1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3 *
4 * LibTomCrypt is a library that provides various cryptographic
5 * algorithms in a highly modular and flexible manner.
6 *
7 * The library is free for all purposes without any express
8 * guarantee it works.
9 */
10 #include "tomcrypt_private.h"
11
12 /* automatically generated file, do not edit */
13
14 #define FOR(i,n) for (i = 0;i < n;++i)
15 #define sv static void
16
17 typedef unsigned char u8;
18 typedef ulong32 u32;
19 typedef ulong64 u64;
20 typedef long64 i64;
21 typedef i64 gf[16];
22
23 static const u8
24 _9[32] = {9};
25 static const gf
26 gf0,
27 gf1 = {1},
28 _121665 = {0xDB41,1},
29 D = {0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203},
30 D2 = {0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406},
31 X = {0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169},
32 Y = {0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666},
33 I = {0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83};
34
vn(const u8 * x,const u8 * y,int n)35 static int vn(const u8 *x,const u8 *y,int n)
36 {
37 int i;
38 u32 d = 0;
39 FOR(i,n) d |= x[i]^y[i];
40 return (1 & ((d - 1) >> 8)) - 1;
41 }
42
tweetnacl_crypto_verify_32(const u8 * x,const u8 * y)43 static int tweetnacl_crypto_verify_32(const u8 *x,const u8 *y)
44 {
45 return vn(x,y,32);
46 }
47
set25519(gf r,const gf a)48 sv set25519(gf r, const gf a)
49 {
50 int i;
51 FOR(i,16) r[i]=a[i];
52 }
53
car25519(gf o)54 sv car25519(gf o)
55 {
56 int i;
57 i64 c;
58 FOR(i,16) {
59 o[i]+=(1LL<<16);
60 c=o[i]>>16;
61 o[(i+1)*(i<15)]+=c-1+37*(c-1)*(i==15);
62 o[i]-=c<<16;
63 }
64 }
65
sel25519(gf p,gf q,int b)66 sv sel25519(gf p,gf q,int b)
67 {
68 i64 t,i,c=~(b-1);
69 FOR(i,16) {
70 t= c&(p[i]^q[i]);
71 p[i]^=t;
72 q[i]^=t;
73 }
74 }
75
pack25519(u8 * o,const gf n)76 sv pack25519(u8 *o,const gf n)
77 {
78 int i,j,b;
79 gf m,t;
80 FOR(i,16) t[i]=n[i];
81 car25519(t);
82 car25519(t);
83 car25519(t);
84 FOR(j,2) {
85 m[0]=t[0]-0xffed;
86 for(i=1;i<15;i++) {
87 m[i]=t[i]-0xffff-((m[i-1]>>16)&1);
88 m[i-1]&=0xffff;
89 }
90 m[15]=t[15]-0x7fff-((m[14]>>16)&1);
91 b=(m[15]>>16)&1;
92 m[14]&=0xffff;
93 sel25519(t,m,1-b);
94 }
95 FOR(i,16) {
96 o[2*i]=t[i]&0xff;
97 o[2*i+1]=t[i]>>8;
98 }
99 }
100
neq25519(const gf a,const gf b)101 static int neq25519(const gf a, const gf b)
102 {
103 u8 c[32],d[32];
104 pack25519(c,a);
105 pack25519(d,b);
106 return tweetnacl_crypto_verify_32(c,d);
107 }
108
par25519(const gf a)109 static u8 par25519(const gf a)
110 {
111 u8 d[32];
112 pack25519(d,a);
113 return d[0]&1;
114 }
115
unpack25519(gf o,const u8 * n)116 sv unpack25519(gf o, const u8 *n)
117 {
118 int i;
119 FOR(i,16) o[i]=n[2*i]+((i64)n[2*i+1]<<8);
