diff options
| author | Gluzskiy Alexandr <sss@sss.chaoslab.ru> | 2018-04-24 12:01:36 +0300 |
|---|---|---|
| committer | Gluzskiy Alexandr <sss@sss.chaoslab.ru> | 2018-04-24 12:01:36 +0300 |
| commit | 0b1150d20f49eb0ec82b57ab3fac727f346c0da0 (patch) | |
| tree | 387c1d63df86419dd92f2c6adef701567c6bf91f /libs/libaxolotl/src/curve25519/ed25519 | |
| parent | 0998b447f51c40d2300db7f673e080de20e8f0be (diff) | |
libs:
updated libsignal-c
protocols:
jabber: omemo:
used 31bit device id instead of 32bit (32bit conflicts with conversations, not xep compliant)
Diffstat (limited to 'libs/libaxolotl/src/curve25519/ed25519')
26 files changed, 2039 insertions, 1025 deletions
diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/crypto_additions.h b/libs/libaxolotl/src/curve25519/ed25519/additions/crypto_additions.h index 9339ddb981..5c4b8f47bf 100644 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/crypto_additions.h +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/crypto_additions.h @@ -26,16 +26,6 @@ void ge_scalarmult_cofactor(ge_p3 *q, const ge_p3 *p); void elligator(fe u, const fe r); void hash_to_point(ge_p3* p, const unsigned char* msg, const unsigned long in_len); -void calculate_Bv(ge_p3* Bv, - unsigned char* buf, - const unsigned char* A, - const unsigned char* msg, const unsigned long msg_len); -void calculate_Bv_and_V(ge_p3* Bv, - unsigned char* V, - unsigned char* buf, - const unsigned char* a, - const unsigned char* A, - const unsigned char* msg, const unsigned long msg_len); int crypto_sign_modified( unsigned char *sm, @@ -51,19 +41,5 @@ int crypto_sign_open_modified( const unsigned char *pk ); -int crypto_vsign_modified( - unsigned char *sm, - const unsigned char *M,unsigned long Mlen, - const unsigned char *a, - const unsigned char *A, - const unsigned char *random, - const ge_p3 *Bu, - const unsigned char *U); - -int crypto_vsign_open_modified( - unsigned char *m, - const unsigned char *sm,unsigned long long smlen, - const unsigned char *pk, const ge_p3* Bu); - #endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/curve_sigs.c b/libs/libaxolotl/src/curve25519/ed25519/additions/curve_sigs.c index 7a49b18aaa..325472427c 100644 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/curve_sigs.c +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/curve_sigs.c @@ -1,5 +1,5 @@ -#include <string.h> #include <stdlib.h> +#include <string.h> #include "ge.h" #include "curve_sigs.h" #include "crypto_sign.h" diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/elligator.c b/libs/libaxolotl/src/curve25519/ed25519/additions/elligator.c index 6feb96bad6..17b03a71f6 100644 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/elligator.c +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/elligator.c @@ -78,34 +78,3 @@ void hash_to_point(ge_p3* p, const unsigned char* in, const unsigned long in_len } -void calculate_Bv(ge_p3* Bv, - unsigned char* buf, - const unsigned char* A, - const unsigned char* msg, const unsigned long msg_len) -{ - int count; - - /* Calculate SHA512(label(2) || A || msg) */ - buf[0] = 0xFD; - for (count = 1; count < 32; count++) - buf[count] = 0xFF; - memmove(buf+32, A, 32); - memmove(buf+64, msg, msg_len); - - hash_to_point(Bv, buf, 64 + msg_len); -} - - -void calculate_Bv_and_V(ge_p3* Bv, - unsigned char* V, - unsigned char* buf, - const unsigned char* a, - const unsigned char* A, - const unsigned char* msg, const unsigned long msg_len) -{ - ge_p3 p3; - - calculate_Bv(Bv, buf, A, msg, msg_len); - ge_scalarmult(&p3, a, Bv); - ge_p3_tobytes(V, &p3); -} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/ge_p3_add.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/ge_p3_add.c new file mode 100644 index 0000000000..75d9673d01 --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/ge_p3_add.c @@ -0,0 +1,15 @@ +#include "ge.h" + +/* +r = p + q +*/ + +void ge_p3_add(ge_p3 *r, const ge_p3 *p, const ge_p3 *q) +{ + ge_cached p_cached; + ge_p1p1 r_p1p1; + + ge_p3_to_cached(&p_cached, p); + ge_add(&r_p1p1, q, &p_cached); + ge_p1p1_to_p3(r, &r_p1p1); +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_constants.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_constants.h new file mode 100644 index 0000000000..392a88e57b --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_constants.h @@ -0,0 +1,19 @@ +#ifndef _GEN_CONSTANTS_H__ +#define _GEN_CONSTANTS_H__ + +#define LABELSETMAXLEN 512 +#define LABELMAXLEN 128 +#define BUFLEN 1024 +#define BLOCKLEN 128 /* SHA512 */ +#define HASHLEN 64 /* SHA512 */ +#define POINTLEN 32 +#define SCALARLEN 32 +#define RANDLEN 32 +#define SIGNATURELEN 64 +#define VRFSIGNATURELEN 96 +#define VRFOUTPUTLEN 32 +#define MSTART 2048 +#define MSGMAXLEN 1048576 + +#endif + diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_crypto_additions.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_crypto_additions.h new file mode 100644 index 0000000000..569ae26f4d --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_crypto_additions.h @@ -0,0 +1,16 @@ + +#ifndef __GEN_CRYPTO_ADDITIONS__ +#define __GEN_CRYPTO_ADDITIONS__ + +#include "crypto_uint32.h" +#include "fe.h" +#include "ge.h" + +int sc_isreduced(const unsigned char* s); + +int point_isreduced(const unsigned char* p); + +void ge_p3_add(ge_p3 *r, const ge_p3 *p, const ge_p3 *q); + +#endif + diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.c new file mode 100644 index 0000000000..9755d28ede --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.c @@ -0,0 +1,349 @@ +#include <string.h> +#include "gen_eddsa.h" +#include "gen_labelset.h" +#include "gen_constants.h" +#include "gen_crypto_additions.h" +#include "crypto_hash_sha512.h" +#include "crypto_verify_32.h" +#include "zeroize.h" +#include "ge.h" +#include "sc.h" +#include "crypto_additions.h" +#include "utility.h" + +/* B: base point + * R: commitment (point), + r: private nonce (scalar) + K: encoded public key + k: private key (scalar) + Z: 32-bytes random + M: buffer containing message, message starts at M_start, continues for M_len + + r = hash(B || labelset || Z || pad1 || k || pad2 || labelset || K || extra || M) (mod q) +*/ +int generalized_commit(unsigned char* R_bytes, unsigned char* r_scalar, + const unsigned char* labelset, const unsigned long labelset_len, + const unsigned char* extra, const unsigned long extra_len, + const unsigned char* K_bytes, const unsigned char* k_scalar, + const unsigned char* Z, + unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len) +{ + ge_p3 R_point; + unsigned char hash[HASHLEN]; + unsigned char* bufstart = NULL; + unsigned char* bufptr = NULL; + unsigned char* bufend = NULL; + unsigned long prefix_len = 0; + + if (labelset_validate(labelset, labelset_len) != 0) + goto err; + if (R_bytes == NULL || r_scalar == NULL || + K_bytes == NULL || k_scalar == NULL || + Z == NULL || M_buf == NULL) + goto err; + if (extra == NULL && extra_len != 0) + goto err; + if (extra != NULL && extra_len == 0) + goto err; + if (extra != NULL && labelset_is_empty(labelset, labelset_len)) + goto err; + if (HASHLEN != 64) + goto err; + + prefix_len = 0; + prefix_len += POINTLEN + labelset_len + RANDLEN; + prefix_len += ((BLOCKLEN - (prefix_len % BLOCKLEN)) % BLOCKLEN); + prefix_len += SCALARLEN; + prefix_len += ((BLOCKLEN - (prefix_len % BLOCKLEN)) % BLOCKLEN); + prefix_len += labelset_len + POINTLEN + extra_len; + if (prefix_len > M_start) + goto err; + + bufstart = M_buf + M_start - prefix_len; + bufptr = bufstart; + bufend = M_buf + M_start; + bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, labelset, labelset_len); + bufptr = buffer_add(bufptr, bufend, Z, RANDLEN); + bufptr = buffer_pad(bufstart, bufptr, bufend); + bufptr = buffer_add(bufptr, bufend, k_scalar, SCALARLEN); + bufptr = buffer_pad(bufstart, bufptr, bufend); + bufptr = buffer_add(bufptr, bufend, labelset, labelset_len); + bufptr = buffer_add(bufptr, bufend, K_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, extra, extra_len); + if (bufptr != bufend || bufptr != M_buf + M_start || bufptr - bufstart != prefix_len) + goto err; + + crypto_hash_sha512(hash, M_buf + M_start - prefix_len, prefix_len + M_len); + sc_reduce(hash); + ge_scalarmult_base(&R_point, hash); + ge_p3_tobytes(R_bytes, &R_point); + memcpy(r_scalar, hash, SCALARLEN); + + zeroize(hash, HASHLEN); + zeroize(bufstart, prefix_len); + return 0; + +err: + zeroize(hash, HASHLEN); + zeroize(M_buf, M_start); + return -1; +} + +/* if is_labelset_empty(labelset): + return hash(R || K || M) (mod q) + else: + return hash(B || labelset || R || labelset || K || extra || M) (mod q) +*/ +int generalized_challenge(unsigned char* h_scalar, + const unsigned char* labelset, const unsigned long labelset_len, + const unsigned char* extra, const unsigned long extra_len, + const unsigned char* R_bytes, + const unsigned char* K_bytes, + unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len) +{ + unsigned char hash[HASHLEN]; + unsigned char* bufstart = NULL; + unsigned char* bufptr = NULL; + unsigned char* bufend = NULL; + unsigned long prefix_len = 0; + + if (h_scalar == NULL) + goto err; + memset(h_scalar, 0, SCALARLEN); + + if (labelset_validate(labelset, labelset_len) != 0) + goto err; + if (R_bytes == NULL || K_bytes == NULL || M_buf == NULL) + goto err; + if (extra == NULL && extra_len != 0) + goto err; + if (extra != NULL && extra_len == 0) + goto err; + if (extra != NULL && labelset_is_empty(labelset, labelset_len)) + goto err; + if (HASHLEN != 64) + goto err; + + if (labelset_is_empty(labelset, labelset_len)) { + if (2*POINTLEN > M_start) + goto err; + if (extra != NULL || extra_len != 0) + goto err; + memcpy(M_buf + M_start - (2*POINTLEN), R_bytes, POINTLEN); + memcpy(M_buf + M_start - (1*POINTLEN), K_bytes, POINTLEN); + prefix_len = 2*POINTLEN; + } else { + prefix_len = 3*POINTLEN + 2*labelset_len + extra_len; + if (prefix_len > M_start) + goto err; + + bufstart = M_buf + M_start - prefix_len; + bufptr = bufstart; + bufend = M_buf + M_start; + bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, labelset, labelset_len); + bufptr = buffer_add(bufptr, bufend, R_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, labelset, labelset_len); + bufptr = buffer_add(bufptr, bufend, K_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, extra, extra_len); + + if (bufptr == NULL) + goto err; + if (bufptr != bufend || bufptr != M_buf + M_start || bufptr - bufstart != prefix_len) + goto err; + } + + crypto_hash_sha512(hash, M_buf + M_start - prefix_len, prefix_len + M_len); + sc_reduce(hash); + memcpy(h_scalar, hash, SCALARLEN); + return 0; + +err: + return -1; +} + +/* return r + kh (mod q) */ +int generalized_prove(unsigned char* out_scalar, + const unsigned char* r_scalar, const unsigned char* k_scalar, const unsigned char* h_scalar) +{ + sc_muladd(out_scalar, h_scalar, k_scalar, r_scalar); + zeroize_stack(); + return 0; +} + +/* R = s*B - h*K */ +int generalized_solve_commitment(unsigned char* R_bytes_out, ge_p3* K_point_out, + const ge_p3* B_point, const unsigned char* s_scalar, + const unsigned char* K_bytes, const unsigned char* h_scalar) +{ + + ge_p3 Kneg_point; + ge_p2 R_calc_point_p2; + + ge_p3 sB; + ge_p3 hK; + ge_p3 R_calc_point_p3; + + if (ge_frombytes_negate_vartime(&Kneg_point, K_bytes) != 0) + return -1; + + if (B_point == NULL) { + ge_double_scalarmult_vartime(&R_calc_point_p2, h_scalar, &Kneg_point, s_scalar); + ge_tobytes(R_bytes_out, &R_calc_point_p2); + } + else { + // s * Bv + ge_scalarmult(&sB, s_scalar, B_point); + + // h * -K + ge_scalarmult(&hK, h_scalar, &Kneg_point); + + // R = sB - hK + ge_p3_add(&R_calc_point_p3, &sB, &hK); + ge_p3_tobytes(R_bytes_out, &R_calc_point_p3); + } + + if (K_point_out) { + ge_neg(K_point_out, &Kneg_point); + } + + return 0; +} + + +int generalized_eddsa_25519_sign( + unsigned