834 lines
15 KiB
JavaScript
834 lines
15 KiB
JavaScript
'use strict';
|
|
|
|
const PluginAuth = require('./plugin-auth');
|
|
const Crypto = require('crypto');
|
|
|
|
/**
|
|
* Standard authentication plugin
|
|
*/
|
|
class Ed25519PasswordAuth extends PluginAuth {
|
|
constructor(packSeq, compressPackSeq, pluginData, resolve, reject, multiAuthResolver) {
|
|
super(resolve, reject, multiAuthResolver);
|
|
this.pluginData = pluginData;
|
|
this.sequenceNo = packSeq;
|
|
}
|
|
|
|
start(out, opts, info) {
|
|
//seed is ended with a null byte value.
|
|
const data = this.pluginData;
|
|
|
|
const sign = Ed25519PasswordAuth.encryptPassword(opts.password, data);
|
|
out.startPacket(this);
|
|
out.writeBuffer(sign, 0, sign.length);
|
|
out.flushBuffer(true);
|
|
this.emit('send_end');
|
|
this.onPacketReceive = this.successSend;
|
|
}
|
|
|
|
static encryptPassword(password, seed) {
|
|
if (!password) return Buffer.alloc(0);
|
|
|
|
let i, j;
|
|
let p = [gf(), gf(), gf(), gf()];
|
|
const signedMsg = Buffer.alloc(96);
|
|
const bytePwd = Buffer.from(password);
|
|
|
|
let hash = Crypto.createHash('sha512');
|
|
const d = hash.update(bytePwd).digest();
|
|
d[0] &= 248;
|
|
d[31] &= 127;
|
|
d[31] |= 64;
|
|
|
|
for (i = 0; i < 32; i++) signedMsg[64 + i] = seed[i];
|
|
for (i = 0; i < 32; i++) signedMsg[32 + i] = d[32 + i];
|
|
|
|
hash = Crypto.createHash('sha512');
|
|
const r = hash.update(signedMsg.slice(32, 96)).digest();
|
|
|
|
reduce(r);
|
|
scalarbase(p, r);
|
|
pack(signedMsg, p);
|
|
|
|
p = [gf(), gf(), gf(), gf()];
|
|
|
|
scalarbase(p, d);
|
|
const tt = Buffer.alloc(32);
|
|
pack(tt, p);
|
|
|
|
for (i = 32; i < 64; i++) signedMsg[i] = tt[i - 32];
|
|
|
|
hash = Crypto.createHash('sha512');
|
|
const h = hash.update(signedMsg).digest();
|
|
|
|
reduce(h);
|
|
|
|
const x = new Float64Array(64);
|
|
for (i = 0; i < 64; i++) x[i] = 0;
|
|
for (i = 0; i < 32; i++) x[i] = r[i];
|
|
for (i = 0; i < 32; i++) {
|
|
for (j = 0; j < 32; j++) {
|
|
x[i + j] += h[i] * d[j];
|
|
}
|
|
}
|
|
|
|
modL(signedMsg.subarray(32), x);
|
|
|
|
return signedMsg.slice(0, 64);
|
|
}
|
|
}
|
|
|
|
/*******************************************************
|
|
*
|
|
* This plugin uses the following public domain tweetnacl-js code by Dmitry Chestnykh (from https://github.com/dchest/tweetnacl-js/blob/master/nacl-fast.js).
|
|
* tweetnacl cannot be used directly (secret key mandatory size is 32 in nacl + implementation differ : second scalarbase use hash of secret key, not secret key).
