Break out into separate repo.
This commit is contained in:
Moxie Marlinspike
commit
60800e1556
|
|
@ -0,0 +1,3 @@
|
|||
/build
|
||||
/obj
|
||||
*.iml
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
|
||||
# Overview
|
||||
|
||||
This is a ratcheting forward secrecy protocol that works in synchronous and asynchronous messaging
|
||||
environments. The protocol overview is available [here](https://github.com/trevp/axolotl/wiki),
|
||||
and the details of the wire format are available [here](https://github.com/WhisperSystems/TextSecure/wiki/ProtocolV2).
|
||||
|
||||
## PreKeys
|
||||
|
||||
This protocol uses a concept called 'PreKeys'. A PreKey is an ECPublicKey and an associated unique
|
||||
ID which are stored together by a server. PreKeys can also be signed.
|
||||
|
||||
At install time, clients generate a single signed PreKey, as well as a large list of unsigned
|
||||
PreKeys, and transmit all of them to the server.
|
||||
|
||||
## Sessions
|
||||
|
||||
The axolotl protocol is session-oriented. Clients establish a "session," which is then used for
|
||||
all subsequent encrypt/decrypt operations. There is no need to ever tear down a session once one
|
||||
has been established.
|
||||
|
||||
Sessions are established in one of three ways:
|
||||
|
||||
1. PreKeyBundles. A client that wishes to send a message to a recipient can establish a session by
|
||||
retrieving a PreKeyBundle for that recipient from the server.
|
||||
1. PreKeyWhisperMessages. A client can receive a PreKeyWhisperMessage from a recipient and use it
|
||||
to establish a session.
|
||||
1. KeyExchangeMessages. Two clients can exchange KeyExchange messages to establish a session.
|
||||
|
||||
## State
|
||||
|
||||
An established session encapsulates a lot of state between two clients. That state is maintained
|
||||
in durable records which need to be kept for the life of the session.
|
||||
|
||||
State is kept in the following places:
|
||||
|
||||
1. Identity State. Clients will need to maintain the state of their own identity key pair, as well
|
||||
as identity keys received from other clients.
|
||||
1. PreKey State. Clients will need to maintain the state of their generated PreKeys.
|
||||
1. Signed PreKey States. Clients will need to maintain the state of their signed PreKeys.
|
||||
1. Session State. Clients will need to maintain the state of the sessions they have established.
|
||||
|
||||
# Using libaxolotl
|
||||
|
||||
## Install time
|
||||
|
||||
At install time, a libaxolotl client needs to generate its identity keys, registration id, and
|
||||
prekeys.
|
||||
|
||||
IdentityKeyPair identityKeyPair = KeyHelper.generateIdentityKeyPair();
|
||||
int registrationId = KeyHelper.generateRegistrationId();
|
||||
List<PreKeyRecord> preKeys = KeyHelper.generatePreKeys(startId, 100);
|
||||
PreKeyRecord lastResortKey = KeyHelper.generateLastResortKey();
|
||||
SignedPreKeyRecord signedPreKey = KeyHelper.generateSignedPreKey(identityKeyPair, 5);
|
||||
|
||||
// Store identityKeyPair somewhere durable and safe.
|
||||
// Store registrationId somewhere durable and safe.
|
||||
|
||||
// Store preKeys in PreKeyStore.
|
||||
// Store signed prekey in SignedPreKeyStore.
|
||||
|
||||
## Building a session
|
||||
|
||||
A libaxolotl client needs to implement four interfaces: IdentityKeyStore, PreKeyStore,
|
||||
SignedPreKeyStore, and SessionStore. These will manage loading and storing of identity,
|
||||
prekeys, signed prekeys, and session state.
|
||||
|
||||
Once those are implemented, building a session is fairly straightforward:
|
||||
|
||||
SessionStore sessionStore = new MySessionStore();
|
||||
PreKeyStore preKeyStore = new MyPreKeyStore();
|
||||
SignedPreKeyStore signedPreKeyStore = new MySignedPreKeyStore();
|
||||
IdentityKeyStore identityStore = new MyIdentityKeyStore();
|
||||
|
||||
// Instantiate a SessionBuilder for a remote recipientId + deviceId tuple.
|
||||
SessionBuilder sessionBuilder = new SessionBuilder(sessionStore, preKeyStore, signedPreKeyStore,
|
||||
identityStore, recipientId, deviceId);
|
||||
|
||||
// Build a session with a PreKey retrieved from the server.
|
||||
sessionBuilder.process(retrievedPreKey);
|
||||
|
||||
SessionCipher sessionCipher = new SessionCipher(sessionStore, recipientId, deviceId);
|
||||
CiphertextMessage message = sessionCipher.encrypt("Hello world!".getBytes("UTF-8"));
|
||||
|
||||
deliver(message.serialize());
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
buildscript {
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
|
||||
dependencies {
|
||||
classpath 'com.android.tools.build:gradle:0.14.2'
|
||||
}
|
||||
}
|
||||
|
||||
apply plugin: 'com.android.library'
|
||||
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
|
||||
dependencies {
|
||||
compile 'com.google.protobuf:protobuf-java:2.5.0'
|
||||
}
|
||||
|
||||
android {
|
||||
compileSdkVersion 21
|
||||
buildToolsVersion '21.1.1'
|
||||
|
||||
compileOptions {
|
||||
sourceCompatibility JavaVersion.VERSION_1_7
|
||||
targetCompatibility JavaVersion.VERSION_1_7
|
||||
}
|
||||
|
||||
android {
|
||||
sourceSets {
|
||||
main {
|
||||
jniLibs.srcDirs = ['libs']
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
tasks.whenTaskAdded { task ->
|
||||
if (task.name.equals("lint")) {
|
||||
task.enabled = false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
LOCAL_PATH:= $(call my-dir)
|
||||
|
||||
include $(CLEAR_VARS)
|
||||
|
||||
LOCAL_MODULE := libcurve25519-donna
|
||||
LOCAL_SRC_FILES := curve25519-donna.c
|
||||
|
||||
include $(BUILD_STATIC_LIBRARY)
|
||||
|
||||
include $(CLEAR_VARS)
|
||||
|
||||
LOCAL_MODULE := libcurve25519-ref10
|
||||
LOCAL_SRC_FILES := $(wildcard ed25519/*.c) $(wildcard ed25519/additions/*.c) $(wildcard ed25519/nacl_sha512/*.c)
|
||||
LOCAL_C_INCLUDES := ed25519/nacl_includes ed25519/additions ed25519/sha512 ed25519
|
||||
|
||||
include $(BUILD_STATIC_LIBRARY)
|
||||
|
||||
include $(CLEAR_VARS)
|
||||
|
||||
LOCAL_MODULE := libcurve25519
|
||||
LOCAL_SRC_FILES := curve25519-jni.c
|
||||
LOCAL_C_INCLUDES := ed25519/additions
|
||||
|
||||
LOCAL_STATIC_LIBRARIES := libcurve25519-donna libcurve25519-ref10
|
||||
|
||||
include $(BUILD_SHARED_LIBRARY)
|
||||
|
||||
|
|
@ -0,0 +1 @@
|
|||
APP_ABI := armeabi armeabi-v7a x86 mips
|
||||
|
|
@ -0,0 +1,870 @@
|
|||
/* Copyright 2008, Google Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are
|
||||
* met:
|
||||
*
|
||||
* * Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* * Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following disclaimer
|
||||
* in the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
* * Neither the name of Google Inc. nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* curve25519-donna: Curve25519 elliptic curve, public key function
|
||||
*
|
||||
* http://code.google.com/p/curve25519-donna/
|
||||
*
|
||||
* Adam Langley <agl@imperialviolet.org>
|
||||
*
|
||||
* Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
|
||||
*
|
||||
* More information about curve25519 can be found here
|
||||
* http://cr.yp.to/ecdh.html
|
||||
*
|
||||
* djb's sample implementation of curve25519 is written in a special assembly
|
||||
* language called qhasm and uses the floating point registers.
|
||||
*
|
||||
* This is, almost, a clean room reimplementation from the curve25519 paper. It
|
||||
* uses many of the tricks described therein. Only the crecip function is taken
|
||||
* from the sample implementation. */
|
||||
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef _MSC_VER
|
||||
#define inline __inline
|
||||
#endif
|
||||
|
||||
typedef uint8_t u8;
|
||||
typedef int32_t s32;
|
||||
typedef int64_t limb;
|
||||
|
||||
/* Field element representation:
|
||||
*
|
||||
* Field elements are written as an array of signed, 64-bit limbs, least
|
||||
* significant first. The value of the field element is:
|
||||
* x[0] + 2^26·x[1] + x^51·x[2] + 2^102·x[3] + ...
|
||||
*
|
||||
* i.e. the limbs are 26, 25, 26, 25, ... bits wide. */
|
||||
|
||||
/* Sum two numbers: output += in */
|
||||
static void fsum(limb *output, const limb *in) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; i += 2) {
|
||||
output[0+i] = output[0+i] + in[0+i];
|
||||
output[1+i] = output[1+i] + in[1+i];
|
||||
}
|
||||
}
|
||||
|
||||
/* Find the difference of two numbers: output = in - output
|
||||
* (note the order of the arguments!). */
|
||||
static void fdifference(limb *output, const limb *in) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; ++i) {
|
||||
output[i] = in[i] - output[i];
|
||||
}
|
||||
}
|
||||
|
||||
/* Multiply a number by a scalar: output = in * scalar */
|
||||
static void fscalar_product(limb *output, const limb *in, const limb scalar) {
|
||||
unsigned i;
|
||||
for (i = 0; i < 10; ++i) {
|
||||
output[i] = in[i] * scalar;
|
||||
}
|
||||
}
|
||||
|
||||
/* Multiply two numbers: output = in2 * in
|
||||
*
|
||||
* output must be distinct to both inputs. The inputs are reduced coefficient
|
||||
* form, the output is not.
|
||||
*
|
||||
* output[x] <= 14 * the largest product of the input limbs. */
|
||||
static void fproduct(limb *output, const limb *in2, const limb *in) {
|
||||
output[0] = ((limb) ((s32) in2[0])) * ((s32) in[0]);
|
||||
output[1] = ((limb) ((s32) in2[0])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[0]);
|
||||
output[2] = 2 * ((limb) ((s32) in2[1])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[0]);
|
||||
output[3] = ((limb) ((s32) in2[1])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[0]);
|
||||
output[4] = ((limb) ((s32) in2[2])) * ((s32) in[2]) +
|
||||
2 * (((limb) ((s32) in2[1])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[0]);
|
||||
output[5] = ((limb) ((s32) in2[2])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[0]);
|
||||
output[6] = 2 * (((limb) ((s32) in2[3])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[0]);
|
||||
output[7] = ((limb) ((s32) in2[3])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[0]);
|
||||
output[8] = ((limb) ((s32) in2[4])) * ((s32) in[4]) +
|
||||
2 * (((limb) ((s32) in2[3])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[0]);
|
||||
output[9] = ((limb) ((s32) in2[4])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in2[0])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[0]);
|
||||
output[10] = 2 * (((limb) ((s32) in2[5])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[1])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[1])) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[2]);
|
||||
output[11] = ((limb) ((s32) in2[5])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in2[2])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[2]);
|
||||
output[12] = ((limb) ((s32) in2[6])) * ((s32) in[6]) +
|
||||
2 * (((limb) ((s32) in2[5])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[3])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[3])) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[4]);
|
||||
output[13] = ((limb) ((s32) in2[6])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[7])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in2[4])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[4]);
|
||||
output[14] = 2 * (((limb) ((s32) in2[7])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[5])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[5])) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[6]);
|
||||
output[15] = ((limb) ((s32) in2[7])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in2[8])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in2[6])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[6]);
|
||||
output[16] = ((limb) ((s32) in2[8])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in2[7])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[7]));
|
||||
output[17] = ((limb) ((s32) in2[8])) * ((s32) in[9]) +
|
||||
((limb) ((s32) in2[9])) * ((s32) in[8]);
|
||||
output[18] = 2 * ((limb) ((s32) in2[9])) * ((s32) in[9]);
|
||||
}
|
||||
|
||||
/* Reduce a long form to a short form by taking the input mod 2^255 - 19.
|
||||
*
|
||||
* On entry: |output[i]| < 14*2^54
|
||||
* On exit: |output[0..8]| < 280*2^54 */
|
||||
static void freduce_degree(limb *output) {
|
||||
/* Each of these shifts and adds ends up multiplying the value by 19.
|
||||
*
|
||||
* For output[0..8], the absolute entry value is < 14*2^54 and we add, at
|
||||
* most, 19*14*2^54 thus, on exit, |output[0..8]| < 280*2^54. */
|
||||
output[8] += output[18] << 4;
|
||||
output[8] += output[18] << 1;
|
||||
output[8] += output[18];
|
||||
output[7] += output[17] << 4;
|
||||
output[7] += output[17] << 1;
|
||||
output[7] += output[17];
|
||||
output[6] += output[16] << 4;
|
||||
output[6] += output[16] << 1;
|
||||
output[6] += output[16];
|
||||
output[5] += output[15] << 4;
|
||||
output[5] += output[15] << 1;
|
||||
output[5] += output[15];
|
||||
output[4] += output[14] << 4;
|
||||
output[4] += output[14] << 1;
|
||||
output[4] += output[14];
|
||||
output[3] += output[13] << 4;
|
||||
output[3] += output[13] << 1;
|
||||
output[3] += output[13];
|
||||
output[2] += output[12] << 4;
|
||||
output[2] += output[12] << 1;
|
||||
output[2] += output[12];
|
||||
output[1] += output[11] << 4;
|
||||
output[1] += output[11] << 1;
|
||||
output[1] += output[11];
|
||||
output[0] += output[10] << 4;
|
||||
output[0] += output[10] << 1;
|
||||
output[0] += output[10];
|
||||
}
|
||||
|
||||
#if (-1 & 3) != 3
|
||||
#error "This code only works on a two's complement system"
|
||||
#endif
|
||||
|
||||
/* return v / 2^26, using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline limb
|
||||
div_by_2_26(const limb v)
|
||||
{
|
||||
/* High word of v; no shift needed. */
|
||||
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||
/* Set to all 1s if v was negative; else set to 0s. */
|
||||
const int32_t sign = ((int32_t) highword) >> 31;
|
||||
/* Set to 0x3ffffff if v was negative; else set to 0. */
|
||||
const int32_t roundoff = ((uint32_t) sign) >> 6;
|
||||
/* Should return v / (1<<26) */
|
||||
return (v + roundoff) >> 26;
|
||||
}
|
||||
|
||||
/* return v / (2^25), using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline limb
|
||||
div_by_2_25(const limb v)
|
||||
{
|
||||
/* High word of v; no shift needed*/
|
||||
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||
/* Set to all 1s if v was negative; else set to 0s. */
|
||||
const int32_t sign = ((int32_t) highword) >> 31;
|
||||
/* Set to 0x1ffffff if v was negative; else set to 0. */
|
||||
const int32_t roundoff = ((uint32_t) sign) >> 7;
|
||||
/* Should return v / (1<<25) */
|
||||
return (v + roundoff) >> 25;
|
||||
}
|
||||
|
||||
/* return v / (2^25), using only shifts and adds.
