/src/openssl33/crypto/ec/curve448/eddsa.c

Source
/*
 * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright 2015-2016 Cryptography Research, Inc.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Mike Hamburg
 */
#include <string.h>
#include <openssl/crypto.h>
#include <openssl/evp.h>
#include "crypto/ecx.h"
#include "curve448_local.h"
#include "word.h"
#include "ed448.h"
#include "internal/numbers.h"

#define COFACTOR 4

static c448_error_t oneshot_hash(OSSL_LIB_CTX *ctx, uint8_t *out, size_t outlen,
    const uint8_t *in, size_t inlen,
    const char *propq)
{
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    EVP_MD *shake256 = NULL;
    c448_error_t ret = C448_FAILURE;

    if (hashctx == NULL)
        return C448_FAILURE;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        goto err;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
        || !EVP_DigestUpdate(hashctx, in, inlen)
        || !EVP_DigestFinalXOF(hashctx, out, outlen))
        goto err;

    ret = C448_SUCCESS;
err:
    EVP_MD_CTX_free(hashctx);
    EVP_MD_free(shake256);
    return ret;
}

static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
{
    secret_scalar_ser[0] &= -COFACTOR;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
    secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
}

static c448_error_t hash_init_with_dom(OSSL_LIB_CTX *ctx, EVP_MD_CTX *hashctx,
    uint8_t prehashed,
    uint8_t for_prehash,
    const uint8_t *context,
    size_t context_len,
    const char *propq)
{
    /* ASCII: "SigEd448", in hex for EBCDIC compatibility */
    const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
    uint8_t dom[2];
    EVP_MD *shake256 = NULL;

    if (context_len > UINT8_MAX)
        return C448_FAILURE;

    dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
        - (for_prehash == 0 ? 1 : 0));
    dom[1] = (uint8_t)context_len;

    shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
    if (shake256 == NULL)
        return C448_FAILURE;

    if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
        || !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s) - 1)
        || !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
        || !EVP_DigestUpdate(hashctx, context, context_len)) {
        EVP_MD_free(shake256);
        return C448_FAILURE;
    }

    EVP_MD_free(shake256);
    return C448_SUCCESS;
}

/* In this file because it uses the hash */
c448_error_t
ossl_c448_ed448_convert_private_key_to_x448(
    OSSL_LIB_CTX *ctx,
    uint8_t x[X448_PRIVATE_BYTES],
    const uint8_t ed[EDDSA_448_PRIVATE_BYTES],
    const char *propq)
{
    /* pass the private key through oneshot_hash function */
    /* and keep the first X448_PRIVATE_BYTES bytes */
    return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
        EDDSA_448_PRIVATE_BYTES, propq);
}

c448_error_t
ossl_c448_ed448_derive_public_key(
    OSSL_LIB_CTX *ctx,
    uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
    const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
    const char *propq)
{
    /* only this much used for keygen */
    uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
    curve448_scalar_t secret_scalar;
    unsigned int c;
    curve448_point_t p;

    if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
            privkey,
            EDDSA_448_PRIVATE_BYTES,
            propq))
        return C448_FAILURE;

    clamp(secret_scalar_ser);

    ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
        sizeof(secret_scalar_ser));

    /*
     * Since we are going to mul_by_cofactor during encoding, divide by it
     * here. However, the EdDSA base point is not the same as the decaf base
     * point if the sigma isogeny is in use: the EdDSA base point is on
     * Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
     * converted it effectively picks up a factor of 2 from the isogenies.  So
     * we might start at 2 instead of 1.
     */
    for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
        ossl_curve448_scalar_halve(secret_scalar, secret_scalar);

    ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
        secret_scalar);

    ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);

    /* Cleanup */
    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_point_destroy(p);
    OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));

    return C448_SUCCESS;
}

c448_error_t
ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
    uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
    const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
    const uint8_t *message, size_t message_len,
    uint8_t prehashed, const uint8_t *context,
    size_t context_len, const char *propq)
{
    curve448_scalar_t secret_scalar;
    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
    c448_error_t ret = C448_FAILURE;
    curve448_scalar_t nonce_scalar;
    uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
    unsigned int c;
    curve448_scalar_t challenge_scalar;

    if (hashctx == NULL)
        return C448_FAILURE;

