o
    eR]                     @   s  d Z ddlZddlZddlZdZejd dkZer&ejZe	Z
edddZneZeZdd	 Zd
d Z
dZdd d Zdd d Zdd Zdd Zdd Zded e Zeded d eZdd Zded ZeeZee ee dee e fZdZdd  Zd!d" Zd#d$ Z g Z!d%d& Z"e"  d'd( Z#d)d* Z$d+d, Z%d-d. Z&d/d0 Z'd1d2 Z(d3d4 Z)d5d6 Z*d7d8 Z+d9d: Z,G d;d< d<e-Z.d=d> Z/dS )?a  
NB: This code is not safe for use with secret keys or secret data.
The only safe use of this code is for verifying signatures on public messages.

Functions for computing the public key of a secret key and for signing
a message are included, namely publickey_unsafe and signature_unsafe,
for testing purposes only.

The root of the problem is that Python's long-integer arithmetic is
not designed for use in cryptography.  Specifically, it may take more
or less time to execute an operation depending on the values of the
inputs, and its memory access patterns may also depend on the inputs.
This opens it to timing and cache side-channel attacks which can
disclose data to an attacker.  We rely on Python's long-integer
arithmetic, so we cannot handle secrets without risking their disclosure.
    Nz1.0.dev0   to_bytes   Zbigc                 C   s   t | | S N)ord)bufi r	   3/usr/lib/python3/dist-packages/stem/util/ed25519.py
indexbytes=   s   r   c                 C   s   d dd | D S )N    c                 s   s    | ]}t |V  qd S r   )chr).0cr	   r	   r
   	<genexpr>A   s    z intlist2bytes.<locals>.<genexpr>)join)lr	   r	   r
   intlist2bytes@   s   r                  l	   S9i@eM^w|o c                 C   s   t |  S r   )hashlibZsha512Zdigestmr	   r	   r
   HI   s   r   c                 C   s(   |dkr| |  t  } |d8 }|dks| S )z== pow(x, 2**p, q)r   r   q)xpr	   r	   r
   pow2M   s
   r!   c                 C   s   | |  t  }t|d|  t  }|| t  }|| t  | t  }t|d| t  }t|d| t  }t|d| t  }t|d| t  }t|d| t  }	t|	d|	 t  }
t|
d| t  }t|d| t  S )z$= z^{-1} \mod q$, for z != 0r      
      2   d   )r   r!   )zz2Zz9Zz11Zz2_5_0Zz2_10_0Zz2_20_0Zz2_40_0Zz2_50_0Zz2_100_0Zz2_200_0Zz2_250_0r	   r	   r
   invU   s   r)   i$iB    c                 C   sl   | |  d t t|  |  d  }t|td d t}|| | t dkr*|t t }|d dkr4t| }|S )Nr   r      r   r   )r)   dpowr   I)yZxxr   r	   r	   r
   xrecoverj   s    r0   r"   )r   r   r   r   c                 C   s   | \}}}}|\}}}}	|| ||  t  }
|| ||  t  }|d t |	 t  }|d | t  }||
 }|| }|| }||
 }|| }|| }|| }|| }|t  |t  |t  |t  fS Nr   r   r,   )PQx1y1z1t1x2y2r(   t2abr   ddefghx3y3t3z3r	   r	   r
   edwards_add}   s   rG   c                 C   s   | \}}}}|| t  }|| t  }d| | t  }|| ||  | | t  }| | }	|	| }
| | }||
 }|	| }|| }|
|	 }|t  |t  |t  |t  fS r1   r   )r3   r5   r6   r7   r8   r<   r=   r   r?   rA   r@   rB   rC   rD   rE   rF   r	   r	   r
   edwards_double   s   

rH   c                 C   s8   |dkrt S t| |d }t|}|d@ rt|| }|S )Nr   r   r   )ident
scalarmultrH   rG   )r3   r?   r4   r	   r	   r
   rJ      s   
rJ   c                  C   s(   t } tdD ]}t|  t| } qd S )N   )BrangeBpowappendrH   )r3   r   r	   r	   r
   	make_Bpow   s
   

rP   c                 C   sL   | t  } t}tdD ]}| d@ rt|t| }| d } q
| dks$J | |S )z7
    Implements scalarmult(B, e) more efficiently.
    rK   r   r   r   )r   rI   rM   rG   rN   )r?   r3   r   r	   r	   r
   scalarmult_B   s   
rQ   c                    s6   fddt tD  d fddt td D S )Nc                       g | ]} |? d @ qS r   r	   r   r   r/   r	   r
   
