wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

wolfcrypt/src/ed25519.c@11:cee25a834751, 2017-05-30 (annotated)

Committer:
wolfSSL
Date:
Tue May 30 01:44:10 2017 +0000
Revision:
11:cee25a834751
wolfSSL 3.11.0

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 11:cee25a834751 1 /* ed25519.c
wolfSSL 11:cee25a834751 2 *
wolfSSL 11:cee25a834751 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 11:cee25a834751 4 *
wolfSSL 11:cee25a834751 5 * This file is part of wolfSSL.
wolfSSL 11:cee25a834751 6 *
wolfSSL 11:cee25a834751 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 11:cee25a834751 8 * it under the terms of the GNU General Public License as published by
wolfSSL 11:cee25a834751 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 11:cee25a834751 10 * (at your option) any later version.
wolfSSL 11:cee25a834751 11 *
wolfSSL 11:cee25a834751 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 11:cee25a834751 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 11:cee25a834751 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 11:cee25a834751 15 * GNU General Public License for more details.
wolfSSL 11:cee25a834751 16 *
wolfSSL 11:cee25a834751 17 * You should have received a copy of the GNU General Public License
wolfSSL 11:cee25a834751 18 * along with this program; if not, write to the Free Software
wolfSSL 11:cee25a834751 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 11:cee25a834751 20 */
wolfSSL 11:cee25a834751 21
wolfSSL 11:cee25a834751 22
wolfSSL 11:cee25a834751 23 /* Based On Daniel J Bernstein's ed25519 Public Domain ref10 work. */
wolfSSL 11:cee25a834751 24
wolfSSL 11:cee25a834751 25 #ifdef HAVE_CONFIG_H
wolfSSL 11:cee25a834751 26 #include <config.h>
wolfSSL 11:cee25a834751 27 #endif
wolfSSL 11:cee25a834751 28
wolfSSL 11:cee25a834751 29 /* in case user set HAVE_ED25519 there */
wolfSSL 11:cee25a834751 30 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 11:cee25a834751 31
wolfSSL 11:cee25a834751 32 #ifdef HAVE_ED25519
wolfSSL 11:cee25a834751 33
wolfSSL 11:cee25a834751 34 #include <wolfssl/wolfcrypt/ed25519.h>
wolfSSL 11:cee25a834751 35 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 11:cee25a834751 36 #include <wolfssl/wolfcrypt/hash.h>
wolfSSL 11:cee25a834751 37 #ifdef NO_INLINE
wolfSSL 11:cee25a834751 38 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 11:cee25a834751 39 #else
wolfSSL 11:cee25a834751 40 #define WOLFSSL_MISC_INCLUDED
wolfSSL 11:cee25a834751 41 #include <wolfcrypt/src/misc.c>
wolfSSL 11:cee25a834751 42 #endif
wolfSSL 11:cee25a834751 43
wolfSSL 11:cee25a834751 44 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 45 #include <wolfssl/wolfcrypt/port/nxp/ksdk_port.h>
wolfSSL 11:cee25a834751 46 #endif
wolfSSL 11:cee25a834751 47
wolfSSL 11:cee25a834751 48 /* generate an ed25519 key pair.
wolfSSL 11:cee25a834751 49 * returns 0 on success
wolfSSL 11:cee25a834751 50 */
wolfSSL 11:cee25a834751 51 int wc_ed25519_make_key(WC_RNG* rng, int keySz, ed25519_key* key)
wolfSSL 11:cee25a834751 52 {
wolfSSL 11:cee25a834751 53 byte az[ED25519_PRV_KEY_SIZE];
wolfSSL 11:cee25a834751 54 int ret;
wolfSSL 11:cee25a834751 55 #if !defined(FREESCALE_LTC_ECC)
wolfSSL 11:cee25a834751 56 ge_p3 A;
wolfSSL 11:cee25a834751 57 #endif
wolfSSL 11:cee25a834751 58
wolfSSL 11:cee25a834751 59 if (rng == NULL || key == NULL)
wolfSSL 11:cee25a834751 60 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 61
wolfSSL 11:cee25a834751 62 /* ed25519 has 32 byte key sizes */
wolfSSL 11:cee25a834751 63 if (keySz != ED25519_KEY_SIZE)