|
||||
*
|
||||
* On entry: v can take any value. */
|
||||
static inline s32
|
||||
div_s32_by_2_25(const s32 v)
|
||||
{
|
||||
const s32 roundoff = ((uint32_t)(v >> 31)) >> 7;
|
||||
return (v + roundoff) >> 25;
|
||||
}
|
||||
|
||||
/* Reduce all coefficients of the short form input so that |x| < 2^26.
|
||||
*
|
||||
* On entry: |output[i]| < 280*2^54 */
|
||||
static void freduce_coefficients(limb *output) {
|
||||
unsigned i;
|
||||
|
||||
output[10] = 0;
|
||||
|
||||
for (i = 0; i < 10; i += 2) {
|
||||
limb over = div_by_2_26(output[i]);
|
||||
/* The entry condition (that |output[i]| < 280*2^54) means that over is, at
|
||||
* most, 280*2^28 in the first iteration of this loop. This is added to the
|
||||
* next limb and we can approximate the resulting bound of that limb by
|
||||
* 281*2^54. */
|
||||
output[i] -= over << 26;
|
||||
output[i+1] += over;
|
||||
|
||||
/* For the first iteration, |output[i+1]| < 281*2^54, thus |over| <
|
||||
* 281*2^29. When this is added to the next limb, the resulting bound can
|
||||
* be approximated as 281*2^54.
|
||||
*
|
||||
* For subsequent iterations of the loop, 281*2^54 remains a conservative
|
||||
* bound and no overflow occurs. */
|
||||
over = div_by_2_25(output[i+1]);
|
||||
output[i+1] -= over << 25;
|
||||
output[i+2] += over;
|
||||
}
|
||||
/* Now |output[10]| < 281*2^29 and all other coefficients are reduced. */
|
||||
output[0] += output[10] << 4;
|
||||
output[0] += output[10] << 1;
|
||||
output[0] += output[10];
|
||||
|
||||
output[10] = 0;
|
||||
|
||||
/* Now output[1..9] are reduced, and |output[0]| < 2^26 + 19*281*2^29
|
||||
* So |over| will be no more than 2^16. */
|
||||
{
|
||||
limb over = div_by_2_26(output[0]);
|
||||
output[0] -= over << 26;
|
||||
output[1] += over;
|
||||
}
|
||||
|
||||
/* Now output[0,2..9] are reduced, and |output[1]| < 2^25 + 2^16 < 2^26. The
|
||||
* bound on |output[1]| is sufficient to meet our needs. */
|
||||
}
|
||||
|
||||
/* A helpful wrapper around fproduct: output = in * in2.
|
||||
*
|
||||
* On entry: |in[i]| < 2^27 and |in2[i]| < 2^27.
|
||||
*
|
||||
* output must be distinct to both inputs. The output is reduced degree
|
||||
* (indeed, one need only provide storage for 10 limbs) and |output[i]| < 2^26. */
|
||||
static void
|
||||
fmul(limb *output, const limb *in, const limb *in2) {
|
||||
limb t[19];
|
||||
fproduct(t, in, in2);
|
||||
/* |t[i]| < 14*2^54 */
|
||||
freduce_degree(t);
|
||||
freduce_coefficients(t);
|
||||
/* |t[i]| < 2^26 */
|
||||
memcpy(output, t, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
/* Square a number: output = in**2
|
||||
*
|
||||
* output must be distinct from the input. The inputs are reduced coefficient
|
||||
* form, the output is not.
|
||||
*
|
||||
* output[x] <= 14 * the largest product of the input limbs. */
|
||||
static void fsquare_inner(limb *output, const limb *in) {
|
||||
output[0] = ((limb) ((s32) in[0])) * ((s32) in[0]);
|
||||
output[1] = 2 * ((limb) ((s32) in[0])) * ((s32) in[1]);
|
||||
output[2] = 2 * (((limb) ((s32) in[1])) * ((s32) in[1]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[2]));
|
||||
output[3] = 2 * (((limb) ((s32) in[1])) * ((s32) in[2]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[3]));
|
||||
output[4] = ((limb) ((s32) in[2])) * ((s32) in[2]) +
|
||||
4 * ((limb) ((s32) in[1])) * ((s32) in[3]) +
|
||||
2 * ((limb) ((s32) in[0])) * ((s32) in[4]);
|
||||
output[5] = 2 * (((limb) ((s32) in[2])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[5]));
|
||||
output[6] = 2 * (((limb) ((s32) in[3])) * ((s32) in[3]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[6]) +
|
||||
2 * ((limb) ((s32) in[1])) * ((s32) in[5]));
|
||||
output[7] = 2 * (((limb) ((s32) in[3])) * ((s32) in[4]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[7]));
|
||||
output[8] = ((limb) ((s32) in[4])) * ((s32) in[4]) +
|
||||
2 * (((limb) ((s32) in[2])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[1])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[5])));
|
||||
output[9] = 2 * (((limb) ((s32) in[4])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[0])) * ((s32) in[9]));
|
||||
output[10] = 2 * (((limb) ((s32) in[5])) * ((s32) in[5]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[3])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[1])) * ((s32) in[9])));
|
||||
output[11] = 2 * (((limb) ((s32) in[5])) * ((s32) in[6]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[2])) * ((s32) in[9]));
|
||||
output[12] = ((limb) ((s32) in[6])) * ((s32) in[6]) +
|
||||
2 * (((limb) ((s32) in[4])) * ((s32) in[8]) +
|
||||
2 * (((limb) ((s32) in[5])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[3])) * ((s32) in[9])));
|
||||
output[13] = 2 * (((limb) ((s32) in[6])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[5])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[4])) * ((s32) in[9]));
|
||||
output[14] = 2 * (((limb) ((s32) in[7])) * ((s32) in[7]) +
|
||||
((limb) ((s32) in[6])) * ((s32) in[8]) +
|
||||
2 * ((limb) ((s32) in[5])) * ((s32) in[9]));
|
||||
output[15] = 2 * (((limb) ((s32) in[7])) * ((s32) in[8]) +
|
||||
((limb) ((s32) in[6])) * ((s32) in[9]));
|
||||
output[16] = ((limb) ((s32) in[8])) * ((s32) in[8]) +
|
||||
4 * ((limb) ((s32) in[7])) * ((s32) in[9]);
|
||||
output[17] = 2 * ((limb) ((s32) in[8])) * ((s32) in[9]);
|
||||
output[18] = 2 * ((limb) ((s32) in[9])) * ((s32) in[9]);
|
||||
}
|
||||
|
||||
/* fsquare sets output = in^2.
|
||||
*
|
||||
* On entry: The |in| argument is in reduced coefficients form and |in[i]| <
|
||||
* 2^27.
|
||||
*
|
||||
* On exit: The |output| argument is in reduced coefficients form (indeed, one
|
||||
* need only provide storage for 10 limbs) and |out[i]| < 2^26. */
|
||||
static void
|
||||
fsquare(limb *output, const limb *in) {
|
||||
limb t[19];
|
||||
fsquare_inner(t, in);
|
||||
/* |t[i]| < 14*2^54 because the largest product of two limbs will be <
|
||||
* 2^(27+27) and fsquare_inner adds together, at most, 14 of those
|
||||
* products. */
|
||||
freduce_degree(t);
|
||||
freduce_coefficients(t);
|
||||
/* |t[i]| < 2^26 */
|
||||
memcpy(output, t, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
/* Take a little-endian, 32-byte number and expand it into polynomial form */
|
||||
static void
|
||||
fexpand(limb *output, const u8 *input) {
|
||||
#define F(n,start,shift,mask) \
|
||||
output[n] = ((((limb) input[start + 0]) | \
|
||||
((limb) input[start + 1]) << 8 | \
|
||||
((limb) input[start + 2]) << 16 | \
|
||||
((limb) input[start + 3]) << 24) >> shift) & mask;
|
||||
F(0, 0, 0, 0x3ffffff);
|
||||
F(1, 3, 2, 0x1ffffff);
|
||||
F(2, 6, 3, 0x3ffffff);
|
||||
F(3, 9, 5, 0x1ffffff);
|
||||
F(4, 12, 6, 0x3ffffff);
|
||||
F(5, 16, 0, 0x1ffffff);
|
||||
F(6, 19, 1, 0x3ffffff);
|
||||
F(7, 22, 3, 0x1ffffff);
|
||||
F(8, 25, 4, 0x3ffffff);
|
||||
F(9, 28, 6, 0x1ffffff);
|
||||
#undef F
|
||||
}
|
||||
|
||||
#if (-32 >> 1) != -16
|
||||
#error "This code only works when >> does sign-extension on negative numbers"
|
||||
#endif
|
||||
|
||||
/* s32_eq returns 0xffffffff iff a == b and zero otherwise. */
|
||||
static s32 s32_eq(s32 a, s32 b) {
|
||||
a = ~(a ^ b);
|
||||
a &= a << 16;
|
||||
a &= a << 8;
|
||||
a &= a << 4;
|
||||
a &= a << 2;
|
||||
a &= a << 1;
|
||||
return a >> 31;
|
||||
}
|
||||
|
||||
/* s32_gte returns 0xffffffff if a >= b and zero otherwise, where a and b are
|
||||
* both non-negative. */
|
||||
static s32 s32_gte(s32 a, s32 b) {
|
||||
a -= b;
|
||||
/* a >= 0 iff a >= b. */
|
||||
return ~(a >> 31);
|
||||
}
|
||||
|
||||
/* Take a fully reduced polynomial form number and contract it into a
|
||||
* little-endian, 32-byte array.
|
||||
*
|
||||
* On entry: |input_limbs[i]| < 2^26 */
|
||||
static void
|
||||
fcontract(u8 *output, limb *input_limbs) {
|
||||
int i;
|
||||
int j;
|
||||
s32 input[10];
|
||||
s32 mask;
|
||||
|
||||
/* |input_limbs[i]| < 2^26, so it's valid to convert to an s32. */
|
||||
for (i = 0; i < 10; i++) {
|
||||
input[i] = input_limbs[i];
|
||||
}
|
||||
|
||||
for (j = 0; j < 2; ++j) {
|
||||
for (i = 0; i < 9; ++i) {
|
||||
if ((i & 1) == 1) {
|
||||
/* This calculation is a time-invariant way to make input[i]
|
||||
* non-negative by borrowing from the next-larger limb. */
|
||||
const s32 mask = input[i] >> 31;
|
||||
const s32 carry = -((input[i] & mask) >> 25);
|
||||
input[i] = input[i] + (carry << 25);
|
||||
input[i+1] = input[i+1] - carry;
|
||||
} else {
|
||||
const s32 mask = input[i] >> 31;
|
||||
const s32 carry = -((input[i] & mask) >> 26);
|
||||
input[i] = input[i] + (carry << 26);
|
||||
input[i+1] = input[i+1] - carry;
|
||||
}
|
||||
}
|
||||
|
||||
/* There's no greater limb for input[9] to borrow from, but we can multiply
|
||||
* by 19 and borrow from input[0], which is valid mod 2^255-19. */
|
||||
{
|
||||
const s32 mask = input[9] >> 31;
|
||||
const s32 carry = -((input[9] & mask) >> 25);
|
||||
input[9] = input[9] + (carry << 25);
|
||||
input[0] = input[0] - (carry * 19);
|
||||
}
|
||||
|
||||
/* After the first iteration, input[1..9] are non-negative and fit within
|
||||
* 25 or 26 bits, depending on position. However, input[0] may be
|
||||
* negative. */
|
||||
}
|
||||
|
||||
/* The first borrow-propagation pass above ended with every limb
|
||||
except (possibly) input[0] non-negative.
|
||||
|
||||
If input[0] was negative after the first pass, then it was because of a
|
||||
carry from input[9]. On entry, input[9] < 2^26 so the carry was, at most,
|
||||
one, since (2**26-1) >> 25 = 1. Thus input[0] >= -19.
|
||||
|
||||
In the second pass, each limb is decreased by at most one. Thus the second
|
||||
borrow-propagation pass could only have wrapped around to decrease
|
||||
input[0] again if the first pass left input[0] negative *and* input[1]
|
||||
through input[9] were all zero. In that case, input[1] is now 2^25 - 1,
|
||||
and this last borrow-propagation step will leave input[1] non-negative. */
|
||||
{
|
||||
const s32 mask = input[0] >> 31;
|
||||
const s32 carry = -((input[0] & mask) >> 26);
|
||||
input[0] = input[0] + (carry << 26);
|
||||
input[1] = input[1] - carry;
|
||||
}
|
||||
|
||||
/* All input[i] are now non-negative. However, there might be values between
|
||||
* 2^25 and 2^26 in a limb which is, nominally, 25 bits wide. */
|
||||
for (j = 0; j < 2; j++) {
|
||||
for (i = 0; i < 9; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
const s32 carry = input[i] >> 25;
|
||||
input[i] &= 0x1ffffff;
|
||||
input[i+1] += carry;
|
||||
} else {
|
||||
const s32 carry = input[i] >> 26;
|
||||
input[i] &= 0x3ffffff;
|
||||
input[i+1] += carry;
|
||||
}
|
||||
}
|
||||
|
||||
{
|
||||
const s32 carry = input[9] >> 25;
|
||||
input[9] &= 0x1ffffff;
|
||||
input[0] += 19*carry;
|
||||
}
|
||||
}
|
||||
|
||||
/* If the first carry-chain pass, just above, ended up with a carry from
|
||||
* input[9], and that caused input[0] to be out-of-bounds, then input[0] was
|
||||
* < 2^26 + 2*19, because the carry was, at most, two.
|
||||
*
|
||||
* If the second pass carried from input[9] again then input[0] is < 2*19 and
|
||||
* the input[9] -> input[0] carry didn't push input[0] out of bounds. */
|
||||
|
||||
/* It still remains the case that input might be between 2^255-19 and 2^255.
