Coverage Report

Created: 2024-11-21 07:03

/src/botan/src/lib/pubkey/ed25519/ed25519.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* Ed25519
3
* (C) 2017 Ribose Inc
4
*
5
* Based on the public domain code from SUPERCOP ref10 by
6
* Peter Schwabe, Daniel J. Bernstein, Niels Duif, Tanja Lange, Bo-Yin Yang
7
*
8
* Botan is released under the Simplified BSD License (see license.txt)
9
*/
10
11
#include <botan/ed25519.h>
12
13
#include <botan/rng.h>
14
#include <botan/internal/ct_utils.h>
15
#include <botan/internal/ed25519_internal.h>
16
#include <botan/internal/sha2_64.h>
17
18
namespace Botan {
19
20
204
void ed25519_gen_keypair(uint8_t* pk, uint8_t* sk, const uint8_t seed[32]) {
21
204
   uint8_t az[64];
22
23
204
   SHA_512 sha;
24
204
   sha.update(seed, 32);
25
204
   sha.final(az);
26
204
   az[0] &= 248;
27
204
   az[31] &= 63;
28
204
   az[31] |= 64;
29
30
204
   ge_scalarmult_base(pk, az);
31
32
   // todo copy_mem
33
204
   copy_mem(sk, seed, 32);
34
204
   copy_mem(sk + 32, pk, 32);
35
204
}
36
37
void ed25519_sign(uint8_t sig[64],
38
                  const uint8_t m[],
39
                  size_t mlen,
40
                  const uint8_t sk[64],
41
                  const uint8_t domain_sep[],
42
204
                  size_t domain_sep_len) {
43
204
   uint8_t az[64];
44
204
   uint8_t nonce[64];
45
204
   uint8_t hram[64];
46
47
204
   SHA_512 sha;
48
49
204
   sha.update(sk, 32);
50
204
   sha.final(az);
51
204
   az[0] &= 248;
52
204
   az[31] &= 63;
53
204
   az[31] |= 64;
54
55
204
   sha.update(domain_sep, domain_sep_len);
56
204
   sha.update(az + 32, 32);
57
204
   sha.update(m, mlen);
58
204
   sha.final(nonce);
59
60
204
   sc_reduce(nonce);
61
204
   ge_scalarmult_base(sig, nonce);
62
63
204
   sha.update(domain_sep, domain_sep_len);
64
204
   sha.update(sig, 32);
65
204
   sha.update(sk + 32, 32);
66
204
   sha.update(m, mlen);
67
204
   sha.final(hram);
68
69
204
   sc_reduce(hram);
70
204
   sc_muladd(sig + 32, hram, az, nonce);
71
204
}
72
73
bool ed25519_verify(const uint8_t* m,
74
                    size_t mlen,
75
                    const uint8_t sig[64],
76
                    const uint8_t* pk,
77
                    const uint8_t domain_sep[],
78
283
                    size_t domain_sep_len) {
79
283
   uint8_t h[64];
80
283
   uint8_t rcheck[32];
81
283
   ge_p3 A;
82
283
   SHA_512 sha;
83
84
283
   if(sig[63] & 224) {
85
5
      return false;
86
5
   }
87
278
   if(ge_frombytes_negate_vartime(&A, pk) != 0) {
88
4
      return false;
89
4
   }
90
91
274
   const uint64_t CURVE25519_ORDER[4] = {
92
274
      0x1000000000000000,
93
274
      0x0000000000000000,
94
274
      0x14def9dea2f79cd6,
95
274
      0x5812631a5cf5d3ed,
96
274
   };
97
98
274
   const uint64_t s[4] = {load_le<uint64_t>(sig + 32, 3),
99
274
                          load_le<uint64_t>(sig + 32, 2),
100
274
                          load_le<uint64_t>(sig + 32, 1),
101
274
                          load_le<uint64_t>(sig + 32, 0)};
102
103
   // RFC 8032 adds the requirement that we verify that s < order in
104
   // the signature; this did not exist in the original Ed25519 spec.
105
274
   for(size_t i = 0; i != 4; ++i) {
106
274
      if(s[i] > CURVE25519_ORDER[i]) {
107
1
         return false;
108
1
      }
109
273
      if(s[i] < CURVE25519_ORDER[i]) {
110
273
         break;
111
273
      }
112
0
      if(i == 3) {  // here s == order
113
0
         return false;
114
0
      }
115
0
   }
116
117
273
   sha.update(domain_sep, domain_sep_len);
118
273
   sha.update(sig, 32);
119
273
   sha.update(pk, 32);
120
273
   sha.update(m, mlen);
121
273
   sha.final(h);
122
273
   sc_reduce(h);
123
124
273
   ge_double_scalarmult_vartime(rcheck, h, &A, sig + 32);
125
126
273
   return CT::is_equal(rcheck, sig, 32).as_bool();
127
274
}
128
129
}  // namespace Botan