wolfSSL 11:cee25a834751 64 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 65
wolfSSL 11:cee25a834751 66 ret = wc_RNG_GenerateBlock(rng, key->k, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 67 if (ret != 0)
wolfSSL 11:cee25a834751 68 return ret;
wolfSSL 11:cee25a834751 69 ret = wc_Sha512Hash(key->k, ED25519_KEY_SIZE, az);
wolfSSL 11:cee25a834751 70 if (ret != 0) {
wolfSSL 11:cee25a834751 71 ForceZero(key->k, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 72 return ret;
wolfSSL 11:cee25a834751 73 }
wolfSSL 11:cee25a834751 74
wolfSSL 11:cee25a834751 75 /* apply clamp */
wolfSSL 11:cee25a834751 76 az[0] &= 248;
wolfSSL 11:cee25a834751 77 az[31] &= 63; /* same than az[31] &= 127 because of az[31] |= 64 */
wolfSSL 11:cee25a834751 78 az[31] |= 64;
wolfSSL 11:cee25a834751 79
wolfSSL 11:cee25a834751 80 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 81 ltc_pkha_ecc_point_t publicKey = {0};
wolfSSL 11:cee25a834751 82 publicKey.X = key->pointX;
wolfSSL 11:cee25a834751 83 publicKey.Y = key->pointY;
wolfSSL 11:cee25a834751 84 LTC_PKHA_Ed25519_PointMul(LTC_PKHA_Ed25519_BasePoint(), az, ED25519_KEY_SIZE, &publicKey, kLTC_Ed25519 /* result on Ed25519 */);
wolfSSL 11:cee25a834751 85 LTC_PKHA_Ed25519_Compress(&publicKey, key->p);
wolfSSL 11:cee25a834751 86 #else
wolfSSL 11:cee25a834751 87 ge_scalarmult_base(&A, az);
wolfSSL 11:cee25a834751 88 ge_p3_tobytes(key->p, &A);
wolfSSL 11:cee25a834751 89 #endif
wolfSSL 11:cee25a834751 90 /* put public key after private key, on the same buffer */
wolfSSL 11:cee25a834751 91 XMEMMOVE(key->k + ED25519_KEY_SIZE, key->p, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 92
wolfSSL 11:cee25a834751 93 return ret;
wolfSSL 11:cee25a834751 94 }
wolfSSL 11:cee25a834751 95
wolfSSL 11:cee25a834751 96
wolfSSL 11:cee25a834751 97 #ifdef HAVE_ED25519_SIGN
wolfSSL 11:cee25a834751 98 /*
wolfSSL 11:cee25a834751 99 in contains the message to sign
wolfSSL 11:cee25a834751 100 inlen is the length of the message to sign
wolfSSL 11:cee25a834751 101 out is the buffer to write the signature
wolfSSL 11:cee25a834751 102 outLen [in/out] input size of out buf
wolfSSL 11:cee25a834751 103 output gets set as the final length of out
wolfSSL 11:cee25a834751 104 key is the ed25519 key to use when signing
wolfSSL 11:cee25a834751 105 return 0 on success
wolfSSL 11:cee25a834751 106 */
wolfSSL 11:cee25a834751 107 int wc_ed25519_sign_msg(const byte* in, word32 inlen, byte* out,
wolfSSL 11:cee25a834751 108 word32 *outLen, ed25519_key* key)
wolfSSL 11:cee25a834751 109 {
wolfSSL 11:cee25a834751 110 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 111 byte tempBuf[ED25519_PRV_KEY_SIZE];
wolfSSL 11:cee25a834751 112 #else
wolfSSL 11:cee25a834751 113 ge_p3 R;
wolfSSL 11:cee25a834751 114 #endif
wolfSSL 11:cee25a834751 115 byte nonce[SHA512_DIGEST_SIZE];
wolfSSL 11:cee25a834751 116 byte hram[SHA512_DIGEST_SIZE];
wolfSSL 11:cee25a834751 117 byte az[ED25519_PRV_KEY_SIZE];
wolfSSL 11:cee25a834751 118 Sha512 sha;
wolfSSL 11:cee25a834751 119 int ret;
wolfSSL 11:cee25a834751 120
wolfSSL 11:cee25a834751 121 /* sanity check on arguments */
wolfSSL 11:cee25a834751 122 if (in == NULL || out == NULL || outLen == NULL || key == NULL)
wolfSSL 11:cee25a834751 123 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 124
wolfSSL 11:cee25a834751 125 /* check and set up out length */
wolfSSL 11:cee25a834751 126 if (*outLen < ED25519_SIG_SIZE) {
wolfSSL 11:cee25a834751 127 *outLen = ED25519_SIG_SIZE;
wolfSSL 11:cee25a834751 128 return BUFFER_E;
wolfSSL 11:cee25a834751 129 }
wolfSSL 11:cee25a834751 130 *outLen = ED25519_SIG_SIZE;
wolfSSL 11:cee25a834751 131
