# Copyright (c) 2014-2022, The Monero Project
# 
# All rights reserved.
# 
# Redistribution and use in source and binary forms, with or without modification, are
# permitted provided that the following conditions are met:
# 
# 1. Redistributions of source code must retain the above copyright notice, this list of
#    conditions and the following disclaimer.
# 
# 2. Redistributions in binary form must reproduce the above copyright notice, this list
#    of conditions and the following disclaimer in the documentation and/or other
#    materials provided with the distribution.
# 
# 3. Neither the name of the copyright holder nor the names of its contributors may be
#    used to endorse or promote products derived from this software without specific
#    prior written permission.
# 
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
# THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
# THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
# 
# Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers

use Math::BigInt only => 'GMP';
use Digest::Keccak qw(keccak_256);

my $p = Math::BigInt->new(2)->bpow(255)->bsub(19);		#F_p
my $l = Math::BigInt->new(2)->bpow(252)->badd('27742317777372353535851937790883648493');
#my $d = Math::BigInt->new(486662); 					#motgomery: y^2 = x^3 + 486662x^2 + x
my $d = Math::BigInt->new(-121665)->bmul(minv(121666))->bmod($p); 	#twisted edwards: -x^2 +y^2 = 1 + d*x^2*y^2
my $x0 = Math::BigInt->new('15112221349535400772501151409588531511454012693041857206046113283949847762202');
my $y0 = Math::BigInt->new('46316835694926478169428394003475163141307993866256225615783033603165251855960');		#y0 = 4/5
my $m = Math::BigInt->new('7237005577332262213973186563042994240829374041602535252466099000494570602493'); 		#p = 8m+5
my $ps = $p->copy()->bdec->bdiv(4);
my $pl = $p->copy()->bdec->bdiv(2);
my $ii = Math::BigInt->new(2)->bmodpow($ps,$p);		#sqrt(-1)

sub ec_rec {
	my $y = Math::BigInt->new($_[0]);
	my $xx = $y->copy()->bpow(2)->bdec()->bmul(minv($y->copy()->bpow(2)->bmul($d)->binc))->bmod($p);
	return 0 if !($xx->copy()->bmodpow($pl,$p)->binc->bmod($p));
	my $p2 = $p->copy()->badd(3)->bdiv(8);
	my $x = $xx->copy()->bmodpow($p2, $p);
	if ($x->copy()->bpow(2)->bsub($xx)->bmod($p)) {$x->bmul($ii)->bmod($p)}
	if ($x->is_odd) {$x = $p->copy()->bsub($x)};
	return $x;
	} 

sub h2i {
	return Math::BigInt->new('0x'.(unpack 'H*', (reverse pack 'H*', shift)));;
	}

sub i2h {
	my $t = substr(Math::BigInt->new(shift)->as_hex(),2,64);
	if (length($t)%2 == 1) {$t = '0'.$t}
	return unpack 'H*', (reverse pack 'H*', $t);
	}
	
	
sub random {
	return keccak_256(rand(2**20));
	#return keccak_256(3); #I swear that's random!
	}

sub ec_pack {
	my $x = Math::BigInt->new($_[0]);
	my $y = Math::BigInt->new($_[1]);
	my $or = Math::BigInt->new(2)->bpow(255);
	$y |= $or if ($x->is_odd());
	return unpack 'H*', (reverse pack 'H*', substr($y->as_hex(),2,64));
	}
	
sub ec_unpack {
	my $y = Math::BigInt->new(h2i(shift));
	my $b = $y >> 255;
	my $and = Math::BigInt->new(2)->bpow(255)->bdec();
	$y &= $and;
	my $x = ec_rec($y);
	return (0,0) if $x==0;
	($b==0) || ($x = $p->copy()->bsub($x));
	return ($x,$y);
	}


sub minv {
	my $x = Math::BigInt->new(shift);
	$x->bmodpow($p-2,$p);
	return $x;
	}
	
	
sub ec_doub {
	my $x = Math::BigInt->new($_[0]);
	my $y = Math::BigInt->new($_[1]);
	
