From: Daiki Ueno dueno@redhat.com
Signed-off-by: Daiki Ueno dueno@redhat.com --- Makefile.in | 4 +- ecc-192.c | 1 + ecc-224.c | 1 + ecc-25519.c | 1 + ecc-256.c | 1 + ecc-384.c | 1 + ecc-448.c | 1 + ecc-521.c | 1 + ecc-internal.h | 18 +++ ed25519-sha512-sign.c | 15 +++ ed448-shake256-pubkey.c | 60 ++++++++++ ed448-shake256-sign.c | 92 +++++++++++++++ ed448-shake256-verify.c | 66 +++++++++++ eddsa-compress.c | 11 +- eddsa-decompress.c | 17 ++- eddsa-expand.c | 20 +++- eddsa-hash.c | 35 ++++++ eddsa-pubkey.c | 2 +- eddsa-sign.c | 16 +-- eddsa-verify.c | 16 ++- eddsa.h | 24 ++++ nettle.texinfo | 25 +++++ testsuite/.test-rules.make | 3 + testsuite/Makefile.in | 2 +- testsuite/ed448-test.c | 240 ++++++++++++++++++++++++++++++++++++++++ testsuite/eddsa-compress-test.c | 137 ++++++++++++----------- testsuite/eddsa-sign-test.c | 66 ++++++++++- testsuite/eddsa-verify-test.c | 49 +++++++- 28 files changed, 833 insertions(+), 92 deletions(-) create mode 100644 ed448-shake256-pubkey.c create mode 100644 ed448-shake256-sign.c create mode 100644 ed448-shake256-verify.c create mode 100644 testsuite/ed448-test.c
diff --git a/Makefile.in b/Makefile.in index 80c66ce8..10185bb8 100644 --- a/Makefile.in +++ b/Makefile.in @@ -185,7 +185,9 @@ hogweed_SOURCES = sexp.c sexp-format.c \ eddsa-compress.c eddsa-decompress.c eddsa-expand.c \ eddsa-hash.c eddsa-pubkey.c eddsa-sign.c eddsa-verify.c \ ed25519-sha512-pubkey.c \ - ed25519-sha512-sign.c ed25519-sha512-verify.c + ed25519-sha512-sign.c ed25519-sha512-verify.c \ + ed448-shake256-pubkey.c \ + ed448-shake256-sign.c ed448-shake256-verify.c
OPT_SOURCES = fat-x86_64.c fat-arm.c mini-gmp.c
diff --git a/ecc-192.c b/ecc-192.c index 1fbbcded..319d1418 100644 --- a/ecc-192.c +++ b/ecc-192.c @@ -172,6 +172,7 @@ const struct ecc_curve nettle_secp_192r1 = ecc_b, ecc_g, NULL, + NULL, ecc_unit, ecc_table }; diff --git a/ecc-224.c b/ecc-224.c index b1ff0578..f679c01a 100644 --- a/ecc-224.c +++ b/ecc-224.c @@ -124,6 +124,7 @@ const struct ecc_curve nettle_secp_224r1 = ecc_b, ecc_g, NULL, + NULL, ecc_unit, ecc_table }; diff --git a/ecc-25519.c b/ecc-25519.c index 16073ecf..ac5638a6 100644 --- a/ecc-25519.c +++ b/ecc-25519.c @@ -352,6 +352,7 @@ const struct ecc_curve _nettle_curve25519 = ecc_d, /* Use the Edwards curve constant. */ ecc_g, ecc_edwards, + &_nettle_ed25519_sha512, ecc_unit, ecc_table }; diff --git a/ecc-256.c b/ecc-256.c index d0870657..e9268e76 100644 --- a/ecc-256.c +++ b/ecc-256.c @@ -301,6 +301,7 @@ const struct ecc_curve nettle_secp_256r1 = ecc_b, ecc_g, NULL, + NULL, ecc_unit, ecc_table }; diff --git a/ecc-384.c b/ecc-384.c index 006c4568..4aa7f96e 100644 --- a/ecc-384.c +++ b/ecc-384.c @@ -209,6 +209,7 @@ const struct ecc_curve nettle_secp_384r1 = ecc_b, ecc_g, NULL, + NULL, ecc_unit, ecc_table }; diff --git a/ecc-448.c b/ecc-448.c index a70ff7cc..f98616d8 100644 --- a/ecc-448.c +++ b/ecc-448.c @@ -267,6 +267,7 @@ const struct ecc_curve _nettle_curve448 = ecc_b, ecc_g, NULL, + &_nettle_ed448_shake256, ecc_unit, ecc_table }; diff --git a/ecc-521.c b/ecc-521.c index 9d32b54e..396f66e0 100644 --- a/ecc-521.c +++ b/ecc-521.c @@ -137,6 +137,7 @@ const struct ecc_curve nettle_secp_521r1 = ecc_b, ecc_g, NULL, + NULL, ecc_unit, ecc_table }; diff --git a/ecc-internal.h b/ecc-internal.h index b58093ee..1ddec986 100644 --- a/ecc-internal.h +++ b/ecc-internal.h @@ -84,6 +84,9 @@ extern const struct ecc_curve _nettle_curve25519; extern const struct ecc_curve _nettle_curve448;
+extern const struct ecc_eddsa _nettle_ed25519_sha512; +extern const struct ecc_eddsa _nettle_ed448_shake256; + #define ECC_MAX_SIZE ((521 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
/* Window size for ecc_mul_a. Using 4 bits seems like a good choice, @@ -200,6 +203,9 @@ struct ecc_curve equivalent Edwards curve. */ const mp_limb_t *edwards_root;
+ /* EdDSA parameters; NULL if the curve is not usable in EdDSA. */ + const struct ecc_eddsa *eddsa; + /* For redc, same as B mod p, otherwise 1. */ const mp_limb_t *unit;
@@ -216,6 +222,18 @@ struct ecc_curve const mp_limb_t *pippenger_table; };
+/* EdDSA parameters. */ +typedef void ecc_eddsa_dom_func (int phflag, size_t length, uint8_t *context, + const struct nettle_hash *hash, + void *ctx); + +struct ecc_eddsa +{ + unsigned short b; + unsigned short c; + ecc_eddsa_dom_func *dom; +}; + /* In-place reduction. */ ecc_mod_func ecc_mod; ecc_mod_func ecc_pp1_redc; diff --git a/ed25519-sha512-sign.c b/ed25519-sha512-sign.c index af9de209..c26dc6b1 100644 --- a/ed25519-sha512-sign.c +++ b/ed25519-sha512-sign.c @@ -38,6 +38,21 @@ #include "ecc-internal.h" #include "sha2.h"
