diff options
Diffstat (limited to 'libs/libsodium/src/crypto_sign/ed25519/ref10')
5 files changed, 32 insertions, 152 deletions
diff --git a/libs/libsodium/src/crypto_sign/ed25519/ref10/keypair.c b/libs/libsodium/src/crypto_sign/ed25519/ref10/keypair.c index 5d0e6a0006..6c15b2d6c6 100644 --- a/libs/libsodium/src/crypto_sign/ed25519/ref10/keypair.c +++ b/libs/libsodium/src/crypto_sign/ed25519/ref10/keypair.c @@ -50,12 +50,13 @@ crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk, fe25519 x;
fe25519 one_minus_y;
- if (ge25519_has_small_order(ed25519_pk) != 0 ||
- ge25519_frombytes_negate_vartime(&A, ed25519_pk) != 0 ||
+ if (ge25519_frombytes_negate_vartime(&A, ed25519_pk) != 0 ||
+ ge25519_has_small_order(&A) != 0 ||
ge25519_is_on_main_subgroup(&A) == 0) {
return -1;
}
fe25519_1(one_minus_y);
+ /* assumes A.Z=1 */
fe25519_sub(one_minus_y, one_minus_y, A.Y);
fe25519_1(x);
fe25519_add(x, x, A.Y);
diff --git a/libs/libsodium/src/crypto_sign/ed25519/ref10/obsolete.c b/libs/libsodium/src/crypto_sign/ed25519/ref10/obsolete.c deleted file mode 100644 index f0d53b7335..0000000000 --- a/libs/libsodium/src/crypto_sign/ed25519/ref10/obsolete.c +++ /dev/null @@ -1,116 +0,0 @@ -
-#include <limits.h>
-#include <stdint.h>
-#include <string.h>
-
-#include "crypto_hash_sha512.h"
-#include "crypto_sign_edwards25519sha512batch.h"
-#include "crypto_verify_32.h"
-#include "private/ed25519_ref10.h"
-#include "randombytes.h"
-#include "utils.h"
-
-int
-crypto_sign_edwards25519sha512batch_keypair(unsigned char *pk,
- unsigned char *sk)
-{
- ge25519_p3 A;
-
- randombytes_buf(sk, 32);
- crypto_hash_sha512(sk, sk, 32);
- sk[0] &= 248;
- sk[31] &= 127;
- sk[31] |= 64;
- ge25519_scalarmult_base(&A, sk);
- ge25519_p3_tobytes(pk, &A);
-
- return 0;
-}
-
-int
-crypto_sign_edwards25519sha512batch(unsigned char *sm,
- unsigned long long *smlen_p,
- const unsigned char *m,
- unsigned long long mlen,
- const unsigned char *sk)
-{
- crypto_hash_sha512_state hs;
- unsigned char nonce[64];
- unsigned char hram[64];
- unsigned char sig[64];
- ge25519_p3 A;
- ge25519_p3 R;
-
- crypto_hash_sha512_init(&hs);
- crypto_hash_sha512_update(&hs, sk + 32, 32);
- crypto_hash_sha512_update(&hs, m, mlen);
- crypto_hash_sha512_final(&hs, nonce);
- ge25519_scalarmult_base(&A, sk);
- ge25519_p3_tobytes(sig + 32, &A);
- sc25519_reduce(nonce);
- ge25519_scalarmult_base(&R, nonce);
- ge25519_p3_tobytes(sig, &R);
- crypto_hash_sha512_init(&hs);
- crypto_hash_sha512_update(&hs, sig, 32);
- crypto_hash_sha512_update(&hs, m, mlen);
- crypto_hash_sha512_final(&hs, hram);
- sc25519_reduce(hram);
- sc25519_muladd(sig + 32, hram, nonce, sk);
- sodium_memzero(hram, sizeof hram);
- memmove(sm + 32, m, (size_t) mlen);
- memcpy(sm, sig, 32);
- memcpy(sm + 32 + mlen, sig + 32, 32);
- *smlen_p = mlen + 64U;
-
- return 0;
-}
-
-int