char* signature_out, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* eddsa_25519_privkey_scalar, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char labelset[LABELSETMAXLEN]; + unsigned long labelset_len = 0; + unsigned char R_bytes[POINTLEN]; + unsigned char r_scalar[SCALARLEN]; + unsigned char h_scalar[SCALARLEN]; + unsigned char s_scalar[SCALARLEN]; + unsigned char* M_buf = NULL; + + if (signature_out == NULL) + goto err; + memset(signature_out, 0, SIGNATURELEN); + + if (eddsa_25519_pubkey_bytes == NULL) + goto err; + if (eddsa_25519_privkey_scalar == NULL) + goto err; + if (msg == NULL) + goto err; + if (customization_label == NULL && customization_label_len != 0) + goto err; + if (customization_label_len > LABELMAXLEN) + goto err; + if (msg_len > MSGMAXLEN) + goto err; + + if ((M_buf = malloc(msg_len + MSTART)) == 0) + goto err; + memcpy(M_buf + MSTART, msg, msg_len); + + if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, NULL, 0, + customization_label, customization_label_len) != 0) + goto err; + + if (generalized_commit(R_bytes, r_scalar, labelset, labelset_len, NULL, 0, + eddsa_25519_pubkey_bytes, eddsa_25519_privkey_scalar, + random, M_buf, MSTART, msg_len) != 0) + goto err; + + if (generalized_challenge(h_scalar, labelset, labelset_len, NULL, 0, + R_bytes, eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0) + goto err; + + if (generalized_prove(s_scalar, r_scalar, eddsa_25519_privkey_scalar, h_scalar) != 0) + goto err; + + memcpy(signature_out, R_bytes, POINTLEN); + memcpy(signature_out + POINTLEN, s_scalar, SCALARLEN); + + zeroize(r_scalar, SCALARLEN); + zeroize_stack(); + free(M_buf); + return 0; + +err: + zeroize(r_scalar, SCALARLEN); + zeroize_stack(); + free(M_buf); + return -1; +} + +int generalized_eddsa_25519_verify( + const unsigned char* signature, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char labelset[LABELSETMAXLEN]; + unsigned long labelset_len = 0; + const unsigned char* R_bytes = NULL; + const unsigned char* s_scalar = NULL; + unsigned char h_scalar[SCALARLEN]; + unsigned char* M_buf = NULL; + unsigned char R_calc_bytes[POINTLEN]; + + if (signature == NULL) + goto err; + if (eddsa_25519_pubkey_bytes == NULL) + goto err; + if (msg == NULL) + goto err; + if (customization_label == NULL && customization_label_len != 0) + goto err; + if (customization_label_len > LABELMAXLEN) + goto err; + if (msg_len > MSGMAXLEN) + goto err; + + if ((M_buf = malloc(msg_len + MSTART)) == 0) + goto err; + memcpy(M_buf + MSTART, msg, msg_len); + + if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, NULL, 0, + customization_label, customization_label_len) != 0) + goto err; + + R_bytes = signature; + s_scalar = signature + POINTLEN; + + if (!point_isreduced(eddsa_25519_pubkey_bytes)) + goto err; + if (!point_isreduced(R_bytes)) + goto err; + if (!sc_isreduced(s_scalar)) + goto err; + + if (generalized_challenge(h_scalar, labelset, labelset_len, + NULL, 0, R_bytes, eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0) + goto err; + + if (generalized_solve_commitment(R_calc_bytes, NULL, NULL, + s_scalar, eddsa_25519_pubkey_bytes, h_scalar) != 0) + goto err; + + if (crypto_verify_32(R_bytes, R_calc_bytes) != 0) + goto err; + + free(M_buf); + return 0; + +err: + free(M_buf); + return -1; +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.h new file mode 100644 index 0000000000..0c281bcac9 --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_eddsa.h @@ -0,0 +1,65 @@ +#ifndef __GEN_EDDSA_H__ +#define __GEN_EDDSA_H__ + +#include "ge.h" + +/* B: base point + R: commitment (point), + r: private nonce (scalar) + K: encoded public key + k: private key (scalar) + Z: 32-bytes random + M: buffer containing message, message starts at M_start, continues for M_len + + r = hash(B || labelset || Z || pad1 || k || pad2 || labelset || K || extra || M) (mod q) +*/ +int generalized_commit(unsigned char* R_bytes, unsigned char* r_scalar, + const unsigned char* labelset, const unsigned long labelset_len, + const unsigned char* extra, const unsigned long extra_len, + const unsigned char* K_bytes, const unsigned char* k_scalar, + const unsigned char* Z, + unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len); + +/* if is_labelset_empty(labelset): + return hash(R || K || M) (mod q) + else: + return hash(B || labelset || R || labelset || K || extra || M) (mod q) +*/ +int generalized_challenge(unsigned char* h_scalar, + const unsigned char* labelset, const unsigned long labelset_len, + const unsigned char* extra, const unsigned long extra_len, + const unsigned char* R_bytes, + const unsigned char* K_bytes, + unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len); + +/* return r + kh (mod q) */ +int generalized_prove(unsigned char* out_scalar, + const unsigned char* r_scalar, + const unsigned char* k_scalar, + const unsigned char* h_scalar); + +/* R = B^s / K^h */ +int generalized_solve_commitment(unsigned char* R_bytes_out, ge_p3* K_point_out, + const ge_p3* B_point, const unsigned char* s_scalar, + const unsigned char* K_bytes, const unsigned char* h_scalar); + + +int generalized_eddsa_25519_sign( + unsigned char* signature_out, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* eddsa_25519_privkey_scalar, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +int generalized_eddsa_25519_verify( + const unsigned char* signature, + const unsigned char* eddsa_25519_pubkey, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.c new file mode 100644 index 0000000000..b181cad5dc --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.c @@ -0,0 +1,157 @@ +#include <stdlib.h> +#include <string.h> +#include "gen_labelset.h" +#include "gen_constants.h" + +const unsigned char B_bytes[] = { + 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, +}; + +unsigned char* buffer_add(unsigned char* bufptr, const unsigned char* bufend, + const unsigned char* in, const unsigned long in_len) +{ + unsigned long count = 0; + + if (bufptr == NULL || bufend == NULL || bufptr > bufend) + return NULL; + if (in == NULL && in_len != 0) + return NULL; + if (bufend - bufptr < in_len) + return NULL; + + for (count=0; count < in_len; count++) { + if (bufptr >= bufend) + return NULL; + *bufptr++ = *in++; + } + return bufptr; +} + +unsigned char* buffer_pad(const unsigned char* buf, unsigned char* bufptr, const unsigned char* bufend) +{ + unsigned long count = 0; + unsigned long pad_len = 0; + + if (buf == NULL || bufptr == NULL || bufend == NULL || bufptr >= bufend || bufptr < buf) + return NULL; + + pad_len = (BLOCKLEN - ((bufptr-buf) % BLOCKLEN)) % BLOCKLEN; + if (bufend - bufptr < pad_len) + return NULL; + + for (count=0; count < pad_len; count++) { + if (bufptr >= bufend) + return NULL; + *bufptr++ = 0; + } + return bufptr; +} + +int labelset_new(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen, + const unsigned char* protocol_name, const unsigned char protocol_name_len, + const unsigned char* customization_label, const unsigned char customization_label_len) +{ + unsigned char* bufptr; + + *labelset_len = 0; + if (labelset == NULL) + return -1; + if (labelset_len == NULL) + return -1; + if (labelset_maxlen > LABELSETMAXLEN) + return -1; + if (labelset_maxlen < 3 + protocol_name_len + customization_label_len) + return -1; + if (protocol_name == NULL && protocol_name_len != 0) + return -1; + if (customization_label == NULL && customization_label_len != 0) + return -1; + if (protocol_name_len > LABELMAXLEN) + return -1; + if (customization_label_len > LABELMAXLEN) + return -1; + + bufptr = labelset; + *bufptr++ = 2; + *bufptr++ = protocol_name_len; + bufptr = buffer_add(bufptr, labelset + labelset_maxlen, protocol_name, protocol_name_len); + if (bufptr != NULL && bufptr < labelset + labelset_maxlen) + *bufptr++ = customization_label_len; + bufptr = buffer_add(bufptr, labelset + labelset_maxlen, + customization_label, customization_label_len); + + if (bufptr != NULL && bufptr - labelset == 3 + protocol_name_len + customization_label_len) { + *labelset_len = bufptr - labelset; + return 0; + } + return -1; +} + + +int labelset_add(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen, + const unsigned char* label, const unsigned char label_len) +{ + unsigned char* bufptr; + if (labelset_len == NULL) + return -1; + if (*labelset_len > LABELSETMAXLEN || labelset_maxlen > LABELSETMAXLEN) + return -1; + if (*labelset_len >= labelset_maxlen || *labelset_len + label_len + 1 > labelset_maxlen) + return -1; + if (*labelset_len < 3 || labelset_maxlen < 4) + return -1; + if (label_len > LABELMAXLEN) + return -1; + + labelset[0]++; + labelset[*labelset_len] = label_len; + bufptr = labelset + *labelset_len + 1; + bufptr = buffer_add(bufptr, labelset + labelset_maxlen, label, label_len); + if (bufptr == NULL) + return -1; + if (bufptr - labelset >= labelset_maxlen) + return -1; + if (bufptr - labelset != *labelset_len + 1 + label_len) + return -1; + + *labelset_len += (1 + label_len); + return 0; +} + +int labelset_validate(const unsigned char* labelset, const unsigned long labelset_len) +{ + unsigned char num_labels = 0; + unsigned char count = 0; + unsigned long offset = 0; + unsigned char label_len = 0; + + if (labelset == NULL) + return -1; + if (labelset_len < 3 || labelset_len > LABELSETMAXLEN) + return -1; + + num_labels = labelset[0]; + offset = 1; + for (count = 0; count < num_labels; count++) { + label_len = labelset[offset]; + if (label_len > LABELMAXLEN) + return -1; + offset += 1 + label_len; + if (offset > labelset_len) + return -1; + } + if (offset != labelset_len) + return -1; + return 0; +} + +int labelset_is_empty(const unsigned char* labelset, const unsigned long labelset_len) +{ + if (labelset_len != 3) + return 0; + return 1; +} + diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.h new file mode 100644 index 0000000000..6ac40da99d --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_labelset.h @@ -0,0 +1,23 @@ +#ifndef __GEN_LABELSET_H__ +#define __GEN_LABELSET_H__ + +extern const unsigned char B_bytes[]; + +unsigned char* buffer_add(unsigned char* bufptr, const unsigned char* bufend, + const unsigned char* in, const unsigned long in_len); + +unsigned char* buffer_pad(const unsigned char* buf, unsigned char* bufptr, const unsigned char* bufend); + + +int labelset_new(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen, + const unsigned char* protocol_name, const unsigned char protocol_name_len, + const unsigned char* customization_label, const unsigned char customization_label_len); + +int labelset_add(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen, + const unsigned char* label, const unsigned char label_len); + +int labelset_validate(const unsigned char* labelset, const unsigned long labelset_len); + +int labelset_is_empty(const unsigned char* labelset, const unsigned long labelset_len); + +#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.c new file mode 100644 index 0000000000..4e79b4859d --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.c @@ -0,0 +1,312 @@ +#include <string.h> +#include "gen_eddsa.h" +#include "gen_veddsa.h" +#include "gen_constants.h" +#include "gen_labelset.h" +#include "gen_crypto_additions.h" +#include "crypto_hash_sha512.h" +#include "crypto_verify_32.h" +#include "crypto_additions.h" +#include "zeroize.h" +#include "ge.h" +#include "sc.h" +#include "utility.h" + +static int generalized_calculate_Bv(ge_p3* Bv_point, + const unsigned char* labelset, const unsigned long labelset_len, + const unsigned char* K_bytes, + unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len) +{ + unsigned char* bufptr; + unsigned long prefix_len = 0; + + if (labelset_validate(labelset, labelset_len) != 0) + return -1; + if (Bv_point == NULL || K_bytes == NULL || M_buf == NULL) + return -1; + + prefix_len = 2*POINTLEN + labelset_len; + if (prefix_len > M_start) + return -1; + + bufptr = M_buf + M_start - prefix_len; + bufptr = buffer_add(bufptr, M_buf + M_start, B_bytes, POINTLEN); + bufptr = buffer_add(bufptr, M_buf + M_start, labelset, labelset_len); + bufptr = buffer_add(bufptr, M_buf + M_start, K_bytes, POINTLEN); + if (bufptr == NULL || bufptr != M_buf + M_start) + return -1; + + hash_to_point(Bv_point, M_buf + M_start - prefix_len, prefix_len + M_len); + if (ge_isneutral(Bv_point)) + return -1; + return 0; +} + +static int generalized_calculate_vrf_output(unsigned char* vrf_output, + const unsigned char* labelset, const unsigned long labelset_len, + const ge_p3* cKv_point) +{ + unsigned char buf[BUFLEN]; + unsigned char* bufptr = buf; + unsigned char* bufend = buf + BUFLEN; + unsigned char cKv_bytes[POINTLEN]; + unsigned char hash[HASHLEN]; + + if (vrf_output == NULL) + return -1; + memset(vrf_output, 0, VRFOUTPUTLEN); + + if (labelset_len + 2*POINTLEN > BUFLEN) + return -1; + if (labelset_validate(labelset, labelset_len) != 0) + return -1; + if (cKv_point == NULL) + return -1; + if (VRFOUTPUTLEN > HASHLEN) + return -1; + + ge_p3_tobytes(cKv_bytes, cKv_point); + + bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN); + bufptr = buffer_add(bufptr, bufend, labelset, labelset_len); + bufptr = buffer_add(bufptr, bufend, cKv_bytes, POINTLEN); + if (bufptr == NULL) + return -1; + if (bufptr - buf > BUFLEN) + return -1; + crypto_hash_sha512(hash, buf, bufptr - buf); + memcpy(vrf_output, hash, VRFOUTPUTLEN); + return 0; +} + +int generalized_veddsa_25519_sign( + unsigned char* signature_out, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* eddsa_25519_privkey_scalar, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char labelset[LABELSETMAXLEN]; + unsigned long labelset_len = 0; + ge_p3 Bv_point; + ge_p3 Kv_point; + ge_p3 Rv_point; + unsigned char Bv_bytes[POINTLEN]; + unsigned char Kv_bytes[POINTLEN]; + unsigned char Rv_bytes[POINTLEN]; + unsigned char R_bytes[POINTLEN]; + unsigned char r_scalar[SCALARLEN]; + unsigned char h_scalar[SCALARLEN]; + unsigned char s_scalar[SCALARLEN]; + unsigned char extra[3*POINTLEN]; + unsigned char* M_buf = NULL; + char* protocol_name = "VEdDSA_25519_SHA512_Elligator2"; + + if (signature_out == NULL) + goto err; + memset(signature_out, 0, VRFSIGNATURELEN); + + if (eddsa_25519_pubkey_bytes == NULL) + goto err; + if (eddsa_25519_privkey_scalar == NULL) + goto err; + if (msg == NULL) + goto err; + if (customization_label == NULL && customization_label_len != 0) + goto err; + if (customization_label_len > LABELMAXLEN) + goto err; + if (msg_len > MSGMAXLEN) + goto err; + + if ((M_buf = malloc(msg_len + MSTART)) == 0) { + goto err; + } + memcpy(M_buf + MSTART, msg, msg_len); + + // labelset = new_labelset(protocol_name, customization_label) + if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, + (unsigned char*)protocol_name, strlen(protocol_name), + customization_label, customization_label_len) != 0) + goto err; + + // labelset1 = add_label(labels, "1") + // Bv = hash(hash(labelset1 || K) || M) + // Kv = k * Bv + labelset_add(labelset, &labelset_len, LABELSETMAXLEN, (unsigned char*)"1", 1); + if (generalized_calculate_Bv(&Bv_point, labelset, labelset_len, + eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0) + goto err; + ge_scalarmult(&Kv_point, eddsa_25519_privkey_scalar, &Bv_point); + ge_p3_tobytes(Bv_bytes, &Bv_point); + ge_p3_tobytes(Kv_bytes, &Kv_point); + + // labelset2 = add_label(labels, "2") + // R, r = commit(labelset2, (Bv || Kv), (K,k), Z, M) + labelset[labelset_len-1] = (unsigned char)'2'; + memcpy(extra, Bv_bytes, POINTLEN); + memcpy(extra + POINTLEN, Kv_bytes, POINTLEN); + if (generalized_commit(R_bytes, r_scalar, + labelset, labelset_len, + extra, 2*POINTLEN, + eddsa_25519_pubkey_bytes, eddsa_25519_privkey_scalar, + random, M_buf, MSTART, msg_len) != 0) + goto err; + + // Rv = r * Bv + ge_scalarmult(&Rv_point, r_scalar, &Bv_point); + ge_p3_tobytes(Rv_bytes, &Rv_point); + + // labelset3 = add_label(labels, "3") + // h = challenge(labelset3, (Bv || Kv || Rv), R, K, M) + labelset[labelset_len-1] = (unsigned char)'3'; + memcpy(extra + 2*POINTLEN, Rv_bytes, POINTLEN); + if (generalized_challenge(h_scalar, + labelset, labelset_len, + extra, 3*POINTLEN, + R_bytes, eddsa_25519_pubkey_bytes, + M_buf, MSTART, msg_len) != 0) + goto err; + + // s = prove(r, k, h) + if (generalized_prove(s_scalar, r_scalar, eddsa_25519_privkey_scalar, h_scalar) != 0) + goto err; + + // return (Kv || h || s) + memcpy(signature_out, Kv_bytes, POINTLEN); + memcpy(signature_out + POINTLEN, h_scalar, SCALARLEN); + memcpy(signature_out + POINTLEN + SCALARLEN, s_scalar, SCALARLEN); + + zeroize(r_scalar, SCALARLEN); + zeroize_stack(); + free(M_buf); + return 0; + +err: + zeroize(r_scalar, SCALARLEN); + zeroize_stack(); + free(M_buf); + return -1; +} + +int generalized_veddsa_25519_verify( + unsigned char* vrf_out, + const unsigned char* signature, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char labelset[LABELSETMAXLEN]; + unsigned long labelset_len = 0; + const unsigned char* Kv_bytes; + const unsigned char* h_scalar; + const unsigned char* s_scalar; + ge_p3 Bv_point, K_point, Kv_point, cK_point, cKv_point; + unsigned char Bv_bytes[POINTLEN]; + unsigned char R_calc_bytes[POINTLEN]; + unsigned char Rv_calc_bytes[POINTLEN]; + unsigned char h_calc_scalar[SCALARLEN]; + unsigned char extra[3*POINTLEN]; + unsigned char* M_buf = NULL; + char* protocol_name = "VEdDSA_25519_SHA512_Elligator2"; + + if (vrf_out == NULL) + goto err; + memset(vrf_out, 0, VRFOUTPUTLEN); + + if (signature == NULL) + goto err; + if (eddsa_25519_pubkey_bytes == NULL) + goto err; + if (msg == NULL) + goto err; + if (customization_label == NULL && customization_label_len != 0) + goto err; + if (customization_label_len > LABELMAXLEN) + goto err; + if (msg_len > MSGMAXLEN) + goto err; + + if ((M_buf = malloc(msg_len + MSTART)) == 0) { + goto err; + } + memcpy(M_buf + MSTART, msg, msg_len); + + Kv_bytes = signature; + h_scalar = signature + POINTLEN; + s_scalar = signature + POINTLEN + SCALARLEN; + + if (!point_isreduced(eddsa_25519_pubkey_bytes)) + goto err; + if (!point_isreduced(Kv_bytes)) + goto err; + if (!sc_isreduced(h_scalar)) + goto err; + if (!sc_isreduced(s_scalar)) + goto err; + + // labelset = new_labelset(protocol_name, customization_label) + if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, + (unsigned char*)protocol_name, strlen(protocol_name), + customization_label, customization_label_len) != 0) + goto err; + + // labelset1 = add_label(labels, "1") + // Bv = hash(hash(labelset1 || K) || M) + labelset_add(labelset, &labelset_len, LABELSETMAXLEN, (unsigned char*)"1", 1); + if (generalized_calculate_Bv(&Bv_point, labelset, labelset_len, + eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0) + goto err; + ge_p3_tobytes(Bv_bytes, &Bv_point); + + // R = solve_commitment(B, s, K, h) + if (generalized_solve_commitment(R_calc_bytes, &K_point, NULL, + s_scalar, eddsa_25519_pubkey_bytes, h_scalar) != 0) + goto err; + + // Rv = solve_commitment(Bv, s, Kv, h) + if (generalized_solve_commitment(Rv_calc_bytes, &Kv_point, &Bv_point, + s_scalar, Kv_bytes, h_scalar) != 0) + goto err; + + ge_scalarmult_cofactor(&cK_point, &K_point); + ge_scalarmult_cofactor(&cKv_point, &Kv_point); + if (ge_isneutral(&cK_point) || ge_isneutral(&cKv_point) || ge_isneutral(&Bv_point)) + goto err; + + // labelset3 = add_label(labels, "3") + // h = challenge(labelset3, (Bv || Kv || Rv), R, K, M) + labelset[labelset_len-1] = (unsigned char)'3'; + memcpy(extra, Bv_bytes, POINTLEN); + memcpy(extra + POINTLEN, Kv_bytes, POINTLEN); + memcpy(extra + 2*POINTLEN, Rv_calc_bytes, POINTLEN); + if (generalized_challenge(h_calc_scalar, + labelset, labelset_len, + extra, 3*POINTLEN, + R_calc_bytes, eddsa_25519_pubkey_bytes, + M_buf, MSTART, msg_len) != 0) + goto err; + + // if bytes_equal(h, h') + if (crypto_verify_32(h_scalar, h_calc_scalar) != 0) + goto err; + + // labelset4 = add_label(labels, "4") + // v = hash(labelset4 || c*Kv) + labelset[labelset_len-1] = (unsigned char)'4'; + if (generalized_calculate_vrf_output(vrf_out, labelset, labelset_len, &cKv_point) != 0) + goto err; + + free(M_buf); + return 0; + +err: + free(M_buf); + return -1; +} + diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.h new file mode 100644 index 0000000000..1bc27a6e2b --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_veddsa.h @@ -0,0 +1,23 @@ +#ifndef __GEN_VEDDSA_H__ +#define __GEN_VEDDSA_H__ + +int generalized_veddsa_25519_sign( + unsigned char* signature_out, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* eddsa_25519_privkey_scalar, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +int generalized_veddsa_25519_verify( + unsigned char* vrf_out, + const unsigned char* signature, + const unsigned char* eddsa_25519_pubkey_bytes, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.c new file mode 100644 index 0000000000..d4df5c1f1f --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.c @@ -0,0 +1,131 @@ +#include <string.h> +#include "crypto_additions.h" +#include "gen_x.h" +#include "gen_constants.h" +#include "gen_eddsa.h" +#include "gen_veddsa.h" +#include "gen_crypto_additions.h" +#include "zeroize.h" + +static int convert_25519_pubkey(unsigned char* ed_pubkey_bytes, const unsigned char* x25519_pubkey_bytes) { + fe u; + fe y; + + /* Convert the X25519 public key into an Ed25519 public key. + + y = (u - 1) / (u + 1) + + NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp + */ + if (!fe_isreduced(x25519_pubkey_bytes)) + return -1; + fe_frombytes(u, x25519_pubkey_bytes); + fe_montx_to_edy(y, u); + fe_tobytes(ed_pubkey_bytes, y); + return 0; +} + +static int calculate_25519_keypair(unsigned char* K_bytes, unsigned char* k_scalar, + const unsigned char* x25519_privkey_scalar) +{ + unsigned char kneg[SCALARLEN]; + ge_p3 ed_pubkey_point; + unsigned char sign_bit = 0; + + if (SCALARLEN != 32) + return -1; + + /* Convert the Curve25519 privkey to an Ed25519 public key */ + ge_scalarmult_base(&ed_pubkey_point, x25519_privkey_scalar); + ge_p3_tobytes(K_bytes, &ed_pubkey_point); + + /* Force Edwards sign bit to zero */ + sign_bit = (K_bytes[31] & 0x80) >> 7; + memcpy(k_scalar, x25519_privkey_scalar, 32); + sc_neg(kneg, k_scalar); + sc_cmov(k_scalar, kneg, sign_bit); + K_bytes[31] &= 0x7F; + + zeroize(kneg, SCALARLEN); + return 0; +} + +int generalized_xeddsa_25519_sign(unsigned char* signature_out, + const unsigned char* x25519_privkey_scalar, + const unsigned char* msg, const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char K_bytes[POINTLEN]; + unsigned char k_scalar[SCALARLEN]; + int retval = -1; + + if (calculate_25519_keypair(K_bytes, k_scalar, x25519_privkey_scalar) != 0) + return -1; + + retval = generalized_eddsa_25519_sign(signature_out, + K_bytes, k_scalar, + msg, msg_len, random, + customization_label, customization_label_len); + zeroize(k_scalar, SCALARLEN); + return retval; +} + +int generalized_xveddsa_25519_sign( + unsigned char* signature_out, + const unsigned char* x25519_privkey_scalar, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char K_bytes[POINTLEN]; + unsigned char k_scalar[SCALARLEN]; + int retval = -1; + + if (calculate_25519_keypair(K_bytes, k_scalar, x25519_privkey_scalar) != 0) + return -1; + + retval = generalized_veddsa_25519_sign(signature_out, K_bytes, k_scalar, + msg, msg_len, random, + customization_label, customization_label_len); + zeroize(k_scalar, SCALARLEN); + return retval; +} + +int generalized_xeddsa_25519_verify( + const unsigned char* signature, + const unsigned char* x25519_pubkey_bytes, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char K_bytes[POINTLEN]; + + if (convert_25519_pubkey(K_bytes, x25519_pubkey_bytes) != 0) + return -1; + + return generalized_eddsa_25519_verify(signature, K_bytes, msg, msg_len, + customization_label, customization_label_len); +} + +int