
|
if self._aliases is not None: |
||||
|
yield from self._aliases |
||||
|
|
||||
|
@property |
||||
|
def all_aliases(self): |
||||
|
yield self._primary_name |
||||
|
yield from self.aliases |
||||
|
|
||||
|
@property |
||||
|
def prettyname(self): |
||||
|
if self._instance is None: |
||||
|
return self._curve_class.pretty_name |
||||
|
else: |
||||
|
return self._instance.prettyname |
||||
|
|
||||
|
@property |
||||
|
def domain_params(self): |
||||
|
if self._instance is None: |
||||
|
return dict(self._domain_params) |
||||
|
else: |
||||
|
return self._instance.domainparamdict |
||||
|
|
||||
|
@property |
||||
|
def prettytitle(self): |
||||
|
return "%d bit %s Curve" % (self.fieldsize_bits, self.prettyname) |
||||
|
|
||||
|
def dump(self, domain = False): |
||||
|
print("%s: %s" % (self.name, self.prettytitle)) |
||||
|
if self._aliases is not None: |
||||
|
print("Aliases: %s" % (", ".join(sorted(list(self._aliases))))) |
||||
|
if self._oid is not None: |
||||
|
print("OID : %s" % (self._oid)) |
||||
|
if domain: |
||||
|
print("Domain parameters:") |
||||
|
for (key, value) in sorted(self.domain_params.items()): |
||||
|
if isinstance(value, FieldElement): |
||||
|
value = value.sigint() |
||||
|
print(" %-10s %s" % (key, value)) |
||||
|
|
||||
|
def __call__(self): |
||||
|
"""Instanciate the curve.""" |
||||
|
if self._instance is None: |
||||
|
# Instanciate actual curve |
||||
|
params = self._domain_params |
||||
|
params["name"] = self.name |
||||
|
params["quirks"] = self._quirks |
||||
|
self._instance = self._curve_class(**params) |
||||
|
return self._instance |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self._secondary_name is not None: |
||||
|
return "CurveDBEntry<%s AKA %s>" % (self.primary_name, self._secondary_name) |
||||
|
else: |
||||
|
return "CurveDBEntry<%s>" % (self.name) |
||||
|
|
||||
|
cdb = CurveDB() |
||||
|
cdb.register(_CurveDBEntry("brainpoolP160r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x340e7be2a280eb74e2be61bada745d97e8f7c300, |
||||
|
"b": 0x1e589a8595423412134faa2dbdec95c8d8675e58, |
||||
|
"p": 0xe95e4a5f737059dc60dfc7ad95b3d8139515620f, |
||||
|
"n": 0xe95e4a5f737059dc60df5991d45029409e60fc09, |
||||
|
"h": 1, |
||||
|
"Gx": 0xbed5af16ea3f6a4f62938c4631eb5af7bdbcdbc3, |
||||
|
"Gy": 0x1667cb477a1a8ec338f94741669c976316da6321, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.1", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP160t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xe95e4a5f737059dc60dfc7ad95b3d8139515620c, |
||||
|
"b": 0x7a556b6dae535b7b51ed2c4d7daa7a0b5c55f380, |
||||
|
"p": 0xe95e4a5f737059dc60dfc7ad95b3d8139515620f, |
||||
|
"n": 0xe95e4a5f737059dc60df5991d45029409e60fc09, |
||||
|
"h": 1, |
||||
|
"Gx": 0xb199b13b9b34efc1397e64baeb05acc265ff2378, |
||||
|
"Gy": 0xadd6718b7c7c1961f0991b842443772152c9e0ad, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.2", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP192r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x6a91174076b1e0e19c39c031fe8685c1cae040e5c69a28ef, |
||||
|
"b": 0x469a28ef7c28cca3dc721d044f4496bcca7ef4146fbf25c9, |
||||
|
"p": 0xc302f41d932a36cda7a3463093d18db78fce476de1a86297, |
||||
|
"n": 0xc302f41d932a36cda7a3462f9e9e916b5be8f1029ac4acc1, |
||||
|
"h": 1, |
||||
|
"Gx": 0xc0a0647eaab6a48753b033c56cb0f0900a2f5c4853375fd6, |
||||
|
"Gy": 0x14b690866abd5bb88b5f4828c1490002e6773fa2fa299b8f, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.3", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP192t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xc302f41d932a36cda7a3463093d18db78fce476de1a86294, |
||||
|
"b": 0x13d56ffaec78681e68f9deb43b35bec2fb68542e27897b79, |
||||
|
"p": 0xc302f41d932a36cda7a3463093d18db78fce476de1a86297, |
||||
|
"n": 0xc302f41d932a36cda7a3462f9e9e916b5be8f1029ac4acc1, |
||||
|
"h": 1, |
||||
|
"Gx": 0x3ae9e58c82f63c30282e1fe7bbf43fa72c446af6f4618129, |
||||
|
"Gy": 0x97e2c5667c2223a902ab5ca449d0084b7e5b3de7ccc01c9, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.4", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP224r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x68a5e62ca9ce6c1c299803a6c1530b514e182ad8b0042a59cad29f43, |
||||
|
"b": 0x2580f63ccfe44138870713b1a92369e33e2135d266dbb372386c400b, |
||||
|
"p": 0xd7c134aa264366862a18302575d1d787b09f075797da89f57ec8c0ff, |
||||
|
"n": 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939f, |
||||
|
"h": 1, |
||||
|
"Gx": 0xd9029ad2c7e5cf4340823b2a87dc68c9e4ce3174c1e6efdee12c07d, |
||||
|
"Gy": 0x58aa56f772c0726f24c6b89e4ecdac24354b9e99caa3f6d3761402cd, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.5", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP224t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xd7c134aa264366862a18302575d1d787b09f075797da89f57ec8c0fc, |
||||
|
"b": 0x4b337d934104cd7bef271bf60ced1ed20da14c08b3bb64f18a60888d, |
||||
|
"p": 0xd7c134aa264366862a18302575d1d787b09f075797da89f57ec8c0ff, |
||||
|
"n": 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939f, |
||||
|
"h": 1, |
||||
|
"Gx": 0x6ab1e344ce25ff3896424e7ffe14762ecb49f8928ac0c76029b4d580, |
||||
|
"Gy": 0x374e9f5143e568cd23f3f4d7c0d4b1e41c8cc0d1c6abd5f1a46db4c, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.6", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP256r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9, |
||||
|
"b": 0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6, |
||||
|
"p": 0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377, |
||||
|
"n": 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7, |
||||
|
"h": 1, |
||||
|
"Gx": 0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262, |
||||
|
"Gy": 0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.7", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP256t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5374, |
||||
|
"b": 0x662c61c430d84ea4fe66a7733d0b76b7bf93ebc4af2f49256ae58101fee92b04, |
||||
|
"p": 0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377, |
||||
|
"n": 0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7, |
||||
|
"h": 1, |
||||
|
"Gx": 0xa3e8eb3cc1cfe7b7732213b23a656149afa142c47aafbc2b79a191562e1305f4, |
||||
|
"Gy": 0x2d996c823439c56d7f7b22e14644417e69bcb6de39d027001dabe8f35b25c9be, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.8", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP320r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x3ee30b568fbab0f883ccebd46d3f3bb8a2a73513f5eb79da66190eb085ffa9f492f375a97d860eb4, |
||||
|
"b": 0x520883949dfdbc42d3ad198640688a6fe13f41349554b49acc31dccd884539816f5eb4ac8fb1f1a6, |
||||
|
"p": 0xd35e472036bc4fb7e13c785ed201e065f98fcfa6f6f40def4f92b9ec7893ec28fcd412b1f1b32e27, |
||||
|
"n": 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59311, |
||||
|
"h": 1, |
||||
|
"Gx": 0x43bd7e9afb53d8b85289bcc48ee5bfe6f20137d10a087eb6e7871e2a10a599c710af8d0d39e20611, |
||||
|
"Gy": 0x14fdd05545ec1cc8ab4093247f77275e0743ffed117182eaa9c77877aaac6ac7d35245d1692e8ee1, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.9", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP320t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xd35e472036bc4fb7e13c785ed201e065f98fcfa6f6f40def4f92b9ec7893ec28fcd412b1f1b32e24, |
||||
|
"b": 0xa7f561e038eb1ed560b3d147db782013064c19f27ed27c6780aaf77fb8a547ceb5b4fef422340353, |
||||
|
"p": 0xd35e472036bc4fb7e13c785ed201e065f98fcfa6f6f40def4f92b9ec7893ec28fcd412b1f1b32e27, |
||||
|
"n": 0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59311, |
||||
|
"h": 1, |
||||
|
"Gx": 0x925be9fb01afc6fb4d3e7d4990010f813408ab106c4f09cb7ee07868cc136fff3357f624a21bed52, |
||||
|
"Gy": 0x63ba3a7a27483ebf6671dbef7abb30ebee084e58a0b077ad42a5a0989d1ee71b1b9bc0455fb0d2c3, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.10", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP384r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826, |
||||
|
"b": 0x4a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11, |
||||
|
"p": 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53, |
||||
|
"n": 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565, |
||||
|
"h": 1, |
||||
|
"Gx": 0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e, |
||||
|
"Gy": 0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.11", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP384t1", ShortWeierstrassCurve, { |
||||
|
"a": 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec50, |
||||
|
"b": 0x7f519eada7bda81bd826dba647910f8c4b9346ed8ccdc64e4b1abd11756dce1d2074aa263b88805ced70355a33b471ee, |
||||
|
"p": 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53, |
||||
|
"n": 0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565, |
||||
|
"h": 1, |
||||
|
"Gx": 0x18de98b02db9a306f2afcd7235f72a819b80ab12ebd653172476fecd462aabffc4ff191b946a5f54d8d0aa2f418808cc, |
||||
|
"Gy": 0x25ab056962d30651a114afd2755ad336747f93475b7a1fca3b88f2b6a208ccfe469408584dc2b2912675bf5b9e582928, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.12", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP512r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca, |
||||
|
"b": 0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723, |
||||
|
"p": 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3, |
||||
|
"n": 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069, |
||||
|
"h": 1, |
||||
|
"Gx": 0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822, |
||||
|
"Gy": 0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.13", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("brainpoolP512t1", ShortWeierstrassCurve, { |
||||
|
"a": 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f0, |
||||
|
"b": 0x7cbbbcf9441cfab76e1890e46884eae321f70c0bcb4981527897504bec3e36a62bcdfa2304976540f6450085f2dae145c22553b465763689180ea2571867423e, |
||||
|
"p": 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3, |
||||
|
"n": 0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069, |
||||
|
"h": 1, |
||||
|
"Gx": 0x640ece5c12788717b9c1ba06cbc2a6feba85842458c56dde9db1758d39c0313d82ba51735cdb3ea499aa77a7d6943a64f7a3f25fe26f06b51baa2696fa9035da, |
||||
|
"Gy": 0x5b534bd595f5af0fa2c892376c84ace1bb4e3019b71634c01131159cae03cee9d9932184beef216bd71df2dadf86a627306ecff96dbb8bace198b61e00f8b332, |
||||
|
}, oid = "1.3.36.3.3.2.8.1.1.14", origin = "ECC Brainpool")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime192v1", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffffffffffffffffffffffffffefffffffffffffffc, |
||||
|
"b": 0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffeffffffffffffffff, |
||||
|
"n": 0xffffffffffffffffffffffff99def836146bc9b1b4d22831, |
||||
|
"h": 1, |
||||
|
"Gx": 0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012, |
||||
|
"Gy": 0x7192b95ffc8da78631011ed6b24cdd573f977a11e794811, |
||||
|
}, aliases = [ "secp192r1", "NIST P-192", "ansip192r1" ], oid = "1.2.840.10045.3.1.1", origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / ANSI X9.62 / FIPS 186-2 / NIST Recommended Elliptic Curves for Federal Government Use")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime192v2", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffffffffffffffffffffffffffefffffffffffffffc, |
||||
|
"b": 0xcc22d6dfb95c6b25e49c0d6364a4e5980c393aa21668d953, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffeffffffffffffffff, |
||||
|
"n": 0xfffffffffffffffffffffffe5fb1a724dc80418648d8dd31, |
||||
|
"h": 1, |
||||
|
"Gx": 0xeea2bae7e1497842f2de7769cfe9c989c072ad696f48034a, |
||||
|
"Gy": 0x6574d11d69b6ec7a672bb82a083df2f2b0847de970b2de15, |
||||
|
}, oid = "1.2.840.10045.3.1.2", origin = "ANSI X9.62")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime192v3", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffffffffffffffffffffffffffefffffffffffffffc, |
||||
|
"b": 0x22123dc2395a05caa7423daeccc94760a7d462256bd56916, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffeffffffffffffffff, |
||||
|
"n": 0xffffffffffffffffffffffff7a62d031c83f4294f640ec13, |
||||
|
"h": 1, |
||||
|
"Gx": 0x7d29778100c65a1da1783716588dce2b8b4aee8e228f1896, |
||||
|
"Gy": 0x38a90f22637337334b49dcb66a6dc8f9978aca7648a943b0, |
||||
|
}, oid = "1.2.840.10045.3.1.3", origin = "ANSI X9.62")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime239v1", ShortWeierstrassCurve, { |
||||
|
"a": 0x7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc, |
||||
|
"b": 0x6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a, |
||||
|
"p": 0x7fffffffffffffffffffffff7fffffffffff8000000000007fffffffffff, |
||||
|
"n": 0x7fffffffffffffffffffffff7fffff9e5e9a9f5d9071fbd1522688909d0b, |
||||
|
"h": 1, |
||||
|
"Gx": 0xffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf, |
||||
|
"Gy": 0x7debe8e4e90a5dae6e4054ca530ba04654b36818ce226b39fccb7b02f1ae, |
||||
|
}, oid = "1.2.840.10045.3.1.4", origin = "ANSI X9.62")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime239v2", ShortWeierstrassCurve, { |
||||
|
"a": 0x7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc, |
||||
|
"b": 0x617fab6832576cbbfed50d99f0249c3fee58b94ba0038c7ae84c8c832f2c, |
||||
|
"p": 0x7fffffffffffffffffffffff7fffffffffff8000000000007fffffffffff, |
||||
|
"n": 0x7fffffffffffffffffffffff800000cfa7e8594377d414c03821bc582063, |
||||
|
"h": 1, |
||||
|
"Gx": 0x38af09d98727705120c921bb5e9e26296a3cdcf2f35757a0eafd87b830e7, |
||||
|
"Gy": 0x5b0125e4dbea0ec7206da0fc01d9b081329fb555de6ef460237dff8be4ba, |
||||
|
}, oid = "1.2.840.10045.3.1.5", origin = "ANSI X9.62")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime239v3", ShortWeierstrassCurve, { |
||||
|
"a": 0x7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc, |
||||
|
"b": 0x255705fa2a306654b1f4cb03d6a750a30c250102d4988717d9ba15ab6d3e, |
||||
|
"p": 0x7fffffffffffffffffffffff7fffffffffff8000000000007fffffffffff, |
||||
|
"n": 0x7fffffffffffffffffffffff7fffff975deb41b3a6057c3c432146526551, |
||||
|
"h": 1, |
||||
|
"Gx": 0x6768ae8e18bb92cfcf005c949aa2c6d94853d0e660bbf854b1c9505fe95a, |
||||
|
"Gy": 0x1607e6898f390c06bc1d552bad226f3b6fcfe48b6e818499af18e3ed6cf3, |
||||
|
}, oid = "1.2.840.10045.3.1.6", origin = "ANSI X9.62")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("prime256v1", ShortWeierstrassCurve, { |
||||
|
"a": 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc, |
||||
|
"b": 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b, |
||||
|
"p": 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff, |
||||
|
"n": 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551, |
||||
|
"h": 1, |
||||
|
"Gx": 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296, |
||||
|
"Gy": 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5, |
||||
|
}, aliases = [ "secp256r1", "NIST P-256" ], oid = "1.2.840.10045.3.1.7", origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / ANSI X9.62 / FIPS 186-2 / NIST Recommended Elliptic Curves for Federal Government Use")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp112r1", ShortWeierstrassCurve, { |
||||
|
"a": 0xdb7c2abf62e35e668076bead2088, |
||||
|
"b": 0x659ef8ba043916eede8911702b22, |
||||
|
"p": 0xdb7c2abf62e35e668076bead208b, |
||||
|
"n": 0xdb7c2abf62e35e7628dfac6561c5, |
||||
|
"h": 1, |
||||
|
"Gx": 0x9487239995a5ee76b55f9c2f098, |
||||
|
"Gy": 0xa89ce5af8724c0a23e0e0ff77500, |
||||
|
}, aliases = [ "wap-wsg-idm-ecid-wtls6" ], oid = "1.3.132.0.6", alt_oids = { "wap-wsg-idm-ecid-wtls6": "2.23.43.1.4.6" }, origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / Wireless Application Protocol WAP-261-WTLS-20010406a")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp112r2", ShortWeierstrassCurve, { |
||||
|
"a": 0x6127c24c05f38a0aaaf65c0ef02c, |
||||
|
"b": 0x51def1815db5ed74fcc34c85d709, |
||||
|
"p": 0xdb7c2abf62e35e668076bead208b, |
||||
|
"n": 0x36df0aafd8b8d7597ca10520d04b, |
||||
|
"h": 4, |
||||
|
"Gx": 0x4ba30ab5e892b4e1649dd0928643, |
||||
|
"Gy": 0xadcd46f5882e3747def36e956e97, |
