Class X448

java.lang.Object

org.bouncycastle.math.ec.rfc7748.X448

public abstract class X448
extends Object

A low-level implementation of X448 (RFC 7748).

Algorithm map.

• generatePrivateKey(SecureRandom, byte[]) — 56 random bytes followed by clampPrivateKey(byte[]) (RFC 7748 sec. 5 clamping: clear bits 0..1, set bit 447).
• generatePublicKey(byte[], int, byte[], int) / scalarMultBase(byte[], int, byte[], int) — computed as k * B on the 4-isogenous edwards448 curve via Ed448.scalarMultBaseXY(Friend, byte[], int, int[], int[]) (a signed multi-comb in projective Edwards coordinates), then converted to the curve448 u coordinate using the RFC 7748 sec. 4.2 4-isogeny map u = (y / x)^2.
• scalarMult(byte[], int, byte[], int, byte[], int) (key agreement) — Montgomery ladder on XZ-only projective coordinates per RFC 7748 sec. 5, with per-bit constant-time cswap; the A24 = (A + 2) / 4 curve constant is precomputed from A = 156326. The final two doublings correspond to the always-cleared low bits of the scalar; these clear the cofactor to ensure a non-twist result.
• calculateAgreement(byte[], int, byte[], int, byte[], int) — scalarMult(byte[], int, byte[], int, byte[], int) followed by the RFC 7748 sec. 6.2 all-zero rejection.

Side-channel scope. Secret-scalar operations are written to be constant-time at the Java level: the Montgomery ladder in scalarMult(byte[], int, byte[], int, byte[], int) performs identical field operations per bit with branchless cswap; scalarMultBase(byte[], int, byte[], int) routes through the Ed448 signed-comb, which walks all precomputed entries with mask-based cmov rather than a secret-indexed array load and applies conditional negation by XOR-with-mask; the final modular inverse uses constant-time Mod.modOddInverse. The all-zero rejection in calculateAgreement(byte[], int, byte[], int, byte[], int) runs an OR-accumulator and only leaks the RFC-mandated public rejection criterion. This is sufficient against a remote network timing attacker but is not a substitute for a constant-time native implementation against a co-located cache-line-resolution adversary — JVM-level timing variance from JIT, GC and cache eviction is not addressable in pure Java.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	X448.Friend

Field Summary

Fields

Modifier and Type	Field	Description
static final int	POINT_SIZE
static final int	SCALAR_SIZE

Constructor Summary

Constructors

Constructor	Description
X448()

Method Summary

Modifier and Type	Method	Description
static boolean	calculateAgreement(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)
static void	clampPrivateKey(byte[] k)
static void	generatePrivateKey(SecureRandom random, byte[] k)
static void	generatePublicKey(byte[] k, int kOff, byte[] r, int rOff)
static void	precompute()
static void	scalarMult(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)
static void	scalarMultBase(byte[] k, int kOff, byte[] r, int rOff)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

POINT_SIZE

public static final int POINT_SIZE

See Also:

• Constant Field Values

SCALAR_SIZE

public static final int SCALAR_SIZE

See Also:

• Constant Field Values

Constructor Details

X448

public X448()

Method Details

calculateAgreement

public static boolean calculateAgreement(byte[] k,
 int kOff,
 byte[] u,
 int uOff,
 byte[] r,
 int rOff)

clampPrivateKey

public static void clampPrivateKey(byte[] k)

generatePrivateKey

public static void generatePrivateKey(SecureRandom random,
 byte[] k)

generatePublicKey

public static void generatePublicKey(byte[] k,
 int kOff,
 byte[] r,
 int rOff)

precompute

public static void precompute()

scalarMult

public static void scalarMult(byte[] k,
 int kOff,
 byte[] u,
 int uOff,
 byte[] r,
 int rOff)

scalarMultBase

public static void scalarMultBase(byte[] k,
 int kOff,
 byte[] r,
 int rOff)