+static void +ed25519_sha512_dom (int phflag, size_t length, uint8_t *context, + const struct nettle_hash *hash, + void *ctx) +{ + /* No-op for PureEdDSA. */ +} + +const struct ecc_eddsa _nettle_ed25519_sha512 = +{ + 256, + 3, + ed25519_sha512_dom +}; + void ed25519_sha512_sign (const uint8_t *pub, const uint8_t *priv, diff --git a/ed448-shake256-pubkey.c b/ed448-shake256-pubkey.c new file mode 100644 index 00000000..7cfa54e9 --- /dev/null +++ b/ed448-shake256-pubkey.c @@ -0,0 +1,60 @@ +/* ed448-shake256-pubkey.c + + Copyright (C) 2017 Daiki Ueno + Copyright (C) 2017 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "eddsa.h" + +#include "ecc-internal.h" +#include "sha3.h" + +void +ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv) +{ + const struct ecc_curve *ecc = &_nettle_curve448; + struct shake256_ctx ctx; + uint8_t digest[ED448_SIGNATURE_SIZE]; + mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc); + mp_limb_t *scratch = gmp_alloc_limbs (itch); + +#define k scratch +#define scratch_out (scratch + ecc->q.size) + + _eddsa_expand_key (ecc, &nettle_shake256, &ctx, priv, digest, k); + _eddsa_public_key (ecc, k, pub, scratch_out); + + gmp_free_limbs (scratch, itch); +#undef k +#undef scratch_out +} diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c new file mode 100644 index 00000000..f52804f6 --- /dev/null +++ b/ed448-shake256-sign.c @@ -0,0 +1,92 @@ +/* ed448-shake256-sign.c + + Copyright (C) 2017 Daiki Ueno + Copyright (C) 2017 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> + +#include "eddsa.h" + +#include "ecc-internal.h" +#include "sha3.h" + +static void +ed448_shake256_dom (int phflag, size_t length, uint8_t *context, + const struct nettle_hash *hash, + void *ctx) +{ + uint8_t buffer[2]; + buffer[0] = phflag ? 1 : 0; + assert (length < 256); + buffer[1] = length; + hash->update (ctx, 8, "SigEd448"); + hash->update (ctx, 2, buffer); + hash->update (ctx, length, context); +} + +const struct ecc_eddsa _nettle_ed448_shake256 = +{ + 456, + 2, + ed448_shake256_dom +}; + +void +ed448_shake256_sign (const uint8_t *pub, + const uint8_t *priv, + size_t length, const uint8_t *msg, + uint8_t *signature) +{ + const struct ecc_curve *ecc = &_nettle_curve448; + mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc); + mp_limb_t *scratch = gmp_alloc_limbs (itch); +#define k2 scratch +#define scratch_out (scratch + ecc->q.size) + struct shake256_ctx ctx; + uint8_t digest[ED448_SIGNATURE_SIZE]; +#define k1 (digest + ED448_KEY_SIZE) + + _eddsa_expand_key (ecc, &nettle_shake256, &ctx, priv, digest, k2); + + ed448_shake256_dom (0, 0, "", &nettle_shake256, &ctx); + shake256_update (&ctx, ED448_KEY_SIZE, k1); + _eddsa_sign (ecc, &nettle_shake256, pub, + &ctx, + k2, length, msg, signature, scratch_out); + + gmp_free_limbs (scratch, itch); +#undef k1 +#undef k2 +#undef scratch_out +} diff --git a/ed448-shake256-verify.c b/ed448-shake256-verify.c new file mode 100644 index 00000000..4081abc3 --- /dev/null +++ b/ed448-shake256-verify.c @@ -0,0 +1,66 @@ +/* ed448-shake256-verify.c + + Copyright (C) 2017 Daiki Ueno + Copyright (C) 2017 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <string.h> + +#include "eddsa.h" + +#include "ecc-internal.h" +#include "sha3.h" + +int +ed448_shake256_verify (const uint8_t *pub, + size_t length, const uint8_t *msg, + const uint8_t *signature) +{ + const struct ecc_curve *ecc = &_nettle_curve448; + mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc); + mp_limb_t *scratch = gmp_alloc_limbs (itch); + struct shake256_ctx ctx; + int res; +#define A scratch +#define scratch_out (scratch + 3*ecc->p.size) + res = (_eddsa_decompress (ecc, + A, pub, scratch_out) + && _eddsa_verify (ecc, &nettle_shake256, + pub, A, &ctx, + length, msg, signature, + scratch_out)); + gmp_free_limbs (scratch, itch); + return res; +#undef A +#undef scratch_out +} diff --git a/eddsa-compress.c b/eddsa-compress.c index 40959586..2b36d3aa 100644 --- a/eddsa-compress.c +++ b/eddsa-compress.c @@ -33,6 +33,8 @@ # include "config.h" #endif
+#include <assert.h> + #include "eddsa.h"
#include "ecc-internal.h" @@ -48,15 +50,20 @@ void _eddsa_compress (const struct ecc_curve *ecc, uint8_t *r, mp_limb_t *p, mp_limb_t *scratch) { + size_t nbytes; + #define xp scratch #define yp (scratch + ecc->p.size) #define scratch_out (scratch + 2*ecc->p.size)
+ assert (ecc->eddsa); + + nbytes = 1 + (ecc->eddsa->b - 1) / 8; ecc->h_to_a (ecc, 0, xp, p, scratch_out); /* Encoding is the y coordinate and an appended "sign" bit, which is the low bit of x. Bit order is not specified explicitly, but for little-endian encoding, it makes most sense to append the bit after the most significant bit of y. */ - mpn_get_base256_le (r, 1 + ecc->p.bit_size / 8, yp, ecc->p.size); - r[ecc->p.bit_size / 8] += (xp[0] & 1) << (ecc->p.bit_size & 7); + mpn_get_base256_le (r, nbytes, yp, ecc->p.size); + r[nbytes - 1] += (xp[0] & 1) << ((ecc->eddsa->b - 1) & 7); } diff --git a/eddsa-decompress.c b/eddsa-decompress.c index 75550168..75a38c0f 100644 --- a/eddsa-decompress.c +++ b/eddsa-decompress.c @@ -33,6 +33,8 @@ # include "config.h" #endif
