1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
#include <string.h>
#include "crypto_sign.h"
#include "crypto_hash_sha512.h"
#include "ge.h"
#include "sc.h"
#include "zeroize.h"
#include "crypto_additions.h"
/* NEW: Compare to pristine crypto_sign()
Uses explicit private key for nonce derivation and as scalar,
instead of deriving both from a master key.
*/
int crypto_usign_modified(
unsigned char *sm,
const unsigned char *M,unsigned long Mlen,
const unsigned char *a,
const unsigned char *A,
const unsigned char *random,
const ge_p3 *Bu,
const unsigned char *U
)
{
unsigned char r[64];
unsigned char h[64];
ge_p3 R, Ru;
int count=0;
/* r = SHA512(label(3) || a || U || random(64)) */
sm[0] = 0xFC;
for (count = 1; count < 32; count++)
sm[count] = 0xFF;
memmove(sm + 32, a, 32); /* Use privkey directly for nonce derivation */
memmove(sm + 64, U, 32);
memmove(sm + 96, random, 64); /* Add suffix of random data */
crypto_hash_sha512(r, sm, 160);
sc_reduce(r);
ge_scalarmult_base(&R, r);
ge_scalarmult(&Ru, r, Bu);
/* h = SHA512(label(4) || A || U || R || Ru || M) */
sm[0] = 0xFB;
memmove(sm + 32, A, 32);
memmove(sm + 64, U, 32);
ge_p3_tobytes(sm+96, &R);
ge_p3_tobytes(sm+128, &Ru);
memmove(sm + 160, M, Mlen);
crypto_hash_sha512(h, sm, Mlen + 160);
sc_reduce(h);
memmove(sm, h, 32); /* Write h */
sc_muladd(sm + 32, h, a, r); /* Write s */
/* Erase any traces of private scalar or
nonce left in the stack from sc_muladd. */
zeroize_stack();
zeroize(r, 64);
return 0;
}
|