generalized_xveddsa_25519_verify( + unsigned char* vrf_out, + const unsigned char* signature, + const unsigned char* x25519_pubkey_bytes, + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len) +{ + unsigned char K_bytes[POINTLEN]; + + if (convert_25519_pubkey(K_bytes, x25519_pubkey_bytes) != 0) + return -1; + + return generalized_veddsa_25519_verify(vrf_out, signature, K_bytes, msg, msg_len, + customization_label, customization_label_len); +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.h b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.h new file mode 100644 index 0000000000..3c4c04cb6c --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/gen_x.h @@ -0,0 +1,37 @@ +#ifndef __GEN_X_H +#define __GEN_X_H + +int generalized_xeddsa_25519_sign(unsigned char* signature_out, /* 64 bytes */ + const unsigned char* x25519_privkey_scalar, /* 32 bytes */ + const unsigned char* msg, const unsigned long msg_len, + const unsigned char* random, /* 32 bytes */ + const unsigned char* customization_label, + const unsigned long customization_label_len); + +int generalized_xeddsa_25519_verify( + const unsigned char* signature, /* 64 bytes */ + const unsigned char* x25519_pubkey_bytes, /* 32 bytes */ + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +int generalized_xveddsa_25519_sign( + unsigned char* signature_out, /* 96 bytes */ + const unsigned char* x25519_privkey_scalar, /* 32 bytes */ + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* random, /* 32 bytes */ + const unsigned char* customization_label, + const unsigned long customization_label_len); + +int generalized_xveddsa_25519_verify( + unsigned char* vrf_out, /* 32 bytes */ + const unsigned char* signature, /* 96 bytes */ + const unsigned char* x25519_pubkey_bytes, /* 32 bytes */ + const unsigned char* msg, + const unsigned long msg_len, + const unsigned char* customization_label, + const unsigned long customization_label_len); + +#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/point_isreduced.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/point_isreduced.c new file mode 100644 index 0000000000..5541ffebbb --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/point_isreduced.c @@ -0,0 +1,12 @@ +#include<string.h> +#include "fe.h" +#include "crypto_additions.h" + +int point_isreduced(const unsigned char* p) +{ + unsigned char strict[32]; + + memmove(strict, p, 32); + strict[31] &= 0x7F; /* mask off sign bit */ + return fe_isreduced(strict); +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/sc_isreduced.c b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/sc_isreduced.c new file mode 100644 index 0000000000..24193808ad --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/additions/generalized/sc_isreduced.c @@ -0,0 +1,17 @@ +#include <string.h> +#include "fe.h" +#include "sc.h" +#include "crypto_additions.h" +#include "crypto_verify_32.h" + +int sc_isreduced(const unsigned char* s) +{ + unsigned char strict[64]; + + memset(strict, 0, 64); + memmove(strict, s, 32); + sc_reduce(strict); + if (crypto_verify_32(strict, s) != 0) + return 0; + return 1; +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/vopen_modified.c b/libs/libaxolotl/src/curve25519/ed25519/additions/vopen_modified.c deleted file mode 100644 index 20b85bb155..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/vopen_modified.c +++ /dev/null @@ -1,85 +0,0 @@ -#include <string.h> -#include "sc.h" -#include "ge.h" -#include "crypto_hash_sha512.h" -#include "crypto_verify_32.h" -#include "crypto_additions.h" -#include "crypto_sign.h" - -int crypto_vsign_open_modified( - unsigned char *m, - const unsigned char *sm,unsigned long long smlen, - const unsigned char *pk, const ge_p3* Bv -) -{ - ge_p3 Vneg, V, Aneg, A, c_V, c_A, h_Vneg, s_Bv; - unsigned char h[32]; - unsigned char s[32]; - ge_p2 R; - unsigned char hcheck[64]; - unsigned char vrf_output[64]; - int count; - ge_p1p1 Rp1p1; - ge_p3 Rv; - ge_cached h_Vnegcached; - - if (smlen < 96) goto badsig; - if (sm[63] & 224) goto badsig; /* strict parsing of h */ - if (sm[95] & 224) goto badsig; /* strict parsing of s */ - - /* Load -A */ - if (ge_frombytes_negate_vartime(&Aneg,pk) != 0) goto badsig; - - /* Load -V, h, s */ - if (ge_frombytes_negate_vartime(&Vneg, sm) != 0) goto badsig; - memmove(h, sm + 32, 32); - memmove(s, sm + 64, 32); - if (h[31] & 224) goto badsig; /* strict parsing of h */ - if (s[31] & 224) goto badsig; /* strict parsing of s */ - - ge_neg(&A, &Aneg); - ge_neg(&V, &Vneg); - ge_scalarmult_cofactor(&c_A, &A); - ge_scalarmult_cofactor(&c_V, &V); - if (ge_isneutral(&c_A) || ge_isneutral(&c_V) || ge_isneutral(Bv)) - goto badsig; - - // R = (s*B) + (h * -A)) - ge_double_scalarmult_vartime(&R, h, &Aneg, s); - - // s * Bv - ge_scalarmult(&s_Bv, s, Bv); - - // h * -V - ge_scalarmult(&h_Vneg, h, &Vneg); - - // Rv = (sc * Bv) + (hc * (-V)) - ge_p3_to_cached(&h_Vnegcached, &h_Vneg); - ge_add(&Rp1p1, &s_Bv, &h_Vnegcached); - ge_p1p1_to_p3(&Rv, &Rp1p1); - - // Check h == SHA512(label(4) || A || V || R || Rv || M) - m[0] = 0xFB; // label 4 - for (count = 1; count < 32; count++) - m[count] = 0xFF; - memmove(m+32, pk, 32); - ge_p3_tobytes(m+64, &V); - ge_tobytes(m+96, &R); - ge_p3_tobytes(m+128, &Rv); - memmove(m+160, sm+96, smlen - 96); - - crypto_hash_sha512(hcheck, m, smlen + 64); - sc_reduce(hcheck); - - if (crypto_verify_32(hcheck, h) == 0) { - ge_p3_tobytes(m+32, &c_V); - m[0] = 0xFA; // label 5 - crypto_hash_sha512(vrf_output, m, 64); - memmove(m, vrf_output, 32); - return 0; - } - -badsig: - memset(m, 0, 32); - return -1; -} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/vsign_modified.c b/libs/libaxolotl/src/curve25519/ed25519/additions/vsign_modified.c deleted file mode 100644 index 518b851d63..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/vsign_modified.c +++ /dev/null @@ -1,62 +0,0 @@ -#include <string.h> -#include "crypto_sign.h" -#include "crypto_hash_sha512.h" -#include "ge.h" -#include "sc.h" -#include "zeroize.h" -#include "crypto_additions.h" - -/* NEW: Compare to pristine crypto_sign() - Uses explicit private key for nonce derivation and as scalar, - instead of deriving both from a master key. -*/ -int crypto_vsign_modified( - unsigned char *sm, - const unsigned char *M,unsigned long Mlen, - const unsigned char *a, - const unsigned char *A, - const unsigned char *random, - const ge_p3 *Bv, - const unsigned char *V -) -{ - unsigned char r[64]; - unsigned char h[64]; - ge_p3 R, Rv; - int count=0; - - /* r = SHA512(label(3) || a || V || random(64)) */ - sm[0] = 0xFC; - for (count = 1; count < 32; count++) - sm[count] = 0xFF; - - memmove(sm + 32, a, 32); /* Use privkey directly for nonce derivation */ - memmove(sm + 64, V, 32); - - memmove(sm + 96, random, 64); /* Add suffix of random data */ - crypto_hash_sha512(r, sm, 160); - - sc_reduce(r); - ge_scalarmult_base(&R, r); - ge_scalarmult(&Rv, r, Bv); - - /* h = SHA512(label(4) || A || V || R || Rv || M) */ - sm[0] = 0xFB; - memmove(sm + 32, A, 32); - memmove(sm + 64, V, 32); - ge_p3_tobytes(sm+96, &R); - ge_p3_tobytes(sm+128, &Rv); - memmove(sm + 160, M, Mlen); - - crypto_hash_sha512(h, sm, Mlen + 160); - sc_reduce(h); - - memmove(sm, h, 32); /* Write h */ - sc_muladd(sm + 32, h, a, r); /* Write s */ - - /* Erase any traces of private scalar or - nonce left in the stack from sc_muladd. */ - zeroize_stack(); - zeroize(r, 64); - return 0; -} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.c b/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.c deleted file mode 100644 index 8f60169bd4..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.c +++ /dev/null @@ -1,89 +0,0 @@ -#include <string.h> -#include "ge.h" -#include "crypto_additions.h" -#include "zeroize.h" -#include "vxeddsa.h" -#include "crypto_verify_32.h" - -int vxed25519_sign(unsigned char* signature_out, - const unsigned char* curve25519_privkey, - const unsigned char* msg, const unsigned long msg_len, - const unsigned char* random) -{ - unsigned char a[32], aneg[32]; - unsigned char A[32]; - ge_p3 Bv, ed_pubkey_point; - unsigned char sigbuf[MAX_MSG_LEN + 160]; /* working buffer */ - unsigned char sign_bit = 0; - - if (msg_len > MAX_MSG_LEN) { - memset(signature_out, 0, 96); - return -1; - } - /* Convert the Curve25519 privkey to an Ed25519 public key */ - ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey); - ge_p3_tobytes(A, &ed_pubkey_point); - - /* Force Edwards sign bit to zero */ - sign_bit = (A[31] & 0x80) >> 7; - memcpy(a, curve25519_privkey, 32); - sc_neg(aneg, a); - sc_cmov(a, aneg, sign_bit); - A[31] &= 0x7F; - - calculate_Bv_and_V(&Bv, signature_out, sigbuf, a, A, msg, msg_len); - - /* Perform an Ed25519 signature with explicit private key */ - crypto_vsign_modified(sigbuf, msg, msg_len, a, A, random, &Bv, signature_out /*V*/); - memmove(signature_out+32, sigbuf, 64); - - zeroize(a, 32); - zeroize(aneg, 32); - return 0; -} - -int vxed25519_verify(unsigned char* vrf_out, - const unsigned char* signature, - const unsigned char* curve25519_pubkey, - const unsigned char* msg, const unsigned long msg_len) -{ - fe u; - fe y; - unsigned char ed_pubkey[32]; - unsigned char verifybuf[MAX_MSG_LEN + 160]; /* working buffer */ - unsigned char verifybuf2[MAX_MSG_LEN + 160]; /* working buffer #2 ?? !!! */ - ge_p3 Bv; - - if (msg_len > MAX_MSG_LEN) { - return -1; - } - - /* Convert the Curve25519 public key (u) into an Ed25519 public key. - - y = (u - 1) / (u + 1) - - NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp - */ - if (!fe_isreduced(curve25519_pubkey)) - return -1; - fe_frombytes(u, curve25519_pubkey); - fe_montx_to_edy(y, u); - fe_tobytes(ed_pubkey, y); - - calculate_Bv(&Bv, verifybuf, ed_pubkey, msg, msg_len); - - memmove(verifybuf, signature, 96); - memmove(verifybuf+96, msg, msg_len); - - /* Then perform a signature verification, return 0 on success */ - /* The below call has a strange API: */ - /* verifybuf = V || h || s || message */ - /* verifybuf2 = used as buffer, gets the VRF output if success */ - if (crypto_vsign_open_modified(verifybuf2, verifybuf, 96 + msg_len, ed_pubkey, &Bv) == 0) { - memmove(vrf_out, verifybuf2, 32); - return 0; - } else { - memset(vrf_out, 0, 32); - return -1; - } -} diff --git a/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.h b/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.h deleted file mode 100644 index 4e48844170..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/additions/vxeddsa.h +++ /dev/null @@ -1,18 +0,0 @@ - -#ifndef __VXEDDSA_H__ -#define __VXEDDSA_H__ - -/* returns 0 on success */ -int vxed25519_sign(unsigned char* signature_out, /* 96 bytes */ - const unsigned char* curve25519_privkey, /* 32 bytes */ - const unsigned char* msg, const unsigned long msg_len, /* <= 256 bytes */ - const unsigned char* random); /* 64 bytes */ - -/* returns 0 on success */ -int vxed25519_verify(unsigned char* vrf_out, /* 32 bytes */ - const unsigned char* signature, /* 96 bytes */ - const unsigned char* curve25519_pubkey, /* 32 bytes */ - const unsigned char* msg, const unsigned long msg_len); /* <= 256 bytes */ - - -#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/main/main.c b/libs/libaxolotl/src/curve25519/ed25519/main/main.c deleted file mode 100644 index 9d6599467e..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/main/main.c +++ /dev/null @@ -1,12 +0,0 @@ -#include "tests.h" - - -int main(int argc, char* argv[]) -{ - all_fast_tests(0); - curvesigs_slow_test(0, 10000); - xeddsa_slow_test(0, 10000); - xeddsa_to_curvesigs_slow_test(0, 10000); - vxeddsa_slow_test(0, 10000); - return 0; -} diff --git a/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.c b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.c new file mode 100644 index 0000000000..6566e25526 --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.c @@ -0,0 +1,469 @@ +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include "crypto_hash_sha512.h" +#include "keygen.h" +#include "curve_sigs.h" +#include "xeddsa.h" +#include "crypto_additions.h" +#include "ge.h" +#include "utility.h" +#include "gen_crypto_additions.h" +#include "gen_x.h" +#include "internal_fast_tests.h" +#include <assert.h> + + +#define ERROR(...) do {if (!silent) { printf(__VA_ARGS__); abort(); } else return -1; } while (0) +#define INFO(...) do {if (!silent) printf(__VA_ARGS__);} while (0) + +#define TEST(msg, cond) \ + do { \ + if ((cond)) { \ + INFO("%s good\n", msg); \ + } \ + else { \ + ERROR("%s BAD!!!