+#include <assert.h> + #include "eddsa.h"
#include "ecc-internal.h" @@ -50,6 +52,7 @@ _eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p, mp_limb_t *scratch) { mp_limb_t sign, cy; + size_t bits; int res;
#define xp p @@ -61,17 +64,25 @@ _eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p, #define tp (scratch + 2*ecc->p.size) #define scratch_out (scratch + 4*ecc->p.size)
- sign = cp[ecc->p.bit_size / 8] >> (ecc->p.bit_size & 7); + assert (ecc->eddsa); + + bits = ecc->eddsa->b - 1; + sign = cp[bits / 8] >> (bits & 7); if (sign > 1) return 0; - mpn_set_base256_le (yp, ecc->p.size, cp, 1 + ecc->p.bit_size / 8); + mpn_set_base256_le (yp, ecc->p.size, cp, 1 + bits / 8); /* Clear out the sign bit (if it fits) */ yp[ecc->p.size - 1] &= ~(mp_limb_t) 0 >> (ecc->p.size * GMP_NUMB_BITS - ecc->p.bit_size); ecc_modp_sqr (ecc, y2, yp); ecc_modp_mul (ecc, vp, y2, ecc->b); ecc_modp_sub (ecc, vp, vp, ecc->unit); - ecc_modp_sub (ecc, up, ecc->unit, y2); + /* The sign is different between curve25519 and curve448. */ + /* FIXME: Define a suitable method in ecc_eddsa? */ + if (ecc->p.bit_size == 255) + ecc_modp_sub (ecc, up, ecc->unit, y2); + else + ecc_modp_sub (ecc, up, y2, ecc->unit); res = ecc->p.sqrt (&ecc->p, tp, up, vp, scratch_out);
cy = mpn_sub_n (xp, tp, ecc->p.m, ecc->p.size); diff --git a/eddsa-expand.c b/eddsa-expand.c index dc2bfaf1..3e39c8f7 100644 --- a/eddsa-expand.c +++ b/eddsa-expand.c @@ -52,18 +52,26 @@ _eddsa_expand_key (const struct ecc_curve *ecc, uint8_t *digest, mp_limb_t *k2) { - size_t nbytes = 1 + ecc->p.bit_size / 8; + size_t nbytes; + mp_size_t size;
- assert (H->digest_size >= 2*nbytes); + assert (ecc->eddsa); + + nbytes = 1 + (ecc->eddsa->b - 1) / 8; + size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / 8;
H->init (ctx); H->update (ctx, nbytes, key); H->digest (ctx, 2*nbytes, digest);
- mpn_set_base256_le (k2, ecc->p.size, digest, nbytes); - /* Clear low 3 bits */ - k2[0] &= ~(mp_limb_t) 7; - /* Set bit number bit_size - 1 (bit 254 for curve25519) */ + mpn_set_base256_le (k2, size, digest, nbytes); + /* FIXME: reduce k2 to ecc->p.size */ + + /* Clear low c bits */ + k2[0] &= ~(mp_limb_t) ((1 << ecc->eddsa->c) - 1); + + /* Set bit number bit_size - 1 (bit 254 for curve25519, bit 447 for + curve448) */ k2[(ecc->p.bit_size - 1) / GMP_NUMB_BITS] |= (mp_limb_t) 1 << ((ecc->p.bit_size - 1) % GMP_NUMB_BITS); /* Clear any higher bits. */ diff --git a/eddsa-hash.c b/eddsa-hash.c index 4fb79f1b..a8d50815 100644 --- a/eddsa-hash.c +++ b/eddsa-hash.c @@ -49,3 +49,38 @@ _eddsa_hash (const struct ecc_modulo *m, mpn_set_base256_le (rp, 2*m->size, digest, 2*nbytes); m->mod (m, rp); } + +void +_eddsa_sized_hash (const struct ecc_modulo *m, + mp_size_t bits, + mp_limb_t *rp, + const uint8_t *digest) +{ + size_t nbytes = 1 + (bits - 1) / 8; + mp_size_t rn = (bits - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS; + mp_size_t i; + + mpn_set_base256_le (rp, 2*rn, digest, 2*nbytes); + + /* Special case for Ed448: reduce rp to 2*m->size limbs. + After decoding rp from a hash of size 2*rn: + + rp = XX || r0 || r1 + + where r0 and r1 have m->size limbs. Reduce this to: + + rp = r0' || r1 + + where r0' has m->size limbs. */ + for (i = 0; i < 2*(rn - m->size); i++) + { + mp_limb_t hi; + hi = mpn_addmul_1 (rp + m->size + i, m->B, m->B_size, + rp[2*m->size + i]); + assert (hi <= 1); + hi = cnd_add_n (hi, rp + m->size + i, m->B, m->size); + /* Sufficient roughly if b < B^size / p */ + assert (hi == 0); + } + m->mod (m, rp); +} diff --git a/eddsa-pubkey.c b/eddsa-pubkey.c index d1546707..55ca3a83 100644 --- a/eddsa-pubkey.c +++ b/eddsa-pubkey.c @@ -40,7 +40,7 @@ mp_size_t _eddsa_public_key_itch (const struct ecc_curve *ecc) { - return 3*ecc->p.size + ecc->mul_g_itch; + return 3*ecc->p.size + ECC_MAX(ecc->mul_g_itch, _eddsa_compress_itch (ecc)); }
void diff --git a/eddsa-sign.c b/eddsa-sign.c index e5dc0e9d..23cca06e 100644 --- a/eddsa-sign.c +++ b/eddsa-sign.c @@ -44,7 +44,7 @@ mp_size_t _eddsa_sign_itch (const struct ecc_curve *ecc) { - return 5*ecc->p.size + ecc->mul_g_itch; + return 7*ecc->p.size + ECC_MAX(ecc->mul_g_itch, _eddsa_compress_itch (ecc)); }
void @@ -67,22 +67,24 @@ _eddsa_sign (const struct ecc_curve *ecc, #define hash ((uint8_t *) (scratch + 3*size)) #define scratch_out (scratch + 5*size)
- size = ecc->p.size; - nbytes = 1 + ecc->p.bit_size / 8; + assert (ecc->eddsa);
