29:I[49813,["/_next/static/chunks/3z--bwudlglfp.js","/_next/static/chunks/2u04xn-9yg2co.js","/_next/static/chunks/1b5-8ftwqgmtb.js","/_next/static/chunks/3nqo6bdos11l6.js","/_next/static/chunks/0fz0mlrjifmq7.js","/_next/static/chunks/034_kq3j28m99.js","/_next/static/chunks/29v1ttach42xh.js","/_next/static/chunks/3meo7law-jljp.js","/_next/static/chunks/1hplpmn3-d0tx.js"],"CodeWorkspace"] 2a:T2211,/** * Copyright (c) 2011-2026 libbitcoin developers * * This file is part of libbitcoin. * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU Affero General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Affero General Public License for more details. * * You should have received a copy of the GNU Affero General Public License * along with this program. If not, see . */ #include #include #include #include #include #include #include // based on: // datatracker.ietf.org/doc/html/rfc7748 // tweetnacl.cr.yp.to (field arithmetic) // [Bernstein, Josefsson, Liusvaara] namespace libbitcoin { namespace system { BC_PUSH_WARNING(NO_ARRAY_INDEXING) BC_PUSH_WARNING(NO_DYNAMIC_ARRAY_INDEXING) // Limbs are radix 2^16 over int64, and may be negative between carries. The // limb count and the radix width are both sixteen, but are not related. constexpr auto radix_bits = 16_size; constexpr auto radix = bit_right(radix_bits); // The field prime p = 2^255 - 19 in radix 2^16 limbs (low, middle, high). constexpr int64_t prime_low = 0xffed; constexpr int64_t prime_middle = 0xffff; constexpr int64_t prime_high = 0x7fff; // The fold of a limb carried beyond 2^256, which is 38 = 2 * 19 (mod p). constexpr int64_t fold = 38; // x25519 // ---------------------------------------------------------------------------- bool x25519::multiply(key& out, const key& scalar, const key& point) NOEXCEPT { // The Montgomery ladder constant (a - 2) / 4 = 121665 in radix 2^16. constexpr field a24{ 0xdb41, 1 }; // Clamp the scalar: clear the low three bits, clear the high bit and set // the next highest bit (rfc7748 decodeScalar25519). auto clamped = scalar; mask_right_into(clamped[0], 3); mask_left_into(clamped[31], 1); set_right_into(clamped[31], 6); field x{}; unpack(x, point); field a{}; field b = x; field c{}; field d{}; field e{}; field f{}; a[zero] = 1; d[zero] = 1; // Montgomery ladder over the scalar bits, from 254 down to 0. for (size_t index{ 255 }; index > zero; --index) { const auto bit = sub1(index); const auto byte = clamped[shift_right(bit, 3)]; const auto swap = to_int(get_right(byte, bit_and(bit, 7_size))); select(a, b, swap); select(c, d, swap); add(e, a, c); subtract(a, a, c); add(c, b, d); subtract(b, b, d); square(d, e); square(f, a); multiply(a, c, a); multiply(c, b, e); add(e, a, c); subtract(a, a, c); square(b, a); subtract(c, d, f); multiply(a, c, a24); add(a, a, d); multiply(c, c, a); multiply(a, d, f); multiply(d, b, x); square(b, e); select(a, b, swap); select(c, d, swap); } invert(c, c); multiply(a, a, c); pack(out, a); wipe(clamped); wipe(a); wipe(b); wipe(c); wipe(d); wipe(e); wipe(f); // An all zero result indicates a low order point. return std::any_of(out.cbegin(), out.cend(), [](uint8_t byte) NOEXCEPT { return !is_zero(byte); }); } bool x25519::multiply(key& out, const key& scalar) NOEXCEPT { constexpr key base{ 9 }; return multiply(out, scalar, base); } // This sacrifices about 1.1 bits of entropy, out of 251 (acceptable). // About one third of Z85 key encodings contain a hash sign (a config comment). static bool allowed(const x25519::key& key, bool sanitize) NOEXCEPT { if (!sanitize) return true; std::string encoded{}; return encode_base85(encoded, key) && !contains(encoded, '#'); } void x25519::generate(key& private_key, key& public_key, bool sanitize) NOEXCEPT { // A low order result is astronomically improbable. do { maybe_random::fill(private_key); } while (!multiply(public_key, private_key) || !allowed(private_key, sanitize) || !allowed(public_key, sanitize)); } // field // ---------------------------------------------------------------------------- // Propagate limb carries, folding top limb overflow (p = 2^255 - 19). constexpr void x25519::carry(field& out) NOEXCEPT { for (size_t index{}; index < limbs; ++index) { // The radix is added so that the floored carry of a negative limb is // one less than