|
||||
* In this case, input[1..9] must take their maximum value and input[0] must
|
||||
* be >= (2^255-19) & 0x3ffffff, which is 0x3ffffed. */
|
||||
mask = s32_gte(input[0], 0x3ffffed);
|
||||
for (i = 1; i < 10; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
mask &= s32_eq(input[i], 0x1ffffff);
|
||||
} else {
|
||||
mask &= s32_eq(input[i], 0x3ffffff);
|
||||
}
|
||||
}
|
||||
|
||||
/* mask is either 0xffffffff (if input >= 2^255-19) and zero otherwise. Thus
|
||||
* this conditionally subtracts 2^255-19. */
|
||||
input[0] -= mask & 0x3ffffed;
|
||||
|
||||
for (i = 1; i < 10; i++) {
|
||||
if ((i & 1) == 1) {
|
||||
input[i] -= mask & 0x1ffffff;
|
||||
} else {
|
||||
input[i] -= mask & 0x3ffffff;
|
||||
}
|
||||
}
|
||||
|
||||
input[1] <<= 2;
|
||||
input[2] <<= 3;
|
||||
input[3] <<= 5;
|
||||
input[4] <<= 6;
|
||||
input[6] <<= 1;
|
||||
input[7] <<= 3;
|
||||
input[8] <<= 4;
|
||||
input[9] <<= 6;
|
||||
#define F(i, s) \
|
||||
output[s+0] |= input[i] & 0xff; \
|
||||
output[s+1] = (input[i] >> 8) & 0xff; \
|
||||
output[s+2] = (input[i] >> 16) & 0xff; \
|
||||
output[s+3] = (input[i] >> 24) & 0xff;
|
||||
output[0] = 0;
|
||||
output[16] = 0;
|
||||
F(0,0);
|
||||
F(1,3);
|
||||
F(2,6);
|
||||
F(3,9);
|
||||
F(4,12);
|
||||
F(5,16);
|
||||
F(6,19);
|
||||
F(7,22);
|
||||
F(8,25);
|
||||
F(9,28);
|
||||
#undef F
|
||||
}
|
||||
|
||||
/* Input: Q, Q', Q-Q'
|
||||
* Output: 2Q, Q+Q'
|
||||
*
|
||||
* x2 z3: long form
|
||||
* x3 z3: long form
|
||||
* x z: short form, destroyed
|
||||
* xprime zprime: short form, destroyed
|
||||
* qmqp: short form, preserved
|
||||
*
|
||||
* On entry and exit, the absolute value of the limbs of all inputs and outputs
|
||||
* are < 2^26. */
|
||||
static void fmonty(limb *x2, limb *z2, /* output 2Q */
|
||||
limb *x3, limb *z3, /* output Q + Q' */
|
||||
limb *x, limb *z, /* input Q */
|
||||
limb *xprime, limb *zprime, /* input Q' */
|
||||
const limb *qmqp /* input Q - Q' */) {
|
||||
limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],
|
||||
zzprime[19], zzzprime[19], xxxprime[19];
|
||||
|
||||
memcpy(origx, x, 10 * sizeof(limb));
|
||||
fsum(x, z);
|
||||
/* |x[i]| < 2^27 */
|
||||
fdifference(z, origx); /* does x - z */
|
||||
/* |z[i]| < 2^27 */
|
||||
|
||||
memcpy(origxprime, xprime, sizeof(limb) * 10);
|
||||
fsum(xprime, zprime);
|
||||
/* |xprime[i]| < 2^27 */
|
||||
fdifference(zprime, origxprime);
|
||||
/* |zprime[i]| < 2^27 */
|
||||
fproduct(xxprime, xprime, z);
|
||||
/* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <
|
||||
* 2^(27+27) and fproduct adds together, at most, 14 of those products.
|
||||
* (Approximating that to 2^58 doesn't work out.) */
|
||||
fproduct(zzprime, x, zprime);
|
||||
/* |zzprime[i]| < 14*2^54 */
|
||||
freduce_degree(xxprime);
|
||||
freduce_coefficients(xxprime);
|
||||
/* |xxprime[i]| < 2^26 */
|
||||
freduce_degree(zzprime);
|
||||
freduce_coefficients(zzprime);
|
||||
/* |zzprime[i]| < 2^26 */
|
||||
memcpy(origxprime, xxprime, sizeof(limb) * 10);
|
||||
fsum(xxprime, zzprime);
|
||||
/* |xxprime[i]| < 2^27 */
|
||||
fdifference(zzprime, origxprime);
|
||||
/* |zzprime[i]| < 2^27 */
|
||||
fsquare(xxxprime, xxprime);
|
||||
/* |xxxprime[i]| < 2^26 */
|
||||
fsquare(zzzprime, zzprime);
|
||||
/* |zzzprime[i]| < 2^26 */
|
||||
fproduct(zzprime, zzzprime, qmqp);
|
||||
/* |zzprime[i]| < 14*2^52 */
|
||||
freduce_degree(zzprime);
|
||||
freduce_coefficients(zzprime);
|
||||
/* |zzprime[i]| < 2^26 */
|
||||
memcpy(x3, xxxprime, sizeof(limb) * 10);
|
||||
memcpy(z3, zzprime, sizeof(limb) * 10);
|
||||
|
||||
fsquare(xx, x);
|
||||
/* |xx[i]| < 2^26 */
|
||||
fsquare(zz, z);
|
||||
/* |zz[i]| < 2^26 */
|
||||
fproduct(x2, xx, zz);
|
||||
/* |x2[i]| < 14*2^52 */
|
||||
freduce_degree(x2);
|
||||
freduce_coefficients(x2);
|
||||
/* |x2[i]| < 2^26 */
|
||||
fdifference(zz, xx); // does zz = xx - zz
|
||||
/* |zz[i]| < 2^27 */
|
||||
memset(zzz + 10, 0, sizeof(limb) * 9);
|
||||
fscalar_product(zzz, zz, 121665);
|
||||
/* |zzz[i]| < 2^(27+17) */
|
||||
/* No need to call freduce_degree here:
|
||||
fscalar_product doesn't increase the degree of its input. */
|
||||
freduce_coefficients(zzz);
|
||||
/* |zzz[i]| < 2^26 */
|
||||
fsum(zzz, xx);
|
||||
/* |zzz[i]| < 2^27 */
|
||||
fproduct(z2, zz, zzz);
|
||||
/* |z2[i]| < 14*2^(26+27) */
|
||||
freduce_degree(z2);
|
||||
freduce_coefficients(z2);
|
||||
/* |z2|i| < 2^26 */
|
||||
}
|
||||
|
||||
/* Conditionally swap two reduced-form limb arrays if 'iswap' is 1, but leave
|
||||
* them unchanged if 'iswap' is 0. Runs in data-invariant time to avoid
|
||||
* side-channel attacks.
|
||||
*
|
||||
* NOTE that this function requires that 'iswap' be 1 or 0; other values give
|
||||
* wrong results. Also, the two limb arrays must be in reduced-coefficient,
|
||||
* reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
|
||||
* and all all values in a[0..9],b[0..9] must have magnitude less than
|
||||
* INT32_MAX. */
|
||||
static void
|
||||
swap_conditional(limb a[19], limb b[19], limb iswap) {
|
||||
unsigned i;
|
||||
const s32 swap = (s32) -iswap;
|
||||
|
||||
for (i = 0; i < 10; ++i) {
|
||||
const s32 x = swap & ( ((s32)a[i]) ^ ((s32)b[i]) );
|
||||
a[i] = ((s32)a[i]) ^ x;
|
||||
b[i] = ((s32)b[i]) ^ x;
|
||||
}
|
||||
}
|
||||
|
||||
/* Calculates nQ where Q is the x-coordinate of a point on the curve
|
||||
*
|
||||
* resultx/resultz: the x coordinate of the resulting curve point (short form)
|
||||
* n: a little endian, 32-byte number
|
||||
* q: a point of the curve (short form) */
|
||||
static void
|
||||
cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
|
||||
limb a[19] = {0}, b[19] = {1}, c[19] = {1}, d[19] = {0};
|
||||
limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
|
||||
limb e[19] = {0}, f[19] = {1}, g[19] = {0}, h[19] = {1};
|
||||
limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
|
||||
|
||||
unsigned i, j;
|
||||
|
||||
memcpy(nqpqx, q, sizeof(limb) * 10);
|
||||
|
||||
for (i = 0; i < 32; ++i) {
|
||||
u8 byte = n[31 - i];
|
||||
for (j = 0; j < 8; ++j) {
|
||||
const limb bit = byte >> 7;
|
||||
|
||||
swap_conditional(nqx, nqpqx, bit);
|
||||
swap_conditional(nqz, nqpqz, bit);
|
||||
fmonty(nqx2, nqz2,
|
||||
nqpqx2, nqpqz2,
|
||||
nqx, nqz,
|
||||
nqpqx, nqpqz,
|
||||
q);
|
||||
swap_conditional(nqx2, nqpqx2, bit);
|
||||
swap_conditional(nqz2, nqpqz2, bit);
|
||||
|
||||
t = nqx;
|
||||
nqx = nqx2;
|
||||
nqx2 = t;
|
||||
t = nqz;
|
||||
nqz = nqz2;
|
||||
nqz2 = t;
|
||||
t = nqpqx;
|
||||
nqpqx = nqpqx2;
|
||||
nqpqx2 = t;
|
||||
t = nqpqz;
|
||||
nqpqz = nqpqz2;
|
||||
nqpqz2 = t;
|
||||
|
||||
byte <<= 1;
|
||||
}
|
||||
}
|
||||
|
||||
memcpy(resultx, nqx, sizeof(limb) * 10);
|
||||
memcpy(resultz, nqz, sizeof(limb) * 10);
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// Shamelessly copied from djb's code
|
||||
// -----------------------------------------------------------------------------
|
||||
static void
|
||||
crecip(limb *out, const limb *z) {
|
||||
limb z2[10];
|
||||
limb z9[10];
|
||||
limb z11[10];
|
||||
limb z2_5_0[10];
|
||||
limb z2_10_0[10];
|
||||
limb z2_20_0[10];
|
||||
limb z2_50_0[10];
|
||||
limb z2_100_0[10];
|
||||
limb t0[10];
|
||||
limb t1[10];
|
||||
int i;
|
||||
|
||||
/* 2 */ fsquare(z2,z);
|
||||
/* 4 */ fsquare(t1,z2);
|
||||
/* 8 */ fsquare(t0,t1);
|
||||
/* 9 */ fmul(z9,t0,z);
|
||||
/* 11 */ fmul(z11,z9,z2);
|
||||
/* 22 */ fsquare(t0,z11);
|
||||
/* 2^5 - 2^0 = 31 */ fmul(z2_5_0,t0,z9);
|
||||
|
||||
/* 2^6 - 2^1 */ fsquare(t0,z2_5_0);
|
||||
/* 2^7 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^8 - 2^3 */ fsquare(t0,t1);
|
||||
/* 2^9 - 2^4 */ fsquare(t1,t0);
|
||||
/* 2^10 - 2^5 */ fsquare(t0,t1);
|
||||
/* 2^10 - 2^0 */ fmul(z2_10_0,t0,z2_5_0);
|
||||
|
||||
/* 2^11 - 2^1 */ fsquare(t0,z2_10_0);
|
||||
/* 2^12 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^20 - 2^0 */ fmul(z2_20_0,t1,z2_10_0);
|
||||
|
||||
/* 2^21 - 2^1 */ fsquare(t0,z2_20_0);
|
||||
/* 2^22 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^40 - 2^0 */ fmul(t0,t1,z2_20_0);
|
||||
|
||||
/* 2^41 - 2^1 */ fsquare(t1,t0);
|
||||
/* 2^42 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||
/* 2^50 - 2^0 */ fmul(z2_50_0,t0,z2_10_0);
|
||||
|
||||
/* 2^51 - 2^1 */ fsquare(t0,z2_50_0);
|
||||
/* 2^52 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^100 - 2^0 */ fmul(z2_100_0,t1,z2_50_0);
|
||||
|
||||
/* 2^101 - 2^1 */ fsquare(t1,z2_100_0);
|
||||
/* 2^102 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||
/* 2^200 - 2^0 */ fmul(t1,t0,z2_100_0);
|
||||
|
||||
/* 2^201 - 2^1 */ fsquare(t0,t1);
|
||||
/* 2^202 - 2^2 */ fsquare(t1,t0);
|
||||
/* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||
/* 2^250 - 2^0 */ fmul(t0,t1,z2_50_0);
|
||||
|
||||
/* 2^251 - 2^1 */ fsquare(t1,t0);
|
||||
/* 2^252 - 2^2 */ fsquare(t0,t1);
|
||||
/* 2^253 - 2^3 */ fsquare(t1,t0);
|
||||
/* 2^254 - 2^4 */ fsquare(t0,t1);
|
||||
/* 2^255 - 2^5 */ fsquare(t1,t0);
|
||||
/* 2^255 - 21 */ fmul(out,t1,z11);
|
||||
}
|
||||
|
||||
int
|
||||
curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
|
||||
limb bp[10], x[10], z[11], zmone[10];
|
||||
uint8_t e[32];
|
||||
int i;
|
||||
|
||||
for (i = 0; i < 32; ++i) e[i] = secret[i];
|
||||
// e[0] &= 248;
|
||||
// e[31] &= 127;
|
||||
// e[31] |= 64;
|
||||
|
||||
fexpand(bp, basepoint);
|
||||
cmult(x, z, e, bp);
|
||||
crecip(zmone, z);
|
||||
fmul(z, x, zmone);
|
||||
fcontract(mypublic, z);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef CURVE25519_DONNA_H
|
||||
#define CURVE25519_DONNA_H
|
||||
|
||||
extern int curve25519_donna(uint8_t *, const uint8_t *, const uint8_t *);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,109 @@
|
|||
/**
|
||||
* Copyright (C) 2013-2014 Open Whisper Systems
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include <jni.h>
|
||||
#include "curve25519-donna.h"
|
||||
#include "curve_sigs.h"
|
||||
|
||||
JNIEXPORT jbyteArray JNICALL Java_org_whispersystems_libaxolotl_ecc_Curve25519_generatePrivateKey
|
||||
(JNIEnv *env, jclass clazz, jbyteArray random)
|
||||
{
|
||||
uint8_t* privateKey = (uint8_t*)(*env)->GetByteArrayElements(env, random, 0);
|
||||
|
||||
privateKey[0] &= 248;
|
||||
privateKey[31] &= 127;
|
||||
privateKey[31] |= 64;
|
||||
|
||||
(*env)->ReleaseByteArrayElements(env, random, privateKey, 0);
|
||||
|
||||
return random;
|
||||
}
|
||||
|
||||
JNIEXPORT jbyteArray JNICALL Java_org_whispersystems_libaxolotl_ecc_Curve25519_generatePublicKey
|
||||
(JNIEnv *env, jclass clazz, jbyteArray privateKey)
|
||||
{
|
||||
static const uint8_t basepoint[32] = {9};
|
||||
|
||||
jbyteArray publicKey = (*env)->NewByteArray(env, 32);
|
||||
uint8_t* publicKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, publicKey, 0);
|
||||
uint8_t* privateKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, privateKey, 0);
|
||||
|
||||
curve25519_donna(publicKeyBytes, privateKeyBytes, basepoint);
|
||||
|
||||
(*env)->ReleaseByteArrayElements(env, publicKey, publicKeyBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, privateKey, privateKeyBytes, 0);
|
||||
|
||||
return publicKey;
|
||||
}
|
||||
|
||||
