Source: ecc.js

  1. /**
  2.  * base class for all ecc operations.
  3.  * @namespace
  4.  */
  5. sjcl.ecc = {};
  7. /**
  8.  * Represents a point on a curve in affine coordinates.
  9.  * @constructor
  10.  * @param {sjcl.ecc.curve} curve The curve that this point lies on.
  11.  * @param {bigInt} x The x coordinate.
  12.  * @param {bigInt} y The y coordinate.
  13.  */
  14. sjcl.ecc.point = function(curve,x,y) {
  15.   if (x === undefined) {
  16.     this.isIdentity = true;
  17.   } else {
  18.     if (x instanceof sjcl.bn) {
  19.       x = new curve.field(x);
  20.     }
  21.     if (y instanceof sjcl.bn) {
  22.       y = new curve.field(y);
  23.     }
  25.     this.x = x;
  26.     this.y = y;
  28.     this.isIdentity = false;
  29.   }
  30.   this.curve = curve;
  31. };
  35. sjcl.ecc.point.prototype = {
  36.   toJac: function() {
  37.     return new sjcl.ecc.pointJac(this.curve, this.x, this.y, new this.curve.field(1));
  38.   },
  40.   mult: function(k) {
  41.     return this.toJac().mult(k, this).toAffine();
  42.   },
  44.   /**
  45.    * Multiply this point by k, added to affine2*k2, and return the answer in Jacobian coordinates.
  46.    * @param {bigInt} k The coefficient to multiply this by.
  47.    * @param {bigInt} k2 The coefficient to multiply affine2 this by.
  48.    * @param {sjcl.ecc.point} affine The other point in affine coordinates.
  49.    * @return {sjcl.ecc.pointJac} The result of the multiplication and addition, in Jacobian coordinates.
  50.    */
  51.   mult2: function(k, k2, affine2) {
  52.     return this.toJac().mult2(k, this, k2, affine2).toAffine();
  53.   },
  55.   multiples: function() {
  56.     var m, i, j;
  57.     if (this._multiples === undefined) {
  58.       j = this.toJac().doubl();
  59.       m = this._multiples = [new sjcl.ecc.point(this.curve), this, j.toAffine()];
  60.       for (i=3; i<16; i++) {
  61.         j = j.add(this);
  62.         m.push(j.toAffine());
  63.       }
  64.     }
  65.     return this._multiples;
  66.   },
  68.   negate: function() {
  69.     var newY = new this.curve.field(0).sub(this.y).normalize().reduce();
  70.     return new sjcl.ecc.point(this.curve, this.x, newY);
  71.   },
  73.   isValid: function() {
  74.     return this.y.square().equals(this.curve.b.add(this.x.mul(this.curve.a.add(this.x.square()))));
  75.   },
  77.   toBits: function() {
  78.     return sjcl.bitArray.concat(this.x.toBits(), this.y.toBits());
  79.   }
  80. };
  82. /**
  83.  * Represents a point on a curve in Jacobian coordinates. Coordinates can be specified as bigInts or strings (which
  84.  * will be converted to bigInts).
  85.  *
  86.  * @constructor
  87.  * @param {bigInt/string} x The x coordinate.
  88.  * @param {bigInt/string} y The y coordinate.
  89.  * @param {bigInt/string} z The z coordinate.
  90.  * @param {sjcl.ecc.curve} curve The curve that this point lies on.
  91.  */
  92. sjcl.ecc.pointJac = function(curve, x, y, z) {
  93.   if (x === undefined) {
  94.     this.isIdentity = true;
  95.   } else {
  96.     this.x = x;
  97.     this.y = y;
  98.     this.z = z;
  99.     this.isIdentity = false;
  100.   }
  101.   this.curve = curve;
  102. };
  104. sjcl.ecc.pointJac.prototype = {
  105.   /**
  106.    * Adds S and T and returns the result in Jacobian coordinates. Note that S must be in Jacobian coordinates and T must be in affine coordinates.
  107.    * @param {sjcl.ecc.pointJac} S One of the points to add, in Jacobian coordinates.
  108.    * @param {sjcl.ecc.point} T The other point to add, in affine coordinates.
  109.    * @return {sjcl.ecc.pointJac} The sum of the two points, in Jacobian coordinates.
