X-Git-Url: http://www.git.cypherpunks.ru/?a=blobdiff_plain;f=pygost%2Fgost3410.py;h=a3e2f7ad8c316458ee8916398842c6dde1af1f07;hb=3d854c61b4a7446ccf8d4b1b6cfd2297d81d6b07;hp=7e92e3422c29b0b5ae569257143196a945836a04;hpb=ccf38ecbf1c166c0817893afd85bcb0976e09789;p=pygost.git

diff --git a/pygost/gost3410.py b/pygost/gost3410.py
index 7e92e34..a3e2f7a 100644
--- a/pygost/gost3410.py
+++ b/pygost/gost3410.py
@@ -1,6 +1,6 @@
 # coding: utf-8
 # PyGOST -- Pure Python GOST cryptographic functions library
-# Copyright (C) 2015-2020 Sergey Matveev <stargrave@stargrave.org>
+# Copyright (C) 2015-2021 Sergey Matveev <stargrave@stargrave.org>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -13,7 +13,7 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-""" GOST R 34.10 public-key signature function.
+"""GOST R 34.10 public-key signature function.
 
 This is implementation of GOST R 34.10-2001 (:rfc:`5832`), GOST R
 34.10-2012 (:rfc:`7091`). The difference between 2001 and 2012 is the
@@ -28,14 +28,14 @@ from pygost.utils import long2bytes
 from pygost.utils import modinvert
 
 
-MODE2SIZE = {
-    2001: 32,
-    2012: 64,
-}
+def point_size(point):
+    """Determine is it either 256 or 512 bit point
+    """
+    return (512 // 8) if point.bit_length() > 256 else (256 // 8)
 
 
 class GOST3410Curve(object):
-    """ GOST 34.10 validated curve
+    """GOST 34.10 validated curve
 
     >>> curve = CURVES["id-GostR3410-2001-TestParamSet"]
     >>> prv = prv_unmarshal(urandom(32))
@@ -53,21 +53,29 @@ class GOST3410Curve(object):
                       the canonical form
     :param long e, d: coefficients of the equation of the elliptic curve in
                       the twisted Edwards form
+    :param str name: human-readable curve name
     """
-    def __init__(self, p, q, a, b, x, y, e=None, d=None):
+    def __init__(self, p, q, a, b, x, y, cofactor=1, e=None, d=None, name=None):
         self.p = p
         self.q = q
         self.a = a
         self.b = b
         self.x = x
         self.y = y
+        self.cofactor = cofactor
         self.e = e
         self.d = d
-        r1 = self.y * self.y % self.p
-        r2 = ((self.x * self.x + self.a) * self.x + self.b) % self.p
-        if r1 != self.pos(r2):
+        if not self.contains((x, y)):
             raise ValueError("Invalid parameters")
         self._st = None
+        self.name = name
+
+    @property
+    def point_size(self):
+        return point_size(self.p)
+
+    def __repr__(self):
+        return "<%s: %s>" % (self.__class__.__name__, self.name)
 
     def pos(self, v):
         """Make positive number
@@ -76,6 +84,16 @@ class GOST3410Curve(object):
             return v + self.p
         return v
 
