/src/openssl32/crypto/ec/curve448/eddsa.c

Source (jump to first uncovered line)
/*
 * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright 2015-2016 Cryptography Research, Inc.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Mike Hamburg
 */
#include <string.h>
#include <openssl/crypto.h>
#include <openssl/evp.h>
#include "crypto/ecx.h"
#include "curve448_local.h"
#include "word.h"
#include "ed448.h"
#include "internal/numbers.h"

#define COFACTOR 4

static c448_error_t oneshot_hash(OSSL_LIB_CTX *ctx, uint8_t *out, size_t outlen,
                                 const uint8_t *in, size_t inlen,
                                 const char *propq)
{
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    EVP_MD *shake256 = NULL;
    c448_error_t ret = C448_FAILURE;

    if (hashctx == NULL)
        return C448_FAILURE;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        goto err;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
            || !EVP_DigestUpdate(hashctx, in, inlen)
            || !EVP_DigestFinalXOF(hashctx, out, outlen))
        goto err;

    ret = C448_SUCCESS;
 err:
    EVP_MD_CTX_free(hashctx);
    EVP_MD_free(shake256);
    return ret;
}

static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
{
    secret_scalar_ser[0] &= -COFACTOR;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
}

static c448_error_t hash_init_with_dom(OSSL_LIB_CTX *ctx, EVP_MD_CTX *hashctx,
                                       uint8_t prehashed,
                                       uint8_t for_prehash,
                                       const uint8_t *context,
                                       size_t context_len,
                                       const char *propq)
{
    /* ASCII: "SigEd448", in hex for EBCDIC compatibility */
    const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
    uint8_t dom[2];
    EVP_MD *shake256 = NULL;

    if (context_len > UINT8_MAX)
        return C448_FAILURE;

    dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
                       - (for_prehash == 0 ? 1 : 0));
    dom[1] = (uint8_t)context_len;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        return C448_FAILURE;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
            || !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s)-1)
            || !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
            || !EVP_DigestUpdate(hashctx, context, context_len)) {
        EVP_MD_free(shake256);
        return C448_FAILURE;
    }

    EVP_MD_free(shake256);
    return C448_SUCCESS;
}

/* In this file because it uses the hash */
c448_error_t
ossl_c448_ed448_convert_private_key_to_x448(
                            OSSL_LIB_CTX *ctx,
                            uint8_t x[X448_PRIVATE_BYTES],
                            const uint8_t ed [EDDSA_448_PRIVATE_BYTES],
                            const char *propq)
{
    /* pass the private key through oneshot_hash function */
    /* and keep the first X448_PRIVATE_BYTES bytes */
    return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
                        EDDSA_448_PRIVATE_BYTES, propq);
}

c448_error_t
ossl_c448_ed448_derive_public_key(
                        OSSL_LIB_CTX *ctx,
                        uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                        const char *propq)
{
    /* only this much used for keygen */
    uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
    curve448_scalar_t secret_scalar;
    unsigned int c;
    curve448_point_t p;

    if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
                      privkey,
                      EDDSA_448_PRIVATE_BYTES,
                      propq))
        return C448_FAILURE;

    clamp(secret_scalar_ser);

    ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
                                     sizeof(secret_scalar_ser));

    /*
     * Since we are going to mul_by_cofactor during encoding, divide by it
     * here. However, the EdDSA base point is not the same as the decaf base
     * point if the sigma isogeny is in use: the EdDSA base point is on
     * Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
     * converted it effectively picks up a factor of 2 from the isogenies.  So
     * we might start at 2 instead of 1.
     */
    for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
        ossl_curve448_scalar_halve(secret_scalar, secret_scalar);

    ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
                                        secret_scalar);

    ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);

    /* Cleanup */
    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_point_destroy(p);
    OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));

    return C448_SUCCESS;
}

c448_error_t
ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
                     uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                     const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                     const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                     const uint8_t *message, size_t message_len,
                     uint8_t prehashed, const uint8_t *context,
                     size_t context_len, const char *propq)
{
    curve448_scalar_t secret_scalar;
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    c448_error_t ret = C448_FAILURE;
    curve448_scalar_t nonce_scalar;
    uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
    unsigned int c;
    curve448_scalar_t challenge_scalar;

    if (hashctx == NULL)
        return C448_FAILURE;