- assert (H->digest_size >= 2 * nbytes); + size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS; + nbytes = 1 + (ecc->eddsa->b - 1) / 8;
H->update (ctx, length, msg); H->digest (ctx, 2*nbytes, hash); - _eddsa_hash (&ecc->q, rp, hash); + _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, rp, hash); + ecc->mul_g (ecc, P, rp, scratch_out); _eddsa_compress (ecc, signature, P, scratch_out);
+ ecc->eddsa->dom (0, 0, "", H, ctx); H->update (ctx, nbytes, signature); H->update (ctx, nbytes, pub); H->update (ctx, length, msg); H->digest (ctx, 2*nbytes, hash); - _eddsa_hash (&ecc->q, hp, hash); + _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, hp, hash);
ecc_modq_mul (ecc, sp, hp, k2); ecc_modq_add (ecc, sp, sp, rp); /* FIXME: Can be plain add */ @@ -91,7 +93,7 @@ _eddsa_sign (const struct ecc_curve *ecc, { unsigned shift; mp_limb_t cy; - assert (ecc->p.bit_size == 255); + assert (ecc->p.bit_size == 255 || ecc->p.bit_size == 448); shift = ecc->q.bit_size - 1 - GMP_NUMB_BITS * (ecc->p.size - 1); cy = mpn_submul_1 (sp, ecc->q.m, ecc->p.size, sp[ecc->p.size-1] >> shift); diff --git a/eddsa-verify.c b/eddsa-verify.c index 5541d975..3add4325 100644 --- a/eddsa-verify.c +++ b/eddsa-verify.c @@ -69,7 +69,7 @@ equal_h (const struct ecc_modulo *p, mp_size_t _eddsa_verify_itch (const struct ecc_curve *ecc) { - return 8*ecc->p.size + ecc->mul_itch; + return 8*ecc->p.size + ECC_MAX(ecc->mul_itch, _eddsa_decompress_itch (ecc)); }
int @@ -83,6 +83,7 @@ _eddsa_verify (const struct ecc_curve *ecc, const uint8_t *signature, mp_limb_t *scratch) { + mp_size_t size; size_t nbytes; #define R scratch #define sp (scratch + 2*ecc->p.size) @@ -92,28 +93,33 @@ _eddsa_verify (const struct ecc_curve *ecc, #define S R #define hash ((uint8_t *) P)
- nbytes = 1 + ecc->p.bit_size / 8; + assert (ecc->eddsa); + + size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS; + nbytes = 1 + (ecc->eddsa->b - 1) / 8;
/* Could maybe save some storage by delaying the R and S operations, but it makes sense to check them for validity up front. */ if (!_eddsa_decompress (ecc, R, signature, R+2*ecc->p.size)) return 0;
- mpn_set_base256_le (sp, ecc->q.size, signature + nbytes, nbytes); + mpn_set_base256_le (sp, size, signature + nbytes, nbytes); + /* Check that s < q */ if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0) return 0;
H->init (ctx); + ecc->eddsa->dom (0, 0, "", H, ctx); H->update (ctx, nbytes, signature); H->update (ctx, nbytes, pub); H->update (ctx, length, msg); H->digest (ctx, 2*nbytes, hash); - _eddsa_hash (&ecc->q, hp, hash); + _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, hp, hash);
/* Compute h A + R - s G, which should be the neutral point */ ecc->mul (ecc, P, hp, A, scratch_out); - ecc_add_eh (ecc, P, P, R, scratch_out); + ecc->add_hh (ecc, P, P, R, scratch_out); /* Move out of the way. */ mpn_copyi (hp, sp, ecc->q.size); ecc->mul_g (ecc, S, hp, scratch_out); diff --git a/eddsa.h b/eddsa.h index 49f1a025..542532dc 100644 --- a/eddsa.h +++ b/eddsa.h @@ -45,12 +45,16 @@ extern "C" { #define ed25519_sha512_public_key nettle_ed25519_sha512_public_key #define ed25519_sha512_sign nettle_ed25519_sha512_sign #define ed25519_sha512_verify nettle_ed25519_sha512_verify +#define ed448_shake256_public_key nettle_ed448_shake256_public_key +#define ed448_shake256_sign nettle_ed448_shake256_sign +#define ed448_shake256_verify nettle_ed448_shake256_verify
#define _eddsa_compress _nettle_eddsa_compress #define _eddsa_compress_itch _nettle_eddsa_compress_itch #define _eddsa_decompress _nettle_eddsa_decompress #define _eddsa_decompress_itch _nettle_eddsa_decompress_itch #define _eddsa_hash _nettle_eddsa_hash +#define _eddsa_sized_hash _nettle_eddsa_sized_hash #define _eddsa_expand_key _nettle_eddsa_expand_key #define _eddsa_sign _nettle_eddsa_sign #define _eddsa_sign_itch _nettle_eddsa_sign_itch @@ -61,6 +65,8 @@ extern "C" {
#define ED25519_KEY_SIZE 32 #define ED25519_SIGNATURE_SIZE 64 +#define ED448_KEY_SIZE 57 +#define ED448_SIGNATURE_SIZE 114
void ed25519_sha512_public_key (uint8_t *pub, const uint8_t *priv); @@ -76,6 +82,20 @@ ed25519_sha512_verify (const uint8_t *pub, size_t length, const uint8_t *msg, const uint8_t *signature);
+void +ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv); + +void +ed448_shake256_sign (const uint8_t *pub, + const uint8_t *priv, + size_t length, const uint8_t *msg, + uint8_t *signature); + +int +ed448_shake256_verify (const uint8_t *pub, + size_t length, const uint8_t *msg, + const uint8_t *signature); + /* Low-level internal functions */
struct ecc_curve; @@ -98,6 +118,10 @@ void _eddsa_hash (const struct ecc_modulo *m, mp_limb_t *rp, const uint8_t *digest);