JNIEXPORT jbyteArray JNICALL Java_org_whispersystems_libaxolotl_ecc_Curve25519_calculateAgreement
|
||||
(JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey)
|
||||
{
|
||||
jbyteArray sharedKey = (*env)->NewByteArray(env, 32);
|
||||
uint8_t* sharedKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, sharedKey, 0);
|
||||
uint8_t* privateKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, privateKey, 0);
|
||||
uint8_t* publicKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, publicKey, 0);
|
||||
|
||||
curve25519_donna(sharedKeyBytes, privateKeyBytes, publicKeyBytes);
|
||||
|
||||
(*env)->ReleaseByteArrayElements(env, sharedKey, sharedKeyBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, publicKey, publicKeyBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, privateKey, privateKeyBytes, 0);
|
||||
|
||||
return sharedKey;
|
||||
}
|
||||
|
||||
JNIEXPORT jbyteArray JNICALL Java_org_whispersystems_libaxolotl_ecc_Curve25519_calculateSignature
|
||||
(JNIEnv *env, jclass clazz, jbyteArray random, jbyteArray privateKey, jbyteArray message)
|
||||
{
|
||||
jbyteArray signature = (*env)->NewByteArray(env, 64);
|
||||
uint8_t* signatureBytes = (uint8_t*)(*env)->GetByteArrayElements(env, signature, 0);
|
||||
uint8_t* randomBytes = (uint8_t*)(*env)->GetByteArrayElements(env, random, 0);
|
||||
uint8_t* privateKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, privateKey, 0);
|
||||
uint8_t* messageBytes = (uint8_t*)(*env)->GetByteArrayElements(env, message, 0);
|
||||
jsize messageLength = (*env)->GetArrayLength(env, message);
|
||||
|
||||
int result = curve25519_sign(signatureBytes, privateKeyBytes, messageBytes, messageLength, randomBytes);
|
||||
|
||||
(*env)->ReleaseByteArrayElements(env, signature, signatureBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, random, randomBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, privateKey, privateKeyBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, message, messageBytes, 0);
|
||||
|
||||
if (result == 0) return signature;
|
||||
else (*env)->ThrowNew(env, (*env)->FindClass(env, "java/lang/AssertionError"), "Signature failed!");
|
||||
}
|
||||
|
||||
JNIEXPORT jboolean JNICALL Java_org_whispersystems_libaxolotl_ecc_Curve25519_verifySignature
|
||||
(JNIEnv *env, jclass clazz, jbyteArray publicKey, jbyteArray message, jbyteArray signature)
|
||||
{
|
||||
uint8_t* signatureBytes = (uint8_t*)(*env)->GetByteArrayElements(env, signature, 0);
|
||||
uint8_t* publicKeyBytes = (uint8_t*)(*env)->GetByteArrayElements(env, publicKey, 0);
|
||||
uint8_t* messageBytes = (uint8_t*)(*env)->GetByteArrayElements(env, message, 0);
|
||||
jsize messageLength = (*env)->GetArrayLength(env, message);
|
||||
|
||||
jboolean result = (curve25519_verify(signatureBytes, publicKeyBytes, messageBytes, messageLength) == 0);
|
||||
|
||||
(*env)->ReleaseByteArrayElements(env, signature, signatureBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, publicKey, publicKeyBytes, 0);
|
||||
(*env)->ReleaseByteArrayElements(env, message, messageBytes, 0);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
#include <string.h>
|
||||
#include "compare.h"
|
||||
|
||||
/* Const-time comparison from SUPERCOP, but here it's only used for
|
||||
signature verification, so doesn't need to be const-time. But
|
||||
copied the nacl version anyways. */
|
||||
int crypto_verify_32_ref(const unsigned char *x, const unsigned char *y)
|
||||
{
|
||||
unsigned int differentbits = 0;
|
||||
#define F(i) differentbits |= x[i] ^ y[i];
|
||||
F(0)
|
||||
F(1)
|
||||
F(2)
|
||||
F(3)
|
||||
F(4)
|
||||
F(5)
|
||||
F(6)
|
||||
F(7)
|
||||
F(8)
|
||||
F(9)
|
||||
F(10)
|
||||
F(11)
|
||||
F(12)
|
||||
F(13)
|
||||
F(14)
|
||||
F(15)
|
||||
F(16)
|
||||
F(17)
|
||||
F(18)
|
||||
F(19)
|
||||
F(20)
|
||||
F(21)
|
||||
F(22)
|
||||
F(23)
|
||||
F(24)
|
||||
F(25)
|
||||
F(26)
|
||||
F(27)
|
||||
F(28)
|
||||
F(29)
|
||||
F(30)
|
||||
F(31)
|
||||
return (1 & ((differentbits - 1) >> 8)) - 1;
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef __COMPARE_H__
|
||||
#define __COMPARE_H__
|
||||
|
||||
int crypto_verify_32_ref(const unsigned char *b1, const unsigned char *b2);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_hash_sha512_H
|
||||
#define crypto_hash_sha512_H
|
||||
|
||||
extern int crypto_hash_sha512(unsigned char *,const unsigned char *,unsigned long long);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
#include <string.h>
|
||||
#include "ge.h"
|
||||
#include "curve_sigs.h"
|
||||
#include "crypto_sign.h"
|
||||
|
||||
void curve25519_keygen(unsigned char* curve25519_pubkey_out,
|
||||
const unsigned char* curve25519_privkey_in)
|
||||
{
|
||||
ge_p3 ed; /* Ed25519 pubkey point */
|
||||
fe ed_y, ed_y_plus_one, one_minus_ed_y, inv_one_minus_ed_y;
|
||||
fe mont_x;
|
||||
|
||||
/* Perform a fixed-base multiplication of the Edwards base point,
|
||||
(which is efficient due to precalculated tables), then convert
|
||||
to the Curve25519 montgomery-format public key. In particular,
|
||||
convert Curve25519's "montgomery" x-coordinate into an Ed25519
|
||||
"edwards" y-coordinate:
|
||||
|
||||
mont_x = (ed_y + 1) / (1 - ed_y)
|
||||
|
||||
with projective coordinates:
|
||||
|
||||
mont_x = (ed_y + ed_z) / (ed_z - ed_y)
|
||||
|
||||
NOTE: ed_y=1 is converted to mont_x=0 since fe_invert is mod-exp
|
||||
*/
|
||||
|
||||
ge_scalarmult_base(&ed, curve25519_privkey_in);
|
||||
fe_add(ed_y_plus_one, ed.Y, ed.Z);
|
||||
fe_sub(one_minus_ed_y, ed.Z, ed.Y);
|
||||
fe_invert(inv_one_minus_ed_y, one_minus_ed_y);
|
||||
fe_mul(mont_x, ed_y_plus_one, inv_one_minus_ed_y);
|
||||
fe_tobytes(curve25519_pubkey_out, mont_x);
|
||||
}
|
||||
|
||||
int curve25519_sign(unsigned char* signature_out,
|
||||
const unsigned char* curve25519_privkey,
|
||||
const unsigned char* msg, const unsigned long msg_len,
|
||||
const unsigned char* random)
|
||||
{
|
||||
ge_p3 ed_pubkey_point; /* Ed25519 pubkey point */
|
||||
unsigned char ed_pubkey[32]; /* Ed25519 encoded pubkey */
|
||||
unsigned char sigbuf[MAX_MSG_LEN + 128]; /* working buffer */
|
||||
unsigned char sign_bit = 0;
|
||||
|
||||
if (msg_len > MAX_MSG_LEN) {
|
||||
memset(signature_out, 0, 64);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Convert the Curve25519 privkey to an Ed25519 public key */
|
||||
ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey);
|
||||
ge_p3_tobytes(ed_pubkey, &ed_pubkey_point);
|
||||
sign_bit = ed_pubkey[31] & 0x80;
|
||||
|
||||
/* Perform an Ed25519 signature with explicit private key */
|
||||
crypto_sign_modified(sigbuf, msg, msg_len, curve25519_privkey,
|
||||
ed_pubkey, random);
|
||||
memmove(signature_out, sigbuf, 64);
|
||||
|
||||
/* Encode the sign bit into signature (in unused high bit of S) */
|
||||
signature_out[63] &= 0x7F; /* bit should be zero already, but just in case */
|
||||
signature_out[63] |= sign_bit;
|
||||
return 0;
|
||||
}
|
||||
|
||||
int curve25519_verify(const unsigned char* signature,
|
||||
const unsigned char* curve25519_pubkey,
|
||||
const unsigned char* msg, const unsigned long msg_len)
|
||||
{
|
||||
fe mont_x, mont_x_minus_one, mont_x_plus_one, inv_mont_x_plus_one;
|
||||
fe one;
|
||||
fe ed_y;
|
||||
unsigned char ed_pubkey[32];
|
||||
unsigned long long some_retval;
|
||||
unsigned char verifybuf[MAX_MSG_LEN + 64]; /* working buffer */
|
||||
unsigned char verifybuf2[MAX_MSG_LEN + 64]; /* working buffer #2 */
|
||||
|
||||
if (msg_len > MAX_MSG_LEN) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Convert the Curve25519 public key into an Ed25519 public key. In
|
||||
particular, convert Curve25519's "montgomery" x-coordinate into an
|
||||
Ed25519 "edwards" y-coordinate:
|
||||
|
||||
ed_y = (mont_x - 1) / (mont_x + 1)
|
||||
|
||||
NOTE: mont_x=-1 is converted to ed_y=0 since fe_invert is mod-exp
|
||||
|
||||
Then move the sign bit into the pubkey from the signature.
|
||||
*/
|
||||
fe_frombytes(mont_x, curve25519_pubkey);
|
||||
fe_1(one);
|
||||
fe_sub(mont_x_minus_one, mont_x, one);
|
||||
fe_add(mont_x_plus_one, mont_x, one);
|
||||
fe_invert(inv_mont_x_plus_one, mont_x_plus_one);
|
||||
fe_mul(ed_y, mont_x_minus_one, inv_mont_x_plus_one);
|
||||
fe_tobytes(ed_pubkey, ed_y);
|
||||
|
||||
/* Copy the sign bit, and remove it from signature */
|
||||
ed_pubkey[31] &= 0x7F; /* bit should be zero already, but just in case */
|
||||
ed_pubkey[31] |= (signature[63] & 0x80);
|
||||
memmove(verifybuf, signature, 64);
|
||||
verifybuf[63] &= 0x7F;
|
||||
|
||||
memmove(verifybuf+64, msg, msg_len);
|
||||
|
||||
/* Then perform a normal Ed25519 verification, return 0 on success */
|
||||
/* The below call has a strange API: */
|
||||
/* verifybuf = R || S || message */
|
||||
/* verifybuf2 = internal to next call gets a copy of verifybuf, S gets
|
||||
replaced with pubkey for hashing, then the whole thing gets zeroized
|
||||
(if bad sig), or contains a copy of msg (good sig) */
|
||||
return crypto_sign_open(verifybuf2, &some_retval, verifybuf, 64 + msg_len, ed_pubkey);
|
||||
}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
|
||||
#ifndef __CURVE_SIGS_H__
|
||||
#define __CURVE_SIGS_H__
|
||||
|
||||
#define MAX_MSG_LEN 256
|
||||
|
||||
void curve25519_keygen(unsigned char* curve25519_pubkey_out, /* 32 bytes */
|
||||
const unsigned char* curve25519_privkey_in); /* 32 bytes */
|
||||
|
||||
/* returns 0 on success */
|
||||
int curve25519_sign(unsigned char* signature_out, /* 64 bytes */
|
||||
const unsigned char* curve25519_privkey, /* 32 bytes */
|
||||
const unsigned char* msg, const unsigned long msg_len,
|
||||
const unsigned char* random); /* 64 bytes */
|
||||
|
||||
/* returns 0 on success */
|
||||
int curve25519_verify(const unsigned char* signature, /* 64 bytes */
|
||||
const unsigned char* curve25519_pubkey, /* 32 bytes */
|
||||
const unsigned char* msg, const unsigned long msg_len);
|
||||
|
||||
/* helper function - modified version of crypto_sign() to use
|
||||
explicit private key. In particular:
|
||||
|
||||
sk : private key
|
||||
pk : public key
|
||||
msg : message
|
||||
prefix : 0xFE || [0xFF]*31
|
||||
random : 64 bytes random
|
||||
q : main subgroup order
|
||||
|
||||
The prefix is chosen to distinguish the two SHA512 uses below, since
|
||||
prefix is an invalid encoding for R (it would encode a "field element"
|
||||
of 2^255 - 2). 0xFF*32 is set aside for use in ECDH protocols, which
|
||||
is why the first byte here ix 0xFE.
|
||||
|
||||
sig_nonce = SHA512(prefix || sk || msg || random) % q
|
||||
R = g^sig_nonce
|
||||
M = SHA512(R || pk || m)
|
||||
S = sig_nonce + (m * sk)
|
||||
signature = (R || S)
|
||||
*/
|
||||
int crypto_sign_modified(
|
||||
unsigned char *sm,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk, /* Curve/Ed25519 private key */
|
||||
const unsigned char *pk, /* Ed25519 public key */
|
||||
const unsigned char *random /* 64 bytes random to hash into nonce */
|
||||
);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
#include "zeroize.h"
|
||||
|
||||
/* NEW: Compare to pristine crypto_sign()
|
||||
Uses explicit private key for nonce derivation and as scalar,
|
||||
instead of deriving both from a master key.