    {
        /*
         * Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
         * secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
         */
        uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];

        if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
                EDDSA_448_PRIVATE_BYTES, propq))
            goto err;
        clamp(expanded);
        ossl_curve448_scalar_decode_long(secret_scalar, expanded,
            EDDSA_448_PRIVATE_BYTES);

        /* Hash to create the nonce */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                context_len, propq)
            || !EVP_DigestUpdate(hashctx,
                expanded + EDDSA_448_PRIVATE_BYTES,
                EDDSA_448_PRIVATE_BYTES)
            || !EVP_DigestUpdate(hashctx, message, message_len)) {
            OPENSSL_cleanse(expanded, sizeof(expanded));
            goto err;
        }
        OPENSSL_cleanse(expanded, sizeof(expanded));
    }

    /* Decode the nonce */
    {
        uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];

        if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
            goto err;
        ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
        OPENSSL_cleanse(nonce, sizeof(nonce));
    }

    {
        /* Scalarmul to create the nonce-point */
        curve448_scalar_t nonce_scalar_2;
        curve448_point_t p;

        ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
        for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
            ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);

        ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
            nonce_scalar_2);
        ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
        ossl_curve448_point_destroy(p);
        ossl_curve448_scalar_destroy(nonce_scalar_2);
    }

    {
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        /* Compute the challenge */
        if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
                propq)
            || !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
            || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
            || !EVP_DigestUpdate(hashctx, message, message_len)
            || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
            goto err;

        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
            sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }

    ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
    ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);

    OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
    memcpy(signature, nonce_point, sizeof(nonce_point));
    ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
        challenge_scalar);

    ossl_curve448_scalar_destroy(secret_scalar);
    ossl_curve448_scalar_destroy(nonce_scalar);
    ossl_curve448_scalar_destroy(challenge_scalar);

    ret = C448_SUCCESS;
err:
    EVP_MD_CTX_free(hashctx);
    return ret;
}

c448_error_t
ossl_c448_ed448_sign_prehash(
    OSSL_LIB_CTX *ctx,
    uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
    const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
    const uint8_t hash[64], const uint8_t *context,
    size_t context_len, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
        context, context_len, propq);
}

c448_error_t
ossl_c448_ed448_verify(
    OSSL_LIB_CTX *ctx,
    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
    const uint8_t *message, size_t message_len,
    uint8_t prehashed, const uint8_t *context,
    uint8_t context_len, const char *propq)
{
    curve448_point_t pk_point, r_point;
    c448_error_t error;
    curve448_scalar_t challenge_scalar;
    curve448_scalar_t response_scalar;
    /* Order in little endian format */
    static const uint8_t order[] = {
        0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
        0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
        0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
    };
    int i;

    /*
     * Check that s (second 57 bytes of the sig) is less than the order. Both
     * s and the order are in little-endian format. This can be done in
     * variable time, since if this is not the case the signature if publicly
     * invalid.
     */
    for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
        if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
            return C448_FAILURE;
        if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
            break;
    }
    if (i < 0)
        return C448_FAILURE;

    error = ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);

    if (C448_SUCCESS != error)
        return error;

    error = ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
    if (C448_SUCCESS != error)
        return error;

    {
        /* Compute the challenge */
        EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];

        if (hashctx == NULL
            || !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
                context_len, propq)
            || !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
            || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
            || !EVP_DigestUpdate(hashctx, message, message_len)
            || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
            EVP_MD_CTX_free(hashctx);
            return C448_FAILURE;
        }

        EVP_MD_CTX_free(hashctx);
        ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
            sizeof(challenge));
        OPENSSL_cleanse(challenge, sizeof(challenge));
    }
    ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
        challenge_scalar);

    ossl_curve448_scalar_decode_long(response_scalar,
        &signature[EDDSA_448_PUBLIC_BYTES],
        EDDSA_448_PRIVATE_BYTES);

