Master (#1262)

* clear

* feat: Add everything

* fix: Commenht

crypto/internal/ed25519/edwards25519/edwards25519_test.go

@@ -0,0 +1,267 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package edwards25519
+
+import (
+	"crypto/rand"
+	"testing"
+)
+
+func TestScNegMulAddIdentity(t *testing.T) {
+	one := [32]byte{1}
+	var seed [64]byte
+	var a, minusA, x [32]byte
+
+	rand.Reader.Read(seed[:])
+	ScReduce(&a, &seed)
+	copy(minusA[:], a[:])
+	ScNeg(&minusA, &minusA)
+	ScMulAdd(&x, &one, &a, &minusA)
+	if x != [32]byte{} {
+		t.Errorf("%x --neg--> %x --sum--> %x", a, minusA, x)
+	}
+}
+
+func TestGeAddAgainstgeAdd(t *testing.T) {
+	var x, y [32]byte
+	rand.Reader.Read(x[:])
+	rand.Reader.Read(y[:])
+	var X, Y ExtendedGroupElement
+	x[31] &= 127
+	y[31] &= 127
+	GeScalarMultBase(&X, &x)
+	GeScalarMultBase(&Y, &y)
+
+	var SBytesRef [32]byte
+	var SRef ExtendedGroupElement
+	var Ycached CachedGroupElement
+	var SCompletedRef CompletedGroupElement
+	Y.ToCached(&Ycached)
+	geAdd(&SCompletedRef, &X, &Ycached)
+	SCompletedRef.ToExtended(&SRef)
+	SRef.ToBytes(&SBytesRef)
+
+	var SBytes [32]byte
+	var S ExtendedGroupElement
+	GeAdd(&S, &X, &Y)
+	S.ToBytes(&SBytes)
+
+	if SBytes != SBytesRef {
+		t.Errorf("GeAdd does not match geAdd: %x != %x", SBytes, SBytesRef)
+	}
+}
+
+func TestGeScalarMultAgainstDoubleScalarMult(t *testing.T) {
+	var zero [32]byte
+
+	var x [32]byte
+	rand.Reader.Read(x[:])
+	var X ExtendedGroupElement
+	x[31] &= 127
+	GeScalarMultBase(&X, &x)
+
+	var a [32]byte
+	rand.Reader.Read(a[:])
+	a[31] &= 127
+
+	var ABytesRef [32]byte
+	var Aref ProjectiveGroupElement
+	GeDoubleScalarMultVartime(&Aref, &a, &X, &zero)
+	Aref.ToBytes(&ABytesRef)
+
+	var ABytes [32]byte
+	var A ExtendedGroupElement
+	GeScalarMult(&A, &a, &X)
+	A.ToBytes(&ABytes)
+
+	if ABytes != ABytesRef {
+		t.Errorf(
+			"GeScalarMult does not match GeDoubleScalarMultVartime: %x != %x",
+			ABytes,
+			ABytesRef,
+		)
+	}
+}
+
+func inc(b *[32]byte) {
+	acc := uint(1)
+	for i := 0; i < 32; i++ {
+		acc += uint(b[i])
+		acc, b[i] = uint(acc>>8), byte(acc)
+	}
+}
+
+func TestGeAddAgainstScalarMult(t *testing.T) {
+	var x, s [32]byte
+	rand.Reader.Read(x[:])
+	x[31] &= 127
+	var X ExtendedGroupElement
+	GeScalarMultBase(&X, &x)
+	var A ExtendedGroupElement
+	A.Zero()
+	var ABytes, ABytesMult [32]byte
+	A.ToBytes(&ABytes)
+	var AMult ExtendedGroupElement
+	GeScalarMult(&AMult, &s, &X)
+	AMult.ToBytes(&ABytesMult)
+	if ABytes != ABytesMult {
+		t.Errorf("addition does not match multiplication (%x) -> %x != %x", s, ABytes, ABytesMult)
+	}
+
+	GeAdd(&A, &A, &X)
+	inc(&s)
+}
+
+func TestGeAddAgainstDoubleScalarMult(t *testing.T) {
+	var zero, x, s [32]byte
+	rand.Reader.Read(x[:])
+	x[31] &= 127
+	var X ExtendedGroupElement
+	GeScalarMultBase(&X, &x)
+	var A ExtendedGroupElement