|
|
*
|
|
*******************************************************/
|
|
|
|
const gf = function (init) {
|
|
const r = new Float64Array(16);
|
|
if (init) for (let i = 0; i < init.length; i++) r[i] = init[i];
|
|
return r;
|
|
};
|
|
|
|
const gf0 = gf(),
|
|
gf1 = gf([1]),
|
|
D2 = gf([
|
|
0xf159,
|
|
0x26b2,
|
|
0x9b94,
|
|
0xebd6,
|
|
0xb156,
|
|
0x8283,
|
|
0x149a,
|
|
0x00e0,
|
|
0xd130,
|
|
0xeef3,
|
|
0x80f2,
|
|
0x198e,
|
|
0xfce7,
|
|
0x56df,
|
|
0xd9dc,
|
|
0x2406
|
|
]),
|
|
X = gf([
|
|
0xd51a,
|
|
0x8f25,
|
|
0x2d60,
|
|
0xc956,
|
|
0xa7b2,
|
|
0x9525,
|
|
0xc760,
|
|
0x692c,
|
|
0xdc5c,
|
|
0xfdd6,
|
|
0xe231,
|
|
0xc0a4,
|
|
0x53fe,
|
|
0xcd6e,
|
|
0x36d3,
|
|
0x2169
|
|
]),
|
|
Y = gf([
|
|
0x6658,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666,
|
|
0x6666
|
|
]);
|
|
|
|
const L = new Float64Array([
|
|
0xed,
|
|
0xd3,
|
|
0xf5,
|
|
0x5c,
|
|
0x1a,
|
|
0x63,
|
|
0x12,
|
|
0x58,
|
|
0xd6,
|
|
0x9c,
|
|
0xf7,
|
|
0xa2,
|
|
0xde,
|
|
0xf9,
|
|
0xde,
|
|
0x14,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
0x10
|
|
]);
|
|
|
|
function reduce(r) {
|
|
const x = new Float64Array(64);
|
|
let i;
|
|
for (i = 0; i < 64; i++) x[i] = r[i];
|
|
for (i = 0; i < 64; i++) r[i] = 0;
|
|
modL(r, x);
|
|
}
|
|
|
|
function modL(r, x) {
|
|
let carry, i, j, k;
|
|
for (i = 63; i >= 32; --i) {
|
|
carry = 0;
|
|
for (j = i - 32, k = i - 12; j < k; ++j) {
|
|
x[j] += carry - 16 * x[i] * L[j - (i - 32)];
|
|
carry = (x[j] + 128) >> 8;
|
|
x[j] -= carry * 256;
|
|
}
|
|
x[j] += carry;
|
|
x[i] = 0;
|
|
}
|
|
carry = 0;
|
|
for (j = 0; j < 32; j++) {
|
|
x[j] += carry - (x[31] >> 4) * L[j];
|
|
carry = x[j] >> 8;
|
|
x[j] &= 255;
|
|
}
|
|
for (j = 0; j < 32; j++) x[j] -= carry * L[j];
|
|
for (i = 0; i < 32; i++) {
|
|
x[i + 1] += x[i] >> 8;
|
|
r[i] = x[i] & 255;
|
|
}
|
|
}
|
|
|
|
function scalarbase(p, s) {
|
|
const q = [gf(), gf(), gf(), gf()];
|
|
set25519(q[0], X);
|
|
set25519(q[1], Y);
|
|
set25519(q[2], gf1);
|
|
M(q[3], X, Y);
|
|
scalarmult(p, q, s);
|
|
}
|
|
|
|
function set25519(r, a) {
|
|
for (let i = 0; i < 16; i++) r[i] = a[i] | 0;
|
|
}
|
|
|
|
function M(o, a, b) {
|
|
let v,
|
|
c,
|
|
t0 = 0,
|
|
t1 = 0,
|
|
t2 = 0,
|
|
t3 = 0,
|
|
t4 = 0,
|
|
t5 = 0,
|
|
t6 = 0,
|
|
t7 = 0,
|
|
t8 = 0,
|
|
t9 = 0,
|
|
t10 = 0,
|
|
t11 = 0,
|
|
t12 = 0,
|
|
t13 = 0,
|
|
t14 = 0,
|
|
t15 = 0,
|
|
t16 = 0,
|
|
t17 = 0,
|
|
t18 = 0,
|
|
t19 = 0,
|
|
t20 = 0,
|
|
t21 = 0,
|
|
t22 = 0,
|
|
t23 = 0,
|
|
t24 = 0,
|
|
t25 = 0,
|
|
t26 = 0,
|
|
t27 = 0,
|
|
t28 = 0,
|
|
t29 = 0,
|
|
t30 = 0;
|
|
const b0 = b[0],
|
|
b1 = b[1],
|
|
b2 = b[2],
|
|
b3 = b[3],
|
|
b4 = b[4],
|
|
b5 = b[5],
|
|
b6 = b[6],
|
|
b7 = b[7],
|
|
b8 = b[8],
|
|
b9 = b[9],
|
|
b10 = b[10],
|
|
b11 = b[11],
|
|
b12 = b[12],
|
|
b13 = b[13],
|
|
b14 = b[14],
|
|
b15 = b[15];
|
|
|
|
v = a[0];
|
