java.lang.Object
net.i2p.crypto.eddsa.EdDSABlinding
public final class EdDSABlindingextends Object
Utilities for EdDSA key blinding operations. Provides methods to blind and unblind EdDSA keys for privacy protection.

  • Field Details

    • ORDER

      public static final BigInteger ORDER
      Order of the Ed25519 prime-order subgroup, as used to reduce exponents.

    • ONE

      private static final byte[] ONE
      The value 1, little-endian, for scalar arithmetic.

    • MINUS_ONE

      private static final byte[] MINUS_ONE
      -1 mod l, little endian; used by unblind to subtract alpha.

    • CURVE_FIELD

      private static final Field CURVE_FIELD
      The field the curve's points live in.

  • Constructor Details

    • EdDSABlinding

      private EdDSABlinding()
      Utility class, not intended for instantiation.

  • Method Details

    • blind

      public static EdDSAPublicKey blind(EdDSAPublicKey key, EdDSAPrivateKey alpha)
      Blind an EdDSA key. Only for SigType EdDSA_SHA512_Ed25519.
      Parameters:
      key - must be SigType EdDSA_SHA512_Ed25519
      alpha - generated from hash of secret data
      Returns:
      the blinded public key
      Throws:
      UnsupportedOperationException - for an unsupported group representation

    • blind

      public static EdDSAPrivateKey blind(EdDSAPrivateKey key, EdDSAPrivateKey alpha)
      Blind an EdDSA private key. Only for SigType EdDSA_SHA512_Ed25519.
      Parameters:
      key - must be SigType EdDSA_SHA512_Ed25519
      alpha - generated from hash of secret data
      Returns:
      the blinded private key
      Throws:
      UnsupportedOperationException - for an unsupported curve

    • unblind

      public static EdDSAPrivateKey unblind(EdDSAPrivateKey key, EdDSAPrivateKey alpha)
      Unblind an EdDSA private key using alpha, the inverse of blind(EdDSAPrivateKey, EdDSAPrivateKey): subtracts alpha from the blinded scalar mod l. The recovered scalar is the original scalar reduced mod l; it yields the same public key point and signatures as the original.
      Parameters:
      key - must be SigType EdDSA_SHA512_Ed25519
      alpha - the same alpha used to blind the key
      Returns:
      the unblinded private key

    • toLittleEndian

      private static byte[] toLittleEndian(BigInteger v)
      Encode a positive BigInteger below 2^256 as 32 little-endian bytes.
      Parameters:
      v - the value to encode
      Returns:
      the value as 32 little-endian bytes, zero-padded

    • reduce

      public static byte[] reduce(byte[] b)
      Reduce a 64-byte value modulo l. Use to generate alpha.
      Parameters:
      b - 64 bytes little endian of random
      Returns:
      32 bytes little endian mod l