||||
|
}, oid = "1.3.132.0.7", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp128r1", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffdfffffffffffffffffffffffc, |
||||
|
"b": 0xe87579c11079f43dd824993c2cee5ed3, |
||||
|
"p": 0xfffffffdffffffffffffffffffffffff, |
||||
|
"n": 0xfffffffe0000000075a30d1b9038a115, |
||||
|
"h": 1, |
||||
|
"Gx": 0x161ff7528b899b2d0c28607ca52c5b86, |
||||
|
"Gy": 0xcf5ac8395bafeb13c02da292dded7a83, |
||||
|
}, oid = "1.3.132.0.28", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp128r2", ShortWeierstrassCurve, { |
||||
|
"a": 0xd6031998d1b3bbfebf59cc9bbff9aee1, |
||||
|
"b": 0x5eeefca380d02919dc2c6558bb6d8a5d, |
||||
|
"p": 0xfffffffdffffffffffffffffffffffff, |
||||
|
"n": 0x3fffffff7fffffffbe0024720613b5a3, |
||||
|
"h": 4, |
||||
|
"Gx": 0x7b6aa5d85e572983e6fb32a7cdebc140, |
||||
|
"Gy": 0x27b6916a894d3aee7106fe805fc34b44, |
||||
|
}, oid = "1.3.132.0.29", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp160k1", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 7, |
||||
|
"p": 0x0fffffffffffffffffffffffffffffffeffffac73, |
||||
|
"n": 0x100000000000000000001b8fa16dfab9aca16b6b3, |
||||
|
"h": 1, |
||||
|
"Gx": 0x03b4c382ce37aa192a4019e763036f4f5dd4d7ebb, |
||||
|
"Gy": 0x0938cf935318fdced6bc28286531733c3f03c4fee, |
||||
|
}, aliases = [ "ansip160k1" ], oid = "1.3.132.0.9", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp160r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x0ffffffffffffffffffffffffffffffff7ffffffc, |
||||
|
"b": 0x01c97befc54bd7a8b65acf89f81d4d4adc565fa45, |
||||
|
"p": 0x0ffffffffffffffffffffffffffffffff7fffffff, |
||||
|
"n": 0x100000000000000000001f4c8f927aed3ca752257, |
||||
|
"h": 1, |
||||
|
"Gx": 0x04a96b5688ef573284664698968c38bb913cbfc82, |
||||
|
"Gy": 0x023a628553168947d59dcc912042351377ac5fb32, |
||||
|
}, aliases = [ "ansip160r1" ], oid = "1.3.132.0.8", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp160r2", ShortWeierstrassCurve, { |
||||
|
"a": 0x0fffffffffffffffffffffffffffffffeffffac70, |
||||
|
"b": 0x0b4e134d3fb59eb8bab57274904664d5af50388ba, |
||||
|
"p": 0x0fffffffffffffffffffffffffffffffeffffac73, |
||||
|
"n": 0x100000000000000000000351ee786a818f3a1a16b, |
||||
|
"h": 1, |
||||
|
"Gx": 0x052dcb034293a117e1f4ff11b30f7199d3144ce6d, |
||||
|
"Gy": 0x0feaffef2e331f296e071fa0df9982cfea7d43f2e, |
||||
|
}, aliases = [ "ansip160r2", "wap-wsg-idm-ecid-wtls7" ], oid = "1.3.132.0.30", alt_oids = { "wap-wsg-idm-ecid-wtls7": "2.23.43.1.4.7" }, origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / Wireless Application Protocol WAP-261-WTLS-20010406a")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp192k1", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 3, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffffffffffeffffee37, |
||||
|
"n": 0xfffffffffffffffffffffffe26f2fc170f69466a74defd8d, |
||||
|
"h": 1, |
||||
|
"Gx": 0xdb4ff10ec057e9ae26b07d0280b7f4341da5d1b1eae06c7d, |
||||
|
"Gy": 0x9b2f2f6d9c5628a7844163d015be86344082aa88d95e2f9d, |
||||
|
}, aliases = [ "ansip192k1" ], oid = "1.3.132.0.31", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp224k1", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 5, |
||||
|
"p": 0x0fffffffffffffffffffffffffffffffffffffffffffffffeffffe56d, |
||||
|
"n": 0x10000000000000000000000000001dce8d2ec6184caf0a971769fb1f7, |
||||
|
"h": 1, |
||||
|
"Gx": 0x0a1455b334df099df30fc28a169a467e9e47075a90f7e650eb6b7a45c, |
||||
|
"Gy": 0x07e089fed7fba344282cafbd6f7e319f7c0b0bd59e2ca4bdb556d61a5, |
||||
|
}, aliases = [ "ansip224k1" ], oid = "1.3.132.0.32", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp224r1", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe, |
||||
|
"b": 0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4, |
||||
|
"p": 0xffffffffffffffffffffffffffffffff000000000000000000000001, |
||||
|
"n": 0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d, |
||||
|
"h": 1, |
||||
|
"Gx": 0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21, |
||||
|
"Gy": 0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34, |
||||
|
}, aliases = [ "ansip224r1", "NIST P-224", "wap-wsg-idm-ecid-wtls12" ], oid = "1.3.132.0.33", alt_oids = { "wap-wsg-idm-ecid-wtls12": "2.23.43.1.4.12" }, origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / FIPS 186-2 / NIST Recommended Elliptic Curves for Federal Government Use / Wireless Application Protocol WAP-261-WTLS-20010406a")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp256k1", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 7, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f, |
||||
|
"n": 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141, |
||||
|
"h": 1, |
||||
|
"Gx": 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798, |
||||
|
"Gy": 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8, |
||||
|
}, aliases = [ "ansip256k1" ], oid = "1.3.132.0.10", origin = "Certicom Standards for Efficient Cryptography (SEC) 2")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp384r1", ShortWeierstrassCurve, { |
||||
|
"a": 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc, |
||||
|
"b": 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff, |
||||
|
"n": 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973, |
||||
|
"h": 1, |
||||
|
"Gx": 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7, |
||||
|
"Gy": 0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f, |
||||
|
}, aliases = [ "ansip384r1", "NIST P-384" ], oid = "1.3.132.0.34", origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / FIPS 186-2 / NIST Recommended Elliptic Curves for Federal Government Use")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("secp521r1", ShortWeierstrassCurve, { |
||||
|
"a": 0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc, |
||||
|
"b": 0x051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00, |
||||
|
"p": 0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, |
||||
|
"n": 0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409, |
||||
|
"h": 1, |
||||
|
"Gx": 0x0c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66, |
||||
|
"Gy": 0x11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650, |
||||
|
}, aliases = [ "NIST P-521", "ansip521r1" ], oid = "1.3.132.0.35", origin = "Certicom Standards for Efficient Cryptography (SEC) 2 / FIPS 186-2 / NIST Recommended Elliptic Curves for Federal Government Use")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("wap-wsg-idm-ecid-wtls8", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 3, |
||||
|
"p": 0x0fffffffffffffffffffffffffde7, |
||||
|
"n": 0x100000000000001ecea551ad837e9, |
||||
|
"h": 1, |
||||
|
"Gx": 1, |
||||
|
"Gy": 2, |
||||
|
}, oid = "2.23.43.1.4.8", origin = "Wireless Application Protocol WAP-261-WTLS-20010406a")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("wap-wsg-idm-ecid-wtls9", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 3, |
||||
|
"p": 0x0fffffffffffffffffffffffffffffffffffc808f, |
||||
|
"n": 0x100000000000000000001cdc98ae0e2de574abf33, |
||||
|
"h": 1, |
||||
|
"Gx": 1, |
||||
|
"Gy": 2, |
||||
|
}, oid = "2.23.43.1.4.9", origin = "Wireless Application Protocol WAP-261-WTLS-20010406a")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("Curve25519", MontgomeryCurve, { |
||||
|
"a": 486662, |
||||
|
"b": 1, |
||||
|
"p": (2 ** 255) - 19, |
||||
|
"n": (2 ** 252) + 27742317777372353535851937790883648493, |
||||
|
"h": 8, |
||||
|
"Gx": 0x9, |
||||
|
"Gy": 0x5f51e65e475f794b1fe122d388b72eb36dc2b28192839e4dd6163a5d81312c14, |
||||
|
}, origin = "2006 Bernstein")) |
||||
|
|
||||
|
# Curve imported from IETF https://tools.ietf.org/html/rfc7748 |
||||
|
cdb.register(_CurveDBEntry("Curve448", MontgomeryCurve, { |
||||
|
"a": 156326, |
||||
|
"b": 1, |
||||
|
"p": (2 ** 448) - (2 ** 224) - 1, |
||||
|
"n": (2 ** 446) - 0x8335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d, |
||||
|
"h": 4, |
||||
|
"Gx": 0x5, |
||||
|
"Gy": 0x7d235d1295f5b1f66c98ab6e58326fcecbae5d34f55545d060f75dc28df3f6edb8027e2346430d211312c4b150677af76fd7223d457b5b1a, |
||||
|
}, origin = "2006 Bernstein")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("Ed25519", TwistedEdwardsCurve, { |
||||
|
"a": -1, |
||||
|
"d": 37095705934669439343138083508754565189542113879843219016388785533085940283555, |
||||
|
"p": (2 ** 255) - 19, |
||||
|
"n": (2 ** 252) + 27742317777372353535851937790883648493, |
||||
|
"h": 8, |
||||
|
"Gx": 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a, |
||||
|
"Gy": 0x6666666666666666666666666666666666666666666666666666666666666658, |
||||
|
}, origin = "2011 Bernstein-Duif-Lange-Schwabe-Yang", quirks = [ CurveQuirkEdDSASetPrivateKeyMSB(), CurveQuirkEdDSAEnsurePrimeOrderSubgroup(), CurveQuirkSigningHashFunction("sha512") ])) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("Anomalous", ShortWeierstrassCurve, { |
||||
|
"a": 0x98d0fac687d6343eb1a1f595283eb1a1f58d0fac687d635f5e4, |
||||
|
"b": 0x4a1f58d0fac687d6343eb1a5e2d6343eb1a1f58d0fac688ab3f, |
||||
|
"p": 0xb0000000000000000000000953000000000000000000001f9d7, |
||||
|
"n": 0xb0000000000000000000000953000000000000000000001f9d7, |
||||
|
"h": 1, |
||||
|
"Gx": 0x101efb35fd1963c4871a2d17edaafa7e249807f58f8705126c6, |
||||
|
"Gy": 0x22389a3954375834304ba1d509a97de6c07148ea7f5951b20e7, |
||||
|
}, secure = False, origin = "Bernstein http://safecurves.cr.yp.to illustration of additive transfer and small discriminant")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("M-221", MontgomeryCurve, { |
||||
|
"a": 117050, |
||||
|
"b": 1, |
||||
|
"p": 0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffd, |
||||
|
"n": 0x40000000000000000000000000015a08ed730e8a2f77f005042605b, |
||||
|
"h": 8, |
||||
|
"Gx": 4, |
||||
|
"Gy": 0xf7acdd2a4939571d1cef14eca37c228e61dbff10707dc6c08c5056d, |
||||
|
}, aliases = [ "Curve2213" ], origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("E-222", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": 160102, |
||||
|
"p": 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffff8b, |
||||
|
"n": 0xffffffffffffffffffffffffffff70cbc95e932f802f31423598cbf, |
||||
|
"h": 4, |
||||
|
"Gx": 0x19b12bb156a389e55c9768c303316d07c23adab3736eb2bc3eb54e51, |
||||
|
"Gy": 28, |
||||
|
}, origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("Curve1174", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": -1174, |
||||
|
"p": 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7, |
||||
|
"n": 0x1fffffffffffffffffffffffffffffff77965c4dfd307348944d45fd166c971, |
||||
|
"h": 4, |
||||
|
"Gx": 0x37fbb0cea308c479343aee7c029a190c021d96a492ecd6516123f27bce29eda, |
||||
|
"Gy": 0x6b72f82d47fb7cc6656841169840e0c4fe2dee2af3f976ba4ccb1bf9b46360e, |
||||
|
}, origin = "2013 Bernstein-Hamburg-Krasnova-Lange")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("BN(2,254)", ShortWeierstrassCurve, { |
||||
|
"a": 0, |
||||
|
"b": 2, |
||||
|
"p": 0x2523648240000001ba344d80000000086121000000000013a700000000000013, |
||||
|
"n": 0x2523648240000001ba344d8000000007ff9f800000000010a10000000000000d, |
||||
|
"h": 1, |
||||
|
"Gx": -1, |
||||
|
"Gy": 1, |
||||
|
}, origin = "2011 Pereira-Simplicio-Naehrig-Barreto")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("ANSSI FRP256v1", ShortWeierstrassCurve, { |
||||
|
"a": -3, |
||||
|
"b": 0xee353fca5428a9300d4aba754a44c00fdfec0c9ae4b1a1803075ed967b7bb73f, |
||||
|
"p": 0xf1fd178c0b3ad58f10126de8ce42435b3961adbcabc8ca6de8fcf353d86e9c03, |
||||
|
"n": 0xf1fd178c0b3ad58f10126de8ce42435b53dc67e140d2bf941ffdd459c6d655e1, |
||||
|
"h": 1, |
||||
|
"Gx": 0xb6b3d4c356c139eb31183d4749d423958c27d2dcaf98b70164c97a2dd98f5cff, |
||||
|
"Gy": 0x6142e0f7c8b204911f9271f0f3ecef8c2701c307e8e4c9e183115a1554062cfb, |
||||
|
}, oid = "1.2.250.1.223.101.256.1", origin = "Agence nationale de la sécurité des systèmes d'information")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("E-382", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": -67254, |
||||
|
"p": 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff97, |
||||
|
"n": 0xfffffffffffffffffffffffffffffffffffffffffffffffd5fb21f21e95eee17c5e69281b102d2773e27e13fd3c9719, |
||||
|
"h": 4, |
||||
|
"Gx": 0x196f8dd0eab20391e5f05be96e8d20ae68f840032b0b64352923bab85364841193517dbce8105398ebc0cc9470f79603, |
||||
|
"Gy": 17, |
||||
|
}, origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("M-383", MontgomeryCurve, { |
||||
|
"a": 2065150, |
||||
|
"b": 1, |
||||
|
"p": 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff45, |
||||
|
"n": 0x10000000000000000000000000000000000000000000000006c79673ac36ba6e7a32576f7b1b249e46bbc225be9071d7, |
||||
|
"h": 8, |
||||
|
"Gx": 12, |
||||
|
"Gy": 0x1ec7ed04aaf834af310e304b2da0f328e7c165f0e8988abd3992861290f617aa1f1b2e7d0b6e332e969991b62555e77e, |
||||
|
}, origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("Curve383187", MontgomeryCurve, { |
||||
|
"a": 229969, |
||||
|
"b": 1, |
||||
|
"p": 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff45, |
||||
|
"n": 0x1000000000000000000000000000000000000000000000000e85a85287a1488acd41ae84b2b7030446f72088b00a0e21, |
||||
|
"h": 8, |
||||
|
"Gx": 5, |
||||
|
"Gy": 0x1eebe07dc1871896732b12d5504a32370471965c7a11f2c89865f855ab3cbd7c224e3620c31af3370788457dd5ce46df, |
||||
|
}, origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("Curve41417", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": 3617, |
||||
|
"p": 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffef, |
||||
|
"n": 0x7ffffffffffffffffffffffffffffffffffffffffffffffffffeb3cc92414cf706022b36f1c0338ad63cf181b0e71a5e106af79, |
||||
|
"h": 8, |
||||
|
"Gx": 0x1a334905141443300218c0631c326e5fcd46369f44c03ec7f57ff35498a4ab4d6d6ba111301a73faa8537c64c4fd3812f3cbc595, |
||||
|
"Gy": 34, |
||||
|
}, aliases = [ "Curve3617" ], origin = "2013 Bernstein-Lange")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("Ed448-Goldilocks", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": -39081, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff, |
||||
|
"n": 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffff7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3, |
||||
|
"h": 4, |
||||
|
"Gx": 0x297ea0ea2692ff1b4faff46098453a6a26adf733245f065c3c59d0709cecfa96147eaaf3932d94c63d96c170033f4ba0c7f0de840aed939f, |
||||
|
"Gy": 19, |
||||
|
}, origin = "2014 Hamburg", quirks = [ CurveQuirkEdDSASetPrivateKeyMSB(), CurveQuirkEdDSAEnsurePrimeOrderSubgroup(), CurveQuirkSigningHashFunction("shake256-114") ])) |
||||
|
|
||||
|
# Curve imported from https://tools.ietf.org/html/rfc8032 |
||||
|
cdb.register(_CurveDBEntry("Ed448", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": -39081, |
||||
|
"p": 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff, |
||||
|
"n": 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffff7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3, |
||||
|
"h": 4, |
||||
|
"Gx": 0x4f1970c66bed0ded221d15a622bf36da9e146570470f1767ea6de324a3d3a46412ae1af72ab66511433b80e18b00938e2626a82bc70cc05e, |
||||
|
"Gy": 0x693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14, |
||||
|
}, origin = "https://tools.ietf.org/html/rfc8032", quirks = [ CurveQuirkEdDSASetPrivateKeyMSB(), CurveQuirkEdDSAEnsurePrimeOrderSubgroup(), CurveQuirkSigningHashFunction("shake256-114") ])) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("M-511", MontgomeryCurve, { |
||||
|
"a": 530438, |
||||
|
"b": 1, |
||||
|
"p": 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff45, |
||||
|
"n": 0x100000000000000000000000000000000000000000000000000000000000000017b5feff30c7f5677ab2aeebd13779a2ac125042a6aa10bfa54c15bab76baf1b, |
||||
|
"h": 8, |
||||
|
"Gx": 5, |
||||
|
"Gy": 0x2fbdc0ad8530803d28fdbad354bb488d32399ac1cf8f6e01ee3f96389b90c809422b9429e8a43dbf49308ac4455940abe9f1dbca542093a895e30a64af056fa5, |
||||
|
}, aliases = [ "Curve511187" ], origin = "2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