|
t0 += v * b0;
|
|
t1 += v * b1;
|
|
t2 += v * b2;
|
|
t3 += v * b3;
|
|
t4 += v * b4;
|
|
t5 += v * b5;
|
|
t6 += v * b6;
|
|
t7 += v * b7;
|
|
t8 += v * b8;
|
|
t9 += v * b9;
|
|
t10 += v * b10;
|
|
t11 += v * b11;
|
|
t12 += v * b12;
|
|
t13 += v * b13;
|
|
t14 += v * b14;
|
|
t15 += v * b15;
|
|
v = a[1];
|
|
t1 += v * b0;
|
|
t2 += v * b1;
|
|
t3 += v * b2;
|
|
t4 += v * b3;
|
|
t5 += v * b4;
|
|
t6 += v * b5;
|
|
t7 += v * b6;
|
|
t8 += v * b7;
|
|
t9 += v * b8;
|
|
t10 += v * b9;
|
|
t11 += v * b10;
|
|
t12 += v * b11;
|
|
t13 += v * b12;
|
|
t14 += v * b13;
|
|
t15 += v * b14;
|
|
t16 += v * b15;
|
|
v = a[2];
|
|
t2 += v * b0;
|
|
t3 += v * b1;
|
|
t4 += v * b2;
|
|
t5 += v * b3;
|
|
t6 += v * b4;
|
|
t7 += v * b5;
|
|
t8 += v * b6;
|
|
t9 += v * b7;
|
|
t10 += v * b8;
|
|
t11 += v * b9;
|
|
t12 += v * b10;
|
|
t13 += v * b11;
|
|
t14 += v * b12;
|
|
t15 += v * b13;
|
|
t16 += v * b14;
|
|
t17 += v * b15;
|
|
v = a[3];
|
|
t3 += v * b0;
|
|
t4 += v * b1;
|
|
t5 += v * b2;
|
|
t6 += v * b3;
|
|
t7 += v * b4;
|
|
t8 += v * b5;
|
|
t9 += v * b6;
|
|
t10 += v * b7;
|
|
t11 += v * b8;
|
|
t12 += v * b9;
|
|
t13 += v * b10;
|
|
t14 += v * b11;
|
|
t15 += v * b12;
|
|
t16 += v * b13;
|
|
t17 += v * b14;
|
|
t18 += v * b15;
|
|
v = a[4];
|
|
t4 += v * b0;
|
|
t5 += v * b1;
|
|
t6 += v * b2;
|
|
t7 += v * b3;
|
|
t8 += v * b4;
|
|
t9 += v * b5;
|
|
t10 += v * b6;
|
|
t11 += v * b7;
|
|
t12 += v * b8;
|
|
t13 += v * b9;
|
|
t14 += v * b10;
|
|
t15 += v * b11;
|
|
t16 += v * b12;
|
|
t17 += v * b13;
|
|
t18 += v * b14;
|
|
t19 += v * b15;
|
|
v = a[5];
|
|
t5 += v * b0;
|
|
t6 += v * b1;
|
|
t7 += v * b2;
|
|
t8 += v * b3;
|
|
t9 += v * b4;
|
|
t10 += v * b5;
|
|
t11 += v * b6;
|
|
t12 += v * b7;
|
|
t13 += v * b8;
|
|
t14 += v * b9;
|
|
t15 += v * b10;
|
|
t16 += v * b11;
|
|
t17 += v * b12;
|
|
t18 += v * b13;
|
|
t19 += v * b14;
|
|
t20 += v * b15;
|
|
v = a[6];
|
|
t6 += v * b0;
|
|
t7 += v * b1;
|
|
t8 += v * b2;
|
|
t9 += v * b3;
|
|
t10 += v * b4;
|
|
t11 += v * b5;
|
|
t12 += v * b6;
|
|
t13 += v * b7;
|
|
t14 += v * b8;
|
|
t15 += v * b9;
|
|
t16 += v * b10;
|
|
t17 += v * b11;
|
|
t18 += v * b12;
|
|
t19 += v * b13;
|
|
t20 += v * b14;
|
|
t21 += v * b15;
|
|
v = a[7];
|
|
t7 += v * b0;
|
|
t8 += v * b1;
|
|
t9 += v * b2;
|
|
t10 += v * b3;
|
|
t11 += v * b4;
|
|
t12 += v * b5;
|
|
t13 += v * b6;
|
|
t14 += v * b7;
|
|
t15 += v * b8;
|
|
t16 += v * b9;
|
|
t17 += v * b10;
|
|
t18 += v * b11;
|
|
t19 += v * b12;
|
|
t20 += v * b13;
|
|
t21 += v * b14;
|
|
t22 += v * b15;
|
|
v = a[8];
|
|
t8 += v * b0;
|
|
t9 += v * b1;
|
|
t10 += v * b2;
|
|
t11 += v * b3;
|
|
t12 += v * b4;
|
|
t13 += v * b5;
|
|
t14 += v * b6;
|
|
t15 += v * b7;
|
|
t16 += v * b8;
|
|
t17 += v * b9;
|
|
t18 += v * b10;
|
|
t19 += v * b11;
|
|
t20 += v * b12;
|
|
t21 += v * b13;
|
|
t22 += v * b14;