wolfSSL 11:cee25a834751 132 /* step 1: create nonce to use where nonce is r in
wolfSSL 11:cee25a834751 133 r = H(h_b, ... ,h_2b-1,M) */
wolfSSL 11:cee25a834751 134 ret = wc_Sha512Hash(key->k, ED25519_KEY_SIZE, az);
wolfSSL 11:cee25a834751 135 if (ret != 0)
wolfSSL 11:cee25a834751 136 return ret;
wolfSSL 11:cee25a834751 137
wolfSSL 11:cee25a834751 138 /* apply clamp */
wolfSSL 11:cee25a834751 139 az[0] &= 248;
wolfSSL 11:cee25a834751 140 az[31] &= 63; /* same than az[31] &= 127 because of az[31] |= 64 */
wolfSSL 11:cee25a834751 141 az[31] |= 64;
wolfSSL 11:cee25a834751 142
wolfSSL 11:cee25a834751 143 ret = wc_InitSha512(&sha);
wolfSSL 11:cee25a834751 144 if (ret != 0)
wolfSSL 11:cee25a834751 145 return ret;
wolfSSL 11:cee25a834751 146 ret = wc_Sha512Update(&sha, az + ED25519_KEY_SIZE, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 147 if (ret != 0)
wolfSSL 11:cee25a834751 148 return ret;
wolfSSL 11:cee25a834751 149 ret = wc_Sha512Update(&sha, in, inlen);
wolfSSL 11:cee25a834751 150 if (ret != 0)
wolfSSL 11:cee25a834751 151 return ret;
wolfSSL 11:cee25a834751 152 ret = wc_Sha512Final(&sha, nonce);
wolfSSL 11:cee25a834751 153 if (ret != 0)
wolfSSL 11:cee25a834751 154 return ret;
wolfSSL 11:cee25a834751 155
wolfSSL 11:cee25a834751 156 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 157 ltc_pkha_ecc_point_t ltcPoint = {0};
wolfSSL 11:cee25a834751 158 ltcPoint.X = &tempBuf[0];
wolfSSL 11:cee25a834751 159 ltcPoint.Y = &tempBuf[32];
wolfSSL 11:cee25a834751 160 LTC_PKHA_sc_reduce(nonce);
wolfSSL 11:cee25a834751 161 LTC_PKHA_Ed25519_PointMul(LTC_PKHA_Ed25519_BasePoint(), nonce, ED25519_KEY_SIZE, &ltcPoint, kLTC_Ed25519 /* result on Ed25519 */);
wolfSSL 11:cee25a834751 162 LTC_PKHA_Ed25519_Compress(&ltcPoint, out);
wolfSSL 11:cee25a834751 163 #else
wolfSSL 11:cee25a834751 164 sc_reduce(nonce);
wolfSSL 11:cee25a834751 165
wolfSSL 11:cee25a834751 166 /* step 2: computing R = rB where rB is the scalar multiplication of
wolfSSL 11:cee25a834751 167 r and B */
wolfSSL 11:cee25a834751 168 ge_scalarmult_base(&R,nonce);
wolfSSL 11:cee25a834751 169 ge_p3_tobytes(out,&R);
wolfSSL 11:cee25a834751 170 #endif
wolfSSL 11:cee25a834751 171
wolfSSL 11:cee25a834751 172 /* step 3: hash R + public key + message getting H(R,A,M) then
wolfSSL 11:cee25a834751 173 creating S = (r + H(R,A,M)a) mod l */
wolfSSL 11:cee25a834751 174 ret = wc_InitSha512(&sha);
wolfSSL 11:cee25a834751 175 if (ret != 0)
wolfSSL 11:cee25a834751 176 return ret;
wolfSSL 11:cee25a834751 177 ret = wc_Sha512Update(&sha, out, ED25519_SIG_SIZE/2);
wolfSSL 11:cee25a834751 178 if (ret != 0)
wolfSSL 11:cee25a834751 179 return ret;
wolfSSL 11:cee25a834751 180 ret = wc_Sha512Update(&sha, key->p, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 181 if (ret != 0)
wolfSSL 11:cee25a834751 182 return ret;
wolfSSL 11:cee25a834751 183 ret = wc_Sha512Update(&sha, in, inlen);
wolfSSL 11:cee25a834751 184 if (ret != 0)
wolfSSL 11:cee25a834751 185 return ret;
wolfSSL 11:cee25a834751 186 ret = wc_Sha512Final(&sha, hram);
wolfSSL 11:cee25a834751 187 if (ret != 0)
wolfSSL 11:cee25a834751 188 return ret;
wolfSSL 11:cee25a834751 189
wolfSSL 11:cee25a834751 190 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 191 LTC_PKHA_sc_reduce(hram);
wolfSSL 11:cee25a834751 192 LTC_PKHA_sc_muladd(out + (ED25519_SIG_SIZE/2), hram, az, nonce);
wolfSSL 11:cee25a834751 193 #else
wolfSSL 11:cee25a834751 194 sc_reduce(hram);
wolfSSL 11:cee25a834751 195 sc_muladd(out + (ED25519_SIG_SIZE/2), hram, az, nonce);
wolfSSL 11:cee25a834751 196 #endif
wolfSSL 11:cee25a834751 197