	#$t = $x->copy()->bpow(2)->bmul(3)->badd($x->copy()->bmul($d)->bmul(2))->binc()->bmul(minv($y->copy()->bmul(2)));			#montgomery
	#$x2 = $t->copy()->bpow(2)->bsub($d)->bsub($x)->bsub($x)->bmod($p);												#montgomery
	#$y2 = $x->copy()->bmul(2)->badd($x)->badd($d)->bmul($t)->bsub($t->copy()->bpow(3))->bsub($y)->bmod($p);		#montgomery
	$t = $x->copy()->bmul($x)->bmul($y)->bmul($y)->bmul($d)->bmod($p);
	$x3 = $x->copy()->bmul($y)->bmul(2)->bmul(minv($t+1))->bmod($p);
	$y3 = $y->copy()->bpow(2)->badd($x->copy()->bpow(2))->bmul(minv(1-$t))->bmod($p);
	return ($x3,$y3);
	}
sub ec_add {
	my $x1 = Math::BigInt->new($_[0]);
	my $y1 = Math::BigInt->new($_[1]);
	my $x2 = Math::BigInt->new($_[2]);
	my $y2 = Math::BigInt->new($_[3]);	
	
	#$t = $y2->copy()->bsub($y1)->bmul(minv($x2->copy()->bsub($x1)));
	#$x3 = $t->copy()->bpow(2)->bsub($d)->bsub($x1)->bsub($x2)->bmod($p);
	#$y3 = $x1->copy()->bmul(2)->badd($x2)->badd($d)->bmul($t)->bsub($t->copy()->bpow(3))->bsub($y1)->bmod($p);
	$t = $x1->copy->bmul($x2)->bmul($y1)->bmul($y2)->bmul($d)->bmod($p);
	$x3 = $x1->copy()->bmul($y2)->badd($y1->copy()->bmul($x2))->bmul(minv($t+1))->bmod($p); 
	$y3 = $y1->copy()->bmul($y2)->badd($x1->copy()->bmul($x2))->bmul(minv(1-$t))->bmod($p);
	
	
	return ($x3,$y3);
	}
	
sub ec_mul {
	my $n = Math::BigInt->new($_[0]);
	my $x = Math::BigInt->new($_[1]);
	my $y = Math::BigInt->new($_[2]);

	if ($n->is_one()) {
		return ($x,$y);
		last;
		}
	elsif ($n->is_even()) {	
		$n->bdiv(2);
		return ec_mul($n,&ec_doub($x,$y));
		}
	else {
		$n->bdec()->bdiv(2);
		return ec_add($x,$y,ec_mul($n,&ec_doub($x,$y))); 	
		}
	}
	
sub pkeygen {
	my $key = Math::BigInt->new(h2i(shift))->bmod($l);
	return ec_pack(ec_mul($key,$x0,$y0));
	}

sub ec_hash {
	my $h = pack 'H*', shift;
	my $h = Math::BigInt->new('0x'.(unpack 'H*', reverse keccak_256($h)));
	my ($x,$y) = (0,0);
	while ($x == 0) {
		($x,$y) = ec_unpack(i2h($h));
		$h->binc();
		}
	return ec_mul(8,$x,$y);
	}
	
sub im_gen {
	my ($x,$y) = ec_hash(shift);
	my $k = Math::BigInt->new(h2i(shift))->bmod($l);
	return ec_pack(ec_mul($k,$x,$y));
	}
	
	
sub sign {
	my ($m,$sec_key) = @_;
	my $sec_key = Math::BigInt->new(h2i($sec_key));
	my ($x,$y) = ec_mul($sec_key,$x0,$y0);
	my $k = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
	#my $k = Math::BigInt->new('5267557024171956683337957876581522196748200715787296882078421399301151717969');
	my $e = unpack 'H*', keccak_256($m.(pack 'H*', ec_pack(ec_mul($k,$x0,$y0))));
	my $s = i2h(Math::BigInt->new(h2i($e))->bmul($sec_key)->bneg()->badd($k)->bmod($l));
	$e = i2h(Math::BigInt->new(h2i($e))->bmod($l));
	return ($s,$e);	
	}
	