|
||||
*/
|
||||
int crypto_sign_modified(
|
||||
unsigned char *sm,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk, const unsigned char* pk,
|
||||
const unsigned char* random
|
||||
)
|
||||
{
|
||||
unsigned char nonce[64];
|
||||
unsigned char hram[64];
|
||||
ge_p3 R;
|
||||
int count=0;
|
||||
|
||||
memmove(sm + 64,m,mlen);
|
||||
memmove(sm + 32,sk,32); /* NEW: Use privkey directly for nonce derivation */
|
||||
|
||||
/* NEW : add prefix to separate hash uses - see .h */
|
||||
sm[0] = 0xFE;
|
||||
for (count = 1; count < 32; count++)
|
||||
sm[count] = 0xFF;
|
||||
|
||||
/* NEW: add suffix of random data */
|
||||
memmove(sm + mlen + 64, random, 64);
|
||||
|
||||
crypto_hash_sha512(nonce,sm,mlen + 128);
|
||||
memmove(sm + 32,pk,32);
|
||||
|
||||
sc_reduce(nonce);
|
||||
ge_scalarmult_base(&R,nonce);
|
||||
ge_p3_tobytes(sm,&R);
|
||||
|
||||
crypto_hash_sha512(hram,sm,mlen + 64);
|
||||
sc_reduce(hram);
|
||||
sc_muladd(sm + 32,hram,sk,nonce); /* NEW: Use privkey directly */
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
#include "zeroize.h"
|
||||
|
||||
void zeroize(unsigned char* b, size_t len)
|
||||
{
|
||||
size_t count = 0;
|
||||
unsigned long retval = 0;
|
||||
volatile unsigned char *p = b;
|
||||
|
||||
for (count = 0; count < len; count++)
|
||||
p[count] = 0;
|
||||
}
|
||||
|
||||
void zeroize_stack()
|
||||
{
|
||||
unsigned char m[ZEROIZE_STACK_SIZE];
|
||||
zeroize(m, sizeof m);
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#ifndef __ZEROIZE_H__
|
||||
#define __ZEROIZE_H__
|
||||
|
||||
#include <stdlib.h>
|
||||
|
||||
#define ZEROIZE_STACK_SIZE 2048
|
||||
|
||||
void zeroize(unsigned char* b, size_t len);
|
||||
|
||||
void zeroize_stack();
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
#define CRYPTO_SECRETKEYBYTES 64
|
||||
#define CRYPTO_PUBLICKEYBYTES 32
|
||||
#define CRYPTO_BYTES 64
|
||||
#define CRYPTO_DETERMINISTIC 1
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
{ 25967493,-14356035,29566456,3660896,-12694345,4014787,27544626,-11754271,-6079156,2047605 },
|
||||
{ -12545711,934262,-2722910,3049990,-727428,9406986,12720692,5043384,19500929,-15469378 },
|
||||
{ -8738181,4489570,9688441,-14785194,10184609,-12363380,29287919,11864899,-24514362,-4438546 },
|
||||
},
|
||||
{
|
||||
{ 15636291,-9688557,24204773,-7912398,616977,-16685262,27787600,-14772189,28944400,-1550024 },
|
||||
{ 16568933,4717097,-11556148,-1102322,15682896,-11807043,16354577,-11775962,7689662,11199574 },
|
||||
{ 30464156,-5976125,-11779434,-15670865,23220365,15915852,7512774,10017326,-17749093,-9920357 },
|
||||
},
|
||||
{
|
||||
{ 10861363,11473154,27284546,1981175,-30064349,12577861,32867885,14515107,-15438304,10819380 },
|
||||
{ 4708026,6336745,20377586,9066809,-11272109,6594696,-25653668,12483688,-12668491,5581306 },
|
||||
{ 19563160,16186464,-29386857,4097519,10237984,-4348115,28542350,13850243,-23678021,-15815942 },
|
||||
},
|
||||
{
|
||||
{ 5153746,9909285,1723747,-2777874,30523605,5516873,19480852,5230134,-23952439,-15175766 },
|
||||
{ -30269007,-3463509,7665486,10083793,28475525,1649722,20654025,16520125,30598449,7715701 },
|
||||
{ 28881845,14381568,9657904,3680757,-20181635,7843316,-31400660,1370708,29794553,-1409300 },
|
||||
},
|
||||
{
|
||||
{ -22518993,-6692182,14201702,-8745502,-23510406,8844726,18474211,-1361450,-13062696,13821877 },
|
||||
{ -6455177,-7839871,3374702,-4740862,-27098617,-10571707,31655028,-7212327,18853322,-14220951 },
|
||||
{ 4566830,-12963868,-28974889,-12240689,-7602672,-2830569,-8514358,-10431137,2207753,-3209784 },
|
||||
},
|
||||
{
|
||||
{ -25154831,-4185821,29681144,7868801,-6854661,-9423865,-12437364,-663000,-31111463,-16132436 },
|
||||
{ 25576264,-2703214,7349804,-11814844,16472782,9300885,3844789,15725684,171356,6466918 },
|
||||
{ 23103977,13316479,9739013,-16149481,817875,-15038942,8965339,-14088058,-30714912,16193877 },
|
||||
},
|
||||
{
|
||||
{ -33521811,3180713,-2394130,14003687,-16903474,-16270840,17238398,4729455,-18074513,9256800 },
|
||||
{ -25182317,-4174131,32336398,5036987,-21236817,11360617,22616405,9761698,-19827198,630305 },
|
||||
{ -13720693,2639453,-24237460,-7406481,9494427,-5774029,-6554551,-15960994,-2449256,-14291300 },
|
||||
},
|
||||
{
|
||||
{ -3151181,-5046075,9282714,6866145,-31907062,-863023,-18940575,15033784,25105118,-7894876 },
|
||||
{ -24326370,15950226,-31801215,-14592823,-11662737,-5090925,1573892,-2625887,2198790,-15804619 },
|
||||
{ -3099351,10324967,-2241613,7453183,-5446979,-2735503,-13812022,-16236442,-32461234,-12290683 },
|
||||
},
|
||||
|
|
@ -0,0 +1 @@
|
|||
-10913610,13857413,-15372611,6949391,114729,-8787816,-6275908,-3247719,-18696448,-12055116
|
||||
|
|
@ -0,0 +1 @@
|
|||
-21827239,-5839606,-30745221,13898782,229458,15978800,-12551817,-6495438,29715968,9444199
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
#ifndef FE_H
|
||||
#define FE_H
|
||||
|
||||
#include "crypto_int32.h"
|
||||
|
||||
typedef crypto_int32 fe[10];
|
||||
|
||||
/*
|
||||
fe means field element.
|
||||
Here the field is \Z/(2^255-19).
|
||||
An element t, entries t[0]...t[9], represents the integer
|
||||
t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9].
|
||||
Bounds on each t[i] vary depending on context.
|
||||
*/
|
||||
|
||||
#define fe_frombytes crypto_sign_ed25519_ref10_fe_frombytes
|
||||
#define fe_tobytes crypto_sign_ed25519_ref10_fe_tobytes
|
||||
#define fe_copy crypto_sign_ed25519_ref10_fe_copy
|
||||
#define fe_isnonzero crypto_sign_ed25519_ref10_fe_isnonzero
|
||||
#define fe_isnegative crypto_sign_ed25519_ref10_fe_isnegative
|
||||
#define fe_0 crypto_sign_ed25519_ref10_fe_0
|
||||
#define fe_1 crypto_sign_ed25519_ref10_fe_1
|
||||
#define fe_cswap crypto_sign_ed25519_ref10_fe_cswap
|
||||
#define fe_cmov crypto_sign_ed25519_ref10_fe_cmov
|
||||
#define fe_add crypto_sign_ed25519_ref10_fe_add
|
||||
#define fe_sub crypto_sign_ed25519_ref10_fe_sub
|
||||
#define fe_neg crypto_sign_ed25519_ref10_fe_neg
|
||||
#define fe_mul crypto_sign_ed25519_ref10_fe_mul
|
||||
#define fe_sq crypto_sign_ed25519_ref10_fe_sq
|
||||
#define fe_sq2 crypto_sign_ed25519_ref10_fe_sq2
|
||||
#define fe_mul121666 crypto_sign_ed25519_ref10_fe_mul121666
|
||||
#define fe_invert crypto_sign_ed25519_ref10_fe_invert
|
||||
#define fe_pow22523 crypto_sign_ed25519_ref10_fe_pow22523
|
||||
|
||||
extern void fe_frombytes(fe,const unsigned char *);
|
||||
extern void fe_tobytes(unsigned char *,const fe);
|
||||
|
||||
extern void fe_copy(fe,const fe);
|
||||
extern int fe_isnonzero(const fe);
|
||||
extern int fe_isnegative(const fe);
|
||||
extern void fe_0(fe);
|
||||
extern void fe_1(fe);
|
||||
extern void fe_cswap(fe,fe,unsigned int);
|
||||
extern void fe_cmov(fe,const fe,unsigned int);
|
||||
|
||||
extern void fe_add(fe,const fe,const fe);
|
||||
extern void fe_sub(fe,const fe,const fe);
|
||||
extern void fe_neg(fe,const fe);
|
||||
extern void fe_mul(fe,const fe,const fe);
|
||||
extern void fe_sq(fe,const fe);
|
||||
extern void fe_sq2(fe,const fe);
|
||||
extern void fe_mul121666(fe,const fe);
|
||||
extern void fe_invert(fe,const fe);
|
||||
extern void fe_pow22523(fe,const fe);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = 0
|
||||
*/
|
||||
|
||||
void fe_0(fe h)
|
||||
{
|
||||
h[0] = 0;
|
||||
h[1] = 0;
|
||||
h[2] = 0;
|
||||
h[3] = 0;
|
||||
h[4] = 0;
|
||||
h[5] = 0;
|
||||
h[6] = 0;
|
||||
h[7] = 0;
|
||||
h[8] = 0;
|
||||
h[9] = 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = 1
|
||||
*/
|
||||
|
||||
void fe_1(fe h)
|
||||
{
|
||||
h[0] = 1;
|
||||
h[1] = 0;
|
||||
h[2] = 0;
|
||||
h[3] = 0;
|
||||
h[4] = 0;
|
||||
h[5] = 0;
|
||||
h[6] = 0;
|
||||
h[7] = 0;
|
||||
h[8] = 0;
|
||||
h[9] = 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f + g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
void fe_add(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 h0 = f0 + g0;
|
||||
crypto_int32 h1 = f1 + g1;
|
||||
crypto_int32 h2 = f2 + g2;
|
||||
crypto_int32 h3 = f3 + g3;
|
||||
crypto_int32 h4 = f4 + g4;
|
||||
crypto_int32 h5 = f5 + g5;
|
||||
crypto_int32 h6 = f6 + g6;
|
||||
crypto_int32 h7 = f7 + g7;
|
||||
crypto_int32 h8 = f8 + g8;
|
||||
crypto_int32 h9 = f9 + g9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
Replace (f,g) with (g,g) if b == 1;
|
||||
replace (f,g) with (f,g) if b == 0.
|
||||
|
||||
Preconditions: b in {0,1}.
|
||||
*/
|
||||
|
||||
void fe_cmov(fe f,const fe g,unsigned int b)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 x0 = f0 ^ g0;
|
||||
crypto_int32 x1 = f1 ^ g1;
|
||||
crypto_int32 x2 = f2 ^ g2;
|
||||
crypto_int32 x3 = f3 ^ g3;
|
||||
crypto_int32 x4 = f4 ^ g4;
|
||||
crypto_int32 x5 = f5 ^ g5;
|
||||
crypto_int32 x6 = f6 ^ g6;
|
||||
crypto_int32 x7 = f7 ^ g7;
|
||||
crypto_int32 x8 = f8 ^ g8;
|
||||
crypto_int32 x9 = f9 ^ g9;
|
||||
b = -b;
|
||||
x0 &= b;
|
||||
x1 &= b;
|
||||
x2 &= b;
|
||||
x3 &= b;
|
||||
x4 &= b;
|
||||
x5 &= b;
|
||||
x6 &= b;
|
||||
x7 &= b;
|
||||
x8 &= b;
|
||||
x9 &= b;
|
||||
f[0] = f0 ^ x0;
|
||||
f[1] = f1 ^ x1;
|
||||
f[2] = f2 ^ x2;
|
||||
f[3] = f3 ^ x3;
|
||||
f[4] = f4 ^ x4;
|
||||
f[5] = f5 ^ x5;
|
||||
f[6] = f6 ^ x6;
|
||||
f[7] = f7 ^ x7;
|
||||
f[8] = f8 ^ x8;
|
||||
f[9] = f9 ^ x9;
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f
|
||||
*/
|
||||
|
||||
void fe_copy(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
h[0] = f0;
|
||||
h[1] = f1;
|
||||
h[2] = f2;
|
||||
h[3] = f3;
|
||||
h[4] = f4;
|
||||
h[5] = f5;
|
||||
h[6] = f6;
|
||||
h[7] = f7;
|
||||
h[8] = f8;
|
||||
h[9] = f9;
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Ignores top bit of h.
|
||||
*/
|
||||
|
||||
void fe_frombytes(fe h,const unsigned char *s)
|
||||
{
|
||||
crypto_int64 h0 = load_4(s);
|
||||
crypto_int64 h1 = load_3(s + 4) << 6;
|
||||
crypto_int64 h2 = load_3(s + 7) << 5;
|
||||
crypto_int64 h3 = load_3(s + 10) << 3;
|
||||
crypto_int64 h4 = load_3(s + 13) << 2;
|
||||
crypto_int64 h5 = load_4(s + 16);
|
||||
crypto_int64 h6 = load_3(s + 20) << 7;
|
||||
crypto_int64 h7 = load_3(s + 23) << 5;
|
||||
crypto_int64 h8 = load_3(s + 26) << 4;
|
||||
crypto_int64 h9 = (load_3(s + 29) & 8388607) << 2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#include "fe.h"
|
||||
|
||||
void fe_invert(fe out,const fe z)
|
||||
{
|
||||
fe t0;
|
||||
fe t1;
|
||||
fe t2;
|
||||
fe t3;
|
||||
int i;
|
||||
|
||||
#include "pow225521.h"
|
||||
|
||||
return;
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
return 1 if f is in {1,3,5,...,q-2}
|
||||
return 0 if f is in {0,2,4,...,q-1}
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
int fe_isnegative(const fe f)
|
||||
{
|
||||
unsigned char s[32];
|
||||
fe_tobytes(s,f);
|
||||
return s[0] & 1;
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_verify_32.h"
|
||||
|
||||
/*
|
||||
return 1 if f == 0
|
||||
return 0 if f != 0
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
static const unsigned char zero[32];
|
||||
|
||||
int fe_isnonzero(const fe f)
|
||||
{
|
||||
unsigned char s[32];
|
||||
fe_tobytes(s,f);
|
||||
return crypto_verify_32(s,zero);
|
||||
}
|
||||
|
|
@ -0,0 +1,253 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = f * g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|g| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
Notes on implementation strategy:
|
||||
|
||||
Using schoolbook multiplication.
|
||||
Karatsuba would save a little in some cost models.
|
||||
|
||||
Most multiplications by 2 and 19 are 32-bit precomputations;
|
||||
cheaper than 64-bit postcomputations.
