/src/openssl34/crypto/ec/curve448/eddsa.c

Source (jump to first uncovered line)
/*
 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright 2015-2016 Cryptography Research, Inc.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Mike Hamburg
 */
#include <string.h>
#include <openssl/crypto.h>
#include <openssl/evp.h>
#include "crypto/ecx.h"
#include "curve448_local.h"
#include "word.h"
#include "ed448.h"
#include "internal/numbers.h"

#define COFACTOR 4

static c448_error_t oneshot_hash(OSSL_LIB_CTX *ctx, uint8_t *out, size_t outlen,
                                 const uint8_t *in, size_t inlen,
                                 const char *propq)
{
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    EVP_MD *shake256 = NULL;
    c448_error_t ret = C448_FAILURE;

    if (hashctx == NULL)
        return C448_FAILURE;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        goto err;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
            || !EVP_DigestUpdate(hashctx, in, inlen)
            || !EVP_DigestFinalXOF(hashctx, out, outlen))
        goto err;

    ret = C448_SUCCESS;
 err:
    EVP_MD_CTX_free(hashctx);
    EVP_MD_free(shake256);
    return ret;
}

static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
{
    secret_scalar_ser[0] &= -COFACTOR;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
}

static c448_error_t hash_init_with_dom(OSSL_LIB_CTX *ctx, EVP_MD_CTX *hashctx,
                                       uint8_t prehashed,
                                       uint8_t for_prehash,
                                       const uint8_t *context,
                                       size_t context_len,
                                       const char *propq)
{
    /* ASCII: "SigEd448", in hex for EBCDIC compatibility */
    const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
    uint8_t dom[2];
    EVP_MD *shake256 = NULL;

    if (context_len > UINT8_MAX)
        return C448_FAILURE;

    dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
                       - (for_prehash == 0 ? 1 : 0));
    dom[1] = (uint8_t)context_len;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        return C448_FAILURE;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
            || !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s)-1)
            || !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
            || !EVP_DigestUpdate(hashctx, context, context_len)) {
        EVP_MD_free(shake256);
        return C448_FAILURE;
    }

    EVP_MD_free(shake256);
    return C448_SUCCESS;
}

/* In this file because it uses the hash */
c448_error_t
ossl_c448_ed448_convert_private_key_to_x448(
                            OSSL_LIB_CTX *ctx,
                            uint8_t x[X448_PRIVATE_BYTES],
                            const uint8_t ed [EDDSA_448_PRIVATE_BYTES],
                            const char *propq)
{
    /* pass the private key through oneshot_hash function */
    /* and keep the first X448_PRIVATE_BYTES bytes */
    return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
                        EDDSA_448_PRIVATE_BYTES, propq);
}

c448_error_t
ossl_c448_ed448_derive_public_key(
                        OSSL_LIB_CTX *ctx,
                        uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                        const char *propq)
{
    /* only this much used for keygen */
    uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
    curve448_scalar_t secret_scalar;
    unsigned int c;
    curve448_point_t p;

    if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
                      privkey,
                      EDDSA_448_PRIVATE_BYTES,
                      propq))
        return C448_FAILURE;

    clamp(secret_scalar_ser);

    ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
                                     sizeof(secret_scalar_ser));

    /*
     * Since we are going to mul_by_cofactor during encoding, divide by it
     * here. However, the EdDSA base point is not the same as the decaf base
     * point if the sigma isogeny is in use: the EdDSA base point is on
     * Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
     * converted it effectively picks up a factor of 2 from the isogenies.  So
     * we might start at 2 instead of 1.
     */
    for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
        ossl_curve448_scalar_halve(secret_scalar, secret_scalar);

    ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
                                        secret_scalar);

    ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);

    /* Cleanup */
    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_point_destroy(p);
    OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));

    return C448_SUCCESS;
}

c448_error_t
ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
                     uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                     const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                     const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                     const uint8_t *message, size_t message_len,
                     uint8_t prehashed, const uint8_t *context,
                     size_t context_len, const char *propq)
{
    curve448_scalar_t secret_scalar;
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    c448_error_t ret = C448_FAILURE;
    curve448_scalar_t nonce_scalar;
    uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
    unsigned int c;
    curve448_scalar_t challenge_scalar;

    if (hashctx == NULL)
        return C448_FAILURE;

    {
        /*
         * Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
         * secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
         */
        uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];

        if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
                          EDDSA_448_PRIVATE_BYTES, propq))
            goto err;
        clamp(expanded);
        ossl_curve448_scalar_decode_long(secret_scalar, expanded,
                                         EDDSA_448_PRIVATE_BYTES);

