2e7786ec56fa0b4e9db306b0d793185e682f9395c779c9ea76940c8efd0fdf076ef6b09b668e7f7d3b9fb896910f320809b6bc40be11cd952a7b470754fc4a 9.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381
  1. 'use strict';
  2. var BN = require('bn.js');
  3. var utils = require('../utils');
  4. var getNAF = utils.getNAF;
  5. var getJSF = utils.getJSF;
  6. var assert = utils.assert;
  7. function BaseCurve(type, conf) {
  8. this.type = type;
  9. this.p = new BN(conf.p, 16);
  10. // Use Montgomery, when there is no fast reduction for the prime
  11. this.red = conf.prime ? BN.red(conf.prime) : BN.mont(this.p);
  12. // Useful for many curves
  13. this.zero = new BN(0).toRed(this.red);
  14. this.one = new BN(1).toRed(this.red);
  15. this.two = new BN(2).toRed(this.red);
  16. // Curve configuration, optional
  17. this.n = conf.n && new BN(conf.n, 16);
  18. this.g = conf.g && this.pointFromJSON(conf.g, conf.gRed);
  19. // Temporary arrays
  20. this._wnafT1 = new Array(4);
  21. this._wnafT2 = new Array(4);
  22. this._wnafT3 = new Array(4);
  23. this._wnafT4 = new Array(4);
  24. this._bitLength = this.n ? this.n.bitLength() : 0;
  25. // Generalized Greg Maxwell's trick
  26. var adjustCount = this.n && this.p.div(this.n);
  27. if (!adjustCount || adjustCount.cmpn(100) > 0) {
  28. this.redN = null;
  29. } else {
  30. this._maxwellTrick = true;
  31. this.redN = this.n.toRed(this.red);
  32. }
  33. }
  34. module.exports = BaseCurve;
  35. BaseCurve.prototype.point = function point() {
  36. throw new Error('Not implemented');
  37. };
  38. BaseCurve.prototype.validate = function validate() {
  39. throw new Error('Not implemented');
  40. };
  41. BaseCurve.prototype._fixedNafMul = function _fixedNafMul(p, k) {
  42. assert(p.precomputed);
  43. var doubles = p._getDoubles();
  44. var naf = getNAF(k, 1, this._bitLength);
  45. var I = (1 << (doubles.step + 1)) - (doubles.step % 2 === 0 ? 2 : 1);
  46. I /= 3;
  47. // Translate into more windowed form
  48. var repr = [];
  49. var j;
  50. var nafW;
  51. for (j = 0; j < naf.length; j += doubles.step) {
  52. nafW = 0;
  53. for (var l = j + doubles.step - 1; l >= j; l--)
  54. nafW = (nafW << 1) + naf[l];
  55. repr.push(nafW);
  56. }
  57. var a = this.jpoint(null, null, null);
  58. var b = this.jpoint(null, null, null);
  59. for (var i = I; i > 0; i--) {
  60. for (j = 0; j < repr.length; j++) {
  61. nafW = repr[j];
  62. if (nafW === i)
  63. b = b.mixedAdd(doubles.points[j]);
  64. else if (nafW === -i)
  65. b = b.mixedAdd(doubles.points[j].neg());
  66. }
  67. a = a.add(b);
  68. }
  69. return a.toP();
  70. };
  71. BaseCurve.prototype._wnafMul = function _wnafMul(p, k) {
  72. var w = 4;
  73. // Precompute window
  74. var nafPoints = p._getNAFPoints(w);
  75. w = nafPoints.wnd;
  76. var wnd = nafPoints.points;
  77. // Get NAF form
  78. var naf = getNAF(k, w, this._bitLength);
  79. // Add `this`*(N+1) for every w-NAF index
  80. var acc = this.jpoint(null, null, null);
  81. for (var i = naf.length - 1; i >= 0; i--) {
  82. // Count zeroes
  83. for (var l = 0; i >= 0 && naf[i] === 0; i--)
  84. l++;
  85. if (i >= 0)
  86. l++;
  87. acc = acc.dblp(l);
  88. if (i < 0)
  89. break;
  90. var z = naf[i];
  91. assert(z !== 0);
  92. if (p.type === 'affine') {
  93. // J +- P
  94. if (z > 0)
  95. acc = acc.mixedAdd(wnd[(z - 1) >> 1]);
  96. else
  97. acc = acc.mixedAdd(wnd[(-z - 1) >> 1].neg());
  98. } else {
  99. // J +- J
  100. if (z > 0)