120 o[15]&=0x7fff;
121 }
122
A(gf o,const gf a,const gf b)123 sv A(gf o,const gf a,const gf b)
124 {
125 int i;
126 FOR(i,16) o[i]=a[i]+b[i];
127 }
128
Z(gf o,const gf a,const gf b)129 sv Z(gf o,const gf a,const gf b)
130 {
131 int i;
132 FOR(i,16) o[i]=a[i]-b[i];
133 }
134
M(gf o,const gf a,const gf b)135 sv M(gf o,const gf a,const gf b)
136 {
137 i64 i,j,t[31];
138 FOR(i,31) t[i]=0;
139 FOR(i,16) FOR(j,16) t[i+j]+=a[i]*b[j];
140 FOR(i,15) t[i]+=38*t[i+16];
141 FOR(i,16) o[i]=t[i];
142 car25519(o);
143 car25519(o);
144 }
145
S(gf o,const gf a)146 sv S(gf o,const gf a)
147 {
148 M(o,a,a);
149 }
150
inv25519(gf o,const gf i)151 sv inv25519(gf o,const gf i)
152 {
153 gf c;
154 int a;
155 FOR(a,16) c[a]=i[a];
156 for(a=253;a>=0;a--) {
157 S(c,c);
158 if(a!=2&&a!=4) M(c,c,i);
159 }
160 FOR(a,16) o[a]=c[a];
161 }
162
pow2523(gf o,const gf i)163 sv pow2523(gf o,const gf i)
164 {
165 gf c;
166 int a;
167 FOR(a,16) c[a]=i[a];
168 for(a=250;a>=0;a--) {
169 S(c,c);
170 if(a!=1) M(c,c,i);
171 }
172 FOR(a,16) o[a]=c[a];
173 }
174
tweetnacl_crypto_scalarmult(u8 * q,const u8 * n,const u8 * p)175 int tweetnacl_crypto_scalarmult(u8 *q,const u8 *n,const u8 *p)
176 {
177 u8 z[32];
178 i64 x[80],r,i;
179 gf a,b,c,d,e,f;
180 FOR(i,31) z[i]=n[i];
181 z[31]=(n[31]&127)|64;
182 z[0]&=248;
183 unpack25519(x,p);
184 FOR(i,16) {
185 b[i]=x[i];
186 d[i]=a[i]=c[i]=0;
187 }
188 a[0]=d[0]=1;
189 for(i=254;i>=0;--i) {
190 r=(z[i>>3]>>(i&7))&1;
191 sel25519(a,b,r);
192 sel25519(c,d,r);
193 A(e,a,c);
194 Z(a,a,c);
195 A(c,b,d);
196 Z(b,b,d);
197 S(d,e);
198 S(f,a);
199 M(a,c,a);
200 M(c,b,e);
201 A(e,a,c);
202 Z(a,a,c);
203 S(b,a);
204 Z(c,d,f);
205 M(a,c,_121665);
206 A(a,a,d);
207 M(c,c,a);
208 M(a,d,f);
209 M(d,b,x);
210 S(b,e);
211 sel25519(a,b,r);
212 sel25519(c,d,r);
213 }
214 FOR(i,16) {
215 x[i+16]=a[i];
216 x[i+32]=c[i];
217 x[i+48]=b[i];
218 x[i+64]=d[i];
219 }
220 inv25519(x+32,x+32);
221 M(x+16,x+16,x+32);
222 pack25519(q,x+16);
223 return 0;
224 }
225
tweetnacl_crypto_scalarmult_base(u8 * q,const u8 * n)226 int tweetnacl_crypto_scalarmult_base(u8 *q,const u8 *n)
227 {
228 return tweetnacl_crypto_scalarmult(q,n,_9);
229 }
230
tweetnacl_crypto_hash(u8 * out,const u8 * m,u64 n)231 static int tweetnacl_crypto_hash(u8 *out,const u8 *m,u64 n)
232 {
233 unsigned long len;
234 int err, hash_idx;
235
236 if (n > ULONG_MAX) return CRYPT_OVERFLOW;
237
238 hash_idx = find_hash("sha512");
239 len = 64;
240 if ((err = hash_memory(hash_idx, m, n, out, &len)) != CRYPT_OK) return err;
241
242 return 0;
243 }
244
add(gf p[4],gf q[4])245 sv add(gf p[4],gf q[4])
246 {
247 gf a,b,c,d,t,e,f,g,h;
248
249 Z(a, p[1], p[0]);
250 Z(t, q[1], q[0]);
251 M(a, a, t);
