{"id":20060631,"url":"https://github.com/oasisprotocol/curve25519-voi","last_synced_at":"2025-05-16T10:06:15.375Z","repository":{"id":40698341,"uuid":"326705583","full_name":"oasisprotocol/curve25519-voi","owner":"oasisprotocol","description":"High-performance Curve25519/ristretto255 for Go.","archived":false,"fork":false,"pushed_at":"2024-12-13T22:32:29.000Z","size":1334,"stargazers_count":75,"open_issues_count":13,"forks_count":17,"subscribers_count":20,"default_branch":"master","last_synced_at":"2025-04-09T04:06:41.065Z","etag":null,"topics":["batch-verification","cryptography","cryptography-algorithms","curve25519","ed25519","go","golang","ristretto255","sr25519","x25519"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oasisprotocol.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-01-04T14:14:37.000Z","updated_at":"2025-04-03T17:10:40.000Z","dependencies_parsed_at":"2024-06-18T13:59:00.017Z","dependency_job_id":"31238365-5453-4640-a471-045e6b4d60b6","html_url":"https://github.com/oasisprotocol/curve25519-voi","commit_stats":{"total_commits":227,"total_committers":3,"mean_commits":75.66666666666667,"dds":0.008810572687224627,"last_synced_commit":"1f23a7beb09a352354cbd7277c6b7f0170cf6d5d"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oasisprotocol%2Fcurve25519-voi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oasisprotocol%2Fcurve25519-voi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oasisprotocol%2Fcurve25519-voi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oasisprotocol%2Fcurve25519-voi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oasisprotocol","download_url":"https://codeload.github.com/oasisprotocol/curve25519-voi/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254509477,"owners_count":22082891,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["batch-verification","cryptography","cryptography-algorithms","curve25519","ed25519","go","golang","ristretto255","sr25519","x25519"],"created_at":"2024-11-13T13:16:02.054Z","updated_at":"2025-05-16T10:06:15.315Z","avatar_url":"https://github.com/oasisprotocol.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"### curve25519-voi\n\n\u003e It was only machinery.  I’m surprised it’s lasted as long as it has,\n\u003e frankly.  There must still be some residual damage-repair capability.\n\u003e We Demarchists build for posterity, you know.\n\nThis package aims to provide a modern X25519/Ed25519/sr25519\nimplementation for Go, mostly derived from curve25519-dalek.  The\nprimary motivation is to hopefully provide a worthy alternative to\nthe current state of available Go implementations, which is best\ndescribed as \"a gigantic mess of ref10 and donna ports\".  The irony\nof the previous statement in the light of curve25519-dalek's lineage\ndoes not escape this author.\n\n#### WARNING\n\n***DO NOT BOTHER THE curve25519-dalek DEVELOPERS ABOUT THIS PACKAGE***\n\n#### Package structure\n\n * curve: A mid-level API in the spirit of curve25519-dalek.\n * primitives/x25519: A X25519 implementation like `x/crypto/curve25519`.\n * primitives/ed25519: A Ed25519 implementation like `crypto/ed25519`.\n * primitives/ed25519/extra/ecvrf: A implementation of the \"Verifiable Random Functions\" draft (v10, v13).\n * primitives/sr25519: A sr25519 implementation like `https://github.com/w3f/schnorrkel`.\n * primitives/merlin: A Merlin transcript implementation.\n * primitives/h2c: A implementation of the \"Hashing to Elliptic Curves\" draft (v16).\n\n#### Ed25519 verification semantics\n\nAt the time of this writing, Ed25519 signature verification behavior\nvaries based on the implementation.  The implementation provided by\nthis package aims to provide a sensible default, and to support\ncompatibility with other implementations if required.\n\nThe default verification semantics are as follows, using the terminology\nfrom [ed25519-speccheck][1]:\n\n * Both iterative and batch verification are cofactored.\n * Small order A is rejected.\n * Small order R is accepted.\n * Non-canonical A is rejected.\n * Non-canonical R is rejected.\n * A signature's scalar component must be in canonical form (S \u003c L).