that of a positive limb, which is then subtracted. out[index] += radix; const auto carried = floored_divide(out[index], radix); if (index < sub1(limbs)) out[add1(index)] += sub1(carried); else out[zero] += sub1(carried) * fold; out[index] -= carried * radix; } } // Constant time conditional swap (bit is zero or one). constexpr void x25519::select(field& p, field& q, int64_t bit) NOEXCEPT { const auto mask = negate(bit); for (size_t index{}; index < limbs; ++index) { const auto swap = bit_and(mask, bit_xor(p[index], q[index])); p[index] ^= swap; q[index] ^= swap; } } constexpr void x25519::add(field& out, const field& a, const field& b) NOEXCEPT { for (size_t index{}; index < limbs; ++index) out[index] = (a[index] + b[index]); } constexpr void x25519::subtract(field& out, const field& a, const field& b) NOEXCEPT { for (size_t index{}; index < limbs; ++index) out[index] = (a[index] - b[index]); } constexpr void x25519::multiply(field& out, const field& a, const field& b) NOEXCEPT { std_array product{}; for (size_t i{}; i < limbs; ++i) for (size_t j{}; j < limbs; ++j) product[i + j] += (a[i] * b[j]); // Reduce the upper half, as 2^256 = 38 (mod p). for (size_t index{}; index < sub1(limbs); ++index) product[index] += (product[index + limbs] * fold); for (size_t index{}; index < limbs; ++index) out[index] = product[index]; carry(out); carry(out); } constexpr void x25519::square(field& out, const field& a) NOEXCEPT { multiply(out, a, a); } // Inversion by exponentiation to p - 2 (Fermat), constant time. constexpr void x25519::invert(field& out, const field& a) NOEXCEPT { auto c = a; for (size_t index{ 254 }; index > zero; --index) { const auto exponent = sub1(index); square(c, c); if (exponent != 2 && exponent != 4) multiply(c, c, a); } out = c; } // Fully reduce and serialize little-endian. void x25519::pack(key& out, const field& in) NOEXCEPT { auto t = in; carry(t); carry(t); carry(t); // Subtract p twice, keeping the result only if non-negative. for (size_t pass{}; pass < two; ++pass) { // A negative limb borrows from the next and is normalized to radix. field m{}; m[zero] = t[zero] - prime_low; for (auto index = one; index < sub1(limbs); ++index) { auto& previous = m[sub1(index)]; m[index] = t[index] - prime_middle - to_int(is_negative(previous)); previous = floored_modulo(previous, radix); } auto& penultimate = m[sub1(sub1(limbs))]; auto& last = m[sub1(limbs)]; last = t[sub1(limbs)] - prime_high - to_int(is_negative(penultimate)); penultimate = floored_modulo(penultimate, radix); // The subtraction is kept only if the top limb did not borrow. select(t, m, to_int(!is_negative(last))); } std_array words{}; for (size_t index{}; index < limbs; ++index) words[index] = possible_narrow_and_sign_cast(t[index]); to_little_endians(out, words); } // Deserialize little-endian, masking the unused top bit. void x25519::unpack(field& out, const key& in) NOEXCEPT { std_array words{}; from_little_endians(words, in); for (size_t index{}; index < limbs; ++index) out[index] = words[index]; set_right_into(out[sub1(limbs)], sub1(radix_bits), false); } BC_POP_WARNING() BC_POP_WARNING() } // namespace system } // namespace libbitcoin 12:["$","$L29",null,{"project":{"id":"cmuidb72x000001s1932ifphv","owner":"libbitcoin","repo":"libbitcoin-system","displayName":"libbitcoin/libbitcoin-system","defaultBranch":"master"},"commit":{"sha":"121d29eceaf821490dfef9f329758891c584ae57","message":"Disable clang-cl warnings in system headers.","authorLogin":"evoskuil","authorName":"Eric Voskuil","date":"2026-10-30T18:12:39.000Z","htmlUrl":"https://github.com/libbitcoin/libbitcoin-system/commit/121d29eceaf821490dfef9f329758891c584ae57","isHead":false,"headSha":"876e2e139ded674b405285caa83394aac84953f0"},"gitRef":"121d29eceaf821490dfef9f329758891c584ae57","path":"src/crypto/x25519.cpp","target":{"kind":"file","file":{"path":"src/crypto/x25519.cpp","size":8721,"content":"$2a","tooLarge":false,"binary":false,"htmlUrl":"https://github.com/libbitcoin/libbitcoin-system/blob/121d29eceaf821490dfef9f329758891c584ae57/src/crypto/x25519.cpp","mutants":[],"mutantsAtOtherRevisions":0}},"treeCache":{"":[{"name":".github","path":".github","type":"dir","size":null},{"name":".vscode","path":".vscode","type":"dir","size":null},{"name":"builds","path":"builds","