        /* Hash to create the nonce */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                                context_len, propq)
                || !EVP_DigestUpdate(hashctx,
                                     expanded + EDDSA_448_PRIVATE_BYTES,
                                     EDDSA_448_PRIVATE_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)) {
            OPENSSL_cleanse(expanded, sizeof(expanded));
            goto err;
        }
        OPENSSL_cleanse(expanded, sizeof(expanded));
    }

    /* Decode the nonce */
    {
        uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];

        if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
            goto err;
        ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
        OPENSSL_cleanse(nonce, sizeof(nonce));
    }

    {
        /* Scalarmul to create the nonce-point */
        curve448_scalar_t nonce_scalar_2;
        curve448_point_t p;

        ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
        for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
            ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);

        ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
                                            nonce_scalar_2);
        ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
        ossl_curve448_point_destroy(p);
        ossl_curve448_scalar_destroy(nonce_scalar_2);
    }

    {
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        /* Compute the challenge */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
                                propq)
                || !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
                || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)
                || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
            goto err;

        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
                                         sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }

    ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
    ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);

    OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
    memcpy(signature, nonce_point, sizeof(nonce_point));
    ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
                                challenge_scalar);

    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_scalar_destroy(nonce_scalar);
    ossl_curve448_scalar_destroy(challenge_scalar);

    ret = C448_SUCCESS;
 err:
    EVP_MD_CTX_free(hashctx);
    return ret;
}

c448_error_t
ossl_c448_ed448_sign_prehash(
                        OSSL_LIB_CTX *ctx,
                        uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
                        const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                        const uint8_t hash[64], const uint8_t *context,
                        size_t context_len, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
                                context, context_len, propq);
}

static c448_error_t
c448_ed448_pubkey_verify(const uint8_t *pub, size_t pub_len)
{
    curve448_point_t pk_point;

    if (pub_len != EDDSA_448_PUBLIC_BYTES)
        return C448_FAILURE;

    return ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pub);
}

c448_error_t
ossl_c448_ed448_verify(
                    OSSL_LIB_CTX *ctx,
                    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                    const uint8_t *message, size_t message_len,
                    uint8_t prehashed, const uint8_t *context,
                    uint8_t context_len, const char *propq)
{
    curve448_point_t pk_point, r_point;
    c448_error_t error;
    curve448_scalar_t challenge_scalar;
    curve448_scalar_t response_scalar;
    /* Order in little endian format */
    static const uint8_t order[] = {
        0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
        0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
        0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
    };
    int i;

    /*
     * Check that s (second 57 bytes of the sig) is less than the order. Both
     * s and the order are in little-endian format. This can be done in
     * variable time, since if this is not the case the signature if publicly
     * invalid.
     */
    for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
        if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
            return C448_FAILURE;
        if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
            break;
    }
    if (i < 0)
        return C448_FAILURE;

    error =
        ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);

    if (C448_SUCCESS != error)
        return error;

    error =
        ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
    if (C448_SUCCESS != error)
        return error;

    {
        /* Compute the challenge */
        EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        if (hashctx == NULL
                || !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                                       context_len, propq)
                || !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
                || !EVP_DigestUpdate(hashctx, message, message_len)
                || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
            EVP_MD_CTX_free(hashctx);
            return C448_FAILURE;
        }

        EVP_MD_CTX_free(hashctx);
        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
                                         sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }
    ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
                             challenge_scalar);

    ossl_curve448_scalar_decode_long(response_scalar,
                                     &signature[EDDSA_448_PUBLIC_BYTES],
                                     EDDSA_448_PRIVATE_BYTES);

    /* pk_point = -c(x(P)) + (cx + k)G = kG */
    ossl_curve448_base_double_scalarmul_non_secret(pk_point,
                                                   response_scalar,
                                                   pk_point, challenge_scalar);
    return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
}

c448_error_t
ossl_c448_ed448_verify_prehash(
                    OSSL_LIB_CTX *ctx,
                    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
                    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
                    const uint8_t hash[64], const uint8_t *context,
                    uint8_t context_len, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
                                  context_len, propq);
}

int
ossl_ed448_sign(OSSL_LIB_CTX *ctx, uint8_t *out_sig,
                const uint8_t *message, size_t message_len,
                const uint8_t public_key[57], const uint8_t private_key[57],
                const uint8_t *context, size_t context_len,
                const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
                                message_len, phflag, context, context_len,
                                propq) == C448_SUCCESS;
}