# Curve imported from SafeCurves http://safecurves.cr.yp.to |
||||
|
cdb.register(_CurveDBEntry("E-521", TwistedEdwardsCurve, { |
||||
|
"a": 1, |
||||
|
"d": -376014, |
||||
|
"p": 0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, |
||||
|
"n": 0x7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd15b6c64746fc85f736b8af5e7ec53f04fbd8c4569a8f1f4540ea2435f5180d6b, |
||||
|
"h": 4, |
||||
|
"Gx": 0x752cb45c48648b189df90cb2296b2878a3bfd9f42fc6c818ec8bf3c9c0c6203913f6ecc5ccc72434b1ae949d568fc99c6059d0fb13364838aa302a940a2f19ba6c, |
||||
|
"Gy": 12, |
||||
|
}, origin = "2013 Bernstein-Lange / 2013 Hamburg / 2013 Aranha-Barreto-Pereira-Ricardini")) |
||||
|
|
||||
|
cdb.register(_CurveDBEntry("rigol", ShortWeierstrassCurve, { |
||||
|
"a": 0x2982, |
||||
|
"b": 0x3408, |
||||
|
"p": 0xaebf94cee3e707, |
||||
|
"n": 0xaebf94d5c6aa71, |
||||
|
"h": 1, |
||||
|
"Gx": 0x7a3e808599a525, |
||||
|
"Gy": 0x28be7fafd2a052, |
||||
|
}, origin = "Rigol DS2xxx feature activation curve")) |
||||
|
|
||||
|
def getcurvedb(): |
||||
|
"""Returns an instance of the curve database singleton object.""" |
||||
|
return CurveDB() |
||||
|
|
||||
|
def getcurvenames(): |
||||
|
"""Returns the names of all curves known to toyecc.""" |
||||
|
return CurveDB().curvenames() |
||||
|
|
||||
|
def getcurveentry(name): |
||||
|
"""Returns a curve entry by its name.""" |
||||
|
return CurveDB().getentry(name) |
||||
|
|
||||
|
def getcurvebyname(name): |
||||
|
"""Returns a curve by its name.""" |
||||
|
return CurveDB()[name] |
||||
@ -0,0 +1,140 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
from .Exceptions import NoSuchCurveException |
||||
|
|
||||
|
class CurveOpIsomorphism(object): |
||||
|
def _twist(self, d = None, sqrt_d = None): |
||||
|
"""Returns the twisted curve with the twist coefficient d. If d is a |
||||
|
quadratic non-residue mod p then this function will yield a curve that |
||||
|
is isomorphous on the field extension GF(sqrt(d)). If it is a quadratic |
||||
|
residue, it will return an GF(p)-isomorphous curve.""" |
||||
|
assert(self.curvetype == "shortweierstrass") |
||||
|
ShortWeierstrassCurve = self.__class__ |
||||
|
|
||||
|
if sqrt_d is not None: |
||||
|
# If a square root is given, then it must be a correct square root |
||||
|
assert(sqrt_d ** 2 == d) |
||||
|
|
||||
|
a = self.a * (d ** 2) |
||||
|
b = self.b * (d ** 3) |
||||
|
if d.is_qr and self.hasgenerator: |
||||
|
# Quadratic twist will return an GF(p)-isomorphous curve -> convert |
||||
|
# generator point as well |
||||
|
if sqrt_d is None: |
||||
|
sqrt_d = d.sqrt()[0] |
||||
|
Gx = int(self.G.x * d) |
||||
|
Gy = int(self.G.y * (sqrt_d ** 3)) |
||||
|
|
||||
|
n = self.n |
||||
|
h = self.h |
||||
|
else: |
||||
|
# Quadratic twist will return an isomorphous curve on the |
||||
|
# GF(sqrt(d)) field extension -> no generator point conversion for |
||||
|
# now |
||||
|
# Gx = int(self.G.x * d) |
||||
|
# Gy = int(self.G.y * d) |
||||
|
Gx = None |
||||
|
Gy = None |
||||
|
|
||||
|
# If the original curve had q + 1 - t points, then its twist will |
||||
|
# have q + 1 + t points. TODO: Does this help us to find the order |
||||
|
# of the generator point G? I don't think it does :-( Leave n and h |
||||
|
# therefore unset for the moment. |
||||
|
n = None |
||||
|
h = None |
||||
|
|
||||
|
return ShortWeierstrassCurve(a = int(a), b = int(b), p = self.p, n = n, h = h, Gx = Gx, Gy = Gy) |
||||
|
|
||||
|
def twist(self, d = None): |
||||
|
"""If the twist coefficient d is omitted, the function will |
||||
|
automatically look for an arbitrary quadratic non-residue in F_P.""" |
||||
|
if d == 0: |
||||
|
raise Exception("Domain error: d must be nonzero.") |
||||
|
elif d is None: |
||||
|
# Search for a QNR in F_P |
||||
|
d = FieldElement.any_qnr(self.p) |
||||
|
else: |
||||
|
d = FieldElement(d, self.p) |
||||
|
if d.is_qr: |
||||
|
raise Exception("Twist requested, but twist coefficient d is a quadratic-residue mod p. Refusing to return a GF(p)-isomorphic curve; if you want this behavior, use twist_fp_isomorphic()") |
||||
|
return self._twist(d) |
||||
|
|
||||
|
def twist_fp_isomorphic(self, u): |
||||
|
"""Returns a GF(p)-isomorphous curve by applying the substituting |
||||
|
transformation x = u^2 x' and y = u^3 y' on the curve equation. The |
||||
|
function therefore returns a quadratic twist with d = u^2, i.e. it |
||||
|
ensures that the twist coefficient d is a quadratic residue mod p..""" |
||||
|
if u == 0: |
||||
|
raise Exception("Domain error: u must be nonzero.") |
||||
|
return self._twist(FieldElement(u ** 2, self.p), FieldElement(u, self.p)) |
||||
|
|
||||
|
def twist_fp_isomorphic_fixed_a(self, a): |
||||
|
"""Tries to find an GF(p)-isomorphous curve which has a particular |
||||
|
given value for the curve coefficient 'a'.""" |
||||
|
|
||||
|
# anew = a * u^4 -> u = quartic_root(anew / a) |
||||
|
scalar = a // self.a |
||||
|
u = scalar.quartic_root() |
||||
|
if u is None: |
||||
|
raise NoSuchCurveException("Cannot find an isomorphism so that a = %d because %s has no quartic root in F_P" % (a, scalar)) |
||||
|
return self.twist_fp_isomorphic(int(u)) |
||||
|
|
||||
|
def is_isomorphous_curve(self, other): |
||||
|
"""Returns if the given curve 'other' is isomorphous in the same field |
||||
|
as the given curve curve.""" |
||||
|
if other.p != self.p: |
||||
|
return False |
||||
|
|
||||
|
try: |
||||
|
iso = self.twist_fp_isomorphic_fixed_a(other.a) |
||||
|
except NoSuchCurveException: |
||||
|
# No isomorphous curve with this value for a exists |
||||
|
return False |
||||
|
|
||||
|
# The curves should be identical after the transformation if they're |
||||
|
# isomorphous to each other |
||||
|
return (iso.a == other.a) and (iso.b == other.b) |
||||
|
|
||||
|
class CurveOpExportSage(object): |
||||
|
def export_sage(self, varname = "curve"): |
||||
|
"""Exports the elliptic curve to statements that can be used within the |
||||
|
SAGE computer algebra system.""" |
||||
|
|
||||
|
# EllipticCurve([a1,a2,a3,a4,a6]) means in Sage: |
||||
|
# y² + a1 x y + a3 y = x³ + a2 x² + a4 x + a6 |
||||
|
# i.e. for Short Weierstrass a4 = A, a6 = B |
||||
|
|
||||
|
statements = [ ] |
||||
|
statements.append("# %s" % (str(self))) |
||||
|
statements.append("%s_p = 0x%x" % (varname, int(self.p))) |
||||
|
statements.append("%s_F = GF(%s_p)" % (varname, varname)) |
||||
|
if self.curvetype == "shortweierstrass": |
||||
|
statements.append("%s_a = 0x%x" % (varname, int(self.a))) |
||||
|
statements.append("%s_b = 0x%x" % (varname, int(self.b))) |
||||
|
statements.append("%s = EllipticCurve(%s_F, [ %s_a, %s_b ])" % (varname, varname, varname, varname)) |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
return statements |
||||
@ -0,0 +1,77 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import hashlib |
||||
|
|
||||
|
class CurveQuirk(object): |
||||
|
identifier = None |
||||
|
|
||||
|
@property |
||||
|
def identity(self): |
||||
|
return (self.identifier, ) |
||||
|
|
||||
|
def __eq__(self, other): |
||||
|
return self.identity == other.identity |
||||
|
|
||||
|
def __ne__(self, other): |
||||
|
return not (self == other) |
||||
|
|
||||
|
def __lt__(self, other): |
||||
|
return self.identity < other.identity |
||||
|
|
||||
|
def __hash__(self): |
||||
|
return hash(self.identity) |
||||
|
|
||||
|
def __str__(self): |
||||
|
return self.identifier |
||||
|
|
||||
|
class CurveQuirkEdDSASetPrivateKeyMSB(CurveQuirk): |
||||
|
"""Set the highest significant bit of the private key during EdDSA |
||||
|
signature generation. For example, for EdDSA signatures on Ed25519, this |
||||
|
would bitwise or the value 'a' with 2^254.""" |
||||
|
identifier = "EdDSA_set_private_key_MSB" |
||||
|
|
||||
|
class CurveQuirkEdDSAEnsurePrimeOrderSubgroup(CurveQuirk): |
||||
|
"""Ensures during EdDSA signature generation that the private key is on a |
||||
|
prime-order subgroup. This is done by clearing the amount of bits that is |
||||
|
required by the cofactor of the curve (which has to be a power of two for |
||||
|
this quirk to work, otherwise it'll fail at runtime). Concretely, for EdDSA |
||||
|
on Ed25519 this means that the least significant three bits would be set to |
||||
|
zero because the curve cofactor is 8.""" |
||||
|
identifier = "EdDSA_use_prime_order_subgroup" |
||||
|
|
||||
|
class CurveQuirkSigningHashFunction(CurveQuirk): |
||||
|
"""For some curves, the signing hash function is implicitly given. In |
||||
|
particular for the Ed448 and Ed25519 variants, this is true. Encode these |
||||
|
as a curve quirk.""" |
||||
|
identifier = "signing_hash_function" |
||||
|
|
||||
|
def __init__(self, sig_fnc_name): |
||||
|
self._sig_fnc_name = sig_fnc_name |
||||
|
|
||||
|
def hashdata(self, data): |
||||
|
hash_fnc = { |
||||
|
"sha512": lambda x: hashlib.sha512(data).digest(), |
||||
|
"shake256-114": lambda x: hashlib.shake_256(data).digest(114), |
||||
|
} |
||||
|
return hash_fnc[self._sig_fnc_name](data) |
||||
@ -0,0 +1,67 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .Polynomial import Polynomial |
||||
|
|
||||
|
class DivisionPolynomial(object): |
||||
|
def __init__(self, curve): |
||||
|
"""Creates a division polynomial generator which returns \psi_i for the |
||||
|
given curve in Weierstrass form.""" |
||||
|
self._curve = curve |
||||
|
assert(self._curve.curvetype == "shortweierstrass") |
||||
|
self._cache = { } |
||||
|
self._curvepoly = None |
||||
|
self._initcache() |
||||
|
|
||||
|
def _initcache(self): |
||||
|
(a, b) = (self.curve.a, self.curve.b) |
||||
|
x = Polynomial(self.curve.p) |
||||
|
self._cache[0] = Polynomial(self.curve.p, 0) |
||||
|
self._cache[1] = Polynomial(self.curve.p, 1) |
||||
|
self._cache[2] = Polynomial(self.curve.p, 2) |
||||
|
self._cache[3] = (3 * x**4) + (6 * a * x**2) + (12 * b * x) - (a**2) |
||||
|
self._cache[4] = 4 * (x**6 + (5 * a * x**4) + (20 * b * x**3) - (5 * a**2 * x**2) - (4 * a * b * x) - (8 * b**2) - (a**3)) |
||||
|
self._curvepoly = x**3 + (a * x) + b |
||||
|
|
||||
|
@property |
||||
|
def curve(self): |
||||
|
return self._curve |
||||
|
|
||||
|
def __getitem__(self, index): |
||||
|
if index not in self._cache: |
||||
|
m = index // 2 |
||||
|
if (index % 2) == 1: |
||||
|
# The paper says this would be correct: |
||||
|
# result = (self[m + 2] * self[m]**3) - (self[m - 1] * self[m + 1] ** 3) |
||||
|
# But MIRACL does it differently. Use the MIRACL approach: |
||||
|
if (m % 2) == 0: |
||||
|
result = (self._curvepoly**2 * self[m + 2] * self[m]**3) - (self[m - 1] * self[m + 1]**3) |
||||
|
else: |
||||
|
result = (self[m + 2] * self[m]**3) - (self._curvepoly**2 * self[m - 1] * self[m + 1]**3) |
||||
|
else: |
||||
|
result = (self[m] // 2) * ((self[m + 2] * self[m - 1]**2) - (self[m - 2] * self[m + 1]**2)) |
||||
|
self._cache[index] = result |
||||
|
return self._cache[index] |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "DivisionPolys<%s, %d cached>" % (str(self.curve), len(self._cache)) |
||||
@ -0,0 +1,41 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2016 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
def doc_inherit(superclass): |
||||
|
"""Inherit the docstring of a parent method. The super class needs to be |
||||
|
given as the decorator's parameter. Does not overwrite the docstring if |
||||
|
there is already one present.""" |
||||
|
def decorator(decoree): |
||||
|
method_name = decoree.__name__ |
||||
|
if decoree.__doc__ is None: |
||||
|
parent_method = getattr(superclass, method_name, None) |
||||
|
if parent_method is None: |
||||
|
raise Exception("Tried to inherit docstring of method '%s' from class '%s', but the latter does not offer a method by that name." % (method_name, str(superclass))) |
||||
|
docstr = parent_method.__doc__ |
||||
|
if docstr is None: |
||||
|
raise Exception("Tried to inherit docstring of method '%s' from class '%s', but that method also does not have a docstring." % (method_name, str(superclass))) |
||||
|
decoree.__doc__ = docstr |
||||
|
else: |
||||
|
raise Exception("Tried to overwrite an already present docstring of %s" % (str(decoree))) |
||||
|
return decoree |
||||
|
return decorator |
||||
@ -0,0 +1,79 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .PrivKeyOps import PrivKeyOpECDSASign, PrivKeyOpECIESDecrypt, PrivKeyOpEDDSASign, PrivKeyOpEDDSAKeyGen, PrivKeyOpEDDSAEncode, PrivKeyOpECDH, PrivKeyOpLoad |
||||
|
from .ECPublicKey import ECPublicKey |
||||
|
from .Random import secure_rand_int_between |
||||
|
|
||||
|
class ECPrivateKey(PrivKeyOpECDSASign, PrivKeyOpECIESDecrypt, PrivKeyOpEDDSASign, PrivKeyOpEDDSAKeyGen, PrivKeyOpEDDSAEncode, PrivKeyOpECDH, PrivKeyOpLoad): |
||||
|
"""Represents an elliptic curve private key.""" |
||||
|
|
||||
|
def __init__(self, scalar, curve): |
||||
|
"""Initialize the private key with the given scalar on the given |
||||
|
curve.""" |
||||
|
self._seed = None |
||||
|
self._scalar = scalar |
||||
|
self._curve = curve |
||||
|
self._pubkey = ECPublicKey(self._scalar * self._curve.G) |
||||
|
|
||||
|
@property |
||||
|
def scalar(self): |
||||
|
"""Returns the private scalar d of the key.""" |
||||
|
return self._scalar |
||||
|
|
||||
|
@property |
||||
|
def curve(self): |
||||
|
"""Returns the group which is used for EC computations.""" |
||||
|
return self._curve |
||||
|
|
||||
|
@property |
||||
|
def pubkey(self): |
||||
|
"""Returns the public key that is the counterpart to this private key.""" |
||||
|
return self._pubkey |
||||
|
|
||||
|
@property |
||||
|
def seed(self): |
||||
|
"""Returns the seed or None if there wasn't one. A seed is used for |
||||
|
schemes like EdDSA; it basically is a binary string that is hashed to |
||||
|
yield that actual private scalar d.""" |
||||
|
return self._seed |
||||
|
|
||||
|
def set_seed(self, seed): |
||||
|
"""Sets the seed of the private key. This operation can only performed |
||||
|
if no scalar has previously been set for this key.""" |
||||
|
assert(self._seed is None) |
||||
|
self._seed = seed |
||||
|
return self |
||||
|
|
||||
|
@staticmethod |
||||
|
def generate(curve): |
||||
|
"""Generate a random private key on a given curve.""" |
||||
|
scalar = secure_rand_int_between(1, curve.n - 1) |
||||
|
return ECPrivateKey(scalar, curve) |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self._seed is None: |
||||
|
return "PrivateKey<d = 0x%x>" % (self.scalar) |
||||
|
else: |
||||
|
seedstr = "".join("%02x" % (c) for c in self._seed) |
||||
|
return "PrivateKey<d = 0x%x, seed = %s>" % (self.scalar, seedstr) |
||||
@ -0,0 +1,44 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2016 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .PubKeyOps import PubKeyOpECDSAVerify, PubKeyOpECDSAExploitReusedNonce, PubKeyOpEDDSAVerify, PubKeyOpEDDSAEncode, PubKeyOpECIESEncrypt, PubKeyOpLoad |
||||
|
|
||||
|
class ECPublicKey(PubKeyOpECDSAVerify, PubKeyOpECDSAExploitReusedNonce, PubKeyOpEDDSAVerify, PubKeyOpEDDSAEncode, PubKeyOpECIESEncrypt, PubKeyOpLoad): |
||||
|
"""Elliptic curve public key abstraction. An EC public key is just a point |
||||
|
on the curve, which is why the constructor only takes this (public) point |
||||
|
as a parameter. The public key abstraction allows this point to be used in |
||||
|
various meaningful purposes (ECDSA signature verification, etc.).""" |
||||
|
|
||||
|
def __init__(self, point): |
||||
|
self._point = point |
||||
|
|
||||
|
@property |
||||
|
def curve(self): |
||||
|
return self._point.curve |
||||
|
|
||||
|
@property |
||||
|
def point(self): |
||||
|
return self._point |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "PublicKey<%s>" % (str(self.point)) |
||||
@ -0,0 +1,202 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
|
||||
|
class EllipticCurve(object): |
||||
|
"""Elliptic curve base class. Provides functionality which all curves have |
||||
|
in common.""" |
||||
|