+    def contains(self, point):
+        """Is point on the curve?
+
+        :type point: (long, long)
+        """
+        x, y = point
+        r1 = y * y % self.p
+        r2 = ((x * x + self.a) * x + self.b) % self.p
+        return r1 == self.pos(r2)
+
     def _add(self, p1x, p1y, p2x, p2y):
         if p1x == p2x and p1y == p2y:
             # double
@@ -107,7 +125,7 @@ class GOST3410Curve(object):
         """Compute s/t parameters for twisted Edwards curve points conversion
         """
         if self.e is None or self.d is None:
-            raise ValueError("non twisted Edwards curve")
+            raise ValueError("Non twisted Edwards curve")
         if self._st is not None:
             return self._st
         self._st = (
@@ -134,7 +152,18 @@ CURVES = {
         x=bytes2long(hexdec("0000000000000000000000000000000000000000000000000000000000000002")),
         y=bytes2long(hexdec("08E2A8A0E65147D4BD6316030E16D19C85C97F0A9CA267122B96ABBCEA7E8FC8")),
     ),
-    "id-GostR3410-2001-CryptoPro-A-ParamSet": GOST3410Curve(
+    "id-tc26-gost-3410-12-256-paramSetA": GOST3410Curve(
+        p=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97")),
+        q=bytes2long(hexdec("400000000000000000000000000000000FD8CDDFC87B6635C115AF556C360C67")),
+        a=bytes2long(hexdec("C2173F1513981673AF4892C23035A27CE25E2013BF95AA33B22C656F277E7335")),
+        b=bytes2long(hexdec("295F9BAE7428ED9CCC20E7C359A9D41A22FCCD9108E17BF7BA9337A6F8AE9513")),
+        x=bytes2long(hexdec("91E38443A5E82C0D880923425712B2BB658B9196932E02C78B2582FE742DAA28")),
+        y=bytes2long(hexdec("32879423AB1A0375895786C4BB46E9565FDE0B5344766740AF268ADB32322E5C")),
+        cofactor=4,
+        e=0x01,
+        d=bytes2long(hexdec("0605F6B7C183FA81578BC39CFAD518132B9DF62897009AF7E522C32D6DC7BFFB")),
+    ),
+    "id-tc26-gost-3410-12-256-paramSetB": GOST3410Curve(
         p=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97")),
         q=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893")),
         a=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94")),
@@ -142,7 +171,7 @@ CURVES = {
         x=bytes2long(hexdec("0000000000000000000000000000000000000000000000000000000000000001")),
         y=bytes2long(hexdec("8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14")),
     ),
-    "id-GostR3410-2001-CryptoPro-B-ParamSet": GOST3410Curve(
+    "id-tc26-gost-3410-12-256-paramSetC": GOST3410Curve(
         p=bytes2long(hexdec("8000000000000000000000000000000000000000000000000000000000000C99")),
         q=bytes2long(hexdec("800000000000000000000000000000015F700CFFF1A624E5E497161BCC8A198F")),
         a=bytes2long(hexdec("8000000000000000000000000000000000000000000000000000000000000C96")),
@@ -150,7 +179,7 @@ CURVES = {
         x=bytes2long(hexdec("0000000000000000000000000000000000000000000000000000000000000001")),
         y=bytes2long(hexdec("3FA8124359F96680B83D1C3EB2C070E5C545C9858D03ECFB744BF8D717717EFC")),
     ),
-    "id-GostR3410-2001-CryptoPro-C-ParamSet": GOST3410Curve(
+    "id-tc26-gost-3410-12-256-paramSetD": GOST3410Curve(
         p=bytes2long(hexdec("9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B")),
         q=bytes2long(hexdec("9B9F605F5A858107AB1EC85E6B41C8AA582CA3511EDDFB74F02F3A6598980BB9")),
         a=bytes2long(hexdec("9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D7598")),
@@ -158,17 +187,7 @@ CURVES = {
         x=bytes2long(hexdec("0000000000000000000000000000000000000000000000000000000000000000")),
         y=bytes2long(hexdec("41ECE55743711A8C3CBF3783CD08C0EE4D4DC440D4641A8F366E550DFDB3BB67")),
     ),
-    "id-tc26-gost-3410-2012-256-paramSetA": GOST3410Curve(
-        p=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97")),
-        q=bytes2long(hexdec("400000000000000000000000000000000FD8CDDFC87B6635C115AF556C360C67")),
-        a=bytes2long(hexdec("C2173F1513981673AF4892C23035A27CE25E2013BF95AA33B22C656F277E7335")),
-        b=bytes2long(hexdec("295F9BAE7428ED9CCC20E7C359A9D41A22FCCD9108E17BF7BA9337A6F8AE9513")),
