Xuyi Wang / wolfSSL

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Dependents:   OS

wolfcrypt/src/curve25519.c@0:d92f9d21154c, 2015-06-26 (annotated)

Committer:
wolfSSL
Date:
Fri Jun 26 00:39:20 2015 +0000
Revision:
0:d92f9d21154c
wolfSSL 3.6.0

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 0:d92f9d21154c 1 /* curve25519.c
wolfSSL 0:d92f9d21154c 2 *
wolfSSL 0:d92f9d21154c 3 * Copyright (C) 2006-2015 wolfSSL Inc.
wolfSSL 0:d92f9d21154c 4 *
wolfSSL 0:d92f9d21154c 5 * This file is part of wolfSSL. (formerly known as CyaSSL)
wolfSSL 0:d92f9d21154c 6 *
wolfSSL 0:d92f9d21154c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 0:d92f9d21154c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 0:d92f9d21154c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 0:d92f9d21154c 10 * (at your option) any later version.
wolfSSL 0:d92f9d21154c 11 *
wolfSSL 0:d92f9d21154c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 0:d92f9d21154c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 0:d92f9d21154c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 0:d92f9d21154c 15 * GNU General Public License for more details.
wolfSSL 0:d92f9d21154c 16 *
wolfSSL 0:d92f9d21154c 17 * You should have received a copy of the GNU General Public License
wolfSSL 0:d92f9d21154c 18 * along with this program; if not, write to the Free Software
wolfSSL 0:d92f9d21154c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
wolfSSL 0:d92f9d21154c 20 */
wolfSSL 0:d92f9d21154c 21
wolfSSL 0:d92f9d21154c 22 /* Based On Daniel J Bernstein's curve25519 Public Domain ref10 work. */
wolfSSL 0:d92f9d21154c 23
wolfSSL 0:d92f9d21154c 24
wolfSSL 0:d92f9d21154c 25 #ifdef HAVE_CONFIG_H
wolfSSL 0:d92f9d21154c 26 #include <config.h>
wolfSSL 0:d92f9d21154c 27 #endif
wolfSSL 0:d92f9d21154c 28
wolfSSL 0:d92f9d21154c 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 0:d92f9d21154c 30
wolfSSL 0:d92f9d21154c 31 #ifdef HAVE_CURVE25519
wolfSSL 0:d92f9d21154c 32
wolfSSL 0:d92f9d21154c 33 #include <wolfssl/wolfcrypt/curve25519.h>
wolfSSL 0:d92f9d21154c 34 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 0:d92f9d21154c 35 #ifdef NO_INLINE
wolfSSL 0:d92f9d21154c 36 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 0:d92f9d21154c 37 #else
wolfSSL 0:d92f9d21154c 38 #include <wolfcrypt/src/misc.c>
wolfSSL 0:d92f9d21154c 39 #endif
wolfSSL 0:d92f9d21154c 40
wolfSSL 0:d92f9d21154c 41 const curve25519_set_type curve25519_sets[] = {
wolfSSL 0:d92f9d21154c 42 {
wolfSSL 0:d92f9d21154c 43 32,
wolfSSL 0:d92f9d21154c 44 "CURVE25519",
wolfSSL 0:d92f9d21154c 45 }
wolfSSL 0:d92f9d21154c 46 };
wolfSSL 0:d92f9d21154c 47
wolfSSL 0:d92f9d21154c 48
wolfSSL 0:d92f9d21154c 49
wolfSSL 0:d92f9d21154c 50 int wc_curve25519_make_key(RNG* rng, int keysize, curve25519_key* key)
wolfSSL 0:d92f9d21154c 51 {
wolfSSL 0:d92f9d21154c 52 unsigned char basepoint[CURVE25519_KEYSIZE] = {9};
wolfSSL 0:d92f9d21154c 53 unsigned char n[CURVE25519_KEYSIZE];
wolfSSL 0:d92f9d21154c 54 unsigned char p[CURVE25519_KEYSIZE];
wolfSSL 0:d92f9d21154c 55 int i;
wolfSSL 0:d92f9d21154c 56 int ret;
wolfSSL 0:d92f9d21154c 57
wolfSSL 0:d92f9d21154c 58 if (key == NULL || rng == NULL)
wolfSSL 0:d92f9d21154c 59 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 60
