suwako / LittleBeast

master
ブランチ master
LittleBeast / src / Std / Lib / Crypto / X25519.php
4.5 KB、126行 生 Blame 履歴
1<?php
2/*************************************************************
3# 076 License
4
5Copyright (c) テクニカル諏訪子
6
7Permission is hereby granted to any person obtaining a copy of the software
8Little Beast (the "Software") to use, modify, merge, copy, publish, distribute,
9sublicense, and/or sell copies of the Software, subject to the following conditions:
10
11 1. **Origin Attribution**:
12 - You must not misrepresent the origin of the Software; you must not claim
13 you created the original Software.
14 - If the Software is used in a product, you must either:
15 a. Provide clear attribution in the product's documentation, user interface,
16 or other visible areas, **OR**
17 b. Pay the original developers a fee they specify in writing.
18 2. **Usage Restriction**:
19 - The Software, or any derivative works, dependencies, or libraries
20 incorporating it, must not be used for censorship or to suppress freedom of
21 speech, expression, or creativity. Prohibited uses include, but are not
22 limited to:
23 - Censorship of so-called "hate speech", visuals, non-mainstream opinions,
24 ideas, or objective reality.
25 - Tools or systems designed to restrict access to information or
26 artistic works.
27 3. **Notice Preservation**:
28 - This license and the above copyright notice must remain intact in all copies
29 of the source code.
30
31THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
32INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
33PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
34HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
35CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
36OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
37 */
38namespace Std\Lib\Crypto;
39
40/**
41 * X25519（RFC 7748）の鍵交換
42 *
43 * 例：
44 * [$priv, $pub] = X25519::generate();
45 * $shared = X25519::sharedSecret($priv, $peerPub);
46 */
47class X25519 {
48 private static ?\GMP $p = null;
49
50 /**
51 * 新しい鍵の組
52 *
53 * @return array [秘密鍵（32バイト）, 公開鍵（32バイト）]
54 */
55 public static function generate(): array {
56 $priv = random_bytes(32);
57 return [$priv, self::publicKey($priv)];
58 }
59
60 /** 秘密鍵から公開鍵 */
61 public static function publicKey(string $priv): string {
62 return self::ladder($priv, "\x09".str_repeat("\0", 31));
63 }
64
65 /**
66 * 共有の秘密
67 *
68 * @param string $priv 自分の秘密鍵
69 * @param string $pub 相手の公開鍵
70 * @return string 32バイト
71 * @throws \InvalidArgumentException 長さが違う、又は結果が全部0（小さい位数の点）の場合
72 */
73 public static function sharedSecret(string $priv, string $pub): string {
74 $s = self::ladder($priv, $pub);
75 if ($s === str_repeat("\0", 32)) throw new \InvalidArgumentException('X25519：不正な公開鍵');
76 return $s;
77 }
78
79 /** モンゴメリ・ラダー（RFC 7748 5） */
80 private static function ladder(string $k, string $u): string {
81 if (strlen($k) !== 32 || strlen($u) !== 32) throw new \InvalidArgumentException('X25519：鍵は32バイト');
82 $p = self::$p ??= gmp_sub(gmp_pow(2, 255), 19);
83
84 $k[0] = chr(ord($k[0]) & 248);
85 $k[31] = chr((ord($k[31]) & 127) | 64);
86 $u[31] = chr(ord($u[31]) & 127);
87 $scalar = gmp_import(strrev($k));
88 $x1 = gmp_mod(gmp_import(strrev($u)), $p);
89
90 $x2 = gmp_init(1);
91 $z2 = gmp_init(0);
92 $x3 = $x1;
93 $z3 = gmp_init(1);
94 $swap = 0;
95
96 for ($t = 254; $t >= 0; $t--) {
97 $kt = gmp_testbit($scalar, $t) ? 1 : 0;
98 if ($swap ^ $kt) {
99 [$x2, $x3] = [$x3, $x2];
100 [$z2, $z3] = [$z3, $z2];
101 }
102 $swap = $kt;
103
104 $a = gmp_add($x2, $z2);
105 $aa = gmp_mod(gmp_mul($a, $a), $p);
106 $b = gmp_sub($x2, $z2);
107 $bb = gmp_mod(gmp_mul($b, $b), $p);
108 $e = gmp_sub($aa, $bb);
109 $c = gmp_add($x3, $z3);
110 $d = gmp_sub($x3, $z3);
111 $da = gmp_mul($d, $a);
112 $cb = gmp_mul($c, $b);
113 $x3 = gmp_mod(gmp_pow(gmp_add($da, $cb), 2), $p);
114 $z3 = gmp_mod(gmp_mul($x1, gmp_pow(gmp_sub($da, $cb), 2)), $p);
115 $x2 = gmp_mod(gmp_mul($aa, $bb), $p);
116 $z2 = gmp_mod(gmp_mul($e, gmp_add($aa, gmp_mul(121665, $e))), $p);
117 }
118 if ($swap) {
119 [$x2, $x3] = [$x3, $x2];
120 [$z2, $z3] = [$z3, $z2];
121 }
122
123 $r = gmp_mod(gmp_mul($x2, gmp_powm($z2, gmp_sub($p, 2), $p)), $p);
124 return strrev(str_pad(gmp_export($r), 32, "\0", STR_PAD_LEFT));
125 }
126}