    {
        /*
         * Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
         * secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
         */
        uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];

        if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
                          EDDSA_448_PRIVATE_BYTES, propq))
            goto err;
        clamp(expanded);
        ossl_curve448_scalar_decode_long(secret_scalar, expanded,
                                         EDDSA_448_PRIVATE_BYTES);

        /* Hash to create the nonce */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                                context_len, propq)
                || !EVP_DigestUpdate(hashctx,
                                     expanded + EDDSA_448_PRIVATE_BYTES,
                                     EDDSA_448_PRIVATE_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)) {
            OPENSSL_cleanse(expanded, sizeof(expanded));
            goto err;
        }
        OPENSSL_cleanse(expanded, sizeof(expanded));
    }

    /* Decode the nonce */
    {
        uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];

        if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
            goto err;
        ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
        OPENSSL_cleanse(nonce, sizeof(nonce));
    }

    {
        /* Scalarmul to create the nonce-point */
        curve448_scalar_t nonce_scalar_2;
        curve448_point_t p;

        ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
        for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
            ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);

        ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
                                            nonce_scalar_2);
        ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
        ossl_curve448_point_destroy(p);
        ossl_curve448_scalar_destroy(nonce_scalar_2);
    }

    {
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        /* Compute the challenge */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
                                propq)
                || !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
                || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)
                || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
            goto err;

        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
                                         sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }

    ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
    ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);

    OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
    memcpy(signature, nonce_point, sizeof(nonce_point));
    ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
                                challenge_scalar);

    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_scalar_destroy(nonce_scalar);
    ossl_curve448_scalar_destroy(challenge_scalar);

    ret = C448_SUCCESS;
 err:
    EVP_MD_CTX_free(hashctx);
    return ret;
}

c448_error_t
ossl_c448_ed448_sign_prehash(
                        OSSL_LIB_CTX *ctx,
                        uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                        const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                        const uint8_t hash[64], const uint8_t *context,
                        size_t context_len, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
                                context, context_len, propq);
}

c448_error_t
ossl_c448_ed448_verify(
                    OSSL_LIB_CTX *ctx,
                    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                    const uint8_t *message, size_t message_len,
                    uint8_t prehashed, const uint8_t *context,
                    uint8_t context_len, const char *propq)
{
    curve448_point_t pk_point, r_point;
    c448_error_t error;
    curve448_scalar_t challenge_scalar;
    curve448_scalar_t response_scalar;
    /* Order in little endian format */
    static const uint8_t order[] = {
        0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
        0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
        0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
    };
    int i;

    /*
     * Check that s (second 57 bytes of the sig) is less than the order. Both
     * s and the order are in little-endian format. This can be done in
     * variable time, since if this is not the case the signature if publicly
     * invalid.
     */
    for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
        if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
            return C448_FAILURE;
        if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
            break;
    }
    if (i < 0)
        return C448_FAILURE;

    error =
        ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);

    if (C448_SUCCESS != error)
        return error;

    error =
        ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
    if (C448_SUCCESS != error)
        return error;

    {
        /* Compute the challenge */
        EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        if (hashctx == NULL
                || !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                                       context_len, propq)
                || !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)
                || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
            EVP_MD_CTX_free(hashctx);
            return C448_FAILURE;
        }

        EVP_MD_CTX_free(hashctx);
        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
                                         sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }
    ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
                             challenge_scalar);

    ossl_curve448_scalar_decode_long(response_scalar,
                                     &signature[EDDSA_448_PUBLIC_BYTES],
                                     EDDSA_448_PRIVATE_BYTES);

    /* pk_point = -c(x(P)) + (cx + k)G = kG */
    ossl_curve448_base_double_scalarmul_non_secret(pk_point,
                                                   response_scalar,
                                                   pk_point, challenge_scalar);
    return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
}

c448_error_t
ossl_c448_ed448_verify_prehash(
                    OSSL_LIB_CTX *ctx,
                    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                    const uint8_t hash[64], const uint8_t *context,
                    uint8_t context_len, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
                                  context_len, propq);
}

int
ossl_ed448_sign(OSSL_LIB_CTX *ctx, uint8_t *out_sig,
                const uint8_t *message, size_t message_len,
                const uint8_t public_key[57], const uint8_t private_key[57],
                const uint8_t *context, size_t context_len,
                const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
                                message_len, phflag, context, context_len,
                                propq) == C448_SUCCESS;
}

int
ossl_ed448_verify(OSSL_LIB_CTX *ctx,
                  const uint8_t *message, size_t message_len,
                  const uint8_t signature[114], const uint8_t public_key[57],
                  const uint8_t *context, size_t context_len,
                  const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, public_key, message,
                                  message_len, phflag, context, (uint8_t)context_len,
                                  propq) == C448_SUCCESS;
}

int
ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
                               const uint8_t private_key[57], const char *propq)
{
    return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
                                             propq) == C448_SUCCESS;
}

