ed25519.c 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145
  1. /* $OpenBSD: ed25519.c,v 1.3 2013/12/09 11:03:45 markus Exp $ */
  2. /*
  3. * Public Domain, Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange,
  4. * Peter Schwabe, Bo-Yin Yang.
  5. * Copied from supercop-20130419/crypto_sign/ed25519/ref/ed25519.c
  6. */
  7. #include "includes.h"
  8. #include "crypto_api.h"
  9. #include "ge25519.h"
  10. static void get_hram(unsigned char *hram, const unsigned char *sm, const unsigned char *pk, unsigned char *playground, unsigned long long smlen)
  11. {
  12. unsigned long long i;
  13. for (i = 0;i < 32;++i) playground[i] = sm[i];
  14. for (i = 32;i < 64;++i) playground[i] = pk[i-32];
  15. for (i = 64;i < smlen;++i) playground[i] = sm[i];
  16. crypto_hash_sha512(hram,playground,smlen);
  17. }
  18. int crypto_sign_ed25519_keypair(
  19. unsigned char *pk,
  20. unsigned char *sk
  21. )
  22. {
  23. sc25519 scsk;
  24. ge25519 gepk;
  25. unsigned char extsk[64];
  26. int i;
  27. randombytes(sk, 32);
  28. crypto_hash_sha512(extsk, sk, 32);
  29. extsk[0] &= 248;
  30. extsk[31] &= 127;
  31. extsk[31] |= 64;
  32. sc25519_from32bytes(&scsk,extsk);
  33. ge25519_scalarmult_base(&gepk, &scsk);
  34. ge25519_pack(pk, &gepk);
  35. for(i=0;i<32;i++)
  36. sk[32 + i] = pk[i];
  37. return 0;
  38. }
  39. int crypto_sign_ed25519(
  40. unsigned char *sm,unsigned long long *smlen,
  41. const unsigned char *m,unsigned long long mlen,
  42. const unsigned char *sk
  43. )
  44. {
  45. sc25519 sck, scs, scsk;
  46. ge25519 ger;
  47. unsigned char r[32];
  48. unsigned char s[32];
  49. unsigned char extsk[64];
  50. unsigned long long i;
  51. unsigned char hmg[crypto_hash_sha512_BYTES];
  52. unsigned char hram[crypto_hash_sha512_BYTES];
  53. crypto_hash_sha512(extsk, sk, 32);
  54. extsk[0] &= 248;
  55. extsk[31] &= 127;
  56. extsk[31] |= 64;
  57. *smlen = mlen+64;
  58. for(i=0;i<mlen;i++)
  59. sm[64 + i] = m[i];
  60. for(i=0;i<32;i++)
  61. sm[32 + i] = extsk[32+i];
  62. crypto_hash_sha512(hmg, sm+32, mlen+32); /* Generate k as h(extsk[32],...,extsk[63],m) */
  63. /* Computation of R */
  64. sc25519_from64bytes(&sck, hmg);
  65. ge25519_scalarmult_base(&ger, &sck);
  66. ge25519_pack(r, &ger);
  67. /* Computation of s */
  68. for(i=0;i<32;i++)
  69. sm[i] = r[i];
  70. get_hram(hram, sm, sk+32, sm, mlen+64);
  71. sc25519_from64bytes(&scs, hram);
  72. sc25519_from32bytes(&scsk, extsk);
  73. sc25519_mul(&scs, &scs, &scsk);
  74. sc25519_add(&scs, &scs, &sck);
  75. sc25519_to32bytes(s,&scs); /* cat s */
  76. for(i=0;i<32;i++)
  77. sm[32 + i] = s[i];
  78. return 0;
  79. }
  80. int crypto_sign_ed25519_open(
  81. unsigned char *m,unsigned long long *mlen,
  82. const unsigned char *sm,unsigned long long smlen,
  83. const unsigned char *pk
  84. )
  85. {
  86. unsigned int i;
  87. int ret;
  88. unsigned char t2[32];
  89. ge25519 get1, get2;
  90. sc25519 schram, scs;
  91. unsigned char hram[crypto_hash_sha512_BYTES];
  92. *mlen = (unsigned long long) -1;
  93. if (smlen < 64) return -1;
  94. if (ge25519_unpackneg_vartime(&get1, pk)) return -1;
  95. get_hram(hram,sm,pk,m,smlen);
  96. sc25519_from64bytes(&schram, hram);
  97. sc25519_from32bytes(&scs, sm+32);
  98. ge25519_double_scalarmult_vartime(&get2, &get1, &schram, &ge25519_base, &scs);
  99. ge25519_pack(t2, &get2);
  100. ret = crypto_verify_32(sm, t2);
  101. if (!ret)
  102. {
  103. for(i=0;i<smlen-64;i++)
  104. m[i] = sm[i + 64];
  105. *mlen = smlen-64;
  106. }
  107. else
  108. {
  109. for(i=0;i<smlen-64;i++)
  110. m[i] = 0;
  111. }
  112. return ret;
  113. }