/** * Check whether if <b>signature</b> is a valid signature for the * <b>len</b>-byte message in <b>msg</b> made with the key <b>pubkey</b>. * * Return 0 if the signature is valid; -1 if it isn't. */ int ed25519_checksig(const ed25519_signature_t *signature, const uint8_t *msg, size_t len, const ed25519_public_key_t *pubkey) { return get_ed_impl()->open(signature->sig, msg, len, pubkey->pubkey) < 0 ? -1 : 0; }
/** * Given an ed25519 public key in <b>inp</b>, generate a corresponding blinded * public key in <b>out</b>, blinded with the 32-byte parameter in * <b>param</b>. Return 0 on sucess, -1 on railure. */ int ed25519_public_blind(ed25519_public_key_t *out, const ed25519_public_key_t *inp, const uint8_t *param) { get_ed_impl()->blind_public_key(out->pubkey, inp->pubkey, param); return 0; }
/** * Given a secret key in <b>seckey</b>, expand it into an * ed25519 public key. Return 0 on success, -1 on failure. */ int ed25519_public_key_generate(ed25519_public_key_t *pubkey_out, const ed25519_secret_key_t *seckey) { if (get_ed_impl()->pubkey(pubkey_out->pubkey, seckey->seckey) < 0) return -1; return 0; }
/** * Given a 32-byte random seed in <b>seed</b>, expand it into an ed25519 * secret key in <b>seckey_out</b>. Return 0 on success, -1 on failure. */ int ed25519_secret_key_from_seed(ed25519_secret_key_t *seckey_out, const uint8_t *seed) { if (get_ed_impl()->seckey_expand(seckey_out->seckey, seed) < 0) return -1; return 0; }
/** * Given a curve25519 public key and sign bit of X coordinate of the ed25519 * public key, generate the corresponding ed25519 public key. */ int ed25519_public_key_from_curve25519_public_key(ed25519_public_key_t *pubkey, const curve25519_public_key_t *pubkey_in, int signbit) { return get_ed_impl()->pubkey_from_curve25519_pubkey(pubkey->pubkey, pubkey_in->public_key, signbit); }
/** * Set <b>signature_out</b> to a signature of the <b>len</b>-byte message * <b>msg</b>, using the secret and public key in <b>keypair</b>. */ int ed25519_sign(ed25519_signature_t *signature_out, const uint8_t *msg, size_t len, const ed25519_keypair_t *keypair) { if (get_ed_impl()->sign(signature_out->sig, msg, len, keypair->seckey.seckey, keypair->pubkey.pubkey) < 0) { return -1; } return 0; }
/** * Initialize a new ed25519 secret key in <b>seckey_out</b>. If * <b>extra_strong</b>, take the RNG inputs directly from the operating * system. Return 0 on success, -1 on failure. */ int ed25519_secret_key_generate(ed25519_secret_key_t *seckey_out, int extra_strong) { int r; uint8_t seed[32]; if (! extra_strong || crypto_strongest_rand(seed, sizeof(seed)) < 0) crypto_rand((char*)seed, sizeof(seed)); r = get_ed_impl()->seckey_expand(seckey_out->seckey, seed); memwipe(seed, 0, sizeof(seed)); return r < 0 ? -1 : 0; }
/** * Given an ed25519 keypair in <b>inp</b>, generate a corresponding * ed25519 keypair in <b>out</b>, blinded by the corresponding 32-byte input * in 'param'. * * Tor uses key blinding for the "next-generation" hidden services design: * service descriptors are encrypted with a key derived from the service's * long-term public key, and then signed with (and stored at a position * indexed by) a short-term key derived by blinding the long-term keys. */ int ed25519_keypair_blind(ed25519_keypair_t *out, const ed25519_keypair_t *inp, const uint8_t *param) { ed25519_public_key_t pubkey_check; get_ed_impl()->blind_secret_key(out->seckey.seckey, inp->seckey.seckey, param); ed25519_public_blind(&pubkey_check, &inp->pubkey, param); ed25519_public_key_generate(&out->pubkey, &out->seckey); tor_assert(fast_memeq(pubkey_check.pubkey, out->pubkey.pubkey, 32)); memwipe(&pubkey_check, 0, sizeof(pubkey_check)); return 0; }
