spb/os-vault Public

1import Foundation23// https://github.com/miguelsandro/curve25519-swift/blob/master/axlsign.swift45infix operator >>>: BitwiseShiftPrecedence6func >>> (lhs: Int, rhs: Int) -> Int {7    let l = getInt32(Int64(lhs))8    let r = getInt32(Int64(rhs))9    return Int(Int32(bitPattern: UInt32(bitPattern: l) >> UInt32(r)))10}1112func getInt32(_ value: Int64) -> Int32 {13    Int32(truncatingIfNeeded: value)14}1516enum NaclLowLevel {17    // MARK: - Constants1819    static var D = gf([0x78A3, 0x1359, 0x4DCA, 0x75EB,20                       0xD8AB, 0x4141, 0x0A4D, 0x0070,21                       0xE898, 0x7779, 0x4079, 0x8CC7,22                       0xFE73, 0x2B6F, 0x6CEE, 0x5203])23    static let I = gf([0xA0B0, 0x4A0E, 0x1B27, 0xC4EE,24                       0xE478, 0xAD2F, 0x1806, 0x2F43,25                       0xD7A7, 0x3DFB, 0x0099, 0x2B4D,26                       0xDF0B, 0x4FC1, 0x2480, 0x2B83])2728    // MARK: - Methods2930    static func gf() -> [Int64] {31        gf([0])32    }3334    static func gf(_ ai: [Int64]) -> [Int64] {35        var r = [Int64](repeating: 0, count: 16)36        for i in 0 ..< ai.count {37            r[i] = ai[i]38        }39        return r40    }4142    static func unpack25519(_ o: inout [Int64], _ n: [UInt8]) {43        for i in 0 ..< 16 {44            o[i] = Int64(n[2 * i]) + (Int64(n[2 * i + 1]) << 8) // *** R45        }46        o[15] = o[15] & 0x7FFF47    }4849    static func A(_ o: inout [Int64], _ a: [Int64], _ b: [Int64]) {50        for i in 0 ..< 16 {51            o[i] = a[i] + b[i]52        }53    }5455    static func Z(_ o: inout [Int64], _ a: [Int64], _ b: [Int64]) {56        for i in 0 ..< 16 {57            o[i] = a[i] - b[i]58        }59    }6061    static func M(_ o: inout [Int64], _ a: [Int64], _ b: [Int64]) {62        var at = [Int64](repeating: 0, count: 32)63        var ab = [Int64](repeating: 0, count: 16)6465        for i in 0 ..< 16 {66            ab[i] = b[i]67        }6869        var v: Int6470        for i in 0 ..< 16 {71            v = a[i]72            for j in 0 ..< 16 {73                at[j + i] += v * ab[j]74            }75        }7677        for i in 0 ..< 15 {78            at[i] += 38 * at[i + 16]79        }80        // t15 left as is81        // first car82        var c: Int64 = 183        for i in 0 ..< 16 {84            v = at[i] + c + 6553585            c = Int64(floor(Double(v) / 65536.0))86            at[i] = v - c * 6553687        }88        at[0] += c - 1 + 37 * (c - 1)8990        // second car91        c = 192        for i in 0 ..< 16 {93            v = at[i] + c + 6553594            c = Int64(floor(Double(v) / 65536.0))95            at[i] = v - c * 6553696        }97        at[0] += c - 1 + 37 * (c - 1)9899        for i in 0 ..< 16 {100            o[i] = at[i]101        }102    }103104    static func S(_ o: inout [Int64], _ a: [Int64]) {105        M(&o, a, a)106    }107108    static func pow2523(_ o: inout [Int64], _ i: [Int64]) {109        var c = gf()110        for a in 0 ..< 16 {111            c[a] = i[a]112        }113        for a in (0 ... 250).reversed() {114            S(&c, c)115            if a != 1 {116                M(&c, c, i)117            }118        }119        for a in 0 ..< 16 {120            o[a] = c[a]121        }122    }123124    static func vn(_ x: [UInt8], _ xi: Int, _ y: [UInt8], _ yi: Int, _ n: Int) -> Int {125        var d: UInt8 = 0126        for i in 0 ..< n {127            d = d | (x[xi + i] ^ y[yi + i])128        }129        return (1 & ((Int(d) - 1) >>> 8)) - 1130    }131132    static func crypto_verify_32(_ x: [UInt8], _ xi: Int, _ y: [UInt8], _ yi: Int) -> Int {133        vn(x, xi, y, yi, 32)134    }135136    static func set25519(_ r: inout [Int64], _ a: [Int64]) {137        for i in 0 ..< 16 {138            r[i] = a[i] | 0139        }140    }141142    static func car25519(_ o: inout [Int64]) {143        var v: Int64144        var c = 1145        for i in 0 ..< 16 {146            v = o[i] + Int64(c + 65535)147            c = Int(floor(Double(v) / 65536.0))148            o[i] = v - Int64(c * 65536)149        }150        o[0] += Int64(c - 1 + 37 * (c - 1))151    }152153    static func sel25519(_ p: inout [Int64], _ q: inout [Int64], _ b: Int) {154        var t: Int64155        let c = Int64(~(b - 1))156        for i in 0 ..< 16 {157            t = c & (p[i] ^ q[i])158            p[i] = p[i] ^ t159            q[i] = q[i] ^ t160        }161    }162163    static func pack25519(_ o: inout [UInt8], _ n: [Int64]) {164        var b: Int64165        var m = gf()166        var t = gf()167168        for i in 0 ..< 16 {169            t[i] = n[i]170        }171        car25519(&t)172        car25519(&t)173        car25519(&t)174175        for _ in 0 ... 1 {176            m[0] = t[0] - 0xFFED177            for i in 1 ... 14 {178                m[i] = t[i] - 0xFFFF - ((m[i - 1] >> 16) & 1)179                m[i - 1] = m[i - 1] & 0xFFFF180            }181            m[15] = t[15] - 0x7FFF - ((m[14] >> 16) & 1)182            b = (m[15] >> 16) & 1183            m[14] = m[14] & 0xFFFF184            sel25519(&t, &m, Int(1 - b))185        }186        for i in 0 ..< 16 {187            o[2 * i] = UInt8(t[i] & 0xFF) // *** R188            o[2 * i + 1] = UInt8(t[i] >> 8) // *** R189        }190    }191192    static func neq25519(_ a: [Int64], _ b: [Int64]) -> Int {193        var c = [UInt8](repeating: 0, count: 32)194        var d = [UInt8](repeating: 0, count: 32)195        pack25519(&c, a)196        pack25519(&d, b)197        return crypto_verify_32(c, 0, d, 0)198    }199}200