// Package ed25519strict verifies Ed25519 signatures with the strict profile
// of the author signature (spec v0.11, §29.9): the equation of RFC 8032
// without the cofactor, with the public key A and R in their canonical
// encodings, S below ℓ, and A not of small order.
//
// crypto/ed25519 checks S and R, and computes the equation without the
// cofactor, but it accepts a non-canonical A and an A of small order: with A
// = 01 00…00, R the identity and S = 0 it accepts any message. Verify checks A
// first, with an encoding check and the table of the eight points of small
// order, so that no arithmetic on points is written here.
package ed25519strict

import (
	"crypto/ed25519"
	"math/big"
	"slices"
)

// smallOrder are the canonical encodings of the eight points of small order
// of edwards25519: the identity, the point of order 2, the two of order 4 and
// the four of order 8. A canonical A of small order is one of them; the tests
// compute them again.
var smallOrder = [8][32]byte{
	{0x00},
	{31: 0x80},
	{0x01},
	{0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05},
	{0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85},
	{0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a},
	{0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa},
	{0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
}

// Verify reports whether sig is a valid signature of msg by the public key
// pub under the strict profile (spec §29.9). A key or a signature of another
// length is not valid either; the caller tells that case apart (F1).
func Verify(pub, msg, sig []byte) bool {
	if len(pub) != ed25519.PublicKeySize || len(sig) != ed25519.SignatureSize {
		return false
	}
	if !Canonical(pub) || SmallOrder(pub) {
		return false
	}
	// crypto/ed25519 rejects sig[63] & 0xE0 != 0 and S >= ℓ, and compares the
	// encoding of [S]B − [k]A with R, which therefore must be canonical.
	return ed25519.Verify(ed25519.PublicKey(pub), msg, sig)
}

// Canonical reports whether the 32 bytes a are a canonical encoding: their y,
// the low 255 bits, is below p = 2^255 − 19, and their sign bit is clear when
// y is 1 or p − 1, the two values whose x is 0 (spec §29.9, rule 1). It does
// not tell whether y belongs to a point of the curve.
func Canonical(a []byte) bool {
	if len(a) != 32 {
		return false
	}
	high := a[31] & 0x7f
	ones := true
	for _, b := range a[1:31] {
		if b != 0xff {
			ones = false
			break
		}
	}
	// y >= p: 7f ff…ff and a first byte of 0xed or more.
	if high == 0x7f && ones && a[0] >= 0xed {
		return false
	}
	if a[31]&0x80 == 0 {
		return true
	}
	// x = 0: y = 1, 01 00…00, or y = p − 1, ec ff…ff 7f.
	zeros := high == 0
	for _, b := range a[1:31] {
		if b != 0 {
			zeros = false
			break
		}
	}
	isOne := zeros && a[0] == 0x01
	isMinusOne := high == 0x7f && ones && a[0] == 0xec
	return !isOne && !isMinusOne
}

// The field and the curve of edwards25519: p = 2^255 − 19, d = −121665/121666
// mod p, and the exponent (p − 1)/2 of Euler's criterion.
var curveP, curveD, halfP = func() (p, d, h *big.Int) {
	p = new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19))
	d = new(big.Int).ModInverse(big.NewInt(121666), p)
	d.Mul(d, big.NewInt(-121665)).Mod(d, p)
	h = new(big.Int).Rsh(new(big.Int).Sub(p, big.NewInt(1)), 1)
	return p, d, h
}()

// OnCurve reports whether the canonical encoding a is a point of the curve:
// whether x² = (y² − 1)/(d·y² + 1) has a solution modulo p (RFC 8032, 5.1.3).
// Verify leaves that check to crypto/ed25519; a parser of keys uses it to
// refuse a key that no signature could verify (spec §29.9, rule 2). d·y² + 1
// is never 0, because −1/d is not a square.
func OnCurve(a []byte) bool {
	if len(a) != 32 {
		return false
	}
	be := slices.Clone(a)
	be[31] &= 0x7f
	slices.Reverse(be)
	y := new(big.Int).SetBytes(be)
	y2 := new(big.Int).Mul(y, y)
	u := new(big.Int).Sub(y2, big.NewInt(1))
	v := new(big.Int).Mul(curveD, y2)
	v.Add(v, big.NewInt(1)).Mod(v, curveP)
	x2 := u.Mul(u, v.ModInverse(v, curveP))
	x2.Mod(x2, curveP)
	return x2.Sign() == 0 || new(big.Int).Exp(x2, halfP, curveP).Cmp(big.NewInt(1)) == 0
}

// SmallOrder reports whether the canonical encoding a is one of the eight
// points of small order (spec §29.9, rule 2).
func SmallOrder(a []byte) bool {
	if len(a) != 32 {
		return false
	}
	for _, s := range smallOrder {
		if [32]byte(a) == s {
			return true
		}
	}
	return false
}

// SmallOrderPoints returns the canonical encodings of the eight points of
// small order, for the tests and the vectors.
func SmallOrderPoints() [8][32]byte { return smallOrder }