void ge_montx_to_p2(ge_p2* p, const fe u, const unsigned char ed_sign_bit) { fe x, y, A, v, v2, iv, nx; fe_frombytes(A, A_bytes); /* given u, recover edwards y */ /* given u, recover v */ /* given u and v, recover edwards x */ fe_montx_to_edy(y, u); /* y = (u - 1) / (u + 1) */ fe_mont_rhs(v2, u); /* v^2 = u(u^2 + Au + 1) */ fe_sqrt(v, v2); /* v = sqrt(v^2) */ fe_mul(x, u, A); /* x = u * sqrt(-(A+2)) */ fe_invert(iv, v); /* 1/v */ fe_mul(x, x, iv); /* x = (u/v) * sqrt(-(A+2)) */ fe_neg(nx, x); /* negate x to match sign bit */ fe_cmov(x, nx, fe_isnegative(x) ^ ed_sign_bit); fe_copy(p->X, x); fe_copy(p->Y, y); fe_1(p->Z); /* POSTCONDITION: check that p->X and p->Y satisfy the Ed curve equation */ /* -x^2 + y^2 = 1 + dx^2y^2 */ #ifndef NDEBUG { fe one, d, x2, y2, x2y2, dx2y2; unsigned char dbytes[32] = { 0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75, 0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00, 0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c, 0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52 }; fe_frombytes(d, dbytes); fe_1(one); fe_sq(x2, p->X); /* x^2 */ fe_sq(y2, p->Y); /* y^2 */ fe_mul(dx2y2, x2, y2); /* x^2y^2 */ fe_mul(dx2y2, dx2y2, d); /* dx^2y^2 */ fe_add(dx2y2, dx2y2, one); /* dx^2y^2 + 1 */ fe_neg(x2y2, x2); /* -x^2 */ fe_add(x2y2, x2y2, y2); /* -x^2 + y^2 */ assert(fe_isequal(x2y2, dx2y2)); } #endif }
int curve25519_verify(const unsigned char* signature, const unsigned char* curve25519_pubkey, const unsigned char* msg, const unsigned long msg_len) { fe mont_x, mont_x_minus_one, mont_x_plus_one, inv_mont_x_plus_one; fe one; fe ed_y; unsigned char ed_pubkey[32]; unsigned long long some_retval; unsigned char verifybuf[MAX_MSG_LEN + 64]; /* working buffer */ unsigned char verifybuf2[MAX_MSG_LEN + 64]; /* working buffer #2 */ if (msg_len > MAX_MSG_LEN) { return -1; } /* Convert the Curve25519 public key into an Ed25519 public key. In particular, convert Curve25519's "montgomery" x-coordinate into an Ed25519 "edwards" y-coordinate: ed_y = (mont_x - 1) / (mont_x + 1) NOTE: mont_x=-1 is converted to ed_y=0 since fe_invert is mod-exp Then move the sign bit into the pubkey from the signature. */ fe_frombytes(mont_x, curve25519_pubkey); fe_1(one); fe_sub(mont_x_minus_one, mont_x, one); fe_add(mont_x_plus_one, mont_x, one); fe_invert(inv_mont_x_plus_one, mont_x_plus_one); fe_mul(ed_y, mont_x_minus_one, inv_mont_x_plus_one); fe_tobytes(ed_pubkey, ed_y); /* Copy the sign bit, and remove it from signature */ ed_pubkey[31] &= 0x7F; /* bit should be zero already, but just in case */ ed_pubkey[31] |= (signature[63] & 0x80); memmove(verifybuf, signature, 64); verifybuf[63] &= 0x7F; memmove(verifybuf+64, msg, msg_len); /* Then perform a normal Ed25519 verification, return 0 on success */ /* The below call has a strange API: */ /* verifybuf = R || S || message */ /* verifybuf2 = internal to next call gets a copy of verifybuf, S gets replaced with pubkey for hashing, then the whole thing gets zeroized (if bad sig), or contains a copy of msg (good sig) */ return crypto_sign_open(verifybuf2, &some_retval, verifybuf, 64 + msg_len, ed_pubkey); }