  110.    */
  111.   add: function(T) {
  112.     var S = this, sz2, c, d, c2, x1, x2, x, y1, y2, y, z;
  113.     if (S.curve !== T.curve) {
  114.       throw new sjcl.exception.invalid("sjcl.ecc.add(): Points must be on the same curve to add them!");
  115.     }
  117.     if (S.isIdentity) {
  118.       return T.toJac();
  119.     } else if (T.isIdentity) {
  120.       return S;
  121.     }
  123.     sz2 = S.z.square();
  124.     c = T.x.mul(sz2).subM(S.x);
  126.     if (c.equals(0)) {
  127.       if (S.y.equals(T.y.mul(sz2.mul(S.z)))) {
  128.         // same point
  129.         return S.doubl();
  130.       } else {
  131.         // inverses
  132.         return new sjcl.ecc.pointJac(S.curve);
  133.       }
  134.     }
  136.     d = T.y.mul(sz2.mul(S.z)).subM(S.y);
  137.     c2 = c.square();
  139.     x1 = d.square();
  140.     x2 = c.square().mul(c).addM( S.x.add(S.x).mul(c2) );
  141.     x  = x1.subM(x2);
  143.     y1 = S.x.mul(c2).subM(x).mul(d);
  144.     y2 = S.y.mul(c.square().mul(c));
  145.     y  = y1.subM(y2);
  147.     z  = S.z.mul(c);
  149.     return new sjcl.ecc.pointJac(this.curve,x,y,z);
  150.   },
  152.   /**
  153.    * doubles this point.
  154.    * @return {sjcl.ecc.pointJac} The doubled point.
  155.    */
  156.   doubl: function() {
  157.     if (this.isIdentity) { return this; }
  159.     var
  160.       y2 = this.y.square(),
  161.       a  = y2.mul(this.x.mul(4)),
  162.       b  = y2.square().mul(8),
  163.       z2 = this.z.square(),
  164.       c  = this.curve.a.toString() == (new sjcl.bn(-3)).toString() ?
  165.                 this.x.sub(z2).mul(3).mul(this.x.add(z2)) :
  166.                 this.x.square().mul(3).add(z2.square().mul(this.curve.a)),
  167.       x  = c.square().subM(a).subM(a),
  168.       y  = a.sub(x).mul(c).subM(b),
  169.       z  = this.y.add(this.y).mul(this.z);
  170.     return new sjcl.ecc.pointJac(this.curve, x, y, z);
  171.   },
  173.   /**
  174.    * Returns a copy of this point converted to affine coordinates.
  175.    * @return {sjcl.ecc.point} The converted point.
  176.    */
  177.   toAffine: function() {
  178.     if (this.isIdentity || this.z.equals(0)) {
  179.       return new sjcl.ecc.point(this.curve);
  180.     }
  181.     var zi = this.z.inverse(), zi2 = zi.square();
  182.     return new sjcl.ecc.point(this.curve, this.x.mul(zi2).fullReduce(), this.y.mul(zi2.mul(zi)).fullReduce());
  183.   },
  185.   /**
  186.    * Multiply this point by k and return the answer in Jacobian coordinates.
  187.    * @param {bigInt} k The coefficient to multiply by.
  188.    * @param {sjcl.ecc.point} affine This point in affine coordinates.
  189.    * @return {sjcl.ecc.pointJac} The result of the multiplication, in Jacobian coordinates.
  190.    */
  191.   mult: function(k, affine) {
  192.     if (typeof(k) === "number") {
  193.       k = [k];
  194.     } else if (k.limbs !== undefined) {
  195.       k = k.normalize().limbs;
  196.     }
  198.     var i, j, out = new sjcl.ecc.point(this.curve).toJac(), multiples = affine.multiples();
  200.     for (i=k.length-1; i>=0; i--) {
  201.       for (j=sjcl.bn.prototype.radix-4; j>=0; j-=4) {
  202.         out = out.doubl().doubl().doubl().doubl().add(multiples[k[i]>>j & 0xF]);
  203.       }
  204.     }
  206.     return out;
  207.   },
  209.   /**
  210.    * Multiply this point by k, added to affine2*k2, and return the answer in Jacobian coordinates.
  211.    * @param {bigInt} k The coefficient to multiply this by.
  212.    * @param {sjcl.ecc.point} affine This point in affine coordinates.
  213.    * @param {bigInt} k2 The coefficient to multiply affine2 this by.