\n", msg); \ + } \ + } while (0) + + +int sha512_fast_test(int silent) +{ + unsigned char sha512_input[112] = + "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu"; + unsigned char sha512_correct_output[64] = + { + 0x8E, 0x95, 0x9B, 0x75, 0xDA, 0xE3, 0x13, 0xDA, + 0x8C, 0xF4, 0xF7, 0x28, 0x14, 0xFC, 0x14, 0x3F, + 0x8F, 0x77, 0x79, 0xC6, 0xEB, 0x9F, 0x7F, 0xA1, + 0x72, 0x99, 0xAE, 0xAD, 0xB6, 0x88, 0x90, 0x18, + 0x50, 0x1D, 0x28, 0x9E, 0x49, 0x00, 0xF7, 0xE4, + 0x33, 0x1B, 0x99, 0xDE, 0xC4, 0xB5, 0x43, 0x3A, + 0xC7, 0xD3, 0x29, 0xEE, 0xB6, 0xDD, 0x26, 0x54, + 0x5E, 0x96, 0xE5, 0x5B, 0x87, 0x4B, 0xE9, 0x09 + }; + unsigned char sha512_actual_output[64]; + + crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input)); + TEST("SHA512 #1", memcmp(sha512_actual_output, sha512_correct_output, 64) == 0); + + sha512_input[111] ^= 1; + + crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input)); + TEST("SHA512 #2", memcmp(sha512_actual_output, sha512_correct_output, 64) != 0); + + return 0; +} + +int strict_fast_test(int silent) +{ + unsigned char unreduced1[32] = { + 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, + }; + unsigned char unreduced2[32] = { + 0xED, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, + }; + unsigned char unreduced3[32] = { + 0xEC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, + }; + + unsigned char q[32] = { + 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, + 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, + }; + unsigned char qminus1[32] = { + 0xec, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, + 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, + }; + unsigned char qplus1[32] = { + 0xee, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, + 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, + }; + + TEST("fe_isreduced", + (fe_isreduced(unreduced1) == 0) && + (fe_isreduced(unreduced2) == 0) && + (fe_isreduced(unreduced3) == 1) + ); + + TEST("sc_isreduced", + (sc_isreduced(q) == 0) && + (sc_isreduced(qminus1) == 1) && + (sc_isreduced(qplus1) == 0) + ); + return 0; +} + +int ge_fast_test(int silent) +{ + + const unsigned char B_bytes[] = { + 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + }; + + const unsigned char misc_bytes[] = { + 0x57, 0x17, 0xfa, 0xce, 0xca, 0xb9, 0xdf, 0x0e, + 0x90, 0x67, 0xaa, 0x46, 0xba, 0x83, 0x2f, 0xeb, + 0x1c, 0x49, 0xd0, 0x21, 0xb1, 0x33, 0xff, 0x11, + 0xc9, 0x7a, 0xb8, 0xcf, 0xe3, 0x29, 0x46, 0x17, + }; + + unsigned char q_scalar[32] = { + 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, + 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, + }; + + unsigned char c_scalar[32] = { + 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + + unsigned char neutral_bytes[] = { + 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + +/* unsigned char one_scalar[32] = { + 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + }; + + const unsigned char B_bytes[] = { + 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, + }; + */ + + ge_p3 point1, point2, B_point, misc_point, miscneg_point; + + unsigned char output1[32], output2[32]; + + if (ge_frombytes_negate_vartime(&B_point, B_bytes) != 0) + TEST("Failure to parse point #1", 0); + if (ge_frombytes_negate_vartime(&miscneg_point, misc_bytes) != 0) + TEST("Failure to parse point #2", 0); + ge_neg(&B_point, &B_point); + ge_neg(&misc_point, &miscneg_point); + + /* q*B == neutral */ + ge_scalarmult_base(&point1, q_scalar); + ge_scalarmult(&point2, q_scalar, &B_point); + ge_p3_tobytes(output1, &point1); + ge_p3_tobytes(output2, &point2); + + TEST("qB == qB", memcmp(output1, output2, 32) == 0 && memcmp(output1, neutral_bytes, 32) == 0); + TEST("qB isneutral", ge_isneutral(&point1 ) && ge_isneutral(&point2) && !ge_isneutral(&B_point)); + + /* cB == cB, cX == cX */ + ge_scalarmult_cofactor(&point1, &B_point); + ge_scalarmult_base(&point2, c_scalar); + ge_p3_tobytes(output1, &point1); + ge_p3_tobytes(output2, &point2); + TEST("cB == cB", memcmp(output1, output2, 32) == 0); + ge_scalarmult_cofactor(&point1, &misc_point); + ge_scalarmult(&point2, c_scalar, &misc_point); + ge_p3_tobytes(output1, &point1); + ge_p3_tobytes(output2, &point2); + TEST("cX == cX", memcmp(output1, output2, 32) == 0); + + /* */ + ge_p3_add(&point1, &misc_point, &miscneg_point); + TEST("X + -X isneutral", ge_isneutral(&point1)); + + return 0; +} + +int elligator_fast_test(int silent) +{ + unsigned char elligator_correct_output[32] = + { + 0x5f, 0x35, 0x20, 0x00, 0x1c, 0x6c, 0x99, 0x36, + 0xa3, 0x12, 0x06, 0xaf, 0xe7, 0xc7, 0xac, 0x22, + 0x4e, 0x88, 0x61, 0x61, 0x9b, 0xf9, 0x88, 0x72, + 0x44, 0x49, 0x15, 0x89, 0x9d, 0x95, 0xf4, 0x6e + }; + + unsigned char hashtopoint_correct_output1[32] = + { + 0xce, 0x89, 0x9f, 0xb2, 0x8f, 0xf7, 0x20, 0x91, + 0x5e, 0x14, 0xf5, 0xb7, 0x99, 0x08, 0xab, 0x17, + 0xaa, 0x2e, 0xe2, 0x45, 0xb4, 0xfc, 0x2b, 0xf6, + 0x06, 0x36, 0x29, 0x40, 0xed, 0x7d, 0xe7, 0xed + }; + + unsigned char hashtopoint_correct_output2[32] = + { + 0xa0, 0x35, 0xbb, 0xa9, 0x4d, 0x30, 0x55, 0x33, + 0x0d, 0xce, 0xc2, 0x7f, 0x83, 0xde, 0x79, 0xd0, + 0x89, 0x67, 0x72, 0x4c, 0x07, 0x8d, 0x68, 0x9d, + 0x61, 0x52, 0x1d, 0xf9, 0x2c, 0x5c, 0xba, 0x77 + }; + + int count; + fe in, out; + unsigned char bytes[32]; + fe_0(in); + fe_0(out); + for (count = 0; count < 32; count++) { + bytes[count] = count; + } + fe_frombytes(in, bytes); + elligator(out, in); + fe_tobytes(bytes, out); + TEST("Elligator vector", memcmp(bytes, elligator_correct_output, 32) == 0); + + /* Elligator(0) == 0 test */ + fe_0(in); + elligator(out, in); + TEST("Elligator(0) == 0", memcmp(in, out, 32) == 0); + + /* ge_montx_to_p3(0) -> order2 point test */ + fe one, negone, zero; + fe_1(one); + fe_0(zero); + fe_sub(negone, zero, one); + ge_p3 p3; + ge_montx_to_p3(&p3, zero, 0); + TEST("ge_montx_to_p3(0) == order 2 point", + fe_isequal(p3.X, zero) && + fe_isequal(p3.Y, negone) && + fe_isequal(p3.Z, one) && + fe_isequal(p3.T, zero)); + + /* Hash to point vector test */ + unsigned char htp[32]; + + for (count=0; count < 32; count++) { + htp[count] = count; + } + + hash_to_point(&p3, htp, 32); + ge_p3_tobytes(htp, &p3); + TEST("hash_to_point #1", memcmp(htp, hashtopoint_correct_output1, 32) == 0); + + for (count=0; count < 32; count++) { + htp[count] = count+1; + } + + hash_to_point(&p3, htp, 32); + ge_p3_tobytes(htp, &p3); + TEST("hash_to_point #2", memcmp(htp, hashtopoint_correct_output2, 32) == 0); + + return 0; +} + +int curvesigs_fast_test(int silent) +{ + unsigned char signature_correct[64] = { + 0xcf, 0x87, 0x3d, 0x03, 0x79, 0xac, 0x20, 0xe8, + 0x89, 0x3e, 0x55, 0x67, 0xee, 0x0f, 0x89, 0x51, + 0xf8, 0xdb, 0x84, 0x0d, 0x26, 0xb2, 0x43, 0xb4, + 0x63, 0x52, 0x66, 0x89, 0xd0, 0x1c, 0xa7, 0x18, + 0xac, 0x18, 0x9f, 0xb1, 0x67, 0x85, 0x74, 0xeb, + 0xdd, 0xe5, 0x69, 0x33, 0x06, 0x59, 0x44, 0x8b, + 0x0b, 0xd6, 0xc1, 0x97, 0x3f, 0x7d, 0x78, 0x0a, + 0xb3, 0x95, 0x18, 0x62, 0x68, 0x03, 0xd7, 0x82, + }; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[64]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 0, 64); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + privkey[8] = 189; /* just so there's some bits set */ + sc_clamp(privkey); + + /* Signature vector test */ + curve25519_keygen(pubkey, privkey); + + curve25519_sign(signature, privkey, msg, MSG_LEN, random); + + TEST("Curvesig sign", memcmp(signature, signature_correct, 64) == 0); + TEST("Curvesig verify #1", curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0); + signature[0] ^= 1; + TEST("Curvesig verify #2", curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0); + return 0; +} + +int xeddsa_fast_test(int silent) +{ + unsigned char signature_correct[64] = { + 0x11, 0xc7, 0xf3, 0xe6, 0xc4, 0xdf, 0x9e, 0x8a, + 0x51, 0x50, 0xe1, 0xdb, 0x3b, 0x30, 0xf9, 0x2d, + 0xe3, 0xa3, 0xb3, 0xaa, 0x43, 0x86, 0x56, 0x54, + 0x5f, 0xa7, 0x39, 0x0f, 0x4b, 0xcc, 0x7b, 0xb2, + 0x6c, 0x43, 0x1d, 0x9e, 0x90, 0x64, 0x3e, 0x4f, + 0x0e, 0xaa, 0x0e, 0x9c, 0x55, 0x77, 0x66, 0xfa, + 0x69, 0xad, 0xa5, 0x76, 0xd6, 0x3d, 0xca, 0xf2, + 0xac, 0x32, 0x6c, 0x11, 0xd0, 0xb9, 0x77, 0x02, + }; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[64]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 0, 64); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + privkey[8] = 189; /* just so there's some bits set */ + sc_clamp(privkey); + + /* Signature vector test */ + curve25519_keygen(pubkey, privkey); + + xed25519_sign(signature, privkey, msg, MSG_LEN, random); + TEST("XEdDSA sign", memcmp(signature, signature_correct, 64) == 0); + TEST("XEdDSA verify #1", xed25519_verify(signature, pubkey, msg, MSG_LEN) == 0); + signature[0] ^= 1; + TEST("XEdDSA verify #2", xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0); + memset(pubkey, 0xFF, 32); + TEST("XEdDSA verify #3", xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0); + return 0; +} + +int generalized_xeddsa_fast_test(int silent) +{ + unsigned char signature1[64]; + unsigned char signature2[64]; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char msg1[1000]; + unsigned char msg2[1000]; + unsigned char random[64]; + + memset(signature1, 0, 64); + memset(signature2, 0, 64); + memset(privkey, 0xF0, 32); + memset(pubkey, 2, 32); + memset(msg1, 0x10, 1000); + memset(msg2, 0x20, 1000); + memset(random, 0xBC, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + msg2[0] = 1; + TEST("generalized xeddsa sign #1", generalized_xeddsa_25519_sign(signature1, privkey, msg1, 100, random, NULL, 0) == 0); + TEST("generalized xeddsa sign #2", generalized_xeddsa_25519_sign(signature2, privkey, msg2, 100, random, NULL, 0) == 0); + + TEST("generalized (old) xeddsa verify #1", xed25519_verify(signature1, pubkey, msg1, 100) == 0); + TEST("generalized (old) xeddsa verify #2", xed25519_verify(signature2, pubkey, msg2, 100) == 0); + TEST("generalized (old) xeddsa verify #3", xed25519_verify(signature1, pubkey, msg2, 100) != 0); + TEST("generalized (old) xeddsa verify #4", xed25519_verify(signature2, pubkey, msg1, 100) != 0); + + TEST("generalized xeddsa verify #1", generalized_xeddsa_25519_verify(signature1, pubkey, msg1, 100, NULL, 0) == 0); + TEST("generalized xeddsa verify #2", generalized_xeddsa_25519_verify(signature2, pubkey, msg2, 100, NULL, 0) == 0); + TEST("generalized xeddsa verify #3", generalized_xeddsa_25519_verify(signature1, pubkey, msg2, 100, NULL, 0) != 0); + TEST("generalized xeddsa verify #4", generalized_xeddsa_25519_verify(signature2, pubkey, msg1, 100, NULL, 0) != 0); + return 0; +} + +int generalized_xveddsa_fast_test(int silent) +{ + unsigned char signature1[96]; + unsigned char signature2[96]; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char msg1[1000]; + unsigned char msg2[1000]; + unsigned char random[64]; + unsigned char vrf[32]; + + memset(signature1, 0, 64); + memset(signature2, 0, 64); + memset(privkey, 1, 32); + memset(pubkey, 2, 32); + memset(msg1, 0x11, 1000); + memset(msg2, 0x22, 1000); + memset(random, 0xAB, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + msg2[0] ^= 1; + TEST("generalized xveddsa sign #1", generalized_xveddsa_25519_sign(signature1, privkey, msg1, 100, random, NULL, 0) == 0); + TEST("generalized xveddsa sign #2", generalized_xveddsa_25519_sign(signature2, privkey, msg2, 100, random, (unsigned char*)"abc", 3) == 