public abstract class X25519
extends java.lang.Object
Algorithm map.
generatePrivateKey(java.security.SecureRandom, byte[]) — 32 random bytes followed by
clampPrivateKey(byte[]) (RFC 7748 sec. 5 clamping: clear bits
254..255 then 0..2, set bit 254).generatePublicKey(byte[], int, byte[], int) / scalarMultBase(byte[], int, byte[], int) —
computed as k * B on the birationally-equivalent
edwards25519 curve via
Ed25519#scalarMultBaseYZ(Friend, byte[], int, int[], int[])
(a signed multi-comb in extended Edwards coordinates), then
converted to the curve25519 u coordinate using the RFC
7748 sec. 4.1 birational map u = (1 + Y) / (1 - Y)
where Y = y / z.scalarMult(byte[], int, byte[], int, byte[], int) (key agreement) — Montgomery ladder on
XZ-only projective coordinates per RFC 7748 sec. 5, with
per-bit constant-time cswap; the
A24 = (A + 2) / 4 curve constant is precomputed from
A = 486662. The final three doublings correspond to the
always-cleared low bits of the scalar; these clear the cofactor
to ensure a non-twist result.calculateAgreement(byte[], int, byte[], int, byte[], int) — scalarMult(byte[], int, byte[], int, byte[], int) followed
by the RFC 7748 sec. 6.1 all-zero rejection.
Side-channel scope. Secret-scalar operations are written to be
constant-time at the Java level: the Montgomery ladder in
scalarMult(byte[], int, byte[], int, byte[], int) performs identical field operations per bit with
branchless cswap; scalarMultBase(byte[], int, byte[], int) routes through the
Ed25519 signed-comb, which walks all precomputed entries with mask-based
cmov rather than a secret-indexed array load and applies
conditional negation by XOR-with-mask; the final modular inverse uses
constant-time Mod.modOddInverse. The all-zero rejection in
calculateAgreement(byte[], int, byte[], int, byte[], int) runs an OR-accumulator and only leaks the
RFC-mandated public rejection criterion. This is sufficient against a
remote network timing attacker but is not a substitute for a constant-time
native implementation against a co-located cache-line-resolution
adversary — JVM-level timing variance from JIT, GC and cache
eviction is not addressable in pure Java.
| Modifier and Type | Class and Description |
|---|---|
static class |
X25519.Friend |
| Modifier and Type | Field and Description |
|---|---|
static int |
POINT_SIZE |
static int |
SCALAR_SIZE |
| Constructor and Description |
|---|
X25519() |
| Modifier and Type | Method and Description |
|---|---|
static boolean |
calculateAgreement(byte[] k,
int kOff,
byte[] u,
int uOff,
byte[] r,
int rOff) |
static void |
clampPrivateKey(byte[] k) |
static void |
generatePrivateKey(java.security.SecureRandom random,
byte[] k) |
static void |
generatePublicKey(byte[] k,
int kOff,
byte[] r,
int rOff) |
static void |
precompute() |
static void |
scalarMult(byte[] k,
int kOff,
byte[] u,
int uOff,
byte[] r,
int rOff) |
static void |
scalarMultBase(byte[] k,
int kOff,
byte[] r,
int rOff) |
public static final int POINT_SIZE
public static final int SCALAR_SIZE
public static boolean calculateAgreement(byte[] k,
int kOff,
byte[] u,
int uOff,
byte[] r,
int rOff)
public static void clampPrivateKey(byte[] k)
public static void generatePrivateKey(java.security.SecureRandom random,
byte[] k)
public static void generatePublicKey(byte[] k,
int kOff,
byte[] r,
int rOff)
public static void precompute()
public static void scalarMult(byte[] k,
int kOff,
byte[] u,
int uOff,
byte[] r,
int rOff)
public static void scalarMultBase(byte[] k,
int kOff,
byte[] r,
int rOff)