  101. acc = acc.add(wnd[(z - 1) >> 1]);
  102. else
  103. acc = acc.add(wnd[(-z - 1) >> 1].neg());
  104. }
  105. }
  106. return p.type === 'affine' ? acc.toP() : acc;
  107. };
  108. BaseCurve.prototype._wnafMulAdd = function _wnafMulAdd(defW,
  109. points,
  110. coeffs,
  111. len,
  112. jacobianResult) {
  113. var wndWidth = this._wnafT1;
  114. var wnd = this._wnafT2;
  115. var naf = this._wnafT3;
  116. // Fill all arrays
  117. var max = 0;
  118. var i;
  119. var j;
  120. var p;
  121. for (i = 0; i < len; i++) {
  122. p = points[i];
  123. var nafPoints = p._getNAFPoints(defW);
  124. wndWidth[i] = nafPoints.wnd;
  125. wnd[i] = nafPoints.points;
  126. }
  127. // Comb small window NAFs
  128. for (i = len - 1; i >= 1; i -= 2) {
  129. var a = i - 1;
  130. var b = i;
  131. if (wndWidth[a] !== 1 || wndWidth[b] !== 1) {
  132. naf[a] = getNAF(coeffs[a], wndWidth[a], this._bitLength);
  133. naf[b] = getNAF(coeffs[b], wndWidth[b], this._bitLength);
  134. max = Math.max(naf[a].length, max);
  135. max = Math.max(naf[b].length, max);
  136. continue;
  137. }
  138. var comb = [
  139. points[a], /* 1 */
  140. null, /* 3 */
  141. null, /* 5 */
  142. points[b], /* 7 */
  143. ];
  144. // Try to avoid Projective points, if possible
  145. if (points[a].y.cmp(points[b].y) === 0) {
  146. comb[1] = points[a].add(points[b]);
  147. comb[2] = points[a].toJ().mixedAdd(points[b].neg());
  148. } else if (points[a].y.cmp(points[b].y.redNeg()) === 0) {
  149. comb[1] = points[a].toJ().mixedAdd(points[b]);
  150. comb[2] = points[a].add(points[b].neg());
  151. } else {
  152. comb[1] = points[a].toJ().mixedAdd(points[b]);
  153. comb[2] = points[a].toJ().mixedAdd(points[b].neg());
  154. }
  155. var index = [
  156. -3, /* -1 -1 */
  157. -1, /* -1 0 */
  158. -5, /* -1 1 */
  159. -7, /* 0 -1 */
  160. 0, /* 0 0 */
  161. 7, /* 0 1 */
  162. 5, /* 1 -1 */
  163. 1, /* 1 0 */
  164. 3, /* 1 1 */
  165. ];
  166. var jsf = getJSF(coeffs[a], coeffs[b]);
  167. max = Math.max(jsf[0].length, max);
  168. naf[a] = new Array(max);
  169. naf[b] = new Array(max);
  170. for (j = 0; j < max; j++) {
  171. var ja = jsf[0][j] | 0;
  172. var jb = jsf[1][j] | 0;
  173. naf[a][j] = index[(ja + 1) * 3 + (jb + 1)];
  174. naf[b][j] = 0;
  175. wnd[a] = comb;
  176. }
  177. }
  178. var acc = this.jpoint(null, null, null);
  179. var tmp = this._wnafT4;
  180. for (i = max; i >= 0; i--) {
  181. var k = 0;
  182. while (i >= 0) {
  183. var zero = true;
  184. for (j = 0; j < len; j++) {
  185. tmp[j] = naf[j][i] | 0;
  186. if (tmp[j] !== 0)
  187. zero = false;
  188. }
  189. if (!zero)
  190. break;
  191. k++;
  192. i--;
  193. }
  194. if (i >= 0)
  195. k++;
  196. acc = acc.dblp(k);
  197. if (i < 0)
  198. break;
  199. for (j = 0; j < len; j++) {
  200. var z = tmp[j];
  201. p;
  202. if (z === 0)
  203. continue;
  204. else if (z > 0)
  205. p = wnd[j][(z - 1) >> 1];
  206. else if (z < 0)
  207. p = wnd[j][(-z - 1) >> 1].neg();
  208. if (p.type === 'affine')
  209. acc = acc.mixedAdd(p);
  210. else
  211. acc = acc.add(p);
  212. }
  213. }
  214. // Zeroify references
  215. for (i = 0; i < len; i++)
  216. wnd[i] = null;
  217. if (jacobianResult)
  218. return acc;
  219. else
  220. return acc.toP();
  221. };
  222. function BasePoint(curve, type) {
  223. this.curve = curve;
  224. this.type = type;
  225. this.precomputed = null;
  226. }
  227. BaseCurve.BasePoint = BasePoint;
