summaryrefslogtreecommitdiff
path: root/node/C25519.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'node/C25519.cpp')
-rw-r--r--node/C25519.cpp290
1 files changed, 18 insertions, 272 deletions
diff --git a/node/C25519.cpp b/node/C25519.cpp
index a78e0466..f35a88c2 100644
--- a/node/C25519.cpp
+++ b/node/C25519.cpp
@@ -268,9 +268,7 @@ static void recip(unsigned int out[32],const unsigned int z[32])
/* 2^255 - 21 */ mult(out,t1,z11);
}
-static inline int crypto_scalarmult(unsigned char *q,
- const unsigned char *n,
- const unsigned char *p)
+static inline int crypto_scalarmult(unsigned char *q,const unsigned char *n,const unsigned char *p)
{
unsigned int work[96];
unsigned char e[32];
@@ -288,12 +286,24 @@ static inline int crypto_scalarmult(unsigned char *q,
return 0;
}
-static const unsigned char base[32] = {9};
-
-static inline int crypto_scalarmult_base(unsigned char *q,
- const unsigned char *n)
+//static const unsigned char base[32] = {9};
+static inline int crypto_scalarmult_base(unsigned char *q,const unsigned char *n)
{
- return crypto_scalarmult(q,n,base);
+ //return crypto_scalarmult(q,n,base);
+ unsigned int work[96];
+ unsigned char e[32];
+ unsigned int i;
+ for (i = 0;i < 32;++i) e[i] = n[i];
+ e[0] &= 248;
+ e[31] &= 127;
+ e[31] |= 64;
+ for (i = 0;i < 32;++i) work[i] = 9;
+ mainloop(work,e);
+ recip(work + 32,work + 32);
+ mult(work + 64,work,work + 32);
+ freeze(work + 64);
+ for (i = 0;i < 32;++i) q[i] = work[64 + i];
+ return 0;
}
//////////////////////////////////////////////////////////////////////////////
@@ -413,20 +423,6 @@ static inline void fe25519_pack(unsigned char r[32], const fe25519 *x)
r[i] = y.v[i];
}
-#if 0
-static int fe25519_iszero(const fe25519 *x)
-{
- int i;
- int r;
- fe25519 t = *x;
- fe25519_freeze(&t);
- r = equal(t.v[0],0);
- for(i=1;i<32;i++)
- r &= equal(t.v[i],0);
- return r;
-}
-#endif
-
static inline int fe25519_iseq_vartime(const fe25519 *x, const fe25519 *y)
{
int i;
@@ -745,14 +741,6 @@ static inline void sc25519_from32bytes(sc25519 *r, const unsigned char x[32])
barrett_reduce(r, t);
}
-#if 0
-static void shortsc25519_from16bytes(shortsc25519 *r, const unsigned char x[16])
-{
- int i;
- for(i=0;i<16;i++) r->v[i] = x[i];
-}
-#endif
-
static inline void sc25519_from64bytes(sc25519 *r, const unsigned char x[64])
{
int i;
@@ -761,56 +749,12 @@ static inline void sc25519_from64bytes(sc25519 *r, const unsigned char x[64])
barrett_reduce(r, t);
}
-#if 0
-static void sc25519_from_shortsc(sc25519 *r, const shortsc25519 *x)
-{
- int i;
- for(i=0;i<16;i++)
- r->v[i] = x->v[i];
- for(i=0;i<16;i++)
- r->v[16+i] = 0;
-}
-#endif
-
static inline void sc25519_to32bytes(unsigned char r[32], const sc25519 *x)
{
int i;
for(i=0;i<32;i++) r[i] = x->v[i];
}
-#if 0
-static int sc25519_iszero_vartime(const sc25519 *x)
-{
- int i;
- for(i=0;i<32;i++)
- if(x->v[i] != 0) return 0;
- return 1;
-}
-#endif
-
-#if 0
-static int sc25519_isshort_vartime(const sc25519 *x)
-{
- int i;
- for(i=31;i>15;i--)
- if(x->v[i] != 0) return 0;
- return 1;
-}
-#endif
-
-#if 0
-static int sc25519_lt_vartime(const sc25519 *x, const sc25519 *y)