Coverage Report

Created: 2025-08-11 07:04

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright 2015-2016 Cryptography Research, Inc.
4		*
5		* Licensed under the Apache License 2.0 (the "License"). You may not use
6		* this file except in compliance with the License. You can obtain a copy
7		* in the file LICENSE in the source distribution or at
8		* https://www.openssl.org/source/license.html
9		*
10		* Originally written by Mike Hamburg
11		*/
12		#include <string.h>
13		#include <openssl/crypto.h>
14		#include <openssl/evp.h>
15		#include "crypto/ecx.h"
16		#include "curve448_local.h"
17		#include "word.h"
18		#include "ed448.h"
19		#include "internal/numbers.h"
20
21	41	#define COFACTOR 4
22
23		static c448_error_t oneshot_hash(OSSL_LIB_CTX ctx, uint8_t out, size_t outlen,
24		const uint8_t *in, size_t inlen,
25		const char *propq)
26	41	{
27	41	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
28	41	EVP_MD *shake256 = NULL;
29	41	c448_error_t ret = C448_FAILURE;
30
31	41	if (hashctx == NULL)
32	0	return C448_FAILURE;
33
34	41	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
35	41	if (shake256 == NULL)
36	0	goto err;
37
38	41	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
39	41	\|\| !EVP_DigestUpdate(hashctx, in, inlen)
40	41	\|\| !EVP_DigestFinalXOF(hashctx, out, outlen))
41	0	goto err;
42
43	41	ret = C448_SUCCESS;
44	41	err:
45	41	EVP_MD_CTX_free(hashctx);
46	41	EVP_MD_free(shake256);
47	41	return ret;
48	41	}
49
50		static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
51	41	{
52	41	secret_scalar_ser[0] &= -COFACTOR;
53	41	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
54	41	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] \|= 0x80;
55	41	}
56
57		static c448_error_t hash_init_with_dom(OSSL_LIB_CTX ctx, EVP_MD_CTX hashctx,
58		uint8_t prehashed,
59		uint8_t for_prehash,
60		const uint8_t *context,
61		size_t context_len,
62		const char *propq)
63	70	{
64		/* ASCII: "SigEd448", in hex for EBCDIC compatibility */
65	70	const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
66	70	uint8_t dom[2];
67	70	EVP_MD *shake256 = NULL;
68
69	70	if (context_len > UINT8_MAX)
70	0	return C448_FAILURE;
71
72	70	dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
73	70	- (for_prehash == 0 ? 1 : 0));
74	70	dom[1] = (uint8_t)context_len;
75
76	70	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
77	70	if (shake256 == NULL)
78	0	return C448_FAILURE;
79
80	70	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
81	70	\|\| !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s)-1)
82	70	\|\| !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
83	70	\|\| !EVP_DigestUpdate(hashctx, context, context_len)) {
84	0	EVP_MD_free(shake256);
85	0	return C448_FAILURE;
86	0	}
87
88	70	EVP_MD_free(shake256);
89	70	return C448_SUCCESS;
90	70	}
91
92		/* In this file because it uses the hash */
93		c448_error_t
94		ossl_c448_ed448_convert_private_key_to_x448(
95		OSSL_LIB_CTX *ctx,
96		uint8_t x[X448_PRIVATE_BYTES],
97		const uint8_t ed [EDDSA_448_PRIVATE_BYTES],
98		const char *propq)
99	0	{
100		/* pass the private key through oneshot_hash function */
101		/* and keep the first X448_PRIVATE_BYTES bytes */
102	0	return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
103	0	EDDSA_448_PRIVATE_BYTES, propq);
104	0	}
105
106		c448_error_t
107		ossl_c448_ed448_derive_public_key(
108		OSSL_LIB_CTX *ctx,
109		uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
110		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
111		const char *propq)
112	41	{
113		/* only this much used for keygen */
114	41	uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
115	41	curve448_scalar_t secret_scalar;
116	41	unsigned int c;
117	41	curve448_point_t p;
118
119	41	if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
120	41	privkey,
121	41	EDDSA_448_PRIVATE_BYTES,
122	41	propq))
123	0	return C448_FAILURE;
124
125	41	clamp(secret_scalar_ser);
126
127	41	ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
128	41	sizeof(secret_scalar_ser));
129
130		/*
131		* Since we are going to mul_by_cofactor during encoding, divide by it
132		* here. However, the EdDSA base point is not the same as the decaf base
133		* point if the sigma isogeny is in use: the EdDSA base point is on
134		* Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
135		* converted it effectively picks up a factor of 2 from the isogenies. So
136		* we might start at 2 instead of 1.
137		*/
138	123	for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
139	82	ossl_curve448_scalar_halve(secret_scalar, secret_scalar);