-        x=bytes2long(hexdec("91E38443A5E82C0D880923425712B2BB658B9196932E02C78B2582FE742DAA28")),
-        y=bytes2long(hexdec("32879423AB1A0375895786C4BB46E9565FDE0B5344766740AF268ADB32322E5C")),
-        e=0x01,
-        d=bytes2long(hexdec("0605F6B7C183FA81578BC39CFAD518132B9DF62897009AF7E522C32D6DC7BFFB")),
-    ),
-    "id-tc26-gost-3410-2012-512-paramSetTest": GOST3410Curve(
+    "id-tc26-gost-3410-12-512-paramSetTest": GOST3410Curve(
         p=bytes2long(hexdec("4531ACD1FE0023C7550D267B6B2FEE80922B14B2FFB90F04D4EB7C09B5D2D15DF1D852741AF4704A0458047E80E4546D35B8336FAC224DD81664BBF528BE6373")),
         q=bytes2long(hexdec("4531ACD1FE0023C7550D267B6B2FEE80922B14B2FFB90F04D4EB7C09B5D2D15DA82F2D7ECB1DBAC719905C5EECC423F1D86E25EDBE23C595D644AAF187E6E6DF")),
         a=7,
@@ -192,27 +211,38 @@ CURVES = {
         x=bytes2long(hexdec("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002")),
         y=bytes2long(hexdec("1A8F7EDA389B094C2C071E3647A8940F3C123B697578C213BE6DD9E6C8EC7335DCB228FD1EDF4A39152CBCAAF8C0398828041055F94CEEEC7E21340780FE41BD")),
     ),
-    "id-tc26-gost-3410-2012-512-paramSetC": GOST3410Curve(
+    "id-tc26-gost-3410-12-512-paramSetC": GOST3410Curve(
         p=bytes2long(hexdec("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7")),
         q=bytes2long(hexdec("3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC98CDBA46506AB004C33A9FF5147502CC8EDA9E7A769A12694623CEF47F023ED")),
         a=bytes2long(hexdec("DC9203E514A721875485A529D2C722FB187BC8980EB866644DE41C68E143064546E861C0E2C9EDD92ADE71F46FCF50FF2AD97F951FDA9F2A2EB6546F39689BD3")),
         b=bytes2long(hexdec("B4C4EE28CEBC6C2C8AC12952CF37F16AC7EFB6A9F69F4B57FFDA2E4F0DE5ADE038CBC2FFF719D2C18DE0284B8BFEF3B52B8CC7A5F5BF0A3C8D2319A5312557E1")),
         x=bytes2long(hexdec("E2E31EDFC23DE7BDEBE241CE593EF5DE2295B7A9CBAEF021D385F7074CEA043AA27272A7AE602BF2A7B9033DB9ED3610C6FB85487EAE97AAC5BC7928C1950148")),
         y=bytes2long(hexdec("F5CE40D95B5EB899ABBCCFF5911CB8577939804D6527378B8C108C3D2090FF9BE18E2D33E3021ED2EF32D85822423B6304F726AA854BAE07D0396E9A9ADDC40F")),
+        cofactor=4,
         e=0x01,
         d=bytes2long(hexdec("9E4F5D8C017D8D9F13A5CF3CDF5BFE4DAB402D54198E31EBDE28A0621050439CA6B39E0A515C06B304E2CE43E79E369E91A0CFC2BC2A22B4CA302DBB33EE7550")),
     ),
 }
+CURVES["id-GostR3410-2001-CryptoPro-A-ParamSet"] = CURVES["id-tc26-gost-3410-12-256-paramSetB"]
+CURVES["id-GostR3410-2001-CryptoPro-B-ParamSet"] = CURVES["id-tc26-gost-3410-12-256-paramSetC"]
+CURVES["id-GostR3410-2001-CryptoPro-C-ParamSet"] = CURVES["id-tc26-gost-3410-12-256-paramSetD"]
 CURVES["id-GostR3410-2001-CryptoPro-XchA-ParamSet"] = CURVES["id-GostR3410-2001-CryptoPro-A-ParamSet"]
 CURVES["id-GostR3410-2001-CryptoPro-XchB-ParamSet"] = CURVES["id-GostR3410-2001-CryptoPro-C-ParamSet"]
-CURVES["id-tc26-gost-3410-2012-256-paramSetB"] = CURVES["id-GostR3410-2001-CryptoPro-A-ParamSet"]
-CURVES["id-tc26-gost-3410-2012-256-paramSetC"] = CURVES["id-GostR3410-2001-CryptoPro-B-ParamSet"]
-CURVES["id-tc26-gost-3410-2012-256-paramSetD"] = CURVES["id-GostR3410-2001-CryptoPro-C-ParamSet"]
-DEFAULT_CURVE = CURVES["id-GostR3410-2001-CryptoPro-A-ParamSet"]
+CURVES["id-tc26-gost-3410-2012-256-paramSetA"] = CURVES["id-tc26-gost-3410-12-256-paramSetA"]
+CURVES["id-tc26-gost-3410-2012-256-paramSetB"] = CURVES["id-tc26-gost-3410-12-256-paramSetB"]
+CURVES["id-tc26-gost-3410-2012-256-paramSetC"] = CURVES["id-tc26-gost-3410-12-256-paramSetC"]
+CURVES["id-tc26-gost-3410-2012-256-paramSetD"] = CURVES["id-tc26-gost-3410-12-256-paramSetD"]
+CURVES["id-tc26-gost-3410-2012-512-paramSetTest"] = CURVES["id-tc26-gost-3410-12-512-paramSetTest"]
+CURVES["id-tc26-gost-3410-2012-512-paramSetA"] = CURVES["id-tc26-gost-3410-12-512-paramSetA"]
+CURVES["id-tc26-gost-3410-2012-512-paramSetB"] = CURVES["id-tc26-gost-3410-12-512-paramSetB"]
+CURVES["id-tc26-gost-3410-2012-512-paramSetC"] = CURVES["id-tc26-gost-3410-12-512-paramSetC"]
+for _name, _curve in CURVES.items():
+    _curve.name = _name
+DEFAULT_CURVE = CURVES["id-tc26-gost-3410-12-256-paramSetB"]
 
