You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
libsxmp/sxt/ed25519.c

223 lines
4.5 KiB
C

/*
* Public Domain, Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange,
* Peter Schwabe, Bo-Yin Yang.
* Copied from supercop-20130419/crypto_sign/ed25519/ref/ed25519.c
*/
#include "config.h"
#include <stdint.h>
#include <sys/types.h>
#include <sxt/ge25519.h>
#include <sxt/rdb.h>
#include <sxt/sxtkey.h>
#include <sxt/ciphers.h>
#include <sxt/lcrypt.h>
/*
* Public Domain, Author: Daniel J. Bernstein
* Copied from nacl-20110221/crypto_verify/32/ref/verify.c
*/
static int crypto_verify_32(const unsigned char *x,const unsigned char *y)
{
unsigned int differentbits = 0;
#define F(i) differentbits |= x[i] ^ y[i];
F(0)
F(1)
F(2)
F(3)
F(4)
F(5)
F(6)
F(7)
F(8)
F(9)
F(10)
F(11)
F(12)
F(13)
F(14)
F(15)
F(16)
F(17)
F(18)
F(19)
F(20)
F(21)
F(22)
F(23)
F(24)
F(25)
F(26)
F(27)
F(28)
F(29)
F(30)
F(31)
return (1 & ((differentbits - 1) >> 8)) - 1;
}
static void get_hram(unsigned char *hram,
const unsigned char *sm,
const unsigned char *pk,
unsigned char *playground,
unsigned long long smlen)
{
unsigned long long i;
SHA512CTX ctx;
for (i = 0;i < 32;++i) playground[i] = sm[i];
for (i = 32;i < 64;++i) playground[i] = pk[i-32];
for (i = 64;i < smlen;++i) playground[i] = sm[i];
ctx = sha512_init();
sha512_update(ctx, playground, smlen);
sha512_final(hram, ctx);
}
int crypto_sign_ed25519_keypair(unsigned char *pk,
unsigned char *sk)
{
sc25519 scsk;
ge25519 gepk;
SHA512CTX ctx;
unsigned char extsk[64];
int i;
int rc;
rc = sxt_get_random(sk, 32, 0);
if (rc < 0){
return -1;
}
ctx = sha512_init();
sha512_update(ctx, sk, 32);
sha512_final(extsk, ctx);
extsk[0] &= 248;
extsk[31] &= 127;
extsk[31] |= 64;
sc25519_from32bytes(&scsk,extsk);
ge25519_scalarmult_base(&gepk, &scsk);
ge25519_pack(pk, &gepk);
for(i=0;i<32;i++) {
sk[32 + i] = pk[i];
}
return 0;
}
int crypto_sign_ed25519(unsigned char *sm,
unsigned long long *smlen,
const unsigned char *m,
unsigned long long mlen,
const unsigned char *sk)
{
sc25519 sck, scs, scsk;
ge25519 ger;
SHA512CTX ctx;
unsigned char r[32];
unsigned char s[32];
unsigned char extsk[64];
unsigned long long i;
unsigned char hmg[SHA512_DIGEST_LEN];
unsigned char hram[SHA512_DIGEST_LEN];
ctx = sha512_init();
sha512_update(ctx, sk, 32);
sha512_final(extsk, ctx);
extsk[0] &= 248;
extsk[31] &= 127;
extsk[31] |= 64;
*smlen = mlen + 64;
for (i = 0;i < mlen; i++) {
sm[64 + i] = m[i];
}
for (i = 0;i < 32; i++) {
sm[32 + i] = extsk[32+i];
}
/* Generate k as h(extsk[32],...,extsk[63],m) */
ctx = sha512_init();
sha512_update(ctx, sm + 32, mlen + 32);
sha512_final(hmg, ctx);
/* Computation of R */
sc25519_from64bytes(&sck, hmg);
ge25519_scalarmult_base(&ger, &sck);
ge25519_pack(r, &ger);
/* Computation of s */
for (i = 0; i < 32; i++) {
sm[i] = r[i];
}
get_hram(hram, sm, sk+32, sm, mlen+64);
sc25519_from64bytes(&scs, hram);
sc25519_from32bytes(&scsk, extsk);
sc25519_mul(&scs, &scs, &scsk);
sc25519_add(&scs, &scs, &sck);
sc25519_to32bytes(s,&scs); /* cat s */
for (i = 0;i < 32; i++) {
sm[32 + i] = s[i];
}
return 0;
}
int crypto_sign_ed25519_open(unsigned char *m,
unsigned long long *mlen,
const unsigned char *sm,
unsigned long long smlen,
const unsigned char *pk)
{
unsigned int i;
int ret;
unsigned char t2[32];
ge25519 get1, get2;
sc25519 schram, scs;
unsigned char hram[SHA512_DIGEST_LEN];
*mlen = (unsigned long long) -1;
if (smlen < 64) return -1;
if (ge25519_unpackneg_vartime(&get1, pk)) {
return -1;
}
get_hram(hram,sm,pk,m,smlen);
sc25519_from64bytes(&schram, hram);
sc25519_from32bytes(&scs, sm+32);
ge25519_double_scalarmult_vartime(&get2,
&get1,
&schram,
&ge25519_base,
&scs);
ge25519_pack(t2, &get2);
ret = crypto_verify_32(sm, t2);
if (ret != 0) {
for (i = 0; i < smlen - 64; i++) {
m[i] = sm[i + 64];
}
*mlen = smlen-64;
} else {
for (i = 0; i < smlen - 64; i++) {
m[i] = 0;
}
}
return ret;
}