140
141	41	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
142	41	secret_scalar);
143
144	41	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);
145
146		/* Cleanup */
147	41	ossl_curve448_scalar_destroy(secret_scalar);
148	41	ossl_curve448_point_destroy(p);
149	41	OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));
150
151	41	return C448_SUCCESS;
152	41	}
153
154		c448_error_t
155		ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
156		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
157		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
158		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
159		const uint8_t *message, size_t message_len,
160		uint8_t prehashed, const uint8_t *context,
161		size_t context_len, const char *propq)
162	0	{
163	0	curve448_scalar_t secret_scalar;
164	0	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
165	0	c448_error_t ret = C448_FAILURE;
166	0	curve448_scalar_t nonce_scalar;
167	0	uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
168	0	unsigned int c;
169	0	curve448_scalar_t challenge_scalar;
170
171	0	if (hashctx == NULL)
172	0	return C448_FAILURE;
173
174	0	{
175		/*
176		* Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
177		* secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
178		*/
179	0	uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];
180
181	0	if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
182	0	EDDSA_448_PRIVATE_BYTES, propq))
183	0	goto err;
184	0	clamp(expanded);
185	0	ossl_curve448_scalar_decode_long(secret_scalar, expanded,
186	0	EDDSA_448_PRIVATE_BYTES);
187
188		/* Hash to create the nonce */
189	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
190	0	context_len, propq)
191	0	\|\| !EVP_DigestUpdate(hashctx,
192	0	expanded + EDDSA_448_PRIVATE_BYTES,
193	0	EDDSA_448_PRIVATE_BYTES)
194	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)) {
195	0	OPENSSL_cleanse(expanded, sizeof(expanded));
196	0	goto err;
197	0	}
198	0	OPENSSL_cleanse(expanded, sizeof(expanded));
199	0	}
200
201		/* Decode the nonce */
202	0	{
203	0	uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];
204
205	0	if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
206	0	goto err;
207	0	ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
208	0	OPENSSL_cleanse(nonce, sizeof(nonce));
209	0	}
210
211	0	{
212		/* Scalarmul to create the nonce-point */
213	0	curve448_scalar_t nonce_scalar_2;
214	0	curve448_point_t p;
215
216	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
217	0	for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
218	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);
219
220	0	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
221	0	nonce_scalar_2);
222	0	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
223	0	ossl_curve448_point_destroy(p);
224	0	ossl_curve448_scalar_destroy(nonce_scalar_2);
225	0	}
226
227	0	{
228	0	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
229
230		/* Compute the challenge */
231	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
232	0	propq)
233	0	\|\| !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
234	0	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
235	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
236	0	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
237	0	goto err;
238
239	0	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
240	0	sizeof(challenge));
241	0	OPENSSL_cleanse(challenge, sizeof(challenge));
242	0	}
243
244	0	ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
245	0	ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);
246
247	0	OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
248	0	memcpy(signature, nonce_point, sizeof(nonce_point));
249	0	ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
250	0	challenge_scalar);
251
252	0	ossl_curve448_scalar_destroy(secret_scalar);
253	0	ossl_curve448_scalar_destroy(nonce_scalar);
254	0	ossl_curve448_scalar_destroy(challenge_scalar);
255
256	0	ret = C448_SUCCESS;
257	0	err:
258	0	EVP_MD_CTX_free(hashctx);
259	0	return ret;
260	0	}
261
262		c448_error_t
263		ossl_c448_ed448_sign_prehash(
264		OSSL_LIB_CTX *ctx,
265		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
266		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
267		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
268		const uint8_t hash[64], const uint8_t *context,
269		size_t context_len, const char *propq)
270	0	{
271	0	return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
272	0	context, context_len, propq);