<listcomp>       zencodeint.<locals>.<listcomp>r   c                    ,   g | ] t t fd dtdD qS )c                        g | ]} d  |  |> qS r+   r	   r   jbitsr   r	   r
   rV           z(encodeint.<locals>.<listcomp>.<listcomp>r+   int2bytesumrM   r   r^   r   r
   rV          r+   )rM   r=   r   rU   r	   r^   r/   r
   	encodeint   s   
rh   c                    sp   | \}}}t |}|| t }| t fddttd D |d@ g  d fddttd D S )Nc                    rR   rS   r	   rT   rU   r	   r
   rV      rW   zencodepoint.<locals>.<listcomp>r   r   c                    rX   )c                    rY   rZ   r	   r[   r]   r	   r
   rV      r_   z*encodepoint.<locals>.<listcomp>.<listcomp>r+   r`   rc   rd   re   r
   rV      rf   r+   )r)   r   rM   r=   r   )r3   r   r'   tZzir	   rg   r
   encodepoint   s   $
rj   c                 C   s   t | |d |d ? d@ S )Nr+   r   r   )rB   r   r	   r	   r
   bit   s   rl   c                    sD   t |  dtd  t fddtdtd D  }t|}t|S )
    Not safe to use with secret keys or secret data.

    See module docstring.  This function should be used for testing only.
    r   c                 3   "    | ]}d | t  | V  qdS r   Nrl   rT   rB   r	   r
   r           z#publickey_unsafe.<locals>.<genexpr>r   )r   r=   rb   rM   rQ   rj   )skr<   Ar	   rq   r
   publickey_unsafe   s   ,ru   c                    s&   t |  t fddtdt D S )Nc                 3   rn   ro   rp   rT   rq   r	   r
   r      rr   zHint.<locals>.<genexpr>r   )r   rb   rM   r=   r   r	   rq   r
   Hint   s   rv   c                    s   t | dtd  t fddtdtd D  }tt fddttd td D |  }t|}|tt|| |  |  t }t|t	| S )	rm   r   c                 3   rn   ro   rp   rT   rq   r	   r
   r      rr   z#signature_unsafe.<locals>.<genexpr>r   c                    s   g | ]}t  |qS r	   rk   r[   rq   r	   r
   rV      s    z$signature_unsafe.<locals>.<listcomp>r+   r*   )
r   r=   rb   rM   rv   r   rQ   rj   r   rh   )r   rs   pkr<   rRSr	   rq   r
   signature_unsafe   s   ,& r{   c                 C   s\   | \}}}}|t  dko-|| t  || t  ko-|| ||  ||  t| |  t  dkS )Nr   r2   )r3   r   r/   r'   ri   r	   r	   r
   	isoncurve  s   *r|   c                    s   t  fddtdtD S )Nc                 3   rn   ro   rp   rT   sr	   r
   r     rr   zdecodeint.<locals>.<genexpr>r   )rb   rM   r=   r}   r	   r}   r
   	decodeint  s   r   c                    sn   t  fddtdtd D }t|}|d@ t td kr#t| }||d|| t f}t|s5td|S )Nc                 3   rn   ro   rp   rT   r}   r	   r
   r     rr   zdecodepoint.<locals>.<genexpr>r   r   z#decoding point that is not on curve)rb   rM   r=   r0   rl   r   r|   
ValueError)r~   r/   r   r3   r	   r}   r
   decodepoint  s    r   c                   @   s   e Zd ZdS )SignatureMismatchN)__name__
__module____qualname__r	   r	   r	   r
   r     s    r   c                 C   s   t | td krtdt |td krtdt| dtd  }t|}t| td td  }tt|| | }t| \}}}	}
}t|t	|| \}}}}}t
|rtt
|rt|| ||	  t dkst|| ||	  t dkrxtddS )z
    Not safe to use when any argument is secret.

    See module docstring.  This function should be used only for
    verifying public signatures of public messages.
    r*   zsignature length is wrongr+   zpublic-key length is wrongNr   z$signature does not pass verification)lenr=   r   r   r   rv   rj   rQ   rG   rJ   r|   r   r   )r~   r   rw   ry   rt   rz   rB   r5   r6   r7   r8   r3   r9   r:   r(   r;   r4   r	   r	   r
   
checkvalid   s"   r   )0__doc__r   operatorsys__version__version_infoZPY3getitemr   bytesr   methodcallerra   r   ZxrangerM   r=   r   r   r   r!   r)   r,   r-   r.   r0   ZByZBxrL   rI   rG   rH   rJ   rN   rP   rQ   rh   rj   rl   ru   rv   r{   r|   r   r   	Exceptionr   r   r	   r	   r	   r
   <module>   sZ   