+void +_eddsa_sized_hash (const struct ecc_modulo *m, + mp_size_t bits, mp_limb_t *rp, const uint8_t *digest); + mp_size_t _eddsa_sign_itch (const struct ecc_curve *ecc);
diff --git a/nettle.texinfo b/nettle.texinfo index 20adc0e6..e32d348a 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -4585,6 +4585,31 @@ Verifies a message using the provided public key. Returns 1 if the signature is valid, otherwise 0. @end deftypefun
+Nettle also provides Ed448, an EdDSA signature scheme based on an +Edwards curve equivalent to curve448. + +@defvr Constant ED448_KEY_SIZE +The size of a private or public Ed448 key, 57 octets. +@end defvr + +@defvr Constant ED448_SIGNATURE_SIZE +The size of an Ed448 signature, 114 octets. +@end defvr + +@deftypefun void ed448_shake256_public_key (uint8_t *@var{pub}, const uint8_t *@var{priv}) +Computes the public key corresponding to the given private key. Both +input and output are of size @code{ED448_KEY_SIZE}. +@end deftypefun + +@deftypefun void ed448_shake256_sign (const uint8_t *@var{pub}, const uint8_t *@var{priv}, size_t @var{length}, const uint8_t *@var{msg}, uint8_t *@var{signature}) +Signs a message using the provided key pair. +@end deftypefun + +@deftypefun int ed448_shake256_verify (const uint8_t *@var{pub}, size_t @var{length}, const uint8_t *@var{msg}, const uint8_t *@var{signature}) +Verifies a message using the provided public key. Returns 1 if the +signature is valid, otherwise 0. +@end deftypefun + @node Randomness, ASCII encoding, Public-key algorithms, Reference @comment node-name, next, previous, up @section Randomness diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make index 5b48dadc..d96c4712 100644 --- a/testsuite/.test-rules.make +++ b/testsuite/.test-rules.make @@ -265,6 +265,9 @@ eddsa-verify-test$(EXEEXT): eddsa-verify-test.$(OBJEXT) ed25519-test$(EXEEXT): ed25519-test.$(OBJEXT) $(LINK) ed25519-test.$(OBJEXT) $(TEST_OBJS) -o ed25519-test$(EXEEXT)
+ed448-test$(EXEEXT): ed448-test.$(OBJEXT) + $(LINK) ed448-test.$(OBJEXT) $(TEST_OBJS) -o ed448-test$(EXEEXT) + sha1-huge-test$(EXEEXT): sha1-huge-test.$(OBJEXT) $(LINK) sha1-huge-test.$(OBJEXT) $(TEST_OBJS) -o sha1-huge-test$(EXEEXT)
diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in index cbcc3fd3..e0d141e0 100644 --- a/testsuite/Makefile.in +++ b/testsuite/Makefile.in @@ -48,7 +48,7 @@ TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \ ecdsa-sign-test.c ecdsa-verify-test.c \ ecdsa-keygen-test.c ecdh-test.c \ eddsa-compress-test.c eddsa-sign-test.c \ - eddsa-verify-test.c ed25519-test.c + eddsa-verify-test.c ed25519-test.c ed448-test.c
TS_SOURCES = $(TS_NETTLE_SOURCES) $(TS_HOGWEED_SOURCES) CXX_SOURCES = cxx-test.cxx diff --git a/testsuite/ed448-test.c b/testsuite/ed448-test.c new file mode 100644 index 00000000..56dc6277 --- /dev/null +++ b/testsuite/ed448-test.c @@ -0,0 +1,240 @@ +/* ed448-test.c + + Copyright (C) 2017 Daiki Ueno + Copyright (C) 2017 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#include "testutils.h" + +#include <errno.h> + +#include "eddsa.h" + +#include "base16.h" + +static void +decode_hex (size_t length, uint8_t *dst, const char *src) +{ + struct base16_decode_ctx ctx; + size_t out_size; + base16_decode_init (&ctx); + ASSERT (base16_decode_update (&ctx, &out_size, dst, 2*length, src)); + ASSERT (out_size == length); + ASSERT (base16_decode_final (&ctx)); +} + +/* Processes a single line in the format of + http://ed25519.cr.yp.to/python/sign.input: + + sk pk : pk : m : s m : + + where sk (secret key) and pk (public key) are 57 bytes each, m is + variable size, and s is 114 bytes. All values hex encoded. +*/ +static void +test_one (const char *line) +{ + const char *p; + const char *mp; + uint8_t sk[ED448_KEY_SIZE]; + uint8_t pk[ED448_KEY_SIZE]; + uint8_t t[ED448_KEY_SIZE]; + uint8_t s[ED448_SIGNATURE_SIZE]; + uint8_t *msg; + size_t msg_size; + uint8_t s2[ED448_SIGNATURE_SIZE]; + + decode_hex (ED448_KEY_SIZE, sk, line); + + p = strchr (line, ':'); + ASSERT (p == line + 228); + p++; + decode_hex (ED448_KEY_SIZE, pk, p); + p = strchr (p, ':'); + ASSERT (p == line + 343); + mp = ++p; + p = strchr (p, ':'); + ASSERT (p); + ASSERT ((p - mp) % 2 == 0); + msg_size = (p - mp) / 2; + + decode_hex (ED448_SIGNATURE_SIZE, s, p+1); + + msg = xalloc (msg_size + 1); + msg[msg_size] = 'x'; + + decode_hex (msg_size, msg, mp); + + ed448_shake256_public_key (t, sk); + ASSERT (MEMEQ(ED448_KEY_SIZE, t, pk)); + + ed448_shake256_sign (pk, sk, msg_size, msg, s2); + ASSERT (MEMEQ (ED448_SIGNATURE_SIZE, s, s2)); + + ASSERT (ed448_shake256_verify (pk, msg_size, msg, s)); + + s2[ED448_SIGNATURE_SIZE/3] ^= 0x40; + ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2)); + + memcpy (s2, s, ED448_SIGNATURE_SIZE); + s2[2*ED448_SIGNATURE_SIZE/3] ^= 0x40; + ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2)); + + ASSERT (!ed448_shake256_verify (pk, msg_size + 1, msg, s)); + + if (msg_size > 0) + { + msg[msg_size-1] ^= 0x20; + ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s)); + } + free (msg); +} + +#ifndef HAVE_GETLINE +static ssize_t +getline(char **lineptr, size_t *n, FILE *f) +{ + size_t i; + int c; + if (!