static int curve25519(unsigned char* q, unsigned char* n, unsigned char* p) { unsigned char e[32]; unsigned int i; fe x1; fe x2; fe z2; fe x3; fe z3; fe tmp0; fe tmp1; int pos; unsigned int swap; unsigned int b; for (i = 0;i < 32;++i) e[i] = n[i]; e[0] &= 248; e[31] &= 127; e[31] |= 64; fe_frombytes(x1,p); fe_1(x2); fe_0(z2); fe_copy(x3,x1); fe_1(z3); swap = 0; for (pos = 254;pos >= 0;--pos) { b = e[pos / 8] >> (pos & 7); b &= 1; swap ^= b; fe_cswap(x2,x3,swap); fe_cswap(z2,z3,swap); swap = b; #include <cyassl/ctaocrypt/ecc25519_montgomery.h> } fe_cswap(x2,x3,swap); fe_cswap(z2,z3,swap); fe_invert(z2,z2); fe_mul(x2,x2,z2); fe_tobytes(q,x2); return 0; }
static int crypto_scalarmult_curve25519_sandy2x(unsigned char *q, const unsigned char *n, const unsigned char *p) { unsigned char e[32]; unsigned int i; fe var[3]; fe51 x_51; fe51 z_51; for (i = 0;i < 32;++i) e[i] = n[i]; e[0] &= 248; e[31] &= 127; e[31] |= 64; fe_frombytes(x1, p); ladder(var, e); z_51.v[0] = (z2[1] << 26) + z2[0]; z_51.v[1] = (z2[3] << 26) + z2[2]; z_51.v[2] = (z2[5] << 26) + z2[4]; z_51.v[3] = (z2[7] << 26) + z2[6]; z_51.v[4] = (z2[9] << 26) + z2[8]; x_51.v[0] = (x2[1] << 26) + x2[0]; x_51.v[1] = (x2[3] << 26) + x2[2]; x_51.v[2] = (x2[5] << 26) + x2[4]; x_51.v[3] = (x2[7] << 26) + x2[6]; x_51.v[4] = (x2[9] << 26) + x2[8]; fe51_invert(&z_51, &z_51); fe51_mul(&x_51, &x_51, &z_51); fe51_pack(q, &x_51); return 0; }
int xed25519_verify(const unsigned char* signature, const unsigned char* curve25519_pubkey, const unsigned char* msg, const unsigned long msg_len) { fe u; fe y; unsigned char ed_pubkey[32]; unsigned char strict[32]; unsigned char verifybuf[MAX_MSG_LEN + 64]; /* working buffer */ unsigned char verifybuf2[MAX_MSG_LEN + 64]; /* working buffer #2 */ if (msg_len > MAX_MSG_LEN) { return -1; } /* Convert the Curve25519 public key into an Ed25519 public key. y = (u - 1) / (u + 1) NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp */ fe_frombytes(u, curve25519_pubkey); fe_tobytes(strict, u); if (crypto_verify_32(strict, curve25519_pubkey) != 0) return 0; fe_montx_to_edy(y, u); fe_tobytes(ed_pubkey, y); memmove(verifybuf, signature, 64); memmove(verifybuf+64, msg, msg_len); /* Then perform a normal Ed25519 verification, return 0 on success */ /* The below call has a strange API: */ /* verifybuf = R || S || message */ /* verifybuf2 = internal to next call gets a copy of verifybuf, S gets replaced with pubkey for hashing */ return crypto_sign_open_modified(verifybuf2, verifybuf, 64 + msg_len, ed_pubkey); }