def __init__(self, p, n, h, Gx, Gy, **kwargs): |
||||
|
assert(isinstance(p, int)) # Modulus |
||||
|
assert((n is None) or isinstance(n, int)) # Order |
||||
|
assert((h is None) or isinstance(h, int)) # Cofactor |
||||
|
assert((Gx is None) or isinstance(Gx, int)) # Generator Point X |
||||
|
assert((Gy is None) or isinstance(Gy, int)) # Generator Point Y |
||||
|
assert((Gx is None) == (Gy is None)) # Either both X and Y of G are set or none |
||||
|
self._p = p |
||||
|
self._n = n |
||||
|
self._h = h |
||||
|
if (Gx is not None) and (Gy is not None): |
||||
|
self._G = AffineCurvePoint(Gx, Gy, self) |
||||
|
else: |
||||
|
self._G = None |
||||
|
|
||||
|
if "quirks" in kwargs: |
||||
|
self._quirks = { quirk.identifier: quirk for quirk in kwargs["quirks"] } |
||||
|
else: |
||||
|
self._quirks = { } |
||||
|
@property |
||||
|
def p(self): |
||||
|
"""Returns the prime modulus which constitutes the finite field in |
||||
|
which the curve lies.""" |
||||
|
return self._p |
||||
|
|
||||
|
@property |
||||
|
def n(self): |
||||
|
"""Returns the order of the subgroup that is created by the generator |
||||
|
G.""" |
||||
|
return self._n |
||||
|
|
||||
|
@property |
||||
|
def h(self): |
||||
|
"""Returns the cofactor of the generator subgroup, i.e. h = #E(F_p) / |
||||
|
n. This will always be an integer according to Lagrange's Theorem.""" |
||||
|
return self._h |
||||
|
|
||||
|
@property |
||||
|
def G(self): |
||||
|
"""Returns the generator point G of the curve or None if no such point |
||||
|
was set. The generator point generates a subgroup over #E(F_p).""" |
||||
|
return self._G |
||||
|
|
||||
|
@property |
||||
|
def curve_order(self): |
||||
|
"""Returns the order of the curve in the underlying field, i.e. |
||||
|
#E(F_p). Intuitively, this is the total number of points on the curve |
||||
|
(plus maybe points at ininity, depending on the curve type) that |
||||
|
satisfy the curve equation.""" |
||||
|
if (self.h is None) or (self.n is None): |
||||
|
raise Exception("#E(F_p) is unknown for this curve") |
||||
|
return self.h * self.n |
||||
|
|
||||
|
@property |
||||
|
def frobenius_trace(self): |
||||
|
"""Returns the Frobenius trace 't' of the curve. Since |
||||
|
#E(F_p) = p + 1 - t it follows that t = p + 1 - #E(F_p).""" |
||||
|
return self.p + 1 - self.curve_order |
||||
|
|
||||
|
@property |
||||
|
def domainparams(self): |
||||
|
"""Returns the curve parameters as a named tuple.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
@property |
||||
|
def hasgenerator(self): |
||||
|
"""Returns if a generator point was supplied for the curve.""" |
||||
|
return self.G is not None |
||||
|
|
||||
|
@property |
||||
|
def hasname(self): |
||||
|
"""Returns if the curve is named (i.e. its name is not None).""" |
||||
|
return self.name is not None |
||||
|
|
||||
|
@property |
||||
|
def name(self): |
||||
|
"""Returns the name of the curve, if it was given one during |
||||
|
construction. Purely informational.""" |
||||
|
return self._name |
||||
|
|
||||
|
@property |
||||
|
def prettyname(self): |
||||
|
"""Returns the pretty name of the curve type. This might depend on the |
||||
|
actual curve, since it may also vary on the actual domain parameters to |
||||
|
include if the curve is a Koblitz curve or not.""" |
||||
|
return self.pretty_name |
||||
|
|
||||
|
@property |
||||
|
def curvetype(self): |
||||
|
"""Returns a string that corresponds to the curve type. For example, |
||||
|
this string can be 'shortweierstrass', 'twistededwards' or |
||||
|
'montgomery'.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
@property |
||||
|
def domainparamdict(self): |
||||
|
"""Returns the domain parameters of the curve as a dictionary.""" |
||||
|
return dict(self.domainparams._asdict()) |
||||
|
|
||||
|
@property |
||||
|
def security_bit_estimate(self): |
||||
|
"""Gives a haphazard estimate of the security of the underlying field, |
||||
|
in bits. For most curves, this will be half the bitsize of n (but might |
||||
|
be less, for example for Koblitz curves some bits might be |
||||
|
subtracted).""" |
||||
|
return self.n.bit_length() // 2 |
||||
|
|
||||
|
def enumerate_points(self): |
||||
|
"""Enumerates all points on the curve, including the point at infinity |
||||
|
(if the curve has such a special point).""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def naive_order_calculation(self): |
||||
|
"""Naively calculates the order #E(F_p) of the curve by enumerating and |
||||
|
counting all points which fulfull the curve equation. Note that this |
||||
|
implementation only works for the smallest of curves and is |
||||
|
computationally infeasible for all practical applications.""" |
||||
|
order = 0 |
||||
|
for pt in self.enumerate_points(): |
||||
|
order += 1 |
||||
|
return order |
||||
|
|
||||
|
def neutral(self): |
||||
|
"""Returns the neutral element of the curve group (for some curves, |
||||
|
this will be the point at infinity).""" |
||||
|
return AffineCurvePoint(None, None, self) |
||||
|
|
||||
|
def is_neutral(self, P): |
||||
|
"""Checks if a given point P is the neutral element of the group.""" |
||||
|
return P.x is None |
||||
|
|
||||
|
def oncurve(self, P): |
||||
|
"""Checks is a given point P is on the curve.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def point_addition(self, P, Q): |
||||
|
"""Returns the sum of two points P and Q on the curve.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def point_conjugate(self, P): |
||||
|
"""Returns the negated point -P to a given point P.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def compress(self, P): |
||||
|
"""Returns the compressed representation of the point P on the |
||||
|
curve. Not all curves may support this operation.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def uncompress(self, compressed): |
||||
|
"""Returns the uncompressed representation of a point on the curve. Not |
||||
|
all curves may support this operation.""" |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def has_quirk(self, quirk_class): |
||||
|
"""Some elliptic curves may have quirks or tweaks for certain |
||||
|
algorithms. These are attached to the curve using the 'quirks' kwarg of |
||||
|
the constructor. Code that wants to query if a specific quirk is |
||||
|
present may do so by calling 'has_quirk' with the according quirk class |
||||
|
(not a quirk class instance!).""" |
||||
|
return quirk_class.identifier in self._quirks |
||||
|
|
||||
|
def get_quirk(self, quirk_class): |
||||
|
"""If a quirk is present for a given elliptic curve, this quirk may |
||||
|
have been parametrized during instanciation. The get_quirk() method |
||||
|
returns that quirk instance when given a specific quirk class as input. |
||||
|
It raises a KeyError if the requested quirk is not present for the |
||||
|
elliptic curve.""" |
||||
|
return self._quirks[quirk_class.identifier] |
||||
|
|
||||
|
def __eq__(self, other): |
||||
|
return self.domainparams == other.domainparams |
||||
|
|
||||
|
def __ne__(self, other): |
||||
|
return not (self == other) |
||||
@ -0,0 +1,34 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
class DuplicateCurveException(Exception): |
||||
|
pass |
||||
|
|
||||
|
class NoSuchCurveException(Exception): |
||||
|
pass |
||||
|
|
||||
|
class UnsupportedPointFormatException(Exception): |
||||
|
pass |
||||
|
|
||||
|
class UnsupportedFieldException(Exception): |
||||
|
pass |
||||
@ -0,0 +1,249 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import random |
||||
|
|
||||
|
class FieldElement(object): |
||||
|
"""Represents an element in a finite field over a (prime) modulus.""" |
||||
|
|
||||
|
def __init__(self, intvalue, modulus): |
||||
|
assert(isinstance(intvalue, int)) |
||||
|
assert(isinstance(modulus, int)) |
||||
|
self._intvalue = intvalue % modulus |
||||
|
self._modulus = modulus |
||||
|
self._qnr = None |
||||
|
|
||||
|
@property |
||||
|
def modulus(self): |
||||
|
"""Returns the field's modulus.""" |
||||
|
return self._modulus |
||||
|
|
||||
|
@staticmethod |
||||
|
def _eea(a, b): |
||||
|
"""Extended euclidian algorithm. Returns the gcd of (a, b) and the |
||||
|
Bezout-coefficients.""" |
||||
|
assert(isinstance(a, int)) |
||||
|
assert(isinstance(b, int)) |
||||
|
(s, t, u, v) = (1, 0, 0, 1) |
||||
|
while b != 0: |
||||
|
(q, r) = (a // b, a % b) |
||||
|
(unew, vnew) = (s, t) |
||||
|
s = u - (q * s) |
||||
|
t = v - (q * t) |
||||
|
(a, b) = (b, r) |
||||
|
(u, v) = (unew, vnew) |
||||
|
return (a, u, v) |
||||
|
|
||||
|
def inverse(self): |
||||
|
if int(self) == 0: |
||||
|
raise Exception("Trying to invert zero") |
||||
|
(gcd, u, v) = self._eea(int(self), self.modulus) |
||||
|
return FieldElement(v, self.modulus) |
||||
|
|
||||
|
@property |
||||
|
def is_qr(self): |
||||
|
"""Returns if the number is a quadratic residue according to Euler's |
||||
|
criterion.""" |
||||
|
return not self.is_qnr |
||||
|
|
||||
|
@property |
||||
|
def is_qnr(self): |
||||
|
"""Returns if the number is a quadratic non-residue according to |
||||
|
Euler's criterion.""" |
||||
|
if self._qnr is None: |
||||
|
self._qnr = int(self ** ((self._modulus - 1) // 2)) != 1 |
||||
|
return self._qnr |
||||
|
|
||||
|
@property |
||||
|
def legrende_symbol(self): |
||||
|
"""Returns the Legrende symbol of the field element, i.e. 0 if the |
||||
|
element is 0 mod p, 1 if it is a quadratic residue mod p or -1 if it is |
||||
|
a quadratic non-residue mod p.""" |
||||
|
if self == 0: |
||||
|
return 0 |
||||
|
elif self.is_qr: |
||||
|
return 1 |
||||
|
else: |
||||
|
return -1 |
||||
|
|
||||
|
def _tonelli_shanks_sqrt(self): |
||||
|
"""Performs the Tonelli-Shanks algorithm to determine the square root |
||||
|
on an element. Note that the algorithm only works if the value it is |
||||
|
performed on is a quadratic residue mod p.""" |
||||
|
q = self._modulus - 1 |
||||
|
s = 0 |
||||
|
while (q % 2) == 0: |
||||
|
s += 1 |
||||
|
q >>= 1 |
||||
|
assert(q * (2 ** s) == self.modulus - 1) |
||||
|
|
||||
|
while True: |
||||
|
z = FieldElement(random.randint(1, self.modulus - 1), self.modulus) |
||||
|
if z.is_qnr: |
||||
|
break |
||||
|
assert(z.is_qnr) |
||||
|
c = z ** q |
||||
|
|
||||
|
r = self ** ((q + 1) // 2) |
||||
|
t = self ** q |
||||
|
m = s |
||||
|
while int(t) != 1: |
||||
|
for i in range(1, m): |
||||
|
if int(t ** (1 << i)) == 1: |
||||
|
break |
||||
|
|
||||
|
b = c ** (1 << (m - i - 1)) |
||||
|
r = r * b |
||||
|
t = t * (b ** 2) |
||||
|
c = b ** 2 |
||||
|
m = i |
||||
|
|
||||
|
return r |
||||
|
|
||||
|
def sqr(self): |
||||
|
"""Return the squared value.""" |
||||
|
return self * self |
||||
|
|
||||
|
def sqrt(self): |
||||
|
"""Returns the square root of the value or None if the value is a |
||||
|
quadratic non-residue mod p.""" |
||||
|
if self.is_qnr: |
||||
|
return None |
||||
|
|
||||
|
if (self._modulus % 4) == 3: |
||||
|
root = self ** ((self._modulus + 1) // 4) |
||||
|
assert(root * root == self) |
||||
|
else: |
||||
|
root = self._tonelli_shanks_sqrt() |
||||
|
|
||||
|
if (int(root) & 1) == 0: |
||||
|
return (root, -root) |
||||
|
else: |
||||
|
return (-root, root) |
||||
|
|
||||
|
def quartic_root(self): |
||||
|
"""Returns the quartic root of the value or None if no such value |
||||
|
explicitly exists mod p.""" |
||||
|
root = self.sqrt() |
||||
|
if root is not None: |
||||
|
r1 = root[0].sqrt() or list() |
||||
|
r2 = root[1].sqrt() or list() |
||||
|
for candidate in list(r1) + list(r2): |
||||
|
if (candidate ** 4) == self: |
||||
|
return candidate |
||||
|
|
||||
|
def __checktype(self, value): |
||||
|
if isinstance(value, int): |
||||
|
return value |
||||
|
elif isinstance(value, FieldElement): |
||||
|
if value.modulus == self.modulus: |
||||
|
return int(value) |
||||
|
else: |
||||
|
raise Exception("Cannot perform meaningful arithmetic operations on field elements in different fields.") |
||||
|
|
||||
|
def sigint(self): |
||||
|
"""Returns a signed integer if the negative value is less than 10 |
||||
|
decimal digits and the absolute negated value is smaller than the |
||||
|
absolute positive value.""" |
||||
|
neg = abs(int(-self)) |
||||
|
if (neg < int(self)) and (neg < 1000000000): |
||||
|
return -neg |
||||
|
else: |
||||
|
return int(self) |
||||
|
|
||||
|
@classmethod |
||||
|
def any_qnr(cls, modulus): |
||||
|
"""Returns any quadratic non-residue in F(modulus).""" |
||||
|
for i in range(1000): |
||||
|
candidate = cls(random.randint(2, modulus - 1), modulus) |
||||
|
if candidate.is_qnr: |
||||
|
return candidate |
||||
|
raise Exception("Could not find a QNR in F_%d with a reasonable amount of tries." % (modulus)) |
||||
|
|
||||
|
def __int__(self): |
||||
|
return self._intvalue |
||||
|
|
||||
|
def __add__(self, value): |
||||
|
value = self.__checktype(value) |
||||
|
if value is None: |
||||
|
return NotImplemented |
||||
|
return FieldElement(int(self) + value, self.modulus) |
||||
|
|
||||
|
def __sub__(self, value): |
||||
|
value = self.__checktype(value) |
||||
|
if value is None: |
||||
|
return NotImplemented |
||||
|
return FieldElement(int(self) - value, self.modulus) |
||||
|
|
||||
|
def __mul__(self, value): |
||||
|
value = self.__checktype(value) |
||||
|
if value is None: |
||||
|
return NotImplemented |
||||
|
return FieldElement(int(self) * value, self.modulus) |
||||
|
|
||||
|
def __floordiv__(self, value): |
||||
|
value = self.__checktype(value) |
||||
|
if value is None: |
||||
|
return NotImplemented |
||||
|
return self * FieldElement(value, self.modulus).inverse() |
||||
|
|
||||
|
def __pow__(self, exponent): |
||||
|
assert(isinstance(exponent, int)) |
||||
|
return FieldElement(pow(int(self), exponent, self.modulus), self.modulus) |
||||
|
|
||||
|
def __neg__(self): |
||||
|
return FieldElement(-int(self), self.modulus) |
||||
|
|
||||
|
def __radd__(self, value): |
||||
|
return self + value |
||||
|
|
||||
|
def __rsub__(self, value): |
||||
|
return -self + value |
||||
|
|
||||
|
def __rmul__(self, value): |
||||
|
return self * value |
||||
|
|
||||
|
def __rfloordiv__(self, value): |
||||
|
return self.inverse() * value |
||||
|
|
||||
|
def __eq__(self, value): |
||||
|
if value is None: |
||||
|
return False |
||||
|
value = self.__checktype(value) |
||||
|
return int(self) == (value % self.modulus) |
||||
|
|
||||
|
def __ne__(self, other): |
||||
|
return not (self == other) |
||||
|
|
||||
|
def __lt__(self, value): |
||||
|
value = self.__checktype(value) |
||||
|
return int(self) < value |
||||
|
|
||||
|
def __hash__(self): |
||||
|
return hash((self._intvalue, self._modulus)) |
||||
|
|
||||
|
def __repr__(self): |
||||
|
return str(self) |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "{0x%x}" % (int(self)) |
||||
@ -0,0 +1,164 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import collections |
||||
|
from .FieldElement import FieldElement |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .EllipticCurve import EllipticCurve |
||||
|
from .DocInherit import doc_inherit |
||||
|
import toyecc.TwistedEdwardsCurve |
||||
|
|
||||
|
_MontgomeryCurveDomainParameters = collections.namedtuple("MontgomeryCurveDomainParameters", [ "curvetype", "a", "b", "p", "n", "G" ]) |
||||
|
|
||||
|
class MontgomeryCurve(EllipticCurve): |
||||
|
"""Represents an elliptic curve over a finite field F_P that satisfies the |
||||
|
Montgomery equation by^2 = x^3 + ax^2 + x.""" |
||||
|
pretty_name = "Montgomery" |
||||
|
|
||||
|
def __init__(self, a, b, p, n, h, Gx, Gy, **kwargs): |
||||
|
"""Create an elliptic Montgomery curve given the equation coefficients |
||||
|
a and b, the curve modulus p, the order of the curve n, the cofactor of |
||||
|
the curve h and the generator point G's X and Y coordinates in affine |
||||
|
representation, Gx and Gy.""" |
||||
|
EllipticCurve.__init__(self, p, n, h, Gx, Gy, **kwargs) |
||||
|