  214.    * @param {sjcl.ecc.point} affine The other point in affine coordinates.
  215.    * @return {sjcl.ecc.pointJac} The result of the multiplication and addition, in Jacobian coordinates.
  216.    */
  217.   mult2: function(k1, affine, k2, affine2) {
  218.     if (typeof(k1) === "number") {
  219.       k1 = [k1];
  220.     } else if (k1.limbs !== undefined) {
  221.       k1 = k1.normalize().limbs;
  222.     }
  224.     if (typeof(k2) === "number") {
  225.       k2 = [k2];
  226.     } else if (k2.limbs !== undefined) {
  227.       k2 = k2.normalize().limbs;
  228.     }
  230.     var i, j, out = new sjcl.ecc.point(this.curve).toJac(), m1 = affine.multiples(),
  231.         m2 = affine2.multiples(), l1, l2;
  233.     for (i=Math.max(k1.length,k2.length)-1; i>=0; i--) {
  234.       l1 = k1[i] | 0;
  235.       l2 = k2[i] | 0;
  236.       for (j=sjcl.bn.prototype.radix-4; j>=0; j-=4) {
  237.         out = out.doubl().doubl().doubl().doubl().add(m1[l1>>j & 0xF]).add(m2[l2>>j & 0xF]);
  238.       }
  239.     }
  241.     return out;
  242.   },
  244.   negate: function() {
  245.     return this.toAffine().negate().toJac();
  246.   },
  248.   isValid: function() {
  249.     var z2 = this.z.square(), z4 = z2.square(), z6 = z4.mul(z2);
  250.     return this.y.square().equals(
  251.              this.curve.b.mul(z6).add(this.x.mul(
  252.                this.curve.a.mul(z4).add(this.x.square()))));
  253.   }
  254. };
  256. /**
  257.  * Construct an elliptic curve. Most users will not use this and instead start with one of the NIST curves defined below.
  258.  *
  259.  * @constructor
  260.  * @param {bigInt} p The prime modulus.
  261.  * @param {bigInt} r The prime order of the curve.
  262.  * @param {bigInt} a The constant a in the equation of the curve y^2 = x^3 + ax + b (for NIST curves, a is always -3).
  263.  * @param {bigInt} x The x coordinate of a base point of the curve.
  264.  * @param {bigInt} y The y coordinate of a base point of the curve.
  265.  */
  266. sjcl.ecc.curve = function(Field, r, a, b, x, y) {
  267.   this.field = Field;
  268.   this.r = new sjcl.bn(r);
  269.   this.a = new Field(a);
  270.   this.b = new Field(b);
  271.   this.G = new sjcl.ecc.point(this, new Field(x), new Field(y));
  272. };
  274. sjcl.ecc.curve.prototype.fromBits = function (bits) {
  275.   var w = sjcl.bitArray, l = this.field.prototype.exponent + 7 & -8,
  276.       p = new sjcl.ecc.point(this, this.field.fromBits(w.bitSlice(bits, 0, l)),
  277.                              this.field.fromBits(w.bitSlice(bits, l, 2*l)));
  278.   if (!p.isValid()) {
  279.     throw new sjcl.exception.corrupt("not on the curve!");
  280.   }
  281.   return p;
  282. };
  284. sjcl.ecc.curves = {
  285.   c192: new sjcl.ecc.curve(
  286.     sjcl.bn.prime.p192,
  287.     "0xffffffffffffffffffffffff99def836146bc9b1b4d22831",
  288.     -3,
  289.     "0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1",
  290.     "0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012",
  291.     "0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811"),
  293.   c224: new sjcl.ecc.curve(
  294.     sjcl.bn.prime.p224,
  295.     "0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d",
  296.     -3,
  297.     "0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
  298.     "0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
  299.     "0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34"),
  301.   c256: new sjcl.ecc.curve(
  302.     sjcl.bn.prime.p256,
  303.     "0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
  304.     -3,
  305.     "0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
  306.     "0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
  307.     "0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5"),
  309.   c384: new sjcl.ecc.curve(
  310.     sjcl.bn.prime.p384,
  311.     "0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973",
  312.     -3,
  313.     "0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef",
  314.     "0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7",
  315.     "0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f"),
  316.     