    /* pk_point = -c(x(P)) + (cx + k)G = kG */
    ossl_curve448_base_double_scalarmul_non_secret(pk_point,
        response_scalar,
        pk_point, challenge_scalar);
    return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
}

c448_error_t
ossl_c448_ed448_verify_prehash(
    OSSL_LIB_CTX *ctx,
    const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
    const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
    const uint8_t hash[64], const uint8_t *context,
    uint8_t context_len, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
        context_len, propq);
}

int ossl_ed448_sign(OSSL_LIB_CTX *ctx, uint8_t *out_sig,
    const uint8_t *message, size_t message_len,
    const uint8_t public_key[57], const uint8_t private_key[57],
    const uint8_t *context, size_t context_len,
    const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
               message_len, phflag, context, context_len,
               propq)
        == C448_SUCCESS;
}

int ossl_ed448_verify(OSSL_LIB_CTX *ctx,
    const uint8_t *message, size_t message_len,
    const uint8_t signature[114], const uint8_t public_key[57],
    const uint8_t *context, size_t context_len,
    const uint8_t phflag, const char *propq)
{
    return ossl_c448_ed448_verify(ctx, signature, public_key, message,
               message_len, phflag, context, (uint8_t)context_len,
               propq)
        == C448_SUCCESS;
}

int ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
    const uint8_t private_key[57], const char *propq)
{
    return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
               propq)
        == C448_SUCCESS;
}

