o eR]@sdZddlZddlZddlZdZejddkZer&ejZe Z e dddZ n e Z eZdd Zd d Z d Zd ddZd ddZddZddZddZdedeZed eddeZddZdedZeeZeeeedeeefZdZdd Zd!d"Zd#d$Z gZ!d%d&Z"e"d'd(Z#d)d*Z$d+d,Z%d-d.Z&d/d0Z'd1d2Z(d3d4Z)d5d6Z*d7d8Z+d9d:Z,Gd;d<dZ/dS)?a NB: This code is not safe for use with secret keys or secret data. The only safe use of this code is for verifying signatures on public messages. Functions for computing the public key of a secret key and for signing a message are included, namely publickey_unsafe and signature_unsafe, for testing purposes only. The root of the problem is that Python's long-integer arithmetic is not designed for use in cryptography. Specifically, it may take more or less time to execute an operation depending on the values of the inputs, and its memory access patterns may also depend on the inputs. This opens it to timing and cache side-channel attacks which can disclose data to an attacker. We rely on Python's long-integer arithmetic, so we cannot handle secrets without risking their disclosure. Nz1.0.dev0to_bytesZbigcCs t||SN)ord)bufir 3/usr/lib/python3/dist-packages/stem/util/ed25519.py indexbytes=s r cCsddd|DS)Ncss|]}t|VqdSr)chr).0cr r r Asz intlist2bytes..)join)lr r r intlist2bytes@srl S9i @eM^w|ocCst|Sr)hashlibZsha512Zdigestmr r r HIsrcCs(|dkr||t}|d8}|dks|S)z== pow(x, 2**p, q)rrq)xpr r r pow2Ms  r!c Cs||t}t|d|t}||t}||t|t}t|d|t}t|d|t}t|d|t}t|d|t}t|d|t} t| d| t} t| d|t} t| d|tS)z$= z^{-1} \mod q$, for z != 0r 2d)rr!) zz2Zz9Zz11Zz2_5_0Zz2_10_0Zz2_20_0Zz2_40_0Zz2_50_0Zz2_100_0Zz2_200_0Zz2_250_0r r r invUs  r)i$iBcCsl||dtt||d}t|tddt}|||tdkr*|tt}|ddkr4t|}|S)Nrrrr)r)dpowrI)yZxxrr r r xrecoverjs   r0r")rrrrcCs|\}}}}|\}}}} ||||t} ||||t} |dt| t} |d|t} | | }| | }| | }| | }||}||}||}||}|t|t|t|tfSNrrr,)PQx1y1z1t1x2y2r(t2abrddefghx3y3t3z3r r r edwards_add}s  rGcCs|\}}}}||t}||t}d||t}||||||t}| |} | |} | |} || } | | } || }| | }| t| t|t|tfSr1r)r3r5r6r7r8r<r=rr?rAr@rBrCrDrErFr r r edwards_doubles     rHcCs8|dkrtSt||d}t|}|d@rt||}|S)Nrrr)ident scalarmultrHrG)r3r?r4r r r rJs rJcCs(t}tdD] }t|t|}qdS)N)BrangeBpowappendrH)r3rr r r make_Bpows    rPcCsL|t}t}tdD]}|d@rt|t|}|d}q |dks$J||S)z7 Implements scalarmult(B, e) more efficiently. rKrrr)rrIrMrGrN)r?r3rr r r scalarmult_Bs  rQcs6fddttDdfddttdDS)Ncg|]}|?d@qSrr rrr/r r zencodeint..r c,g|]ttfddtdDqS)c g|] }d||>qSr+r rjbitsrr r rV z(encodeint...r+int2bytesumrMrr^rr rVr+)rMr=rrUr r^r/r encodeints rhcsp|\}}}t|}||t}|tfddttdD|d@gdfddttdDS)NcrRrSr rTrUr r rVrWzencodepoint..rr crX)crYrZr r[r]r r rVr_z*encodepoint...r+r`rcrdrer rVrfr+)r)rrMr=r)r3rr'tZzir rgr encodepoints   $ rjcCst||d|d?d@S)Nr+rr )rBrr r r bitsrlcsDt|dtdtfddtdtdD}t|}t|S) Not safe to use with secret keys or secret data. See module docstring. This function should be used for testing only. rc3"|] }d|t|VqdSrNrlrTrBr r r z#publickey_unsafe..r)rr=rbrMrQrj)skr<Ar rqr publickey_unsafes,rucs&t|tfddtdtDS)Nc3rnrorprTrqr r rrrzHint..r)rrbrMr=rr rqr Hintsrvcst|dtdtfddtdtdD}ttfddttdtdD|}t|}|tt||||t}t|t |S) rmrc3rnrorprTrqr r rrrz#signature_unsafe..rcsg|]}t|qSr rkr[rqr r rVsz$signature_unsafe..r+r*) rr=rbrMrvrrQrjrrh)rrspkr<rRSr rqr signature_unsafes,& r{cCs\|\}}}}|tdko-||t||tko-||||||t||tdkS)Nrr2)r3rr/r'rir r r isoncurves  *r|cstfddtdtDS)Nc3rnrorprTsr r rrrzdecodeint..r)rbrMr=r}r r}r decodeint srcsntfddtdtdD}t|}|d@ttdkr#t|}||d||tf}t|s5td|S)Nc3rnrorprTr}r r rrrzdecodepoint..rrz#decoding point that is not on curve)rbrMr=r0rlrr| ValueError)r~r/rr3r r}r decodepoints rc@s eZdZdS)SignatureMismatchN)__name__ __module__ __qualname__r r r r rsrcCst|tdkr tdt|tdkrtdt|dtd}t|}t|tdtd}tt|||}t|\}}} } } t|t ||\} } }}}t | rtt |rt||| | t dkst||| | t dkrxt ddS)z Not safe to use when any argument is secret. See module docstring. This function should be used only for verifying public signatures of public messages. r*zsignature length is wrongr+zpublic-key length is wrongNrz$signature does not pass verification) lenr=rrrrvrjrQrGrJr|rr)r~rrwryrtrzrBr5r6r7r8r3r9r:r(r;r4r r r checkvalid s"r)0__doc__roperatorsys __version__ version_infoZPY3getitemr bytesr methodcallerrar ZxrangerMr=rrrr!r)r,r-r.r0ZByZBxrLrIrGrHrJrNrPrQrhrjrlrurvr{r|rr Exceptionrrr r r r sZ