/src/botan/src/lib/pubkey/ed25519/ed25519_key.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Ed25519 |
3 | | * (C) 2017 Ribose Inc |
4 | | * |
5 | | * Based on the public domain code from SUPERCOP ref10 by |
6 | | * Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang |
7 | | * |
8 | | * Botan is released under the Simplified BSD License (see license.txt) |
9 | | */ |
10 | | |
11 | | #include <botan/ed25519.h> |
12 | | #include <botan/internal/pk_ops_impl.h> |
13 | | #include <botan/hash.h> |
14 | | #include <botan/ber_dec.h> |
15 | | #include <botan/der_enc.h> |
16 | | #include <botan/rng.h> |
17 | | |
18 | | namespace Botan { |
19 | | |
20 | | AlgorithmIdentifier Ed25519_PublicKey::algorithm_identifier() const |
21 | 0 | { |
22 | 0 | return AlgorithmIdentifier(get_oid(), AlgorithmIdentifier::USE_EMPTY_PARAM); |
23 | 0 | } |
24 | | |
25 | | bool Ed25519_PublicKey::check_key(RandomNumberGenerator&, bool) const |
26 | 0 | { |
27 | 0 | return true; // no tests possible? |
28 | 0 | // TODO could check cofactor |
29 | 0 | } |
30 | | |
31 | | Ed25519_PublicKey::Ed25519_PublicKey(const uint8_t pub_key[], size_t pub_len) |
32 | 0 | { |
33 | 0 | if(pub_len != 32) |
34 | 0 | throw Decoding_Error("Invalid length for Ed25519 key"); |
35 | 0 | m_public.assign(pub_key, pub_key + pub_len); |
36 | 0 | } Unexecuted instantiation: Botan::Ed25519_PublicKey::Ed25519_PublicKey(unsigned char const*, unsigned long) Unexecuted instantiation: Botan::Ed25519_PublicKey::Ed25519_PublicKey(unsigned char const*, unsigned long) |
37 | | |
38 | | Ed25519_PublicKey::Ed25519_PublicKey(const AlgorithmIdentifier&, |
39 | | const std::vector<uint8_t>& key_bits) |
40 | 173 | { |
41 | 173 | m_public = key_bits; |
42 | 173 | |
43 | 173 | if(m_public.size() != 32) |
44 | 2 | throw Decoding_Error("Invalid size for Ed25519 public key"); |
45 | 173 | } Unexecuted instantiation: Botan::Ed25519_PublicKey::Ed25519_PublicKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) Botan::Ed25519_PublicKey::Ed25519_PublicKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > const&) Line | Count | Source | 40 | 173 | { | 41 | 173 | m_public = key_bits; | 42 | 173 | | 43 | 173 | if(m_public.size() != 32) | 44 | 2 | throw Decoding_Error("Invalid size for Ed25519 public key"); | 45 | 173 | } |
|
46 | | |
47 | | std::vector<uint8_t> Ed25519_PublicKey::public_key_bits() const |
48 | 0 | { |
49 | 0 | return m_public; |
50 | 0 | } |
51 | | |
52 | | Ed25519_PrivateKey::Ed25519_PrivateKey(const secure_vector<uint8_t>& secret_key) |
53 | 0 | { |
54 | 0 | if(secret_key.size() == 64) |
55 | 0 | { |
56 | 0 | m_private = secret_key; |
57 | 0 | m_public.assign(m_private.begin() + 32, m_private.end()); |
58 | 0 | } |
59 | 0 | else if(secret_key.size() == 32) |
60 | 0 | { |
61 | 0 | m_public.resize(32); |
62 | 0 | m_private.resize(64); |
63 | 0 | ed25519_gen_keypair(m_public.data(), m_private.data(), secret_key.data()); |
64 | 0 | } |
65 | 0 | else |
66 | 0 | throw Decoding_Error("Invalid size for Ed25519 private key"); |
67 | 0 | } Unexecuted instantiation: Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) Unexecuted instantiation: Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) |