0); + + TEST("generalized xveddsa verify #1", generalized_xveddsa_25519_verify(vrf, signature1, pubkey, msg1, 100, NULL, 0) == 0); + TEST("generalized xveddsa verify #2", generalized_xveddsa_25519_verify(vrf, signature2, pubkey, msg2, 100, (unsigned char*)"abc", 3) == 0); + TEST("generalized xveddsa verify #3", generalized_xveddsa_25519_verify(vrf, signature1, pubkey, msg2, 100, NULL, 0) != 0); + TEST("generalized xveddsa verify #4", generalized_xveddsa_25519_verify(vrf, signature2, pubkey, msg1, 100, (unsigned char*)"abc", 3) != 0); + + + unsigned char signature3[96]; + unsigned char vrf3[96]; + random[0] ^= 1; + TEST("generalized xveddsa sign #3", generalized_xveddsa_25519_sign(signature3, privkey, msg1, 100, random, NULL, 0) == 0); + TEST("generalized xveddsa verify #5", generalized_xveddsa_25519_verify(vrf, signature1, pubkey, msg1, 100, NULL, 0) == 0); + TEST("generalized xveddsa verify #6", generalized_xveddsa_25519_verify(vrf3, signature3, pubkey, msg1, 100, NULL, 0) == 0); + TEST("generalized xveddsa VRFs equal", memcmp(vrf, vrf3, 32) == 0); + TEST("generalized xveddsa Kv equal", memcmp(signature1+0, signature3+0, 32) == 0); + TEST("generalized xveddsa h not equal", memcmp(signature1+32, signature3+32, 32) != 0); + TEST("generalized xveddsa s not equal", memcmp(signature1+64, signature3+64, 32) != 0); + return 0; +} + +int all_fast_tests(int silent) +{ + int result; + if ((result = sha512_fast_test(silent)) != 0) + return -1; + if ((result = strict_fast_test(silent)) != 0) + return -2; + if ((result = ge_fast_test(silent)) != 0) + return -3; + if ((result = elligator_fast_test(silent)) != 0) + return -3; + if ((result = curvesigs_fast_test(silent)) != 0) + return -4; + if ((result = xeddsa_fast_test(silent)) != 0) + return -5; + if ((result = generalized_xeddsa_fast_test(silent)) != 0) + return -6; + if ((result = generalized_xveddsa_fast_test(silent)) != 0) + return -7; + + return 0; +} + diff --git a/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.h b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.h new file mode 100644 index 0000000000..47f117546d --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_fast_tests.h @@ -0,0 +1,19 @@ +#ifndef __INTERNAL_FAST_TESTS_H__ +#define __INTERNAL_FAST_TESTS_H__ + +/* silent = 0 : prints info+error messages to stdout, abort() on test failure + * silent = 1 : returns 0 for success, anything else for failure + */ + +int sha512_fast_test(int silent); +int strict_fast_test(int silent); +int elligator_fast_test(int silent); +int curvesigs_fast_test(int silent); +int xeddsa_fast_test(int silent); +int vxeddsa_fast_test(int silent); +int generalized_xeddsa_fast_test(int silent); +int generalized_xveddsa_fast_test(int silent); + +int all_fast_tests(int silent); + +#endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/tests/internal_slow_tests.c b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_slow_tests.c new file mode 100644 index 0000000000..740ddbe843 --- /dev/null +++ b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_slow_tests.c @@ -0,0 +1,371 @@ +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include "crypto_hash_sha512.h" +#include "keygen.h" +#include "curve_sigs.h" +#include "xeddsa.h" +#include "crypto_additions.h" +#include "ge.h" +#include "utility.h" +#include "gen_x.h" +#include "internal_slow_tests.h" +#include <assert.h> + + +#define ERROR(...) do {if (!silent) { printf(__VA_ARGS__); abort(); } else return -1; } while (0) +#define INFO(...) do {if (!silent) printf(__VA_ARGS__);} while (0) + +#define TEST(msg, cond) \ + do { \ + if ((cond)) { \ + INFO("%s good\n", msg); \ + } \ + else { \ + ERROR("%s BAD!!!\n", msg); \ + } \ + } while (0) + + + +int curvesigs_slow_test(int silent, int iterations) +{ + + unsigned char signature_10k_correct[64] = { + 0xfc, 0xba, 0x55, 0xc4, 0x85, 0x4a, 0x42, 0x25, + 0x19, 0xab, 0x08, 0x8d, 0xfe, 0xb5, 0x13, 0xb6, + 0x0d, 0x24, 0xbb, 0x16, 0x27, 0x55, 0x71, 0x48, + 0xdd, 0x20, 0xb1, 0xcd, 0x2a, 0xd6, 0x7e, 0x35, + 0xef, 0x33, 0x4c, 0x7b, 0x6d, 0x94, 0x6f, 0x52, + 0xec, 0x43, 0xd7, 0xe6, 0x35, 0x24, 0xcd, 0x5b, + 0x5d, 0xdc, 0xb2, 0x32, 0xc6, 0x22, 0x53, 0xf3, + 0x38, 0x02, 0xf8, 0x28, 0x28, 0xc5, 0x65, 0x05, + }; + + int count; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[64]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 0, 64); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + /* Signature random test */ + INFO("Pseudorandom curvesigs...\n"); + for (count = 1; count <= iterations; count++) { + unsigned char b[64]; + crypto_hash_sha512(b, signature, 64); + memmove(privkey, b, 32); + crypto_hash_sha512(b, privkey, 32); + memmove(random, b, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + curve25519_sign(signature, privkey, msg, MSG_LEN, random); + + if (curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0) + ERROR("Curvesig verify failure #1 %d\n", count); + + if (b[63] & 1) + signature[count % 64] ^= 1; + else + msg[count % MSG_LEN] ^= 1; + if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0) + ERROR("Curvesig verify failure #2 %d\n", count); + + if (count == 10000) { + if (memcmp(signature, signature_10k_correct, 64) != 0) + ERROR("Curvesig signature 10K doesn't match %d\n", count); + } + if (count == 100000) + print_bytes("100K curvesigs", signature, 64); + if (count == 1000000) + print_bytes("1M curvesigs", signature, 64); + if (count == 10000000) + print_bytes("10M curvesigs", signature, 64); + } + INFO("good\n"); + return 0; +} + +int xeddsa_slow_test(int silent, int iterations) +{ + + unsigned char signature_10k_correct[64] = { + 0x15, 0x29, 0x03, 0x38, 0x66, 0x16, 0xcd, 0x26, + 0xbb, 0x3e, 0xec, 0xe2, 0x9f, 0x72, 0xa2, 0x5c, + 0x7d, 0x05, 0xc9, 0xcb, 0x84, 0x3f, 0x92, 0x96, + 0xb3, 0xfb, 0xb9, 0xdd, 0xd6, 0xed, 0x99, 0x04, + 0xc1, 0xa8, 0x02, 0x16, 0xcf, 0x49, 0x3f, 0xf1, + 0xbe, 0x69, 0xf9, 0xf1, 0xcc, 0x16, 0xd7, 0xdc, + 0x6e, 0xd3, 0x78, 0xaa, 0x04, 0xeb, 0x71, 0x51, + 0x9d, 0xe8, 0x7a, 0x5b, 0xd8, 0x49, 0x7b, 0x05, + }; + + int count; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[96]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 1, 64); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + /* Signature random test */ + INFO("Pseudorandom XEdDSA...\n"); + for (count = 1; count <= iterations; count++) { + unsigned char b[64]; + crypto_hash_sha512(b, signature, 64); + memmove(privkey, b, 32); + crypto_hash_sha512(b, privkey, 32); + memmove(random, b, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + xed25519_sign(signature, privkey, msg, MSG_LEN, random); + + if (xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0) + ERROR("XEdDSA verify failure #1 %d\n", count); + + if (b[63] & 1) + signature[count % 64] ^= 1; + else + msg[count % MSG_LEN] ^= 1; + if (xed25519_verify(signature, pubkey, msg, MSG_LEN) == 0) + ERROR("XEdDSA verify failure #2 %d\n", count); + + if (count == 10000) { + if (memcmp(signature, signature_10k_correct, 64) != 0) + ERROR("XEDSA signature 10K doesn't match %d\n", count); + } + if (count == 100000) + print_bytes("100K XEdDSA", signature, 64); + if (count == 1000000) + print_bytes("1M XEdDSA", signature, 64); + if (count == 10000000) + print_bytes("10M XEdDSA", signature, 64); + } + INFO("good\n"); + return 0; +} + +int xeddsa_to_curvesigs_slow_test(int silent, int iterations) +{ + unsigned char signature_10k_correct[64] = { + 0x33, 0x50, 0xa8, 0x68, 0xcd, 0x9e, 0x74, 0x99, + 0xa3, 0x5c, 0x33, 0x75, 0x2b, 0x22, 0x03, 0xf8, + 0xb5, 0x0f, 0xea, 0x8c, 0x33, 0x1c, 0x68, 0x8b, + 0xbb, 0xf3, 0x31, 0xcf, 0x7c, 0x42, 0x37, 0x35, + 0xa0, 0x0e, 0x15, 0xb8, 0x5d, 0x2b, 0xe1, 0xa2, + 0x03, 0x77, 0x94, 0x3d, 0x13, 0x5c, 0xd4, 0x9b, + 0x6a, 0x31, 0xf4, 0xdc, 0xfe, 0x24, 0xad, 0x54, + 0xeb, 0xd2, 0x98, 0x47, 0xf1, 0xcc, 0xbf, 0x0d + + }; + + int count; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[96]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 2, 64); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + /* Signature random test */ + INFO("Pseudorandom XEdDSA/Curvesigs...\n"); + for (count = 1; count <= iterations; count++) { + unsigned char b[64]; + crypto_hash_sha512(b, signature, 64); + memmove(privkey, b, 32); + crypto_hash_sha512(b, privkey, 32); + memmove(random, b, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + xed25519_sign(signature, privkey, msg, MSG_LEN, random); + + if (curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0) + ERROR("XEdDSA/Curvesigs verify failure #1 %d\n", count); + + if (b[63] & 1) + signature[count % 64] ^= 1; + else + msg[count % MSG_LEN] ^= 1; + if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0) + ERROR("XEdDSA/Curvesigs verify failure #2 %d\n", count); + + if (count == 10000) { + if (memcmp(signature, signature_10k_correct, 64) != 0) + ERROR("XEdDSA/Curvesigs signature 10K doesn't match %d\n", count); + } + if (count == 100000) + print_bytes("100K XEdDSA/C", signature, 64); + if (count == 1000000) + print_bytes("1M XEdDSA/C", signature, 64); + if (count == 10000000) + print_bytes("10M XEdDSA/C", signature, 64); + } + INFO("good\n"); + return 0; +} + +int generalized_xveddsa_slow_test(int silent, int iterations) +{ + unsigned char signature_10k_correct[96] = { + 0x89, 0x21, 0xf5, 0x2f, 0x37, 0x72, 0x08, 0x55, + 0x18, 0x9d, 0x24, 0xed, 0x86, 0xb1, 0x7a, 0x02, + 0xbf, 0x29, 0x5e, 0xa7, 0x45, 0xdc, 0x80, 0x03, + 0x7f, 0x4f, 0xca, 0x79, 0xe0, 0x95, 0xd0, 0xa1, + 0xb5, 0x99, 0xbe, 0xbd, 0xef, 0xbe, 0xa4, 0xdc, + 0x0c, 0x07, 0x6a, 0xf7, 0x7f, 0xe1, 0x1c, 0xb8, + 0x18, 0x84, 0xb8, 0xb4, 0xcf, 0x38, 0x7d, 0x98, + 0x37, 0xd8, 0x40, 0x23, 0x42, 0x12, 0x70, 0x06, + 0xb0, 0xd1, 0x0c, 0xc0, 0x1c, 0xa6, 0x9a, 0x2f, + 0xb4, 0x02, 0xd6, 0x37, 0x22, 0xe9, 0xfb, 0x00, + 0x22, 0x02, 0x5a, 0xf4, 0x40, 0x43, 0xb8, 0xe9, + 0xf4, 0x13, 0x44, 0x16, 0x19, 0x8d, 0x7e, 0x02, + }; + unsigned char signature_100k_correct[96] = { + 0xc4, 0x99, 0x64, 0x1f, 0x94, 0x95, 0xf4, 0x57, + 0xa0, 0xb9, 0x3d, 0xc3, 0xb5, 0x2e, 0x1e, 0xdd, + 0x92, 0xf2, 0x4c, 0xb2, 0x01, 0x36, 0x3d, 0xf2, + 0xea, 0x2c, 0xdc, 0x32, 0x21, 0x5f, 0xc5, 0xd2, + 0xff, 0x16, 0x41, 0x71, 0x3a, 0x77, 0x79, 0xeb, + 0x67, 0x20, 0xc4, 0xec, 0x39, 0xe1, 0x54, 0x2d, + 0x40, 0x10, 0xf9, 0xca, 0xc5, 0x21, 0x0a, 0x47, + 0x63, 0x99, 0x23, 0x04, 0x9d, 0x03, 0x1a, 0x06, + 0x00, 0xb9, 0x56, 0x7e, 0xef, 0xee, 0x0b, 0x40, + 0x59, 0xc1, 0x86, 0xd9, 0xa7, 0x87, 0x70, 0xec, + 0x05, 0x89, 0xbe, 0x71, 0x43, 0xd1, 0xf5, 0x61, + 0x5e, 0x00, 0x41, 0xde, 0x1f, 0x41, 0x2d, 0x0e, + }; + + +/* + unsigned char signature_1m_correct[96] = { + 0xf8, 0xb1, 0x20, 0xf2, 0x1e, 0x5c, 0xbf, 0x5f, + 0xea, 0x07, 0xcb, 0xb5, 0x77, 0xb8, 0x03, 0xbc, + 0xcb, 0x6d, 0xf1, 0xc1, 0xa5, 0x03, 0x05, 0x7b, + 0x01, 0x63, 0x9b, 0xf9, 0xed, 0x3e, 0x57, 0x47, + 0xd2, 0x5b, 0xf4, 0x7e, 0x7c, 0x45, 0xce, 0xfc, + 0x06, 0xb3, 0xf4, 0x05, 0x81, 0x9f, 0x53, 0xb0, + 0x18, 0xe3, 0xfa, 0xcb, 0xb2, 0x52, 0x3e, 0x57, + 0xcb, 0x34, 0xcc, 0x81, 0x60, 0xb9, 0x0b, 0x04, + 0x07, 0x79, 0xc0, 0x53, 0xad, 0xc4, 0x4b, 0xd0, + 0xb5, 0x7d, 0x95, 0x4e, 0xbe, 0xa5, 0x75, 0x0c, + 0xd4, 0xbf, 0xa7, 0xc0, 0xcf, 0xba, 0xe7, 0x7c, + 0xe2, 0x90, 0xef, 0x61, 0xa9, 0x29, 0x66, 0x0d, + }; + + unsigned char signature_10m_correct[96] = { + 0xf5, 0xa4, 0xbc, 0xec, 0xc3, 0x3d, 0xd0, 0x43, + 0xd2, 0x81, 0x27, 0x9e, 0xf0, 0x4c, 0xbe, 0xf3, + 0x77, 0x01, 0x56, 0x41, 0x0e, 0xff, 0x0c, 0xb9, + 0x66, 0xec, 0x4d, 0xe0, 0xb7, 0x25, 0x63, 0x6b, + 0x5c, 0x08, 0x39, 0x80, 0x4e, 0x37, 0x1b, 0x2c, + 0x46, 0x6f, 0x86, 0x99, 0x1c, 0x4e, 0x31, 0x60, + 0xdb, 0x4c, 0xfe, 0xc5, 0xa2, 0x4d, 0x71, 0x2b, + 0xd6, 0xd0, 0xc3, 0x98, 0x88, 0xdb, 0x0e, 0x0c, + 0x68, 0x4a, 0xd3, 0xc7, 0x56, 0xac, 0x8d, 0x95, + 0x7b, 0xbd, 0x99, 0x50, 0xe8, 0xd3, 0xea, 0xf3, + 0x7b, 0x26, 0xf2, 0xa2, 0x2b, 0x02, 0x58, 0xca, + 0xbd, 0x2c, 0x2b, 0xf7, 0x77, 0x58, 0xfe, 0x09, + }; + */ + + int count; + const int MSG_LEN = 200; + unsigned char privkey[32]; + unsigned char pubkey[32]; + unsigned char signature[96]; + unsigned char msg[MSG_LEN]; + unsigned char random[64]; + unsigned char vrf_out[32]; + + memset(privkey, 0, 32); + memset(pubkey, 0, 32); + memset(signature, 3, 96); + memset(msg, 0, MSG_LEN); + memset(random, 0, 64); + + INFO("Pseudorandom XVEdDSA...