*lineptr) + { + *n = 500; + *lineptr = xalloc (*n); + } + + i = 0; + do + { + c = getc(f); + if (c < 0) + { + if (i > 0) + break; + return -1; + } + + (*lineptr) [i++] = c; + if (i == *n) + { + *n *= 2; + *lineptr = realloc (*lineptr, *n); + if (!*lineptr) + die ("Virtual memory exhausted.\n"); + } + } while (c != '\n'); + + (*lineptr) [i] = 0; + return i; +} +#endif + +void +test_main(void) +{ + const char *input = getenv ("ED448_SIGN_INPUT"); + if (input) + { + size_t buf_size; + char *buf; + FILE *f = fopen (input, "r"); + if (!f) + die ("Opening input file '%s' failed: %s\n", + input, strerror (errno)); + + for (buf = NULL; getline (&buf, &buf_size, f) >= 0; ) + test_one (buf); + + free (buf); + fclose (f); + } + else + { + /* Test vectors from RFC 8032. */ + /* Blank */ + test_one ("6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b" + "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:" + "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:" + ":" + "533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600" + ":"); + /* 1 octet */ + test_one ("c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e" + "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:" + "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:" + "03:" + "26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00" + "03:"); + /* 11 octets */ + test_one ("cd23d24f714274e744343237b93290f511f6425f98e64459ff203e8985083ffdf60500553abc0e05cd02184bdb89c4ccd67e187951267eb328" + "dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:" + "dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:" + "0c3e544074ec63b0265e0c:" + "1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00" + "0c3e544074ec63b0265e0c:"); + /* 12 octets */ + test_one ("258cdd4ada32ed9c9ff54e63756ae582fb8fab2ac721f2c8e676a72768513d939f63dddb55609133f29adf86ec9929dccb52c1c5fd2ff7e21b" + "3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:" + "3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:" + "64a65f3cdedcdd66811e2915:" + "7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00" + "64a65f3cdedcdd66811e2915:"); + /* 13 octets */ + test_one ("7ef4e84544236752fbb56b8f31a23a10e42814f5f55ca037cdcc11c64c9a3b2949c1bb60700314611732a6c2fea98eebc0266a11a93970100e" + "b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:" + "b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:" + "64a65f3cdedcdd66811e2915e7:" + "6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100" + "64a65f3cdedcdd66811e2915e7:"); + /* 64 octets */ + test_one ("d65df341ad13e008567688baedda8e9dcdc17dc024974ea5b4227b6530e339bff21f99e68ca6968f3cca6dfe0fb9f4fab4fa135d5542ea3f01" + "df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:" + "df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:" + "bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:" + "554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900" + "bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:"); + /* 256 octets */ + test_one ("2ec5fe3c17045abdb136a5e6a913e32ab75ae68b53d2fc149b77e504132d37569b7e766ba74a19bd6162343a21c8590aa9cebca9014c636df5" + "79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:" + "79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:" + "15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:" + "c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00" + "15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:"); + /* 1023 octets */ + test_one ("872d093780f5d3730df7c212664b37b8a0f24f56810daa8382cd4fa3f77634ec44dc54f1c2ed9bea86fafb7632d8be199ea165f5ad55dd9ce8" + "a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:" + "a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:" + "6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263" + "06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c" + "af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:" + "e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00" + "6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263" + "06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c" + "af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:"); + } +} diff --git a/testsuite/eddsa-compress-test.c b/testsuite/eddsa-compress-test.c index 9ceb6fe9..834be212 100644 --- a/testsuite/eddsa-compress-test.c +++ b/testsuite/eddsa-compress-test.c @@ -37,76 +37,87 @@