|
|
t23 += v * b15;
|
|
v = a[9];
|
|
t9 += v * b0;
|
|
t10 += v * b1;
|
|
t11 += v * b2;
|
|
t12 += v * b3;
|
|
t13 += v * b4;
|
|
t14 += v * b5;
|
|
t15 += v * b6;
|
|
t16 += v * b7;
|
|
t17 += v * b8;
|
|
t18 += v * b9;
|
|
t19 += v * b10;
|
|
t20 += v * b11;
|
|
t21 += v * b12;
|
|
t22 += v * b13;
|
|
t23 += v * b14;
|
|
t24 += v * b15;
|
|
v = a[10];
|
|
t10 += v * b0;
|
|
t11 += v * b1;
|
|
t12 += v * b2;
|
|
t13 += v * b3;
|
|
t14 += v * b4;
|
|
t15 += v * b5;
|
|
t16 += v * b6;
|
|
t17 += v * b7;
|
|
t18 += v * b8;
|
|
t19 += v * b9;
|
|
t20 += v * b10;
|
|
t21 += v * b11;
|
|
t22 += v * b12;
|
|
t23 += v * b13;
|
|
t24 += v * b14;
|
|
t25 += v * b15;
|
|
v = a[11];
|
|
t11 += v * b0;
|
|
t12 += v * b1;
|
|
t13 += v * b2;
|
|
t14 += v * b3;
|
|
t15 += v * b4;
|
|
t16 += v * b5;
|
|
t17 += v * b6;
|
|
t18 += v * b7;
|
|
t19 += v * b8;
|
|
t20 += v * b9;
|
|
t21 += v * b10;
|
|
t22 += v * b11;
|
|
t23 += v * b12;
|
|
t24 += v * b13;
|
|
t25 += v * b14;
|
|
t26 += v * b15;
|
|
v = a[12];
|
|
t12 += v * b0;
|
|
t13 += v * b1;
|
|
t14 += v * b2;
|
|
t15 += v * b3;
|
|
t16 += v * b4;
|
|
t17 += v * b5;
|
|
t18 += v * b6;
|
|
t19 += v * b7;
|
|
t20 += v * b8;
|
|
t21 += v * b9;
|
|
t22 += v * b10;
|
|
t23 += v * b11;
|
|
t24 += v * b12;
|
|
t25 += v * b13;
|
|
t26 += v * b14;
|
|
t27 += v * b15;
|
|
v = a[13];
|
|
t13 += v * b0;
|
|
t14 += v * b1;
|
|
t15 += v * b2;
|
|
t16 += v * b3;
|
|
t17 += v * b4;
|
|
t18 += v * b5;
|
|
t19 += v * b6;
|
|
t20 += v * b7;
|
|
t21 += v * b8;
|
|
t22 += v * b9;
|
|
t23 += v * b10;
|
|
t24 += v * b11;
|
|
t25 += v * b12;
|
|
t26 += v * b13;
|
|
t27 += v * b14;
|
|
t28 += v * b15;
|
|
v = a[14];
|
|
t14 += v * b0;
|
|
t15 += v * b1;
|
|
t16 += v * b2;
|
|
t17 += v * b3;
|
|
t18 += v * b4;
|
|
t19 += v * b5;
|
|
t20 += v * b6;
|
|
t21 += v * b7;
|
|
t22 += v * b8;
|
|
t23 += v * b9;
|
|
t24 += v * b10;
|
|
t25 += v * b11;
|
|
t26 += v * b12;
|
|
t27 += v * b13;
|
|
t28 += v * b14;
|
|
t29 += v * b15;
|
|
v = a[15];
|
|
t15 += v * b0;
|
|
t16 += v * b1;
|
|
t17 += v * b2;
|
|
t18 += v * b3;
|
|
t19 += v * b4;
|
|
t20 += v * b5;
|
|
t21 += v * b6;
|
|
t22 += v * b7;
|
|
t23 += v * b8;
|
|
t24 += v * b9;
|
|
t25 += v * b10;
|
|
t26 += v * b11;
|
|
t27 += v * b12;
|
|
t28 += v * b13;
|
|
t29 += v * b14;
|
|
t30 += v * b15;
|
|
|
|
t0 += 38 * t16;
|
|
t1 += 38 * t17;
|
|
t2 += 38 * t18;
|
|
t3 += 38 * t19;
|
|
t4 += 38 * t20;
|
|
t5 += 38 * t21;
|
|
t6 += 38 * t22;
|
|
t7 += 38 * t23;
|
|
t8 += 38 * t24;
|
|
t9 += 38 * t25;
|
|
t10 += 38 * t26;
|
|
t11 += 38 * t27;
|
|
t12 += 38 * t28;
|
|
t13 += 38 * t29;
|
|
t14 += 38 * t30;
|
|
// t15 left as is
|
|
|
|
// first car
|
|
c = 1;
|
|
v = t0 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t0 = v - c * 65536;
|
|
v = t1 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t1 = v - c * 65536;
