GNUnet 0.21.2
crypto_elligator.c File Reference
#include "platform.h"
#include <gcrypt.h>
#include <sodium.h>
#include "gnunet_util_lib.h"
#include "benchmark.h"
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
#include <gmp.h>
#include <limits.h>
Include dependency graph for crypto_elligator.c:

Go to the source code of this file.

Macros

#define P_BITS   (256)
 
#define P_BYTES   ((P_BITS + CHAR_BIT - 1) / CHAR_BIT)
 
#define P_LIMBS   ((P_BITS + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
 

Functions

static void decode_bytes (mp_limb_t *number, const uint8_t *bytes)
 
static void encode_bytes (uint8_t *bytes, mp_limb_t *number)
 
void __attribute__ ((constructor))
 Initialize elligator scratch space. More...
 
static void least_square_root (mp_limb_t *root, const mp_limb_t *number, mp_limb_t *scratch_space)
 Calculates the root of a given number. More...
 
bool GNUNET_CRYPTO_ecdhe_elligator_encoding (struct GNUNET_CRYPTO_ElligatorRepresentative *r, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, bool high_y)
 Encodes a point on Curve25519 to a an element of the underlying finite field. More...
 
static bool elligator_direct_map (uint8_t *point, bool *high_y, uint8_t *representative)
 Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve. More...
 
void GNUNET_CRYPTO_ecdhe_elligator_decoding (struct GNUNET_CRYPTO_EcdhePublicKey *point, bool *high_y, const struct GNUNET_CRYPTO_ElligatorRepresentative *representative)
 Clears the most significant bit and second most significant bit of the serialized representaive before applying elligator direct map. More...
 
static bool convert_from_ed_to_curve (uint8_t *point, const uint8_t *source)
 Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve. More...
 
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdhe_elligator_generate_public_key (struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
 Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point. More...
 
void GNUNET_CRYPTO_ecdhe_elligator_key_create (struct GNUNET_CRYPTO_ElligatorRepresentative *repr, struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
 Generates a private key for Curve25519 and the elligator representative of the corresponding public key. More...
 
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_elligator_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_CRYPTO_ElligatorRepresentative *r, struct GNUNET_HashCode *key_material)
 Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair. More...
 
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_elligator_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_ElligatorRepresentative *r, struct GNUNET_HashCode *key_material)
 Carries out ecdh decapsulation with own private key and the representative of the received public key. More...
 

Variables

static const uint8_t lookupTable [8][crypto_scalarmult_SCALARBYTES]
 
static const unsigned char p_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char negative_1_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char negative_2_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char divide_negative_1_2_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char divide_plus_p_3_8_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char divide_minus_p_1_2_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char square_root_negative_1_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char A_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char negative_A_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char u_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char inverted_u_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static const unsigned char d_bytes [(((256)+CHAR_BIT - 1)/CHAR_BIT)]
 
static mp_limb_t p [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t negative_1 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t negative_2 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t divide_negative_1_2 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t divide_plus_p_3_8 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t divide_minus_p_1_2 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t square_root_negative_1 [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t A [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t negative_A [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t u [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t inverted_u [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_limb_t d [(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
 
static mp_size_t scratch_space_length
 

Macro Definition Documentation

◆ P_BITS

#define P_BITS   (256)

Definition at line 91 of file crypto_elligator.c.

◆ P_BYTES

#define P_BYTES   ((P_BITS + CHAR_BIT - 1) / CHAR_BIT)

Definition at line 92 of file crypto_elligator.c.

◆ P_LIMBS

#define P_LIMBS   ((P_BITS + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)

Definition at line 93 of file crypto_elligator.c.

Function Documentation

◆ decode_bytes()

static void decode_bytes ( mp_limb_t *  number,
const uint8_t *  bytes 
)
static

Definition at line 198 of file crypto_elligator.c.

199{
200 mp_limb_t scratch_space[1];
201
202 for (size_t i = 0; i < P_BYTES; ++i)
203 {
204 mpn_lshift (number, number, P_LIMBS, 8);
205 mpn_sec_add_1 (number, number, 1, bytes[P_BYTES - i - 1], scratch_space);
206 }
207}
#define P_BYTES
#define P_LIMBS
uint32_t number

References number, P_BYTES, and P_LIMBS.