68 | | |
69 | | Ed25519_PrivateKey::Ed25519_PrivateKey(RandomNumberGenerator& rng) |
70 | 0 | { |
71 | 0 | const secure_vector<uint8_t> seed = rng.random_vec(32); |
72 | 0 | m_public.resize(32); |
73 | 0 | m_private.resize(64); |
74 | 0 | ed25519_gen_keypair(m_public.data(), m_private.data(), seed.data()); |
75 | 0 | } Unexecuted instantiation: Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(Botan::RandomNumberGenerator&) Unexecuted instantiation: Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(Botan::RandomNumberGenerator&) |
76 | | |
77 | | Ed25519_PrivateKey::Ed25519_PrivateKey(const AlgorithmIdentifier&, |
78 | | const secure_vector<uint8_t>& key_bits) |
79 | 11 | { |
80 | 11 | secure_vector<uint8_t> bits; |
81 | 11 | BER_Decoder(key_bits).decode(bits, OCTET_STRING).discard_remaining(); |
82 | 11 | |
83 | 11 | if(bits.size() != 32) |
84 | 6 | throw Decoding_Error("Invalid size for Ed25519 private key"); |
85 | 5 | m_public.resize(32); |
86 | 5 | m_private.resize(64); |
87 | 5 | ed25519_gen_keypair(m_public.data(), m_private.data(), bits.data()); |
88 | 5 | } Unexecuted instantiation: Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(Botan::AlgorithmIdentifier const&, std::__1::vector<unsigned char, Botan::secure_allocator<unsigned char> > const&) Line | Count | Source | 79 | 11 | { | 80 | 11 | secure_vector<uint8_t> bits; | 81 | 11 | BER_Decoder(key_bits).decode(bits, OCTET_STRING).discard_remaining(); | 82 | 11 | | 83 | 11 | if(bits.size() != 32) | 84 | 6 | throw Decoding_Error("Invalid size for Ed25519 private key"); | 85 | 5 | m_public.resize(32); | 86 | 5 | m_private.resize(64); | 87 | 5 | ed25519_gen_keypair(m_public.data(), m_private.data(), bits.data()); | 88 | 5 | } |
|
89 | | |
90 | | secure_vector<uint8_t> Ed25519_PrivateKey::private_key_bits() const |
91 | 0 | { |
92 | 0 | secure_vector<uint8_t> bits(&m_private[0], &m_private[32]); |
93 | 0 | return DER_Encoder().encode(bits, OCTET_STRING).get_contents(); |
94 | 0 | } |
95 | | |
96 | | bool Ed25519_PrivateKey::check_key(RandomNumberGenerator&, bool) const |
97 | 0 | { |
98 | 0 | return true; // ??? |
99 | 0 | } |
100 | | |
101 | | namespace { |
102 | | |
103 | | /** |
104 | | * Ed25519 verifying operation |
105 | | */ |
106 | | class Ed25519_Pure_Verify_Operation final : public PK_Ops::Verification |
107 | | { |
108 | | public: |
109 | | Ed25519_Pure_Verify_Operation(const Ed25519_PublicKey& key) : m_key(key) |
110 | 74 | { |
111 | 74 | } |
112 | | |
113 | | void update(const uint8_t msg[], size_t msg_len) override |
114 | 74 | { |
115 | 74 | m_msg.insert(m_msg.end(), msg, msg + msg_len); |
116 | 74 | } |
117 | | |
118 | | bool is_valid_signature(const uint8_t sig[], size_t sig_len) override |
119 | 74 | { |
120 | 74 | if(sig_len != 64) |
121 | 0 | return false; |
122 | 74 | |
123 | 74 | const std::vector<uint8_t>& pub_key = m_key.get_public_key(); |
124 | 74 | BOTAN_ASSERT_EQUAL(pub_key.size(), 32, "Expected size"); |
125 | 74 | const bool ok = ed25519_verify(m_msg.data(), m_msg.size(), sig, pub_key.data(), nullptr, 0); |
