bend-collections

Releases (1)

• 1.0.0.0 indexed

Definitions (4,483)

src/crypto/poly1305/limbs.bend

• def picka when m is all zeros, b when m is all ones.
• def select
• def freezeThe low 16 limbs of h mod p, for h below 2p: g = h + 5 has bit 130 set exactly when h >= p, and then its low 128 bits are those of h - p.
• def bytesn bytes of the value of ds + u (mod 2^(8n)).
• def finThe tag bytes: the low 128 bits of (h mod p) + s.

src/crypto/poly1305/poly1305.bend

• def mask
• def clamp_maskr &= 0x0ffffffc0ffffffc0ffffffc0fffffff, byte by byte.
• def clamp
• def loadA message block as limbs: its bytes, then the 0x01 byte.
• def absorbThe accumulator over 16-byte blocks (the last one possibly shorter); fuel bounds the number of blocks.
• def zero
• def r_keyr = clamp(key[0..16]) and s = key[16..32], as limbs.
• def s_key
• def tag
• def macThe 16-byte tag of msg under key = r || s.
• def has_key
• def when
• def poly1305The tag, or None unless the key has 32 bytes.
• def verifyTrue exactly when the key has 32 bytes and tag is the tag of msg; the tags are compared in constant time (src/crypto/subtle.bend).

src/crypto/random.bend

• type Gen
• def wrap
• def new
• def of_words
• def os_word
• def from_os
• def keep_pending
• def nextthe Source step: the next 64-bit output (pending bytes are left for bytes)
• def le_bytesthe eight little-endian bytes of a 64-bit word
• type Fillthe bytes read so far (latest first), the generator and its pending bytes
• def split_bytes
• def split
• def take1one byte: the next pending byte, or the first byte of a fresh word
• def fill
• def done
• def bytes
• def uint64
• def uint_belowuniform in [0, n) for n > 0
• def shufflea uniform permutation of items

src/crypto/secp256k1.bend

• type Keypair
• def keypair_of
• def generate_keypair
• def word_bytes
• def random_bytes
• def os_retry
• def generate_keypair_os32 bytes of the operating system's random source (getrandom, arc4random, crypto.getRandomValues) as the seed; a seed outside [1, n - 1] (chance 2^-128) is drawn again, up to 8 times
• def public_key
• def sign
• def compact
• def sign_compact
• def verify
• def verify_strict
• def recover
• def eth_address
• def ecrecover
• def schnorr_pubkey
• def schnorr_sign
• def schnorr_verify

src/crypto/secp256k1/bytes.bend

• def byte
• def limbs_lelittle-endian limbs of little-endian bytes (two bytes per limb)
• def of_bethe 16 limbs of a 32-byte big-endian string (SEC 1 OS2IP)
• def bytes_lelittle-endian bytes of limbs below 2^16
• def to_bethe 32-byte big-endian string of 16 limbs (SEC 1 I2OSP)
• def has_len
• def prefix
• def suffix
• def head
• def tail

src/crypto/secp256k1/ecdsa.bend

• type Signature
• def scalar_ok1 <= x < n
• def hash_scalara 32-byte string as a scalar mod n (bits2int with qlen = hlen = 256, reduced: SEC 1 section 4.1.3 step 5, RFC 6979 section 2.3.2)
• type Drbg
• def hmac(the key is looked at first, so that the proof checker keeps an unknown HMAC folded)
• def cat
• def fill
• def drbg_v
• def drbg_stepsteps b-g: V = 0x01..., K = 0x00..., then two HMAC rounds over V || 0x00 || int2octets(x) || bits2octets(h1) and V || 0x01 || ...
• def drbg_second
• def drbg_init
• def drbg_nextstep h.3: K = HMAC_K(V || 0x00), V = HMAC_K(V)
• def b2n
• type Attempt
• def finish_if
• def finishr = x(R) mod n, s = k^-1 (z + r d) mod n, made low (s > n / 2 is replaced by n - s, which flips the parity bit of the recovery id); the recovery id is the parity of y(R), plus 2 when x(R) >= n
• def attempt_aff
• def attempt_ok
• def attemptthe candidate k = bits2int(V) (RFC 6979 step h.3): used when 1 <= k < n
• def sign_loopstep h: the candidate V; a k outside [1, n - 1], or one giving r = 0 or s = 0 (SEC 1 section 4.1.3 steps 3 and 6), is replaced by the next candidate: K = HMAC_K(V || 0x00), V = HMAC_K(V), V = HMAC_K(V).
• def sign_drbg
• def secret_if
• def secretthe secret key d, when 1 <= d < n
• def sign_dsign with a valid secret scalar d: x = int2octets(d), h1' = bits2octets(h) = int2octets(bits2int(h) mod n)
• def sign_h
• def signthe low-S signature of a 32-byte hash under a 32-byte secret key
• def public_point
• def pk_of
• def public_key_d
• def public_keythe SEC 1 encoding of [d] G (33 bytes compressed, 65 uncompressed)
• def verify_rsu1 = z w, u2 = r w with w = s^-1; R = [u1] G + [u2] Q must not be the point at infinity and x(R) mod n must be r
• def verify_ok
• def verify_q