/** Check whether the given Ed25519 implementation seems to be working. * If so, return 0; otherwise return -1. */ static int ed25519_impl_spot_check(void) { static const uint8_t alicesk[32] = { 0xc5,0xaa,0x8d,0xf4,0x3f,0x9f,0x83,0x7b, 0xed,0xb7,0x44,0x2f,0x31,0xdc,0xb7,0xb1, 0x66,0xd3,0x85,0x35,0x07,0x6f,0x09,0x4b, 0x85,0xce,0x3a,0x2e,0x0b,0x44,0x58,0xf7 }; static const uint8_t alicepk[32] = { 0xfc,0x51,0xcd,0x8e,0x62,0x18,0xa1,0xa3, 0x8d,0xa4,0x7e,0xd0,0x02,0x30,0xf0,0x58, 0x08,0x16,0xed,0x13,0xba,0x33,0x03,0xac, 0x5d,0xeb,0x91,0x15,0x48,0x90,0x80,0x25 }; static const uint8_t alicemsg[2] = { 0xaf, 0x82 }; static const uint8_t alicesig[64] = { 0x62,0x91,0xd6,0x57,0xde,0xec,0x24,0x02, 0x48,0x27,0xe6,0x9c,0x3a,0xbe,0x01,0xa3, 0x0c,0xe5,0x48,0xa2,0x84,0x74,0x3a,0x44, 0x5e,0x36,0x80,0xd7,0xdb,0x5a,0xc3,0xac, 0x18,0xff,0x9b,0x53,0x8d,0x16,0xf2,0x90, 0xae,0x67,0xf7,0x60,0x98,0x4d,0xc6,0x59, 0x4a,0x7c,0x15,0xe9,0x71,0x6e,0xd2,0x8d, 0xc0,0x27,0xbe,0xce,0xea,0x1e,0xc4,0x0a }; const ed25519_impl_t *impl = get_ed_impl(); uint8_t sk[ED25519_SECKEY_LEN]; uint8_t pk[ED25519_PUBKEY_LEN]; uint8_t sig[ED25519_SIG_LEN]; int r = 0; /* Some implementations (eg: The modified Ed25519-donna) have handy self-test * code that sanity-checks the internals. If present, use that to screen out * catastrophic errors like massive compiler failure. */ if (impl->selftest && impl->selftest() != 0) goto fail; /* Validate results versus known answer tests. People really should be * running "make test" instead of relying on this, but it's better than * nothing. * * Test vectors taken from "EdDSA & Ed25519 - 6. Test Vectors for Ed25519 * (TEST3)" (draft-josefsson-eddsa-ed25519-03). */ /* Key expansion, public key derivation. */ if (impl->seckey_expand(sk, alicesk) < 0) goto fail; if (impl->pubkey(pk, sk) < 0) goto fail; if (fast_memneq(pk, alicepk, ED25519_PUBKEY_LEN)) goto fail; /* Signing, verification. */ if (impl->sign(sig, alicemsg, sizeof(alicemsg), sk, pk) < 0) return -1; if (fast_memneq(sig, alicesig, ED25519_SIG_LEN)) return -1; if (impl->open(sig, alicemsg, sizeof(alicemsg), pk) < 0) return -1; /* XXX/yawning: Someone that's more paranoid than I am, can write "Assume * ref0 is cannonical, and fuzz impl against it" if they want, but I doubt * that will catch anything that the known answer tests won't. */ goto end; fail: r = -1; end: return r; }
/** Validate every signature among those in <b>checkable</b>, which contains * exactly <b>n_checkable</b> elements. If <b>okay_out</b> is non-NULL, set * the i'th element of <b>okay_out</b> to 1 if the i'th element of * <b>checkable</b> is valid, and to 0 otherwise. Return 0 if every signature * was valid. Otherwise return -N, where N is the number of invalid * signatures. */ int ed25519_checksig_batch(int *okay_out, const ed25519_checkable_t *checkable, int n_checkable) { int i, res; const ed25519_impl_t *impl = get_ed_impl(); if (impl->open_batch == NULL) { /* No batch verification implementation available, fake it by checking the * each signature individually. */ res = 0; for (i = 0; i < n_checkable; ++i) { const ed25519_checkable_t *ch = &checkable[i]; int r = ed25519_checksig(&ch->signature, ch->msg, ch->len, ch->pubkey); if (r < 0) --res; if (okay_out) okay_out[i] = (r == 0); } } else { /* ed25519-donna style batch verification available. * * Theoretically, this should only be called if n_checkable >= 3, since * that's the threshold where the batch verification actually kicks in, * but the only difference is a few mallocs/frees. */ const uint8_t **ms; size_t *lens; const uint8_t **pks; const uint8_t **sigs; int *oks; int all_ok; ms = tor_malloc(sizeof(uint8_t*)*n_checkable); lens = tor_malloc(sizeof(size_t)*n_checkable); pks = tor_malloc(sizeof(uint8_t*)*n_checkable); sigs = tor_malloc(sizeof(uint8_t*)*n_checkable); oks = okay_out ? okay_out : tor_malloc(sizeof(int)*n_checkable); for (i = 0; i < n_checkable; ++i) { ms[i] = checkable[i].msg; lens[i] = checkable[i].len; pks[i] = checkable[i].pubkey->pubkey; sigs[i] = checkable[i].signature.sig; oks[i] = 0; } res = 0; all_ok = impl->open_batch(ms, lens, pks, sigs, n_checkable, oks); for (i = 0; i < n_checkable; ++i) { if (!oks[i]) --res; } /* XXX: For now sanity check oks with the return value. Once we have * more confidence in the code, if `all_ok == 0` we can skip iterating * over oks since all the signatures were found to be valid. */ tor_assert(((res == 0) && !all_ok) || ((res < 0) && all_ok)); tor_free(ms); tor_free(lens); tor_free(pks); tor_free(sigs); if (! okay_out) tor_free(oks); } return res; }