asanso

#BLS6 curve taken from https://eprint.iacr.org/2019/431.pdf Table 15

def computeS(n,c):
    """
    (Algorithm 2.35: Lenstra, Verheul: An overview of the XTR public key system)
    Computes S_n(c) as defined in Lenstra, Verheul.
    Parameters:
    (int) n>0;
    (GF(p^2)) c
    Returns:

asanso

asanso

asanso

p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001

# assert p.is_prime()
# assert r.is_prime()

proof.arithmetic(False)

Fp = GF(p)
Fpx.<x> = Fp[]

asanso

<script>
var ec8fc = {
        valueOf: function () {
            alert("valueOf1");
            return 1;
        }
    };
var cd0b2 = {
        valueOf: function () {
            alert("valueOf2");

asanso

cd0b2-ec8fc
d4ca7-cbb2f
cd0b2-ec8fc
dd8fd-a90f9
dfaf5-bfb21
aed4b-47351
d1950-f654a
b05b8-aa6af
fdff0-a95f4
d347b-eff1d

asanso

test

asanso

<script>  
window.crypto.subtle.generateKey(
    {
        name: "AES-GCM",
        length: 256, //can be  128, 192, or 256
    },
    false, //whether the key is extractable (i.e. can be used in exportKey)
    ["encrypt", "decrypt"] //can "encrypt", "decrypt", "wrapKey", or "unwrapKey"
)
.then(function(key){

asanso

function recover(privateKey) {
    console.log("recover");
    const MALICIOUS_PRIME = new Uint8Array([129,0,0,0,0,0,0,0,0,0,0,0,0,0,0,17]);
    // this generator has order 5
    const MALICIOUS_GENERATOR = new Uint8Array([46,35,147,92,93,21,176,170,70,144,93,164,112,85,178,126]);

    privateKey.algorithm.generator =  MALICIOUS_GENERATOR;
    privateKey.algorithm.prime =  MALICIOUS_PRIME;
    window.crypto.subtle.generateKey(
    {

asanso

/*
 * Arguments:
 *   priv: CryptoKey representing a DH private key
 *   pub: CryptoKey representing a DH public key
 *
 * Returns: Promise resolving to ArrayBuffer
 */
async function secret(priv, pub) {
  return await window.crypto.subtle.deriveBits(
    {