Coverage Report

Created: 2026-02-14 07:20

Line	Count	Source
1		/*
2		* Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright 2015-2016 Cryptography Research, Inc.
4		*
5		* Licensed under the Apache License 2.0 (the "License"). You may not use
6		* this file except in compliance with the License. You can obtain a copy
7		* in the file LICENSE in the source distribution or at
8		* https://www.openssl.org/source/license.html
9		*
10		* Originally written by Mike Hamburg
11		*/
12		#include <string.h>
13		#include <openssl/crypto.h>
14		#include <openssl/evp.h>
15		#include "crypto/ecx.h"
16		#include "curve448_local.h"
17		#include "word.h"
18		#include "ed448.h"
19		#include "internal/numbers.h"
20
21	23	#define COFACTOR 4
22
23		static c448_error_t oneshot_hash(OSSL_LIB_CTX ctx, uint8_t out, size_t outlen,
24		const uint8_t *in, size_t inlen,
25		const char *propq)
26	23	{
27	23	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
28	23	EVP_MD *shake256 = NULL;
29	23	c448_error_t ret = C448_FAILURE;
30
31	23	if (hashctx == NULL)
32	0	return C448_FAILURE;
33
34	23	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
35	23	if (shake256 == NULL)
36	0	goto err;
37
38	23	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
39	23	\|\| !EVP_DigestUpdate(hashctx, in, inlen)
40	23	\|\| !EVP_DigestFinalXOF(hashctx, out, outlen))
41	0	goto err;
42
43	23	ret = C448_SUCCESS;
44	23	err:
45	23	EVP_MD_CTX_free(hashctx);
46	23	EVP_MD_free(shake256);
47	23	return ret;
48	23	}
49
50		static void clamp(uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES])
51	23	{
52	23	secret_scalar_ser[0] &= -COFACTOR;
53	23	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 1] = 0;
54	23	secret_scalar_ser[EDDSA_448_PRIVATE_BYTES - 2] \|= 0x80;
55	23	}
56
57		static c448_error_t hash_init_with_dom(OSSL_LIB_CTX ctx, EVP_MD_CTX hashctx,
58		uint8_t prehashed,
59		uint8_t for_prehash,
60		const uint8_t *context,
61		size_t context_len,
62		const char *propq)
63	45	{
64		/* ASCII: "SigEd448", in hex for EBCDIC compatibility */
65	45	const char dom_s[] = "\x53\x69\x67\x45\x64\x34\x34\x38";
66	45	uint8_t dom[2];
67	45	EVP_MD *shake256 = NULL;
68
69	45	if (context_len > UINT8_MAX)
70	0	return C448_FAILURE;
71
72	45	dom[0] = (uint8_t)(2 - (prehashed == 0 ? 1 : 0)
73	45	- (for_prehash == 0 ? 1 : 0));
74	45	dom[1] = (uint8_t)context_len;
75
76	45	shake256 = EVP_MD_fetch(ctx, "SHAKE256", propq);
77	45	if (shake256 == NULL)
78	0	return C448_FAILURE;
79
80	45	if (!EVP_DigestInit_ex(hashctx, shake256, NULL)
81	45	\|\| !EVP_DigestUpdate(hashctx, dom_s, sizeof(dom_s) - 1)
82	45	\|\| !EVP_DigestUpdate(hashctx, dom, sizeof(dom))
83	45	\|\| !EVP_DigestUpdate(hashctx, context, context_len)) {
84	0	EVP_MD_free(shake256);
85	0	return C448_FAILURE;
86	0	}
87
88	45	EVP_MD_free(shake256);
89	45	return C448_SUCCESS;
90	45	}
91
92		/* In this file because it uses the hash */
93		c448_error_t
94		ossl_c448_ed448_convert_private_key_to_x448(
95		OSSL_LIB_CTX *ctx,
96		uint8_t x[X448_PRIVATE_BYTES],
97		const uint8_t ed[EDDSA_448_PRIVATE_BYTES],
98		const char *propq)
99	0	{
100		/* pass the private key through oneshot_hash function */
101		/* and keep the first X448_PRIVATE_BYTES bytes */
102	0	return oneshot_hash(ctx, x, X448_PRIVATE_BYTES, ed,
103	0	EDDSA_448_PRIVATE_BYTES, propq);
104	0	}
105
106		c448_error_t
107		ossl_c448_ed448_derive_public_key(
108		OSSL_LIB_CTX *ctx,
109		uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
110		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
111		const char *propq)
112	23	{
113		/* only this much used for keygen */
114	23	uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];
115	23	curve448_scalar_t secret_scalar;
116	23	unsigned int c;
117	23	curve448_point_t p;
118
119	23	if (!oneshot_hash(ctx, secret_scalar_ser, sizeof(secret_scalar_ser),
120	23	privkey,
121	23	EDDSA_448_PRIVATE_BYTES,
122	23	propq))
123	0	return C448_FAILURE;
124
125	23	clamp(secret_scalar_ser);
126
127	23	ossl_curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
128	23	sizeof(secret_scalar_ser));
129
130		/*
131		* Since we are going to mul_by_cofactor during encoding, divide by it
132		* here. However, the EdDSA base point is not the same as the decaf base
133		* point if the sigma isogeny is in use: the EdDSA base point is on
134		* Etwist_d/(1-d) and the decaf base point is on Etwist_d, and when
135		* converted it effectively picks up a factor of 2 from the isogenies. So
136		* we might start at 2 instead of 1.
137		*/
138	69	for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
139	46	ossl_curve448_scalar_halve(secret_scalar, secret_scalar);
140
141	23	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