|
||||
|
||||
There is one remaining multiplication by 19 in the carry chain;
|
||||
one *19 precomputation can be merged into this,
|
||||
but the resulting data flow is considerably less clean.
|
||||
|
||||
There are 12 carries below.
|
||||
10 of them are 2-way parallelizable and vectorizable.
|
||||
Can get away with 11 carries, but then data flow is much deeper.
|
||||
|
||||
With tighter constraints on inputs can squeeze carries into int32.
|
||||
*/
|
||||
|
||||
void fe_mul(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 g1_19 = 19 * g1; /* 1.959375*2^29 */
|
||||
crypto_int32 g2_19 = 19 * g2; /* 1.959375*2^30; still ok */
|
||||
crypto_int32 g3_19 = 19 * g3;
|
||||
crypto_int32 g4_19 = 19 * g4;
|
||||
crypto_int32 g5_19 = 19 * g5;
|
||||
crypto_int32 g6_19 = 19 * g6;
|
||||
crypto_int32 g7_19 = 19 * g7;
|
||||
crypto_int32 g8_19 = 19 * g8;
|
||||
crypto_int32 g9_19 = 19 * g9;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f9_2 = 2 * f9;
|
||||
crypto_int64 f0g0 = f0 * (crypto_int64) g0;
|
||||
crypto_int64 f0g1 = f0 * (crypto_int64) g1;
|
||||
crypto_int64 f0g2 = f0 * (crypto_int64) g2;
|
||||
crypto_int64 f0g3 = f0 * (crypto_int64) g3;
|
||||
crypto_int64 f0g4 = f0 * (crypto_int64) g4;
|
||||
crypto_int64 f0g5 = f0 * (crypto_int64) g5;
|
||||
crypto_int64 f0g6 = f0 * (crypto_int64) g6;
|
||||
crypto_int64 f0g7 = f0 * (crypto_int64) g7;
|
||||
crypto_int64 f0g8 = f0 * (crypto_int64) g8;
|
||||
crypto_int64 f0g9 = f0 * (crypto_int64) g9;
|
||||
crypto_int64 f1g0 = f1 * (crypto_int64) g0;
|
||||
crypto_int64 f1g1_2 = f1_2 * (crypto_int64) g1;
|
||||
crypto_int64 f1g2 = f1 * (crypto_int64) g2;
|
||||
crypto_int64 f1g3_2 = f1_2 * (crypto_int64) g3;
|
||||
crypto_int64 f1g4 = f1 * (crypto_int64) g4;
|
||||
crypto_int64 f1g5_2 = f1_2 * (crypto_int64) g5;
|
||||
crypto_int64 f1g6 = f1 * (crypto_int64) g6;
|
||||
crypto_int64 f1g7_2 = f1_2 * (crypto_int64) g7;
|
||||
crypto_int64 f1g8 = f1 * (crypto_int64) g8;
|
||||
crypto_int64 f1g9_38 = f1_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f2g0 = f2 * (crypto_int64) g0;
|
||||
crypto_int64 f2g1 = f2 * (crypto_int64) g1;
|
||||
crypto_int64 f2g2 = f2 * (crypto_int64) g2;
|
||||
crypto_int64 f2g3 = f2 * (crypto_int64) g3;
|
||||
crypto_int64 f2g4 = f2 * (crypto_int64) g4;
|
||||
crypto_int64 f2g5 = f2 * (crypto_int64) g5;
|
||||
crypto_int64 f2g6 = f2 * (crypto_int64) g6;
|
||||
crypto_int64 f2g7 = f2 * (crypto_int64) g7;
|
||||
crypto_int64 f2g8_19 = f2 * (crypto_int64) g8_19;
|
||||
crypto_int64 f2g9_19 = f2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f3g0 = f3 * (crypto_int64) g0;
|
||||
crypto_int64 f3g1_2 = f3_2 * (crypto_int64) g1;
|
||||
crypto_int64 f3g2 = f3 * (crypto_int64) g2;
|
||||
crypto_int64 f3g3_2 = f3_2 * (crypto_int64) g3;
|
||||
crypto_int64 f3g4 = f3 * (crypto_int64) g4;
|
||||
crypto_int64 f3g5_2 = f3_2 * (crypto_int64) g5;
|
||||
crypto_int64 f3g6 = f3 * (crypto_int64) g6;
|
||||
crypto_int64 f3g7_38 = f3_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f3g8_19 = f3 * (crypto_int64) g8_19;
|
||||
crypto_int64 f3g9_38 = f3_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f4g0 = f4 * (crypto_int64) g0;
|
||||
crypto_int64 f4g1 = f4 * (crypto_int64) g1;
|
||||
crypto_int64 f4g2 = f4 * (crypto_int64) g2;
|
||||
crypto_int64 f4g3 = f4 * (crypto_int64) g3;
|
||||
crypto_int64 f4g4 = f4 * (crypto_int64) g4;
|
||||
crypto_int64 f4g5 = f4 * (crypto_int64) g5;
|
||||
crypto_int64 f4g6_19 = f4 * (crypto_int64) g6_19;
|
||||
crypto_int64 f4g7_19 = f4 * (crypto_int64) g7_19;
|
||||
crypto_int64 f4g8_19 = f4 * (crypto_int64) g8_19;
|
||||
crypto_int64 f4g9_19 = f4 * (crypto_int64) g9_19;
|
||||
crypto_int64 f5g0 = f5 * (crypto_int64) g0;
|
||||
crypto_int64 f5g1_2 = f5_2 * (crypto_int64) g1;
|
||||
crypto_int64 f5g2 = f5 * (crypto_int64) g2;
|
||||
crypto_int64 f5g3_2 = f5_2 * (crypto_int64) g3;
|
||||
crypto_int64 f5g4 = f5 * (crypto_int64) g4;
|
||||
crypto_int64 f5g5_38 = f5_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f5g6_19 = f5 * (crypto_int64) g6_19;
|
||||
crypto_int64 f5g7_38 = f5_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f5g8_19 = f5 * (crypto_int64) g8_19;
|
||||
crypto_int64 f5g9_38 = f5_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f6g0 = f6 * (crypto_int64) g0;
|
||||
crypto_int64 f6g1 = f6 * (crypto_int64) g1;
|
||||
crypto_int64 f6g2 = f6 * (crypto_int64) g2;
|
||||
crypto_int64 f6g3 = f6 * (crypto_int64) g3;
|
||||
crypto_int64 f6g4_19 = f6 * (crypto_int64) g4_19;
|
||||
crypto_int64 f6g5_19 = f6 * (crypto_int64) g5_19;
|
||||
crypto_int64 f6g6_19 = f6 * (crypto_int64) g6_19;
|
||||
crypto_int64 f6g7_19 = f6 * (crypto_int64) g7_19;
|
||||
crypto_int64 f6g8_19 = f6 * (crypto_int64) g8_19;
|
||||
crypto_int64 f6g9_19 = f6 * (crypto_int64) g9_19;
|
||||
crypto_int64 f7g0 = f7 * (crypto_int64) g0;
|
||||
crypto_int64 f7g1_2 = f7_2 * (crypto_int64) g1;
|
||||
crypto_int64 f7g2 = f7 * (crypto_int64) g2;
|
||||
crypto_int64 f7g3_38 = f7_2 * (crypto_int64) g3_19;
|
||||
crypto_int64 f7g4_19 = f7 * (crypto_int64) g4_19;
|
||||
crypto_int64 f7g5_38 = f7_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f7g6_19 = f7 * (crypto_int64) g6_19;
|
||||
crypto_int64 f7g7_38 = f7_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f7g8_19 = f7 * (crypto_int64) g8_19;
|
||||
crypto_int64 f7g9_38 = f7_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 f8g0 = f8 * (crypto_int64) g0;
|
||||
crypto_int64 f8g1 = f8 * (crypto_int64) g1;
|
||||
crypto_int64 f8g2_19 = f8 * (crypto_int64) g2_19;
|
||||
crypto_int64 f8g3_19 = f8 * (crypto_int64) g3_19;
|
||||
crypto_int64 f8g4_19 = f8 * (crypto_int64) g4_19;
|
||||
crypto_int64 f8g5_19 = f8 * (crypto_int64) g5_19;
|
||||
crypto_int64 f8g6_19 = f8 * (crypto_int64) g6_19;
|
||||
crypto_int64 f8g7_19 = f8 * (crypto_int64) g7_19;
|
||||
crypto_int64 f8g8_19 = f8 * (crypto_int64) g8_19;
|
||||
crypto_int64 f8g9_19 = f8 * (crypto_int64) g9_19;
|
||||
crypto_int64 f9g0 = f9 * (crypto_int64) g0;
|
||||
crypto_int64 f9g1_38 = f9_2 * (crypto_int64) g1_19;
|
||||
crypto_int64 f9g2_19 = f9 * (crypto_int64) g2_19;
|
||||
crypto_int64 f9g3_38 = f9_2 * (crypto_int64) g3_19;
|
||||
crypto_int64 f9g4_19 = f9 * (crypto_int64) g4_19;
|
||||
crypto_int64 f9g5_38 = f9_2 * (crypto_int64) g5_19;
|
||||
crypto_int64 f9g6_19 = f9 * (crypto_int64) g6_19;
|
||||
crypto_int64 f9g7_38 = f9_2 * (crypto_int64) g7_19;
|
||||
crypto_int64 f9g8_19 = f9 * (crypto_int64) g8_19;
|
||||
crypto_int64 f9g9_38 = f9_2 * (crypto_int64) g9_19;
|
||||
crypto_int64 h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38;
|
||||
crypto_int64 h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19;
|
||||
crypto_int64 h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38;
|
||||
crypto_int64 h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19;
|
||||
crypto_int64 h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38;
|
||||
crypto_int64 h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19;
|
||||
crypto_int64 h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38;
|
||||
crypto_int64 h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19;
|
||||
crypto_int64 h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38;
|
||||
crypto_int64 h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
/*
|
||||
|h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38))
|
||||
i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
|
||||
|h1| <= (1.65*1.65*2^51*(1+1+19+19+19+19+19+19+19+19))
|
||||
i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9
|
||||
*/
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
/* |h0| <= 2^25 */
|
||||
/* |h4| <= 2^25 */
|
||||
/* |h1| <= 1.71*2^59 */
|
||||
/* |h5| <= 1.71*2^59 */
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
/* |h1| <= 2^24; from now on fits into int32 */
|
||||
/* |h5| <= 2^24; from now on fits into int32 */
|
||||
/* |h2| <= 1.41*2^60 */
|
||||
/* |h6| <= 1.41*2^60 */
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
/* |h2| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h6| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h3| <= 1.71*2^59 */
|
||||
/* |h7| <= 1.71*2^59 */
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
/* |h3| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h7| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h4| <= 1.72*2^34 */
|
||||
/* |h8| <= 1.41*2^60 */
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
/* |h4| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h8| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h5| <= 1.01*2^24 */
|
||||
/* |h9| <= 1.71*2^59 */
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
/* |h9| <= 2^24; from now on fits into int32 unchanged */
|
||||
/* |h0| <= 1.1*2^39 */
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
/* |h0| <= 2^25; from now on fits into int32 unchanged */
|
||||
/* |h1| <= 1.01*2^24 */
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = -f
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
*/
|
||||
|
||||
void fe_neg(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 h0 = -f0;
|
||||
crypto_int32 h1 = -f1;
|
||||
crypto_int32 h2 = -f2;
|
||||
crypto_int32 h3 = -f3;
|
||||
crypto_int32 h4 = -f4;
|
||||
crypto_int32 h5 = -f5;
|
||||
crypto_int32 h6 = -f6;
|
||||
crypto_int32 h7 = -f7;
|
||||
crypto_int32 h8 = -f8;
|
||||
crypto_int32 h9 = -f9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#include "fe.h"
|
||||
|
||||
void fe_pow22523(fe out,const fe z)
|
||||
{
|
||||
fe t0;
|
||||
fe t1;
|
||||
fe t2;
|
||||
int i;
|
||||
|
||||
#include "pow22523.h"
|
||||
|
||||
return;
|
||||
}
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = f * f
|
||||
Can overlap h with f.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
See fe_mul.c for discussion of implementation strategy.
|
||||
*/
|
||||
|
||||
void fe_sq(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 f0_2 = 2 * f0;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f2_2 = 2 * f2;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f4_2 = 2 * f4;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f6_2 = 2 * f6;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
#include "fe.h"
|
||||
#include "crypto_int64.h"
|
||||
|
||||
/*
|
||||
h = 2 * f * f
|
||||
Can overlap h with f.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||
*/
|
||||
|
||||
/*
|
||||
See fe_mul.c for discussion of implementation strategy.
|
||||
*/
|
||||
|
||||
void fe_sq2(fe h,const fe f)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 f0_2 = 2 * f0;
|
||||
crypto_int32 f1_2 = 2 * f1;
|
||||
crypto_int32 f2_2 = 2 * f2;
|
||||
crypto_int32 f3_2 = 2 * f3;
|
||||
crypto_int32 f4_2 = 2 * f4;
|
||||
crypto_int32 f5_2 = 2 * f5;
|
||||
crypto_int32 f6_2 = 2 * f6;
|
||||
crypto_int32 f7_2 = 2 * f7;
|
||||
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
|
||||
h0 += h0;
|
||||
h1 += h1;
|
||||
h2 += h2;
|
||||
h3 += h3;
|
||||
h4 += h4;
|
||||
h5 += h5;
|
||||
h6 += h6;
|
||||
h7 += h7;
|
||||
h8 += h8;
|
||||
h9 += h9;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
|
||||
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
|
||||
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
|
||||
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
|
||||
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
|
||||
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||
|
||||
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
h = f - g
|
||||
Can overlap h with f or g.