\n"); + for (count = 1; count <= iterations; count++) { + unsigned char b[64]; + crypto_hash_sha512(b, signature, 96); + memmove(privkey, b, 32); + crypto_hash_sha512(b, privkey, 32); + memmove(random, b, 64); + + sc_clamp(privkey); + curve25519_keygen(pubkey, privkey); + + generalized_xveddsa_25519_sign(signature, privkey, msg, MSG_LEN, random, NULL, 0); + + if (generalized_xveddsa_25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN, NULL, 0) != 0) + ERROR("XVEdDSA verify failure #1 %d\n", count); + + if (b[63] & 1) + signature[count % 96] ^= 1; + else + msg[count % MSG_LEN] ^= 1; + + if (generalized_xveddsa_25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN, NULL, 0) == 0) + ERROR("XVEdDSA verify failure #2 %d\n", count); + + if (count == 10000) + print_bytes("10K XVEdDSA", signature, 96); + if (count == 100000) + print_bytes("100K XVEdDSA", signature, 96); + if (count == 1000000) + print_bytes("1M XVEdDSA", signature, 96); + if (count == 10000000) + print_bytes("10M XVEdDSA", signature, 96); + if (count == 100000000) + print_bytes("100M XVEdDSA", signature, 96); + + if (count == 10000) { + if (memcmp(signature, signature_10k_correct, 96) != 0) + ERROR("XVEDDSA 10K doesn't match %d\n", count); + } + if (count == 100000) { + if (memcmp(signature, signature_100k_correct, 96) != 0) + ERROR("XVEDDSA 100K doesn't match %d\n", count); + } + /* + if (count == 1000000) { + if (memcmp(signature, signature_1m_correct, 96) != 0) + ERROR("XVEDDSA 1m doesn't match %d\n", count); + } + if (count == 10000000) { + if (memcmp(signature, signature_10m_correct, 96) != 0) + ERROR("XVEDDSA 10m doesn't match %d\n", count); + } + if (count == 100000000) { + if (memcmp(signature, signature_100m_correct, 96) != 0) + ERROR("XVEDDSA 100m doesn't match %d\n", count); + } + */ + } + INFO("good\n"); + return 0; +} diff --git a/libs/libaxolotl/src/curve25519/ed25519/tests/tests.h b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_slow_tests.h index 7ac1e503ca..5a680c6160 100644 --- a/libs/libaxolotl/src/curve25519/ed25519/tests/tests.h +++ b/libs/libaxolotl/src/curve25519/ed25519/tests/internal_slow_tests.h @@ -1,23 +1,15 @@ -#ifndef __TESTS_H__ -#define __TESTS_H__ +#ifndef __INTERNAL_SLOW_TESTS_H__ +#define __INTERNAL_SLOW_TESTS_H__ /* silent = 0 : prints info+error messages to stdout, abort() on test failure * silent = 1 : returns 0 for success, anything else for failure * iterations : hardcoded known-good values are at 10000, so run at least this many */ -int sha512_fast_test(int silent); -int strict_fast_test(int silent); -int elligator_fast_test(int silent); -int curvesigs_fast_test(int silent); -int xeddsa_fast_test(int silent); -int vxeddsa_fast_test(int silent); - int curvesigs_slow_test(int silent, int iterations); int xeddsa_slow_test(int silent, int iterations); int xeddsa_to_curvesigs_slow_test(int silent, int iterations); -int vxeddsa_slow_test(int silent, int iterations); +int generalized_xveddsa_slow_test(int silent, int iterations); -int all_fast_tests(int silent); #endif diff --git a/libs/libaxolotl/src/curve25519/ed25519/tests/tests.c b/libs/libaxolotl/src/curve25519/ed25519/tests/tests.c deleted file mode 100644 index a647383e71..0000000000 --- a/libs/libaxolotl/src/curve25519/ed25519/tests/tests.c +++ /dev/null @@ -1,692 +0,0 @@ -#include <stdlib.h> -#include <stdio.h> -#include <string.h> -#include "crypto_hash_sha512.h" -#include "keygen.h" -#include "curve_sigs.h" -#include "xeddsa.h" -#include "vxeddsa.h" -#include "crypto_additions.h" -#include "ge.h" -#include "utility.h" -#include "tests.h" -#include <assert.h> - - -#define ERROR(...) do {if (!silent) { printf(__VA_ARGS__); abort(); } else return -1; } while (0) -#define INFO(...) do {if (!silent) printf(__VA_ARGS__);} while (0) - -#define TEST(msg, cond) \ - do { \ - if ((cond)) { \ - INFO("%s good\n", msg); \ - } \ - else { \ - ERROR("%s BAD!!!\n", msg); \ - } \ - } while (0) - - -int sha512_fast_test(int silent) -{ - unsigned char sha512_input[112] = - "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu"; - unsigned char sha512_correct_output[64] = - { - 0x8E, 0x95, 0x9B, 0x75, 0xDA, 0xE3, 0x13, 0xDA, - 0x8C, 0xF4, 0xF7, 0x28, 0x14, 0xFC, 0x14, 0x3F, - 0x8F, 0x77, 0x79, 0xC6, 0xEB, 0x9F, 0x7F, 0xA1, - 0x72, 0x99, 0xAE, 0xAD, 0xB6, 0x88, 0x90, 0x18, - 0x50, 0x1D, 0x28, 0x9E, 0x49, 0x00, 0xF7, 0xE4, - 0x33, 0x1B, 0x99, 0xDE, 0xC4, 0xB5, 0x43, 0x3A, - 0xC7, 0xD3, 0x29, 0xEE, 0xB6, 0xDD, 0x26, 0x54, - 0x5E, 0x96, 0xE5, 0x5B, 0x87, 0x4B, 0xE9, 0x09 - }; - unsigned char sha512_actual_output[64]; - - crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input)); - TEST("SHA512 #1", memcmp(sha512_actual_output, sha512_correct_output, 64) == 0); - - sha512_input[111] ^= 1; - - crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input)); - TEST("SHA512 #2", memcmp(sha512_actual_output, sha512_correct_output, 64) != 0); - - return 0; -} - -int strict_fast_test(int silent) -{ - unsigned char unreduced1[32] = { - 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, - }; - unsigned char unreduced2[32] = { - 0xED, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, - }; - unsigned char unreduced3[32] = { - 0xEC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, - 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, - }; - - TEST("fe_isreduced", - (fe_isreduced(unreduced1) == 0) && - (fe_isreduced(unreduced2) == 0) && - (fe_isreduced(unreduced3) == 1) - ); - return 0; -} - -int elligator_fast_test(int silent) -{ - unsigned char elligator_correct_output[32] = - { - 0x5f, 0x35, 0x20, 0x00, 0x1c, 0x6c, 0x99, 0x36, - 0xa3, 0x12, 0x06, 0xaf, 0xe7, 0xc7, 0xac, 0x22, - 0x4e, 0x88, 0x61, 0x61, 0x9b, 0xf9, 0x88, 0x72, - 0x44, 0x49, 0x15, 0x89, 0x9d, 0x95, 0xf4, 0x6e - }; - - unsigned char hashtopoint_correct_output1[32] = - { - 0xce, 0x89, 0x9f, 0xb2, 0x8f, 0xf7, 0x20, 0x91, - 0x5e, 0x14, 0xf5, 0xb7, 0x99, 0x08, 0xab, 0x17, - 0xaa, 0x2e, 0xe2, 0x45, 0xb4, 0xfc, 0x2b, 0xf6, - 0x06, 0x36, 0x29, 0x40, 0xed, 0x7d, 0xe7, 0xed - }; - - unsigned char hashtopoint_correct_output2[32] = - { - 0xa0, 0x35, 0xbb, 0xa9, 0x4d, 0x30, 0x55, 0x33, - 0x0d, 0xce, 0xc2, 0x7f, 0x83, 0xde, 0x79, 0xd0, - 0x89, 0x67, 0x72, 0x4c, 0x07, 0x8d, 0x68, 0x9d, - 0x61, 0x52, 0x1d, 0xf9, 0x2c, 0x5c, 0xba, 0x77 - }; - - unsigned char calculatev_correct_output[32] = - { - 0x1b, 0x77, 0xb5, 0xa0, 0x44, 0x84, 0x7e, 0xb9, - 0x23, 0xd7, 0x93, 0x18, 0xce, 0xc2, 0xc5, 0xe2, - 0x84, 0xd5, 0x79, 0x6f, 0x65, 0x63, 0x1b, 0x60, - 0x9b, 0xf1, 0xf8, 0xce, 0x88, 0x0b, 0x50, 0x9c, - }; - - int count; - fe in, out; - unsigned char bytes[32]; - fe_0(in); - fe_0(out); - for (count = 0; count < 32; count++) { - bytes[count] = count; - } - fe_frombytes(in, bytes); - elligator(out, in); - fe_tobytes(bytes, out); - TEST("Elligator vector", memcmp(bytes, elligator_correct_output, 32) == 0); - - /* Elligator(0) == 0 test */ - fe_0(in); - elligator(out, in); - TEST("Elligator(0) == 0", memcmp(in, out, 32) == 0); - - /* ge_montx_to_p3(0) -> order2 point test */ - fe one, negone, zero; - fe_1(one); - fe_0(zero); - fe_sub(negone, zero, one); - ge_p3 p3; - ge_montx_to_p3(&p3, zero, 0); - TEST("ge_montx_to_p3(0) == order 2 point", - fe_isequal(p3.X, zero) && - fe_isequal(p3.Y, negone) && - fe_isequal(p3.Z, one) && - fe_isequal(p3.T, zero)); - - /* Hash to point vector test */ - unsigned char htp[32]; - - for (count=0; count < 32; count++) { - htp[count] = count; - } - - hash_to_point(&p3, htp, 32); - ge_p3_tobytes(htp, &p3); - TEST("hash_to_point #1", memcmp(htp, hashtopoint_correct_output1, 32) == 0); - - for (count=0; count < 32; count++) { - htp[count] = count+1; - } - - hash_to_point(&p3, htp, 32); - ge_p3_tobytes(htp, &p3); - TEST("hash_to_point #2", memcmp(htp, hashtopoint_correct_output2, 32) == 0); - - /* calculate_U vector test */ - ge_p3 Bv; - unsigned char V[32]; - unsigned char Vbuf[200]; - unsigned char a[32]; - unsigned char A[32]; - unsigned char Vmsg[3]; - Vmsg[0] = 0; - Vmsg[1] = 1; - Vmsg[2] = 2; - for (count=0; count < 32; count++) { - a[count] = 8 + count; - A[count] = 9 + count; - } - sc_clamp(a); - calculate_Bv_and_V(&Bv, V, Vbuf, a, A, Vmsg, 3); - TEST("calculate_Bv_and_V vector", memcmp(V, calculatev_correct_output, 32) == 0); - return 0; -} - -int curvesigs_fast_test(int silent) -{ - unsigned char signature_correct[64] = { - 0xcf, 0x87, 0x3d, 0x03, 0x79, 0xac, 0x20, 0xe8, - 0x89, 0x3e, 0x55, 0x67, 0xee, 0x0f, 0x89, 0x51, - 0xf8, 0xdb, 0x84, 0x0d, 0x26, 0xb2, 0x43, 0xb4, - 0x63, 0x52, 0x66, 0x89, 0xd0, 0x1c, 0xa7, 0x18, - 0xac, 0x18, 0x9f, 0xb1, 0x67, 0x85, 0x74, 0xeb, - 0xdd, 0xe5, 0x69, 0x33, 0x06, 0x59, 0x44, 0x8b, - 0x0b, 0xd6, 0xc1, 0x97, 0x3f, 0x7d, 0x78, 0x0a, - 0xb3, 0x95, 0x18, 0x62, 0x68, 0x03, 0xd7, 0x82, - }; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[64]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 0, 64); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - privkey[8] = 189; /* just so there's some bits set */ - sc_clamp(privkey); - - /* Signature vector test */ - curve25519_keygen(pubkey, privkey); - - curve25519_sign(signature, privkey, msg, MSG_LEN, random); - - TEST("Curvesig sign", memcmp(signature, signature_correct, 64) == 0); - TEST("Curvesig verify #1", curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0); - signature[0] ^= 1; - TEST("Curvesig verify #2", curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0); - return 0; -} - -int xeddsa_fast_test(int silent) -{ - unsigned char signature_correct[64] = { - 0x11, 0xc7, 0xf3, 0xe6, 0xc4, 0xdf, 0x9e, 0x8a, - 0x51, 0x50, 0xe1, 0xdb, 0x3b, 0x30, 0xf9, 0x2d, - 0xe3, 0xa3, 0xb3, 0xaa, 0x43, 0x86, 0x56, 0x54, - 0x5f, 0xa7, 0x39, 0x0f, 0x4b, 0xcc, 0x7b, 0xb2, - 0x6c, 0x43, 0x1d, 0x9e, 0x90, 0x64, 0x3e, 0x4f, - 0x0e, 0xaa, 0x0e, 0x9c, 0x55, 0x77, 0x66, 0xfa, - 0x69, 0xad, 0xa5, 0x76, 0xd6, 0x3d, 0xca, 0xf2, - 0xac, 0x32, 0x6c, 0x11, 0xd0, 0xb9, 0x77, 0x02, - }; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[64]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 0, 64); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - privkey[8] = 189; /* just so there's some bits set */ - sc_clamp(privkey); - - /* Signature vector test */ - curve25519_keygen(pubkey, privkey); - - xed25519_sign(signature, privkey, msg, MSG_LEN, random); - TEST("XEdDSA sign", memcmp(signature, signature_correct, 64) == 0); - TEST("XEdDSA verify #1", xed25519_verify(signature, pubkey, msg, MSG_LEN) == 0); - signature[0] ^= 1; - TEST("XEdDSA verify #2", xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0); - memset(pubkey, 0xFF, 32); - TEST("XEdDSA verify #3", xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0); - return 0; -} - -int vxeddsa_fast_test(int silent) -{ - unsigned char signature_correct[96] = { - 0x23, 0xc6, 0xe5, 0x93, 0x3f, 0xcd, 0x56, 0x47, - 0x7a, 0x86, 0xc9, 0x9b, 0x76, 0x2c, 0xb5, 0x24, - 0xc3, 0xd6, 0x05, 0x55, 0x38, 0x83, 0x4d, 0x4f, - 0x8d, 0xb8, 0xf0, 0x31, 0x07, 0xec, 0xeb, 0xa0, - 0xa0, 0x01, 0x50, 0xb8, 0x4c, 0xbb, 0x8c, 0xcd, - 0x23, 0xdc, 0x65, 0xfd, 0x0e, 0x81, 0xb2, 0x86, - 0x06, 0xa5, 0x6b, 0x0c, 0x4f, 0x53, 0x6d, 0xc8, - 0x8b, 0x8d, 0xc9, 0x04, 0x6e, 0x4a, 0xeb, 0x08, - 0xce, 0x08, 0x71, 0xfc, 0xc7, 0x00, 0x09, 0xa4, - 0xd6, 0xc0, 0xfd, 0x2d, 0x1a, 0xe5, 0xb6, 0xc0, - 0x7c, 0xc7, 0x22, 0x3b, 0x69, 0x59, 0xa8, 0x26, - 0x2b, 0x57, 0x78, 0xd5, 0x46, 0x0e, 0x0f, 0x05, - }; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[96]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - unsigned char vrf_out[32]; - unsigned char vrf_outprev[32]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 