252 A(b, p[0], p[1]);
253 A(t, q[0], q[1]);
254 M(b, b, t);
255 M(c, p[3], q[3]);
256 M(c, c, D2);
257 M(d, p[2], q[2]);
258 A(d, d, d);
259 Z(e, b, a);
260 Z(f, d, c);
261 A(g, d, c);
262 A(h, b, a);
263
264 M(p[0], e, f);
265 M(p[1], h, g);
266 M(p[2], g, f);
267 M(p[3], e, h);
268 }
269
cswap(gf p[4],gf q[4],u8 b)270 sv cswap(gf p[4],gf q[4],u8 b)
271 {
272 int i;
273 FOR(i,4)
274 sel25519(p[i],q[i],b);
275 }
276
pack(u8 * r,gf p[4])277 sv pack(u8 *r,gf p[4])
278 {
279 gf tx, ty, zi;
280 inv25519(zi, p[2]);
281 M(tx, p[0], zi);
282 M(ty, p[1], zi);
283 pack25519(r, ty);
284 r[31] ^= par25519(tx) << 7;
285 }
286
scalarmult(gf p[4],gf q[4],const u8 * s)287 sv scalarmult(gf p[4],gf q[4],const u8 *s)
288 {
289 int i;
290 set25519(p[0],gf0);
291 set25519(p[1],gf1);
292 set25519(p[2],gf1);
293 set25519(p[3],gf0);
294 for (i = 255;i >= 0;--i) {
295 u8 b = (s[i/8]>>(i&7))&1;
296 cswap(p,q,b);
297 add(q,p);
298 add(p,p);
299 cswap(p,q,b);
300 }
301 }
302
scalarbase(gf p[4],const u8 * s)303 sv scalarbase(gf p[4],const u8 *s)
304 {
305 gf q[4];
306 set25519(q[0],X);
307 set25519(q[1],Y);
308 set25519(q[2],gf1);
309 M(q[3],X,Y);
310 scalarmult(p,q,s);
311 }
312
tweetnacl_crypto_sk_to_pk(u8 * pk,const u8 * sk)313 int tweetnacl_crypto_sk_to_pk(u8 *pk, const u8 *sk)
314 {
315 u8 d[64];
316 gf p[4];
317 tweetnacl_crypto_hash(d, sk, 32);
318 d[0] &= 248;
319 d[31] &= 127;
320 d[31] |= 64;
321
322 scalarbase(p,d);
323 pack(pk,p);
324
325 return 0;
326 }
327
tweetnacl_crypto_sign_keypair(prng_state * prng,int wprng,u8 * pk,u8 * sk)328 int tweetnacl_crypto_sign_keypair(prng_state *prng, int wprng, u8 *pk, u8 *sk)
329 {
330 int err;
331
332 /* randombytes(sk,32); */
333 if ((err = prng_is_valid(wprng)) != CRYPT_OK) {
334 return err;
335 }
336
337 if (prng_descriptor[wprng]->read(sk,32, prng) != 32) {
338 return CRYPT_ERROR_READPRNG;
339 }
340
341 if ((err = tweetnacl_crypto_sk_to_pk(pk, sk)) != CRYPT_OK) {
342 return err;
343 }
344
345 /* FOR(i,32) sk[32 + i] = pk[i];
346 * we don't copy the pk in the sk */
347 return CRYPT_OK;
348 }
349
350 static const u64 L[32] = {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10};
351
modL(u8 * r,i64 x[64])352 sv modL(u8 *r,i64 x[64])
353 {
354 i64 carry,i,j;
355 for (i = 63;i >= 32;--i) {
356 carry = 0;
357 for (j = i - 32;j < i - 12;++j) {
358 x[j] += carry - 16 * x[i] * L[j - (i - 32)];
359 carry = (x[j] + 128) >> 8;
360 x[j] -= carry << 8;
361 }
362 x[j] += carry;
363 x[i] = 0;
364 }
365 carry = 0;
366 FOR(j,32) {
367 x[j] += carry - (x[31] >> 4) * L[j];
368 carry = x[j] >> 8;
369 x[j] &= 255;
370 }
371 FOR(j,32) x[j] -= carry * L[j];
372 FOR(i,32) {
373 x[i+1] += x[i] >> 8;
374 r[i] = x[i] & 255;