|
||||
|
||||
Preconditions:
|
||||
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||
|
||||
Postconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
*/
|
||||
|
||||
void fe_sub(fe h,const fe f,const fe g)
|
||||
{
|
||||
crypto_int32 f0 = f[0];
|
||||
crypto_int32 f1 = f[1];
|
||||
crypto_int32 f2 = f[2];
|
||||
crypto_int32 f3 = f[3];
|
||||
crypto_int32 f4 = f[4];
|
||||
crypto_int32 f5 = f[5];
|
||||
crypto_int32 f6 = f[6];
|
||||
crypto_int32 f7 = f[7];
|
||||
crypto_int32 f8 = f[8];
|
||||
crypto_int32 f9 = f[9];
|
||||
crypto_int32 g0 = g[0];
|
||||
crypto_int32 g1 = g[1];
|
||||
crypto_int32 g2 = g[2];
|
||||
crypto_int32 g3 = g[3];
|
||||
crypto_int32 g4 = g[4];
|
||||
crypto_int32 g5 = g[5];
|
||||
crypto_int32 g6 = g[6];
|
||||
crypto_int32 g7 = g[7];
|
||||
crypto_int32 g8 = g[8];
|
||||
crypto_int32 g9 = g[9];
|
||||
crypto_int32 h0 = f0 - g0;
|
||||
crypto_int32 h1 = f1 - g1;
|
||||
crypto_int32 h2 = f2 - g2;
|
||||
crypto_int32 h3 = f3 - g3;
|
||||
crypto_int32 h4 = f4 - g4;
|
||||
crypto_int32 h5 = f5 - g5;
|
||||
crypto_int32 h6 = f6 - g6;
|
||||
crypto_int32 h7 = f7 - g7;
|
||||
crypto_int32 h8 = f8 - g8;
|
||||
crypto_int32 h9 = f9 - g9;
|
||||
h[0] = h0;
|
||||
h[1] = h1;
|
||||
h[2] = h2;
|
||||
h[3] = h3;
|
||||
h[4] = h4;
|
||||
h[5] = h5;
|
||||
h[6] = h6;
|
||||
h[7] = h7;
|
||||
h[8] = h8;
|
||||
h[9] = h9;
|
||||
}
|
||||
|
|
@ -0,0 +1,119 @@
|
|||
#include "fe.h"
|
||||
|
||||
/*
|
||||
Preconditions:
|
||||
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||
|
||||
Write p=2^255-19; q=floor(h/p).
|
||||
Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
|
||||
|
||||
Proof:
|
||||
Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
|
||||
Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
|
||||
|
||||
Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
|
||||
Then 0<y<1.
|
||||
|
||||
Write r=h-pq.
|
||||
Have 0<=r<=p-1=2^255-20.
|
||||
Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
|
||||
|
||||
Write x=r+19(2^-255)r+y.
|
||||
Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
|
||||
|
||||
Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
|
||||
so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
|
||||
*/
|
||||
|
||||
void fe_tobytes(unsigned char *s,const fe h)
|
||||
{
|
||||
crypto_int32 h0 = h[0];
|
||||
crypto_int32 h1 = h[1];
|
||||
crypto_int32 h2 = h[2];
|
||||
crypto_int32 h3 = h[3];
|
||||
crypto_int32 h4 = h[4];
|
||||
crypto_int32 h5 = h[5];
|
||||
crypto_int32 h6 = h[6];
|
||||
crypto_int32 h7 = h[7];
|
||||
crypto_int32 h8 = h[8];
|
||||
crypto_int32 h9 = h[9];
|
||||
crypto_int32 q;
|
||||
crypto_int32 carry0;
|
||||
crypto_int32 carry1;
|
||||
crypto_int32 carry2;
|
||||
crypto_int32 carry3;
|
||||
crypto_int32 carry4;
|
||||
crypto_int32 carry5;
|
||||
crypto_int32 carry6;
|
||||
crypto_int32 carry7;
|
||||
crypto_int32 carry8;
|
||||
crypto_int32 carry9;
|
||||
|
||||
q = (19 * h9 + (((crypto_int32) 1) << 24)) >> 25;
|
||||
q = (h0 + q) >> 26;
|
||||
q = (h1 + q) >> 25;
|
||||
q = (h2 + q) >> 26;
|
||||
q = (h3 + q) >> 25;
|
||||
q = (h4 + q) >> 26;
|
||||
q = (h5 + q) >> 25;
|
||||
q = (h6 + q) >> 26;
|
||||
q = (h7 + q) >> 25;
|
||||
q = (h8 + q) >> 26;
|
||||
q = (h9 + q) >> 25;
|
||||
|
||||
/* Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20. */
|
||||
h0 += 19 * q;
|
||||
/* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */
|
||||
|
||||
carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||
carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||
carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||
carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||
carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||
carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||
carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||
carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||
carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||
carry9 = h9 >> 25; h9 -= carry9 << 25;
|
||||
/* h10 = carry9 */
|
||||
|
||||
/*
|
||||
Goal: Output h0+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
|
||||
Have h0+...+2^230 h9 between 0 and 2^255-1;
|
||||
evidently 2^255 h10-2^255 q = 0.
|
||||
Goal: Output h0+...+2^230 h9.
|
||||
*/
|
||||
|
||||
s[0] = h0 >> 0;
|
||||
s[1] = h0 >> 8;
|
||||
s[2] = h0 >> 16;
|
||||
s[3] = (h0 >> 24) | (h1 << 2);
|
||||
s[4] = h1 >> 6;
|
||||
s[5] = h1 >> 14;
|
||||
s[6] = (h1 >> 22) | (h2 << 3);
|
||||
s[7] = h2 >> 5;
|
||||
s[8] = h2 >> 13;
|
||||
s[9] = (h2 >> 21) | (h3 << 5);
|
||||
s[10] = h3 >> 3;
|
||||
s[11] = h3 >> 11;
|
||||
s[12] = (h3 >> 19) | (h4 << 6);
|
||||
s[13] = h4 >> 2;
|
||||
s[14] = h4 >> 10;
|
||||
s[15] = h4 >> 18;
|
||||
s[16] = h5 >> 0;
|
||||
s[17] = h5 >> 8;
|
||||
s[18] = h5 >> 16;
|
||||
s[19] = (h5 >> 24) | (h6 << 1);
|
||||
s[20] = h6 >> 7;
|
||||
s[21] = h6 >> 15;
|
||||
s[22] = (h6 >> 23) | (h7 << 3);
|
||||
s[23] = h7 >> 5;
|
||||
s[24] = h7 >> 13;
|
||||
s[25] = (h7 >> 21) | (h8 << 4);
|
||||
s[26] = h8 >> 4;
|
||||
s[27] = h8 >> 12;
|
||||
s[28] = (h8 >> 20) | (h9 << 6);
|
||||
s[29] = h9 >> 2;
|
||||
s[30] = h9 >> 10;
|
||||
s[31] = h9 >> 18;
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
#ifndef GE_H
|
||||
#define GE_H
|
||||
|
||||
/*
|
||||
ge means group element.
|
||||
|
||||
Here the group is the set of pairs (x,y) of field elements (see fe.h)
|
||||
satisfying -x^2 + y^2 = 1 + d x^2y^2
|
||||
where d = -121665/121666.
|
||||
|
||||
Representations:
|
||||
ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z
|
||||
ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
|
||||
ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T
|
||||
ge_precomp (Duif): (y+x,y-x,2dxy)
|
||||
*/
|
||||
|
||||
#include "fe.h"
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
} ge_p2;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p3;
|
||||
|
||||
typedef struct {
|
||||
fe X;
|
||||
fe Y;
|
||||
fe Z;
|
||||
fe T;
|
||||
} ge_p1p1;
|
||||
|
||||
typedef struct {
|
||||
fe yplusx;
|
||||
fe yminusx;
|
||||
fe xy2d;
|
||||
} ge_precomp;
|
||||
|
||||
typedef struct {
|
||||
fe YplusX;
|
||||
fe YminusX;
|
||||
fe Z;
|
||||
fe T2d;
|
||||
} ge_cached;
|
||||
|
||||
#define ge_frombytes_negate_vartime crypto_sign_ed25519_ref10_ge_frombytes_negate_vartime
|
||||
#define ge_tobytes crypto_sign_ed25519_ref10_ge_tobytes
|
||||
#define ge_p3_tobytes crypto_sign_ed25519_ref10_ge_p3_tobytes
|
||||
|
||||
#define ge_p2_0 crypto_sign_ed25519_ref10_ge_p2_0
|
||||
#define ge_p3_0 crypto_sign_ed25519_ref10_ge_p3_0
|
||||
#define ge_precomp_0 crypto_sign_ed25519_ref10_ge_precomp_0
|
||||
#define ge_p3_to_p2 crypto_sign_ed25519_ref10_ge_p3_to_p2
|
||||
#define ge_p3_to_cached crypto_sign_ed25519_ref10_ge_p3_to_cached
|
||||
#define ge_p1p1_to_p2 crypto_sign_ed25519_ref10_ge_p1p1_to_p2
|
||||
#define ge_p1p1_to_p3 crypto_sign_ed25519_ref10_ge_p1p1_to_p3
|
||||
#define ge_p2_dbl crypto_sign_ed25519_ref10_ge_p2_dbl
|
||||
#define ge_p3_dbl crypto_sign_ed25519_ref10_ge_p3_dbl
|
||||
|
||||
#define ge_madd crypto_sign_ed25519_ref10_ge_madd
|
||||
#define ge_msub crypto_sign_ed25519_ref10_ge_msub
|
||||
#define ge_add crypto_sign_ed25519_ref10_ge_add
|
||||
#define ge_sub crypto_sign_ed25519_ref10_ge_sub
|
||||
#define ge_scalarmult_base crypto_sign_ed25519_ref10_ge_scalarmult_base
|
||||
#define ge_double_scalarmult_vartime crypto_sign_ed25519_ref10_ge_double_scalarmult_vartime
|
||||
|
||||
extern void ge_tobytes(unsigned char *,const ge_p2 *);
|
||||
extern void ge_p3_tobytes(unsigned char *,const ge_p3 *);
|
||||
extern int ge_frombytes_negate_vartime(ge_p3 *,const unsigned char *);
|
||||
|
||||
extern void ge_p2_0(ge_p2 *);
|
||||
extern void ge_p3_0(ge_p3 *);
|
||||
extern void ge_precomp_0(ge_precomp *);
|
||||
extern void ge_p3_to_p2(ge_p2 *,const ge_p3 *);
|
||||
extern void ge_p3_to_cached(ge_cached *,const ge_p3 *);
|
||||
extern void ge_p1p1_to_p2(ge_p2 *,const ge_p1p1 *);
|
||||
extern void ge_p1p1_to_p3(ge_p3 *,const ge_p1p1 *);
|
||||
extern void ge_p2_dbl(ge_p1p1 *,const ge_p2 *);
|
||||
extern void ge_p3_dbl(ge_p1p1 *,const ge_p3 *);
|
||||
|
||||
extern void ge_madd(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||
extern void ge_msub(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||
extern void ge_add(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||
extern void ge_sub(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||
extern void ge_scalarmult_base(ge_p3 *,const unsigned char *);
|
||||
extern void ge_double_scalarmult_vartime(ge_p2 *,const unsigned char *,const ge_p3 *,const unsigned char *);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p + q
|
||||
*/
|
||||
|
||||
void ge_add(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_add.h"
|
||||
}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
|
||||
/* qhasm: enter ge_add */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe Z2 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ZZ */
|
||||
|
||||
/* qhasm: fe YpX2 */
|
||||
|
||||
/* qhasm: fe YmX2 */
|
||||
|
||||
/* qhasm: fe T2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*YpX2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YpX2=fe#15); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YpX2=q->YplusX); */
|
||||
fe_mul(r->Z,r->X,q->YplusX);
|
||||
|
||||
/* qhasm: B = YmX1*YmX2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YmX2=fe#16); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YmX2=q->YminusX); */
|
||||
fe_mul(r->Y,r->Y,q->YminusX);
|
||||
|
||||
/* qhasm: C = T2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->T2d,p->T);
|
||||
|
||||
/* qhasm: ZZ = Z1*Z2 */
|
||||
/* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
|
||||
/* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
|
||||
fe_mul(r->X,p->Z,q->Z);
|
||||
|
||||
/* qhasm: D = 2*ZZ */
|
||||
/* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
|
||||
/* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
|
||||
fe_add(t0,r->X,r->X);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D+C */
|
||||
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_add(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D-C */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_sub(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,96 @@
|
|||
#include "ge.h"
|
||||
|
||||
static void slide(signed char *r,const unsigned char *a)
|
||||
{
|
||||
int i;
|
||||
int b;
|
||||
int k;
|
||||
|
||||
for (i = 0;i < 256;++i)
|
||||
r[i] = 1 & (a[i >> 3] >> (i & 7));
|
||||
|
||||
for (i = 0;i < 256;++i)
|
||||
if (r[i]) {
|
||||
for (b = 1;b <= 6 && i + b < 256;++b) {
|
||||
if (r[i + b]) {
|
||||
if (r[i] + (r[i + b] << b) <= 15) {
|
||||
r[i] += r[i + b] << b; r[i + b] = 0;
|
||||
} else if (r[i] - (r[i + b] << b) >= -15) {
|
||||
r[i] -= r[i + b] << b;
|
||||
for (k = i + b;k < 256;++k) {
|
||||
if (!r[k]) {
|
||||
r[k] = 1;
|
||||
break;
|
||||
}
|
||||
r[k] = 0;
|
||||
}
|
||||
} else
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static ge_precomp Bi[8] = {
|
||||
#include "base2.h"
|
||||
} ;
|
||||
|
||||
/*
|
||||
r = a * A + b * B
|
||||
where a = a[0]+256*a[1]+...+256^31 a[31].
|
||||
and b = b[0]+256*b[1]+...+256^31 b[31].
|
||||
B is the Ed25519 base point (x,4/5) with x positive.