assert(isinstance(a, int)) # Curve coefficent A |
||||
|
assert(isinstance(b, int)) # Curve coefficent B |
||||
|
self._a = FieldElement(a, p) |
||||
|
self._b = FieldElement(b, p) |
||||
|
self._name = kwargs.get("name") |
||||
|
|
||||
|
# Check that the curve is not singular |
||||
|
assert(self.b * ((self.a ** 2) - 4) != 0) |
||||
|
|
||||
|
if self._G is not None: |
||||
|
# Check that the generator G is on the curve |
||||
|
assert(self._G.oncurve()) |
||||
|
|
||||
|
# Check that the generator G is of curve order |
||||
|
assert((self.n * self.G).is_neutral) |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def domainparams(self): |
||||
|
return _MontgomeryCurveDomainParameters(curvetype = self.curvetype, a = self.a, b = self.b, p = self.p, n = self.n, G = self.G) |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def curvetype(self): |
||||
|
return "montgomery" |
||||
|
|
||||
|
@property |
||||
|
def a(self): |
||||
|
"""Returns the coefficient a of the curve equation by^2 = x^3 + ax^2 + x.""" |
||||
|
return self._a |
||||
|
|
||||
|
@property |
||||
|
def b(self): |
||||
|
"""Returns the coefficient b of the curve equation by^2 = x^3 + ax^2 + x.""" |
||||
|
return self._b |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def oncurve(self, P): |
||||
|
return (P.is_neutral) or ((self.b * P.y ** 2) == (P.x ** 3) + (self.a * (P.x ** 2)) + P.x) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_conjugate(self, P): |
||||
|
return AffineCurvePoint(int(P.x), int(-P.y), self) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_addition(self, P, Q): |
||||
|
if P.is_neutral: |
||||
|
# P is at infinity, O + Q = Q |
||||
|
result = Q |
||||
|
elif P == -Q: |
||||
|
# P == -Q, return O (point at infinity) |
||||
|
result = AffineCurvePoint.neutral(self) |
||||
|
elif P == Q: |
||||
|
# P == Q, point doubling |
||||
|
newx = -2 * P.x - self.a + (3 * P.x**2 + 2 * P.x * self.a + 1)**2 // (4 * P.y**2 * self.b) |
||||
|
newy = -P.y + (3 * P.x**2 + 2 * P.x * self.a + 1) * (3 * P.x + self.a) // (2 * P.y * self.b) - (3 * P.x**2 + 2 * P.x * self.a + 1)**3 // (8 * P.y**3 * self.b**2) |
||||
|
result = AffineCurvePoint(int(newx), int(newy), self) |
||||
|
else: |
||||
|
# P != Q, point addition |
||||
|
newx = -P.x - Q.x - self.a + (P.y - Q.y)**2 * self.b // (P.x - Q.x)**2 |
||||
|
newy = (2 * P.x + Q.x + self.a) * (P.y - Q.y) // (P.x - Q.x) - P.y - (P.y - Q.y)**3 * self.b // (P.x - Q.x)**3 |
||||
|
result = AffineCurvePoint(int(newx), int(newy), self) |
||||
|
return result |
||||
|
|
||||
|
def to_twistededwards(self, a = None): |
||||
|
"""Converts the domain parameters of this curve to domain parameters of |
||||
|
a birationally equivalent twisted Edwards curve. The user may select a |
||||
|
desired a coefficient that the resulting Edwards curve shall have or |
||||
|
leave it at None to accept an arbitrary one.""" |
||||
|
assert((a is None) or isinstance(a, int)) |
||||
|
|
||||
|
# For the Montgomery curve, B can always be arbitrarily chosen as long |
||||
|
# as the surrogate B coeffients are identical in their quadratic |
||||
|
# residue property mod p. This means an Montgomery curve where B is a |
||||
|
# quadratic residue mod p is isomorphous to all other Montgomery curves |
||||
|
# with identical A, p and where B is also a quadratic residue mod p. We |
||||
|
# use this property to get the curve we want if there is a desired "a" |
||||
|
# outcome and choose B appropriately. |
||||
|
if a is None: |
||||
|
# No special wish for a, just do the normal conversion |
||||
|
conversion_b = self.b |
||||
|
a = (self.a + 2) // conversion_b |
||||
|
else: |
||||
|
# We desire a special a and calculate the B we want |
||||
|
conversion_b = (self.a + 2) // a |
||||
|
|
||||
|
# And assure that it's QR property is the same as the original |
||||
|
assert(conversion_b.is_qr == self.b.is_qr) |
||||
|
d = (self.a - 2) // conversion_b |
||||
|
|
||||
|
# Then construct a curve with no generator first |
||||
|
raw_curve = toyecc.TwistedEdwardsCurve.TwistedEdwardsCurve( |
||||
|
a = int(a), |
||||
|
d = int(d), |
||||
|
p = self.p, |
||||
|
n = self.n, |
||||
|
h = self.h, |
||||
|
Gx = None, |
||||
|
Gy = None, |
||||
|
) |
||||
|
|
||||
|
# Convert the generator point to the new curve |
||||
|
G_twed = self.G.convert(raw_curve) |
||||
|
|
||||
|
# And recreate the curve with this new generator |
||||
|
twed_curve = toyecc.TwistedEdwardsCurve.TwistedEdwardsCurve( |
||||
|
a = int(a), |
||||
|
d = int(d), |
||||
|
p = self.p, |
||||
|
n = self.n, |
||||
|
h = self.h, |
||||
|
Gx = int(G_twed.x), |
||||
|
Gy = int(G_twed.y), |
||||
|
) |
||||
|
return twed_curve |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self.hasname: |
||||
|
return "MontgomeryCurve<%s>" % (self.name) |
||||
|
else: |
||||
|
return "MontgomeryCurve<0x%x y^2 = x^3 + 0x%x x^2 + x mod 0x%x>" % (int(self.b), int(self.a), int(self.p)) |
||||
@ -0,0 +1,258 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from . import Tools |
||||
|
from .FieldElement import FieldElement |
||||
|
from .Exceptions import UnsupportedPointFormatException |
||||
|
|
||||
|
class PointOpEDDSAEncoding(object): |
||||
|
def eddsa_encode(self): |
||||
|
"""Performs serialization of the point as required by EdDSA.""" |
||||
|
coordlen = (self.curve.B + 7) // 8 |
||||
|
bitlen = (coordlen * 8) - 1 |
||||
|
enc_value = int(self.y) |
||||
|
enc_value &= ((1 << bitlen) - 1) |
||||
|
enc_value |= (int(self.x) & 1) << bitlen |
||||
|
return Tools.inttobytes_le(enc_value, (self.curve.B + 7) // 8) |
||||
|
|
||||
|
@staticmethod |
||||
|
def __eddsa_recoverx(curve, y): |
||||
|
x = 0 |
||||
|
xx = (y * y - 1) // (curve.d * y * y - curve.a) |
||||
|
if curve.p % 8 == 5: |
||||
|
x = xx ** ((curve.p + 3) // 8) |
||||
|
if x * x == -xx: |
||||
|
x = x * (FieldElement(2, curve.p) ** ((curve.p - 1) // 4)) |
||||
|
elif curve.p % 4 == 3: |
||||
|
x = xx ** ((curve.p + 1) // 4) |
||||
|
if x * x != xx: |
||||
|
x = 0 |
||||
|
return int(x) |
||||
|
|
||||
|
@classmethod |
||||
|
def eddsa_decode(cls, curve, data): |
||||
|
"""Performs deserialization of the point as required by EdDSA.""" |
||||
|
assert(curve.curvetype == "twistededwards") |
||||
|
coordlen = (curve.B + 7) // 8 |
||||
|
bitlen = (coordlen * 8) - 1 |
||||
|
enc_value = int.from_bytes(data, byteorder = "little") |
||||
|
y = enc_value & ((1 << bitlen) - 1) |
||||
|
x = PointOpEDDSAEncoding.__eddsa_recoverx(curve, y) |
||||
|
hibit = (enc_value >> bitlen) & 1 |
||||
|
if (x & 1) != hibit: |
||||
|
x = curve.p - x |
||||
|
return cls(x, y, curve) |
||||
|
|
||||
|
class PointOpCurveConversion(object): |
||||
|
@staticmethod |
||||
|
def __pconv_twed_mont_scalefactor(twedcurve, montcurve): |
||||
|
native_b = 4 // (twedcurve.a - twedcurve.d) |
||||
|
if native_b == montcurve.b: |
||||
|
# Scaling is not necessary, already native curve format |
||||
|
scale_factor = 1 |
||||
|
else: |
||||
|
# Scaling of montgomery y component (v) is needed |
||||
|
if twedcurve.hasgenerator and montcurve.hasgenerator: |
||||
|
# Convert the generator point of the twisted edwards source |
||||
|
# point to unscaled Montgomery space |
||||
|
Gv = (1 + twedcurve.G.y) // ((1 - twedcurve.G.y) * twedcurve.G.x) |
||||
|
|
||||
|
# And calculate a multiplicative scaling factor so that the |
||||
|
# point will result in the target curve's generator point Y |
||||
|
scale_factor = montcurve.G.y // Gv |
||||
|
|
||||
|
elif native_b.is_qr: |
||||
|
# If b is a quadradic residue mod p then any other |
||||
|
# quadratic residue can serve as a surrgate b coefficient |
||||
|
# to yield an isomorphous curve. Only y coordinate of the |
||||
|
# resulting points needs to be scaled. Calculate a scaling |
||||
|
# ratio. |
||||
|
scale_factors = (montcurve.b // native_b).sqrt() |
||||
|
|
||||
|
# At least one of the curves lacks a generator point, |
||||
|
# select just any scale factor |
||||
|
scale_factor = scale_factors[0].inverse() |
||||
|
|
||||
|
else: |
||||
|
# Native B is a quadratic non-residue module B; Not sure |
||||
|
# how to handle this case |
||||
|
# TODO: Implement this |
||||
|
raise Exception(NotImplemented) |
||||
|
return scale_factor |
||||
|
|
||||
|
def convert(self, targetcurve): |
||||
|
"""Convert the affine curve point to a point on a birationally |
||||
|
equivalent target curve.""" |
||||
|
|
||||
|
if self.is_neutral: |
||||
|
return targetcurve.neutral() |
||||
|
|
||||
|
if (self.curve.curvetype == "twistededwards") and (targetcurve.curvetype == "montgomery"): |
||||
|
# (x, y) are Edwards coordinates |
||||
|
# (u, v) are Montgomery coordonates |
||||
|
(x, y) = (self.x, self.y) |
||||
|
u = (1 + y) // (1 - y) |
||||
|
v = (1 + y) // ((1 - y) * x) |
||||
|
|
||||
|
# Montgomery coordinates are unscaled to the actual B coefficient |
||||
|
# of the curve right now. Calculate scaling factor and scale v |
||||
|
# appropriately |
||||
|
scaling_factor = self.__pconv_twed_mont_scalefactor(self.curve, targetcurve) |
||||
|
v = v * scaling_factor |
||||
|
|
||||
|
point = self.__class__(int(u), int(v), targetcurve) |
||||
|
elif (self.curve.curvetype == "montgomery") and (targetcurve.curvetype == "twistededwards"): |
||||
|
# (x, y) are Edwards coordinates |
||||
|
# (u, v) are Montgomery coordonates |
||||
|
(u, v) = (self.x, self.y) |
||||
|
y = (u - 1) // (u + 1) |
||||
|
x = -(1 + y) // (v * (y - 1)) |
||||
|
|
||||
|
# Twisted Edwards coordinates are unscaled to the actual B |
||||
|
# coefficient of the curve right now. Calculate scaling factor and |
||||
|
# scale x appropriately |
||||
|
scaling_factor = self.__pconv_twed_mont_scalefactor(targetcurve, self.curve) |
||||
|
x = x * scaling_factor |
||||
|
|
||||
|
point = self.__class__(int(x), int(y), targetcurve) |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
assert(point.oncurve()) |
||||
|
return point |
||||
|
|
||||
|
class PointOpNaiveOrderCalculation(object): |
||||
|
def naive_order_calculation(self): |
||||
|
"""Calculates the order of the point naively, i.e. by walking through |
||||
|
all points until the given neutral element is hit. Note that this only |
||||
|
works for smallest of curves and is not computationally feasible for |
||||
|
anything else.""" |
||||
|
curpt = self |
||||
|
order = 1 |
||||
|
while not curpt.is_neutral: |
||||
|
order += 1 |
||||
|
curpt += self |
||||
|
return order |
||||
|
|
||||
|
|
||||
|
class PointOpSerialization(object): |
||||
|
def serialize_uncompressed(self): |
||||
|
"""Serializes the point into a bytes object in uncompressed form.""" |
||||
|
length = (self.curve.p.bit_length() + 7) // 8 |
||||
|
serialized = bytes([ 0x04 ]) + Tools.inttobytes(int(self.x), length) + Tools.inttobytes(int(self.y), length) |
||||
|
return serialized |
||||
|
|
||||
|
@classmethod |
||||
|
def deserialize_uncompressed(cls, data, curve = None): |
||||
|
"""Deserializes a curve point which is given in uncompressed form. A |
||||
|
curve may be passed with the 'curve' argument in which case an |
||||
|
AffineCurvePoint is returned from this method. Otherwise the affine X |
||||
|
and Y coordinates are returned as a tuple.""" |
||||
|
if data[0] != 0x04: |
||||
|
raise UnsupportedPointFormatException("Generator point of explicitly encoded curve is given in unsupported form (0x%x)." % (data[0])) |
||||
|
data = data[1:] |
||||
|
assert((len(data) % 2) == 0) |
||||
|
Px = Tools.bytestoint(data[ : len(data) // 2]) |
||||
|
Py = Tools.bytestoint(data[len(data) // 2 : ]) |
||||
|
if curve is not None: |
||||
|
return cls(Px, Py, curve) |
||||
|
else: |
||||
|
return (Px, Py) |
||||
|
|
||||
|
class PointOpScalarMultiplicationXOnly(): |
||||
|
"""Compute an X-only ladder scalar multiplication of the private key and |
||||
|
the X coordinate of a given point.""" |
||||
|
def _x_double(self, x): |
||||
|
"""Doubling of point with coordinate x.""" |
||||
|
if x is None: |
||||
|
return None |
||||
|
|
||||
|
den = 4 * (x**3 + self.curve.a * x + self.curve.b) |
||||
|
if den == 0: |
||||
|
# Point at infinity |
||||
|
return None |
||||
|
num = (x**2 - self.curve.a)**2 - (8 * self.curve.b * x) |
||||
|
return num // den |
||||
|
|
||||
|
def _x_add_multiplicative(self, x1, x2, x3prime): |
||||
|
"""Multiplicative formula addition of x1 + x2, where x3' is the |
||||
|
difference in X of P1 - P2. Using this function only makes sense where |
||||
|
(P1 - P2) is fixed, as it is in the ladder implementation.""" |
||||
|
if x1 is None: |
||||
|
return x2 |
||||
|
elif x2 is None: |
||||
|
return x1 |
||||
|
elif x1 == x2: |
||||
|
return None |
||||
|
num = -4 * self.curve.b * (x1 + x2) + (x1 * x2 - self.curve.a)**2 |
||||
|
den = x3prime * (x1 - x2)**2 |
||||
|
result = num // den |
||||
|
return result |
||||
|
|
||||
|
def _x_add_additive(self, x1, x2, x3prime): |
||||
|
"""Additive formula addition of x1 + x2, where x3' is the difference in |
||||
|
X of P1 - P2. Using this function only makes sense where (P1 - P2) is |
||||
|
fixed, as it is in the ladder implementation.""" |
||||
|
if x1 is None: |
||||
|
return x2 |
||||
|
elif x2 is None: |
||||
|
return x1 |
||||
|
elif x1 == x2: |
||||
|
return None |
||||
|
num = 2 * (x1 + x2) * (x1 * x2 + self.curve.a) + 4 * self.curve.b |
||||
|
den = (x1 - x2) ** 2 |
||||
|
result = num // den - x3prime |
||||
|
return result |
||||
|
|
||||
|
def _x_add(self, x1, x2, x3prime): |
||||
|
"""There are two equivalent implementations, one using the |
||||
|
multiplicative and the other using the additive representation. Both |
||||
|
should work equally well.""" |
||||
|
return self._x_add_multiplicative(x1, x2, x3prime) |
||||
|
#return self._x_add_additive(x1, x2, x3prime) |
||||
|
|
||||
|
def scalar_mul_xonly(self, scalar): |
||||
|
"""This implements the X-coordinate-only multiplication algorithm of a |
||||
|
Short Weierstrass curve with the X coordinate of a given point. |
||||
|
Reference is "Izu and Takagi: A Fast Parallel Elliptic Curve |
||||
|
Multiplication Resistant against Side Channel Attacks" (2002)""" |
||||
|
if self.curve.curvetype != "shortweierstrass": |
||||
|
raise NotImplementedError("X-only ladder multiplication is only implemented for Short Weierstrass curves") |
||||
|
if self.is_neutral: |
||||
|
# Point at infinity is input |
||||
|
return None |
||||
|
elif scalar == 0: |
||||
|
# Multiplication with zero -> point at infinity is output |
||||
|
return None |
||||
|
|
||||
|
x_coordinate = int(self.x) |
||||
|
if not isinstance(x_coordinate, FieldElement): |
||||
|
x_coordinate = FieldElement(x_coordinate, self.curve.p) |
||||
|
Q = [ x_coordinate, self._x_double(x_coordinate), None ] |
||||
|
for bitno in reversed(range(scalar.bit_length() - 1)): |
||||
|
bit = (scalar >> bitno) & 1 |
||||
|
Q[2] = self._x_double(Q[bit]) |
||||
|
Q[1] = self._x_add(Q[0], Q[1], x_coordinate) |
||||
|
Q[0] = Q[2 - bit] |
||||
|
Q[1] = Q[1 + bit] |
||||
|
return Q[0] |
||||
@ -0,0 +1,331 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import re |
||||
|
import collections |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
|
||||
|
class _CoeffDict(object): |
||||
|
def __init__(self): |
||||
|
self._coeffs = { } |
||||
|
|
||||
|
def clone(self): |
||||
|
clone = _CoeffDict() |
||||
|
clone._coeffs = dict(self._coeffs) |
||||
|
return clone |
||||
|
|
||||
|
@property |
||||
|
def degree(self): |
||||
|
if len(self._coeffs) > 0: |
||||
|
return max(self._coeffs.keys()) |
||||
|
else: |
||||
|
return 0 |
||||
|
|
||||
|
def clone(self): |
||||
|
clone = _CoeffDict() |
||||
|
clone._coeffs = dict(self._coeffs) |
||||
|
return clone |
||||
|
|
||||
|
def __eq__(self, other): |
||||
|
return self._coeffs == other._coeffs |
||||
|
|
||||
|
def __neq__(self, other): |
||||
|
return not (self == other) |
||||
|
|
||||
|
def __iter__(self): |
||||
|
return iter(self._coeffs.items()) |
||||
|
|
||||
|
def __len__(self): |
||||
|
return len(self._coeffs) |
||||
|
|
||||