375 }
376 }
377
reduce(u8 * r)378 sv reduce(u8 *r)
379 {
380 i64 x[64],i;
381 FOR(i,64) x[i] = (u64) r[i];
382 FOR(i,64) r[i] = 0;
383 modL(r,x);
384 }
385
tweetnacl_crypto_sign(u8 * sm,u64 * smlen,const u8 * m,u64 mlen,const u8 * sk,const u8 * pk)386 int tweetnacl_crypto_sign(u8 *sm,u64 *smlen,const u8 *m,u64 mlen,const u8 *sk,const u8 *pk)
387 {
388 u8 d[64],h[64],r[64];
389 i64 i,j,x[64];
390 gf p[4];
391
392 tweetnacl_crypto_hash(d, sk, 32);
393 d[0] &= 248;
394 d[31] &= 127;
395 d[31] |= 64;
396
397 *smlen = mlen+64;
398 FOR(i,(i64)mlen) sm[64 + i] = m[i];
399 FOR(i,32) sm[32 + i] = d[32 + i];
400
401 tweetnacl_crypto_hash(r, sm+32, mlen+32);
402 reduce(r);
403 scalarbase(p,r);
404 pack(sm,p);
405
406 FOR(i,32) sm[i+32] = pk[i];
407 tweetnacl_crypto_hash(h,sm,mlen + 64);
408 reduce(h);
409
410 FOR(i,64) x[i] = 0;
411 FOR(i,32) x[i] = (u64) r[i];
412 FOR(i,32) FOR(j,32) x[i+j] += h[i] * (u64) d[j];
413 modL(sm + 32,x);
414
415 return 0;
416 }
417
unpackneg(gf r[4],const u8 p[32])418 static int unpackneg(gf r[4],const u8 p[32])
419 {
420 gf t, chk, num, den, den2, den4, den6;
421 set25519(r[2],gf1);
422 unpack25519(r[1],p);
423 S(num,r[1]);
424 M(den,num,D);
425 Z(num,num,r[2]);
426 A(den,r[2],den);
427
428 S(den2,den);
429 S(den4,den2);
430 M(den6,den4,den2);
431 M(t,den6,num);
432 M(t,t,den);
433
434 pow2523(t,t);
435 M(t,t,num);
436 M(t,t,den);
437 M(t,t,den);
438 M(r[0],t,den);
439
440 S(chk,r[0]);
441 M(chk,chk,den);
442 if (neq25519(chk, num)) M(r[0],r[0],I);
443
444 S(chk,r[0]);
445 M(chk,chk,den);
446 if (neq25519(chk, num)) return -1;
447
448 if (par25519(r[0]) == (p[31]>>7)) Z(r[0],gf0,r[0]);
449
450 M(r[3],r[0],r[1]);
451 return 0;
452 }
453
tweetnacl_crypto_sign_open(int * stat,u8 * m,u64 * mlen,const u8 * sm,u64 smlen,const u8 * pk)454 int tweetnacl_crypto_sign_open(int *stat, u8 *m,u64 *mlen,const u8 *sm,u64 smlen,const u8 *pk)
455 {
456 u64 i;
457 u8 s[32],t[32],h[64];
458 gf p[4],q[4];
459
460 *stat = 0;
461 if (*mlen < smlen) return CRYPT_BUFFER_OVERFLOW;
462 *mlen = -1;
463 if (smlen < 64) return CRYPT_INVALID_ARG;
464
465 if (unpackneg(q,pk)) return CRYPT_ERROR;
466
467 XMEMMOVE(m,sm,smlen);
468 XMEMMOVE(s,m + 32,32);
469 XMEMMOVE(m + 32,pk,32);
470 tweetnacl_crypto_hash(h,m,smlen);
471 reduce(h);
472 scalarmult(p,q,h);
473
474 scalarbase(q,s);
475 add(p,q);
476 pack(t,p);
477
478 smlen -= 64;
479 if (tweetnacl_crypto_verify_32(sm, t)) {
480 FOR(i,smlen) m[i] = 0;
481 zeromem(m, smlen);
482 return CRYPT_OK;
483 }
484
485 *stat = 1;
486 XMEMMOVE(m,m + 64,smlen);
487 *mlen = smlen;
488 return CRYPT_OK;
489 }
490
491 /* ref: $Format:%D$ */
492 /* git commit: $Format:%H$ */
493 /* commit time: $Format:%ai$ */
494