Referenced by __attribute__(), convert_from_ed_to_curve(), elligator_direct_map(), and GNUNET_CRYPTO_ecdhe_elligator_encoding().

Here is the caller graph for this function:

◆ encode_bytes()

static void encode_bytes ( uint8_t *  bytes,
mp_limb_t *  number 
)
static

Definition at line 212 of file crypto_elligator.c.

213{
214 for (size_t i = 0; i < P_BYTES; ++i)
215 {
216 bytes[P_BYTES - i - 1] = mpn_lshift (number, number, P_LIMBS, 8);
217 }
218}

References number, P_BYTES, and P_LIMBS.

Referenced by convert_from_ed_to_curve(), elligator_direct_map(), and GNUNET_CRYPTO_ecdhe_elligator_encoding().

Here is the caller graph for this function:

◆ __attribute__()

void __attribute__ ( (constructor)  )

Initialize elligator scratch space.

Definition at line 224 of file crypto_elligator.c.

226{
227 static bool initialized = false;
228
229 if (initialized)
230 {
231 return;
232 }
233
246
247 mp_size_t scratch_space_lengths[] = {
248 // For least_square_root
249
250 mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
251 mpn_sec_sqr_itch (P_LIMBS),
252 mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
253 mpn_sec_sub_1_itch (P_LIMBS),
254 mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
255
256 // For Elligator_2_Curve25519_encode
257
258 mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
259 mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
260 mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
261 mpn_sec_sqr_itch (P_LIMBS),
262 mpn_sec_sub_1_itch (P_LIMBS),
263
264 // For Elligator_2_Curve25519_decode
265
266 mpn_sec_sqr_itch (P_LIMBS),
267 mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
268 mpn_sec_div_r_itch (P_LIMBS, P_LIMBS),
269 mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
270 mpn_sec_add_1_itch (P_LIMBS),
271 mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
272
273 // For Elligator_2_Curve25519_convert_from_Ed25519
274 mpn_sec_sqr_itch (P_LIMBS),
275 mpn_sec_div_r_itch (P_LIMBS + P_LIMBS, P_LIMBS),
276 mpn_sec_mul_itch (P_LIMBS, P_LIMBS),
277 mpn_sec_add_1_itch (P_LIMBS),
278 mpn_sec_powm_itch (P_LIMBS, P_BITS - 1, P_LIMBS),
279 mpn_sec_sub_1_itch (P_LIMBS)
280 };
281
282 for (size_t i = 0; i < sizeof scratch_space_lengths
283 / sizeof *scratch_space_lengths; ++i)
284 {
285 if (scratch_space_lengths[i] > scratch_space_length)
286 {
287 scratch_space_length = scratch_space_lengths[i];
288 }
289 }
290
291 initialized = true;
292}
static void decode_bytes(mp_limb_t *number, const uint8_t *bytes)
static mp_limb_t divide_minus_p_1_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t negative_A[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t negative_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
#define P_BITS
static mp_limb_t square_root_negative_1[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t p[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static const unsigned char divide_minus_p_1_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char negative_A_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static mp_limb_t d[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static const unsigned char u_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char p_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char negative_1_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char negative_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static mp_size_t scratch_space_length
static const unsigned char A_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char square_root_negative_1_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char d_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static mp_limb_t negative_1[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static const unsigned char divide_plus_p_3_8_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static const unsigned char divide_negative_1_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static mp_limb_t A[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t inverted_u[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t divide_plus_p_3_8[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static mp_limb_t u[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static const unsigned char inverted_u_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static mp_limb_t divide_negative_1_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static int initialized
Have we been initialized?
Definition: plugin.c:59

References A, A_bytes, d, d_bytes, decode_bytes(), divide_minus_p_1_2, divide_minus_p_1_2_bytes, divide_negative_1_2, divide_negative_1_2_bytes, divide_plus_p_3_8, divide_plus_p_3_8_bytes, initialized, inverted_u, inverted_u_bytes, negative_1, negative_1_bytes, negative_2, negative_2_bytes, negative_A, negative_A_bytes, p, P_BITS, p_bytes, P_LIMBS, scratch_space_length, square_root_negative_1, square_root_negative_1_bytes, u, and u_bytes.

