From: Daiki Ueno <[email protected]>
Signed-off-by: Daiki Ueno <[email protected]>
---
Makefile.in | 4 +-
ecc-192.c | 1 +
ecc-224.c | 1 +
ecc-25519.c | 1 +
ecc-256.c | 1 +
ecc-384.c | 1 +
ecc-448.c | 1 +
ecc-521.c | 1 +
ecc-internal.h | 18 +++
ed25519-sha512-sign.c | 15 +++
ed448-shake256-pubkey.c | 60 ++++++++++
ed448-shake256-sign.c | 92 +++++++++++++++
ed448-shake256-verify.c | 66 +++++++++++
eddsa-compress.c | 11 +-
eddsa-decompress.c | 17 ++-
eddsa-expand.c | 20 +++-
eddsa-hash.c | 35 ++++++
eddsa-pubkey.c | 2 +-
eddsa-sign.c | 16 +--
eddsa-verify.c | 16 ++-
eddsa.h | 24 ++++
nettle.texinfo | 25 +++++
testsuite/.test-rules.make | 3 +
testsuite/Makefile.in | 2 +-
testsuite/ed448-test.c | 240 ++++++++++++++++++++++++++++++++++++++++
testsuite/eddsa-compress-test.c | 137 ++++++++++++-----------
testsuite/eddsa-sign-test.c | 66 ++++++++++-
testsuite/eddsa-verify-test.c | 49 +++++++-
28 files changed, 833 insertions(+), 92 deletions(-)
create mode 100644 ed448-shake256-pubkey.c
create mode 100644 ed448-shake256-sign.c
create mode 100644 ed448-shake256-verify.c
create mode 100644 testsuite/ed448-test.c
diff --git a/Makefile.in b/Makefile.in
index 80c66ce8..10185bb8 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -185,7 +185,9 @@ hogweed_SOURCES = sexp.c sexp-format.c \
eddsa-compress.c eddsa-decompress.c eddsa-expand.c \
eddsa-hash.c eddsa-pubkey.c eddsa-sign.c eddsa-verify.c \
ed25519-sha512-pubkey.c \
- ed25519-sha512-sign.c ed25519-sha512-verify.c
+ ed25519-sha512-sign.c ed25519-sha512-verify.c \
+ ed448-shake256-pubkey.c \
+ ed448-shake256-sign.c ed448-shake256-verify.c
OPT_SOURCES = fat-x86_64.c fat-arm.c mini-gmp.c
diff --git a/ecc-192.c b/ecc-192.c
index 1fbbcded..319d1418 100644
--- a/ecc-192.c
+++ b/ecc-192.c
@@ -172,6 +172,7 @@ const struct ecc_curve nettle_secp_192r1 =
ecc_b,
ecc_g,
NULL,
+ NULL,
ecc_unit,
ecc_table
};
diff --git a/ecc-224.c b/ecc-224.c
index b1ff0578..f679c01a 100644
--- a/ecc-224.c
+++ b/ecc-224.c
@@ -124,6 +124,7 @@ const struct ecc_curve nettle_secp_224r1 =
ecc_b,
ecc_g,
NULL,
+ NULL,
ecc_unit,
ecc_table
};
diff --git a/ecc-25519.c b/ecc-25519.c
index 16073ecf..ac5638a6 100644
--- a/ecc-25519.c
+++ b/ecc-25519.c
@@ -352,6 +352,7 @@ const struct ecc_curve _nettle_curve25519 =
ecc_d, /* Use the Edwards curve constant. */
ecc_g,
ecc_edwards,
+ &_nettle_ed25519_sha512,
ecc_unit,
ecc_table
};
diff --git a/ecc-256.c b/ecc-256.c
index d0870657..e9268e76 100644
--- a/ecc-256.c
+++ b/ecc-256.c
@@ -301,6 +301,7 @@ const struct ecc_curve nettle_secp_256r1 =
ecc_b,
ecc_g,
NULL,
+ NULL,
ecc_unit,
ecc_table
};
diff --git a/ecc-384.c b/ecc-384.c
index 006c4568..4aa7f96e 100644
--- a/ecc-384.c
+++ b/ecc-384.c
@@ -209,6 +209,7 @@ const struct ecc_curve nettle_secp_384r1 =
ecc_b,
ecc_g,
NULL,
+ NULL,
ecc_unit,
ecc_table
};
diff --git a/ecc-448.c b/ecc-448.c
index a70ff7cc..f98616d8 100644
--- a/ecc-448.c
+++ b/ecc-448.c
@@ -267,6 +267,7 @@ const struct ecc_curve _nettle_curve448 =
ecc_b,
ecc_g,
NULL,
+ &_nettle_ed448_shake256,
ecc_unit,
ecc_table
};
diff --git a/ecc-521.c b/ecc-521.c
index 9d32b54e..396f66e0 100644
--- a/ecc-521.c
+++ b/ecc-521.c
@@ -137,6 +137,7 @@ const struct ecc_curve nettle_secp_521r1 =
ecc_b,
ecc_g,
NULL,
+ NULL,
ecc_unit,
ecc_table
};
diff --git a/ecc-internal.h b/ecc-internal.h
index b58093ee..1ddec986 100644
--- a/ecc-internal.h
+++ b/ecc-internal.h
@@ -84,6 +84,9 @@
extern const struct ecc_curve _nettle_curve25519;
extern const struct ecc_curve _nettle_curve448;
+extern const struct ecc_eddsa _nettle_ed25519_sha512;
+extern const struct ecc_eddsa _nettle_ed448_shake256;
+
#define ECC_MAX_SIZE ((521 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
/* Window size for ecc_mul_a. Using 4 bits seems like a good choice,
@@ -200,6 +203,9 @@ struct ecc_curve
equivalent Edwards curve. */
const mp_limb_t *edwards_root;
+ /* EdDSA parameters; NULL if the curve is not usable in EdDSA. */
+ const struct ecc_eddsa *eddsa;
+
/* For redc, same as B mod p, otherwise 1. */
const mp_limb_t *unit;
@@ -216,6 +222,18 @@ struct ecc_curve
const mp_limb_t *pippenger_table;
};
+/* EdDSA parameters. */
+typedef void ecc_eddsa_dom_func (int phflag, size_t length, uint8_t *context,
+ const struct nettle_hash *hash,
+ void *ctx);
+
+struct ecc_eddsa
+{
+ unsigned short b;
+ unsigned short c;
+ ecc_eddsa_dom_func *dom;
+};
+
/* In-place reduction. */
ecc_mod_func ecc_mod;
ecc_mod_func ecc_pp1_redc;
diff --git a/ed25519-sha512-sign.c b/ed25519-sha512-sign.c
index af9de209..c26dc6b1 100644
--- a/ed25519-sha512-sign.c
+++ b/ed25519-sha512-sign.c
@@ -38,6 +38,21 @@
#include "ecc-internal.h"
#include "sha2.h"
+static void
+ed25519_sha512_dom (int phflag, size_t length, uint8_t *context,
+ const struct nettle_hash *hash,
+ void *ctx)
+{
+ /* No-op for PureEdDSA. */
+}
+
+const struct ecc_eddsa _nettle_ed25519_sha512 =
+{
+ 256,
+ 3,
+ ed25519_sha512_dom
+};
+
void
ed25519_sha512_sign (const uint8_t *pub,
const uint8_t *priv,
diff --git a/ed448-shake256-pubkey.c b/ed448-shake256-pubkey.c
new file mode 100644
index 00000000..7cfa54e9
--- /dev/null
+++ b/ed448-shake256-pubkey.c
@@ -0,0 +1,60 @@
+/* ed448-shake256-pubkey.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ struct shake256_ctx ctx;
+ uint8_t digest[ED448_SIGNATURE_SIZE];
+ mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+
+#define k scratch
+#define scratch_out (scratch + ecc->q.size)
+
+ _eddsa_expand_key (ecc, &nettle_shake256, &ctx, priv, digest, k);
+ _eddsa_public_key (ecc, k, pub, scratch_out);
+
+ gmp_free_limbs (scratch, itch);
+#undef k
+#undef scratch_out
+}
diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c
new file mode 100644
index 00000000..f52804f6
--- /dev/null
+++ b/ed448-shake256-sign.c
@@ -0,0 +1,92 @@
+/* ed448-shake256-sign.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "sha3.h"
+
+static void
+ed448_shake256_dom (int phflag, size_t length, uint8_t *context,
+ const struct nettle_hash *hash,
+ void *ctx)
+{
+ uint8_t buffer[2];
+ buffer[0] = phflag ? 1 : 0;
+ assert (length < 256);
+ buffer[1] = length;
+ hash->update (ctx, 8, "SigEd448");
+ hash->update (ctx, 2, buffer);
+ hash->update (ctx, length, context);
+}
+
+const struct ecc_eddsa _nettle_ed448_shake256 =
+{
+ 456,
+ 2,
+ ed448_shake256_dom
+};
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+ const uint8_t *priv,
+ size_t length, const uint8_t *msg,
+ uint8_t *signature)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+#define k2 scratch
+#define scratch_out (scratch + ecc->q.size)
+ struct shake256_ctx ctx;
+ uint8_t digest[ED448_SIGNATURE_SIZE];
+#define k1 (digest + ED448_KEY_SIZE)
+
+ _eddsa_expand_key (ecc, &nettle_shake256, &ctx, priv, digest, k2);
+
+ ed448_shake256_dom (0, 0, "", &nettle_shake256, &ctx);
+ shake256_update (&ctx, ED448_KEY_SIZE, k1);
+ _eddsa_sign (ecc, &nettle_shake256, pub,
+ &ctx,
+ k2, length, msg, signature, scratch_out);
+
+ gmp_free_limbs (scratch, itch);
+#undef k1
+#undef k2
+#undef scratch_out
+}
diff --git a/ed448-shake256-verify.c b/ed448-shake256-verify.c
new file mode 100644
index 00000000..4081abc3
--- /dev/null
+++ b/ed448-shake256-verify.c
@@ -0,0 +1,66 @@
+/* ed448-shake256-verify.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "sha3.h"
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+ size_t length, const uint8_t *msg,
+ const uint8_t *signature)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+ struct shake256_ctx ctx;
+ int res;
+#define A scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+ res = (_eddsa_decompress (ecc,
+ A, pub, scratch_out)
+ && _eddsa_verify (ecc, &nettle_shake256,
+ pub, A, &ctx,
+ length, msg, signature,
+ scratch_out));
+ gmp_free_limbs (scratch, itch);
+ return res;
+#undef A
+#undef scratch_out
+}
diff --git a/eddsa-compress.c b/eddsa-compress.c
index 40959586..2b36d3aa 100644
--- a/eddsa-compress.c
+++ b/eddsa-compress.c
@@ -33,6 +33,8 @@
# include "config.h"
#endif
+#include <assert.h>
+
#include "eddsa.h"
#include "ecc-internal.h"
@@ -48,15 +50,20 @@ void
_eddsa_compress (const struct ecc_curve *ecc, uint8_t *r, mp_limb_t *p,
mp_limb_t *scratch)
{
+ size_t nbytes;
+
#define xp scratch
#define yp (scratch + ecc->p.size)
#define scratch_out (scratch + 2*ecc->p.size)
+ assert (ecc->eddsa);
+
+ nbytes = 1 + (ecc->eddsa->b - 1) / 8;
ecc->h_to_a (ecc, 0, xp, p, scratch_out);
/* Encoding is the y coordinate and an appended "sign" bit, which is
the low bit of x. Bit order is not specified explicitly, but for
little-endian encoding, it makes most sense to append the bit
after the most significant bit of y. */
- mpn_get_base256_le (r, 1 + ecc->p.bit_size / 8, yp, ecc->p.size);
- r[ecc->p.bit_size / 8] += (xp[0] & 1) << (ecc->p.bit_size & 7);
+ mpn_get_base256_le (r, nbytes, yp, ecc->p.size);
+ r[nbytes - 1] += (xp[0] & 1) << ((ecc->eddsa->b - 1) & 7);
}
diff --git a/eddsa-decompress.c b/eddsa-decompress.c
index 75550168..75a38c0f 100644
--- a/eddsa-decompress.c
+++ b/eddsa-decompress.c
@@ -33,6 +33,8 @@
# include "config.h"
#endif
+#include <assert.h>
+
#include "eddsa.h"
#include "ecc-internal.h"
@@ -50,6 +52,7 @@ _eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p,
mp_limb_t *scratch)
{
mp_limb_t sign, cy;
+ size_t bits;
int res;
#define xp p
@@ -61,17 +64,25 @@ _eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t
*p,
#define tp (scratch + 2*ecc->p.size)
#define scratch_out (scratch + 4*ecc->p.size)
- sign = cp[ecc->p.bit_size / 8] >> (ecc->p.bit_size & 7);
+ assert (ecc->eddsa);
+
+ bits = ecc->eddsa->b - 1;
+ sign = cp[bits / 8] >> (bits & 7);
if (sign > 1)
return 0;
- mpn_set_base256_le (yp, ecc->p.size, cp, 1 + ecc->p.bit_size / 8);
+ mpn_set_base256_le (yp, ecc->p.size, cp, 1 + bits / 8);
/* Clear out the sign bit (if it fits) */
yp[ecc->p.size - 1] &= ~(mp_limb_t) 0
>> (ecc->p.size * GMP_NUMB_BITS - ecc->p.bit_size);
ecc_modp_sqr (ecc, y2, yp);
ecc_modp_mul (ecc, vp, y2, ecc->b);
ecc_modp_sub (ecc, vp, vp, ecc->unit);
- ecc_modp_sub (ecc, up, ecc->unit, y2);
+ /* The sign is different between curve25519 and curve448. */
+ /* FIXME: Define a suitable method in ecc_eddsa? */
+ if (ecc->p.bit_size == 255)
+ ecc_modp_sub (ecc, up, ecc->unit, y2);
+ else
+ ecc_modp_sub (ecc, up, y2, ecc->unit);
res = ecc->p.sqrt (&ecc->p, tp, up, vp, scratch_out);
cy = mpn_sub_n (xp, tp, ecc->p.m, ecc->p.size);
diff --git a/eddsa-expand.c b/eddsa-expand.c
index dc2bfaf1..3e39c8f7 100644
--- a/eddsa-expand.c
+++ b/eddsa-expand.c
@@ -52,18 +52,26 @@ _eddsa_expand_key (const struct ecc_curve *ecc,
uint8_t *digest,
mp_limb_t *k2)
{
- size_t nbytes = 1 + ecc->p.bit_size / 8;
+ size_t nbytes;
+ mp_size_t size;
- assert (H->digest_size >= 2*nbytes);
+ assert (ecc->eddsa);
+
+ nbytes = 1 + (ecc->eddsa->b - 1) / 8;
+ size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / 8;
H->init (ctx);
H->update (ctx, nbytes, key);
H->digest (ctx, 2*nbytes, digest);
- mpn_set_base256_le (k2, ecc->p.size, digest, nbytes);
- /* Clear low 3 bits */
- k2[0] &= ~(mp_limb_t) 7;
- /* Set bit number bit_size - 1 (bit 254 for curve25519) */
+ mpn_set_base256_le (k2, size, digest, nbytes);
+ /* FIXME: reduce k2 to ecc->p.size */
+
+ /* Clear low c bits */
+ k2[0] &= ~(mp_limb_t) ((1 << ecc->eddsa->c) - 1);
+
+ /* Set bit number bit_size - 1 (bit 254 for curve25519, bit 447 for
+ curve448) */
k2[(ecc->p.bit_size - 1) / GMP_NUMB_BITS]
|= (mp_limb_t) 1 << ((ecc->p.bit_size - 1) % GMP_NUMB_BITS);
/* Clear any higher bits. */
diff --git a/eddsa-hash.c b/eddsa-hash.c
index 4fb79f1b..a8d50815 100644
--- a/eddsa-hash.c
+++ b/eddsa-hash.c
@@ -49,3 +49,38 @@ _eddsa_hash (const struct ecc_modulo *m,
mpn_set_base256_le (rp, 2*m->size, digest, 2*nbytes);
m->mod (m, rp);
}
+
+void
+_eddsa_sized_hash (const struct ecc_modulo *m,
+ mp_size_t bits,
+ mp_limb_t *rp,
+ const uint8_t *digest)
+{
+ size_t nbytes = 1 + (bits - 1) / 8;
+ mp_size_t rn = (bits - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;
+ mp_size_t i;
+
+ mpn_set_base256_le (rp, 2*rn, digest, 2*nbytes);
+
+ /* Special case for Ed448: reduce rp to 2*m->size limbs.
+ After decoding rp from a hash of size 2*rn:
+
+ rp = XX || r0 || r1
+
+ where r0 and r1 have m->size limbs. Reduce this to:
+
+ rp = r0' || r1
+
+ where r0' has m->size limbs. */
+ for (i = 0; i < 2*(rn - m->size); i++)
+ {
+ mp_limb_t hi;
+ hi = mpn_addmul_1 (rp + m->size + i, m->B, m->B_size,
+ rp[2*m->size + i]);
+ assert (hi <= 1);
+ hi = cnd_add_n (hi, rp + m->size + i, m->B, m->size);
+ /* Sufficient roughly if b < B^size / p */
+ assert (hi == 0);
+ }
+ m->mod (m, rp);
+}
diff --git a/eddsa-pubkey.c b/eddsa-pubkey.c
index d1546707..55ca3a83 100644
--- a/eddsa-pubkey.c
+++ b/eddsa-pubkey.c
@@ -40,7 +40,7 @@
mp_size_t
_eddsa_public_key_itch (const struct ecc_curve *ecc)
{
- return 3*ecc->p.size + ecc->mul_g_itch;
+ return 3*ecc->p.size + ECC_MAX(ecc->mul_g_itch, _eddsa_compress_itch (ecc));
}
void
diff --git a/eddsa-sign.c b/eddsa-sign.c
index e5dc0e9d..23cca06e 100644
--- a/eddsa-sign.c
+++ b/eddsa-sign.c
@@ -44,7 +44,7 @@
mp_size_t
_eddsa_sign_itch (const struct ecc_curve *ecc)
{
- return 5*ecc->p.size + ecc->mul_g_itch;
+ return 7*ecc->p.size + ECC_MAX(ecc->mul_g_itch, _eddsa_compress_itch (ecc));
}
void
@@ -67,22 +67,24 @@ _eddsa_sign (const struct ecc_curve *ecc,
#define hash ((uint8_t *) (scratch + 3*size))
#define scratch_out (scratch + 5*size)
- size = ecc->p.size;
- nbytes = 1 + ecc->p.bit_size / 8;
+ assert (ecc->eddsa);
- assert (H->digest_size >= 2 * nbytes);
+ size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;
+ nbytes = 1 + (ecc->eddsa->b - 1) / 8;
H->update (ctx, length, msg);
H->digest (ctx, 2*nbytes, hash);
- _eddsa_hash (&ecc->q, rp, hash);
+ _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, rp, hash);
+
ecc->mul_g (ecc, P, rp, scratch_out);
_eddsa_compress (ecc, signature, P, scratch_out);
+ ecc->eddsa->dom (0, 0, "", H, ctx);
H->update (ctx, nbytes, signature);
H->update (ctx, nbytes, pub);
H->update (ctx, length, msg);
H->digest (ctx, 2*nbytes, hash);
- _eddsa_hash (&ecc->q, hp, hash);
+ _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, hp, hash);
ecc_modq_mul (ecc, sp, hp, k2);
ecc_modq_add (ecc, sp, sp, rp); /* FIXME: Can be plain add */
@@ -91,7 +93,7 @@ _eddsa_sign (const struct ecc_curve *ecc,
{
unsigned shift;
mp_limb_t cy;
- assert (ecc->p.bit_size == 255);
+ assert (ecc->p.bit_size == 255 || ecc->p.bit_size == 448);
shift = ecc->q.bit_size - 1 - GMP_NUMB_BITS * (ecc->p.size - 1);
cy = mpn_submul_1 (sp, ecc->q.m, ecc->p.size,
sp[ecc->p.size-1] >> shift);
diff --git a/eddsa-verify.c b/eddsa-verify.c
index 5541d975..3add4325 100644
--- a/eddsa-verify.c
+++ b/eddsa-verify.c
@@ -69,7 +69,7 @@ equal_h (const struct ecc_modulo *p,
mp_size_t
_eddsa_verify_itch (const struct ecc_curve *ecc)
{
- return 8*ecc->p.size + ecc->mul_itch;
+ return 8*ecc->p.size + ECC_MAX(ecc->mul_itch, _eddsa_decompress_itch (ecc));
}
int
@@ -83,6 +83,7 @@ _eddsa_verify (const struct ecc_curve *ecc,
const uint8_t *signature,
mp_limb_t *scratch)
{
+ mp_size_t size;
size_t nbytes;
#define R scratch
#define sp (scratch + 2*ecc->p.size)
@@ -92,28 +93,33 @@ _eddsa_verify (const struct ecc_curve *ecc,
#define S R
#define hash ((uint8_t *) P)
- nbytes = 1 + ecc->p.bit_size / 8;
+ assert (ecc->eddsa);
+
+ size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;
+ nbytes = 1 + (ecc->eddsa->b - 1) / 8;
/* Could maybe save some storage by delaying the R and S operations,
but it makes sense to check them for validity up front. */
if (!_eddsa_decompress (ecc, R, signature, R+2*ecc->p.size))
return 0;
- mpn_set_base256_le (sp, ecc->q.size, signature + nbytes, nbytes);
+ mpn_set_base256_le (sp, size, signature + nbytes, nbytes);
+
/* Check that s < q */
if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0)
return 0;
H->init (ctx);
+ ecc->eddsa->dom (0, 0, "", H, ctx);
H->update (ctx, nbytes, signature);
H->update (ctx, nbytes, pub);
H->update (ctx, length, msg);
H->digest (ctx, 2*nbytes, hash);
- _eddsa_hash (&ecc->q, hp, hash);
+ _eddsa_sized_hash (&ecc->q, ecc->eddsa->b, hp, hash);
/* Compute h A + R - s G, which should be the neutral point */
ecc->mul (ecc, P, hp, A, scratch_out);
- ecc_add_eh (ecc, P, P, R, scratch_out);
+ ecc->add_hh (ecc, P, P, R, scratch_out);
/* Move out of the way. */
mpn_copyi (hp, sp, ecc->q.size);
ecc->mul_g (ecc, S, hp, scratch_out);
diff --git a/eddsa.h b/eddsa.h
index 49f1a025..542532dc 100644
--- a/eddsa.h
+++ b/eddsa.h
@@ -45,12 +45,16 @@ extern "C" {
#define ed25519_sha512_public_key nettle_ed25519_sha512_public_key
#define ed25519_sha512_sign nettle_ed25519_sha512_sign
#define ed25519_sha512_verify nettle_ed25519_sha512_verify
+#define ed448_shake256_public_key nettle_ed448_shake256_public_key
+#define ed448_shake256_sign nettle_ed448_shake256_sign
+#define ed448_shake256_verify nettle_ed448_shake256_verify
#define _eddsa_compress _nettle_eddsa_compress
#define _eddsa_compress_itch _nettle_eddsa_compress_itch
#define _eddsa_decompress _nettle_eddsa_decompress
#define _eddsa_decompress_itch _nettle_eddsa_decompress_itch
#define _eddsa_hash _nettle_eddsa_hash
+#define _eddsa_sized_hash _nettle_eddsa_sized_hash
#define _eddsa_expand_key _nettle_eddsa_expand_key
#define _eddsa_sign _nettle_eddsa_sign
#define _eddsa_sign_itch _nettle_eddsa_sign_itch
@@ -61,6 +65,8 @@ extern "C" {
#define ED25519_KEY_SIZE 32
#define ED25519_SIGNATURE_SIZE 64
+#define ED448_KEY_SIZE 57
+#define ED448_SIGNATURE_SIZE 114
void
ed25519_sha512_public_key (uint8_t *pub, const uint8_t *priv);
@@ -76,6 +82,20 @@ ed25519_sha512_verify (const uint8_t *pub,
size_t length, const uint8_t *msg,
const uint8_t *signature);
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+ const uint8_t *priv,
+ size_t length, const uint8_t *msg,
+ uint8_t *signature);
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+ size_t length, const uint8_t *msg,
+ const uint8_t *signature);
+
/* Low-level internal functions */
struct ecc_curve;
@@ -98,6 +118,10 @@ void
_eddsa_hash (const struct ecc_modulo *m,
mp_limb_t *rp, const uint8_t *digest);
+void
+_eddsa_sized_hash (const struct ecc_modulo *m,
+ mp_size_t bits, mp_limb_t *rp, const uint8_t *digest);
+
mp_size_t
_eddsa_sign_itch (const struct ecc_curve *ecc);
diff --git a/nettle.texinfo b/nettle.texinfo
index 20adc0e6..e32d348a 100644
--- a/nettle.texinfo
+++ b/nettle.texinfo
@@ -4585,6 +4585,31 @@ Verifies a message using the provided public key.
Returns 1 if the
signature is valid, otherwise 0.
@end deftypefun
+Nettle also provides Ed448, an EdDSA signature scheme based on an
+Edwards curve equivalent to curve448.
+
+@defvr Constant ED448_KEY_SIZE
+The size of a private or public Ed448 key, 57 octets.
+@end defvr
+
+@defvr Constant ED448_SIGNATURE_SIZE
+The size of an Ed448 signature, 114 octets.
+@end defvr
+
+@deftypefun void ed448_shake256_public_key (uint8_t *@var{pub}, const uint8_t
*@var{priv})
+Computes the public key corresponding to the given private key. Both
+input and output are of size @code{ED448_KEY_SIZE}.
+@end deftypefun
+
+@deftypefun void ed448_shake256_sign (const uint8_t *@var{pub}, const uint8_t
*@var{priv}, size_t @var{length}, const uint8_t *@var{msg}, uint8_t
*@var{signature})
+Signs a message using the provided key pair.
+@end deftypefun
+
+@deftypefun int ed448_shake256_verify (const uint8_t *@var{pub}, size_t
@var{length}, const uint8_t *@var{msg}, const uint8_t *@var{signature})
+Verifies a message using the provided public key. Returns 1 if the
+signature is valid, otherwise 0.
+@end deftypefun
+
@node Randomness, ASCII encoding, Public-key algorithms, Reference
@comment node-name, next, previous, up
@section Randomness
diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make
index 5b48dadc..d96c4712 100644
--- a/testsuite/.test-rules.make
+++ b/testsuite/.test-rules.make
@@ -265,6 +265,9 @@ eddsa-verify-test$(EXEEXT): eddsa-verify-test.$(OBJEXT)
ed25519-test$(EXEEXT): ed25519-test.$(OBJEXT)
$(LINK) ed25519-test.$(OBJEXT) $(TEST_OBJS) -o ed25519-test$(EXEEXT)
+ed448-test$(EXEEXT): ed448-test.$(OBJEXT)
+ $(LINK) ed448-test.$(OBJEXT) $(TEST_OBJS) -o ed448-test$(EXEEXT)
+
sha1-huge-test$(EXEEXT): sha1-huge-test.$(OBJEXT)
$(LINK) sha1-huge-test.$(OBJEXT) $(TEST_OBJS) -o sha1-huge-test$(EXEEXT)
diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in
index cbcc3fd3..e0d141e0 100644
--- a/testsuite/Makefile.in
+++ b/testsuite/Makefile.in
@@ -48,7 +48,7 @@ TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \
ecdsa-sign-test.c ecdsa-verify-test.c \
ecdsa-keygen-test.c ecdh-test.c \
eddsa-compress-test.c eddsa-sign-test.c \
- eddsa-verify-test.c ed25519-test.c
+ eddsa-verify-test.c ed25519-test.c ed448-test.c
TS_SOURCES = $(TS_NETTLE_SOURCES) $(TS_HOGWEED_SOURCES)
CXX_SOURCES = cxx-test.cxx
diff --git a/testsuite/ed448-test.c b/testsuite/ed448-test.c
new file mode 100644
index 00000000..56dc6277
--- /dev/null
+++ b/testsuite/ed448-test.c
@@ -0,0 +1,240 @@
+/* ed448-test.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#include "testutils.h"
+
+#include <errno.h>
+
+#include "eddsa.h"
+
+#include "base16.h"
+
+static void
+decode_hex (size_t length, uint8_t *dst, const char *src)
+{
+ struct base16_decode_ctx ctx;
+ size_t out_size;
+ base16_decode_init (&ctx);
+ ASSERT (base16_decode_update (&ctx, &out_size, dst, 2*length, src));
+ ASSERT (out_size == length);
+ ASSERT (base16_decode_final (&ctx));
+}
+
+/* Processes a single line in the format of
+ http://ed25519.cr.yp.to/python/sign.input:
+
+ sk pk : pk : m : s m :
+
+ where sk (secret key) and pk (public key) are 57 bytes each, m is
+ variable size, and s is 114 bytes. All values hex encoded.
+*/
+static void
+test_one (const char *line)
+{
+ const char *p;
+ const char *mp;
+ uint8_t sk[ED448_KEY_SIZE];
+ uint8_t pk[ED448_KEY_SIZE];
+ uint8_t t[ED448_KEY_SIZE];
+ uint8_t s[ED448_SIGNATURE_SIZE];
+ uint8_t *msg;
+ size_t msg_size;
+ uint8_t s2[ED448_SIGNATURE_SIZE];
+
+ decode_hex (ED448_KEY_SIZE, sk, line);
+
+ p = strchr (line, ':');
+ ASSERT (p == line + 228);
+ p++;
+ decode_hex (ED448_KEY_SIZE, pk, p);
+ p = strchr (p, ':');
+ ASSERT (p == line + 343);
+ mp = ++p;
+ p = strchr (p, ':');
+ ASSERT (p);
+ ASSERT ((p - mp) % 2 == 0);
+ msg_size = (p - mp) / 2;
+
+ decode_hex (ED448_SIGNATURE_SIZE, s, p+1);
+
+ msg = xalloc (msg_size + 1);
+ msg[msg_size] = 'x';
+
+ decode_hex (msg_size, msg, mp);
+
+ ed448_shake256_public_key (t, sk);
+ ASSERT (MEMEQ(ED448_KEY_SIZE, t, pk));
+
+ ed448_shake256_sign (pk, sk, msg_size, msg, s2);
+ ASSERT (MEMEQ (ED448_SIGNATURE_SIZE, s, s2));
+
+ ASSERT (ed448_shake256_verify (pk, msg_size, msg, s));
+
+ s2[ED448_SIGNATURE_SIZE/3] ^= 0x40;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+ memcpy (s2, s, ED448_SIGNATURE_SIZE);
+ s2[2*ED448_SIGNATURE_SIZE/3] ^= 0x40;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+ ASSERT (!ed448_shake256_verify (pk, msg_size + 1, msg, s));
+
+ if (msg_size > 0)
+ {
+ msg[msg_size-1] ^= 0x20;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s));
+ }
+ free (msg);
+}
+
+#ifndef HAVE_GETLINE
+static ssize_t
+getline(char **lineptr, size_t *n, FILE *f)
+{
+ size_t i;
+ int c;
+ if (!*lineptr)
+ {
+ *n = 500;
+ *lineptr = xalloc (*n);
+ }
+
+ i = 0;
+ do
+ {
+ c = getc(f);
+ if (c < 0)
+ {
+ if (i > 0)
+ break;
+ return -1;
+ }
+
+ (*lineptr) [i++] = c;
+ if (i == *n)
+ {
+ *n *= 2;
+ *lineptr = realloc (*lineptr, *n);
+ if (!*lineptr)
+ die ("Virtual memory exhausted.\n");
+ }
+ } while (c != '\n');
+
+ (*lineptr) [i] = 0;
+ return i;
+}
+#endif
+
+void
+test_main(void)
+{
+ const char *input = getenv ("ED448_SIGN_INPUT");
+ if (input)
+ {
+ size_t buf_size;
+ char *buf;
+ FILE *f = fopen (input, "r");
+ if (!f)
+ die ("Opening input file '%s' failed: %s\n",
+ input, strerror (errno));
+
+ for (buf = NULL; getline (&buf, &buf_size, f) >= 0; )
+ test_one (buf);
+
+ free (buf);
+ fclose (f);
+ }
+ else
+ {
+ /* Test vectors from RFC 8032. */
+ /* Blank */
+ test_one
("6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b"
+
"5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+
"5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+ ":"
+
"533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600"
+ ":");
+ /* 1 octet */
+ test_one
("c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e"
+
"43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+
"43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+ "03:"
+
"26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00"
+ "03:");
+ /* 11 octets */
+ test_one
("cd23d24f714274e744343237b93290f511f6425f98e64459ff203e8985083ffdf60500553abc0e05cd02184bdb89c4ccd67e187951267eb328"
+
"dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+
"dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+ "0c3e544074ec63b0265e0c:"
+
"1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00"
+ "0c3e544074ec63b0265e0c:");
+ /* 12 octets */
+ test_one
("258cdd4ada32ed9c9ff54e63756ae582fb8fab2ac721f2c8e676a72768513d939f63dddb55609133f29adf86ec9929dccb52c1c5fd2ff7e21b"
+
"3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+
"3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+ "64a65f3cdedcdd66811e2915:"
+
"7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00"
+ "64a65f3cdedcdd66811e2915:");
+ /* 13 octets */
+ test_one
("7ef4e84544236752fbb56b8f31a23a10e42814f5f55ca037cdcc11c64c9a3b2949c1bb60700314611732a6c2fea98eebc0266a11a93970100e"
+
"b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+
"b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+ "64a65f3cdedcdd66811e2915e7:"
+
"6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100"
+ "64a65f3cdedcdd66811e2915e7:");
+ /* 64 octets */
+ test_one
("d65df341ad13e008567688baedda8e9dcdc17dc024974ea5b4227b6530e339bff21f99e68ca6968f3cca6dfe0fb9f4fab4fa135d5542ea3f01"
+
"df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+
"df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+
"bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:"
+
"554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900"
+
"bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:");
+ /* 256 octets */
+ test_one
("2ec5fe3c17045abdb136a5e6a913e32ab75ae68b53d2fc149b77e504132d37569b7e766ba74a19bd6162343a21c8590aa9cebca9014c636df5"
+
"79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+
"79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+
"15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:"
+
"c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00"
+
"15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:");
+ /* 1023 octets */
+ test_one
("872d093780f5d3730df7c212664b37b8a0f24f56810daa8382cd4fa3f77634ec44dc54f1c2ed9bea86fafb7632d8be199ea165f5ad55dd9ce8"
+
"a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+
"a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+
"6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+
"06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+
"af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:"
+
"e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00"
+
"6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+
"06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+
"af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:");
+ }
+}
diff --git a/testsuite/eddsa-compress-test.c b/testsuite/eddsa-compress-test.c
index 9ceb6fe9..834be212 100644
--- a/testsuite/eddsa-compress-test.c
+++ b/testsuite/eddsa-compress-test.c
@@ -37,76 +37,87 @@
void test_main (void)
{
- const struct ecc_curve *ecc = &_nettle_curve25519;
gmp_randstate_t rands;
- mp_size_t size, itch;
- mpz_t zp, t;
- mp_limb_t *s;
- mp_limb_t *p;
- mp_limb_t *pa1;
- mp_limb_t *pa2;
- mp_limb_t *scratch;
- size_t clen;
- uint8_t *c;
- unsigned j;
+ unsigned i, j;
gmp_randinit_default (rands);
- size = ecc_size (ecc);
- clen = 1 + ecc->p.bit_size / 8;
-
- mpz_roinit_n (zp, ecc->p.m, size);
-
- mpz_init (t);
- s = xalloc_limbs (size);
- p = xalloc_limbs (ecc_size_j (ecc));
- pa1 = xalloc_limbs (ecc_size_a (ecc));
- pa2 = xalloc_limbs (ecc_size_a (ecc));
- c = xalloc (clen);
-
- itch = _eddsa_decompress_itch (ecc);
- if (itch < ecc->mul_g_itch)
- itch = ecc->mul_g_itch;
-
- scratch = xalloc_limbs (itch);
-
- for (j = 0; j < COUNT; j++)
+ for (i = 0; ecc_curves[i]; i++)
{
- mpz_t x1, y1, x2, y2;
-
- mpz_urandomb (t, rands, ecc->q.bit_size);
- mpz_limbs_copy (s, t, ecc->q.size);
- ecc->mul_g (ecc, p, s, scratch);
- _eddsa_compress (ecc, c, p, scratch);
- ecc->h_to_a (ecc, 0, pa1, p, scratch);
- _eddsa_decompress (ecc, pa2, c, scratch);
- mpz_roinit_n (x1, pa1, size);
- mpz_roinit_n (y1, pa1 + size, size);
- mpz_roinit_n (x2, pa2, size);
- mpz_roinit_n (y2, pa2 + size, size);
- if (!(mpz_congruent_p (x1, x2, zp)
- && mpz_congruent_p (y1, y2, zp)))
+ const struct ecc_curve *ecc = ecc_curves[i];
+ mp_size_t size, itch;
+ mpz_t zp, t;
+ mp_limb_t *s;
+ mp_limb_t *p;
+ mp_limb_t *pa1;
+ mp_limb_t *pa2;
+ mp_limb_t *scratch;
+ size_t clen;
+ uint8_t *c;
+
+ if (!(ecc->p.bit_size == 255 || ecc->p.bit_size == 448))
+ continue;
+
+ if (!ecc->eddsa)
+ abort ();
+
+ size = ecc_size (ecc);
+ clen = 1 + (ecc->eddsa->b - 1) / 8;
+
+ mpz_roinit_n (zp, ecc->p.m, size);
+
+ mpz_init (t);
+ s = xalloc_limbs (size);
+ p = xalloc_limbs (ecc_size_j (ecc));
+ pa1 = xalloc_limbs (ecc_size_a (ecc));
+ pa2 = xalloc_limbs (ecc_size_a (ecc));
+ c = xalloc (clen);
+
+ itch = _eddsa_decompress_itch (ecc);
+ if (itch < ecc->mul_g_itch)
+ itch = ecc->mul_g_itch;
+
+ scratch = xalloc_limbs (itch);
+
+ for (j = 0; j < COUNT; j++)
{
- fprintf (stderr, "eddsa compression failed:\nc = ");
- print_hex (clen, c);
- fprintf (stderr, "\np1 = 0x");
- mpz_out_str (stderr, 16, x1);
- fprintf (stderr, ",\n 0x");
- mpz_out_str (stderr, 16, y1);
- fprintf (stderr, "\np2 = 0x");
- mpz_out_str (stderr, 16, x2);
- fprintf (stderr, ",\n 0x");
- mpz_out_str (stderr, 16, y2);
- fprintf (stderr, "\n");
- abort ();
+ mpz_t x1, y1, x2, y2;
+
+ mpz_urandomb (t, rands, ecc->q.bit_size);
+ mpz_limbs_copy (s, t, ecc->q.size);
+ ecc->mul_g (ecc, p, s, scratch);
+ _eddsa_compress (ecc, c, p, scratch);
+ ecc->h_to_a (ecc, 0, pa1, p, scratch);
+ _eddsa_decompress (ecc, pa2, c, scratch);
+ mpz_roinit_n (x1, pa1, size);
+ mpz_roinit_n (y1, pa1 + size, size);
+ mpz_roinit_n (x2, pa2, size);
+ mpz_roinit_n (y2, pa2 + size, size);
+ if (!(mpz_congruent_p (x1, x2, zp)
+ && mpz_congruent_p (y1, y2, zp)))
+ {
+ fprintf (stderr, "eddsa compression failed:\nc = ");
+ print_hex (clen, c);
+ fprintf (stderr, "\np1 = 0x");
+ mpz_out_str (stderr, 16, x1);
+ fprintf (stderr, ",\n 0x");
+ mpz_out_str (stderr, 16, y1);
+ fprintf (stderr, "\np2 = 0x");
+ mpz_out_str (stderr, 16, x2);
+ fprintf (stderr, ",\n 0x");
+ mpz_out_str (stderr, 16, y2);
+ fprintf (stderr, "\n");
+ abort ();
+ }
}
+ mpz_clear (t);
+ free (s);
+ free (p);
+ free (c);
+ free (pa1);
+ free (pa2);
+ free (scratch);
}
- mpz_clear (t);
- free (s);
- free (p);
- free (c);
- free (pa1);
- free (pa2);
- free (scratch);
+
gmp_randclear (rands);
}
diff --git a/testsuite/eddsa-sign-test.c b/testsuite/eddsa-sign-test.c
index c496e6eb..b4471d16 100644
--- a/testsuite/eddsa-sign-test.c
+++ b/testsuite/eddsa-sign-test.c
@@ -42,13 +42,14 @@ test_eddsa_sign (const struct ecc_curve *ecc,
const struct tstring *ref)
{
mp_limb_t *scratch = xalloc_limbs (_eddsa_sign_itch (ecc));
- size_t nbytes = 1 + ecc->p.bit_size / 8;
+ mp_size_t size = (ecc->eddsa->b - 1 + GMP_NUMB_BITS - 1) / 8;
+ size_t nbytes = 1 + (ecc->eddsa->b - 1) / 8;
uint8_t *signature = xalloc (2*nbytes);
void *ctx = xalloc (H->context_size);
uint8_t *public_out = xalloc (nbytes);
uint8_t *digest = xalloc (2*nbytes);
const uint8_t *k1 = digest + nbytes;
- mp_limb_t *k2 = xalloc_limbs (ecc->p.size);
+ mp_limb_t *k2 = xalloc_limbs (size);
ASSERT (public->length == nbytes);
ASSERT (private->length == nbytes);
@@ -68,6 +69,8 @@ test_eddsa_sign (const struct ecc_curve *ecc,
fprintf (stderr, "\n");
abort ();
}
+
+ ecc->eddsa->dom (0, 0, "", H, ctx);
H->update (ctx, nbytes, k1);
_eddsa_sign (ecc, H, public->data, ctx, k2,
@@ -140,4 +143,63 @@ void test_main (void)
"99df1340cce54626 183144ef46887163"
"4b0a5c0033534108 e1c67c0dc99d3014"
"f01084e98c95e101 4b309b1dbb2e6704"));
+
+ /* Based on a few of the test vectors from RFC 8032 */
+ test_eddsa_sign (&_nettle_curve448, &nettle_shake256,
+ SHEX("5fd7449b59b461fd 2ce787ec616ad46a"
+ "1da1342485a70e1f 8a0ea75d80e96778"
+ "edf124769b46c706 1bd6783df1e50f6c"
+ "d1fa1abeafe82561 80"),
+ SHEX("6c82a562cb808d10 d632be89c8513ebf"
+ "6c929f34ddfa8c9f 63c9960ef6e348a3"
+ "528c8a3fcc2f044e 39a3fc5b94492f8f"
+ "032e7549a20098f9 5b"),
+ SHEX(""),
+ SHEX("533a37f6bbe45725 1f023c0d88f976ae"
+ "2dfb504a843e34d2 074fd823d41a591f"
+ "2b233f034f628281 f2fd7a22ddd47d78"
+ "28c59bd0a21bfd39 80ff0d2028d4b18a"
+ "9df63e006c5d1c2d 345b925d8dc00b41"
+ "04852db99ac5c7cd da8530a113a0f4db"
+ "b61149f05a736326 8c71d95808ff2e65"
+ "2600"));
+ test_eddsa_sign (&_nettle_curve448, &nettle_shake256,
+ SHEX("43ba28f430cdff45 6ae531545f7ecd0a"
+ "c834a55d9358c037 2bfa0c6c6798c086"
+ "6aea01eb00742802 b8438ea4cb82169c"
+ "235160627b4c3a94 80"),
+ SHEX("c4eab05d357007c6 32f3dbb48489924d"
+ "552b08fe0c353a0d 4a1f00acda2c463a"
+ "fbea67c5e8d2877c 5e3bc397a659949e"
+ "f8021e954e0a1227 4e"),
+ SHEX("03"),
+ SHEX("26b8f91727bd6289 7af15e41eb43c377"
+ "efb9c610d48f2335 cb0bd0087810f435"
+ "2541b143c4b981b7 e18f62de8ccdf633"
+ "fc1bf037ab7cd779 805e0dbcc0aae1cb"
+ "cee1afb2e027df36 bc04dcecbf154336"
+ "c19f0af7e0a64729 05e799f1953d2a0f"
+ "f3348ab21aa4adaf d1d234441cf807c0"
+ "3a00"));
+ test_eddsa_sign (&_nettle_curve448, &nettle_shake256,
+ SHEX("df9705f58edbab80 2c7f8363cfe5560a"
+ "b1c6132c20a9f1dd 163483a26f8ac53a"
+ "39d6808bf4a1dfbd 261b099bb03b3fb5"
+ "0906cb28bd8a081f 00"),
+ SHEX("d65df341ad13e008 567688baedda8e9d"
+ "cdc17dc024974ea5 b4227b6530e339bf"
+ "f21f99e68ca6968f 3cca6dfe0fb9f4fa"
+ "b4fa135d5542ea3f 01"),
+ SHEX("bd0f6a3747cd561b dddf4640a332461a"
+ "4a30a12a434cd0bf 40d766d9c6d458e5"
+ "512204a30c17d1f5 0b5079631f64eb31"
+ "12182da300583546 1113718d1a5ef944"),
+ SHEX("554bc2480860b49e ab8532d2a533b7d5"
+ "78ef473eeb58c98b b2d0e1ce488a98b1"
+ "8dfde9b9b90775e6 7f47d4a1c3482058"
+ "efc9f40d2ca033a0 801b63d45b3b722e"
+ "f552bad3b4ccb667 da350192b61c508c"
+ "f7b6b5adadc2c8d9 a446ef003fb05cba"
+ "5f30e88e36ec2703 b349ca229c267083"
+ "3900"));
}
diff --git a/testsuite/eddsa-verify-test.c b/testsuite/eddsa-verify-test.c
index dd6712ab..bab91509 100644
--- a/testsuite/eddsa-verify-test.c
+++ b/testsuite/eddsa-verify-test.c
@@ -42,7 +42,7 @@ test_eddsa (const struct ecc_curve *ecc,
{
mp_limb_t *A = xalloc_limbs (ecc_size_a (ecc));
mp_limb_t *scratch = xalloc_limbs (_eddsa_verify_itch (ecc));
- size_t nbytes = 1 + ecc->p.bit_size / 8;
+ size_t nbytes = 1 + (ecc->eddsa->b - 1) / 8;
uint8_t *cmsg = xalloc (msg->length);
uint8_t *csignature = xalloc (2*nbytes);
void *ctx = xalloc (H->context_size);
@@ -157,4 +157,51 @@ test_main (void)
"99df1340cce54626 183144ef46887163"
"4b0a5c0033534108 e1c67c0dc99d3014"
"f01084e98c95e101 4b309b1dbb2e6704"));
+
+ /* Based on a few of the test vectors from RFC 8032 */
+ test_eddsa (&_nettle_curve448, &nettle_shake256,
+ H("5fd7449b59b461fd 2ce787ec616ad46a"
+ "1da1342485a70e1f 8a0ea75d80e96778"
+ "edf124769b46c706 1bd6783df1e50f6c"
+ "d1fa1abeafe82561 80"),
+ SHEX(""),
+ H("533a37f6bbe45725 1f023c0d88f976ae"
+ "2dfb504a843e34d2 074fd823d41a591f"
+ "2b233f034f628281 f2fd7a22ddd47d78"
+ "28c59bd0a21bfd39 80ff0d2028d4b18a"
+ "9df63e006c5d1c2d 345b925d8dc00b41"
+ "04852db99ac5c7cd da8530a113a0f4db"
+ "b61149f05a736326 8c71d95808ff2e65"
+ "2600"));
+ test_eddsa (&_nettle_curve448, &nettle_shake256,
+ H("43ba28f430cdff45 6ae531545f7ecd0a"
+ "c834a55d9358c037 2bfa0c6c6798c086"
+ "6aea01eb00742802 b8438ea4cb82169c"
+ "235160627b4c3a94 80"),
+ SHEX("03"),
+ H("26b8f91727bd6289 7af15e41eb43c377"
+ "efb9c610d48f2335 cb0bd0087810f435"
+ "2541b143c4b981b7 e18f62de8ccdf633"
+ "fc1bf037ab7cd779 805e0dbcc0aae1cb"
+ "cee1afb2e027df36 bc04dcecbf154336"
+ "c19f0af7e0a64729 05e799f1953d2a0f"
+ "f3348ab21aa4adaf d1d234441cf807c0"
+ "3a00"));
+ test_eddsa (&_nettle_curve448, &nettle_shake256,
+ H("df9705f58edbab80 2c7f8363cfe5560a"
+ "b1c6132c20a9f1dd 163483a26f8ac53a"
+ "39d6808bf4a1dfbd 261b099bb03b3fb5"
+ "0906cb28bd8a081f 00"),
+ SHEX("bd0f6a3747cd561b dddf4640a332461a"
+ "4a30a12a434cd0bf 40d766d9c6d458e5"
+ "512204a30c17d1f5 0b5079631f64eb31"
+ "12182da300583546 1113718d1a5ef944"),
+ H("554bc2480860b49e ab8532d2a533b7d5"
+ "78ef473eeb58c98b b2d0e1ce488a98b1"
+ "8dfde9b9b90775e6 7f47d4a1c3482058"
+ "efc9f40d2ca033a0 801b63d45b3b722e"
+ "f552bad3b4ccb667 da350192b61c508c"
+ "f7b6b5adadc2c8d9 a446ef003fb05cba"
+ "5f30e88e36ec2703 b349ca229c267083"
+ "3900"));
}
--
2.13.3
_______________________________________________
nettle-bugs mailing list
[email protected]
http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