|
|
v = t2 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t2 = v - c * 65536;
|
|
v = t3 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t3 = v - c * 65536;
|
|
v = t4 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t4 = v - c * 65536;
|
|
v = t5 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t5 = v - c * 65536;
|
|
v = t6 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t6 = v - c * 65536;
|
|
v = t7 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t7 = v - c * 65536;
|
|
v = t8 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t8 = v - c * 65536;
|
|
v = t9 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t9 = v - c * 65536;
|
|
v = t10 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t10 = v - c * 65536;
|
|
v = t11 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t11 = v - c * 65536;
|
|
v = t12 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t12 = v - c * 65536;
|
|
v = t13 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t13 = v - c * 65536;
|
|
v = t14 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t14 = v - c * 65536;
|
|
v = t15 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t15 = v - c * 65536;
|
|
t0 += c - 1 + 37 * (c - 1);
|
|
|
|
// second car
|
|
c = 1;
|
|
v = t0 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t0 = v - c * 65536;
|
|
v = t1 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t1 = v - c * 65536;
|
|
v = t2 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t2 = v - c * 65536;
|
|
v = t3 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t3 = v - c * 65536;
|
|
v = t4 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t4 = v - c * 65536;
|
|
v = t5 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t5 = v - c * 65536;
|
|
v = t6 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t6 = v - c * 65536;
|
|
v = t7 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t7 = v - c * 65536;
|
|
v = t8 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t8 = v - c * 65536;
|
|
v = t9 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t9 = v - c * 65536;
|
|
v = t10 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t10 = v - c * 65536;
|
|
v = t11 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t11 = v - c * 65536;
|
|
v = t12 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t12 = v - c * 65536;
|
|
v = t13 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t13 = v - c * 65536;
|
|
v = t14 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t14 = v - c * 65536;
|
|
v = t15 + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
t15 = v - c * 65536;
|
|
t0 += c - 1 + 37 * (c - 1);
|
|
|
|
o[0] = t0;
|
|
o[1] = t1;
|
|
o[2] = t2;
|
|
o[3] = t3;
|
|
o[4] = t4;
|
|
o[5] = t5;
|
|
o[6] = t6;
|
|
o[7] = t7;
|
|
o[8] = t8;
|
|
o[9] = t9;
|
|
o[10] = t10;
|
|
