curve.hpp

Go to the documentation of this file.

// Copyright (c) 2026 Judica, Inc.
// Distributed under the MIT software license, see the accompanying
// file COPYING or https://opensource.org/license/mit/.
 
#pragma once
 
#include "purify/numeric.hpp"
 
namespace purify {
 
struct JacobianPoint {
    FieldElement x;
    FieldElement y;
    FieldElement z;
    bool infinity = false;
 
    static JacobianPoint infinity_point();
};
 
struct AffinePoint {
    FieldElement x;
    FieldElement y;
    bool infinity = false;
};
 
struct CompleteProjectivePoint {
    FieldElement x;
    FieldElement y;
    FieldElement z;
};
 
class EllipticCurve {
public:
    EllipticCurve(FieldElement a, FieldElement b, UInt256 n);
 
    const UInt256& order() const {
        return n_;
    }
 
    AffinePoint affine(const JacobianPoint& point) const;
 
    JacobianPoint negate(const JacobianPoint& point) const;
 
    bool is_x_coord(const FieldElement& x) const;
 
    std::optional<JacobianPoint> lift_x(const FieldElement& x) const;
 
    JacobianPoint double_point(const JacobianPoint& point) const;
 
    JacobianPoint add_mixed(const JacobianPoint& lhs, const AffinePoint& rhs) const;
 
    JacobianPoint add(const JacobianPoint& lhs, const JacobianPoint& rhs) const;
 
    JacobianPoint mul(const JacobianPoint& point, const UInt256& scalar) const;
 
    Result<AffinePoint> mul_secret_affine(const JacobianPoint& point, const UInt256& scalar) const;
 
    FieldElement a_;
    FieldElement b_;
    UInt256 n_;
};
 
Bytes bytes_from_ascii(std::string_view input);
 
Bytes operator+(Bytes lhs, const Bytes& rhs);
 
std::uint64_t ceil_div(std::uint64_t lhs, std::uint64_t rhs);
 
Bytes hmac_sha256(const Bytes& key, const Bytes& data);
 
class TaggedHash {
public:
    explicit TaggedHash(std::string_view tag) {
        purify_sha256(tag_hash_.data(), reinterpret_cast<const unsigned char*>(tag.data()), tag.size());
    }
 
    [[nodiscard]] std::array<unsigned char, 32> digest(std::span<const unsigned char> data) const {
        return digest_many<1>({data});
    }
 
    template <std::size_t Segments>
    [[nodiscard]] std::array<unsigned char, 32>
    digest_many(const std::array<std::span<const unsigned char>, Segments>& segments) const {
        std::array<unsigned char, 32> out{};
        std::array<const unsigned char*, Segments + 2> items{};
        std::array<size_t, Segments + 2> item_lens{};
        items[0] = tag_hash_.data();
        item_lens[0] = tag_hash_.size();
        items[1] = tag_hash_.data();
        item_lens[1] = tag_hash_.size();
        for (std::size_t i = 0; i < Segments; ++i) {
            items[i + 2] = segments[i].empty() ? nullptr : segments[i].data();
            item_lens[i + 2] = segments[i].size();
        }
        int ok = purify_sha256_many(out.data(), items.data(), item_lens.data(), items.size());
        assert(ok != 0 && "TaggedHash::digest_many() must accept well-formed segments");
        (void)ok;
        return out;
    }
 
private:
    std::array<unsigned char, 32> tag_hash_{};
};
 
Bytes hkdf(std::size_t length, const Bytes& ikm, const Bytes& salt = {}, const Bytes& info = {});
 
template <std::size_t Words>
std::optional<BigUInt<Words>> hash_to_int(const Bytes& data, const BigUInt<Words>& range, const Bytes& info = {}) {
    std::size_t bits = range.bit_length();
    for (int i = 0; i < 256; ++i) {
        Bytes salt{static_cast<unsigned char>(i)};
        Bytes derived = hkdf((bits + 7) / 8, data, salt, info);
        BigUInt<Words> value = BigUInt<Words>::from_bytes_be(derived.data(), derived.size());
        value.mask_bits(bits);
        if (value.compare(range) < 0) {
            return value;
        }
    }
    return std::nullopt;
}
 
template <std::size_t Words>
std::optional<BigUInt<Words>> tagged_hash_to_int(std::span<const unsigned char> data, const BigUInt<Words>& range,
                                                 const TaggedHash& tag, std::span<const unsigned char> info = {}) {
    std::size_t bits = range.bit_length();
    std::size_t bytes_needed = (bits + 7) / 8;
    for (std::uint64_t attempt = 0; attempt < 256; ++attempt) {
        Bytes derived;
        derived.reserve(bytes_needed);
        std::array<unsigned char, 8> attempt_bytes{};
        for (std::size_t i = 0; i < attempt_bytes.size(); ++i) {
            attempt_bytes[attempt_bytes.size() - 1 - i] = static_cast<unsigned char>((attempt >> (8 * i)) & 0xffU);
        }
        for (std::uint64_t block = 0; derived.size() < bytes_needed; ++block) {
            std::array<unsigned char, 8> block_bytes{};
            for (std::size_t i = 0; i < block_bytes.size(); ++i) {
                block_bytes[block_bytes.size() - 1 - i] = static_cast<unsigned char>((block >> (8 * i)) & 0xffU);
            }
            std::array digest_segments{
                data,
                info,
                std::span<const unsigned char>(attempt_bytes.data(), attempt_bytes.size()),
                std::span<const unsigned char>(block_bytes.data(), block_bytes.size()),
            };
            std::array<unsigned char, 32> digest = tag.digest_many(digest_segments);
            std::size_t copy_len = std::min<std::size_t>(digest.size(), bytes_needed - derived.size());
            derived.insert(derived.end(), digest.begin(), digest.begin() + static_cast<std::ptrdiff_t>(copy_len));
        }
        BigUInt<Words> value = BigUInt<Words>::from_bytes_be(derived.data(), derived.size());
        value.mask_bits(bits);
        if (value.compare(range) < 0) {
            return value;
        }
    }
    return std::nullopt;
}
 
const UInt256& order_n1();
 
const UInt256& order_n2();
 
const UInt256& half_n1();
 
const UInt256& half_n2();
 
const UInt512& packed_secret_key_space_size();
 
const UInt512& packed_public_key_space_size();
 
const UInt320& two_p();
 
FieldElement field_a();
 
FieldElement field_b();
 
FieldElement field_d();
 
FieldElement field_di();
 
const EllipticCurve& curve1();
 
const EllipticCurve& curve2();
 
Result<JacobianPoint> hash_to_curve(const Bytes& data, const EllipticCurve& curve);
 
const JacobianPoint& generator1();
 
const JacobianPoint& generator2();
 
bool is_valid_secret_key(const UInt512& z);
 
bool is_valid_public_key(const UInt512& packed);
 
Status validate_secret_key(const UInt512& z);
 
Status validate_public_key(const UInt512& packed);
 
Result<std::pair<UInt256, UInt256>> unpack_secret(const UInt512& z);
 
Result<std::pair<UInt256, UInt256>> unpack_public(const UInt512& packed);
 
UInt512 pack_public(const UInt256& x1, const UInt256& x2);
 
FieldElement combine(const FieldElement& x1, const FieldElement& x2);
 
Result<std::vector<int>> key_to_bits(UInt256 n, const UInt256& max_value);
 
}  // namespace purify