def checkvalid(s, m, pk):
if len(s) != 64: raise Exception("signature length is wrong")
if len(pk) != 32: raise Exception("public-key length is wrong")
R = bytes_to_element(s[:32])
A = bytes_to_element(pk)
S = bytes_to_scalar(s[32:])
h = Hint(s[:32] + pk + m)
v1 = Base.scalarmult(S)
v2 = R.add(A.scalarmult(h))
return v1==v2
def checkvalid(s, m, pk):
if len(s) != 64: raise Exception("signature length is wrong")
if len(pk) != 32: raise Exception("public-key length is wrong")
R = bytes_to_element(s[:32])
A = bytes_to_element(pk)
S = bytes_to_scalar(s[32:])
h = Hint(s[:32] + pk + m)
v1 = Base.scalarmult(S)
v2 = R.add(A.scalarmult(h))
return v1==v2
def checkpk(pk, ext_pk):
if len(pk) != 32:
raise Exception("Public-key length is wrong")
A = bytes_to_element(pk)
if A != ext_pk:
raise Exception("Wrong public key extracted")
def extractpk(s, m):
if len(s) != 64:
raise Exception("Signature length is wrong")
R = bytes_to_element(s[:32])
S = bytes_to_scalar(s[32:])
h = Hint(s[:32] + m)
h_inv = inv2(h)
R_neg = R.scalarmult(L-1)
v1 = Base.scalarmult(S)
v2 = v1.add(R_neg)
A = v2.scalarmult(h_inv)
return A
def test_bytes_to_element(self):
b = encodepoint((0, 1)) # order 1, aka Zero
self.assertRaises(ValueError, bytes_to_element, b)
p = bytes_to_unknown_group_element(b)
self.assertFalse(isinstance(p, Element))
self.assertIs(p, Zero)
b = encodepoint((0, -1 % Q)) # order 2
self.assertRaises(ValueError, bytes_to_element, b)
p = bytes_to_unknown_group_element(b)
self.assertFalse(isinstance(p, Element))
# (..,26) is in the right group
b = b"\x1a" + b"\x00" * 31
p = bytes_to_element(b)
self.assertTrue(isinstance(p, Element))
def test_bytes_to_element(self):
b = encodepoint((0,1)) # order 1, aka Zero
self.assertRaises(ValueError, bytes_to_element, b)
p = bytes_to_unknown_group_element(b)
self.assertFalse(isinstance(p, Element))
self.assertIs(p, Zero)
b = encodepoint((0,-1%Q)) # order 2
self.assertRaises(ValueError, bytes_to_element, b)
p = bytes_to_unknown_group_element(b)
self.assertFalse(isinstance(p, Element))
# (..,26) is in the right group
b = b"\x1a" + b"\x00"*31
p = bytes_to_element(b)
self.assertTrue(isinstance(p, Element))
def dh_finish(x, Y_s):
Y = bytes_to_element(Y_s)
XY = Y.scalarmult(x)
return sha256(XY.to_bytes()).digest()
def dh_finish(x, Y_s):
Y = bytes_to_element(Y_s)
XY = Y.scalarmult(x)
return blake2b(XY.to_bytes()).digest()
def _finish(start_data, Y_s, blinding):
(a, pw_scalar) = start_data
Y = bytes_to_element(Y_s) # rejects zero and non-group
Z = Y.add(blinding.scalarmult(-pw_scalar)).scalarmult(a)
return Z.to_bytes()
def dh_finish(x: int, Y_s: bytes) -> bytes:
Y = bytes_to_element(Y_s)
XY = Y.scalarmult(x)
return sha256(XY.to_bytes()).digest()
def _finish(start_data, Y_s, blinding):
(a, pw_scalar) = start_data
Y = bytes_to_element(Y_s) # rejects zero and non-group
Z = Y.add(blinding.scalarmult(-pw_scalar)).scalarmult(a)
return Z.to_bytes()