  317.   c521: new sjcl.ecc.curve(
  318.     sjcl.bn.prime.p521,
  319.     "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
  320.     -3,
  321.     "0x051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
  322.     "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
  323.     "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650"),
  325.   k192: new sjcl.ecc.curve(
  326.     sjcl.bn.prime.p192k,
  327.     "0xfffffffffffffffffffffffe26f2fc170f69466a74defd8d",
  328.     0,
  329.     3,
  330.     "0xdb4ff10ec057e9ae26b07d0280b7f4341da5d1b1eae06c7d",
  331.     "0x9b2f2f6d9c5628a7844163d015be86344082aa88d95e2f9d"),
  333.   k224: new sjcl.ecc.curve(
  334.     sjcl.bn.prime.p224k,
  335.     "0x010000000000000000000000000001dce8d2ec6184caf0a971769fb1f7",
  336.     0,
  337.     5,
  338.     "0xa1455b334df099df30fc28a169a467e9e47075a90f7e650eb6b7a45c",
  339.     "0x7e089fed7fba344282cafbd6f7e319f7c0b0bd59e2ca4bdb556d61a5"),
  341.   k256: new sjcl.ecc.curve(
  342.     sjcl.bn.prime.p256k,
  343.     "0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
  344.     0,
  345.     7,
  346.     "0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
  347.     "0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8")
  349. };
  351. sjcl.ecc.curveName = function (curve) {
  352.   var curcurve;
  353.   for (curcurve in sjcl.ecc.curves) {
  354.     if (sjcl.ecc.curves.hasOwnProperty(curcurve)) {
  355.       if (sjcl.ecc.curves[curcurve] === curve) {
  356.         return curcurve;
  357.       }
  358.     }
  359.   }
  361.   throw new sjcl.exception.invalid("no such curve");
  362. };
  364. sjcl.ecc.deserialize = function (key) {
  365.   var types = ["elGamal", "ecdsa"];
  367.   if (!key || !key.curve || !sjcl.ecc.curves[key.curve]) { throw new sjcl.exception.invalid("invalid serialization"); }
  368.   if (types.indexOf(key.type) === -1) { throw new sjcl.exception.invalid("invalid type"); }
  370.   var curve = sjcl.ecc.curves[key.curve];
  372.   if (key.secretKey) {
  373.     if (!key.exponent) { throw new sjcl.exception.invalid("invalid exponent"); }
  374.     var exponent = new sjcl.bn(key.exponent);
  375.     return new sjcl.ecc[key.type].secretKey(curve, exponent);
  376.   } else {
  377.     if (!key.point) { throw new sjcl.exception.invalid("invalid point"); }
  378.     
  379.     var point = curve.fromBits(sjcl.codec.hex.toBits(key.point));
  380.     return new sjcl.ecc[key.type].publicKey(curve, point);
  381.   }
  382. };
  384. /** our basicKey classes
  385. */
  386. sjcl.ecc.basicKey = {
  387.   /** ecc publicKey.
  388.   * @constructor
  389.   * @param {curve} curve the elliptic curve
  390.   * @param {point} point the point on the curve
  391.   */
  392.   publicKey: function(curve, point) {
  393.     this._curve = curve;
  394.     this._curveBitLength = curve.r.bitLength();
  395.     if (point instanceof Array) {
  396.       this._point = curve.fromBits(point);
  397.     } else {
  398.       this._point = point;
  399.     }
  401.     this.serialize = function () {
  402.       var curveName = sjcl.ecc.curveName(curve);
  403.       return {
  404.         type: this.getType(),
  405.         secretKey: false,
  406.         point: sjcl.codec.hex.fromBits(this._point.toBits()),
  407.         curve: curveName
  408.       };
  409.     };
  411.     /** get this keys point data
  412.     * @return x and y as bitArrays
  413.     */
  414.     this.get = function() {
  415.       var pointbits = this._point.toBits();
  416.       var len = sjcl.bitArray.bitLength(pointbits);
  417.       var x = sjcl.bitArray.bitSlice(pointbits, 0, len/2);
  418.       var y = sjcl.bitArray.bitSlice(pointbits, len/2);
  419.       return { x: x, y: y };
  420.     };
  421.   },
  423.   /** ecc secretKey
  424.   * @constructor
  425.   * @param {curve} curve the elliptic curve
  426.   * @param exponent