/*
 * This function should not be necessary since ossl_ed448_verify() already
 * does this check internally.
 * For some reason the FIPS ACVP requires a EDDSA KeyVer test.
 */
int
ossl_ed448_pubkey_verify(const uint8_t *pub, size_t pub_len)
{
    return c448_ed448_pubkey_verify(pub, pub_len);
}

int
ossl_ed448_verify(OSSL_LIB_CTX *ctx,
                  const uint8_t *message, size_t message_len,
                  const uint8_t signature[114], const uint8_t public_key[57],
                  const uint8_t *context, size_t context_len,
                  const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, public_key, message,
                                  message_len, phflag, context, (uint8_t)context_len,
                                  propq) == C448_SUCCESS;
}

int
ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
                               const uint8_t private_key[57], const char *propq)
{
    return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
                                             propq) == C448_SUCCESS;
}

Coverage Report

Created: 2025-08-11 07:04

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright 2015-2016 Cryptography Research, Inc.
4		*
5		* Licensed under the Apache License 2.0 (the "License"). You may not use
6		* this file except in compliance with the License. You can obtain a copy
7		* in the file LICENSE in the source distribution or at
8		* https://www.openssl.org/source/license.html
9		*
10		* Originally written by Mike Hamburg
11		*/
12		#include <string.h>
13		#include <openssl/crypto.h>
14		#include <openssl/evp.h>
15		#include "crypto/ecx.h"
16		#include "curve448_local.h"
17		#include "word.h"
18		#include "ed448.h"
19		#include "internal/numbers.h"
20
21	41	#define COFACTOR 4
22
23		static c448_error_t oneshot_hash(OSSL_LIB_CTX ctx, uint8_t out, size_t outlen,
24		const uint8_t *in, size_t inlen,
25		const char *propq)
26	41	{
27	41	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
28	41	EVP_MD *shake256 = NULL;
29	41	c448_error_t ret = C448_FAILURE;
30
31	41	if (hashctx == NULL)
32	0	return C448_FAILURE;
33
34	41	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
35	41	if (shake256 == NULL)
36	0	goto err;
37
38	41	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
39	41	\|\| !EVP_DigestUpdate(hashctx, in, inlen)
40	41	\|\| !EVP_DigestFinalXOF(hashctx, out, outlen))
41	0	goto err;
42
43	41	ret = C448_SUCCESS;
44	41	err:
45	41	EVP_MD_CTX_free(hashctx);
46	41	EVP_MD_free(shake256);
47	41	return ret;
48	41	}
49
50		static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
51	41	{
52	41	secret_scalar_ser[0] &= -COFACTOR;
53	41	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
54	41	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] \|= 0x80;
55	41	}
56
57		static c448_error_t hash_init_with_dom(OSSL_LIB_CTX ctx, EVP_MD_CTX hashctx,
58		uint8_t prehashed,
59		uint8_t for_prehash,
60		const uint8_t *context,
61		size_t context_len,
62		const char *propq)
63	70	{
64		/* ASCII: "SigEd448", in hex for EBCDIC compatibility */
65	70	const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
66	70	uint8_t dom[2];
67	70	EVP_MD *shake256 = NULL;
68
69	70	if (context_len > UINT8_MAX)
70	0	return C448_FAILURE;
71
72	70	dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
73	70	- (for_prehash == 0 ? 1 : 0));
74	70	dom[1] = (uint8_t)context_len;
75
76	70	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
77	70	if (shake256 == NULL)
78	0	return C448_FAILURE;
79
80	70	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
81	70	\|\| !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s)-1)
82	70	\|\| !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
83	70	\|\| !EVP_DigestUpdate(hashctx, context, context_len)) {
84	0	EVP_MD_free(shake256);
85	0	return C448_FAILURE;
86	0	}
87
88	70	EVP_MD_free(shake256);
89	70	return C448_SUCCESS;
90	70	}
91
92		/* In this file because it uses the hash */
93		c448_error_t
94		ossl_c448_ed448_convert_private_key_to_x448(
95		OSSL_LIB_CTX *ctx,
96		uint8_t x[X448_PRIVATE_BYTES],
97		const uint8_t ed [EDDSA_448_PRIVATE_BYTES],
98		const char *propq)
99	0	{
100		/* pass the private key through oneshot_hash function */
101		/* and keep the first X448_PRIVATE_BYTES bytes */
102	0	return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
103	0	EDDSA_448_PRIVATE_BYTES, propq);
104	0	}
105
106		c448_error_t
107		ossl_c448_ed448_derive_public_key(
108		OSSL_LIB_CTX *ctx,
109		uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
110		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
111		const char *propq)
112	41	{
113		/* only this much used for keygen */
114	41	uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
115	41	curve448_scalar_t secret_scalar;
116	41	unsigned int c;
117	41	curve448_point_t p;
118
119	41	if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
120	41	privkey,
121	41	EDDSA_448_PRIVATE_BYTES,
122	41	propq))
123	0	return C448_FAILURE;
124
125	41	clamp(secret_scalar_ser);
126
127	41	ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
128	41	sizeof(secret_scalar_ser));
129
130		/*