  228. BasePoint.prototype.eq = function eq(/*other*/) {
  229. throw new Error('Not implemented');
  230. };
  231. BasePoint.prototype.validate = function validate() {
  232. return this.curve.validate(this);
  233. };
  234. BaseCurve.prototype.decodePoint = function decodePoint(bytes, enc) {
  235. bytes = utils.toArray(bytes, enc);
  236. var len = this.p.byteLength();
  237. // uncompressed, hybrid-odd, hybrid-even
  238. if ((bytes[0] === 0x04 || bytes[0] === 0x06 || bytes[0] === 0x07) &&
  239. bytes.length - 1 === 2 * len) {
  240. if (bytes[0] === 0x06)
  241. assert(bytes[bytes.length - 1] % 2 === 0);
  242. else if (bytes[0] === 0x07)
  243. assert(bytes[bytes.length - 1] % 2 === 1);
  244. var res = this.point(bytes.slice(1, 1 + len),
  245. bytes.slice(1 + len, 1 + 2 * len));
  246. return res;
  247. } else if ((bytes[0] === 0x02 || bytes[0] === 0x03) &&
  248. bytes.length - 1 === len) {
  249. return this.pointFromX(bytes.slice(1, 1 + len), bytes[0] === 0x03);
  250. }
  251. throw new Error('Unknown point format');
  252. };
  253. BasePoint.prototype.encodeCompressed = function encodeCompressed(enc) {
  254. return this.encode(enc, true);
  255. };
  256. BasePoint.prototype._encode = function _encode(compact) {
  257. var len = this.curve.p.byteLength();
  258. var x = this.getX().toArray('be', len);
  259. if (compact)
  260. return [ this.getY().isEven() ? 0x02 : 0x03 ].concat(x);
  261. return [ 0x04 ].concat(x, this.getY().toArray('be', len));
  262. };
  263. BasePoint.prototype.encode = function encode(enc, compact) {
  264. return utils.encode(this._encode(compact), enc);
  265. };
  266. BasePoint.prototype.precompute = function precompute(power) {
  267. if (this.precomputed)
  268. return this;
  269. var precomputed = {
  270. doubles: null,
  271. naf: null,
  272. beta: null,
  273. };
  274. precomputed.naf = this._getNAFPoints(8);
  275. precomputed.doubles = this._getDoubles(4, power);
  276. precomputed.beta = this._getBeta();
  277. this.precomputed = precomputed;
  278. return this;
  279. };
  280. BasePoint.prototype._hasDoubles = function _hasDoubles(k) {
  281. if (!this.precomputed)
  282. return false;
  283. var doubles = this.precomputed.doubles;
  284. if (!doubles)
  285. return false;
  286. return doubles.points.length >= Math.ceil((k.bitLength() + 1) / doubles.step);
  287. };
  288. BasePoint.prototype._getDoubles = function _getDoubles(step, power) {
  289. if (this.precomputed && this.precomputed.doubles)
  290. return this.precomputed.doubles;
  291. var doubles = [ this ];
  292. var acc = this;
  293. for (var i = 0; i < power; i += step) {
  294. for (var j = 0; j < step; j++)
  295. acc = acc.dbl();
  296. doubles.push(acc);
  297. }
  298. return {
  299. step: step,
  300. points: doubles,
  301. };
  302. };
  303. BasePoint.prototype._getNAFPoints = function _getNAFPoints(wnd) {
  304. if (this.precomputed && this.precomputed.naf)
  305. return this.precomputed.naf;
  306. var res = [ this ];
  307. var max = (1 << wnd) - 1;
  308. var dbl = max === 1 ? null : this.dbl();
  309. for (var i = 1; i < max; i++)
  310. res[i] = res[i - 1].add(dbl);
  311. return {
  312. wnd: wnd,
  313. points: res,
  314. };
  315. };
  316. BasePoint.prototype._getBeta = function _getBeta() {
  317. return null;
  318. };
  319. BasePoint.prototype.dblp = function dblp(k) {
  320. var r = this;
  321. for (var i = 0; i < k; i++)
  322. r = r.dbl();
  323. return r;
  324. };