wolfSSL 0:d92f9d21154c 61 /* currently only a key size of 32 bytes is used */
wolfSSL 0:d92f9d21154c 62 if (keysize != CURVE25519_KEYSIZE)
wolfSSL 0:d92f9d21154c 63 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 64
wolfSSL 0:d92f9d21154c 65 /* get random number from RNG */
wolfSSL 0:d92f9d21154c 66 ret = wc_RNG_GenerateBlock(rng, n, keysize);
wolfSSL 0:d92f9d21154c 67 if (ret != 0)
wolfSSL 0:d92f9d21154c 68 return ret;
wolfSSL 0:d92f9d21154c 69
wolfSSL 0:d92f9d21154c 70 for (i = 0; i < keysize; ++i) key->k.point[i] = n[i];
wolfSSL 0:d92f9d21154c 71 key->k.point[ 0] &= 248;
wolfSSL 0:d92f9d21154c 72 key->k.point[31] &= 127;
wolfSSL 0:d92f9d21154c 73 key->k.point[31] |= 64;
wolfSSL 0:d92f9d21154c 74
wolfSSL 0:d92f9d21154c 75 /* compute public key */
wolfSSL 0:d92f9d21154c 76 ret = curve25519(p, key->k.point, basepoint);
wolfSSL 0:d92f9d21154c 77
wolfSSL 0:d92f9d21154c 78 /* store keys in big endian format */
wolfSSL 0:d92f9d21154c 79 for (i = 0; i < keysize; ++i) n[i] = key->k.point[i];
wolfSSL 0:d92f9d21154c 80 for (i = 0; i < keysize; ++i) {
wolfSSL 0:d92f9d21154c 81 key->p.point[keysize - i - 1] = p[i];
wolfSSL 0:d92f9d21154c 82 key->k.point[keysize - i - 1] = n[i];
wolfSSL 0:d92f9d21154c 83 }
wolfSSL 0:d92f9d21154c 84
wolfSSL 0:d92f9d21154c 85 ForceZero(n, keysize);
wolfSSL 0:d92f9d21154c 86 ForceZero(p, keysize);
wolfSSL 0:d92f9d21154c 87
wolfSSL 0:d92f9d21154c 88 return ret;
wolfSSL 0:d92f9d21154c 89 }
wolfSSL 0:d92f9d21154c 90
wolfSSL 0:d92f9d21154c 91
wolfSSL 0:d92f9d21154c 92 int wc_curve25519_shared_secret(curve25519_key* private_key,
wolfSSL 0:d92f9d21154c 93 curve25519_key* public_key,
wolfSSL 0:d92f9d21154c 94 byte* out, word32* outlen)
wolfSSL 0:d92f9d21154c 95 {
wolfSSL 0:d92f9d21154c 96 unsigned char k[CURVE25519_KEYSIZE];
wolfSSL 0:d92f9d21154c 97 unsigned char p[CURVE25519_KEYSIZE];
wolfSSL 0:d92f9d21154c 98 unsigned char o[CURVE25519_KEYSIZE];
wolfSSL 0:d92f9d21154c 99 int ret = 0;
wolfSSL 0:d92f9d21154c 100 int i;
wolfSSL 0:d92f9d21154c 101
wolfSSL 0:d92f9d21154c 102 /* sanity check */
wolfSSL 0:d92f9d21154c 103 if (private_key == NULL || public_key == NULL || out == NULL ||
wolfSSL 0:d92f9d21154c 104 outlen == NULL)
wolfSSL 0:d92f9d21154c 105 return BAD_FUNC_ARG;
wolfSSL 0:d92f9d21154c 106
wolfSSL 0:d92f9d21154c 107 /* avoid implementation fingerprinting */
wolfSSL 0:d92f9d21154c 108 if (public_key->p.point[0] > 0x7F)
wolfSSL 0:d92f9d21154c 109 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 110
wolfSSL 0:d92f9d21154c 111 XMEMSET(p, 0, sizeof(p));
wolfSSL 0:d92f9d21154c 112 XMEMSET(k, 0, sizeof(k));
wolfSSL 0:d92f9d21154c 113 XMEMSET(out, 0, CURVE25519_KEYSIZE);
wolfSSL 0:d92f9d21154c 114
wolfSSL 0:d92f9d21154c 115 for (i = 0; i < CURVE25519_KEYSIZE; ++i) {
wolfSSL 0:d92f9d21154c 116 p[i] = public_key->p.point [CURVE25519_KEYSIZE - i - 1];
wolfSSL 0:d92f9d21154c 117 k[i] = private_key->k.point[CURVE25519_KEYSIZE - i - 1];
wolfSSL 0:d92f9d21154c 118 }
wolfSSL 0:d92f9d21154c 119
wolfSSL 0:d92f9d21154c 120 ret = curve25519(o , k, p);
wolfSSL 0:d92f9d21154c 121 *outlen = CURVE25519_KEYSIZE;
wolfSSL 0:d92f9d21154c 122
wolfSSL 0:d92f9d21154c 123 for (i = 0; i < CURVE25519_KEYSIZE; ++i) {
wolfSSL 0:d92f9d21154c 124 out[i] = o[CURVE25519_KEYSIZE - i -1];
wolfSSL 0:d92f9d21154c 125 }
wolfSSL 0:d92f9d21154c 126