  427.   */
  428.   secretKey: function(curve, exponent) {
  429.     this._curve = curve;
  430.     this._curveBitLength = curve.r.bitLength();
  431.     this._exponent = exponent;
  433.     this.serialize = function () {
  434.       var exponent = this.get();
  435.       var curveName = sjcl.ecc.curveName(curve);
  436.       return {
  437.         type: this.getType(),
  438.         secretKey: true,
  439.         exponent: sjcl.codec.hex.fromBits(exponent),
  440.         curve: curveName
  441.       };
  442.     };
  444.     /** get this keys exponent data
  445.     * @return {bitArray} exponent
  446.     */
  447.     this.get = function () {
  448.       return this._exponent.toBits();
  449.     };
  450.   }
  451. };
  453. /** @private */
  454. sjcl.ecc.basicKey.generateKeys = function(cn) {
  455.   return function generateKeys(curve, paranoia, sec) {
  456.     curve = curve || 256;
  458.     if (typeof curve === "number") {
  459.       curve = sjcl.ecc.curves['c'+curve];
  460.       if (curve === undefined) {
  461.         throw new sjcl.exception.invalid("no such curve");
  462.       }
  463.     }
  464.     sec = sec || sjcl.bn.random(curve.r, paranoia);
  466.     var pub = curve.G.mult(sec);
  467.     return { pub: new sjcl.ecc[cn].publicKey(curve, pub),
  468.              sec: new sjcl.ecc[cn].secretKey(curve, sec) };
  469.   };
  470. };
  472. /** elGamal keys */
  473. sjcl.ecc.elGamal = {
  474.   /** generate keys
  475.   * @function
  476.   * @param curve
  477.   * @param {int} paranoia Paranoia for generation (default 6)
  478.   * @param {secretKey} sec secret Key to use. used to get the publicKey for ones secretKey
  479.   */
  480.   generateKeys: sjcl.ecc.basicKey.generateKeys("elGamal"),
  481.   /** elGamal publicKey.
  482.   * @constructor
  483.   * @augments sjcl.ecc.basicKey.publicKey
  484.   */
  485.   publicKey: function (curve, point) {
  486.     sjcl.ecc.basicKey.publicKey.apply(this, arguments);
  487.   },
  488.   /** elGamal secretKey
  489.   * @constructor
  490.   * @augments sjcl.ecc.basicKey.secretKey
  491.   */
  492.   secretKey: function (curve, exponent) {
  493.     sjcl.ecc.basicKey.secretKey.apply(this, arguments);
  494.   }
  495. };
  497. sjcl.ecc.elGamal.publicKey.prototype = {
  498.   /** Kem function of elGamal Public Key
  499.   * @param paranoia paranoia to use for randomization.
  500.   * @return {object} key and tag. unkem(tag) with the corresponding secret key results in the key returned.
  501.   */
  502.   kem: function(paranoia) {
  503.     var sec = sjcl.bn.random(this._curve.r, paranoia),
  504.         tag = this._curve.G.mult(sec).toBits(),
  505.         key = sjcl.hash.sha256.hash(this._point.mult(sec).toBits());
  506.     return { key: key, tag: tag };
  507.   },
  508.   
  509.   getType: function() {
  510.     return "elGamal";
  511.   }
  512. };
  514. sjcl.ecc.elGamal.secretKey.prototype = {
  515.   /** UnKem function of elGamal Secret Key
  516.   * @param {bitArray} tag The Tag to decrypt.
  517.   * @return {bitArray} decrypted key.
  518.   */
  519.   unkem: function(tag) {
  520.     return sjcl.hash.sha256.hash(this._curve.fromBits(tag).mult(this._exponent).toBits());
  521.   },
  523.   /** Diffie-Hellmann function
  524.   * @param {elGamal.publicKey} pk The Public Key to do Diffie-Hellmann with
  525.   * @return {bitArray} diffie-hellmann result for this key combination.
  526.   */
  527.   dh: function(pk) {
  528.     return sjcl.hash.sha256.hash(pk._point.mult(this._exponent).toBits());
  529.   },
  531.   /** Diffie-Hellmann function, compatible with Java generateSecret
  532.   * @param {elGamal.publicKey} pk The Public Key to do Diffie-Hellmann with
  533.   * @return {bitArray} undigested X value, diffie-hellmann result for this key combination,
  534.   * compatible with Java generateSecret().