-{
- int i;
- for(i=31;i>=0;i--)
- {
- if(x->v[i] < y->v[i]) return 1;
- if(x->v[i] > y->v[i]) return 0;
- }
- return 0;
-}
-#endif
-
static inline void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y)
{
int i, carry;
@@ -824,21 +768,6 @@ static inline void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y)
reduce_add_sub(r);
}
-#if 0
-static void sc25519_sub_nored(sc25519 *r, const sc25519 *x, const sc25519 *y)
-{
- crypto_uint32 b = 0;
- crypto_uint32 t;
- int i;
- for(i=0;i<32;i++)
- {
- t = x->v[i] - y->v[i] - b;
- r->v[i] = t & 255;
- b = (t >> 8) & 1;
- }
-}
-#endif
-
static inline void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y)
{
int i,j,carry;
@@ -860,15 +789,6 @@ static inline void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y)
barrett_reduce(r, t);
}
-#if 0
-static void sc25519_mul_shortsc(sc25519 *r, const sc25519 *x, const shortsc25519 *y)
-{
- sc25519 t;
- sc25519_from_shortsc(&t, y);
- sc25519_mul(r, x, &t);
-}
-#endif
-
static inline void sc25519_window3(signed char r[85], const sc25519 *s)
{
char carry;
@@ -906,45 +826,6 @@ static inline void sc25519_window3(signed char r[85], const sc25519 *s)
r[84] += carry;
}
-#if 0
-static void sc25519_window5(signed char r[51], const sc25519 *s)
-{
- char carry;
- int i;
- for(i=0;i<6;i++)
- {
- r[8*i+0] = s->v[5*i+0] & 31;
- r[8*i+1] = (s->v[5*i+0] >> 5) & 31;
- r[8*i+1] ^= (s->v[5*i+1] << 3) & 31;
- r[8*i+2] = (s->v[5*i+1] >> 2) & 31;
- r[8*i+3] = (s->v[5*i+1] >> 7) & 31;
- r[8*i+3] ^= (s->v[5*i+2] << 1) & 31;
- r[8*i+4] = (s->v[5*i+2] >> 4) & 31;
- r[8*i+4] ^= (s->v[5*i+3] << 4) & 31;
- r[8*i+5] = (s->v[5*i+3] >> 1) & 31;
- r[8*i+6] = (s->v[5*i+3] >> 6) & 31;
- r[8*i+6] ^= (s->v[5*i+4] << 2) & 31;
- r[8*i+7] = (s->v[5*i+4] >> 3) & 31;
- }
- r[8*i+0] = s->v[5*i+0] & 31;
- r[8*i+1] = (s->v[5*i+0] >> 5) & 31;
- r[8*i+1] ^= (s->v[5*i+1] << 3) & 31;
- r[8*i+2] = (s->v[5*i+1] >> 2) & 31;
-
- /* Making it signed */
- carry = 0;
- for(i=0;i<50;i++)
- {
- r[i] += carry;
- r[i+1] += r[i] >> 5;
- r[i] &= 31;
- carry = r[i] >> 4;
- r[i] -= carry<<5;
- }
- r[50] += carry;
-}
-#endif
-
static inline void sc25519_2interleave2(unsigned char r[127], const sc25519 *s1, const sc25519 *s2)
{
int i;
@@ -2052,16 +1933,6 @@ static inline void ge25519_pack(unsigned char r[32], const ge25519_p3 *p)
r[31] ^= fe25519_getparity(&tx) << 7;
}
-#if 0
-static int ge25519_isneutral_vartime(const ge25519_p3 *p)
-{
- int ret = 1;
- if(!fe25519_iszero(&p->x)) ret = 0;
- if(!fe25519_iseq_vartime(&p->y, &p->z)) ret = 0;
- return ret;
-}
-#endif
-
/* computes [s1]p1 + [s2]p2 */
static void ge25519_double_scalarmult_vartime(ge25519_p3 *r, const ge25519_p3 *p1, const sc25519 *s1, const ge25519_p3 *p2, const sc25519 *s2)
{
@@ -2137,131 +2008,6 @@ static inline void get_hram(unsigned char *hram, const unsigned char *sm, const
SHA512::hash(hram,playground,(unsigned int)smlen);
}
-// This is the original sign and verify code -- the versions in sign() and
-// verify() below the fold are slightly modified in terms of how they behave
-// in relation to the message, but the algorithms are the same.