142	23	secret_scalar);
143
144	23	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);
145
146		/* Cleanup */
147	23	ossl_curve448_scalar_destroy(secret_scalar);
148	23	ossl_curve448_point_destroy(p);
149	23	OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));
150
151	23	return C448_SUCCESS;
152	23	}
153
154		c448_error_t
155		ossl_c448_ed448_sign(OSSL_LIB_CTX *ctx,
156		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
157		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
158		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
159		const uint8_t *message, size_t message_len,
160		uint8_t prehashed, const uint8_t *context,
161		size_t context_len, const char *propq)
162	0	{
163	0	curve448_scalar_t secret_scalar;
164	0	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
165	0	c448_error_t ret = C448_FAILURE;
166	0	curve448_scalar_t nonce_scalar;
167	0	uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };
168	0	unsigned int c;
169	0	curve448_scalar_t challenge_scalar;
170
171	0	if (hashctx == NULL)
172	0	return C448_FAILURE;
173
174	0	{
175		/*
176		* Schedule the secret key, First EDDSA_448_PRIVATE_BYTES is serialized
177		* secret scalar,next EDDSA_448_PRIVATE_BYTES bytes is the seed.
178		*/
179	0	uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];
180
181	0	if (!oneshot_hash(ctx, expanded, sizeof(expanded), privkey,
182	0	EDDSA_448_PRIVATE_BYTES, propq))
183	0	goto err;
184	0	clamp(expanded);
185	0	ossl_curve448_scalar_decode_long(secret_scalar, expanded,
186	0	EDDSA_448_PRIVATE_BYTES);
187
188		/* Hash to create the nonce */
189	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
190	0	context_len, propq)
191	0	\|\| !EVP_DigestUpdate(hashctx,
192	0	expanded + EDDSA_448_PRIVATE_BYTES,
193	0	EDDSA_448_PRIVATE_BYTES)
194	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)) {
195	0	OPENSSL_cleanse(expanded, sizeof(expanded));
196	0	goto err;
197	0	}
198	0	OPENSSL_cleanse(expanded, sizeof(expanded));
199	0	}
200
201		/* Decode the nonce */
202	0	{
203	0	uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];
204
205	0	if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
206	0	goto err;
207	0	ossl_curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
208	0	OPENSSL_cleanse(nonce, sizeof(nonce));
209	0	}
210
211	0	{
212		/* Scalarmul to create the nonce-point */
213	0	curve448_scalar_t nonce_scalar_2;
214	0	curve448_point_t p;
215
216	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
217	0	for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
218	0	ossl_curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);
219
220	0	ossl_curve448_precomputed_scalarmul(p, ossl_curve448_precomputed_base,
221	0	nonce_scalar_2);
222	0	ossl_curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);
223	0	ossl_curve448_point_destroy(p);
224	0	ossl_curve448_scalar_destroy(nonce_scalar_2);
225	0	}
226
227	0	{
228	0	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
229
230		/* Compute the challenge */
231	0	if (!hash_init_with_dom(ctx, hashctx, prehashed, 0, context, context_len,
232	0	propq)
233	0	\|\| !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))
234	0	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
235	0	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
236	0	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))
237	0	goto err;
238
239	0	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
240	0	sizeof(challenge));
241	0	OPENSSL_cleanse(challenge, sizeof(challenge));
242	0	}
243
244	0	ossl_curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);
245	0	ossl_curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);
246
247	0	OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);
248	0	memcpy(signature, nonce_point, sizeof(nonce_point));
249	0	ossl_curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],
250	0	challenge_scalar);
251
252	0	ossl_curve448_scalar_destroy(secret_scalar);
253	0	ossl_curve448_scalar_destroy(nonce_scalar);
254	0	ossl_curve448_scalar_destroy(challenge_scalar);
255
256	0	ret = C448_SUCCESS;
257	0	err:
258	0	EVP_MD_CTX_free(hashctx);
259	0	return ret;
260	0	}
261
262		c448_error_t
263		ossl_c448_ed448_sign_prehash(
264		OSSL_LIB_CTX *ctx,
265		uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
266		const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],
267		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
268		const uint8_t hash[64], const uint8_t *context,
269		size_t context_len, const char *propq)
270	0	{
271	0	return ossl_c448_ed448_sign(ctx, signature, privkey, pubkey, hash, 64, 1,
272	0	context, context_len, propq);
273	0	}
274
275		c448_error_t
276		ossl_c448_ed448_verify(