wolfSSL 11:cee25a834751 198 return ret;
wolfSSL 11:cee25a834751 199 }
wolfSSL 11:cee25a834751 200
wolfSSL 11:cee25a834751 201 #endif /* HAVE_ED25519_SIGN */
wolfSSL 11:cee25a834751 202
wolfSSL 11:cee25a834751 203 #ifdef HAVE_ED25519_VERIFY
wolfSSL 11:cee25a834751 204
wolfSSL 11:cee25a834751 205 /*
wolfSSL 11:cee25a834751 206 sig is array of bytes containing the signature
wolfSSL 11:cee25a834751 207 siglen is the length of sig byte array
wolfSSL 11:cee25a834751 208 msg the array of bytes containing the message
wolfSSL 11:cee25a834751 209 msglen length of msg array
wolfSSL 11:cee25a834751 210 res will be 1 on successful verify and 0 on unsuccessful
wolfSSL 11:cee25a834751 211 return 0 and res of 1 on success
wolfSSL 11:cee25a834751 212 */
wolfSSL 11:cee25a834751 213 int wc_ed25519_verify_msg(byte* sig, word32 siglen, const byte* msg,
wolfSSL 11:cee25a834751 214 word32 msglen, int* res, ed25519_key* key)
wolfSSL 11:cee25a834751 215 {
wolfSSL 11:cee25a834751 216 byte rcheck[ED25519_KEY_SIZE];
wolfSSL 11:cee25a834751 217 byte h[SHA512_DIGEST_SIZE];
wolfSSL 11:cee25a834751 218 #ifndef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 219 ge_p3 A;
wolfSSL 11:cee25a834751 220 ge_p2 R;
wolfSSL 11:cee25a834751 221 #endif
wolfSSL 11:cee25a834751 222 int ret;
wolfSSL 11:cee25a834751 223 Sha512 sha;
wolfSSL 11:cee25a834751 224
wolfSSL 11:cee25a834751 225 /* sanity check on arguments */
wolfSSL 11:cee25a834751 226 if (sig == NULL || msg == NULL || res == NULL || key == NULL)
wolfSSL 11:cee25a834751 227 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 228
wolfSSL 11:cee25a834751 229 /* set verification failed by default */
wolfSSL 11:cee25a834751 230 *res = 0;
wolfSSL 11:cee25a834751 231
wolfSSL 11:cee25a834751 232 /* check on basics needed to verify signature */
wolfSSL 11:cee25a834751 233 if (siglen < ED25519_SIG_SIZE || (sig[ED25519_SIG_SIZE-1] & 224))
wolfSSL 11:cee25a834751 234 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 235
wolfSSL 11:cee25a834751 236 /* uncompress A (public key), test if valid, and negate it */
wolfSSL 11:cee25a834751 237 #ifndef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 238 if (ge_frombytes_negate_vartime(&A, key->p) != 0)
wolfSSL 11:cee25a834751 239 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 240 #endif
wolfSSL 11:cee25a834751 241
wolfSSL 11:cee25a834751 242 /* find H(R,A,M) and store it as h */
wolfSSL 11:cee25a834751 243 ret = wc_InitSha512(&sha);
wolfSSL 11:cee25a834751 244 if (ret != 0)
wolfSSL 11:cee25a834751 245 return ret;
wolfSSL 11:cee25a834751 246 ret = wc_Sha512Update(&sha, sig, ED25519_SIG_SIZE/2);
wolfSSL 11:cee25a834751 247 if (ret != 0)
wolfSSL 11:cee25a834751 248 return ret;
wolfSSL 11:cee25a834751 249 ret = wc_Sha512Update(&sha, key->p, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 250 if (ret != 0)
wolfSSL 11:cee25a834751 251 return ret;
wolfSSL 11:cee25a834751 252 ret = wc_Sha512Update(&sha, msg, msglen);
wolfSSL 11:cee25a834751 253 if (ret != 0)
wolfSSL 11:cee25a834751 254 return ret;
wolfSSL 11:cee25a834751 255 ret = wc_Sha512Final(&sha, h);
wolfSSL 11:cee25a834751 256 if (ret != 0)
wolfSSL 11:cee25a834751 257 return ret;
wolfSSL 11:cee25a834751 258
wolfSSL 11:cee25a834751 259 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 260 LTC_PKHA_sc_reduce(h);
wolfSSL 11:cee25a834751 261 LTC_PKHA_SignatureForVerify(rcheck, h, sig + (ED25519_SIG_SIZE/2), key);
wolfSSL 11:cee25a834751 262 #else
wolfSSL 11:cee25a834751 263 sc_reduce(h);
wolfSSL 11:cee25a834751 264
wolfSSL 11:cee25a834751 265 /*