-crypto_sign_edwards25519sha512batch_open(unsigned char *m,
- unsigned long long *mlen_p,
- const unsigned char *sm,
- unsigned long long smlen,
- const unsigned char *pk)
-{
- unsigned char h[64];
- unsigned char t1[32], t2[32];
- unsigned long long mlen;
- ge25519_cached Ai;
- ge25519_p1p1 csa;
- ge25519_p2 cs;
- ge25519_p3 A;
- ge25519_p3 R;
- ge25519_p3 cs3;
-
- *mlen_p = 0;
- if (smlen < 64 || smlen - 64 > crypto_sign_edwards25519sha512batch_MESSAGEBYTES_MAX) {
- return -1;
- }
- mlen = smlen - 64;
- if (sm[smlen - 1] & 224) {
- return -1;
- }
- if (ge25519_has_small_order(pk) != 0 ||
- ge25519_frombytes_negate_vartime(&A, pk) != 0 ||
- ge25519_has_small_order(sm) != 0 ||
- ge25519_frombytes_negate_vartime(&R, sm) != 0) {
- return -1;
- }
- ge25519_p3_to_cached(&Ai, &A);
- crypto_hash_sha512(h, sm, mlen + 32);
- sc25519_reduce(h);
- ge25519_scalarmult(&cs3, h, &R);
- ge25519_add(&csa, &cs3, &Ai);
- ge25519_p1p1_to_p2(&cs, &csa);
- ge25519_tobytes(t1, &cs);
- t1[31] ^= 1 << 7;
- ge25519_scalarmult_base(&R, sm + 32 + mlen);
- ge25519_p3_tobytes(t2, &R);
- if (crypto_verify_32(t1, t2) != 0) {
- return -1;
- }
- *mlen_p = mlen;
- memmove(m, sm + 32, mlen);
-
- return 0;
-}
diff --git a/libs/libsodium/src/crypto_sign/ed25519/ref10/open.c b/libs/libsodium/src/crypto_sign/ed25519/ref10/open.c index d4b3f26980..b4654e3bee 100644 --- a/libs/libsodium/src/crypto_sign/ed25519/ref10/open.c +++ b/libs/libsodium/src/crypto_sign/ed25519/ref10/open.c @@ -7,6 +7,7 @@ #include "crypto_sign_ed25519.h"
#include "crypto_verify_32.h"
#include "sign_ed25519_ref10.h"
+#include "private/common.h"
#include "private/ed25519_ref10.h"
#include "utils.h"
@@ -19,25 +20,32 @@ _crypto_sign_ed25519_verify_detached(const unsigned char *sig, {
crypto_hash_sha512_state hs;
unsigned char h[64];
- unsigned char rcheck[32];
+ ge25519_p3 check;
+ ge25519_p3 expected_r;
ge25519_p3 A;
- ge25519_p2 R;
+ ge25519_p3 sb_ah;
+ ge25519_p2 sb_ah_p2;
+ ACQUIRE_FENCE;
#ifdef ED25519_COMPAT
if (sig[63] & 224) {
return -1;
}
#else
- if (sc25519_is_canonical(sig + 32) == 0 ||
- ge25519_has_small_order(sig) != 0) {
+ if ((sig[63] & 240) != 0 &&
+ sc25519_is_canonical(sig + 32) == 0) {
return -1;
}
- if (ge25519_is_canonical(pk) == 0 ||
- ge25519_has_small_order(pk) != 0) {
+ if (ge25519_is_canonical(pk) == 0) {
return -1;
}
#endif
- if (ge25519_frombytes_negate_vartime(&A, pk) != 0) {
+ if (ge25519_frombytes_negate_vartime(&A, pk) != 0 ||
+ ge25519_has_small_order(&A) != 0) {
+ return -1;
+ }
+ if (ge25519_frombytes(&expected_r, sig) != 0 ||
+ ge25519_has_small_order(&expected_r) != 0) {
return -1;
}
_crypto_sign_ed25519_ref10_hinit(&hs, prehashed);
@@ -47,11 +55,11 @@ _crypto_sign_ed25519_verify_detached(const unsigned char *sig, crypto_hash_sha512_final(&hs, h);
sc25519_reduce(h);
- ge25519_double_scalarmult_vartime(&R, h, &A, sig + 32);
- ge25519_tobytes(rcheck, &R);