277		OSSL_LIB_CTX *ctx,
278		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
279		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
280		const uint8_t *message, size_t message_len,
281		uint8_t prehashed, const uint8_t *context,
282		uint8_t context_len, const char *propq)
283	64	{
284	64	curve448_point_t pk_point, r_point;
285	64	c448_error_t error;
286	64	curve448_scalar_t challenge_scalar;
287	64	curve448_scalar_t response_scalar;
288		/* Order in little endian format */
289	64	static const uint8_t order[] = {
290	64	0xF3, 0x44, 0x58, 0xAB, 0x92, 0xC2, 0x78, 0x23, 0x55, 0x8F, 0xC5, 0x8D,
291	64	0x72, 0xC2, 0x6C, 0x21, 0x90, 0x36, 0xD6, 0xAE, 0x49, 0xDB, 0x4E, 0xC4,
292	64	0xE9, 0x23, 0xCA, 0x7C, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
293	64	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
294	64	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x3F, 0x00
295	64	};
296	64	int i;
297
298		/*
299		* Check that s (second 57 bytes of the sig) is less than the order. Both
300		* s and the order are in little-endian format. This can be done in
301		* variable time, since if this is not the case the signature if publicly
302		* invalid.
303		*/
304	184	for (i = EDDSA_448_PUBLIC_BYTES - 1; i >= 0; i--) {
305	184	if (signature[i + EDDSA_448_PUBLIC_BYTES] > order[i])
306	7	return C448_FAILURE;
307	177	if (signature[i + EDDSA_448_PUBLIC_BYTES] < order[i])
308	57	break;
309	177	}
310	57	if (i < 0)
311	0	return C448_FAILURE;
312
313	57	error = ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(pk_point, pubkey);
314
315	57	if (C448_SUCCESS != error)
316	8	return error;
317
318	49	error = ossl_curve448_point_decode_like_eddsa_and_mul_by_ratio(r_point, signature);
319	49	if (C448_SUCCESS != error)
320	4	return error;
321
322	45	{
323		/* Compute the challenge */
324	45	EVP_MD_CTX *hashctx = EVP_MD_CTX_new();
325	45	uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];
326
327	45	if (hashctx == NULL
328	45	\|\| !hash_init_with_dom(ctx, hashctx, prehashed, 0, context,
329	45	context_len, propq)
330	45	\|\| !EVP_DigestUpdate(hashctx, signature, EDDSA_448_PUBLIC_BYTES)
331	45	\|\| !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)
332	45	\|\| !EVP_DigestUpdate(hashctx, message, message_len)
333	45	\|\| !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge))) {
334	0	EVP_MD_CTX_free(hashctx);
335	0	return C448_FAILURE;
336	0	}
337
338	45	EVP_MD_CTX_free(hashctx);
339	45	ossl_curve448_scalar_decode_long(challenge_scalar, challenge,
340	45	sizeof(challenge));
341	45	OPENSSL_cleanse(challenge, sizeof(challenge));
342	45	}
343	0	ossl_curve448_scalar_sub(challenge_scalar, ossl_curve448_scalar_zero,
344	45	challenge_scalar);
345
346	45	ossl_curve448_scalar_decode_long(response_scalar,
347	45	&signature[EDDSA_448_PUBLIC_BYTES],
348	45	EDDSA_448_PRIVATE_BYTES);
349
350		/* pk_point = -c(x(P)) + (cx + k)G = kG */
351	45	ossl_curve448_base_double_scalarmul_non_secret(pk_point,
352	45	response_scalar,
353	45	pk_point, challenge_scalar);
354	45	return c448_succeed_if(ossl_curve448_point_eq(pk_point, r_point));
355	45	}
356
357		c448_error_t
358		ossl_c448_ed448_verify_prehash(
359		OSSL_LIB_CTX *ctx,
360		const uint8_t signature[EDDSA_448_SIGNATURE_BYTES],
361		const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],
362		const uint8_t hash[64], const uint8_t *context,
363		uint8_t context_len, const char *propq)
364	0	{
365	0	return ossl_c448_ed448_verify(ctx, signature, pubkey, hash, 64, 1, context,
366	0	context_len, propq);
367	0	}
368
369		int ossl_ed448_sign(OSSL_LIB_CTX ctx, uint8_t out_sig,
370		const uint8_t *message, size_t message_len,
371		const uint8_t public_key[57], const uint8_t private_key[57],
372		const uint8_t *context, size_t context_len,
373		const uint8_t phflag, const char *propq)
374	0	{
375	0	return ossl_c448_ed448_sign(ctx, out_sig, private_key, public_key, message,
376	0	message_len, phflag, context, context_len,
377	0	propq)
378	0	== C448_SUCCESS;
379	0	}
380
381		int ossl_ed448_verify(OSSL_LIB_CTX *ctx,
382		const uint8_t *message, size_t message_len,
383		const uint8_t signature[114], const uint8_t public_key[57],
384		const uint8_t *context, size_t context_len,
385		const uint8_t phflag, const char *propq)
386	64	{
387	64	return ossl_c448_ed448_verify(ctx, signature, public_key, message,
388	64	message_len, phflag, context, (uint8_t)context_len,
389	64	propq)
390	64	== C448_SUCCESS;
391	64	}
392
393		int ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
394		const uint8_t private_key[57], const char *propq)
395	23	{
396	23	return ossl_c448_ed448_derive_public_key(ctx, out_public_key, private_key,
397	23	propq)
398	23	== C448_SUCCESS;
399	23	}