0, 96); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - privkey[8] = 189; /* just so there's some bits set */ - sc_clamp(privkey); - - /* Signature vector test */ - curve25519_keygen(pubkey, privkey); - - vxed25519_sign(signature, privkey, msg, MSG_LEN, random); - TEST("VXEdDSA sign", memcmp(signature, signature_correct, 96) == 0); - TEST("VXEdDSA verify #1", vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) == 0); - memcpy(vrf_outprev, vrf_out, 32); - signature[0] ^= 1; - TEST("VXEdDSA verify #2", vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) != 0); - - memset(pubkey, 0xFF, 32); - TEST("VXEdDSA verify #3", vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) != 0); - curve25519_keygen(pubkey, privkey); - - /* Test U */ - unsigned char sigprev[96]; - memcpy(sigprev, signature, 96); - sigprev[0] ^= 1; /* undo prev disturbance */ - - random[0] ^= 1; - vxed25519_sign(signature, privkey, msg, MSG_LEN, random); - TEST("VXEdDSA verify #3", vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) == 0); - - TEST("VXEdDSA VRF value unchanged", memcmp(vrf_out, vrf_outprev, 32) == 0); - TEST("VXEdDSA (h, s) changed", memcmp(signature+32, sigprev+32, 64) != 0); - return 0; -} - -int curvesigs_slow_test(int silent, int iterations) -{ - - unsigned char signature_10k_correct[64] = { - 0xfc, 0xba, 0x55, 0xc4, 0x85, 0x4a, 0x42, 0x25, - 0x19, 0xab, 0x08, 0x8d, 0xfe, 0xb5, 0x13, 0xb6, - 0x0d, 0x24, 0xbb, 0x16, 0x27, 0x55, 0x71, 0x48, - 0xdd, 0x20, 0xb1, 0xcd, 0x2a, 0xd6, 0x7e, 0x35, - 0xef, 0x33, 0x4c, 0x7b, 0x6d, 0x94, 0x6f, 0x52, - 0xec, 0x43, 0xd7, 0xe6, 0x35, 0x24, 0xcd, 0x5b, - 0x5d, 0xdc, 0xb2, 0x32, 0xc6, 0x22, 0x53, 0xf3, - 0x38, 0x02, 0xf8, 0x28, 0x28, 0xc5, 0x65, 0x05, - }; - - int count; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[64]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 0, 64); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - /* Signature random test */ - INFO("Pseudorandom curvesigs...\n"); - for (count = 1; count <= iterations; count++) { - unsigned char b[64]; - crypto_hash_sha512(b, signature, 64); - memmove(privkey, b, 32); - crypto_hash_sha512(b, privkey, 32); - memmove(random, b, 64); - - sc_clamp(privkey); - curve25519_keygen(pubkey, privkey); - - curve25519_sign(signature, privkey, msg, MSG_LEN, random); - - if (curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0) - ERROR("Curvesig verify failure #1 %d\n", count); - - if (b[63] & 1) - signature[count % 64] ^= 1; - else - msg[count % MSG_LEN] ^= 1; - if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0) - ERROR("Curvesig verify failure #2 %d\n", count); - - if (count == 10000) { - if (memcmp(signature, signature_10k_correct, 64) != 0) - ERROR("Curvesig signature 10K doesn't match %d\n", count); - } - if (count == 100000) - print_bytes("100K curvesigs", signature, 64); - if (count == 1000000) - print_bytes("1M curvesigs", signature, 64); - if (count == 10000000) - print_bytes("10M curvesigs", signature, 64); - } - INFO("good\n"); - return 0; -} - -int xeddsa_slow_test(int silent, int iterations) -{ - - unsigned char signature_10k_correct[64] = { - 0x15, 0x29, 0x03, 0x38, 0x66, 0x16, 0xcd, 0x26, - 0xbb, 0x3e, 0xec, 0xe2, 0x9f, 0x72, 0xa2, 0x5c, - 0x7d, 0x05, 0xc9, 0xcb, 0x84, 0x3f, 0x92, 0x96, - 0xb3, 0xfb, 0xb9, 0xdd, 0xd6, 0xed, 0x99, 0x04, - 0xc1, 0xa8, 0x02, 0x16, 0xcf, 0x49, 0x3f, 0xf1, - 0xbe, 0x69, 0xf9, 0xf1, 0xcc, 0x16, 0xd7, 0xdc, - 0x6e, 0xd3, 0x78, 0xaa, 0x04, 0xeb, 0x71, 0x51, - 0x9d, 0xe8, 0x7a, 0x5b, 0xd8, 0x49, 0x7b, 0x05, - }; - - int count; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[96]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 1, 64); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - /* Signature random test */ - INFO("Pseudorandom XEdDSA...\n"); - for (count = 1; count <= iterations; count++) { - unsigned char b[64]; - crypto_hash_sha512(b, signature, 64); - memmove(privkey, b, 32); - crypto_hash_sha512(b, privkey, 32); - memmove(random, b, 64); - - sc_clamp(privkey); - curve25519_keygen(pubkey, privkey); - - xed25519_sign(signature, privkey, msg, MSG_LEN, random); - - if (xed25519_verify(signature, pubkey, msg, MSG_LEN) != 0) - ERROR("XEdDSA verify failure #1 %d\n", count); - - if (b[63] & 1) - signature[count % 64] ^= 1; - else - msg[count % MSG_LEN] ^= 1; - if (xed25519_verify(signature, pubkey, msg, MSG_LEN) == 0) - ERROR("XEdDSA verify failure #2 %d\n", count); - - if (count == 10000) { - if (memcmp(signature, signature_10k_correct, 64) != 0) - ERROR("XEDSA signature 10K doesn't match %d\n", count); - } - if (count == 100000) - print_bytes("100K XEdDSA", signature, 64); - if (count == 1000000) - print_bytes("1M XEdDSA", signature, 64); - if (count == 10000000) - print_bytes("10M XEdDSA", signature, 64); - } - INFO("good\n"); - return 0; -} - -int xeddsa_to_curvesigs_slow_test(int silent, int iterations) -{ - unsigned char signature_10k_correct[64] = { - 0x33, 0x50, 0xa8, 0x68, 0xcd, 0x9e, 0x74, 0x99, - 0xa3, 0x5c, 0x33, 0x75, 0x2b, 0x22, 0x03, 0xf8, - 0xb5, 0x0f, 0xea, 0x8c, 0x33, 0x1c, 0x68, 0x8b, - 0xbb, 0xf3, 0x31, 0xcf, 0x7c, 0x42, 0x37, 0x35, - 0xa0, 0x0e, 0x15, 0xb8, 0x5d, 0x2b, 0xe1, 0xa2, - 0x03, 0x77, 0x94, 0x3d, 0x13, 0x5c, 0xd4, 0x9b, - 0x6a, 0x31, 0xf4, 0xdc, 0xfe, 0x24, 0xad, 0x54, - 0xeb, 0xd2, 0x98, 0x47, 0xf1, 0xcc, 0xbf, 0x0d - - }; - - int count; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[96]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 2, 64); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - /* Signature random test */ - INFO("Pseudorandom XEdDSA/Curvesigs...\n"); - for (count = 1; count <= iterations; count++) { - unsigned char b[64]; - crypto_hash_sha512(b, signature, 64); - memmove(privkey, b, 32); - crypto_hash_sha512(b, privkey, 32); - memmove(random, b, 64); - - sc_clamp(privkey); - curve25519_keygen(pubkey, privkey); - - xed25519_sign(signature, privkey, msg, MSG_LEN, random); - - if (curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0) - ERROR("XEdDSA/Curvesigs verify failure #1 %d\n", count); - - if (b[63] & 1) - signature[count % 64] ^= 1; - else - msg[count % MSG_LEN] ^= 1; - if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0) - ERROR("XEdDSA/Curvesigs verify failure #2 %d\n", count); - - if (count == 10000) { - if (memcmp(signature, signature_10k_correct, 64) != 0) - ERROR("XEdDSA/Curvesigs signature 10K doesn't match %d\n", count); - } - if (count == 100000) - print_bytes("100K XEdDSA/C", signature, 64); - if (count == 1000000) - print_bytes("1M XEdDSA/C", signature, 64); - if (count == 10000000) - print_bytes("10M XEdDSA/C", signature, 64); - } - INFO("good\n"); - return 0; -} - -int vxeddsa_slow_test(int silent, int iterations) -{ - - unsigned char signature_10k_correct[96] = { - 0xa1, 0x96, 0x96, 0xe5, 0x87, 0x3f, 0x6e, 0x5c, - 0x2e, 0xd3, 0x73, 0xab, 0x04, 0x0c, 0x1f, 0x26, - 0x3c, 0xca, 0x52, 0xc4, 0x7e, 0x49, 0xaa, 0xce, - 0xb5, 0xd6, 0xa2, 0x29, 0x46, 0x3f, 0x1b, 0x54, - 0x45, 0x94, 0x9b, 0x6c, 0x27, 0xf9, 0x2a, 0xed, - 0x17, 0xa4, 0x72, 0xbf, 0x35, 0x37, 0xc1, 0x90, - 0xac, 0xb3, 0xfd, 0x2d, 0xf1, 0x01, 0x05, 0xbe, - 0x56, 0x5c, 0xaf, 0x63, 0x65, 0xad, 0x38, 0x04, - 0x70, 0x53, 0xdf, 0x2b, 0xc1, 0x45, 0xc8, 0xee, - 0x02, 0x0d, 0x2b, 0x22, 0x23, 0x7a, 0xbf, 0xfa, - 0x43, 0x31, 0xb3, 0xac, 0x26, 0xd9, 0x76, 0xfc, - 0xfe, 0x30, 0xa1, 0x7c, 0xce, 0x10, 0x67, 0x0e, - }; - /* - unsigned char signature_100k_correct[96] = { - 0xc9, 0x11, 0x2b, 0x55, 0xfa, 0xc4, 0xb2, 0xfe, - 0x00, 0x7d, 0xf6, 0x45, 0xcb, 0xd2, 0x73, 0xc9, - 0x43, 0xba, 0x20, 0xf6, 0x9c, 0x18, 0x84, 0xef, - 0x6c, 0x65, 0x7a, 0xdb, 0x49, 0xfc, 0x1e, 0xbe, - 0x31, 0xb3, 0xe6, 0xa4, 0x68, 0x2f, 0xd0, 0x30, - 0x81, 0xfc, 0x0d, 0xcd, 0x2d, 0x00, 0xab, 0xae, - 0x9f, 0x08, 0xf0, 0x99, 0xff, 0x9f, 0xdc, 0x2d, - 0x68, 0xd6, 0xe7, 0xe8, 0x44, 0x2a, 0x5b, 0x0e, - 0x48, 0x67, 0xe2, 0x41, 0x4a, 0xd9, 0x0c, 0x2a, - 0x2b, 0x4e, 0x66, 0x09, 0x87, 0xa0, 0x6b, 0x3b, - 0xd1, 0xd9, 0xa3, 0xe3, 0xa5, 0x69, 0xed, 0xc1, - 0x42, 0x03, 0x93, 0x0d, 0xbc, 0x7e, 0xe9, 0x08, - }; - - unsigned char signature_1m_correct[96] = { - 0xf8, 0xb1, 0x20, 0xf2, 0x1e, 0x5c, 0xbf, 0x5f, - 0xea, 0x07, 0xcb, 0xb5, 0x77, 0xb8, 0x03, 0xbc, - 0xcb, 0x6d, 0xf1, 0xc1, 0xa5, 0x03, 0x05, 0x7b, - 0x01, 0x63, 0x9b, 0xf9, 0xed, 0x3e, 0x57, 0x47, - 0xd2, 0x5b, 0xf4, 0x7e, 0x7c, 0x45, 0xce, 0xfc, - 0x06, 0xb3, 0xf4, 0x05, 0x81, 0x9f, 0x53, 0xb0, - 0x18, 0xe3, 0xfa, 0xcb, 0xb2, 0x52, 0x3e, 0x57, - 0xcb, 0x34, 0xcc, 0x81, 0x60, 0xb9, 0x0b, 0x04, - 0x07, 0x79, 0xc0, 0x53, 0xad, 0xc4, 0x4b, 0xd0, - 0xb5, 0x7d, 0x95, 0x4e, 0xbe, 0xa5, 0x75, 0x0c, - 0xd4, 0xbf, 0xa7, 0xc0, 0xcf, 0xba, 0xe7, 0x7c, - 0xe2, 0x90, 0xef, 0x61, 0xa9, 0x29, 0x66, 0x0d, - }; - - unsigned char signature_10m_correct[96] = { - 0xf5, 0xa4, 0xbc, 0xec, 0xc3, 0x3d, 0xd0, 0x43, - 0xd2, 0x81, 0x27, 0x9e, 0xf0, 0x4c, 0xbe, 0xf3, - 0x77, 0x01, 0x56, 0x41, 0x0e, 0xff, 0x0c, 0xb9, - 0x66, 0xec, 0x4d, 0xe0, 0xb7, 0x25, 0x63, 0x6b, - 0x5c, 0x08, 0x39, 0x80, 0x4e, 0x37, 0x1b, 0x2c, - 0x46, 0x6f, 0x86, 0x99, 0x1c, 0x4e, 0x31, 0x60, - 0xdb, 0x4c, 0xfe, 0xc5, 0xa2, 0x4d, 0x71, 0x2b, - 0xd6, 0xd0, 0xc3, 0x98, 0x88, 0xdb, 0x0e, 0x0c, - 0x68, 0x4a, 0xd3, 0xc7, 0x56, 0xac, 0x8d, 0x95, - 0x7b, 0xbd, 0x99, 0x50, 0xe8, 0xd3, 0xea, 0xf3, - 0x7b, 0x26, 0xf2, 0xa2, 0x2b, 0x02, 0x58, 0xca, - 0xbd, 0x2c, 0x2b, 0xf7, 0x77, 0x58, 0xfe, 0x09, - }; - */ - - int count; - const int MSG_LEN = 200; - unsigned char privkey[32]; - unsigned char pubkey[32]; - unsigned char signature[96]; - unsigned char msg[MSG_LEN]; - unsigned char random[64]; - unsigned char vrf_out[32]; - - memset(privkey, 0, 32); - memset(pubkey, 0, 32); - memset(signature, 3, 96); - memset(msg, 0, MSG_LEN); - memset(random, 0, 64); - - INFO("Pseudorandom VXEdDSA...\n"); - for (count = 1; count <= iterations; count++) { - unsigned char b[64]; - crypto_hash_sha512(b, signature, 96); - memmove(privkey, b, 32); - crypto_hash_sha512(b, privkey, 32); - memmove(random, b, 64); - - sc_clamp(privkey); - curve25519_keygen(pubkey, privkey); - - vxed25519_sign(signature, privkey, msg, MSG_LEN, random); - - if (vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) != 0) - ERROR("VXEdDSA verify failure #1 %d\n", count); - - if (b[63] & 1) - signature[count % 96] ^= 1; - else - msg[count % MSG_LEN] ^= 1; - - if (vxed25519_verify(vrf_out, signature, pubkey, msg, MSG_LEN) == 0) - ERROR("VXEdDSA verify failure #2 %d\n", count); - - if (count == 100000) - print_bytes("100K VXEdDSA", signature, 96); - if (count == 1000000) - print_bytes("1M VXEdDSA", signature, 96); - if (count == 10000000) - print_bytes("10M VXEdDSA", signature, 96); - if (count == 100000000) - print_bytes("100M VXEdDSA", signature, 96); - - if (count == 10000) { - if (memcmp(signature, signature_10k_correct, 96) != 0) - ERROR("VXEDDSA 10K doesn't match %d\n", count); - } - /* - if (count == 100000) { - if (memcmp(signature, signature_100k_correct, 96) != 0) - ERROR("VXEDDSA 100K doesn't match %d\n", count); - } - if (count == 1000000) { - if (memcmp(signature, signature_1m_correct, 96) != 0) - ERROR("VXEDDSA 1m doesn't match %d\n", count); - } - if (count == 10000000) { - if (memcmp(signature, signature_10m_correct, 96) != 0) - ERROR("VXEDDSA 10m doesn't match %d\n", count); - } - if (count == 100000000) { - if (memcmp(signature, signature_100m_correct, 96) != 0) - ERROR("VXEDDSA 100m doesn't match %d\n", count); - } - */ - } - INFO("good\n"); - return 0; -} - -int all_fast_tests(int silent) -{ - int result; - if ((result = sha512_fast_test(silent)) != 0) - return result; - if ((result = strict_fast_test(silent)) != 0) - return result; - if ((result = elligator_fast_test(silent)) != 0) - return result; - if ((result = curvesigs_fast_test(silent)) != 0) - return result; - if ((result = xeddsa_fast_test(silent)) != 0) - return result; - if ((result = vxeddsa_fast_test(silent)) != 0) - return result; - - return 0; -} - |