You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

types.go 3.2 KiB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. package sike
  2. // I keep it bool in order to be able to apply logical NOT
  3. type KeyVariant uint
  4. // Representation of an element of the base field F_p.
  5. //
  6. // No particular meaning is assigned to the representation -- it could represent
  7. // an element in Montgomery form, or not. Tracking the meaning of the field
  8. // element is left to higher types.
  9. type Fp [FP_WORDS]uint64
  10. // Represents an intermediate product of two elements of the base field F_p.
  11. type FpX2 [2 * FP_WORDS]uint64
  12. // Represents an element of the extended field Fp^2 = Fp(x+i)
  13. type Fp2 struct {
  14. A Fp
  15. B Fp
  16. }
  17. type DomainParams struct {
  18. // P, Q and R=P-Q base points
  19. Affine_P, Affine_Q, Affine_R Fp2
  20. // Size of a compuatation strategy for x-torsion group
  21. IsogenyStrategy []uint32
  22. // Max size of secret key for x-torsion group
  23. SecretBitLen uint
  24. // Max size of secret key for x-torsion group
  25. SecretByteLen uint
  26. }
  27. type SidhParams struct {
  28. Id uint8
  29. // Bytelen of P
  30. Bytelen int
  31. // The public key size, in bytes.
  32. PublicKeySize int
  33. // The shared secret size, in bytes.
  34. SharedSecretSize int
  35. // Defines A,C constant for starting curve Cy^2 = x^3 + Ax^2 + x
  36. InitCurve ProjectiveCurveParameters
  37. // 2- and 3-torsion group parameter definitions
  38. A, B DomainParams
  39. // Precomputed 1/2 in the Fp2 in Montgomery domain
  40. HalfFp2 Fp2
  41. // Precomputed identity element in the Fp2 in Montgomery domain
  42. OneFp2 Fp2
  43. // Length of SIKE secret message. Must be one of {24,32,40},
  44. // depending on size of prime field used (see [SIKE], 1.4 and 5.1)
  45. MsgLen int
  46. // Length of SIKE ephemeral KEM key (see [SIKE], 1.4 and 5.1)
  47. KemSize int
  48. // Size of a ciphertext returned by encapsulation in bytes
  49. CiphertextSize int
  50. }
  51. // Stores curve projective parameters equivalent to A/C. Meaning of the
  52. // values depends on the context. When working with isogenies over
  53. // subgroup that are powers of:
  54. // * three then (A:C) ~ (A+2C:A-2C)
  55. // * four then (A:C) ~ (A+2C: 4C)
  56. // See Appendix A of SIKE for more details
  57. type CurveCoefficientsEquiv struct {
  58. A Fp2
  59. C Fp2
  60. }
  61. // A point on the projective line P^1(F_{p^2}).
  62. //
  63. // This represents a point on the Kummer line of a Montgomery curve. The
  64. // curve is specified by a ProjectiveCurveParameters struct.
  65. type ProjectivePoint struct {
  66. X Fp2
  67. Z Fp2
  68. }
  69. // Base type for public and private key. Used mainly to carry domain
  70. // parameters.
  71. type key struct {
  72. // Domain parameters of the algorithm to be used with a key
  73. params *SidhParams
  74. // Flag indicates wether corresponds to 2-, 3-torsion group or SIKE
  75. keyVariant KeyVariant
  76. }
  77. // Defines operations on private key
  78. type PrivateKey struct {
  79. key
  80. // Secret key
  81. Scalar []byte
  82. // Used only by KEM
  83. S []byte
  84. }
  85. // Defines operations on public key
  86. type PublicKey struct {
  87. key
  88. affine_xP Fp2
  89. affine_xQ Fp2
  90. affine_xQmP Fp2
  91. }
  92. // A point on the projective line P^1(F_{p^2}).
  93. //
  94. // This is used to work projectively with the curve coefficients.
  95. type ProjectiveCurveParameters struct {
  96. A Fp2
  97. C Fp2
  98. }
  99. const (
  100. // First 2 bits identify SIDH variant third bit indicates
  101. // wether key is a SIKE variant (set) or SIDH (not set)
  102. // 001 - SIDH: corresponds to 2-torsion group
  103. KeyVariant_SIDH_A KeyVariant = 1 << 0
  104. // 010 - SIDH: corresponds to 3-torsion group
  105. KeyVariant_SIDH_B = 1 << 1
  106. // 110 - SIKE
  107. KeyVariant_SIKE = 1<<2 | KeyVariant_SIDH_B
  108. )