proxy.golang.org: github.com/cloudflare/circl

Package circl provides a collection of cryptographic primitives. The goal of this module is to be used as a tool for experimental deployment of cryptographic algorithms targeting Post-Quantum (PQ) and Elliptic Curve Cryptography (ECC). Following blog post describes ideas behind CIRCL in more details: https://blog.cloudflare.com/introducing-circl/

proxy.golang.org: github.com/cloudflare/circl/internal/sha3

Package sha3 implements the SHA-3 fixed-output-length hash functions and the SHAKE variable-output-length hash functions defined by FIPS-202. Both types of hash function use the "sponge" construction and the Keccak permutation. For a detailed specification see http://keccak.noekeon.org/ If you aren't sure what function you need, use SHAKE256 with at least 64 bytes of output. The SHAKE instances are faster than the SHA3 instances; the latter have to allocate memory to conform to the hash.Hash interface. If you need a secret-key MAC (message authentication code), prepend the secret key to the input, hash with SHAKE256 and read at least 32 bytes of output. The SHA3-x (x equals 224, 256, 384, or 512) functions have a security strength against preimage attacks of x bits. Since they only produce "x" bits of output, their collision-resistance is only "x/2" bits. The SHAKE-256 and -128 functions have a generic security strength of 256 and 128 bits against all attacks, provided that at least 2x bits of their output is used. Requesting more than 64 or 32 bytes of output, respectively, does not increase the collision-resistance of the SHAKE functions. A sponge builds a pseudo-random function from a public pseudo-random permutation, by applying the permutation to a state of "rate + capacity" bytes, but hiding "capacity" of the bytes. A sponge starts out with a zero state. To hash an input using a sponge, up to "rate" bytes of the input are XORed into the sponge's state. The sponge is then "full" and the permutation is applied to "empty" it. This process is repeated until all the input has been "absorbed". The input is then padded. The digest is "squeezed" from the sponge in the same way, except that output is copied out instead of input being XORed in. A sponge is parameterized by its generic security strength, which is equal to half its capacity; capacity + rate is equal to the permutation's width. Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means that the security strength of a sponge instance is equal to (1600 - bitrate) / 2. The SHAKE functions are recommended for most new uses. They can produce output of arbitrary length. SHAKE256, with an output length of at least 64 bytes, provides 256-bit security against all attacks. The Keccak team recommends it for most applications upgrading from SHA2-512. (NIST chose a much stronger, but much slower, sponge instance for SHA3-512.) The SHA-3 functions are "drop-in" replacements for the SHA-2 functions. They produce output of the same length, with the same security strengths against all attacks. This means, in particular, that SHA3-256 only has 128-bit collision resistance, because its output length is 32 bytes.

proxy.golang.org: github.com/cloudflare/circl/sign/ed448

Package ed448 implements Ed448 signature scheme as described in RFC-8032. This package implements two signature variants. Specific functions for sign and verify are defined. A generic signing function for all schemes is available through the crypto.Signer interface, which is implemented by the PrivateKey type. A correspond all-in-one verification method is provided by the VerifyAny function. Both schemes require a context string for domain separation. This parameter is passed using a SignerOptions struct defined in this package. References:

proxy.golang.org: github.com/cloudflare/circl/sign

Package sign provides unified interfaces for signature schemes. A register of schemes is available in the package

proxy.golang.org: github.com/cloudflare/circl/dh/x448

Package x448 provides Diffie-Hellman functions as specified in RFC-7748. Validation of public keys. The Diffie-Hellman function, as described in RFC-7748 [1], works for any public key. However, if a different protocol requires contributory behaviour [2,3], then the public keys must be validated against low-order points [3,4]. To do that, the Shared function performs this validation internally and returns false when the public key is invalid (i.e., it is a low-order point). References:

proxy.golang.org: github.com/cloudflare/circl/dh/x25519

Package x25519 provides Diffie-Hellman functions as specified in RFC-7748. Validation of public keys. The Diffie-Hellman function, as described in RFC-7748 [1], works for any public key. However, if a different protocol requires contributory behaviour [2,3], then the public keys must be validated against low-order points [3,4]. To do that, the Shared function performs this validation internally and returns false when the public key is invalid (i.e., it is a low-order point). References:

proxy.golang.org: github.com/cloudflare/circl/ecc/goldilocks

Package goldilocks provides elliptic curve operations over the goldilocks curve.

proxy.golang.org: github.com/cloudflare/circl/math

Package math provides some utility functions for big integers.

proxy.golang.org: github.com/cloudflare/circl/math/mlsbset

Package mlsbset provides a constant-time exponentiation method with precomputation. References: "Efficient and secure algorithms for GLV-based scalar multiplication and their implementation on GLV–GLS curves" by (Faz-Hernandez et al.)

proxy.golang.org: github.com/cloudflare/circl/math/fp448

Package fp448 provides prime field arithmetic over GF(2^448-2^224-1).

proxy.golang.org: github.com/cloudflare/circl/sign/ed25519

Package ed25519 implements Ed25519 signature scheme as described in RFC-8032. This package provides optimized implementations of the three signature variants and maintaining closer compatibility with crypto/ed25519. Specific functions for sign and verify are defined. A generic signing function for all schemes is available through the crypto.Signer interface, which is implemented by the PrivateKey type. A correspond all-in-one verification method is provided by the VerifyAny function. Signing with Ed25519Ph or Ed25519Ctx requires a context string for domain separation. This parameter is passed using a SignerOptions struct defined in this package. While Ed25519Ph accepts an empty context, Ed25519Ctx enforces non-empty context strings. These functions are compatible with the “Ed25519” function defined in RFC-8032. However, unlike RFC 8032's formulation, this package's private key representation includes a public key suffix to make multiple signing operations with the same key more efficient. This package refers to the RFC-8032 private key as the “seed”. References

proxy.golang.org: github.com/cloudflare/circl/internal/conv

proxy.golang.org: github.com/cloudflare/circl/pke/kyber/internal/common/asm

AVX2 optimized version of polynomial operations. See the comments on the generic implementation for the details of the maths involved.

proxy.golang.org: github.com/cloudflare/circl/simd/keccakf1600/internal/asm

proxy.golang.org: github.com/cloudflare/circl/sign/dilithium/internal/common/asm

AVX2 optimized version of Poly.[Inv]NTT(). See the comments on the generic implementation for details on the maths involved.

proxy.golang.org: github.com/Cloudflare/circl

proxy.golang.org: github.com/cloudflare/circl/sign/internal/dilithium/asm

AVX2 optimized version of Poly.[Inv]NTT(). See the comments on the generic implementation for details on the maths involved.