+ ge25519_double_scalarmult_vartime(&sb_ah_p2, h, &A, sig + 32, NULL);
+ ge25519_p2_to_p3(&sb_ah, &sb_ah_p2);
+ ge25519_p3_sub(&check, &expected_r, &sb_ah);
- return crypto_verify_32(rcheck, sig) | (-(rcheck == sig)) |
- sodium_memcmp(sig, rcheck, 32);
+ return ge25519_has_small_order(&check) - 1;
}
int
diff --git a/libs/libsodium/src/crypto_sign/ed25519/ref10/sign.c b/libs/libsodium/src/crypto_sign/ed25519/ref10/sign.c index 74a8100927..c00c08b40e 100644 --- a/libs/libsodium/src/crypto_sign/ed25519/ref10/sign.c +++ b/libs/libsodium/src/crypto_sign/ed25519/ref10/sign.c @@ -33,31 +33,16 @@ _crypto_sign_ed25519_clamp(unsigned char k[32]) }
#ifdef ED25519_NONDETERMINISTIC
-/* r = hash(B || empty_labelset || Z || pad1 || k || pad2 || empty_labelset || K || extra || M) (mod q) */
+/* r = hash(k || K || noise || pad || M) (mod q) */
static void
_crypto_sign_ed25519_synthetic_r_hv(crypto_hash_sha512_state *hs,
- unsigned char Z[32],
- const unsigned char sk[64])
+ unsigned char tmp[64],
+ const unsigned char az[64])
{
- static const unsigned char B[32] = {
- 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
- 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
- 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
- 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
- };
- static const unsigned char zeros[128] = { 0x00 };
- static const unsigned char empty_labelset[3] = { 0x02, 0x00, 0x00 };
-
- crypto_hash_sha512_update(hs, B, 32);
- crypto_hash_sha512_update(hs, empty_labelset, 3);
- randombytes_buf(Z, 32);
- crypto_hash_sha512_update(hs, Z, 32);
- crypto_hash_sha512_update(hs, zeros, 128 - (32 + 3 + 32) % 128);
- crypto_hash_sha512_update(hs, sk, 32);
- crypto_hash_sha512_update(hs, zeros, 128 - 32 % 128);
- crypto_hash_sha512_update(hs, empty_labelset, 3);
- crypto_hash_sha512_update(hs, sk + 32, 32);
- /* empty extra */
+ crypto_hash_sha512_update(hs, az, 64);
+ randombytes_buf(tmp, 32);
+ memset(tmp + 32, 0, 32);
+ crypto_hash_sha512_update(hs, tmp, 64);
}
#endif
@@ -76,7 +61,7 @@ _crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p, crypto_hash_sha512(az, sk, 32);
#ifdef ED25519_NONDETERMINISTIC
- _crypto_sign_ed25519_synthetic_r_hv(&hs, nonce, az);
+ _crypto_sign_ed25519_synthetic_r_hv(&hs, nonce /* tmp */, az);
#else
crypto_hash_sha512_update(&hs, az + 32, 32);
#endif
diff --git a/libs/libsodium/src/crypto_sign/ed25519/ref10/sign_ed25519_ref10.h b/libs/libsodium/src/crypto_sign/ed25519/ref10/sign_ed25519_ref10.h index 29db3269de..4c36638c7e 100644 --- a/libs/libsodium/src/crypto_sign/ed25519/ref10/sign_ed25519_ref10.h +++ b/libs/libsodium/src/crypto_sign/ed25519/ref10/sign_ed25519_ref10.h @@ -1,6 +1,8 @@ #ifndef sign_ed25519_ref10_H
#define sign_ed25519_ref10_H
+#include "private/quirks.h"
+
void _crypto_sign_ed25519_ref10_hinit(crypto_hash_sha512_state *hs,
int prehashed);
|