From 9d9307ce031f1eedd52b9fc98eb4767e4069f562 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Tue, 21 Aug 2018 16:14:12 -0700 Subject: [PATCH] Import 25519 functions, to be reorganized later Signed-off-by: Jason A. Donenfeld --- x25519/x25519.c | 177 ++++++++++++++++++++++++++++++++++++++++++++++++ x25519/x25519.h | 7 ++ 2 files changed, 184 insertions(+) create mode 100644 x25519/x25519.c create mode 100644 x25519/x25519.h diff --git a/x25519/x25519.c b/x25519/x25519.c new file mode 100644 index 0000000..8ce6027 --- /dev/null +++ b/x25519/x25519.c @@ -0,0 +1,177 @@ +/* SPDX-License-Identifier: GPL-2.0+ + * + * Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. + * + * Curve25519 ECDH functions, based on TweetNaCl but cleaned up. + */ + +#include +#include +#include + +#include "x25519.h" + +typedef int64_t fe[16]; + +static inline void carry(fe o) +{ + int i; + + for (i = 0; i < 16; ++i) { + o[(i + 1) % 16] += (i == 15 ? 38 : 1) * (o[i] >> 16); + o[i] &= 0xffff; + } +} + +static inline void cswap(fe p, fe q, int b) +{ + int i; + int64_t t, c = ~(b - 1); + + for (i = 0; i < 16; ++i) { + t = c & (p[i] ^ q[i]); + p[i] ^= t; + q[i] ^= t; + } +} + +static inline void pack(uint8_t *o, const fe n) +{ + int i, j, b; + fe m, t; + + memcpy(t, n, sizeof(t)); + carry(t); + carry(t); + carry(t); + for (j = 0; j < 2; ++j) { + m[0] = t[0] - 0xffed; + for (i = 1; i < 15; ++i) { + m[i] = t[i] - 0xffff - ((m[i - 1] >> 16) & 1); + m[i - 1] &= 0xffff; + } + m[15] = t[15] - 0x7fff - ((m[14] >> 16) & 1); + b = (m[15] >> 16) & 1; + m[14] &= 0xffff; + cswap(t, m, 1 - b); + } + for (i = 0; i < 16; ++i) { + o[2 * i] = t[i] & 0xff; + o[2 * i + 1] = t[i] >> 8; + } +} + +static inline void unpack(fe o, const uint8_t *n) +{ + int i; + + for (i = 0; i < 16; ++i) + o[i] = n[2 * i] + ((int64_t)n[2 * i + 1] << 8); + o[15] &= 0x7fff; +} + +static inline void add(fe o, const fe a, const fe b) +{ + int i; + + for (i = 0; i < 16; ++i) + o[i] = a[i] + b[i]; +} + +static inline void subtract(fe o, const fe a, const fe b) +{ + int i; + + for (i = 0; i < 16; ++i) + o[i] = a[i] - b[i]; +} + +static inline void multmod(fe o, const fe a, const fe b) +{ + int i, j; + int64_t t[31] = { 0 }; + + for (i = 0; i < 16; ++i) { + for (j = 0; j < 16; ++j) + t[i + j] += a[i] * b[j]; + } + for (i = 0; i < 15; ++i) + t[i] += 38 * t[i + 16]; + memcpy(o, t, sizeof(fe)); + carry(o); + carry(o); +} + +static inline void invert(fe o, const fe i) +{ + fe c; + int a; + + memcpy(c, i, sizeof(c)); + for (a = 253; a >= 0; --a) { + multmod(c, c, c); + if (a != 2 && a != 4) + multmod(c, c, i); + } + memcpy(o, c, sizeof(fe)); +} + +static void curve25519_shared_secret(uint8_t shared_secret[32], const uint8_t private_key[32], const uint8_t public_key[32]) +{ + static const fe a24 = { 0xdb41, 1 }; + uint8_t z[32]; + int64_t r; + int i; + fe a = { 1 }, b, c = { 0 }, d = { 1 }, e, f, x; + + memcpy(z, private_key, sizeof(z)); + + z[31] = (z[31] & 127) | 64; + z[0] &= 248; + + unpack(x, public_key); + memcpy(b, x, sizeof(b)); + + for (i = 254; i >= 0; --i) { + r = (z[i >> 3] >> (i & 7)) & 1; + cswap(a, b, r); + cswap(c, d, r); + add(e, a, c); + subtract(a, a, c); + add(c, b, d); + subtract(b, b, d); + multmod(d, e, e); + multmod(f, a, a); + multmod(a, c, a); + multmod(c, b, e); + add(e, a, c); + subtract(a, a, c); + multmod(b, a, a); + subtract(c, d, f); + multmod(a, c, a24); + add(a, a, d); + multmod(c, c, a); + multmod(a, d, f); + multmod(d, b, x); + multmod(b, e, e); + cswap(a, b, r); + cswap(c, d, r); + } + invert(c, c); + multmod(a, a, c); + pack(shared_secret, a); +} + +void curve25519_derive_public_key(uint8_t public_key[32], const uint8_t private_key[32]) +{ + static const uint8_t basepoint[32] = { 9 }; + + curve25519_shared_secret(public_key, private_key, basepoint); +} + +void curve25519_generate_private_key(uint8_t private_key[32]) +{ + getentropy(private_key, 32); + private_key[31] = (private_key[31] & 127) | 64; + private_key[0] &= 248; +} diff --git a/x25519/x25519.h b/x25519/x25519.h new file mode 100644 index 0000000..7d8440d --- /dev/null +++ b/x25519/x25519.h @@ -0,0 +1,7 @@ +#ifndef X25519_H +#define X25519_H + +void curve25519_derive_public_key(unsigned char public_key[32], const unsigned char private_key[32]); +void curve25519_generate_private_key(unsigned char private_key[32]); + +#endif