wolfSSL 11:cee25a834751 266 Uses a fast single-signature verification SB = R + H(R,A,M)A becomes
wolfSSL 11:cee25a834751 267 SB - H(R,A,M)A saving decompression of R
wolfSSL 11:cee25a834751 268 */
wolfSSL 11:cee25a834751 269 ret = ge_double_scalarmult_vartime(&R, h, &A, sig + (ED25519_SIG_SIZE/2));
wolfSSL 11:cee25a834751 270 if (ret != 0)
wolfSSL 11:cee25a834751 271 return ret;
wolfSSL 11:cee25a834751 272
wolfSSL 11:cee25a834751 273 ge_tobytes(rcheck, &R);
wolfSSL 11:cee25a834751 274 #endif /* FREESCALE_LTC_ECC */
wolfSSL 11:cee25a834751 275
wolfSSL 11:cee25a834751 276 /* comparison of R created to R in sig */
wolfSSL 11:cee25a834751 277 ret = ConstantCompare(rcheck, sig, ED25519_SIG_SIZE/2);
wolfSSL 11:cee25a834751 278 if (ret != 0)
wolfSSL 11:cee25a834751 279 return SIG_VERIFY_E;
wolfSSL 11:cee25a834751 280
wolfSSL 11:cee25a834751 281 /* set the verification status */
wolfSSL 11:cee25a834751 282 *res = 1;
wolfSSL 11:cee25a834751 283
wolfSSL 11:cee25a834751 284 return ret;
wolfSSL 11:cee25a834751 285 }
wolfSSL 11:cee25a834751 286
wolfSSL 11:cee25a834751 287 #endif /* HAVE_ED25519_VERIFY */
wolfSSL 11:cee25a834751 288
wolfSSL 11:cee25a834751 289
wolfSSL 11:cee25a834751 290 /* initialize information and memory for key */
wolfSSL 11:cee25a834751 291 int wc_ed25519_init(ed25519_key* key)
wolfSSL 11:cee25a834751 292 {
wolfSSL 11:cee25a834751 293 if (key == NULL)
wolfSSL 11:cee25a834751 294 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 295
wolfSSL 11:cee25a834751 296 XMEMSET(key, 0, sizeof(ed25519_key));
wolfSSL 11:cee25a834751 297
wolfSSL 11:cee25a834751 298 return 0;
wolfSSL 11:cee25a834751 299 }
wolfSSL 11:cee25a834751 300
wolfSSL 11:cee25a834751 301
wolfSSL 11:cee25a834751 302 /* clear memory of key */
wolfSSL 11:cee25a834751 303 void wc_ed25519_free(ed25519_key* key)
wolfSSL 11:cee25a834751 304 {
wolfSSL 11:cee25a834751 305 if (key == NULL)
wolfSSL 11:cee25a834751 306 return;
wolfSSL 11:cee25a834751 307
wolfSSL 11:cee25a834751 308 ForceZero(key, sizeof(ed25519_key));
wolfSSL 11:cee25a834751 309 }
wolfSSL 11:cee25a834751 310
wolfSSL 11:cee25a834751 311
wolfSSL 11:cee25a834751 312 #ifdef HAVE_ED25519_KEY_EXPORT
wolfSSL 11:cee25a834751 313
wolfSSL 11:cee25a834751 314 /*
wolfSSL 11:cee25a834751 315 outLen should contain the size of out buffer when input. outLen is than set
wolfSSL 11:cee25a834751 316 to the final output length.
wolfSSL 11:cee25a834751 317 returns 0 on success
wolfSSL 11:cee25a834751 318 */
wolfSSL 11:cee25a834751 319 int wc_ed25519_export_public(ed25519_key* key, byte* out, word32* outLen)
wolfSSL 11:cee25a834751 320 {
wolfSSL 11:cee25a834751 321 /* sanity check on arguments */
wolfSSL 11:cee25a834751 322 if (key == NULL || out == NULL || outLen == NULL)
wolfSSL 11:cee25a834751 323 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 324
wolfSSL 11:cee25a834751 325 if (*outLen < ED25519_PUB_KEY_SIZE) {
wolfSSL 11:cee25a834751 326 *outLen = ED25519_PUB_KEY_SIZE;
wolfSSL 11:cee25a834751 327 return BUFFER_E;
wolfSSL 11:cee25a834751 328 }
wolfSSL 11:cee25a834751 329
wolfSSL 11:cee25a834751 330 *outLen = ED25519_PUB_KEY_SIZE;
wolfSSL 11:cee25a834751 331 XMEMCPY(out, key->p, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 332
wolfSSL 11:cee25a834751 333 return 0;
wolfSSL 11:cee25a834751 334 }
wolfSSL 11:cee25a834751 335
wolfSSL 11:cee25a834751 336 #endif /* HAVE_ED25519_KEY_EXPORT */
wolfSSL 11:cee25a834751 337
wolfSSL 11:cee25a834751 338
wolfSSL 11:cee25a834751 339 #ifdef HAVE_ED25519_KEY_IMPORT
wolfSSL 11:cee25a834751 340 /*
wolfSSL 11:cee25a834751 341 Imports a compressed/uncompressed public key.