-
-#if 0
-int crypto_sign_keypair(
- unsigned char *pk,
- unsigned char *sk
- )
-{
- sc25519 scsk;
- ge25519 gepk;
- unsigned char extsk[64];
- int i;
-
- randombytes(sk, 32);
- crypto_hash_sha512(extsk, sk, 32);
- extsk[0] &= 248;
- extsk[31] &= 127;
- extsk[31] |= 64;
-
- sc25519_from32bytes(&scsk,extsk);
-
- ge25519_scalarmult_base(&gepk, &scsk);
- ge25519_pack(pk, &gepk);
- for(i=0;i<32;i++)
- sk[32 + i] = pk[i];
- return 0;
-}
-
-static int crypto_sign(
- unsigned char *sm,unsigned long long *smlen,
- const unsigned char *m,unsigned long long mlen,
- const unsigned char *sk
- )
-{
- sc25519 sck, scs, scsk;
- ge25519 ger;
- unsigned char r[32];
- unsigned char s[32];
- unsigned char extsk[64];
- unsigned long long i;
- unsigned char hmg[crypto_hash_sha512_BYTES];
- unsigned char hram[crypto_hash_sha512_BYTES];
-
- crypto_hash_sha512(extsk, sk, 32);
- extsk[0] &= 248;
- extsk[31] &= 127;
- extsk[31] |= 64;
-
- *smlen = mlen+64;
- for(i=0;i<mlen;i++)
- sm[64 + i] = m[i];
- for(i=0;i<32;i++)
- sm[32 + i] = extsk[32+i];
-
- crypto_hash_sha512(hmg, sm+32, mlen+32); /* Generate k as h(extsk[32],...,extsk[63],m) */
-
- /* Computation of R */
- sc25519_from64bytes(&sck, hmg);
- ge25519_scalarmult_base(&ger, &sck);
- ge25519_pack(r, &ger);
-
- /* Computation of s */
- for(i=0;i<32;i++)
- sm[i] = r[i];
-
- get_hram(hram, sm, sk+32, sm, mlen+64);
-
- sc25519_from64bytes(&scs, hram);
- sc25519_from32bytes(&scsk, extsk);
- sc25519_mul(&scs, &scs, &scsk);
-
- sc25519_add(&scs, &scs, &sck);
-
- sc25519_to32bytes(s,&scs); /* cat s */
- for(i=0;i<32;i++)
- sm[32 + i] = s[i];
-
- return 0;
-}
-
-static int crypto_sign_open(
- unsigned char *m,unsigned long long *mlen,
- const unsigned char *sm,unsigned long long smlen,
- const unsigned char *pk
- )
-{
- int i, ret;
- unsigned char t2[32];
- ge25519 get1, get2;
- sc25519 schram, scs;
- unsigned char hram[crypto_hash_sha512_BYTES];
-
- *mlen = (unsigned long long) -1;
- if (smlen < 64) return -1;
-
- if (ge25519_unpackneg_vartime(&get1, pk)) return -1;
-
- get_hram(hram,sm,pk,m,smlen);
-
- sc25519_from64bytes(&schram, hram);
-
- sc25519_from32bytes(&scs, sm+32);
-
- ge25519_double_scalarmult_vartime(&get2, &get1, &schram, &ge25519_base, &scs);
- ge25519_pack(t2, &get2);
-
- ret = crypto_verify_32(sm, t2);
-
- if (!ret)
- {
- for(i=0;i<smlen-64;i++)
- m[i] = sm[i + 64];
- *mlen = smlen-64;
- }
- else
- {
- for(i=0;i<smlen-64;i++)
- m[i] = 0;
- }
- return ret;
-}
-#endif // 0
-
//////////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////
generated by cgit v1.2.3 (git 2.39.1) at 2026-01-13 01:04:14 +0000