|
def __getitem__(self, key): |
||||
|
return self._coeffs.get(key, 0) |
||||
|
|
||||
|
def __setitem__(self, key, value): |
||||
|
if (value == 0) and (key in self._coeffs): |
||||
|
del self._coeffs[key] |
||||
|
else: |
||||
|
self._coeffs[key] = value |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "CoeffDict<%s>" % (str(self._coeffs)) |
||||
|
|
||||
|
class Polynomial(object): |
||||
|
_TERM_RE = re.compile("^((?P<coeff>-?\d+)\*)?x(\^(?P<exponent>\d+))?$") |
||||
|
_CACHE_EXPONENTS = [ 2, 3 ] |
||||
|
|
||||
|
def __init__(self, modulus, initvalue = None): |
||||
|
self._modulus = modulus |
||||
|
self._terms = _CoeffDict() |
||||
|
if initvalue is None: |
||||
|
self._terms[1] = FieldElement(1, self._modulus) |
||||
|
else: |
||||
|
if initvalue != 0: |
||||
|
self._terms[0] = FieldElement(initvalue, self._modulus) |
||||
|
self._expcache = { } |
||||
|
|
||||
|
@property |
||||
|
def degree(self): |
||||
|
return self._terms.degree |
||||
|
|
||||
|
@property |
||||
|
def modulus(self): |
||||
|
return self._modulus |
||||
|
|
||||
|
@property |
||||
|
def is_constant(self): |
||||
|
return self.degree == 0 |
||||
|
|
||||
|
def get_constant(self): |
||||
|
assert(self.is_constant) |
||||
|
return self[0] |
||||
|
|
||||
|
def _clone(self): |
||||
|
clone = Polynomial(self.modulus, 0) |
||||
|
clone._terms = self._terms.clone() |
||||
|
return clone |
||||
|
|
||||
|
def substitute(self, value): |
||||
|
result = 0 |
||||
|
for (exponent, coefficient) in self._terms: |
||||
|
result += coefficient * (value ** exponent) |
||||
|
return result |
||||
|
|
||||
|
def gcd(self, other): |
||||
|
"""Returns the greatest common divisor polynomial of this object and |
||||
|
the other polynomial.""" |
||||
|
assert(isinstance(other, Polynomial)) |
||||
|
assert(self.modulus == other.modulus) |
||||
|
assert((self != 0) or (other != 0)) |
||||
|
(a, b) = (self, other) |
||||
|
if a == 0: |
||||
|
return b |
||||
|
elif b == 0: |
||||
|
return a |
||||
|
|
||||
|
while b != 0: |
||||
|
(a, b) = (b, a % b) |
||||
|
|
||||
|
highest_coefficient = a._terms[a.degree] |
||||
|
a = a // highest_coefficient |
||||
|
return a |
||||
|
|
||||
|
def __and__(self, other): |
||||
|
"""Returns the greatest common divisor polynomial of this object and |
||||
|
the other polynomial.""" |
||||
|
return self.gcd(other) |
||||
|
|
||||
|
def __add__(self, value): |
||||
|
if isinstance(value, int) or isinstance(value, FieldElement): |
||||
|
result = self._clone() |
||||
|
result._terms[0] += value |
||||
|
return result |
||||
|
elif isinstance(value, Polynomial): |
||||
|
result = self._clone() |
||||
|
for (exponent, coefficient) in value: |
||||
|
result._terms[exponent] += coefficient |
||||
|
return result |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __sub__(self, value): |
||||
|
if isinstance(value, int) or isinstance(value, FieldElement): |
||||
|
result = self._clone() |
||||
|
result._terms[0] -= value |
||||
|
return result |
||||
|
elif isinstance(value, Polynomial): |
||||
|
result = self._clone() |
||||
|
for (exponent, coefficient) in value: |
||||
|
result._terms[exponent] -= coefficient |
||||
|
return result |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __pow__(self, value): |
||||
|
if value in self._expcache: |
||||
|
return self._expcache[value] |
||||
|
if isinstance(value, int): |
||||
|
if len(self._terms) == 1: |
||||
|
result = Polynomial(self.modulus, 0) |
||||
|
for (exponent, coefficient) in self: |
||||
|
result._terms[exponent * value] = coefficient ** value |
||||
|
else: |
||||
|
exponent = value |
||||
|
result = Polynomial(self.modulus, 1) |
||||
|
multiplier = self |
||||
|
for bit in range(exponent.bit_length()): |
||||
|
if exponent & (1 << bit): |
||||
|
result = result * multiplier |
||||
|
multiplier = multiplier * multiplier |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
if value in self._CACHE_EXPONENTS: |
||||
|
self._expcache[value] = result |
||||
|
|
||||
|
return result |
||||
|
|
||||
|
def powmod(self, exponent, modulus): |
||||
|
"""Returns the result of (self^exponent) % modulus. Exponent must be an |
||||
|
integer and modulus another Polynomial.""" |
||||
|
assert(isinstance(exponent, int)) |
||||
|
assert((modulus is None) or isinstance(modulus, Polynomial)) |
||||
|
assert(exponent >= 0) |
||||
|
result = Polynomial(self.modulus, 1) |
||||
|
multiplier = self |
||||
|
for bit in range(exponent.bit_length()): |
||||
|
if exponent & (1 << bit): |
||||
|
result = (result * multiplier) % modulus |
||||
|
multiplier = (multiplier * multiplier) % modulus |
||||
|
return result |
||||
|
|
||||
|
@classmethod |
||||
|
def parse_poly(cls, polystr, modulus): |
||||
|
poly = Polynomial(modulus, 0) |
||||
|
|
||||
|
polystr = polystr.replace(" - ", " + -") |
||||
|
terms = polystr.split(" + ") |
||||
|
for term in terms: |
||||
|
if term.isnumeric(): |
||||
|
poly._terms[0] += int(term) |
||||
|
else: |
||||
|
result = cls._TERM_RE.match(term) |
||||
|
if result is None: |
||||
|
raise Exception("Cannot parse polynomial term: '%s'" % (term)) |
||||
|
result = result.groupdict() |
||||
|
|
||||
|
result = { key: int(value) for (key, value) in result.items() if (value is not None) } |
||||
|
coeff = result.get("coeff", 1) |
||||
|
exponent = result.get("exponent", 1) |
||||
|
poly._terms[exponent] += FieldElement(coeff, modulus) |
||||
|
|
||||
|
return poly |
||||
|
|
||||
|
def __floordiv__(self, value): |
||||
|
if isinstance(value, int) or isinstance(value, FieldElement): |
||||
|
result = Polynomial(self.modulus, 0) |
||||
|
for (exponent, coefficient) in self: |
||||
|
result._terms[exponent] = coefficient // value |
||||
|
return result |
||||
|
elif isinstance(value, Polynomial): |
||||
|
if value.degree == 0: |
||||
|
return self // value[0] |
||||
|
|
||||
|
result = Polynomial(self.modulus, 0) |
||||
|
numerator = self._clone() |
||||
|
while numerator.degree >= value.degree: |
||||
|
shift = numerator.degree - value.degree |
||||
|
multiplier = numerator[numerator.degree] // value[value.degree] |
||||
|
|
||||
|
result._terms[shift] += multiplier |
||||
|
for (exponent, coefficient) in value: |
||||
|
numerator._terms[exponent + shift] -= multiplier * coefficient |
||||
|
return result |
||||
|
|
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __mul__(self, value): |
||||
|
if isinstance(value, int) or isinstance(value, FieldElement): |
||||
|
result = Polynomial(self.modulus, 0) |
||||
|
for (exponent, coefficient) in self: |
||||
|
result._terms[exponent] = coefficient * value |
||||
|
return result |
||||
|
elif isinstance(value, Polynomial): |
||||
|
result = Polynomial(self.modulus, 0) |
||||
|
for (exponent1, coefficient1) in self: |
||||
|
for (exponent2, coefficient2) in value: |
||||
|
result._terms[exponent1 + exponent2] += coefficient1 * coefficient2 |
||||
|
return result |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __mod__(self, value): |
||||
|
if isinstance(value, Polynomial): |
||||
|
if value.degree == 0: |
||||
|
return Polynomial(self.modulus, 0) |
||||
|
|
||||
|
result = self._clone() |
||||
|
while result.degree >= value.degree: |
||||
|
shift = result.degree - value.degree |
||||
|
multiplier = result[result.degree] // value[value.degree] |
||||
|
|
||||
|
for (exponent, coefficient) in value: |
||||
|
result._terms[exponent + shift] -= multiplier * coefficient |
||||
|
return result |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __rmul__(self, value): |
||||
|
return self * value |
||||
|
|
||||
|
def __radd__(self, value): |
||||
|
return self + value |
||||
|
|
||||
|
def __getitem__(self, exponent): |
||||
|
return self._terms[exponent] |
||||
|
|
||||
|
def __iter__(self): |
||||
|
yield from iter(self._terms) |
||||
|
|
||||
|
def __eq__(self, value): |
||||
|
if isinstance(value, int) or isinstance(value, FieldElement): |
||||
|
return self.is_constant and (self.get_constant() == value) |
||||
|
elif isinstance(value, Polynomial): |
||||
|
return (self.modulus == value.modulus) and (self._terms == value._terms) |
||||
|
else: |
||||
|
raise Exception(NotImplemented) |
||||
|
|
||||
|
def __ne__(self, value): |
||||
|
return not (self == value) |
||||
|
|
||||
|
def __repr__(self): |
||||
|
return str(self) |
||||
|
|
||||
|
def __str__(self): |
||||
|
terms = [ ] |
||||
|
for (exponent, coefficient) in sorted(self, reverse = True): |
||||
|
if coefficient == 0: |
||||
|
continue |
||||
|
|
||||
|
if exponent == 0: |
||||
|
terms.append("%d" % (int(coefficient))) |
||||
|
continue |
||||
|
|
||||
|
elif coefficient == 1: |
||||
|
coeffstr = "" |
||||
|
else: |
||||
|
coeffstr = "%d*" % (int(coefficient)) |
||||
|
|
||||
|
if exponent == 1: |
||||
|
termstr = "x" |
||||
|
else: |
||||
|
termstr = "x^%d" % (int(exponent)) |
||||
|
|
||||
|
terms.append(coeffstr + termstr) |
||||
|
|
||||
|
if len(terms) == 0: |
||||
|
return "0" |
||||
|
else: |
||||
|
return " + ".join(terms) |
||||
@ -0,0 +1,228 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import hashlib |
||||
|
import collections |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
from .Random import secure_rand, secure_rand_int_between |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .CurveDB import CurveDB |
||||
|
from .ShortWeierstrassCurve import ShortWeierstrassCurve |
||||
|
from .ASN1 import parse_asn1_private_key, parse_asn1_field_params_fp |
||||
|
from . import Tools |
||||
|
from .CurveQuirks import CurveQuirkEdDSASetPrivateKeyMSB, CurveQuirkEdDSAEnsurePrimeOrderSubgroup, CurveQuirkSigningHashFunction |
||||
|
|
||||
|
class PrivKeyOpECDSASign(object): |
||||
|
ECDSASignature = collections.namedtuple("ECDSASignature", [ "hashalg", "r", "s" ]) |
||||
|
|
||||
|
def ecdsa_sign_hash(self, message_digest, k = None, digestname = None): |
||||
|
"""Signs a given messagedigest, given as bytes, using ECDSA. |
||||
|
Optionally a nonce k can be supplied which should usually be unqiuely |
||||
|
chosen for every ECDSA signature. This way it is possible to |
||||
|
deliberately create broken signatures which can be exploited later on. |
||||
|
If k is not supplied, it is randomly chosen. If a digestname is |
||||
|
supplied the name of this digest eventually ends up in the |
||||
|
ECDSASignature object.""" |
||||
|
assert(isinstance(message_digest, bytes)) |
||||
|
assert((k is None) or isinstance(k, int)) |
||||
|
|
||||
|
# Convert message digest to integer value |
||||
|
e = Tools.ecdsa_msgdigest_to_int(message_digest, self.curve.n) |
||||
|
|
||||
|
# Select a random integer (if None is supplied!) |
||||
|
if k is None: |
||||
|
k = secure_rand_int_between(1, self.curve.n - 1) |
||||
|
|
||||
|
# r = (k * G)_x mod n |
||||
|
Rmodp = k * self.curve.G |
||||
|
r = int(Rmodp.x) % self.curve.n |
||||
|
assert(r != 0) |
||||
|
|
||||
|
s = FieldElement(e + self.scalar * r, self.curve.n) // k |
||||
|
|
||||
|
return self.ECDSASignature(r = r, s = int(s), hashalg = digestname) |
||||
|
|
||||
|
def ecdsa_sign(self, message, digestname, k = None): |
||||
|
"""Signs a given message with the digest that is given as a string. |
||||
|
Optionally a nonce k can be supplied which should usually be unqiuely |
||||
|
chosen for every ECDSA signature. This way it is possible to |
||||
|
deliberately create broken signatures which can be exploited later |
||||
|
on. If k is not supplied, it is randomly chosen.""" |
||||
|
assert(isinstance(message, bytes)) |
||||
|
assert(isinstance(digestname, str)) |
||||
|
digest_fnc = hashlib.new(digestname) |
||||
|
digest_fnc.update(message) |
||||
|
message_digest = digest_fnc.digest() |
||||
|
return self.ecdsa_sign_hash(message_digest, k = k, digestname = digestname) |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpECIESDecrypt(object): |
||||
|
def ecies_decrypt(self, R): |
||||
|
"""Takes the transmitted point R and reconstructs the shared secret |
||||
|
point S using the private key.""" |
||||
|
# Transmitted R is given, restore the symmetric key S |
||||
|
return self._scalar * R |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpEDDSASign(object): |
||||
|
class EDDSASignature(object): |
||||
|
def __init__(self, curve, R, s): |
||||
|
self._curve = curve |
||||
|
self._R = R |
||||
|
self._s = s |
||||
|
|
||||
|
@property |
||||
|
def curve(self): |
||||
|
return self._curve |
||||
|
|
||||
|
@property |
||||
|
def R(self): |
||||
|
return self._R |
||||
|
|
||||
|
@property |
||||
|
def s(self): |
||||
|
return self._s |
||||
|
|
||||
|
def encode(self): |
||||
|
"""Performs serialization of the signature as used by EdDSA.""" |
||||
|
return self.R.eddsa_encode() + Tools.inttobytes_le(self.s, (self.curve.B + 7) // 8) |
||||
|
|
||||
|
@classmethod |
||||
|
def decode(cls, curve, encoded_signature): |
||||
|
"""Performs deserialization of the signature as used by EdDSA.""" |
||||
|
assert(isinstance(encoded_signature, bytes)) |
||||
|
coordlen = (curve.B + 7) // 8 |
||||
|
assert(len(encoded_signature) == 2 * coordlen) |
||||
|
encoded_R = encoded_signature[:coordlen] |
||||
|
encoded_s = encoded_signature[coordlen:] |
||||
|
R = AffineCurvePoint.eddsa_decode(curve, encoded_R) |
||||
|
s = Tools.bytestoint_le(encoded_s) |
||||
|
return cls(curve, R, s) |
||||
|
|
||||
|
def __eq__(self, other): |
||||
|
return (self.R, self.s) == (other.R, other.s) |
||||
|
|
||||
|
def __str__(self): |
||||
|
return "EDDSASignature<R = %s, s = %s>" % (self.R, self.s) |
||||
|
|
||||
|
def eddsa_sign(self, message): |
||||
|
"""Performs an EdDSA signature of the message. For this to work the |
||||
|
curve has to be a twisted Edwards curve and the private key scalar has |
||||
|
to be generated from a hashed seed. This hashed seed is automatically |
||||
|
generated when a keypair is generated using, for example, the |
||||
|
eddsa_generate() function instead of the regular key generation |
||||
|
function generate().""" |
||||
|
assert(self.curve.curvetype == "twistededwards") |
||||
|
if self._seed is None: |
||||
|
raise Exception("EdDSA requires a seed which is the source for calculation of the private key scalar.") |
||||
|
if not self.curve.has_quirk(CurveQuirkSigningHashFunction): |
||||
|
raise Exception("Unable to determine EdDSA signature function.") |
||||
|
|
||||
|
quirk = self.curve.get_quirk(CurveQuirkSigningHashFunction) |
||||
|
h = quirk.hashdata(self._seed) |
||||
|
|
||||
|
coordlen = (self.curve.B + 7) // 8 |
||||
|
r = Tools.bytestoint_le(quirk.hashdata(h[coordlen : 2 * coordlen] + message)) |
||||
|
R = r * self.curve.G |
||||
|
s = (r + Tools.bytestoint_le(quirk.hashdata(R.eddsa_encode() + self.pubkey.point.eddsa_encode() + message)) * self.scalar) % self.curve.n |
||||
|
sig = self.EDDSASignature(self.curve, R, s) |
||||
|
return sig |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpEDDSAKeyGen(object): |
||||
|
@classmethod |
||||
|
def eddsa_generate(cls, curve, seed = None): |
||||
|
"""Generates a randomly selected seed value. This seed value is then |
||||
|
hashed using the EdDSA hash function (SHA512 for Ed2556 and |
||||
|
Shake256-114 for Ed448) and the resulting value is (slightly modified) |
||||
|
used as the private key scalar. Since for EdDSA signing operations |
||||
|
this seed value is needed, it is also stored within the private key.""" |
||||
|
coordlen = (curve.B + 7) // 8 |
||||
|
if seed is None: |
||||
|
seed = secure_rand(coordlen) |
||||
|
assert(isinstance(seed, bytes)) |
||||
|
assert(len(seed) == coordlen) |
||||
|
|
||||
|
# Calculate hash over seed and generate scalar from hash over seed |
||||
|
if not curve.has_quirk(CurveQuirkSigningHashFunction): |
||||
|
raise Exception("Unable to determine EdDSA signature function.") |
||||
|
quirk = curve.get_quirk(CurveQuirkSigningHashFunction) |
||||
|
h = quirk.hashdata(seed) |
||||
|
a = int.from_bytes(h[:coordlen], byteorder = "little") & ((1 << (curve.B - 1)) - 1) |
||||
|
|
||||