 
 def public_key(curve, prv):
-    """ Generate public key from the private one
+    """Generate public key from the private one
 
     :param GOST3410Curve curve: curve to use
     :param long prv: private key
@@ -222,8 +252,8 @@ def public_key(curve, prv):
     return curve.exp(prv)
 
 
-def sign(curve, prv, digest, rand=None, mode=2001):
-    """ Calculate signature for provided digest
+def sign(curve, prv, digest, rand=None):
+    """Calculate signature for provided digest
 
     :param GOST3410Curve curve: curve to use
     :param long prv: private key
@@ -231,10 +261,10 @@ def sign(curve, prv, digest, rand=None, mode=2001):
     :type digest: bytes, 32 or 64 bytes
     :param rand: optional predefined random data used for k/r generation
     :type rand: bytes, 32 or 64 bytes
-    :returns: signature
+    :returns: signature, BE(S) || BE(R)
     :rtype: bytes, 64 or 128 bytes
     """
-    size = MODE2SIZE[mode]
+    size = curve.point_size
     q = curve.q
     e = bytes2long(digest) % q
     if e == 0:
@@ -260,8 +290,8 @@ def sign(curve, prv, digest, rand=None, mode=2001):
     return long2bytes(s, size) + long2bytes(r, size)
 
 
-def verify(curve, pub, digest, signature, mode=2001):
-    """ Verify provided digest with the signature
+def verify(curve, pub, digest, signature):
+    """Verify provided digest with the signature
 
     :param GOST3410Curve curve: curve to use
     :type pub: (long, long)
@@ -271,7 +301,7 @@ def verify(curve, pub, digest, signature, mode=2001):
     :type signature: bytes, 64 or 128 bytes
     :rtype: bool
     """
-    size = MODE2SIZE[mode]
+    size = curve.point_size
     if len(signature) != size * 2:
         raise ValueError("Invalid signature length")
     q = curve.q
@@ -305,31 +335,49 @@ def verify(curve, pub, digest, signature, mode=2001):
 
 
 def prv_unmarshal(prv):
-    """Unmarshal private key
+    """Unmarshal little-endian private key
 
     :param bytes prv: serialized private key
     :rtype: long
+
+    It is advisable to use :py:func:`pygost.gost3410.prv_marshal` to
+    assure that key i in curve's Q field for better compatibility with
+    some implementations.
     """
     return bytes2long(prv[::-1])
 
 
-def pub_marshal(pub, mode=2001):
+def prv_marshal(curve, prv):
+    """Marshal little-endian private key
+
+    :param GOST3410Curve curve: curve to use
+    :param long prv: serialized private key
+    :rtype: bytes
+
+    Key is in curve's Q field.
+    """
+    return long2bytes(prv % curve.q, point_size(prv))[::-1]
+
+
+def pub_marshal(pub):
     """Marshal public key
 
     :type pub: (long, long)
     :rtype: bytes
+    :returns: LE(X) || LE(Y)
     """
-    size = MODE2SIZE[mode]
+    size = point_size(pub[0])
     return (long2bytes(pub[1], size) + long2bytes(pub[0], size))[::-1]
 
 
-def pub_unmarshal(pub, mode=2001):
+def pub_unmarshal(pub):
     """Unmarshal public key
 
+    :param pub: LE(X) || LE(Y)
     :type pub: bytes
     :rtype: (long, long)
     """
-    size = MODE2SIZE[mode]
+    size = len(pub) // 2
     pub = pub[::-1]
     return (bytes2long(pub[size:]), bytes2long(pub[:size]))