273	0	}
274
275		c448_error_t
276		ossl_c448_ed448_verify(
277		OSSL_LIB_CTX *ctx,
278		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
279		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
280		const uint8_t *message, size_t message_len,
281		uint8_t prehashed, const uint8_t *context,
282		uint8_t context_len, const char *propq)
283	82	{
284	82	curve448_point_t pk_point, r_point;
285	82	c448_error_t error;
286	82	curve448_scalar_t challenge_scalar;
287	82	curve448_scalar_t response_scalar;
288		/* Order in little endian format */
289	82	static const uint8_t order[] = {
290	82	0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
291	82	0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
292	82	0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
293	82	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
294	82	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
295	82	};
296	82	int i;
297
298		/*
299		* Check that s (second 57 bytes of the sig) is less than the order. Both
300		* s and the order are in little-endian format. This can be done in
301		* variable time, since if this is not the case the signature if publicly
302		* invalid.
303		*/
304	240	for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
305	240	if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
306	3	return C448_FAILURE;
307	237	if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
308	79	break;
309	237	}
310	79	if (i < 0)
311	0	return C448_FAILURE;
312
313	79	error =
314	79	ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);
315
316	79	if (C448_SUCCESS != error)
317	6	return error;
318
319	73	error =
320	73	ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
321	73	if (C448_SUCCESS != error)
322	3	return error;
323
324	70	{
325		/* Compute the challenge */
326	70	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
327	70	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
328
329	70	if (hashctx == NULL
330	70	\|\| !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
331	70	context_len, propq)
332	70	\|\| !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
333	70	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
334	70	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
335	70	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
336	0	EVP_MD_CTX_free(hashctx);
337	0	return C448_FAILURE;
338	0	}
339
340	70	EVP_MD_CTX_free(hashctx);
341	70	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
342	70	sizeof(challenge));
343	70	OPENSSL_cleanse(challenge, sizeof(challenge));
344	70	}
345	0	ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
346	70	challenge_scalar);
347
348	70	ossl_curve448_scalar_decode_long(response_scalar,
349	70	&signature[EDDSA_448_PUBLIC_BYTES],
350	70	EDDSA_448_PRIVATE_BYTES);
351
352		/* pk_point = -c(x(P)) + (cx + k)G = kG */
353	70	ossl_curve448_base_double_scalarmul_non_secret(pk_point,
354	70	response_scalar,
355	70	pk_point, challenge_scalar);
356	70	return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
357	70	}
358
359		c448_error_t
360		ossl_c448_ed448_verify_prehash(
361		OSSL_LIB_CTX *ctx,
362		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
363		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
364		const uint8_t hash[64], const uint8_t *context,
365		uint8_t context_len, const char *propq)
366	0	{
367	0	return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
368	0	context_len, propq);
369	0	}
370
371		int
372		ossl_ed448_sign(OSSL_LIB_CTX ctx, uint8_t out_sig,
373		const uint8_t *message, size_t message_len,
374		const uint8_t public_key[57], const uint8_t private_key[57],
375		const uint8_t *context, size_t context_len,
376		const uint8_t phflag, const char *propq)
377	0	{
378	0	return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
379	0	message_len, phflag, context, context_len,
380	0	propq) == C448_SUCCESS;
381	0	}
382
383		int
384		ossl_ed448_verify(OSSL_LIB_CTX *ctx,
385		const uint8_t *message, size_t message_len,
386		const uint8_t signature[114], const uint8_t public_key[57],
387		const uint8_t *context, size_t context_len,
388		const uint8_t phflag, const char *propq)
389	82	{
390	82	return ossl_c448_ed448_verify(ctx, signature, public_key, message,
391	82	message_len, phflag, context, (uint8_t)context_len,
392	82	propq) == C448_SUCCESS;
393	82	}
394
395		int
396		ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
397		const uint8_t private_key[57], const char *propq)
398	41	{
399	41	return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
400	41	propq) == C448_SUCCESS;
401	41	}