|
# Do we need to mask out lower significant bits to ensure that we use a |
||||
|
# prime order subgroup? |
||||
|
if curve.has_quirk(CurveQuirkEdDSAEnsurePrimeOrderSubgroup): |
||||
|
if not Tools.is_power_of_two(curve.h): |
||||
|
raise Exception("Can only ensure prime order subgroup by masking 'a' when curve cofactor is a power of two, h = %d isn't." % (curve.h)) |
||||
|
a &= ~(curve.h - 1) |
||||
|
|
||||
|
# Is the MSB of the curve always set to ensure constant runtime of the |
||||
|
# Montgomery ladder? |
||||
|
if curve.has_quirk(CurveQuirkEdDSASetPrivateKeyMSB): |
||||
|
bit = curve.n.bit_length() + 1 |
||||
|
a |= (1 << bit) |
||||
|
privkey = cls(a, curve) |
||||
|
privkey.set_seed(seed) |
||||
|
return privkey |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpEDDSAEncode(object): |
||||
|
def eddsa_encode(self): |
||||
|
"""Performs serialization of a private key that is used for EdDSA.""" |
||||
|
return self.seed |
||||
|
|
||||
|
@classmethod |
||||
|
def eddsa_decode(cls, curve, encoded_privkey): |
||||
|
"""Performs decoding of a serialized private key as it is used for EdDSA.""" |
||||
|
return cls.eddsa_generate(curve, encoded_privkey) |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpECDH(object): |
||||
|
def ecdh_compute(self, peer_pubkey): |
||||
|
"""Compute the shared secret point using our own private key and the |
||||
|
public key of our peer.""" |
||||
|
return self.scalar * peer_pubkey.point |
||||
|
|
||||
|
|
||||
|
class PrivKeyOpLoad(object): |
||||
|
@classmethod |
||||
|
def load_derdata(cls, derdata): |
||||
|
"""Loads an EC private key from a DER-encoded ASN.1 bytes object.""" |
||||
|
asn1 = parse_asn1_private_key(derdata) |
||||
|
private_key_scalar = Tools.bytestoint(asn1["privateKey"]) |
||||
|
curve = CurveDB().get_curve_from_asn1(asn1["parameters"]) |
||||
|
return cls(private_key_scalar, curve) |
||||
|
|
||||
|
@classmethod |
||||
|
def load_pem(cls, pemfilename): |
||||
|
"""Loads an EC private key from a PEM-encoded 'EC PRIVATE KEY' file.""" |
||||
|
return cls.load_derdata(Tools.load_pem_data(pemfilename, "EC PRIVATE KEY")) |
||||
|
|
||||
|
@classmethod |
||||
|
def load_der(cls, derfilename): |
||||
|
"""Loads an EC private key from a DER-encoded ASN.1 file.""" |
||||
|
with open(derfilename, "rb") as f: |
||||
|
data = f.read() |
||||
|
return cls.load_derdata(data) |
||||
@ -0,0 +1,166 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import hashlib |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .Random import secure_rand_int_between |
||||
|
from . import Tools |
||||
|
from .PrivKeyOps import PrivKeyOpLoad |
||||
|
from .ASN1 import parse_asn1_public_key |
||||
|
from .CurveDB import CurveDB |
||||
|
from .CurveQuirks import CurveQuirkSigningHashFunction |
||||
|
|
||||
|
class PubKeyOpECDSAExploitReusedNonce(object): |
||||
|
def ecdsa_exploit_reused_nonce(self, msg1, sig1, msg2, sig2): |
||||
|
"""Given two different messages msg1 and msg2 and their corresponding |
||||
|
signatures sig1, sig2, try to calculate the private key that was used |
||||
|
for signing if during signature generation no unique nonces were |
||||
|
used.""" |
||||
|
assert(isinstance(msg1, bytes)) |
||||
|
assert(isinstance(msg2, bytes)) |
||||
|
assert(msg1 != msg2) |
||||
|
assert(sig1.r == sig2.r) |
||||
|
|
||||
|
# Hash the messages |
||||
|
dig1 = hashlib.new(sig1.hashalg) |
||||
|
dig1.update(msg1) |
||||
|
dig1 = dig1.digest() |
||||
|
dig2 = hashlib.new(sig2.hashalg) |
||||
|
dig2.update(msg2) |
||||
|
dig2 = dig2.digest() |
||||
|
|
||||
|
# Calculate hashes of messages |
||||
|
e1 = Tools.ecdsa_msgdigest_to_int(dig1, self.point.curve.n) |
||||
|
e2 = Tools.ecdsa_msgdigest_to_int(dig2, self.point.curve.n) |
||||
|
|
||||
|
# Take them modulo n |
||||
|
e1 = FieldElement(e1, self.point.curve.n) |
||||
|
e2 = FieldElement(e2, self.point.curve.n) |
||||
|
|
||||
|
(s1, s2) = (FieldElement(sig1.s, self.point.curve.n), FieldElement(sig2.s, self.point.curve.n)) |
||||
|
r = sig1.r |
||||
|
|
||||
|
# Recover (supposedly) random nonce |
||||
|
nonce = (e1 - e2) // (s1 - s2) |
||||
|
|
||||
|
# Recover private key |
||||
|
priv = ((nonce * s1) - e1) // r |
||||
|
|
||||
|
return { "nonce": nonce, "privatekey": priv } |
||||
|
|
||||
|
|
||||
|
class PubKeyOpECDSAVerify(object): |
||||
|
def ecdsa_verify_hash(self, message_digest, signature): |
||||
|
"""Verify ECDSA signature over the hash of a message (the message |
||||
|
digest).""" |
||||
|
assert(isinstance(message_digest, bytes)) |
||||
|
assert(0 < signature.r < self.curve.n) |
||||
|
assert(0 < signature.s < self.curve.n) |
||||
|
|
||||
|
# Convert message digest to integer value |
||||
|
e = Tools.ecdsa_msgdigest_to_int(message_digest, self.curve.n) |
||||
|
|
||||
|
(r, s) = (signature.r, FieldElement(signature.s, self.curve.n)) |
||||
|
w = s.inverse() |
||||
|
u1 = int(e * w) |
||||
|
u2 = int(r * w) |
||||
|
|
||||
|
pt = (u1 * self.curve.G) + (u2 * self.point) |
||||
|
x1 = int(pt.x) % self.curve.n |
||||
|
return x1 == r |
||||
|
|
||||
|
def ecdsa_verify(self, message, signature): |
||||
|
"""Verify an ECDSA signature over a message.""" |
||||
|
assert(isinstance(message, bytes)) |
||||
|
digest_fnc = hashlib.new(signature.hashalg) |
||||
|
digest_fnc.update(message) |
||||
|
message_digest = digest_fnc.digest() |
||||
|
return self.ecdsa_verify_hash(message_digest, signature) |
||||
|
|
||||
|
|
||||
|
class PubKeyOpEDDSAVerify(object): |
||||
|
def eddsa_verify(self, message, signature): |
||||
|
"""Verify an EdDSA signature over a message.""" |
||||
|
if not self.curve.has_quirk(CurveQuirkSigningHashFunction): |
||||
|
raise Exception("Unable to determine EdDSA signature function.") |
||||
|
quirk = self.curve.get_quirk(CurveQuirkSigningHashFunction) |
||||
|
h = Tools.bytestoint_le(quirk.hashdata(signature.R.eddsa_encode() + self.point.eddsa_encode() + message)) |
||||
|
return (signature.s * self.curve.G) == signature.R + (h * self.point) |
||||
|
|
||||
|
|
||||
|
class PubKeyOpEDDSAEncode(object): |
||||
|
def eddsa_encode(self): |
||||
|
"""Encodes a EdDSA-encoded public key to its serialized (bytes) |
||||
|
form.""" |
||||
|
return self.point.eddsa_encode() |
||||
|
|
||||
|
@classmethod |
||||
|
def eddsa_decode(cls, curve, encoded_pubkey): |
||||
|
"""Decodes a EdDSA-encoded public key from its serialized (bytes) |
||||
|
form.""" |
||||
|
pubkey = AffineCurvePoint.eddsa_decode(curve, encoded_pubkey) |
||||
|
return cls(pubkey) |
||||
|
|
||||
|
class PubKeyOpECIESEncrypt(object): |
||||
|
def ecies_encrypt(self, r = None): |
||||
|
"""Generates a shared secret which can be used to symetrically encrypt |
||||
|
data that only the holder of the corresponding private key can read. |
||||
|
The output are two points, R and S: R is the public point that is |
||||
|
transmitted together with the message while S is the point which |
||||
|
resembles the shared secret. The receiver can use R together with her |
||||
|
private key to reconstruct S. A random nonce r can be supplied for this |
||||
|
function. If it isn't supplied, it is randomly chosen.""" |
||||
|
|
||||
|
# Chose a random number |
||||
|
if r is None: |
||||
|
r = secure_rand_int_between(1, self.curve.n - 1) |
||||
|
|
||||
|
R = r * self.curve.G |
||||
|
S = r * self.point |
||||
|
|
||||
|
# Return the publicly transmitted R and the symmetric key S |
||||
|
return { "R": R, "S": S } |
||||
|
|
||||
|
|
||||
|
class PubKeyOpLoad(object): |
||||
|
@classmethod |
||||
|
def load_derdata(cls, derdata): |
||||
|
"""Loads an EC public key from a DER-encoded ASN.1 bytes object.""" |
||||
|
asn1 = parse_asn1_public_key(derdata) |
||||
|
curve = CurveDB().get_curve_from_asn1(asn1["algorithm"]["parameters"]) |
||||
|
point = AffineCurvePoint.deserialize_uncompressed(Tools.bits_to_bytes(asn1["subjectPublicKey"]), curve) |
||||
|
return cls(point) |
||||
|
|
||||
|
@classmethod |
||||
|
def load_pem(cls, pemfilename): |
||||
|
"""Loads an EC public key from a PEM-encoded 'PUBLIC KEY' file.""" |
||||
|
return cls.load_derdata(Tools.load_pem_data(pemfilename, "PUBLIC KEY")) |
||||
|
|
||||
|
@classmethod |
||||
|
def load_der(cls, derfilename): |
||||
|
"""Loads an EC public key from a DER-encoded ASN.1 file.""" |
||||
|
with open(derfilename, "rb") as f: |
||||
|
data = f.read() |
||||
|
return cls.load_derdata(data) |
||||
@ -0,0 +1,48 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
def secure_rand(length): |
||||
|
import os |
||||
|
"""Returns a secure random bytes() object of the length 'length' bytes.""" |
||||
|
data = os.urandom(length) |
||||
|
assert(len(data) == length) |
||||
|
return data |
||||
|
|
||||
|
|
||||
|
def secure_rand_int(max_value): |
||||
|
"""Yields a value 0 <= return < maxvalue.""" |
||||
|
assert(max_value >= 2) |
||||
|
bytecnt = ((max_value - 1).bit_length() + 7) // 8 |
||||
|
max_bin_value = 256 ** bytecnt |
||||
|
wholecnt = max_bin_value // max_value |
||||
|
cutoff = wholecnt * max_value |
||||
|
while True: |
||||
|
rnd = sum((value << (8 * bytepos)) for (bytepos, value) in enumerate(secure_rand(bytecnt))) |
||||
|
if rnd < cutoff: |
||||
|
break |
||||
|
return rnd % max_value |
||||
|
|
||||
|
def secure_rand_int_between(min_value, max_value): |
||||
|
"""Yields a random number which goes from min_value (inclusive) to |
||||
|
max_value (inclusive).""" |
||||
|
return secure_rand_int(max_value - min_value + 1) + min_value |
||||
@ -0,0 +1,203 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2016 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import collections |
||||
|
from .FieldElement import FieldElement |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .EllipticCurve import EllipticCurve |
||||
|
from .DocInherit import doc_inherit |
||||
|
from .CurveOps import CurveOpIsomorphism, CurveOpExportSage |
||||
|
|
||||
|
_ShortWeierstrassCurveDomainParameters = collections.namedtuple("ShortWeierstrassCurveDomainParameters", [ "curvetype", "a", "b", "p", "n", "h", "G" ]) |
||||
|
|
||||
|
class ShortWeierstrassCurve(EllipticCurve, CurveOpIsomorphism, CurveOpExportSage): |
||||
|
"""Represents an elliptic curve over a finite field F_P that satisfies the |
||||
|
short Weierstrass equation y^2 = x^3 + ax + b.""" |
||||
|
pretty_name = "Short Weierstrass" |
||||
|
|
||||
|
def __init__(self, a, b, p, n, h, Gx, Gy, **kwargs): |
||||
|
"""Create an elliptic curve given the equation coefficients a and b, |
||||
|
the curve modulus p, the order of the curve n, the cofactor of the |
||||
|
curve h and the generator point G's X and Y coordinates in affine |
||||
|
representation, Gx and Gy.""" |
||||
|
EllipticCurve.__init__(self, p, n, h, Gx, Gy, **kwargs) |
||||
|
assert(isinstance(a, int)) # Curve coefficent A |
||||
|
assert(isinstance(b, int)) # Curve coefficent B |
||||
|
self._a = FieldElement(a, p) |
||||
|
self._b = FieldElement(b, p) |
||||
|
self._name = kwargs.get("name") |
||||
|
|
||||
|
# Check that the curve is not singular |
||||
|
assert((4 * (self.a ** 3)) + (27 * (self.b ** 2)) != 0) |
||||
|
|
||||
|
if self._G is not None: |
||||
|
# Check that the generator G is on the curve |
||||
|
assert(self._G.oncurve()) |
||||
|
|
||||
|
if self.n is not None: |
||||
|
# Check that the generator G is of curve order if a order was |
||||
|
# passed as well |
||||
|
assert((self.n * self.G).is_neutral) |
||||
|
|
||||
|
@classmethod |
||||
|
def init_rawcurve(cls, a, b, p): |
||||
|
"""Returns a raw curve which has an undiscovered amount of points |
||||
|
#E(F_p) (i.e. the domain parameters n and h are not set). This function |
||||
|
can be used to create a curve which is later completed by counting |
||||
|
#E(F_p) using Schoof's algorithm.""" |
||||
|
return cls(a = a, b = b, p = p, n = None, h = None, Gx = None, Gy = None) |
||||
|
|
||||
|
@property |
||||
|
def is_anomalous(self): |
||||
|
"""Returns if the curve is anomalous, i.e. if #F(p) == p. If this is |
||||
|
the case then there is an efficient method to solve the ECDLP. |
||||
|
Therefore the curve is not suitable for cryptographic use.""" |
||||
|
return self.jinv in [ 0, 1728 ] |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def domainparams(self): |
||||
|
return _ShortWeierstrassCurveDomainParameters(curvetype = self.curvetype, a = self.a, b = self.b, p = self.p, n = self.n, h = self.h, G = self.G) |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def curvetype(self): |
||||
|
return "shortweierstrass" |
||||
|
|
||||
|
@property |
||||
|
def is_koblitz(self): |
||||
|
"""Returns whether the curve allows for efficient computation of a map |
||||
|
\phi in the field (i.e. that the curve is commonly known as a 'Koblitz |
||||
|
Curve'). This corresponds to examples 3 and 4 of the paper "Faster |
||||
|
Point Multiplication on Elliptic Curves with Efficient Endomorphisms" |
||||
|
by Gallant, Lambert and Vanstone.""" |
||||
|
return ((self.b == 0) and ((self.p % 4) == 1)) or ((self.a == 0) and ((self.p % 3) == 1)) |
||||
|
|
||||
|
@property |
||||
|
def security_bit_estimate(self): |
||||
|
"""Returns the bit security estimate of the curve. Subtracts four bits |
||||
|
security margin for Koblitz curves.""" |
||||
|
security_bits = self.n.bit_length() // 2 |
||||
|
if self.is_koblitz: |
||||
|
security_bits -= 4 |
||||
|
return security_bits |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def prettyname(self): |
||||
|
name = [ ] |
||||
|
name.append(self.pretty_name) |
||||
|
if self.is_koblitz: |
||||
|
name.append("(Koblitz)") |
||||
|
return " ".join(name) |
||||
|
|
||||
|
@property |
||||
|
def a(self): |
||||
|
"""Returns the coefficient a of the curve equation y^2 = x^3 + ax + b.""" |
||||
|
return self._a |
||||
|
|
||||
|
@property |
||||
|
def b(self): |
||||
|
"""Returns the coefficient b of the curve equation y^2 = x^3 + ax + b.""" |
||||
|
return self._b |
||||
|
|
||||
|
@property |
||||
|
def jinv(self): |
||||
|
"""Returns the j-invariant of the curve, i.e. 1728 * 4 * a^3 / (4 * a^3 |
||||
|
+ 27 * b^2).""" |
||||
|
return 1728 * (4 * self.a ** 3) // ((4 * self.a ** 3) + (27 * self.b ** 2)) |
||||
|
|
||||
|
def getpointwithx(self, x): |
||||
|
"""Returns a tuple of two points which fulfill the curve equation or |
||||
|
None if not such points exist.""" |
||||
|
assert(isinstance(x, int)) |
||||
|
yy = ((FieldElement(x, self._p) ** 3) + (self._a * x) + self._b) |
||||
|
y = yy.sqrt() |
||||
|
if y: |
||||
|
return (AffineCurvePoint(x, int(y[0]), self), AffineCurvePoint(x, int(y[1]), self)) |
||||
|
else: |
||||
|
return None |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def oncurve(self, P): |
||||
|
return P.is_neutral or ((P.y ** 2) == (P.x ** 3) + (self.a * P.x) + self.b) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_conjugate(self, P): |
||||
|
return AffineCurvePoint(int(P.x), int(-P.y), self) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_addition(self, P, Q): |
||||
|
if P.is_neutral: |
||||
|
# P is at infinity, O + Q = Q |
||||
|
result = Q |
||||
|
elif Q.is_neutral: |
||||
|
# Q is at infinity, P + O = P |
||||
|
result = P |
||||
|
elif P == -Q: |
||||
|
# P == -Q, return O (point at infinity) |
||||
|
result = self.neutral() |
||||
|
elif P == Q: |
||||
|
# P == Q, point doubling |
||||
|
s = ((3 * P.x ** 2) + self.a) // (2 * P.y) |
||||
|
newx = s * s - (2 * P.x) |
||||
|
newy = s * (P.x - newx) - P.y |
||||
|
result = AffineCurvePoint(int(newx), int(newy), self) |
||||
|
else: |
||||
|
# P != Q, point addition |
||||
|
s = (P.y - Q.y) // (P.x - Q.x) |
||||
|
newx = (s ** 2) - P.x - Q.x |
||||
|
newy = s * (P.x - newx) - P.y |
||||
|
result = AffineCurvePoint(int(newx), int(newy), self) |
||||
|
return result |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def compress(self, P): |
||||
|
return (int(P.x), int(P.y) % 2) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def uncompress(self, compressed): |
||||
|
