This repository has been archived by the owner on Sep 8, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 122
/
hash2field.go
107 lines (96 loc) · 2.93 KB
/
hash2field.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
package native
import (
"hash"
"golang.org/x/crypto/sha3"
)
// OversizeDstSalt is the salt used to hash a dst over MaxDstLen
var OversizeDstSalt = []byte("H2C-OVERSIZE-DST-")
// MaxDstLen the max size for dst in hash to curve
const MaxDstLen = 255
func getDomainXmd(h hash.Hash, domain []byte) []byte {
var out []byte
if len(domain) > MaxDstLen {
h.Reset()
_, _ = h.Write(OversizeDstSalt)
_, _ = h.Write(domain)
out = h.Sum(nil)
} else {
out = domain
}
return out
}
func getDomainXof(h sha3.ShakeHash, domain []byte) []byte {
var out []byte
if len(domain) > MaxDstLen {
h.Reset()
_, _ = h.Write(OversizeDstSalt)
_, _ = h.Write(domain)
var tv [64]byte
_, _ = h.Read(tv[:])
out = tv[:]
} else {
out = domain
}
return out
}
// ExpandMsgXmd expands the msg with the domain to output a byte array
// with outLen in size using a fixed size hash.
// See https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-13#section-5.4.1
func ExpandMsgXmd(h *EllipticPointHasher, msg, domain []byte, outLen int) []byte {
domain = getDomainXmd(h.xmd, domain)
domainLen := byte(len(domain))
h.xmd.Reset()
// DST_prime = DST || I2OSP(len(DST), 1)
// b_0 = H(Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime)
_, _ = h.xmd.Write(make([]byte, h.xmd.BlockSize()))
_, _ = h.xmd.Write(msg)
_, _ = h.xmd.Write([]byte{uint8(outLen >> 8), uint8(outLen)})
_, _ = h.xmd.Write([]byte{0})
_, _ = h.xmd.Write(domain)
_, _ = h.xmd.Write([]byte{domainLen})
b0 := h.xmd.Sum(nil)
// b_1 = H(b_0 || I2OSP(1, 1) || DST_prime)
h.xmd.Reset()
_, _ = h.xmd.Write(b0)
_, _ = h.xmd.Write([]byte{1})
_, _ = h.xmd.Write(domain)
_, _ = h.xmd.Write([]byte{domainLen})
b1 := h.xmd.Sum(nil)
// b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime)
ell := (outLen + h.xmd.Size() - 1) / h.xmd.Size()
bi := b1
out := make([]byte, outLen)
for i := 1; i < ell; i++ {
h.xmd.Reset()
// b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime)
tmp := make([]byte, h.xmd.Size())
for j := 0; j < h.xmd.Size(); j++ {
tmp[j] = b0[j] ^ bi[j]
}
_, _ = h.xmd.Write(tmp)
_, _ = h.xmd.Write([]byte{1 + uint8(i)})
_, _ = h.xmd.Write(domain)
_, _ = h.xmd.Write([]byte{domainLen})
// b_1 || ... || b_(ell - 1)
copy(out[(i-1)*h.xmd.Size():i*h.xmd.Size()], bi[:])
bi = h.xmd.Sum(nil)
}
// b_ell
copy(out[(ell-1)*h.xmd.Size():], bi[:])
return out[:outLen]
}
// ExpandMsgXof expands the msg with the domain to output a byte array
// with outLen in size using a xof hash
// See https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-13#section-5.4.2
func ExpandMsgXof(h *EllipticPointHasher, msg, domain []byte, outLen int) []byte {
domain = getDomainXof(h.xof, domain)
domainLen := byte(len(domain))
h.xof.Reset()
_, _ = h.xof.Write(msg)
_, _ = h.xof.Write([]byte{uint8(outLen >> 8), uint8(outLen)})
_, _ = h.xof.Write(domain)
_, _ = h.xof.Write([]byte{domainLen})
out := make([]byte, outLen)
_, _ = h.xof.Read(out)
return out
}