Here is the call graph for this function:

◆ least_square_root()

static void least_square_root ( mp_limb_t *  root,
const mp_limb_t *  number,
mp_limb_t *  scratch_space 
)
static

Calculates the root of a given number.

Returns trash if the number is a quadratic non-residue.

Parameters
rootstorage for calculated root
numbervalue for which the root is calculated
scratch_spacebuffer for calculation

Definition at line 304 of file crypto_elligator.c.

307{
308 mp_limb_t a[P_LIMBS + P_LIMBS];
309 mp_limb_t b[P_LIMBS];
310
311 // root := number ^ ((p + 3) / 8)
312
313 mpn_add_n (b, number, p, P_LIMBS); // The next function requires a nonzero input
314 mpn_sec_powm (root, b, P_LIMBS, divide_plus_p_3_8, P_BITS - 1, p, P_LIMBS,
315 scratch_space);
316
317 // If root ^ 2 != number, root := root * square_root(-1)
318
319 mpn_sec_sqr (a, root, P_LIMBS, scratch_space);
320 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
321 mpn_sub_n (b, a, number, P_LIMBS);
322
323 mp_limb_t condition = mpn_sec_sub_1 (b, b, P_LIMBS, 1, scratch_space) ^ 1;
324
325 mpn_sec_mul (a, root, P_LIMBS, square_root_negative_1, P_LIMBS,
326 scratch_space);
327 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
328
329 mpn_cnd_swap (condition, root, a, P_LIMBS);
330
331 // If root > (p - 1) / 2, root := -root
332
333 condition = mpn_sub_n (a, divide_minus_p_1_2, root, P_LIMBS);
334
335 mpn_sub_n (a, p, root, P_LIMBS); // If root = 0, a := p
336
337 mpn_cnd_swap (condition, root, a, P_LIMBS);
338}

References divide_minus_p_1_2, divide_plus_p_3_8, number, p, P_BITS, P_LIMBS, and square_root_negative_1.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_encoding().

Here is the caller graph for this function:

◆ elligator_direct_map()

static bool elligator_direct_map ( uint8_t *  point,
bool *  high_y,
uint8_t *  representative 
)
static

Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve.

This function works deterministically. This step is also known as elligators "decoding" step. Taken from https://github.com/Kleshni/Elligator-2/blob/master/main.c.

Parameters
pointstorage for calculated point on Curve25519
high_yThe 'high_y' argument of the corresponding GNUNET_CRYPTO_ecdhe_elligator_encoding call
representativeGiven representative
Returns
'false' if extra step during direct map calculation is needed, otherwise 'true'

Definition at line 410 of file crypto_elligator.c.

413{
414 mp_limb_t scratch_space[scratch_space_length];
415
416 mp_limb_t a[P_LIMBS + P_LIMBS];
417 mp_limb_t b[P_LIMBS + P_LIMBS];
418 mp_limb_t c[P_LIMBS];
419 mp_limb_t e[P_LIMBS + P_LIMBS];
420
421 // a := representative
422
423 decode_bytes (a, representative);
424
425 // Determine whether a < (p - 1) / 2
426
427 bool result = mpn_sub_n (b, divide_minus_p_1_2, a, P_LIMBS) ^ 1;
428
429 // b := -A / (1 + u * a ^ 2)
430
431 mpn_sec_sqr (b, a, P_LIMBS, scratch_space);
432 mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
433 mpn_sec_mul (a, u, P_LIMBS, b, P_LIMBS, scratch_space);
434 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
435 mpn_sec_add_1 (b, a, P_LIMBS, 1, scratch_space);
436 mpn_sec_powm (a, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
437 scratch_space);
438 mpn_sec_mul (b, a, P_LIMBS, negative_A, P_LIMBS, scratch_space);
439 mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
440
441 // a := b ^ 3 + A * b ^ 2 + b (with 1-bit overflow)
442
443 mpn_sec_sqr (a, b, P_LIMBS, scratch_space);
444 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
445 mpn_add_n (c, b, A, P_LIMBS);
446 mpn_sec_mul (e, c, P_LIMBS, a, P_LIMBS, scratch_space);
447 mpn_sec_div_r (e, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
448 mpn_add_n (a, e, b, P_LIMBS);
449
450 // If a is a quadratic residue modulo p, point := b and high_y := 1
451 // Otherwise point := -b - A and high_y := 0
452
453 mpn_sub_n (c, p, b, P_LIMBS);
454 mpn_add_n (c, c, negative_A, P_LIMBS);
455 mpn_sec_div_r (c, P_LIMBS, p, P_LIMBS, scratch_space);
456
457 mpn_sec_powm (e, a, P_LIMBS, divide_minus_p_1_2, P_BITS - 1, p, P_LIMBS,
458 scratch_space);
459 *high_y = mpn_sub_n (e, e, divide_minus_p_1_2, P_LIMBS);
460
461 mpn_cnd_swap (*high_y, b, c, P_LIMBS);
462
463 encode_bytes (point, c);
464
465 return result;
466}
static void encode_bytes(uint8_t *bytes, mp_limb_t *number)
static int result
Global testing status.