sub check_s {
	my ($m,$pt,$s1,$e1) = @_;
	my ($x,$y) = ec_unpack($pt);
	my $s = Math::BigInt->new(h2i($s1))->bmod($l);
	my $e = Math::BigInt->new(h2i($e1))->bmod($l);
	my ($x1,$y1) = ec_add(ec_mul($s,$x0,$y0),ec_mul($e,$x,$y));
	$m = $m.(pack 'H*', ec_pack($x1,$y1));
	my $ev = Math::BigInt->new(h2i(unpack 'H*', keccak_256($m)))->bmod($l);
	
	return !$ev->bcmp($e); 	
	}

sub r_sign {
	my ($m,$image,$sec_key,$index,@pkeys) = @_;
	my ($ix,$iy) = ec_unpack($image);
	my $n = @pkeys;		
	my $data = $m;
	my $w = $a = $b = $hx = $hy = $px = $py = 0;
	my @zc = ();
	my $sum = Math::BigInt->new();
	#print "begin signing ($n keys)\n";
	for $i (0..$n-1) {
		($hx, $hy) = ec_hash(@pkeys[$i]);
		($px,$py) = ec_unpack(@pkeys[$i]);
		if ($i == $index) {
			$w = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
			$a = pack 'H*', ec_pack(ec_mul($w,$x0,$y0));
			$b = pack 'H*', ec_pack(ec_mul($w,$hx,$hy));
			push @zc,0,0;
			} 
		else {
			$z = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
			$c = Math::BigInt->new('0x'.(unpack 'H*', random()))->bmod($l);
			$sum->badd($c);
			$a = pack 'H*', ec_pack(ec_add(ec_mul($z,$x0,$y0),ec_mul($c,$px,$py)));
			$b = pack 'H*', ec_pack(ec_add(ec_mul($z,$hx,$hy),ec_mul($c,$ix,$iy)));
			push @zc,i2h($z),i2h($c);
			}
		$data = $data.$a.$b;
		#print "key number $i done\n";
		}
	#print "generating ringsig..\n";
	my $h = unpack 'H*', keccak_256($data);
	my $cy = Math::BigInt->new(h2i($h))->bsub($sum)->bmod($l);
	my $zy = $cy->copy()->bmul(h2i($sec_key))->bneg()->badd($w)->bmod($l);
	@zc[2*$index] = i2h($zy);
	@zc[2*$index+1] = i2h($cy);
	return @zc;	
	}

sub r_check_s {
	my ($m,$image,@zc) = @_;
	my $n = @zc/3;
	for $j (0..$n-1) {
		@pkeys[$j] = shift @zc;
		}
	my $data = $m;
	my ($ix,$iy) = ec_unpack($image);	
	my $a = $b = $hx = $hy = $px = $py = $z = $c = 0;
	my $sum = Math::BigInt->new();
	#print "\nBegin checking ($n keys)\n";
	for $i (0..$n-1) {
		$z = Math::BigInt->new(h2i(shift @zc))->bmod($l);
		$c = Math::BigInt->new(h2i(shift @zc))->bmod($l);
		$sum->badd($c)->bmod($l);
		($px,$py) = ec_unpack(@pkeys[$i]);
		$a = pack 'H*', ec_pack(ec_add(ec_mul($z,$x0,$y0),ec_mul($c,$px,$py)));
		($hx, $hy) = ec_hash(@pkeys[$i]);
		$b = pack 'H*', ec_pack(ec_add(ec_mul($z,$hx,$hy),ec_mul($c,$ix,$iy)));
		$data = $data.$a.$b;
		#print "key number $i done\n";
		}
	my $h = Math::BigInt->new(h2i(unpack 'H*',  keccak_256($data)))->bmod($l);
	
	return !$h->bcmp($sum);
	}