void fe_sqrt(fe out, const fe a) { fe exp, b, b2, bi, i; #ifndef NDEBUG fe legendre, zero, one; #endif fe_frombytes(i, i_bytes); fe_pow22523(exp, a); /* b = a^(q-5)/8 */ /* PRECONDITION: legendre symbol == 1 (square) or 0 (a == zero) */ #ifndef NDEBUG fe_sq(legendre, exp); /* in^((q-5)/4) */ fe_sq(legendre, legendre); /* in^((q-5)/2) */ fe_mul(legendre, legendre, a); /* in^((q-3)/2) */ fe_mul(legendre, legendre, a); /* in^((q-1)/2) */ fe_0(zero); fe_1(one); assert(fe_isequal(legendre, zero) || fe_isequal(legendre, one)); #endif fe_mul(b, a, exp); /* b = a * a^(q-5)/8 */ fe_sq(b2, b); /* b^2 = a * a^(q-1)/4 */ /* note b^4 == a^2, so b^2 == a or -a * if b^2 != a, multiply it by sqrt(-1) */ fe_mul(bi, b, i); fe_cmov(b, bi, 1 ^ fe_isequal(b2, a)); fe_copy(out, b); /* PRECONDITION: out^2 == a */ #ifndef NDEBUG fe_sq(b2, out); assert(fe_isequal(a, b2)); #endif }
static int crypto_scalarmult_curve25519_ref10(unsigned char *q, const unsigned char *n, const unsigned char *p) { unsigned char e[32]; unsigned int i; fe x1; fe x2; fe z2; fe x3; fe z3; fe tmp0; fe tmp1; int pos; unsigned int swap; unsigned int b; for (i = 0;i < 32;++i) e[i] = n[i]; e[0] &= 248; e[31] &= 127; e[31] |= 64; fe_frombytes(x1,p); fe_1(x2); fe_0(z2); fe_copy(x3,x1); fe_1(z3); swap = 0; for (pos = 254;pos >= 0;--pos) { b = e[pos / 8] >> (pos & 7); b &= 1; swap ^= b; fe_cswap(x2,x3,swap); fe_cswap(z2,z3,swap); swap = b; fe_sub(tmp0,x3,z3); fe_sub(tmp1,x2,z2); fe_add(x2,x2,z2); fe_add(z2,x3,z3); fe_mul(z3,tmp0,x2); fe_mul(z2,z2,tmp1); fe_sq(tmp0,tmp1); fe_sq(tmp1,x2); fe_add(x3,z3,z2); fe_sub(z2,z3,z2); fe_mul(x2,tmp1,tmp0); fe_sub(tmp1,tmp1,tmp0); fe_sq(z2,z2); fe_mul121666(z3,tmp1); fe_sq(x3,x3); fe_add(tmp0,tmp0,z3); fe_mul(z3,x1,z2); fe_mul(z2,tmp1,tmp0); } fe_cswap(x2,x3,swap); fe_cswap(z2,z3,swap); fe_invert(z2,z2); fe_mul(x2,x2,z2); fe_tobytes(q,x2); return 0; }
int elligator_fast_test(int silent) { unsigned char elligator_correct_output[32] = { 0x5f, 0x35, 0x20, 0x00, 0x1c, 0x6c, 0x99, 0x36, 0xa3, 0x12, 0x06, 0xaf, 0xe7, 0xc7, 0xac, 0x22, 0x4e, 0x88, 0x61, 0x61, 0x9b, 0xf9, 0x88, 0x72, 0x44, 0x49, 0x15, 0x89, 0x9d, 0x95, 0xf4, 0x6e }; unsigned char hashtopoint_correct_output1[32] = { 0xce, 0x89, 0x9f, 0xb2, 0x8f, 0xf7, 0x20, 0x91, 0x5e, 0x14, 0xf5, 0xb7, 0x99, 0x08, 0xab, 0x17, 0xaa, 0x2e, 0xe2, 0x45, 0xb4, 0xfc, 0x2b, 0xf6, 0x06, 0x36, 0x29, 0x40, 0xed, 0x7d, 0xe7, 0xed }; unsigned char hashtopoint_correct_output2[32] = { 0xa0, 0x35, 0xbb, 0xa9, 0x4d, 0x30, 0x55, 0x33, 0x0d, 0xce, 0xc2, 0x7f, 0x83, 0xde, 0x79, 0xd0, 0x89, 0x67, 0x72, 0x4c, 0x07, 0x8d, 0x68, 0x9d, 0x61, 0x52, 0x1d, 0xf9, 0x2c, 0x5c, 0xba, 0x77 }; unsigned char calculatev_correct_output[32] = { 0x1b, 0x77, 0xb5, 0xa0, 0x44, 0x84, 0x7e, 0xb9, 0x23, 0xd7, 0x93, 0x18, 0xce, 0xc2, 0xc5, 0xe2, 0x84, 0xd5, 0x79, 0x6f, 0x65, 0x63, 0x1b, 0x60, 0x9b, 0xf1, 0xf8, 0xce, 0x88, 0x0b, 0x50, 0x9c, }; int count; fe in, out; unsigned char bytes[32]; fe_0(in); fe_0(out); for (count = 0; count < 32; count++) { bytes[count] = count; } fe_frombytes(in, bytes); elligator(out, in); fe_tobytes(bytes, out); TEST("Elligator