void test_main (void) { - const struct ecc_curve *ecc = &_nettle_curve25519; gmp_randstate_t rands; - mp_size_t size, itch; - mpz_t zp, t; - mp_limb_t *s; - mp_limb_t *p; - mp_limb_t *pa1; - mp_limb_t *pa2; - mp_limb_t *scratch; - size_t clen; - uint8_t *c; - unsigned j; + unsigned i, j;
gmp_randinit_default (rands);
- size = ecc_size (ecc); - clen = 1 + ecc->p.bit_size / 8; - - mpz_roinit_n (zp, ecc->p.m, size); - - mpz_init (t); - s = xalloc_limbs (size); - p = xalloc_limbs (ecc_size_j (ecc)); - pa1 = xalloc_limbs (ecc_size_a (ecc)); - pa2 = xalloc_limbs (ecc_size_a (ecc)); - c = xalloc (clen); - - itch = _eddsa_decompress_itch (ecc); - if (itch < ecc->mul_g_itch) - itch = ecc->mul_g_itch; - - scratch = xalloc_limbs (itch); - - for (j = 0; j < COUNT; j++) + for (i = 0; ecc_curves[i]; i++) { - mpz_t x1, y1, x2, y2; - - mpz_urandomb (t, rands, ecc->q.bit_size); - mpz_limbs_copy (s, t, ecc->q.size); - ecc->mul_g (ecc, p, s, scratch); - _eddsa_compress (ecc, c, p, scratch); - ecc->h_to_a (ecc, 0, pa1, p, scratch); - _eddsa_decompress (ecc, pa2, c, scratch); - mpz_roinit_n (x1, pa1, size); - mpz_roinit_n (y1, pa1 + size, size); - mpz_roinit_n (x2, pa2, size); - mpz_roinit_n (y2, pa2 + size, size); - if (!(mpz_congruent_p (x1, x2, zp) - && mpz_congruent_p (y1, y2, zp))) + const struct ecc_curve *ecc = ecc_curves[i]; + mp_size_t size, itch; + mpz_t zp, t; + mp_limb_t *s; + mp_limb_t *p; + mp_limb_t *pa1; + mp_limb_t *pa2; + mp_limb_t *scratch; + size_t clen; + uint8_t *c; + + if (!(ecc->p.bit_size == 255 || ecc->p.bit_size == 448)) + continue; + + if (!ecc->eddsa) + abort (); + + size = ecc_size (ecc); + clen = 1 + (ecc->eddsa->b - 1) / 8; + + mpz_roinit_n (zp, ecc->p.m, size); + + mpz_init (t); + s = xalloc_limbs (size); + p = xalloc_limbs (ecc_size_j (ecc)); + pa1 = xalloc_limbs (ecc_size_a (ecc)); + pa2 = xalloc_limbs (ecc_size_a (ecc)); + c = xalloc (clen); + + itch = _eddsa_decompress_itch (ecc); + if (itch < ecc->mul_g_itch) + itch = ecc->mul_g_itch; + + scratch = xalloc_limbs (itch); + + for (j = 0; j < COUNT; j++) { - fprintf (stderr, "eddsa compression failed:\nc = "); - print_hex (clen, c); - fprintf (stderr, "\np1 = 0x"); - mpz_out_str (stderr, 16, x1); - fprintf (stderr, ",\n 0x"); - mpz_out_str (stderr, 16, y1); - fprintf (stderr, "\np2 = 0x"); - mpz_out_str (stderr, 16, x2); - fprintf (stderr, ",\n 0x"); - mpz_out_str (stderr, 16, y2); - fprintf (stderr, "\n"); - abort (); + mpz_t x1, y1, x2, y2; + + mpz_urandomb (t, rands, ecc->q.bit_size); + mpz_limbs_copy (s, t, ecc->q.size); + ecc->mul_g (ecc, p, s, scratch); + _eddsa_compress (ecc, c, p, scratch); + ecc->h_to_a (ecc, 0, pa1, p, scratch); + _eddsa_decompress (ecc, pa2, c, scratch); + mpz_roinit_n (x1, pa1, size); + mpz_roinit_n (y1, pa1 + size, size); + mpz_roinit_n (x2, pa2, size); + mpz_roinit_n (y2, pa2 + size, size); + if (!(mpz_congruent_p (x1, x2, zp) + && mpz_congruent_p (y1, y2, zp))) + { + fprintf (stderr, "eddsa compression failed:\nc = "); + print_hex (clen, c); + fprintf (stderr, "\np1 = 0x"); + mpz_out_str (stderr, 16, x1); + fprintf (stderr, ",\n 0x"); + mpz_out_str (stderr, 16, y1); + fprintf (stderr, "\np2 = 0x"); + mpz_out_str (stderr, 16, x2); + fprintf (stderr, ",\n 0x"); + mpz_out_str (stderr, 16, y2); + fprintf (stderr, "\n"); + abort (); + } } + mpz_clear (t); + free (s); + free (p); + free (c); + free (pa1); + free (pa2); + free (scratch); } - mpz_clear (t); - free (s); - free (p); - free (c); - free (pa1); - free (pa2); - free (scratch); + gmp_randclear (rands); } diff --git a/testsuite/eddsa-sign-test.c b/testsuite/eddsa-sign-test.c index c496e6eb..b4471d16 100644 --- a/testsuite/eddsa-sign-test.c +++ b/testsuite/eddsa-sign-test.c @@ -42,13 +42,14 @@ test_eddsa_sign (const struct ecc_curve *ecc, const struct tstring *ref) { mp_limb_t *scratch = xalloc_limbs (_eddsa_sign_itch (ecc)); - size_t nbytes = 1 + ecc->p.bit_size / 8; + mp_size_t size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / 8; + size_t nbytes = 1 + (ecc->eddsa->b - 1) / 8; uint8_t *signature = xalloc (2*nbytes); void *ctx = xalloc (H->context_size); uint8_t *public_out = xalloc (nbytes); uint8_t *digest = xalloc (2*nbytes); const uint8_t *k1 = digest + nbytes; - mp_limb_t *k2 = xalloc_limbs (ecc->p.size); + mp_limb_t *k2 = xalloc_limbs (size);
ASSERT (public->length == nbytes); ASSERT (private->length == nbytes); @@ -68,6 +69,8 @@ test_eddsa_sign (const struct ecc_curve *ecc, fprintf (stderr, "\n"); abort (); } + + ecc->eddsa->dom (0, 0, "", H, ctx); H->update (ctx, nbytes, k1);
