ddn.crypto.kex.x25519

ECDH / X25519 Implementation (RFC 7748).

Side-Channel Status: The Montgomery ladder below runs a fixed 255-iteration pattern and performs its conditional swaps with branch-free mask arithmetic. The field arithmetic itself, however, is still variable-time heap-allocated BigInt, so this module is NOT a constant-time implementation: timing analysis of the modular reductions may still correlate with intermediate values. A fixed-width constant-time field representation is required to close that gap.

class X25519

Types 1

classX25519 : KeyAgreement

X25519 Key Agreement (ECDH over Curve25519).

Fields
private ubyte[32] _secret
private bool _initialized
private Object constLock_
private BigInt curveP_
private bool curvePInit_
private BigInt a24_
private bool a24Init_
Methods
void initialize(PrivateKey privateKey)
void init(PrivateKey privateKey)
ubyte[] calculateSecret(PublicKey publicKey)
ubyte[] x25519(const(ubyte)[] k, const(ubyte)[] u) staticCalculates X25519(k, u).
private BigInt decodeLittleEndian(const(ubyte)[] b) static
private ubyte[] encodeLittleEndian(BigInt n) static
private BigInt montgomeryLadder(BigInt k, BigInt u) staticMontgomery ladder scalar multiplication.
private void cswap(uint doSwap, ref BigInt a, ref BigInt b) staticConditional swap for the Montgomery ladder.
private BigInt P() static @trusted
private BigInt A24() static @trusted
private BigInt modInverse(BigInt a, BigInt n) static
Destructors
~this