wolfSSL 11:cee25a834751 342 in the byte array containing the public key
wolfSSL 11:cee25a834751 343 inLen the length of the byte array being passed in
wolfSSL 11:cee25a834751 344 key ed25519 key struct to put the public key in
wolfSSL 11:cee25a834751 345 */
wolfSSL 11:cee25a834751 346 int wc_ed25519_import_public(const byte* in, word32 inLen, ed25519_key* key)
wolfSSL 11:cee25a834751 347 {
wolfSSL 11:cee25a834751 348 int ret;
wolfSSL 11:cee25a834751 349
wolfSSL 11:cee25a834751 350 /* sanity check on arguments */
wolfSSL 11:cee25a834751 351 if (in == NULL || key == NULL)
wolfSSL 11:cee25a834751 352 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 353
wolfSSL 11:cee25a834751 354 if (inLen < ED25519_PUB_KEY_SIZE)
wolfSSL 11:cee25a834751 355 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 356
wolfSSL 11:cee25a834751 357 /* compressed prefix according to draft
wolfSSL 11:cee25a834751 358 http://www.ietf.org/id/draft-koch-eddsa-for-openpgp-02.txt */
wolfSSL 11:cee25a834751 359 if (in[0] == 0x40 && inLen > ED25519_PUB_KEY_SIZE) {
wolfSSL 11:cee25a834751 360 /* key is stored in compressed format so just copy in */
wolfSSL 11:cee25a834751 361 XMEMCPY(key->p, (in + 1), ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 362 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 363 /* recover X coordinate */
wolfSSL 11:cee25a834751 364 ltc_pkha_ecc_point_t pubKey;
wolfSSL 11:cee25a834751 365 pubKey.X = key->pointX;
wolfSSL 11:cee25a834751 366 pubKey.Y = key->pointY;
wolfSSL 11:cee25a834751 367 LTC_PKHA_Ed25519_PointDecompress(key->p, ED25519_PUB_KEY_SIZE, &pubKey);
wolfSSL 11:cee25a834751 368 #endif
wolfSSL 11:cee25a834751 369 return 0;
wolfSSL 11:cee25a834751 370 }
wolfSSL 11:cee25a834751 371
wolfSSL 11:cee25a834751 372 /* importing uncompressed public key */
wolfSSL 11:cee25a834751 373 if (in[0] == 0x04 && inLen > 2*ED25519_PUB_KEY_SIZE) {
wolfSSL 11:cee25a834751 374 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 375 /* reverse bytes for little endian byte order */
wolfSSL 11:cee25a834751 376 for (int i = 0; i < ED25519_KEY_SIZE; i++)
wolfSSL 11:cee25a834751 377 {
wolfSSL 11:cee25a834751 378 key->pointX[i] = *(in + ED25519_KEY_SIZE - i);
wolfSSL 11:cee25a834751 379 key->pointY[i] = *(in + 2*ED25519_KEY_SIZE - i);
wolfSSL 11:cee25a834751 380 }
wolfSSL 11:cee25a834751 381 XMEMCPY(key->p, key->pointY, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 382 ret = 0;
wolfSSL 11:cee25a834751 383 #else
wolfSSL 11:cee25a834751 384 /* pass in (x,y) and store compressed key */
wolfSSL 11:cee25a834751 385 ret = ge_compress_key(key->p, in+1,
wolfSSL 11:cee25a834751 386 in+1+ED25519_PUB_KEY_SIZE, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 387 #endif /* FREESCALE_LTC_ECC */
wolfSSL 11:cee25a834751 388 return ret;
wolfSSL 11:cee25a834751 389 }
wolfSSL 11:cee25a834751 390
wolfSSL 11:cee25a834751 391 /* if not specified compressed or uncompressed check key size
wolfSSL 11:cee25a834751 392 if key size is equal to compressed key size copy in key */
wolfSSL 11:cee25a834751 393 if (inLen == ED25519_PUB_KEY_SIZE) {
wolfSSL 11:cee25a834751 394 XMEMCPY(key->p, in, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 395 #ifdef FREESCALE_LTC_ECC
wolfSSL 11:cee25a834751 396 /* recover X coordinate */
wolfSSL 11:cee25a834751 397 ltc_pkha_ecc_point_t pubKey;
wolfSSL 11:cee25a834751 398 pubKey.X = key->pointX;
wolfSSL 11:cee25a834751 399 pubKey.Y = key->pointY;
wolfSSL 11:cee25a834751 400 LTC_PKHA_Ed25519_PointDecompress(key->p, ED25519_PUB_KEY_SIZE, &pubKey);
wolfSSL 11:cee25a834751 401 #endif
wolfSSL 11:cee25a834751 402 return 0;
wolfSSL 11:cee25a834751 403 }
wolfSSL 11:cee25a834751 404
wolfSSL 11:cee25a834751 405 /* bad public key format */
wolfSSL 11:cee25a834751 406 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 407 }
wolfSSL 11:cee25a834751 408
wolfSSL 11:cee25a834751 409
wolfSSL 11:cee25a834751 410 /*
wolfSSL 11:cee25a834751 411 For importing a private key and its associated public key.