type":"dir","size":null},{"name":"doc","path":"doc","type":"dir","size":null},{"name":"include","path":"include","type":"dir","size":null},{"name":"src","path":"src","type":"dir","size":null},{"name":"test","path":"test","type":"dir","size":null},{"name":"tools","path":"tools","type":"dir","size":null},{"name":".gitignore","path":".gitignore","type":"file","size":1037},{"name":"COPYING","path":"COPYING","type":"file","size":33899},{"name":"README.md","path":"README.md","type":"file","size":9650}],"src":[{"name":"chain","path":"src/chain","type":"dir","size":null},{"name":"config","path":"src/config","type":"dir","size":null},{"name":"crypto","path":"src/crypto","type":"dir","size":null},{"name":"data","path":"src/data","type":"dir","size":null},{"name":"endian","path":"src/endian","type":"dir","size":null},{"name":"error","path":"src/error","type":"dir","size":null},{"name":"filter","path":"src/filter","type":"dir","size":null},{"name":"hash","path":"src/hash","type":"dir","size":null},{"name":"math","path":"src/math","type":"dir","size":null},{"name":"radix","path":"src/radix","type":"dir","size":null},{"name":"serial","path":"src/serial","type":"dir","size":null},{"name":"stream","path":"src/stream","type":"dir","size":null},{"name":"unicode","path":"src/unicode","type":"dir","size":null},{"name":"wallet","path":"src/wallet","type":"dir","size":null},{"name":"words","path":"src/words","type":"dir","size":null},{"name":"x509","path":"src/x509","type":"dir","size":null},{"name":"arena.cpp","path":"src/arena.cpp","type":"file","size":2137},{"name":"define.cpp","path":"src/define.cpp","type":"file","size":5804},{"name":"execution.cpp","path":"src/execution.cpp","type":"file","size":2110},{"name":"settings.cpp","path":"src/settings.cpp","type":"file","size":32380}],"src/crypto":[{"name":"secp256k1","path":"src/crypto/secp256k1","type":"dir","size":null},{"name":"shamir","path":"src/crypto/shamir","type":"dir","size":null},{"name":"aes_gcm.cpp","path":"src/crypto/aes_gcm.cpp","type":"file","size":1091},{"name":"chacha20_poly1305.cpp","path":"src/crypto/chacha20_poly1305.cpp","type":"file","size":4952},{"name":"chacha20.cpp","path":"src/crypto/chacha20.cpp","type":"file","size":14427},{"name":"der_parser.cpp","path":"src/crypto/der_parser.cpp","type":"file","size":5654},{"name":"fschacha20_poly1305.cpp","path":"src/crypto/fschacha20_poly1305.cpp","type":"file","size":2403},{"name":"fschacha20.cpp","path":"src/crypto/fschacha20.cpp","type":"file","size":1729},{"name":"maybe_random.cpp","path":"src/crypto/maybe_random.cpp","type":"file","size":2520},{"name":"poly1305.cpp","path":"src/crypto/poly1305.cpp","type":"file","size":18714},{"name":"salsa20.cpp","path":"src/crypto/salsa20.cpp","type":"file","size":5970},{"name":"x25519.cpp","path":"src/crypto/x25519.cpp","type":"file","size":8721},{"name":"xsalsa20_poly1305.cpp","path":"src/crypto/xsalsa20_poly1305.cpp","type":"file","size":2948}]},"revisions":[{"commitSha":"c37c9b73278f1f97e6eb6421f3544f5e58edba2f","branch":null,"commitMessage":"Merge pull request #2132 from evoskuil/master","commitDate":"2026-10-29T20:40:10.000Z","mutantCount":36},{"commitSha":"9fa0f9a07f31c5cc9ebe5efa05e6d4a6d12ba183","branch":null,"commitMessage":"Test script pattern length guards and the sixteen key multisig builder boundary.","commitDate":"2026-09-29T18:05:00.000Z","mutantCount":129},{"commitSha":"98db5bfd7c7b65532e42309c7b71419d82ec5ea8","branch":null,"commitMessage":"Merge pull request #2017 from evoskuil/master","commitDate":"2026-09-28T17:24:16.000Z","mutantCount":230},{"commitSha":"827fb29d0fecbdf7a157e05b1bea59bc916787aa","branch":null,"commitMessage":"Test multisig sighash cache reset across distinct subscripts","commitDate":"2026-09-26T12:24:47.000Z","mutantCount":1},{"commitSha":"8e7a9fdcb4ca72bc5bfe9961815aaa9bc33b64a0","branch":null,"commitMessage":"Remove dead include.","commitDate":"2026-09-25T06:52:28.000Z","mutantCount":90}],"signedIn":false,"pullRequest":{"id":"cmvwrgy0h00ex01n1ycl8rckj","number":2134,"title":"Expanded CI coverage. (clang-cl, Arm, mac x64).","headSha":"121d29eceaf821490dfef9f329758891c584ae57","state":"MERGED","htmlUrl":"https://github.com/libbitcoin/libbitcoin-system/pull/2134","ranges":[[282,282],[289,289]],"fileInDiff":true,"atHead":true}}]