  535.   */
  536.   dhJavaEc: function(pk) {
  537.     return pk._point.mult(this._exponent).x.toBits();
  538.   }, 
  540.   getType: function() {
  541.     return "elGamal";
  542.   }
  543. };
  545. /** ecdsa keys */
  546. sjcl.ecc.ecdsa = {
  547.   /** generate keys
  548.   * @function
  549.   * @param curve
  550.   * @param {int} paranoia Paranoia for generation (default 6)
  551.   * @param {secretKey} sec secret Key to use. used to get the publicKey for ones secretKey
  552.   */
  553.   generateKeys: sjcl.ecc.basicKey.generateKeys("ecdsa")
  554. };
  556. /** ecdsa publicKey.
  557. * @constructor
  558. * @augments sjcl.ecc.basicKey.publicKey
  559. */
  560. sjcl.ecc.ecdsa.publicKey = function (curve, point) {
  561.   sjcl.ecc.basicKey.publicKey.apply(this, arguments);
  562. };
  564. /** specific functions for ecdsa publicKey. */
  565. sjcl.ecc.ecdsa.publicKey.prototype = {
  566.   /** Diffie-Hellmann function
  567.   * @param {bitArray} hash hash to verify.
  568.   * @param {bitArray} rs signature bitArray.
  569.   * @param {boolean}  fakeLegacyVersion use old legacy version
  570.   */
  571.   verify: function(hash, rs, fakeLegacyVersion) {
  572.     if (sjcl.bitArray.bitLength(hash) > this._curveBitLength) {
  573.       hash = sjcl.bitArray.clamp(hash, this._curveBitLength);
  574.     }
  575.     var w = sjcl.bitArray,
  576.         R = this._curve.r,
  577.         l = this._curveBitLength,
  578.         r = sjcl.bn.fromBits(w.bitSlice(rs,0,l)),
  579.         ss = sjcl.bn.fromBits(w.bitSlice(rs,l,2*l)),
  580.         s = fakeLegacyVersion ? ss : ss.inverseMod(R),
  581.         hG = sjcl.bn.fromBits(hash).mul(s).mod(R),
  582.         hA = r.mul(s).mod(R),
  583.         r2 = this._curve.G.mult2(hG, hA, this._point).x;
  584.     if (r.equals(0) || ss.equals(0) || r.greaterEquals(R) || ss.greaterEquals(R) || !r2.equals(r)) {
  585.       if (fakeLegacyVersion === undefined) {
  586.         return this.verify(hash, rs, true);
  587.       } else {
  588.         throw (new sjcl.exception.corrupt("signature didn't check out"));
  589.       }
  590.     }
  591.     return true;
  592.   },
  594.   getType: function() {
  595.     return "ecdsa";
  596.   }
  597. };
  599. /** ecdsa secretKey
  600. * @constructor
  601. * @augments sjcl.ecc.basicKey.publicKey
  602. */
  603. sjcl.ecc.ecdsa.secretKey = function (curve, exponent) {
  604.   sjcl.ecc.basicKey.secretKey.apply(this, arguments);
  605. };
  607. /** specific functions for ecdsa secretKey. */
  608. sjcl.ecc.ecdsa.secretKey.prototype = {
  609.   /** Diffie-Hellmann function
  610.   * @param {bitArray} hash hash to sign.
  611.   * @param {int} paranoia paranoia for random number generation
  612.   * @param {boolean} fakeLegacyVersion use old legacy version
  613.   */
  614.   sign: function(hash, paranoia, fakeLegacyVersion, fixedKForTesting) {
  615.     if (sjcl.bitArray.bitLength(hash) > this._curveBitLength) {
  616.       hash = sjcl.bitArray.clamp(hash, this._curveBitLength);
  617.     }
  618.     var R  = this._curve.r,
  619.         l  = R.bitLength(),
  620.         k  = fixedKForTesting || sjcl.bn.random(R.sub(1), paranoia).add(1),
  621.         r  = this._curve.G.mult(k).x.mod(R),
  622.         ss = sjcl.bn.fromBits(hash).add(r.mul(this._exponent)),
  623.         s  = fakeLegacyVersion ? ss.inverseMod(R).mul(k).mod(R)
  624.              : ss.mul(k.inverseMod(R)).mod(R);
  625.     return sjcl.bitArray.concat(r.toBits(l), s.toBits(l));
  626.   },
  628.   getType: function() {
  629.     return "ecdsa";
  630.   }
  631. };