References A, decode_bytes(), divide_minus_p_1_2, encode_bytes(), negative_2, negative_A, p, P_BITS, P_LIMBS, result, scratch_space_length, and u.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_decoding().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ convert_from_ed_to_curve()

static bool convert_from_ed_to_curve ( uint8_t *  point,
const uint8_t *  source 
)
static

Takes a number of the underlying finite field of Curve25519 and projects it into a valid point on that curve.

This function works deterministically. This step is also known as elligators "decoding" step. Taken from https://github.com/Kleshni/Elligator-2/blob/master/main.c.

Parameters
pointstorage for calculated point on Curve25519
sourceEd25519 curve point
Returns
'false' if source is not a valid Ed25519 point. In this case the 'point' array will be undefined but dependent on source.

Definition at line 504 of file crypto_elligator.c.

506{
507 mp_limb_t scratch_space[scratch_space_length];
508
509 mp_limb_t y[P_LIMBS];
510 mp_limb_t a[P_LIMBS + P_LIMBS];
511 mp_limb_t b[P_LIMBS + P_LIMBS];
512 mp_limb_t c[P_LIMBS + P_LIMBS];
513
514 uint8_t y_bytes[P_BYTES];
515
516 memcpy (y_bytes, source, 31);
517
518 y_bytes[31] = source[31] & 0x7f;
519
520 decode_bytes (y, y_bytes);
521
522 // Check if y < p
523
524 bool result = mpn_sub_n (a, y, p, P_LIMBS);
525
526 // a := (y ^ 2 - 1) / (1 + d * y ^ 2)
527
528 mpn_sec_sqr (a, y, P_LIMBS, scratch_space);
529 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
530 mpn_sec_mul (b, a, P_LIMBS, d, P_LIMBS, scratch_space);
531 mpn_sec_add_1 (b, b, P_LIMBS, 1, scratch_space);
532 mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
533 mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
534 scratch_space);
535 mpn_add_n (b, a, negative_1, P_LIMBS);
536 mpn_sec_mul (a, b, P_LIMBS, c, P_LIMBS, scratch_space);
537 mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
538
539 // Check, whether a is a square modulo p (including a = 0)
540
541 mpn_add_n (a, a, p, P_LIMBS);
542 mpn_sec_powm (b, a, P_LIMBS, divide_negative_1_2, P_BITS - 1, p, P_LIMBS,
543 scratch_space);
544
545 result &= mpn_sub_n (c, b, divide_minus_p_1_2, P_LIMBS);
546
547 // If a = p, the parity bit must be 0
548
549 mpn_sub_n (a, a, p, P_LIMBS);
550
551 result ^= mpn_sec_sub_1 (a, a, P_LIMBS, 1, scratch_space) & source[31] >> 7;
552
553 // If y != 1, c := (1 + y) / (1 - y), otherwise c := 0
554
555 mpn_sub_n (a, p, y, P_LIMBS);
556 mpn_sec_add_1 (a, a, P_LIMBS, 1, scratch_space);
557 mpn_sec_powm (b, a, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
558 scratch_space);
559 mpn_sec_add_1 (a, y, P_LIMBS, 1, scratch_space);
560 mpn_sec_mul (c, a, P_LIMBS, b, P_LIMBS, scratch_space);
561 mpn_sec_div_r (c, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
562
563 encode_bytes (point, c);
564
565 return result;
566}
static GstElement * source
Appsrc instance into which we write data for the pipeline.