\n\nPre-defined configuration presets for compatibility with the Go standard\nlibrary, FIPS 186-5/RFC 8032, and ZIP-215 are provided for convenience.\n\nFor more details on this general problem, see [Taming the many EdDSAs][2].\n\n#### Notes\n\nThe curve25519-dalek crate makes use of \"modern\" programing language\nfeatures not available in Go.  This package's mid-level API attempts\nto provide something usable by developers familiar with idiomatic Go,\nand thus has more sharp edges, but in all honestly, developers that\nopt to use the mid-level API in theory already know what they are\ngetting into.  Stability of the mid-level API is currently NOT\nguaranteed.\n\nThe curve25519-dalek crate has a series of nice vectorized backends\nwritten using SIMD intrinsics.  While Go has no SIMD intrinsics, and\nthe assembly dialect is anything but nice, the AVX2 backend is also\npresent in this implementation.\n\nMemory sanitization while maintaining reasonable performance in Go is\na hard/unsolved problem, and this package makes no attempts to do so.\nAnyone that mentions memguard will be asked to re-read the previous\nsentence again, and then be mercilessly mocked.  It is worth noting\nthat the standard library does not do this appropriately either.\n\nThe minimum required Go version for this package follows the Go\nsupport policy, of latest version and the previous one.  Attempting\nto subvert the toolchain checks will result in reduced performance\nor insecurity on certain platforms.\n\nThis package uses build tags to enable the 32-bit or 64-bit backend\nrespectively.  Note that for 64-bit targets, this primarily depends\non if the SSA code (`src/cmd/compile/internal/ssagen/ssa.go`) has\nthe appropriate special cases to make `math/bits.Mul64`/`math/bits.Add64`\nperform well.\n\n * 64-bit: `amd64`, `arm64`, `ppc64le`, `ppc64`, `s390x`\n * 32-bit: `386`, `arm`, `mips`, `mipsle`, `wasm`, `mips64`, `mips64le`, `riscv64`, `loong64`\n * Unsupported: Everything else.\n\n**WARNING**: As a concession to the target's growing popularity, the\n`wasm` target is supported using the 32-bit backend, however the\nWebAssembly specification does not mandate that any opcodes are\nconstant time, making it difficult to provide assurances related to\ntiming side-channels.\n\nThe lack of a generic \"just use 32-bit\" fallback can be blamed on\nthe Go developers rejecting [adding build tags for bit-width][3].\n\nThe lattice reduction implementation currently only has a 64-bit\nversion, and thus it will be used on all platforms.  Note that while\nGo 1.12 had a vartime implementation of `math/bits` routines, that\nversion of the compiler is long unsupported, and the lattice reduction\nis verification only so the lack of a timing guarantee has no security\nimpact.\n\n#### Special credits\n\ncurve25519-voi would not exist if it were not for the amazing work\ndone by various other projects.  Any bugs in curve25519-voi are the\nfault of the curve25519-voi developers alone.\n\n * The majority of curve25519-voi is derived from curve25519-dalek.\n\n * The Ed25519 batch verification started off as a port of the\n   implementation present in ed25519-dalek, but was later switched\n   to be based off ed25519consensus.\n\n * The ABGLSV-Pornin multiplication implementation is derived from\n   a curve25519-dalek pull request by Jack Grigg (@str4d), with\n   additional inspiration taken from Thomas Pornin's paper and\n   curve9767 implementation.\n\n * The assembly optimized field element multiplications were taken\n   (with minor modifications) from George Tankersley's ristretto255\n   package.\n\n * The Elligator 2 mapping was taken from Loup Vaillant's Monocypher\n   package.\n\n[1]: https://github.com/novifinancial/ed25519-speccheck\n[2]: https://eprint.iacr.org/2020/1244.pdf\n[3]: https://github.com/golang/go/issues/33388\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foasisprotocol%2Fcurve25519-voi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foasisprotocol%2Fcurve25519-voi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foasisprotocol%2Fcurve25519-voi/lists"}