o[11] = t11;
|
|
o[12] = t12;
|
|
o[13] = t13;
|
|
o[14] = t14;
|
|
o[15] = t15;
|
|
}
|
|
|
|
function scalarmult(p, q, s) {
|
|
let b, i;
|
|
set25519(p[0], gf0);
|
|
set25519(p[1], gf1);
|
|
set25519(p[2], gf1);
|
|
set25519(p[3], gf0);
|
|
for (i = 255; i >= 0; --i) {
|
|
b = (s[(i / 8) | 0] >> (i & 7)) & 1;
|
|
cswap(p, q, b);
|
|
add(q, p);
|
|
add(p, p);
|
|
cswap(p, q, b);
|
|
}
|
|
}
|
|
|
|
function pack(r, p) {
|
|
const tx = gf(),
|
|
ty = gf(),
|
|
zi = gf();
|
|
inv25519(zi, p[2]);
|
|
M(tx, p[0], zi);
|
|
M(ty, p[1], zi);
|
|
pack25519(r, ty);
|
|
r[31] ^= par25519(tx) << 7;
|
|
}
|
|
|
|
function inv25519(o, i) {
|
|
const c = gf();
|
|
let a;
|
|
for (a = 0; a < 16; a++) c[a] = i[a];
|
|
for (a = 253; a >= 0; a--) {
|
|
S(c, c);
|
|
if (a !== 2 && a !== 4) M(c, c, i);
|
|
}
|
|
for (a = 0; a < 16; a++) o[a] = c[a];
|
|
}
|
|
|
|
function S(o, a) {
|
|
M(o, a, a);
|
|
}
|
|
|
|
function par25519(a) {
|
|
const d = new Uint8Array(32);
|
|
pack25519(d, a);
|
|
return d[0] & 1;
|
|
}
|
|
function car25519(o) {
|
|
let i,
|
|
v,
|
|
c = 1;
|
|
for (i = 0; i < 16; i++) {
|
|
v = o[i] + c + 65535;
|
|
c = Math.floor(v / 65536);
|
|
o[i] = v - c * 65536;
|
|
}
|
|
o[0] += c - 1 + 37 * (c - 1);
|
|
}
|
|
|
|
function pack25519(o, n) {
|
|
let i, j, b;
|
|
const m = gf(),
|
|
t = gf();
|
|
for (i = 0; i < 16; i++) t[i] = n[i];
|
|
car25519(t);
|
|
car25519(t);
|
|
car25519(t);
|
|
for (j = 0; j < 2; j++) {
|
|
m[0] = t[0] - 0xffed;
|
|
for (i = 1; i < 15; i++) {
|
|
m[i] = t[i] - 0xffff - ((m[i - 1] >> 16) & 1);
|
|
m[i - 1] &= 0xffff;
|
|
}
|
|
m[15] = t[15] - 0x7fff - ((m[14] >> 16) & 1);
|
|
b = (m[15] >> 16) & 1;
|
|
m[14] &= 0xffff;
|
|
sel25519(t, m, 1 - b);
|
|
}
|
|
for (i = 0; i < 16; i++) {
|
|
o[2 * i] = t[i] & 0xff;
|
|
o[2 * i + 1] = t[i] >> 8;
|
|
}
|
|
}
|
|
|
|
function cswap(p, q, b) {
|
|
for (let i = 0; i < 4; i++) {
|
|
sel25519(p[i], q[i], b);
|
|
}
|
|
}
|
|
|
|
function A(o, a, b) {
|
|
for (let i = 0; i < 16; i++) o[i] = a[i] + b[i];
|
|
}
|
|
|
|
function Z(o, a, b) {
|
|
for (let i = 0; i < 16; i++) o[i] = a[i] - b[i];
|
|
}
|
|
|
|
function add(p, q) {
|
|
const a = gf(),
|
|
b = gf(),
|
|
c = gf(),
|
|
d = gf(),
|
|
e = gf(),
|
|
f = gf(),
|
|
g = gf(),
|
|
h = gf(),
|
|
t = gf();
|
|
|
|
Z(a, p[1], p[0]);
|
|
Z(t, q[1], q[0]);
|
|
M(a, a, t);
|
|
A(b, p[0], p[1]);
|
|
A(t, q[0], q[1]);
|
|
M(b, b, t);
|
|
M(c, p[3], q[3]);
|
|
M(c, c, D2);
|
|
M(d, p[2], q[2]);
|
|
A(d, d, d);
|
|
Z(e, b, a);
|
|
Z(f, d, c);
|
|
A(g, d, c);
|
|
A(h, b, a);
|
|
|
|
M(p[0], e, f);
|
|
M(p[1], h, g);
|
|
M(p[2], g, f);
|
|
M(p[3], e, h);
|
|
}
|
|
|
|
function sel25519(p, q, b) {
|
|
const c = ~(b - 1);
|
|
let t;
|
|
for (let i = 0; i < 16; i++) {
|
|
t = c & (p[i] ^ q[i]);
|
|
p[i] ^= t;
|
|
q[i] ^= t;
|
|
}
|
|
}
|
|
|
|
module.exports = Ed25519PasswordAuth;
|