_eddsa_sign (ecc, H, public->data, ctx, k2, @@ -140,4 +143,63 @@ void test_main (void) "99df1340cce54626 183144ef46887163" "4b0a5c0033534108 e1c67c0dc99d3014" "f01084e98c95e101 4b309b1dbb2e6704")); + + /* Based on a few of the test vectors from RFC 8032 */ + test_eddsa_sign (&_nettle_curve448, &nettle_shake256, + SHEX("5fd7449b59b461fd 2ce787ec616ad46a" + "1da1342485a70e1f 8a0ea75d80e96778" + "edf124769b46c706 1bd6783df1e50f6c" + "d1fa1abeafe82561 80"), + SHEX("6c82a562cb808d10 d632be89c8513ebf" + "6c929f34ddfa8c9f 63c9960ef6e348a3" + "528c8a3fcc2f044e 39a3fc5b94492f8f" + "032e7549a20098f9 5b"), + SHEX(""), + SHEX("533a37f6bbe45725 1f023c0d88f976ae" + "2dfb504a843e34d2 074fd823d41a591f" + "2b233f034f628281 f2fd7a22ddd47d78" + "28c59bd0a21bfd39 80ff0d2028d4b18a" + "9df63e006c5d1c2d 345b925d8dc00b41" + "04852db99ac5c7cd da8530a113a0f4db" + "b61149f05a736326 8c71d95808ff2e65" + "2600")); + test_eddsa_sign (&_nettle_curve448, &nettle_shake256, + SHEX("43ba28f430cdff45 6ae531545f7ecd0a" + "c834a55d9358c037 2bfa0c6c6798c086" + "6aea01eb00742802 b8438ea4cb82169c" + "235160627b4c3a94 80"), + SHEX("c4eab05d357007c6 32f3dbb48489924d" + "552b08fe0c353a0d 4a1f00acda2c463a" + "fbea67c5e8d2877c 5e3bc397a659949e" + "f8021e954e0a1227 4e"), + SHEX("03"), + SHEX("26b8f91727bd6289 7af15e41eb43c377" + "efb9c610d48f2335 cb0bd0087810f435" + "2541b143c4b981b7 e18f62de8ccdf633" + "fc1bf037ab7cd779 805e0dbcc0aae1cb" + "cee1afb2e027df36 bc04dcecbf154336" + "c19f0af7e0a64729 05e799f1953d2a0f" + "f3348ab21aa4adaf d1d234441cf807c0" + "3a00")); + test_eddsa_sign (&_nettle_curve448, &nettle_shake256, + SHEX("df9705f58edbab80 2c7f8363cfe5560a" + "b1c6132c20a9f1dd 163483a26f8ac53a" + "39d6808bf4a1dfbd 261b099bb03b3fb5" + "0906cb28bd8a081f 00"), + SHEX("d65df341ad13e008 567688baedda8e9d" + "cdc17dc024974ea5 b4227b6530e339bf" + "f21f99e68ca6968f 3cca6dfe0fb9f4fa" + "b4fa135d5542ea3f 01"), + SHEX("bd0f6a3747cd561b dddf4640a332461a" + "4a30a12a434cd0bf 40d766d9c6d458e5" + "512204a30c17d1f5 0b5079631f64eb31" + "12182da300583546 1113718d1a5ef944"), + SHEX("554bc2480860b49e ab8532d2a533b7d5" + "78ef473eeb58c98b b2d0e1ce488a98b1" + "8dfde9b9b90775e6 7f47d4a1c3482058" + "efc9f40d2ca033a0 801b63d45b3b722e" + "f552bad3b4ccb667 da350192b61c508c" + "f7b6b5adadc2c8d9 a446ef003fb05cba" + "5f30e88e36ec2703 b349ca229c267083" + "3900")); } diff --git a/testsuite/eddsa-verify-test.c b/testsuite/eddsa-verify-test.c index dd6712ab..bab91509 100644 --- a/testsuite/eddsa-verify-test.c +++ b/testsuite/eddsa-verify-test.c @@ -42,7 +42,7 @@ test_eddsa (const struct ecc_curve *ecc, { mp_limb_t *A = xalloc_limbs (ecc_size_a (ecc)); mp_limb_t *scratch = xalloc_limbs (_eddsa_verify_itch (ecc)); - size_t nbytes = 1 + ecc->p.bit_size / 8; + size_t nbytes = 1 + (ecc->eddsa->b - 1) / 8; uint8_t *cmsg = xalloc (msg->length); uint8_t *csignature = xalloc (2*nbytes); void *ctx = xalloc (H->context_size); @@ -157,4 +157,51 @@ test_main (void) "99df1340cce54626 183144ef46887163" "4b0a5c0033534108 e1c67c0dc99d3014" "f01084e98c95e101 4b309b1dbb2e6704")); + + /* Based on a few of the test vectors from RFC 8032 */ + test_eddsa (&_nettle_curve448, &nettle_shake256, + H("5fd7449b59b461fd 2ce787ec616ad46a" + "1da1342485a70e1f 8a0ea75d80e96778" + "edf124769b46c706 1bd6783df1e50f6c" + "d1fa1abeafe82561 80"), + SHEX(""), + H("533a37f6bbe45725 1f023c0d88f976ae" + "2dfb504a843e34d2 074fd823d41a591f" + "2b233f034f628281 f2fd7a22ddd47d78" + "28c59bd0a21bfd39 80ff0d2028d4b18a" + "9df63e006c5d1c2d 345b925d8dc00b41" + "04852db99ac5c7cd da8530a113a0f4db" + "b61149f05a736326 8c71d95808ff2e65" + "2600")); + test_eddsa (&_nettle_curve448, &nettle_shake256, + H("43ba28f430cdff45 6ae531545f7ecd0a" + "c834a55d9358c037 2bfa0c6c6798c086" + "6aea01eb00742802 b8438ea4cb82169c" + "235160627b4c3a94 80"), + SHEX("03"), + H("26b8f91727bd6289 7af15e41eb43c377" + "efb9c610d48f2335 cb0bd0087810f435" + "2541b143c4b981b7 e18f62de8ccdf633" + "fc1bf037ab7cd779 805e0dbcc0aae1cb" + "cee1afb2e027df36 bc04dcecbf154336" + "c19f0af7e0a64729 05e799f1953d2a0f" + "f3348ab21aa4adaf d1d234441cf807c0" + "3a00")); + test_eddsa (&_nettle_curve448, &nettle_shake256, + H("df9705f58edbab80 2c7f8363cfe5560a" + "b1c6132c20a9f1dd 163483a26f8ac53a" + "39d6808bf4a1dfbd 261b099bb03b3fb5" + "0906cb28bd8a081f 00"), + SHEX("bd0f6a3747cd561b dddf4640a332461a" + "4a30a12a434cd0bf 40d766d9c6d458e5" + "512204a30c17d1f5 0b5079631f64eb31" + "12182da300583546 1113718d1a5ef944"), + H("554bc2480860b49e ab8532d2a533b7d5" + "78ef473eeb58c98b b2d0e1ce488a98b1" + "8dfde9b9b90775e6 7f47d4a1c3482058" + "efc9f40d2ca033a0 801b63d45b3b722e" + "f552bad3b4ccb667 da350192b61c508c" + "f7b6b5adadc2c8d9 a446ef003fb05cba" + "5f30e88e36ec2703 b349ca229c267083" + "3900")); }