wolfSSL 11:cee25a834751 412 */
wolfSSL 11:cee25a834751 413 int wc_ed25519_import_private_key(const byte* priv, word32 privSz,
wolfSSL 11:cee25a834751 414 const byte* pub, word32 pubSz, ed25519_key* key)
wolfSSL 11:cee25a834751 415 {
wolfSSL 11:cee25a834751 416 int ret;
wolfSSL 11:cee25a834751 417
wolfSSL 11:cee25a834751 418 /* sanity check on arguments */
wolfSSL 11:cee25a834751 419 if (priv == NULL || pub == NULL || key == NULL)
wolfSSL 11:cee25a834751 420 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 421
wolfSSL 11:cee25a834751 422 /* key size check */
wolfSSL 11:cee25a834751 423 if (privSz < ED25519_KEY_SIZE || pubSz < ED25519_PUB_KEY_SIZE)
wolfSSL 11:cee25a834751 424 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 425
wolfSSL 11:cee25a834751 426 /* import public key */
wolfSSL 11:cee25a834751 427 ret = wc_ed25519_import_public(pub, pubSz, key);
wolfSSL 11:cee25a834751 428 if (ret != 0)
wolfSSL 11:cee25a834751 429 return ret;
wolfSSL 11:cee25a834751 430
wolfSSL 11:cee25a834751 431 /* make the private key (priv + pub) */
wolfSSL 11:cee25a834751 432 XMEMCPY(key->k, priv, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 433 XMEMCPY(key->k + ED25519_KEY_SIZE, key->p, ED25519_PUB_KEY_SIZE);
wolfSSL 11:cee25a834751 434
wolfSSL 11:cee25a834751 435 return ret;
wolfSSL 11:cee25a834751 436 }
wolfSSL 11:cee25a834751 437
wolfSSL 11:cee25a834751 438 #endif /* HAVE_ED25519_KEY_IMPORT */
wolfSSL 11:cee25a834751 439
wolfSSL 11:cee25a834751 440
wolfSSL 11:cee25a834751 441 #ifdef HAVE_ED25519_KEY_EXPORT
wolfSSL 11:cee25a834751 442
wolfSSL 11:cee25a834751 443 /*
wolfSSL 11:cee25a834751 444 export private key only (secret part so 32 bytes)
wolfSSL 11:cee25a834751 445 outLen should contain the size of out buffer when input. outLen is than set
wolfSSL 11:cee25a834751 446 to the final output length.
wolfSSL 11:cee25a834751 447 returns 0 on success
wolfSSL 11:cee25a834751 448 */
wolfSSL 11:cee25a834751 449 int wc_ed25519_export_private_only(ed25519_key* key, byte* out, word32* outLen)
wolfSSL 11:cee25a834751 450 {
wolfSSL 11:cee25a834751 451 /* sanity checks on arguments */
wolfSSL 11:cee25a834751 452 if (key == NULL || out == NULL || outLen == NULL)
wolfSSL 11:cee25a834751 453 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 454
wolfSSL 11:cee25a834751 455 if (*outLen < ED25519_KEY_SIZE) {
wolfSSL 11:cee25a834751 456 *outLen = ED25519_KEY_SIZE;
wolfSSL 11:cee25a834751 457 return BUFFER_E;
wolfSSL 11:cee25a834751 458 }
wolfSSL 11:cee25a834751 459
wolfSSL 11:cee25a834751 460 *outLen = ED25519_KEY_SIZE;
wolfSSL 11:cee25a834751 461 XMEMCPY(out, key->k, ED25519_KEY_SIZE);
wolfSSL 11:cee25a834751 462
wolfSSL 11:cee25a834751 463 return 0;
wolfSSL 11:cee25a834751 464 }
wolfSSL 11:cee25a834751 465
wolfSSL 11:cee25a834751 466 /*
wolfSSL 11:cee25a834751 467 export private key, including public part
wolfSSL 11:cee25a834751 468 outLen should contain the size of out buffer when input. outLen is than set
wolfSSL 11:cee25a834751 469 to the final output length.