+	A.Zero()
+	var ABytes, ABytesMult [32]byte
+	A.ToBytes(&ABytes)
+	var AMult ProjectiveGroupElement
+	GeDoubleScalarMultVartime(&AMult, &s, &X, &zero)
+	AMult.ToBytes(&ABytesMult)
+	if ABytes != ABytesMult {
+		t.Errorf("addition does not match multiplication (%x)", s)
+	}
+
+	GeAdd(&A, &A, &X)
+	inc(&s)
+}
+
+func TestGeScalarMultiBaseScalarMultDH(t *testing.T) {
+	var a, b [32]byte
+	rand.Reader.Read(a[:])
+	rand.Reader.Read(b[:])
+
+	var A, B ExtendedGroupElement
+	a[31] &= 127
+	b[31] &= 127
+	GeScalarMultBase(&A, &a)
+	GeScalarMultBase(&B, &b)
+
+	var kA, kB ExtendedGroupElement
+	GeScalarMult(&kA, &a, &B)
+	GeScalarMult(&kB, &b, &A)
+
+	var ka, kb [32]byte
+	kA.ToBytes(&ka)
+	kB.ToBytes(&kb)
+
+	if ka != kb {
+		t.Fatal("DH shared secrets do not match")
+	}
+}
+
+func TestGeScalarMultDH(t *testing.T) {
+	var one [32]byte
+	one[0] = 1
+	var base ExtendedGroupElement
+	GeScalarMultBase(&base, &one)
+
+	var a, b [32]byte
+	rand.Reader.Read(a[:])
+	rand.Reader.Read(b[:])
+
+	var A, B ExtendedGroupElement
+	GeScalarMult(&A, &a, &base)
+	GeScalarMult(&B, &b, &base)
+
+	var kA, kB ExtendedGroupElement
+	GeScalarMult(&kA, &a, &B)
+	GeScalarMult(&kB, &b, &A)
+
+	var ka, kb [32]byte
+	kA.ToBytes(&ka)
+	kB.ToBytes(&kb)
+
+	if ka != kb {
+		t.Fatal("DH shared secrets do not match")
+	}
+
+	var bytesA, bytesB [32]byte
+	A.ToBytes(&bytesA)
+	B.ToBytes(&bytesB)
+
+	if bytesA == bytesB {
+		t.Fatalf("DH public key collision: g^%x = g^%x = %x", a, b, A)
+	}
+}
+
+func BenchmarkGeScalarMultBase(b *testing.B) {
+	var s [32]byte
+	rand.Reader.Read(s[:])
+	var P ExtendedGroupElement
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		GeScalarMultBase(&P, &s)
+	}
+}
+
+func BenchmarkGeScalarMult(b *testing.B) {
+	var s [32]byte
+	rand.Reader.Read(s[:])
+
+	var P ExtendedGroupElement
+	s[31] &= 127
+	GeScalarMultBase(&P, &s)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		GeScalarMult(&P, &s, &P)
+	}
+}
+
+func BenchmarkGeDoubleScalarMultVartime(b *testing.B) {
+	var s [32]byte
+	rand.Reader.Read(s[:])
+
+	var P, Pout ExtendedGroupElement
+	s[31] &= 127
+	GeScalarMultBase(&P, &s)
+
+	var out ProjectiveGroupElement
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		GeDoubleScalarMultVartime(&out, &s, &P, &[32]byte{})
+		out.ToExtended(&Pout)
+	}
+}
+
+func BenchmarkGeAdd(b *testing.B) {
+	var s [32]byte
+	rand.Reader.Read(s[:])
+
+	var R, P ExtendedGroupElement
+	s[31] &= 127
+	GeScalarMultBase(&P, &s)
+	R = P
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		GeAdd(&R, &R, &P)
+	}
+}
+
+func BenchmarkGeDouble(b *testing.B) {
+	var s [32]byte
+	rand.Reader.Read(s[:])
+
+	var R, P ExtendedGroupElement
+	s[31] &= 127
+	GeScalarMultBase(&P, &s)
+	R = P
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		GeDouble(&R, &P)
+	}
+}