126 | 74 | m_msg.clear(); |
127 | 74 | return ok; |
128 | 74 | } |
129 | | |
130 | | private: |
131 | | std::vector<uint8_t> m_msg; |
132 | | const Ed25519_PublicKey& m_key; |
133 | | }; |
134 | | |
135 | | /** |
136 | | * Ed25519 verifying operation with pre-hash |
137 | | */ |
138 | | class Ed25519_Hashed_Verify_Operation final : public PK_Ops::Verification |
139 | | { |
140 | | public: |
141 | | Ed25519_Hashed_Verify_Operation(const Ed25519_PublicKey& key, const std::string& hash, bool rfc8032) : |
142 | | m_key(key) |
143 | 0 | { |
144 | 0 | m_hash = HashFunction::create_or_throw(hash); |
145 | 0 |
|
146 | 0 | if(rfc8032) |
147 | 0 | { |
148 | 0 | m_domain_sep = { |
149 | 0 | 0x53, 0x69, 0x67, 0x45, 0x64, 0x32, 0x35, 0x35, 0x31, 0x39, 0x20, 0x6E, 0x6F, 0x20, 0x45, 0x64, |
150 | 0 | 0x32, 0x35, 0x35, 0x31, 0x39, 0x20, 0x63, 0x6F, 0x6C, 0x6C, 0x69, 0x73, 0x69, 0x6F, 0x6E, 0x73, |
151 | 0 | 0x01, 0x00 }; |
152 | 0 | } |
153 | 0 | } |
154 | | |
155 | | void update(const uint8_t msg[], size_t msg_len) override |
156 | 0 | { |
157 | 0 | m_hash->update(msg, msg_len); |
158 | 0 | } |
159 | | |
160 | | bool is_valid_signature(const uint8_t sig[], size_t sig_len) override |
161 | 0 | { |
162 | 0 | if(sig_len != 64) |
163 | 0 | return false; |
164 | 0 | std::vector<uint8_t> msg_hash(m_hash->output_length()); |
165 | 0 | m_hash->final(msg_hash.data()); |
166 | 0 |
|
167 | 0 | const std::vector<uint8_t>& pub_key = m_key.get_public_key(); |
168 | 0 | BOTAN_ASSERT_EQUAL(pub_key.size(), 32, "Expected size"); |
169 | 0 | return ed25519_verify(msg_hash.data(), msg_hash.size(), sig, pub_key.data(), m_domain_sep.data(), m_domain_sep.size()); |
170 | 0 | } |
171 | | |
172 | | private: |
173 | | std::unique_ptr<HashFunction> m_hash; |
174 | | const Ed25519_PublicKey& m_key; |
175 | | std::vector<uint8_t> m_domain_sep; |
176 | | }; |
177 | | |
178 | | /** |
179 | | * Ed25519 signing operation ('pure' - signs message directly) |
180 | | */ |
181 | | class Ed25519_Pure_Sign_Operation final : public PK_Ops::Signature |
182 | | { |
183 | | public: |
184 | | Ed25519_Pure_Sign_Operation(const Ed25519_PrivateKey& key) : m_key(key) |
185 | 0 | { |
186 | 0 | } |
187 | | |
188 | | void update(const uint8_t msg[], size_t msg_len) override |
189 | 0 | { |
190 | 0 | m_msg.insert(m_msg.end(), msg, msg + msg_len); |
191 | 0 | } |
192 | | |
193 | | secure_vector<uint8_t> sign(RandomNumberGenerator&) override |
194 | 0 | { |
195 | 0 | secure_vector<uint8_t> sig(64); |
196 | 0 | ed25519_sign(sig.data(), m_msg.data(), m_msg.size(), m_key.get_private_key().data(), nullptr, 0); |
197 | 0 | m_msg.clear(); |
198 | 0 | return sig; |
199 | 0 | } |
200 | | |
201 | 0 | size_t signature_length() const override { return 64; } |
202 | | |
203 | | private: |
204 | | std::vector<uint8_t> m_msg; |
205 | | const Ed25519_PrivateKey& m_key; |
206 | | }; |
207 | | |
208 | | /** |
209 | | * Ed25519 signing operation with pre-hash |
210 | | */ |
211 | | class Ed25519_Hashed_Sign_Operation final : public PK_Ops::Signature |
212 | | { |
213 | | public: |
