def checkvalid(s, m, pk): if len(s) != 64: raise Exception("signature length is wrong") if len(pk) != 32: raise Exception("public-key length is wrong") R = bytes_to_element(s[:32]) A = bytes_to_element(pk) S = bytes_to_scalar(s[32:]) h = Hint(s[:32] + pk + m) v1 = Base.scalarmult(S) v2 = R.add(A.scalarmult(h)) return v1==v2
def checkpk(pk, ext_pk): if len(pk) != 32: raise Exception("Public-key length is wrong") A = bytes_to_element(pk) if A != ext_pk: raise Exception("Wrong public key extracted")
def extractpk(s, m): if len(s) != 64: raise Exception("Signature length is wrong") R = bytes_to_element(s[:32]) S = bytes_to_scalar(s[32:]) h = Hint(s[:32] + m) h_inv = inv2(h) R_neg = R.scalarmult(L-1) v1 = Base.scalarmult(S) v2 = v1.add(R_neg) A = v2.scalarmult(h_inv) return A
def test_bytes_to_element(self): b = encodepoint((0, 1)) # order 1, aka Zero self.assertRaises(ValueError, bytes_to_element, b) p = bytes_to_unknown_group_element(b) self.assertFalse(isinstance(p, Element)) self.assertIs(p, Zero) b = encodepoint((0, -1 % Q)) # order 2 self.assertRaises(ValueError, bytes_to_element, b) p = bytes_to_unknown_group_element(b) self.assertFalse(isinstance(p, Element)) # (..,26) is in the right group b = b"\x1a" + b"\x00" * 31 p = bytes_to_element(b) self.assertTrue(isinstance(p, Element))
def test_bytes_to_element(self): b = encodepoint((0,1)) # order 1, aka Zero self.assertRaises(ValueError, bytes_to_element, b) p = bytes_to_unknown_group_element(b) self.assertFalse(isinstance(p, Element)) self.assertIs(p, Zero) b = encodepoint((0,-1%Q)) # order 2 self.assertRaises(ValueError, bytes_to_element, b) p = bytes_to_unknown_group_element(b) self.assertFalse(isinstance(p, Element)) # (..,26) is in the right group b = b"\x1a" + b"\x00"*31 p = bytes_to_element(b) self.assertTrue(isinstance(p, Element))
def dh_finish(x, Y_s): Y = bytes_to_element(Y_s) XY = Y.scalarmult(x) return sha256(XY.to_bytes()).digest()
def dh_finish(x, Y_s): Y = bytes_to_element(Y_s) XY = Y.scalarmult(x) return blake2b(XY.to_bytes()).digest()
def _finish(start_data, Y_s, blinding): (a, pw_scalar) = start_data Y = bytes_to_element(Y_s) # rejects zero and non-group Z = Y.add(blinding.scalarmult(-pw_scalar)).scalarmult(a) return Z.to_bytes()
def dh_finish(x: int, Y_s: bytes) -> bytes: Y = bytes_to_element(Y_s) XY = Y.scalarmult(x) return sha256(XY.to_bytes()).digest()