java.lang.Object
net.i2p.router.crypto.ratchet.Elligator2
class Elligator2extends Object
Elligator2 encoding and decoding for X25519 public keys to provide cryptographically indistinguishable representations

Ported from the Jan. 13, 2016 C version at https://github.com/Kleshni/Elligator-2 Note: That code was completely rewritten May 8, 2017 and is now much more complex. No apparent license.

  • Field Details

    • _context

      private final I2PAppContext _context
      The app context.

    • p

      private static final BigInteger p
      The Curve25519 field prime.

    • divide_plus_p_3_8

      private static final BigInteger divide_plus_p_3_8
      The exponent (p+3)/8 for the square root.

    • divide_minus_p_1_2

      private static final BigInteger divide_minus_p_1_2
      The exponent (p-1)/2 for the Legendre check.

    • divide_minus_p_1_4

      private static final BigInteger divide_minus_p_1_4
      The exponent (p-1)/4 for the square root.

    • square_root_negative_1

      private static final BigInteger square_root_negative_1
      A square root of -1 in the field.

    • A_INT

      private static final long A_INT
      The curve constant A as a long.
      See Also:

    • A

      private static final BigInteger A
      The curve constant A.

    • negative_A

      private static final BigInteger negative_A
      The negated curve constant -A.

    • u

      private static final BigInteger u
      A non-square multiplier chosen for the mapping.

    • inverted_u

      private static final BigInteger inverted_u
      The inverse of u in the field.

    • TWO

      private static final BigInteger TWO
      The value two, for exponent math.

    • REPRESENTATIVE_LENGTH

      private static final int REPRESENTATIVE_LENGTH
      Bytes in a field element representative.
      See Also:

    • SPEC

      private static final EdDSANamedCurveSpec SPEC
      The named curve the field comes from.

    • CURVE

      private static final Curve CURVE
      The Curve25519 curve.

    • FIELD

      private static final Field FIELD
      The field the mapping works in.

    • ENCODING

      private static final BigIntegerLittleEndianEncoding ENCODING
      Encoder of field elements to and from bytes.

    • DISABLE

      private static final boolean DISABLE
      Developer switch disabling the mapping.
      See Also:

  • Constructor Details

    • Elligator2

      public Elligator2(I2PAppContext ctx)
      Create an Elligator2 instance.
      Parameters:
      ctx - the I2P app context

  • Method Details

    • encode

      public byte[] encode(PublicKey point)
      Use for on-the-wire. Don't use for unit tests as output will be randomized based on the 'alternative' and the high bits. There are eight possible encodings for any point. Output will look like 256 random bits.
      Parameters:
      point - the public key to encode
      Returns:
      "representative", little endian or null on failure

    • encode

      private static byte[] encode(PublicKey point, boolean alternative, byte highBits)
      Output will look like 254 random bits. High two bits of highBits will be ORed in.

      From javascript version documentation:

      The algorithm can return two different values for a single x coordinate if it's not 0. Which one to return is determined by y coordinate. Since Curve25519 doesn't use y due to optimizations, you should specify a Boolean value as the second argument of the function. It should be unpredictable, because it's recoverable from the representative.

      Parameters:
      point - the public key whose x coordinate is converted
      alternative - picks which of the two possible roots to encode
      highBits - High two bits will be ORed into rv[31]
      Returns:
      "representative", little endian or null on failure

    • decode

      public static PublicKey decode(byte[] representative)
      From javascript version documentation:

      Returns an array with the point and the second argument of the corresponding call to the `encode` function. It's also able to return null if the representative is invalid (there are only 10 invalid representatives).

      Parameters:
      representative - the encoded data, little endian, 32 bytes WILL BE MODIFIED by masking byte 31
      Returns:
      x or null on failure

    • decode

      public static PublicKey decode(AtomicBoolean alternative, byte[] representative)
      From javascript version documentation:

      Returns an array with the point and the second argument of the corresponding call to the `encode` function. It's also able to return null if the representative is invalid (there are only 10 invalid representatives).

      Parameters:
      alternative - out parameter, or null if you don't care
      representative - the encoded data, little endian, 32 bytes; WILL BE MODIFIED by masking byte 31
      Returns:
      x or null on failure

    • square_root

      private static BigInteger square_root(BigInteger x)
      Computes the square root in the field.
      Parameters:
      x - the value to take the root of
      Returns:
      the root, x if there is none

    • legendre

      private static int legendre(BigInteger a)
      Legendre symbol of a modulo the field prime p, computed as a^((p-1)/2) mod p.

      https://gmplib.org/manual/Number-Theoretic-Functions.html https://en.wikipedia.org/wiki/Legendre_symbol

      Parameters:
      a - must already be mod(p)
      Returns:
      -1/0/1