214 | | Ed25519_Hashed_Sign_Operation(const Ed25519_PrivateKey& key, const std::string& hash, bool rfc8032) : |
215 | | m_key(key) |
216 | 0 | { |
217 | 0 | m_hash = HashFunction::create_or_throw(hash); |
218 | 0 |
|
219 | 0 | if(rfc8032) |
220 | 0 | { |
221 | 0 | m_domain_sep = std::vector<uint8_t>{ |
222 | 0 | 0x53, 0x69, 0x67, 0x45, 0x64, 0x32, 0x35, 0x35, 0x31, 0x39, 0x20, 0x6E, 0x6F, 0x20, 0x45, 0x64, |
223 | 0 | 0x32, 0x35, 0x35, 0x31, 0x39, 0x20, 0x63, 0x6F, 0x6C, 0x6C, 0x69, 0x73, 0x69, 0x6F, 0x6E, 0x73, |
224 | 0 | 0x01, 0x00 }; |
225 | 0 | } |
226 | 0 | } |
227 | | |
228 | 0 | size_t signature_length() const override { return 64; } |
229 | | |
230 | | void update(const uint8_t msg[], size_t msg_len) override |
231 | 0 | { |
232 | 0 | m_hash->update(msg, msg_len); |
233 | 0 | } |
234 | | |
235 | | secure_vector<uint8_t> sign(RandomNumberGenerator&) override |
236 | 0 | { |
237 | 0 | secure_vector<uint8_t> sig(64); |
238 | 0 | std::vector<uint8_t> msg_hash(m_hash->output_length()); |
239 | 0 | m_hash->final(msg_hash.data()); |
240 | 0 | ed25519_sign(sig.data(), |
241 | 0 | msg_hash.data(), msg_hash.size(), |
242 | 0 | m_key.get_private_key().data(), |
243 | 0 | m_domain_sep.data(), m_domain_sep.size()); |
244 | 0 | return sig; |
245 | 0 | } |
246 | | |
247 | | private: |
248 | | std::unique_ptr<HashFunction> m_hash; |
249 | | const Ed25519_PrivateKey& m_key; |
250 | | std::vector<uint8_t> m_domain_sep; |
251 | | }; |
252 | | |
253 | | } |
254 | | |
255 | | std::unique_ptr<PK_Ops::Verification> |
256 | | Ed25519_PublicKey::create_verification_op(const std::string& params, |
257 | | const std::string& provider) const |
258 | 74 | { |
259 | 74 | if(provider == "base" || provider.empty()) |
260 | 74 | { |
261 | 74 | if(params == "" || params == "Identity" || params == "Pure") |
262 | 74 | return std::unique_ptr<PK_Ops::Verification>(new Ed25519_Pure_Verify_Operation(*this)); |
263 | 0 | else if(params == "Ed25519ph") |
264 | 0 | return std::unique_ptr<PK_Ops::Verification>(new Ed25519_Hashed_Verify_Operation(*this, "SHA-512", true)); |
265 | 0 | else |
266 | 0 | return std::unique_ptr<PK_Ops::Verification>(new Ed25519_Hashed_Verify_Operation(*this, params, false)); |
267 | 0 | } |
268 | 0 | throw Provider_Not_Found(algo_name(), provider); |
269 | 0 | } |
270 | | |
271 | | std::unique_ptr<PK_Ops::Signature> |
272 | | Ed25519_PrivateKey::create_signature_op(RandomNumberGenerator&, |
273 | | const std::string& params, |
274 | | const std::string& provider) const |
275 | 0 | { |
276 | 0 | if(provider == "base" || provider.empty()) |
277 | 0 | { |
278 | 0 | if(params == "" || params == "Identity" || params == "Pure") |
279 | 0 | return std::unique_ptr<PK_Ops::Signature>(new Ed25519_Pure_Sign_Operation(*this)); |
280 | 0 | else if(params == "Ed25519ph") |
281 | 0 | return std::unique_ptr<PK_Ops::Signature>(new Ed25519_Hashed_Sign_Operation(*this, "SHA-512", true)); |
282 | 0 | else |
283 | 0 | return std::unique_ptr<PK_Ops::Signature>(new Ed25519_Hashed_Sign_Operation(*this, params, false)); |
284 | 0 | } |
285 | 0 | throw Provider_Not_Found(algo_name(), provider); |
286 | 0 | } |
287 | | |
288 | | } |