131		* Since we are going to mul_by_cofactor during encoding, divide by it
132		* here. However, the EdDSA base point is not the same as the decaf base
133		* point if the sigma isogeny is in use: the EdDSA base point is on
134		* Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
135		* converted it effectively picks up a factor of 2 from the isogenies. So
136		* we might start at 2 instead of 1.
137		*/
138	123	for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
139	82	ossl_curve448_scalar_halve(secret_scalar, secret_scalar);
140
141	41	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
142	41	secret_scalar);
143
144	41	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);
145
146		/* Cleanup */
147	41	ossl_curve448_scalar_destroy(secret_scalar);
148	41	ossl_curve448_point_destroy(p);
149	41	OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));
150
151	41	return C448_SUCCESS;
152	41	}
153
154		c448_error_t
155		ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
156		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
157		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
158		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
159		const uint8_t *message, size_t message_len,
160		uint8_t prehashed, const uint8_t *context,
161		size_t context_len, const char *propq)
162	0	{
163	0	curve448_scalar_t secret_scalar;
164	0	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
165	0	c448_error_t ret = C448_FAILURE;
166	0	curve448_scalar_t nonce_scalar;
167	0	uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
168	0	unsigned int c;
169	0	curve448_scalar_t challenge_scalar;
170
171	0	if (hashctx == NULL)
172	0	return C448_FAILURE;
173
174	0	{
175		/*
176		* Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
177		* secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
178		*/
179	0	uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];
180
181	0	if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
182	0	EDDSA_448_PRIVATE_BYTES, propq))
183	0	goto err;
184	0	clamp(expanded);
185	0	ossl_curve448_scalar_decode_long(secret_scalar, expanded,
186	0	EDDSA_448_PRIVATE_BYTES);
187
188		/* Hash to create the nonce */
189	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
190	0	context_len, propq)
191	0	\|\| !EVP_DigestUpdate(hashctx,
192	0	expanded + EDDSA_448_PRIVATE_BYTES,
193	0	EDDSA_448_PRIVATE_BYTES)
194	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)) {
195	0	OPENSSL_cleanse(expanded, sizeof(expanded));
196	0	goto err;
197	0	}
198	0	OPENSSL_cleanse(expanded, sizeof(expanded));
199	0	}
200
201		/* Decode the nonce */
202	0	{
203	0	uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];
204
205	0	if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
206	0	goto err;
207	0	ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
208	0	OPENSSL_cleanse(nonce, sizeof(nonce));
209	0	}
210
211	0	{
212		/* Scalarmul to create the nonce-point */
213	0	curve448_scalar_t nonce_scalar_2;
214	0	curve448_point_t p;
215
216	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
217	0	for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
218	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);
219
220	0	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
221	0	nonce_scalar_2);
222	0	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
223	0	ossl_curve448_point_destroy(p);
224	0	ossl_curve448_scalar_destroy(nonce_scalar_2);
225	0	}
226
227	0	{
228	0	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
229
230		/* Compute the challenge */
231	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
232	0	propq)
233	0	\|\| !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
234	0	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
235	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
236	0	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
237	0	goto err;
238
239	0	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
240	0	sizeof(challenge));
241	0	OPENSSL_cleanse(challenge, sizeof(challenge));
242	0	}
243
244	0	ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
245	0	ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);
246
247	0	OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
248	0	memcpy(signature, nonce_point, sizeof(nonce_point));
249	0	ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
250	0	challenge_scalar);
251
252	0	ossl_curve448_scalar_destroy(secret_scalar);
253	0	ossl_curve448_scalar_destroy(nonce_scalar);
254	0	ossl_curve448_scalar_destroy(challenge_scalar);
255
256	0	ret = C448_SUCCESS;
257	0	err:
258	0	EVP_MD_CTX_free(hashctx);
259	0	return ret;
260	0	}
261
262		c448_error_t
263		ossl_c448_ed448_sign_prehash(
264		OSSL_LIB_CTX *ctx,
265		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
266		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
267		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
268		const uint8_t hash[64], const uint8_t *context,
269		size_t context_len, const char *propq)
270	0	{
271	0	return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
272	0	context, context_len, propq);
273	0	}
274
275		static c448_error_t
276		c448_ed448_pubkey_verify(const uint8_t *pub, size_t pub_len)