wolfSSL 11:cee25a834751 470 returns 0 on success
wolfSSL 11:cee25a834751 471 */
wolfSSL 11:cee25a834751 472 int wc_ed25519_export_private(ed25519_key* key, byte* out, word32* outLen)
wolfSSL 11:cee25a834751 473 {
wolfSSL 11:cee25a834751 474 /* sanity checks on arguments */
wolfSSL 11:cee25a834751 475 if (key == NULL || out == NULL || outLen == NULL)
wolfSSL 11:cee25a834751 476 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 477
wolfSSL 11:cee25a834751 478 if (*outLen < ED25519_PRV_KEY_SIZE) {
wolfSSL 11:cee25a834751 479 *outLen = ED25519_PRV_KEY_SIZE;
wolfSSL 11:cee25a834751 480 return BUFFER_E;
wolfSSL 11:cee25a834751 481 }
wolfSSL 11:cee25a834751 482
wolfSSL 11:cee25a834751 483 *outLen = ED25519_PRV_KEY_SIZE;
wolfSSL 11:cee25a834751 484 XMEMCPY(out, key->k, ED25519_PRV_KEY_SIZE);
wolfSSL 11:cee25a834751 485
wolfSSL 11:cee25a834751 486 return 0;
wolfSSL 11:cee25a834751 487 }
wolfSSL 11:cee25a834751 488
wolfSSL 11:cee25a834751 489 /* export full private key and public key
wolfSSL 11:cee25a834751 490 return 0 on success
wolfSSL 11:cee25a834751 491 */
wolfSSL 11:cee25a834751 492 int wc_ed25519_export_key(ed25519_key* key,
wolfSSL 11:cee25a834751 493 byte* priv, word32 *privSz,
wolfSSL 11:cee25a834751 494 byte* pub, word32 *pubSz)
wolfSSL 11:cee25a834751 495 {
wolfSSL 11:cee25a834751 496 int ret;
wolfSSL 11:cee25a834751 497
wolfSSL 11:cee25a834751 498 /* export 'full' private part */
wolfSSL 11:cee25a834751 499 ret = wc_ed25519_export_private(key, priv, privSz);
wolfSSL 11:cee25a834751 500 if (ret != 0)
wolfSSL 11:cee25a834751 501 return ret;
wolfSSL 11:cee25a834751 502
wolfSSL 11:cee25a834751 503 /* export public part */
wolfSSL 11:cee25a834751 504 ret = wc_ed25519_export_public(key, pub, pubSz);
wolfSSL 11:cee25a834751 505
wolfSSL 11:cee25a834751 506 return ret;
wolfSSL 11:cee25a834751 507 }
wolfSSL 11:cee25a834751 508
wolfSSL 11:cee25a834751 509 #endif /* HAVE_ED25519_KEY_EXPORT */
wolfSSL 11:cee25a834751 510
wolfSSL 11:cee25a834751 511
wolfSSL 11:cee25a834751 512 /* returns the private key size (secret only) in bytes */
wolfSSL 11:cee25a834751 513 int wc_ed25519_size(ed25519_key* key)
wolfSSL 11:cee25a834751 514 {
wolfSSL 11:cee25a834751 515 if (key == NULL)
wolfSSL 11:cee25a834751 516 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 517
wolfSSL 11:cee25a834751 518 return ED25519_KEY_SIZE;
wolfSSL 11:cee25a834751 519 }
wolfSSL 11:cee25a834751 520
wolfSSL 11:cee25a834751 521 /* returns the private key size (secret + public) in bytes */
wolfSSL 11:cee25a834751 522 int wc_ed25519_priv_size(ed25519_key* key)
wolfSSL 11:cee25a834751 523 {
wolfSSL 11:cee25a834751 524 if (key == NULL)
wolfSSL 11:cee25a834751 525 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 526
wolfSSL 11:cee25a834751 527 return ED25519_PRV_KEY_SIZE;
wolfSSL 11:cee25a834751 528 }
wolfSSL 11:cee25a834751 529
wolfSSL 11:cee25a834751 530 /* returns the compressed key size in bytes (public key) */
wolfSSL 11:cee25a834751 531 int wc_ed25519_pub_size(ed25519_key* key)
wolfSSL 11:cee25a834751 532 {
wolfSSL 11:cee25a834751 533 if (key == NULL)
wolfSSL 11:cee25a834751 534 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 535
wolfSSL 11:cee25a834751 536 return ED25519_PUB_KEY_SIZE;
wolfSSL 11:cee25a834751 537 }
wolfSSL 11:cee25a834751 538
wolfSSL 11:cee25a834751 539 /* returns the size of signature in bytes */
wolfSSL 11:cee25a834751 540 int wc_ed25519_sig_size(ed25519_key* key)
wolfSSL 11:cee25a834751 541 {
wolfSSL 11:cee25a834751 542 if (key == NULL)
wolfSSL 11:cee25a834751 543 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 544
wolfSSL 11:cee25a834751 545 return ED25519_SIG_SIZE;
wolfSSL 11:cee25a834751 546 }
wolfSSL 11:cee25a834751 547
wolfSSL 11:cee25a834751 548 #endif /* HAVE_ED25519 */
wolfSSL 11:cee25a834751 549
wolfSSL 11:cee25a834751 550