wolfSSL 0:d92f9d21154c 127 ForceZero(p, sizeof(p));
wolfSSL 0:d92f9d21154c 128 ForceZero(k, sizeof(k));
wolfSSL 0:d92f9d21154c 129 ForceZero(o, sizeof(o));
wolfSSL 0:d92f9d21154c 130
wolfSSL 0:d92f9d21154c 131 return ret;
wolfSSL 0:d92f9d21154c 132 }
wolfSSL 0:d92f9d21154c 133
wolfSSL 0:d92f9d21154c 134
wolfSSL 0:d92f9d21154c 135 /* curve25519 uses a serialized string for key representation */
wolfSSL 0:d92f9d21154c 136 int wc_curve25519_export_public(curve25519_key* key, byte* out, word32* outLen)
wolfSSL 0:d92f9d21154c 137 {
wolfSSL 0:d92f9d21154c 138 word32 keySz;
wolfSSL 0:d92f9d21154c 139
wolfSSL 0:d92f9d21154c 140 if (key == NULL || out == NULL || outLen == NULL)
wolfSSL 0:d92f9d21154c 141 return BAD_FUNC_ARG;
wolfSSL 0:d92f9d21154c 142
wolfSSL 0:d92f9d21154c 143 /* check size of outgoing key */
wolfSSL 0:d92f9d21154c 144 keySz = wc_curve25519_size(key);
wolfSSL 0:d92f9d21154c 145
wolfSSL 0:d92f9d21154c 146 /* copy in public key */
wolfSSL 0:d92f9d21154c 147 XMEMCPY(out, key->p.point, keySz);
wolfSSL 0:d92f9d21154c 148 *outLen = keySz;
wolfSSL 0:d92f9d21154c 149
wolfSSL 0:d92f9d21154c 150 return 0;
wolfSSL 0:d92f9d21154c 151 }
wolfSSL 0:d92f9d21154c 152
wolfSSL 0:d92f9d21154c 153 /* import curve25519 public key
wolfSSL 0:d92f9d21154c 154 return 0 on success */
wolfSSL 0:d92f9d21154c 155 int wc_curve25519_import_public(const byte* in, word32 inLen,
wolfSSL 0:d92f9d21154c 156 curve25519_key* key)
wolfSSL 0:d92f9d21154c 157 {
wolfSSL 0:d92f9d21154c 158 word32 keySz;
wolfSSL 0:d92f9d21154c 159
wolfSSL 0:d92f9d21154c 160 /* sanity check */
wolfSSL 0:d92f9d21154c 161 if (key == NULL || in == NULL)
wolfSSL 0:d92f9d21154c 162 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 163
wolfSSL 0:d92f9d21154c 164 /* check size of incoming keys */
wolfSSL 0:d92f9d21154c 165 keySz = wc_curve25519_size(key);
wolfSSL 0:d92f9d21154c 166 if (inLen != keySz)
wolfSSL 0:d92f9d21154c 167 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 168
wolfSSL 0:d92f9d21154c 169 XMEMCPY(key->p.point, in, inLen);
wolfSSL 0:d92f9d21154c 170
wolfSSL 0:d92f9d21154c 171 key->dp = &curve25519_sets[0];
wolfSSL 0:d92f9d21154c 172
wolfSSL 0:d92f9d21154c 173 return 0;
wolfSSL 0:d92f9d21154c 174 }
wolfSSL 0:d92f9d21154c 175
wolfSSL 0:d92f9d21154c 176
wolfSSL 0:d92f9d21154c 177 /* export curve25519 private key only raw, outLen is in/out size
wolfSSL 0:d92f9d21154c 178 return 0 on success */
wolfSSL 0:d92f9d21154c 179 int wc_curve25519_export_private_raw(curve25519_key* key, byte* out,
wolfSSL 0:d92f9d21154c 180 word32* outLen)
wolfSSL 0:d92f9d21154c 181 {
wolfSSL 0:d92f9d21154c 182 word32 keySz;
wolfSSL 0:d92f9d21154c 183
wolfSSL 0:d92f9d21154c 184 /* sanity check */
wolfSSL 0:d92f9d21154c 185 if (key == NULL || out == NULL || outLen == NULL)
wolfSSL 0:d92f9d21154c 186 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 187
wolfSSL 0:d92f9d21154c 188 keySz = wc_curve25519_size(key);
wolfSSL 0:d92f9d21154c 189 *outLen = keySz;
wolfSSL 0:d92f9d21154c 190 XMEMSET(out, 0, keySz);
wolfSSL 0:d92f9d21154c 191 XMEMCPY(out, key->k.point, keySz);
wolfSSL 0:d92f9d21154c 192
wolfSSL 0:d92f9d21154c 193 return 0;
wolfSSL 0:d92f9d21154c 194 }
wolfSSL 0:d92f9d21154c 195
wolfSSL 0:d92f9d21154c 196
wolfSSL 0:d92f9d21154c 197 /* curve25519 private key import.