vector", memcmp(bytes, elligator_correct_output, 32) == 0); /* Elligator(0) == 0 test */ fe_0(in); elligator(out, in); TEST("Elligator(0) == 0", memcmp(in, out, 32) == 0); /* ge_montx_to_p3(0) -> order2 point test */ fe one, negone, zero; fe_1(one); fe_0(zero); fe_sub(negone, zero, one); ge_p3 p3; ge_montx_to_p3(&p3, zero, 0); TEST("ge_montx_to_p3(0) == order 2 point", fe_isequal(p3.X, zero) && fe_isequal(p3.Y, negone) && fe_isequal(p3.Z, one) && fe_isequal(p3.T, zero)); /* Hash to point vector test */ unsigned char htp[32]; for (count=0; count < 32; count++) { htp[count] = count; } hash_to_point(&p3, htp, 32); ge_p3_tobytes(htp, &p3); TEST("hash_to_point #1", memcmp(htp, hashtopoint_correct_output1, 32) == 0); for (count=0; count < 32; count++) { htp[count] = count+1; } hash_to_point(&p3, htp, 32); ge_p3_tobytes(htp, &p3); TEST("hash_to_point #2", memcmp(htp, hashtopoint_correct_output2, 32) == 0); /* calculate_U vector test */ ge_p3 Bv; unsigned char V[32]; unsigned char Vbuf[200]; unsigned char a[32]; unsigned char A[32]; unsigned char Vmsg[3]; Vmsg[0] = 0; Vmsg[1] = 1; Vmsg[2] = 2; for (count=0; count < 32; count++) { a[count] = 8 + count; A[count] = 9 + count; } sc_clamp(a); calculate_Bv_and_V(&Bv, V, Vbuf, a, A, Vmsg, 3); TEST("calculate_Bv_and_V vector", memcmp(V, calculatev_correct_output, 32) == 0); return 0; }
void ed25519_key_exchange(unsigned char *shared_secret, const unsigned char *public_key, const unsigned char *private_key) { unsigned char e[32]; unsigned int i; fe x1; fe x2; fe z2; fe x3; fe z3; fe tmp0; fe tmp1; int pos; unsigned int swap; unsigned int b; /* copy the private key and make sure it's valid */ for (i = 0; i < 32; ++i) { e[i] = private_key[i]; } e[0] &= 248; e[31] &= 63; e[31] |= 64; /* unpack the public key and convert edwards to montgomery */ /* due to CodesInChaos: montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p */ fe_frombytes(x1, public_key); fe_1(tmp1); fe_add(tmp0, x1, tmp1); fe_sub(tmp1, tmp1, x1); fe_invert(tmp1, tmp1); fe_mul(x1, tmp0, tmp1); fe_1(x2); fe_0(z2); fe_copy(x3, x1); fe_1(z3); swap = 0; for (pos = 254; pos >= 0; --pos) { b = e[pos / 8] >> (pos & 7); b &= 1; swap ^= b; fe_cswap(x2, x3, swap); fe_cswap(z2, z3, swap); swap = b; /* from montgomery.h */ fe_sub(tmp0, x3, z3); fe_sub(tmp1, x2, z2); fe_add(x2, x2, z2); fe_add(z2, x3, z3); fe_mul(z3, tmp0, x2); fe_mul(z2, z2, tmp1); fe_sq(tmp0, tmp1); fe_sq(tmp1, x2); fe_add(x3, z3, z2); fe_sub(z2, z3, z2); fe_mul(x2, tmp1, tmp0); fe_sub(tmp1, tmp1, tmp0); fe_sq(z2, z2); fe_mul121666(z3, tmp1); fe_sq(x3, x3); fe_add(tmp0, tmp0, z3); fe_mul(z3, x1, z2); fe_mul(z2, tmp1, tmp0); } fe_cswap(x2, x3, swap); fe_cswap(z2, z3, swap); fe_invert(z2, z2); fe_mul(x2, x2, z2); fe_tobytes(shared_secret, x2); }
static void fe_from_generic(fe out, const EC_FELEM *in) { fe_frombytes(out, in->bytes); }