References d, decode_bytes(), divide_minus_p_1_2, divide_negative_1_2, encode_bytes(), negative_1, negative_2, p, P_BITS, P_BYTES, P_LIMBS, result, scratch_space_length, and source.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_generate_public_key().

Here is the call graph for this function:
Here is the caller graph for this function:

Variable Documentation

◆ lookupTable

const uint8_t lookupTable[8][crypto_scalarmult_SCALARBYTES]
static

◆ p_bytes

const unsigned char p_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
}

Definition at line 97 of file crypto_elligator.c.

Referenced by __attribute__().

◆ negative_1_bytes

const unsigned char negative_1_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
}

Definition at line 104 of file crypto_elligator.c.

Referenced by __attribute__().

◆ negative_2_bytes

const unsigned char negative_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
}

Definition at line 111 of file crypto_elligator.c.

Referenced by __attribute__().

◆ divide_negative_1_2_bytes

const unsigned char divide_negative_1_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xf6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
}

Definition at line 118 of file crypto_elligator.c.

Referenced by __attribute__().

◆ divide_plus_p_3_8_bytes

const unsigned char divide_plus_p_3_8_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0f
}

Definition at line 125 of file crypto_elligator.c.

Referenced by __attribute__().

◆ divide_minus_p_1_2_bytes

const unsigned char divide_minus_p_1_2_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xf6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
}

Definition at line 132 of file crypto_elligator.c.

Referenced by __attribute__().

◆ square_root_negative_1_bytes

const unsigned char square_root_negative_1_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xb0, 0xa0, 0x0e, 0x4a, 0x27, 0x1b, 0xee, 0xc4,
0x78, 0xe4, 0x2f, 0xad, 0x06, 0x18, 0x43, 0x2f,
0xa7, 0xd7, 0xfb, 0x3d, 0x99, 0x00, 0x4d, 0x2b,
0x0b, 0xdf, 0xc1, 0x4f, 0x80, 0x24, 0x83, 0x2b
}

Definition at line 139 of file crypto_elligator.c.

Referenced by __attribute__().

◆ A_bytes

const unsigned char A_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0x06, 0x6d, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
}

Definition at line 146 of file crypto_elligator.c.

Referenced by __attribute__().

◆ negative_A_bytes

const unsigned char negative_A_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xe7, 0x92, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
}

Definition at line 153 of file crypto_elligator.c.

Referenced by __attribute__().

◆ u_bytes

const unsigned char u_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
}

Definition at line 160 of file crypto_elligator.c.

Referenced by __attribute__().

◆ inverted_u_bytes

const unsigned char inverted_u_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xf7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f
}

Definition at line 167 of file crypto_elligator.c.

Referenced by __attribute__().

◆ d_bytes

const unsigned char d_bytes[(((256)+CHAR_BIT - 1)/CHAR_BIT)]
static
Initial value:
= {
0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52
}

Definition at line 174 of file crypto_elligator.c.

Referenced by __attribute__().

◆ p

mp_limb_t p[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

◆ negative_1

mp_limb_t negative_1[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 182 of file crypto_elligator.c.

Referenced by __attribute__(), and convert_from_ed_to_curve().

◆ negative_2

mp_limb_t negative_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

◆ divide_negative_1_2

mp_limb_t divide_negative_1_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 184 of file crypto_elligator.c.

Referenced by __attribute__(), and convert_from_ed_to_curve().

◆ divide_plus_p_3_8

mp_limb_t divide_plus_p_3_8[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 185 of file crypto_elligator.c.

Referenced by __attribute__(), and least_square_root().

◆ divide_minus_p_1_2

mp_limb_t divide_minus_p_1_2[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

◆ square_root_negative_1

mp_limb_t square_root_negative_1[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 187 of file crypto_elligator.c.

Referenced by __attribute__(), and least_square_root().

◆ A

mp_limb_t A[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

◆ negative_A

mp_limb_t negative_A[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 189 of file crypto_elligator.c.

Referenced by __attribute__(), and elligator_direct_map().

◆ u

◆ inverted_u

mp_limb_t inverted_u[(((256)+GMP_NUMB_BITS - 1)/GMP_NUMB_BITS)]
static

Definition at line 191 of file crypto_elligator.c.

Referenced by __attribute__(), and GNUNET_CRYPTO_ecdhe_elligator_encoding().

◆ d

◆ scratch_space_length

mp_size_t scratch_space_length
static