wolfSSL 0:d92f9d21154c 198 Public key to match private key needs to be imported too */
wolfSSL 0:d92f9d21154c 199 int wc_curve25519_import_private_raw(const byte* priv, word32 privSz,
wolfSSL 0:d92f9d21154c 200 const byte* pub, word32 pubSz, curve25519_key* key)
wolfSSL 0:d92f9d21154c 201 {
wolfSSL 0:d92f9d21154c 202 int ret = 0;
wolfSSL 0:d92f9d21154c 203 word32 keySz;
wolfSSL 0:d92f9d21154c 204
wolfSSL 0:d92f9d21154c 205 /* sanity check */
wolfSSL 0:d92f9d21154c 206 if (key == NULL || priv == NULL || pub == NULL)
wolfSSL 0:d92f9d21154c 207 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 208
wolfSSL 0:d92f9d21154c 209 /* check size of incoming keys */
wolfSSL 0:d92f9d21154c 210 keySz = wc_curve25519_size(key);
wolfSSL 0:d92f9d21154c 211 if (privSz != keySz || pubSz != keySz)
wolfSSL 0:d92f9d21154c 212 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 213
wolfSSL 0:d92f9d21154c 214 XMEMCPY(key->k.point, priv, privSz);
wolfSSL 0:d92f9d21154c 215 XMEMCPY(key->p.point, pub, pubSz);
wolfSSL 0:d92f9d21154c 216
wolfSSL 0:d92f9d21154c 217 return ret;
wolfSSL 0:d92f9d21154c 218 }
wolfSSL 0:d92f9d21154c 219
wolfSSL 0:d92f9d21154c 220
wolfSSL 0:d92f9d21154c 221 int wc_curve25519_init(curve25519_key* key)
wolfSSL 0:d92f9d21154c 222 {
wolfSSL 0:d92f9d21154c 223 word32 keySz;
wolfSSL 0:d92f9d21154c 224
wolfSSL 0:d92f9d21154c 225 if (key == NULL)
wolfSSL 0:d92f9d21154c 226 return ECC_BAD_ARG_E;
wolfSSL 0:d92f9d21154c 227
wolfSSL 0:d92f9d21154c 228 /* currently the format for curve25519 */
wolfSSL 0:d92f9d21154c 229 key->dp = &curve25519_sets[0];
wolfSSL 0:d92f9d21154c 230 keySz = key->dp->size;
wolfSSL 0:d92f9d21154c 231
wolfSSL 0:d92f9d21154c 232 XMEMSET(key->k.point, 0, keySz);
wolfSSL 0:d92f9d21154c 233 XMEMSET(key->p.point, 0, keySz);
wolfSSL 0:d92f9d21154c 234
wolfSSL 0:d92f9d21154c 235 return 0;
wolfSSL 0:d92f9d21154c 236 }
wolfSSL 0:d92f9d21154c 237
wolfSSL 0:d92f9d21154c 238
wolfSSL 0:d92f9d21154c 239 /* Clean the memory of a key */
wolfSSL 0:d92f9d21154c 240 void wc_curve25519_free(curve25519_key* key)
wolfSSL 0:d92f9d21154c 241 {
wolfSSL 0:d92f9d21154c 242 if (key == NULL)
wolfSSL 0:d92f9d21154c 243 return;
wolfSSL 0:d92f9d21154c 244
wolfSSL 0:d92f9d21154c 245 key->dp = NULL;
wolfSSL 0:d92f9d21154c 246 ForceZero(key->p.point, sizeof(key->p.point));
wolfSSL 0:d92f9d21154c 247 ForceZero(key->k.point, sizeof(key->k.point));
wolfSSL 0:d92f9d21154c 248 }
wolfSSL 0:d92f9d21154c 249
wolfSSL 0:d92f9d21154c 250
wolfSSL 0:d92f9d21154c 251 /* get key size */
wolfSSL 0:d92f9d21154c 252 int wc_curve25519_size(curve25519_key* key)
wolfSSL 0:d92f9d21154c 253 {
wolfSSL 0:d92f9d21154c 254 if (key == NULL) return 0;
wolfSSL 0:d92f9d21154c 255
wolfSSL 0:d92f9d21154c 256 return key->dp->size;
wolfSSL 0:d92f9d21154c 257 }
wolfSSL 0:d92f9d21154c 258
wolfSSL 0:d92f9d21154c 259 #endif /*HAVE_CURVE25519*/
wolfSSL 0:d92f9d21154c 260
wolfSSL 0:d92f9d21154c 261