(x, ybit) = compressed |
||||
|
x = FieldElement(x, self.p) |
||||
|
alpha = (x ** 3) + (self.a * x) + self.b |
||||
|
(beta1, beta2) = alpha.sqrt() |
||||
|
if (int(beta1) % 2) == ybit: |
||||
|
y = beta1 |
||||
|
else: |
||||
|
y = beta2 |
||||
|
return AffineCurvePoint(int(x), int(y), self) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def enumerate_points(self): |
||||
|
yield self.neutral() |
||||
|
for x in range(self.p): |
||||
|
points = self.getpointwithx(x) |
||||
|
if points is not None: |
||||
|
yield points[0] |
||||
|
yield points[1] |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self.hasname: |
||||
|
return "ShortWeierstrassCurve<%s>" % (self.name) |
||||
|
else: |
||||
|
return "ShortWeierstrassCurve<y^2 = x^3 + 0x%x x + 0x%x mod 0x%x>" % (int(self.a), int(self.b), int(self.p)) |
||||
@ -0,0 +1,69 @@ |
|||||
|
#!/usr/bin/python3 |
||||
|
# |
||||
|
# Singleton - Singleton decorator, taken from PEP318 |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of jpycommon. |
||||
|
# |
||||
|
# jpycommon is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# jpycommon is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with jpycommon; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
# File UUID a24a2230-7bd4-4737-98ab-8aae62d1bd57 |
||||
|
|
||||
|
def singleton(cls): |
||||
|
class InnerClass(cls): |
||||
|
_instance = None |
||||
|
|
||||
|
def __new__(cls, *args, **kwargs): |
||||
|
if InnerClass._instance is None: |
||||
|
InnerClass._instance = super(InnerClass, cls).__new__(cls, *args, **kwargs) |
||||
|
InnerClass._instance._initialized = False |
||||
|
return InnerClass._instance |
||||
|
|
||||
|
def __init__(self, *args, **kwargs): |
||||
|
if self._initialized: |
||||
|
return |
||||
|
super(InnerClass, self).__init__(*args, **kwargs) |
||||
|
self._initialized = True |
||||
|
|
||||
|
InnerClass.__name__ = cls.__name__ |
||||
|
return InnerClass |
||||
|
|
||||
|
|
||||
|
if __name__ == "__main__": |
||||
|
print("start") |
||||
|
|
||||
|
@singleton |
||||
|
class FooSingleton(): |
||||
|
_barkoo = -1 |
||||
|
|
||||
|
def __init__(self): |
||||
|
print("init called") |
||||
|
|
||||
|
def getid(self): |
||||
|
return id(self) * FooSingleton._barkoo |
||||
|
|
||||
|
print("pre init") |
||||
|
x = FooSingleton() |
||||
|
print(x, x.getid()) |
||||
|
|
||||
|
y = FooSingleton() |
||||
|
print(y, y.getid()) |
||||
|
|
||||
|
z = FooSingleton() |
||||
|
print(z, z.getid()) |
||||
|
|
||||
|
assert(x is y) |
||||
@ -0,0 +1,98 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import hashlib |
||||
|
import base64 |
||||
|
import inspect |
||||
|
|
||||
|
def bytestoint_le(data): |
||||
|
"""Converts given bytes to a little-endian integer value.""" |
||||
|
return sum(value << (8 * index) for (index, value) in enumerate(data)) |
||||
|
|
||||
|
def inttobytes_le(value, length): |
||||
|
"""Converts a little-endian integer value into a bytes object.""" |
||||
|
return bytes((value >> (8 * i)) & 0xff for i in range(length)) |
||||
|
|
||||
|
def bytestoint(data): |
||||
|
"""Converts given bytes to a big-endian integer value.""" |
||||
|
return bytestoint_le(reversed(data)) |
||||
|
|
||||
|
def inttobytes(value, length): |
||||
|
"""Converts a big-endian integer value into a bytes object.""" |
||||
|
return bytes((value >> (8 * i)) & 0xff for i in reversed(range(length))) |
||||
|
|
||||
|
def bits_to_bytes(bitarray): |
||||
|
"""Converts a tuple of bits (e.g. a ASN.1 BitString) to a bytes object. |
||||
|
Only works when number of bits is a multiple of 8.""" |
||||
|
|
||||
|
def bit_word_to_value(word): |
||||
|
assert(len(word) == 8) |
||||
|
return sum(value << i for (i, value) in enumerate(reversed(word))) |
||||
|
|
||||
|
assert((len(bitarray) % 8) == 0) |
||||
|
return bytes(bit_word_to_value(bitarray[i : i + 8]) for i in range(0, len(bitarray), 8)) |
||||
|
|
||||
|
def ecdsa_msgdigest_to_int(message_digest, curveorder): |
||||
|
"""Performs truncation of a message digest to the bitlength of the curve |
||||
|
order.""" |
||||
|
# Convert message digest to integer value |
||||
|
e = bytestoint(message_digest) |
||||
|
|
||||
|
# Truncate hash value if necessary |
||||
|
msg_digest_bits = 8 * len(message_digest) |
||||
|
if msg_digest_bits > curveorder.bit_length(): |
||||
|
shift = msg_digest_bits - curveorder.bit_length() |
||||
|
e >>= shift |
||||
|
|
||||
|
return e |
||||
|
|
||||
|
def load_pem_data(filename, specifier): |
||||
|
"""Loads the PEM payload, designated with a BEGIN and END specifier, from a |
||||
|
file given by its filename.""" |
||||
|
data = None |
||||
|
with open(filename, "r") as f: |
||||
|
spec_begin = "-----BEGIN " + specifier + "-----" |
||||
|
spec_end = "-----END " + specifier + "-----" |
||||
|
for line in f: |
||||
|
line = line.rstrip() |
||||
|
if (data is None) and (line == spec_begin): |
||||
|
data = [ ] |
||||
|
elif (data is not None) and (line == spec_end): |
||||
|
break |
||||
|
elif data is not None: |
||||
|
data.append(line) |
||||
|
if data is None: |
||||
|
raise Exception("Trying to parse PEM file with specifier '%s', but no such block in file found." % (specifier)) |
||||
|
data = base64.b64decode("".join(data).encode("utf-8")) |
||||
|
return data |
||||
|
|
||||
|
def is_power_of_two(value): |
||||
|
"""Returns True if the given value is a positive power of two, False |
||||
|
otherwise.""" |
||||
|
while value > 0: |
||||
|
if value == 1: |
||||
|
return True |
||||
|
elif (value & 1) == 1: |
||||
|
return False |
||||
|
value >>= 1 |
||||
|
return False |
||||
@ -0,0 +1,171 @@ |
|||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
import collections |
||||
|
from .FieldElement import FieldElement |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .EllipticCurve import EllipticCurve |
||||
|
from .DocInherit import doc_inherit |
||||
|
import toyecc.MontgomeryCurve |
||||
|
|
||||
|
_TwistedEdwardsCurveDomainParameters = collections.namedtuple("TwistedEdwardsCurveDomainParameters", [ "curvetype", "a", "d", "p", "n", "G" ]) |
||||
|
|
||||
|
class TwistedEdwardsCurve(EllipticCurve): |
||||
|
"""Represents an elliptic curve over a finite field F_P that satisfies the |
||||
|
Twisted Edwards equation a x^2 + y^2 = 1 + d x^2 y^2.""" |
||||
|
pretty_name = "Twisted Edwards" |
||||
|
|
||||
|
def __init__(self, a, d, p, n, h, Gx, Gy, **kwargs): |
||||
|
"""Create an elliptic Twisted Edwards curve given the equation |
||||
|
coefficients a and d, the curve field's modulus p, the order of the |
||||
|
curve n and the generator point G's X and Y coordinates in affine |
||||
|
representation, Gx and Gy.""" |
||||
|
EllipticCurve.__init__(self, p, n, h, Gx, Gy, **kwargs) |
||||
|
assert(isinstance(a, int)) # Curve coefficent A |
||||
|
assert(isinstance(d, int)) # Curve coefficent D |
||||
|
self._a = FieldElement(a, p) |
||||
|
self._d = FieldElement(d, p) |
||||
|
self._name = kwargs.get("name") |
||||
|
|
||||
|
# Check that the curve is not singular |
||||
|
assert(self.d * (1 - self.d) != 0) |
||||
|
|
||||
|
if self._G is not None: |
||||
|
# Check that the generator G is on the curve |
||||
|
assert(self._G.oncurve()) |
||||
|
|
||||
|
# Check that the generator G is of curve order |
||||
|
assert((self.n * self.G).is_neutral) |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def domainparams(self): |
||||
|
return _TwistedEdwardsCurveDomainParameters(curvetype = self.curvetype, a = self.a, d = self.d, p = self.p, n = self.n, G = self.G) |
||||
|
|
||||
|
@property |
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def curvetype(self): |
||||
|
return "twistededwards" |
||||
|
|
||||
|
@property |
||||
|
def a(self): |
||||
|
"""Returns the coefficient a of the curve equation a x^2 + y^2 = 1 + |
||||
|
d x^2 y^2.""" |
||||
|
return self._a |
||||
|
|
||||
|
@property |
||||
|
def d(self): |
||||
|
"""Returns the coefficient d of the curve equation a x^2 + y^2 = 1 + |
||||
|
d x^2 y^2.""" |
||||
|
return self._d |
||||
|
|
||||
|
@property |
||||
|
def B(self): |
||||
|
"""Returns the length of the curve's field modulus in bits plus one.""" |
||||
|
return self._p.bit_length() + 1 |
||||
|
|
||||
|
@property |
||||
|
def is_complete(self): |
||||
|
"""Returns if the twisted Edwards curve is complete. This is the case |
||||
|
exactly when d is a quadratic non-residue modulo p.""" |
||||
|
return self.d.is_qnr |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def neutral(self): |
||||
|
return AffineCurvePoint(0, 1, self) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def is_neutral(self, P): |
||||
|
return (P.x == 0) and (P.y == 1) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def oncurve(self, P): |
||||
|
return (self.a * P.x ** 2) + P.y ** 2 == 1 + self.d * P.x ** 2 * P.y ** 2 |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_conjugate(self, P): |
||||
|
return AffineCurvePoint(int(-P.x), int(P.y), self) |
||||
|
|
||||
|
@doc_inherit(EllipticCurve) |
||||
|
def point_addition(self, P, Q): |
||||
|
x = (P.x * Q.y + Q.x * P.y) // (1 + self.d * P.x * Q.x * P.y * Q.y) |
||||
|
y = (P.y * Q.y - self.a * P.x * Q.x) // (1 - self.d * P.x * Q.x * P.y * Q.y) |
||||
|
return AffineCurvePoint(int(x), int(y), self) |
||||
|
|
||||
|
def to_montgomery(self, b = None): |
||||
|
"""Converts the twisted Edwards curve domain parameters to Montgomery |
||||
|
domain parameters. For this conversion, b can be chosen semi-freely. |
||||
|
If the native b coefficient is a quadratic residue modulo p, then the |
||||
|
freely chosen b value must also be. If it is a quadratic non-residue, |
||||
|
then so must be the surrogate b coefficient. If b is omitted, the |
||||
|
native b value is used. The generator point of the twisted Edwards |
||||
|
curve is also converted to Montgomery form. For this conversion, |
||||
|
there's an invariant (one of two possible outcomes). An arbitrary |
||||
|
bijection is used for this.""" |
||||
|
assert((b is None) or isinstance(b, int)) |
||||
|
|
||||
|
# Calculate the native montgomery coefficents a, b first |
||||
|
a = 2 * (self.a + self.d) // (self.a - self.d) |
||||
|
native_b = 4 // (self.a - self.d) |
||||
|
if b is None: |
||||
|
b = native_b |
||||
|
else: |
||||
|
# If a b value was supplied, make sure is is either a QR or QNR mod |
||||
|
# p, depending on what the native b value was |
||||
|
b = FieldElement(b, self.p) |
||||
|
if native_b.is_qr != b.is_qr: |
||||
|
raise Exception("The b coefficient of the resulting curve must be a quadratic %s modulo p, %s is not." % ([ "non-residue", "residue" ][native_b.is_qr], str(b))) |
||||
|
|
||||
|
# Generate the raw curve without a generator yet |
||||
|
raw_curve = toyecc.MontgomeryCurve.MontgomeryCurve( |
||||
|
a = int(a), |
||||
|
b = int(b), |
||||
|
p = self.p, |
||||
|
n = self.n, |
||||
|
h = self.h, |
||||
|
Gx = None, |
||||
|
Gy = None, |
||||
|
) |
||||
|
|
||||
|
# Then convert the original generator point using the raw curve to |
||||
|
# yield a birationally equivalent generator point |
||||
|
G_m = self.G.convert(raw_curve) |
||||
|
|
||||
|
# And create the curve again, setting this generator |
||||
|
montgomery_curve = toyecc.MontgomeryCurve.MontgomeryCurve( |
||||
|
a = int(a), |
||||
|
b = int(b), |
||||
|
p = self.p, |
||||
|
n = self.n, |
||||
|
h = self.h, |
||||
|
Gx = int(G_m.x), |
||||
|
Gy = int(G_m.y), |
||||
|
) |
||||
|
|
||||
|
return montgomery_curve |
||||
|
|
||||
|
def __str__(self): |
||||
|
if self.hasname: |
||||
|
return "TwistedEdwardsCurve<%s>" % (self.name) |
||||
|
else: |
||||
|
return "TwistedEdwardsCurve<0x%x x^2 + y^2 = 1 + 0x%x x^2 y^2 mod 0x%x>" % (int(self.a), int(self.d), int(self.p)) |
||||
@ -0,0 +1,95 @@ |
|||||
|
"""toyecc - Elliptic Curve Cryptography demonstration library |
||||
|
|
||||
|
toyecc is a library that is supposed to demonstrate and teach how Elliptic |
||||
|
Curve Cryptography (ECC) works. It is implemented in pure Python and neither |
||||
|
aims to be feature-complete not side-channel resistant nor secure in any way. |
||||
|
Please keep this in mind when using toyecc. Certain algorithms have been |
||||
|
deliberately implemented exactly without precautions against side-channel |
||||
|
attacks in order to cleanly demonstrate the concepts. |
||||
|
|
||||
|
There is a curve database included in toyecc which already knows lots of |
||||
|
interesting elliptic curves by name: |
||||
|
|
||||
|
import toyecc |
||||
|
curve = toyecc.getcurvebyname("secp112r1") |
||||
|
print(curve) |
||||
|
ShortWeierstrassCurve<secp112r1> |
||||
|
|
||||
|
On this curve you can now create a public/private keypair: |
||||
|
|
||||
|
privkey = toyecc.ECPrivateKey.generate(curve) |
||||
|
print(privkey) |
||||
|
PrivateKey<d = 0x89fb9821aa5154c9934b3e0268ef> |
||||
|
print(privkey.pubkey) |
||||
|
PublicKey<(0x69976db41f5e487928463b9f8a38, 0xda1fdba3de89c58683bd2d635430)> |
||||
|
|
||||
|
You can also regenerate this keypair later on if you wish to remain it static |
||||
|
and not change with every invocation: |
||||
|
|
||||
|
privkey = toyecc.ECPrivateKey(0x89fb9821aa5154c9934b3e0268ef, curve) |
||||
|
print(privkey) |
||||
|
PrivateKey<d = 0x89fb9821aa5154c9934b3e0268ef> |
||||
|
|
||||
|
You can use this keypair to perform actions like ECDSA signing: |
||||
|
|
||||
|
signature = privkey.ecdsa_sign(b"Foobar", "sha1") |
||||
|
print(signature) |
||||
|
ECDSASignature(hashalg='sha1', r=1762251013383878369191057972852867, s=3691758261134002001156831324480002) |
||||
|
|
||||
|
If you want to recreate a public key anew, you can also do so by first creating |
||||
|
the public point: |
||||
|
|
||||
|
pubkeypt = toyecc.AffineCurvePoint(0x69976db41f5e487928463b9f8a38, 0xda1fdba3de89c58683bd2d635430, curve) |
||||
|
print(pubkeypt) |
||||
|
(0x69976db41f5e487928463b9f8a38, 0xda1fdba3de89c58683bd2d635430) |
||||
|
|
||||
|
Then you can just wrap the point in a ECPublicKey object to have access to |
||||
|
methods like ECDSA verification and such: |
||||
|
|
||||
|
pubkey = toyecc.ECPublicKey(pubkeypt) |
||||
|
print(pubkey) |
||||
|
PublicKey<(0x69976db41f5e487928463b9f8a38, 0xda1fdba3de89c58683bd2d635430)> |
||||
|
|
||||
|
Lastly, you can verify the signature you created earlier: |
||||
|
|
||||
|
pubkey.ecdsa_verify(b"Foobar", signature) |
||||
|
True |
||||
|
|
||||
|
And change the message so the signature would become invalid: |
||||
|
|
||||
|
pubkey.ecdsa_verify(b"Barfoo", signature) |
||||
|
False |
||||
|
""" |
||||
|
|
||||
|
# |
||||
|
# toyecc - A small Elliptic Curve Cryptography Demonstration. |
||||
|
# Copyright (C) 2011-2022 Johannes Bauer |
||||
|
# |
||||
|
# This file is part of toyecc. |
||||
|
# |
||||
|
# toyecc is free software; you can redistribute it and/or modify |
||||
|
# it under the terms of the GNU General Public License as published by |
||||
|
# the Free Software Foundation; this program is ONLY licensed under |
||||
|
# version 3 of the License, later versions are explicitly excluded. |
||||
|
# |
||||
|
# toyecc is distributed in the hope that it will be useful, |
||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
|
# GNU General Public License for more details. |
||||
|
# |
||||
|
# You should have received a copy of the GNU General Public License |
||||
|
# along with toyecc; if not, write to the Free Software |
||||
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||||
|
# |
||||
|
# Johannes Bauer <JohannesBauer@gmx.de> |
||||
|
# |
||||
|
|
||||
|
from .FieldElement import FieldElement |
||||
|
from .AffineCurvePoint import AffineCurvePoint |
||||
|
from .CurveDB import getcurvedb, getcurveentry, getcurvebyname, getcurvenames |
||||
|
from .ECPrivateKey import ECPrivateKey |
||||
|
from .ECPublicKey import ECPublicKey |
||||
|
from .ShortWeierstrassCurve import ShortWeierstrassCurve |
||||
|
from .CRT import CRT |
||||
|
|
||||
|
VERSION = "0.0.9rc0" |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue