diff options
author | Nicolas Boichat <drinkcat@chromium.org> | 2019-05-08 18:10:41 +0900 |
---|---|---|
committer | Commit Bot <commit-bot@chromium.org> | 2020-03-24 14:47:10 +0000 |
commit | 71ef37803b8b300d963bf9d7d10eccd29f3eb7ba (patch) | |
tree | f1a3cbd8c217f30a3dfbd842d8ec0b3bf379b28b /third_party/boringssl/common/curve25519.c | |
parent | 506fdc01b0f68ce972fa376c0b79bd1d578f0a0e (diff) | |
download | chrome-ec-71ef37803b8b300d963bf9d7d10eccd29f3eb7ba.tar.gz |
curve25519: Move to third_party
curve25519 comes from boringssl as well, move it to that directory.
See git log for which boringssl commit the implementation comes from,
and changes that were applied.
BRANCH=none
BUG=chromium:884905
TEST=make buildall -j, which also include basic tests.
Change-Id: I1dee4795009c1e2034a181f6083d1f9445c87d41
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/1600946
Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>
Diffstat (limited to 'third_party/boringssl/common/curve25519.c')
-rw-r--r-- | third_party/boringssl/common/curve25519.c | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/third_party/boringssl/common/curve25519.c b/third_party/boringssl/common/curve25519.c new file mode 100644 index 0000000000..2a7fad6509 --- /dev/null +++ b/third_party/boringssl/common/curve25519.c @@ -0,0 +1,65 @@ +/* Copyright 2015, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ + +/* This code is mostly taken from the ref10 version of Ed25519 in SUPERCOP + * 20141124 (http://bench.cr.yp.to/supercop.html). That code is released as + * public domain but this file has the ISC license just to keep licencing + * simple. + * + * The field functions are shared by Ed25519 and X25519 where possible. */ + +#include "common.h" +#include "curve25519.h" +#include "trng.h" +#include "util.h" +#define CRYPTO_memcmp safe_memcmp + +#ifdef CONFIG_RNG +void X25519_keypair(uint8_t out_public_value[32], uint8_t out_private_key[32]) { + rand_bytes(out_private_key, 32); + + /* All X25519 implementations should decode scalars correctly (see + * https://tools.ietf.org/html/rfc7748#section-5). However, if an + * implementation doesn't then it might interoperate with random keys a + * fraction of the time because they'll, randomly, happen to be correctly + * formed. + * + * Thus we do the opposite of the masking here to make sure that our private + * keys are never correctly masked and so, hopefully, any incorrect + * implementations are deterministically broken. + * + * This does not affect security because, although we're throwing away + * entropy, a valid implementation of scalarmult should throw away the exact + * same bits anyway. */ + out_private_key[0] |= 7; + out_private_key[31] &= 63; + out_private_key[31] |= 128; + + X25519_public_from_private(out_public_value, out_private_key); +} +#endif + +int X25519(uint8_t out_shared_key[32], const uint8_t private_key[32], + const uint8_t peer_public_value[32]) { + static const uint8_t kZeros[32] = {0}; + x25519_scalar_mult(out_shared_key, private_key, peer_public_value); + /* The all-zero output results when the input is a point of small order. */ + return CRYPTO_memcmp(kZeros, out_shared_key, 32) != 0; +} + +void X25519_public_from_private(uint8_t out_public_value[32], + const uint8_t private_key[32]) { + static const uint8_t kMongomeryBasePoint[32] = {9}; + x25519_scalar_mult(out_public_value, private_key, kMongomeryBasePoint); +} |