libsodium_crypto_core_ed25519 (libsodium v3.0.1)
View SourceLow-level arithmetic on the edwards25519 curve and on scalars modulo its prime group order L, for building custom protocols.
Points are bytes/0 byte compressed encodings and scalars are
scalarbytes/0 byte little-endian integers. is_valid_point/1 accepts
only canonical encodings of points on the main subgroup; add/2 and
sub/2 only reject encodings that are not on the curve, so check
untrusted input first. Scalars are used as given: there is no clamping,
unlike libsodium_crypto_scalarmult_ed25519.
scalar_reduce/1 reduces a nonreducedscalarbytes/0 byte value modulo
L, and from_uniform/1 maps uniformbytes/0 bytes (such as a hash) to a
point. Prefer libsodium_crypto_core_ristretto255 for new protocols, as
it avoids the cofactor pitfalls of edwards25519.
P = libsodium_crypto_core_ed25519:random(),
Q = libsodium_crypto_core_ed25519:random(),
1 = libsodium_crypto_core_ed25519:is_valid_point(P),
R = libsodium_crypto_core_ed25519:add(P, Q),
P = libsodium_crypto_core_ed25519:sub(R, Q),
S = libsodium_crypto_core_ed25519:scalar_random(),
One = libsodium_crypto_core_ed25519:scalar_mul(S, libsodium_crypto_core_ed25519:scalar_invert(S)),
One = <<1, 0:248>>.Summary
Types
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_HASHBYTES (64-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_NONREDUCEDSCALARBYTES (64-byte) binary.
A crypto_core_ed25519_BYTES (32-byte) binary.
A crypto_core_ed25519_BYTES (32-byte) binary.
A crypto_core_ed25519_BYTES (32-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
Functions
Return the point P + Q, or -1 when either input is not a point on the curve.
Return crypto_core_ed25519_bytes(), in bytes.
Map the hashbytes/0 byte string H to a point. Deprecated and
undocumented by libsodium; use from_uniform/1 instead.
Map the uniformbytes/0 byte string R (such as the output of a hash
function) to a point on the main subgroup using Elligator 2.
Return crypto_core_ed25519_hashbytes(), in bytes.
Return 1 when P is the canonical encoding of a point on the main
subgroup (excluding small-order points), otherwise 0.
Return crypto_core_ed25519_nonreducedscalarbytes(), in bytes.
Return a random point on the main subgroup.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
Return a random scalar in [0, L).
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
Return crypto_core_ed25519_scalarbytes(), in bytes.
Return the point P - Q, or -1 when either input is not a point on the curve.
Return crypto_core_ed25519_uniformbytes(), in bytes.
Types
-type comp() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type h() :: <<_:512>>.
A crypto_core_ed25519_HASHBYTES (64-byte) binary.
-type neg() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type nonreduced_scalar() :: <<_:512>>.
A crypto_core_ed25519_NONREDUCEDSCALARBYTES (64-byte) binary.
-type p() :: <<_:256>>.
A crypto_core_ed25519_BYTES (32-byte) binary.
-type q() :: <<_:256>>.
A crypto_core_ed25519_BYTES (32-byte) binary.
-type r() :: <<_:256>>.
A crypto_core_ed25519_BYTES (32-byte) binary.
-type recip() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type s() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type x() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type y() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
-type z() :: <<_:256>>.
A crypto_core_ed25519_SCALARBYTES (32-byte) binary.
Functions
Return the point P + Q, or -1 when either input is not a point on the curve.
-spec bytes() -> Result when Result :: 32.
Return crypto_core_ed25519_bytes(), in bytes.
Map the hashbytes/0 byte string H to a point. Deprecated and
undocumented by libsodium; use from_uniform/1 instead.
Map the uniformbytes/0 byte string R (such as the output of a hash
function) to a point on the main subgroup using Elligator 2.
-spec hashbytes() -> Result when Result :: 64.
Return crypto_core_ed25519_hashbytes(), in bytes.
-spec is_valid_point(P) -> Result when P :: p(), Result :: 0 | 1.
Return 1 when P is the canonical encoding of a point on the main
subgroup (excluding small-order points), otherwise 0.
-spec nonreducedscalarbytes() -> Result when Result :: 64.
Return crypto_core_ed25519_nonreducedscalarbytes(), in bytes.
-spec random() -> Result when Result :: p().
Return a random point on the main subgroup.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
-spec scalar_random() -> Result when Result :: r().
Return a random scalar in [0, L).
-spec scalar_reduce(S) -> Result when S :: nonreduced_scalar(), Result :: r().
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
-spec scalarbytes() -> Result when Result :: 32.
Return crypto_core_ed25519_scalarbytes(), in bytes.
Return the point P - Q, or -1 when either input is not a point on the curve.
-spec uniformbytes() -> Result when Result :: 32.
Return crypto_core_ed25519_uniformbytes(), in bytes.