277	0	{
278	0	curve448_point_t pk_point;
279
280	0	if (pub_len != EDDSA_448_PUBLIC_BYTES)
281	0	return C448_FAILURE;
282
283	0	return ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pub);
284	0	}
285
286		c448_error_t
287		ossl_c448_ed448_verify(
288		OSSL_LIB_CTX *ctx,
289		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
290		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
291		const uint8_t *message, size_t message_len,
292		uint8_t prehashed, const uint8_t *context,
293		uint8_t context_len, const char *propq)
294	82	{
295	82	curve448_point_t pk_point, r_point;
296	82	c448_error_t error;
297	82	curve448_scalar_t challenge_scalar;
298	82	curve448_scalar_t response_scalar;
299		/* Order in little endian format */
300	82	static const uint8_t order[] = {
301	82	0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
302	82	0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
303	82	0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
304	82	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
305	82	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
306	82	};
307	82	int i;
308
309		/*
310		* Check that s (second 57 bytes of the sig) is less than the order. Both
311		* s and the order are in little-endian format. This can be done in
312		* variable time, since if this is not the case the signature if publicly
313		* invalid.
314		*/
315	240	for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
316	240	if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
317	3	return C448_FAILURE;
318	237	if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
319	79	break;
320	237	}
321	79	if (i < 0)
322	0	return C448_FAILURE;
323
324	79	error =
325	79	ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);
326
327	79	if (C448_SUCCESS != error)
328	6	return error;
329
330	73	error =
331	73	ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
332	73	if (C448_SUCCESS != error)
333	3	return error;
334
335	70	{
336		/* Compute the challenge */
337	70	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
338	70	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
339
340	70	if (hashctx == NULL
341	70	\|\| !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
342	70	context_len, propq)
343	70	\|\| !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
344	70	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
345	70	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
346	70	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
347	0	EVP_MD_CTX_free(hashctx);
348	0	return C448_FAILURE;
349	0	}
350
351	70	EVP_MD_CTX_free(hashctx);
352	70	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
353	70	sizeof(challenge));
354	70	OPENSSL_cleanse(challenge, sizeof(challenge));
355	70	}
356	0	ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
357	70	challenge_scalar);
358
359	70	ossl_curve448_scalar_decode_long(response_scalar,
360	70	&signature[EDDSA_448_PUBLIC_BYTES],
361	70	EDDSA_448_PRIVATE_BYTES);
362
363		/* pk_point = -c(x(P)) + (cx + k)G = kG */
364	70	ossl_curve448_base_double_scalarmul_non_secret(pk_point,
365	70	response_scalar,
366	70	pk_point, challenge_scalar);
367	70	return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
368	70	}
369
370		c448_error_t
371		ossl_c448_ed448_verify_prehash(
372		OSSL_LIB_CTX *ctx,
373		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
374		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
375		const uint8_t hash[64], const uint8_t *context,
376		uint8_t context_len, const char *propq)
377	0	{
378	0	return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
379	0	context_len, propq);
380	0	}
381
382		int
383		ossl_ed448_sign(OSSL_LIB_CTX ctx, uint8_t out_sig,
384		const uint8_t *message, size_t message_len,
385		const uint8_t public_key[57], const uint8_t private_key[57],
386		const uint8_t *context, size_t context_len,
387		const uint8_t phflag, const char *propq)
388	0	{
389	0	return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
390	0	message_len, phflag, context, context_len,
391	0	propq) == C448_SUCCESS;
392	0	}
393
394		/*
395		* This function should not be necessary since ossl_ed448_verify() already
396		* does this check internally.
397		* For some reason the FIPS ACVP requires a EDDSA KeyVer test.
398		*/
399		int
400		ossl_ed448_pubkey_verify(const uint8_t *pub, size_t pub_len)
401	0	{
402	0	return c448_ed448_pubkey_verify(pub, pub_len);
403	0	}
404
405		int
406		ossl_ed448_verify(OSSL_LIB_CTX *ctx,
407		const uint8_t *message, size_t message_len,
408		const uint8_t signature[114], const uint8_t public_key[57],
409		const uint8_t *context, size_t context_len,
410		const uint8_t phflag, const char *propq)
411	82	{
412	82	return ossl_c448_ed448_verify(ctx, signature, public_key, message,
413	82	message_len, phflag, context, (uint8_t)context_len,
414	82	propq) == C448_SUCCESS;
415	82	}
416
417		int
418		ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
419		const uint8_t private_key[57], const char *propq)
420	41	{
421	41	return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
422	41	propq) == C448_SUCCESS;
423	41	}