|
||||
*/
|
||||
|
||||
void ge_double_scalarmult_vartime(ge_p2 *r,const unsigned char *a,const ge_p3 *A,const unsigned char *b)
|
||||
{
|
||||
signed char aslide[256];
|
||||
signed char bslide[256];
|
||||
ge_cached Ai[8]; /* A,3A,5A,7A,9A,11A,13A,15A */
|
||||
ge_p1p1 t;
|
||||
ge_p3 u;
|
||||
ge_p3 A2;
|
||||
int i;
|
||||
|
||||
slide(aslide,a);
|
||||
slide(bslide,b);
|
||||
|
||||
ge_p3_to_cached(&Ai[0],A);
|
||||
ge_p3_dbl(&t,A); ge_p1p1_to_p3(&A2,&t);
|
||||
ge_add(&t,&A2,&Ai[0]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[1],&u);
|
||||
ge_add(&t,&A2,&Ai[1]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[2],&u);
|
||||
ge_add(&t,&A2,&Ai[2]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[3],&u);
|
||||
ge_add(&t,&A2,&Ai[3]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[4],&u);
|
||||
ge_add(&t,&A2,&Ai[4]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[5],&u);
|
||||
ge_add(&t,&A2,&Ai[5]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[6],&u);
|
||||
ge_add(&t,&A2,&Ai[6]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[7],&u);
|
||||
|
||||
ge_p2_0(r);
|
||||
|
||||
for (i = 255;i >= 0;--i) {
|
||||
if (aslide[i] || bslide[i]) break;
|
||||
}
|
||||
|
||||
for (;i >= 0;--i) {
|
||||
ge_p2_dbl(&t,r);
|
||||
|
||||
if (aslide[i] > 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_add(&t,&u,&Ai[aslide[i]/2]);
|
||||
} else if (aslide[i] < 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_sub(&t,&u,&Ai[(-aslide[i])/2]);
|
||||
}
|
||||
|
||||
if (bslide[i] > 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_madd(&t,&u,&Bi[bslide[i]/2]);
|
||||
} else if (bslide[i] < 0) {
|
||||
ge_p1p1_to_p3(&u,&t);
|
||||
ge_msub(&t,&u,&Bi[(-bslide[i])/2]);
|
||||
}
|
||||
|
||||
ge_p1p1_to_p2(r,&t);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
#include "ge.h"
|
||||
|
||||
static const fe d = {
|
||||
#include "d.h"
|
||||
} ;
|
||||
|
||||
static const fe sqrtm1 = {
|
||||
#include "sqrtm1.h"
|
||||
} ;
|
||||
|
||||
int ge_frombytes_negate_vartime(ge_p3 *h,const unsigned char *s)
|
||||
{
|
||||
fe u;
|
||||
fe v;
|
||||
fe v3;
|
||||
fe vxx;
|
||||
fe check;
|
||||
|
||||
fe_frombytes(h->Y,s);
|
||||
fe_1(h->Z);
|
||||
fe_sq(u,h->Y);
|
||||
fe_mul(v,u,d);
|
||||
fe_sub(u,u,h->Z); /* u = y^2-1 */
|
||||
fe_add(v,v,h->Z); /* v = dy^2+1 */
|
||||
|
||||
fe_sq(v3,v);
|
||||
fe_mul(v3,v3,v); /* v3 = v^3 */
|
||||
fe_sq(h->X,v3);
|
||||
fe_mul(h->X,h->X,v);
|
||||
fe_mul(h->X,h->X,u); /* x = uv^7 */
|
||||
|
||||
fe_pow22523(h->X,h->X); /* x = (uv^7)^((q-5)/8) */
|
||||
fe_mul(h->X,h->X,v3);
|
||||
fe_mul(h->X,h->X,u); /* x = uv^3(uv^7)^((q-5)/8) */
|
||||
|
||||
fe_sq(vxx,h->X);
|
||||
fe_mul(vxx,vxx,v);
|
||||
fe_sub(check,vxx,u); /* vx^2-u */
|
||||
if (fe_isnonzero(check)) {
|
||||
fe_add(check,vxx,u); /* vx^2+u */
|
||||
if (fe_isnonzero(check)) return -1;
|
||||
fe_mul(h->X,h->X,sqrtm1);
|
||||
}
|
||||
|
||||
if (fe_isnegative(h->X) == (s[31] >> 7))
|
||||
fe_neg(h->X,h->X);
|
||||
|
||||
fe_mul(h->T,h->X,h->Y);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p + q
|
||||
*/
|
||||
|
||||
void ge_madd(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_madd.h"
|
||||
}
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
|
||||
/* qhasm: enter ge_madd */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ypx2 */
|
||||
|
||||
/* qhasm: fe ymx2 */
|
||||
|
||||
/* qhasm: fe xy2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*ypx2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ypx2=fe#15); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ypx2=q->yplusx); */
|
||||
fe_mul(r->Z,r->X,q->yplusx);
|
||||
|
||||
/* qhasm: B = YmX1*ymx2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ymx2=fe#16); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ymx2=q->yminusx); */
|
||||
fe_mul(r->Y,r->Y,q->yminusx);
|
||||
|
||||
/* qhasm: C = xy2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->xy2d,p->T);
|
||||
|
||||
/* qhasm: D = 2*Z1 */
|
||||
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||
fe_add(t0,p->Z,p->Z);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D+C */
|
||||
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_add(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D-C */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_sub(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p - q
|
||||
*/
|
||||
|
||||
void ge_msub(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_msub.h"
|
||||
}
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
|
||||
/* qhasm: enter ge_msub */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ypx2 */
|
||||
|
||||
/* qhasm: fe ymx2 */
|
||||
|
||||
/* qhasm: fe xy2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*ymx2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ymx2=fe#16); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ymx2=q->yminusx); */
|
||||
fe_mul(r->Z,r->X,q->yminusx);
|
||||
|
||||
/* qhasm: B = YmX1*ypx2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ypx2=fe#15); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ypx2=q->yplusx); */
|
||||
fe_mul(r->Y,r->Y,q->yplusx);
|
||||
|
||||
/* qhasm: C = xy2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->xy2d,p->T);
|
||||
|
||||
/* qhasm: D = 2*Z1 */
|
||||
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||
fe_add(t0,p->Z,p->Z);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D-C */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_sub(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D+C */
|
||||
/* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_add(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p1p1_to_p2(ge_p2 *r,const ge_p1p1 *p)
|
||||
{
|
||||
fe_mul(r->X,p->X,p->T);
|
||||
fe_mul(r->Y,p->Y,p->Z);
|
||||
fe_mul(r->Z,p->Z,p->T);
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p1p1_to_p3(ge_p3 *r,const ge_p1p1 *p)
|
||||
{
|
||||
fe_mul(r->X,p->X,p->T);
|
||||
fe_mul(r->Y,p->Y,p->Z);
|
||||
fe_mul(r->Z,p->Z,p->T);
|
||||
fe_mul(r->T,p->X,p->Y);
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p2_0(ge_p2 *h)
|
||||
{
|
||||
fe_0(h->X);
|
||||
fe_1(h->Y);
|
||||
fe_1(h->Z);
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = 2 * p
|
||||
*/
|
||||
|
||||
void ge_p2_dbl(ge_p1p1 *r,const ge_p2 *p)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_p2_dbl.h"
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
|
||||
/* qhasm: enter ge_p2_dbl */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe AA */
|
||||
|
||||
/* qhasm: fe XX */
|
||||
|
||||
/* qhasm: fe YY */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: XX=X1^2 */
|
||||
/* asm 1: fe_sq(>XX=fe#1,<X1=fe#11); */
|
||||
/* asm 2: fe_sq(>XX=r->X,<X1=p->X); */
|
||||
fe_sq(r->X,p->X);
|
||||
|
||||
/* qhasm: YY=Y1^2 */
|
||||
/* asm 1: fe_sq(>YY=fe#3,<Y1=fe#12); */
|
||||
/* asm 2: fe_sq(>YY=r->Z,<Y1=p->Y); */
|
||||
fe_sq(r->Z,p->Y);
|
||||
|
||||
/* qhasm: B=2*Z1^2 */
|
||||
/* asm 1: fe_sq2(>B=fe#4,<Z1=fe#13); */
|
||||
/* asm 2: fe_sq2(>B=r->T,<Z1=p->Z); */
|
||||
fe_sq2(r->T,p->Z);
|
||||
|
||||
/* qhasm: A=X1+Y1 */
|
||||
/* asm 1: fe_add(>A=fe#2,<X1=fe#11,<Y1=fe#12); */
|
||||
/* asm 2: fe_add(>A=r->Y,<X1=p->X,<Y1=p->Y); */
|
||||
fe_add(r->Y,p->X,p->Y);
|
||||
|
||||
/* qhasm: AA=A^2 */
|
||||
/* asm 1: fe_sq(>AA=fe#5,<A=fe#2); */
|
||||
/* asm 2: fe_sq(>AA=t0,<A=r->Y); */
|
||||
fe_sq(t0,r->Y);
|
||||
|
||||
/* qhasm: Y3=YY+XX */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<YY=fe#3,<XX=fe#1); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<YY=r->Z,<XX=r->X); */
|
||||
fe_add(r->Y,r->Z,r->X);
|
||||
|
||||
/* qhasm: Z3=YY-XX */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<YY=fe#3,<XX=fe#1); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<YY=r->Z,<XX=r->X); */
|
||||
fe_sub(r->Z,r->Z,r->X);
|
||||
|
||||
/* qhasm: X3=AA-Y3 */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<AA=fe#5,<Y3=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<AA=t0,<Y3=r->Y); */
|
||||
fe_sub(r->X,t0,r->Y);
|
||||
|
||||
/* qhasm: T3=B-Z3 */
|
||||
/* asm 1: fe_sub(>T3=fe#4,<B=fe#4,<Z3=fe#3); */
|
||||
/* asm 2: fe_sub(>T3=r->T,<B=r->T,<Z3=r->Z); */
|
||||
fe_sub(r->T,r->T,r->Z);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p3_0(ge_p3 *h)
|
||||
{
|
||||
fe_0(h->X);
|
||||
fe_1(h->Y);
|
||||
fe_1(h->Z);
|
||||
fe_0(h->T);
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = 2 * p
|
||||
*/
|
||||
|
||||
void ge_p3_dbl(ge_p1p1 *r,const ge_p3 *p)
|
||||
{
|
||||
ge_p2 q;
|
||||
ge_p3_to_p2(&q,p);
|
||||
ge_p2_dbl(r,&q);
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
static const fe d2 = {
|
||||
#include "d2.h"
|
||||
} ;
|
||||
|
||||
extern void ge_p3_to_cached(ge_cached *r,const ge_p3 *p)
|
||||
{
|
||||
fe_add(r->YplusX,p->Y,p->X);
|
||||
fe_sub(r->YminusX,p->Y,p->X);
|
||||
fe_copy(r->Z,p->Z);
|
||||
fe_mul(r->T2d,p->T,d2);
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p
|
||||
*/
|
||||
|
||||
extern void ge_p3_to_p2(ge_p2 *r,const ge_p3 *p)
|
||||
{
|
||||
fe_copy(r->X,p->X);
|
||||
fe_copy(r->Y,p->Y);
|
||||
fe_copy(r->Z,p->Z);
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_p3_tobytes(unsigned char *s,const ge_p3 *h)
|
||||
{
|
||||
fe recip;
|
||||
fe x;
|
||||
fe y;
|
||||
|
||||
fe_invert(recip,h->Z);
|
||||
fe_mul(x,h->X,recip);
|
||||
fe_mul(y,h->Y,recip);
|
||||
fe_tobytes(s,y);
|
||||
s[31] ^= fe_isnegative(x) << 7;
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_precomp_0(ge_precomp *h)
|
||||
{
|
||||
fe_1(h->yplusx);
|
||||
fe_1(h->yminusx);
|
||||
fe_0(h->xy2d);
|
||||
}
|
||||
|
|
@ -0,0 +1,105 @@
|
|||
#include "ge.h"
|
||||
#include "crypto_uint32.h"
|
||||
|
||||
static unsigned char equal(signed char b,signed char c)
|
||||
{
|
||||
unsigned char ub = b;
|
||||
unsigned char uc = c;
|
||||
unsigned char x = ub ^ uc; /* 0: yes; 1..255: no */
|
||||
crypto_uint32 y = x; /* 0: yes; 1..255: no */
|
||||
y -= 1; /* 4294967295: yes; 0..254: no */
|
||||
y >>= 31; /* 1: yes; 0: no */
|
||||
return y;
|
||||
}
|
||||
|
||||
static unsigned char negative(signed char b)
|
||||
{
|
||||
unsigned long long x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */
|
||||
x >>= 63; /* 1: yes; 0: no */
|
||||
return x;
|
||||
}
|
||||
|
||||
static void cmov(ge_precomp *t,ge_precomp *u,unsigned char b)
|
||||
{
|
||||
fe_cmov(t->yplusx,u->yplusx,b);
|
||||
fe_cmov(t->yminusx,u->yminusx,b);
|
||||
fe_cmov(t->xy2d,u->xy2d,b);
|
||||
}
|
||||
|
||||
/* base[i][j] = (j+1)*256^i*B */
|
||||
static ge_precomp base[32][8] = {
|
||||
#include "base.h"
|
||||
} ;
|
||||
|
||||
static void select(ge_precomp *t,int pos,signed char b)
|
||||
{
|
||||
ge_precomp minust;
|
||||
unsigned char bnegative = negative(b);
|
||||
unsigned char babs = b - (((-bnegative) & b) << 1);
|
||||
|
||||
ge_precomp_0(t);
|
||||
cmov(t,&base[pos][0],equal(babs,1));
|
||||
cmov(t,&base[pos][1],equal(babs,2));
|
||||
cmov(t,&base[pos][2],equal(babs,3));
|
||||
cmov(t,&base[pos][3],equal(babs,4));
|
||||
cmov(t,&base[pos][4],equal(babs,5));
|
||||
cmov(t,&base[pos][5],equal(babs,6));
|
||||
cmov(t,&base[pos][6],equal(babs,7));
|
||||
cmov(t,&base[pos][7],equal(babs,8));
|
||||
fe_copy(minust.yplusx,t->yminusx);
|
||||
fe_copy(minust.yminusx,t->yplusx);
|
||||
fe_neg(minust.xy2d,t->xy2d);
|
||||
cmov(t,&minust,bnegative);
|
||||
}
|
||||
|
||||
/*
|
||||
h = a * B
|
||||
where a = a[0]+256*a[1]+...+256^31 a[31]
|
||||
B is the Ed25519 base point (x,4/5) with x positive.
|
||||
|
||||
Preconditions:
|
||||
a[31] <= 127
|
||||
*/
|
||||
|
||||
void ge_scalarmult_base(ge_p3 *h,const unsigned char *a)
|
||||
{
|
||||
signed char e[64];
|
||||
signed char carry;
|
||||
ge_p1p1 r;
|
||||
ge_p2 s;
|
||||
ge_precomp t;
|
||||
int i;
|
||||
|
||||
for (i = 0;i < 32;++i) {
|
||||
e[2 * i + 0] = (a[i] >> 0) & 15;
|
||||
e[2 * i + 1] = (a[i] >> 4) & 15;
|
||||
}
|
||||
/* each e[i] is between 0 and 15 */
|
||||
/* e[63] is between 0 and 7 */
|
||||
|
||||
carry = 0;
|
||||
for (i = 0;i < 63;++i) {
|
||||
e[i] += carry;
|
||||
carry = e[i] + 8;
|
||||
carry >>= 4;
|
||||
e[i] -= carry << 4;
|
||||
}
|
||||
e[63] += carry;
|
||||
/* each e[i] is between -8 and 8 */
|
||||
|
||||
ge_p3_0(h);
|
||||
for (i = 1;i < 64;i += 2) {
|
||||
select(&t,i / 2,e[i]);
|
||||
ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
|
||||
}
|
||||
|
||||
ge_p3_dbl(&r,h); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||
ge_p2_dbl(&r,&s); ge_p1p1_to_p3(h,&r);
|
||||
|
||||
for (i = 0;i < 64;i += 2) {
|
||||
select(&t,i / 2,e[i]);
|
||||
ge_madd(&r,h,&t); ge_p1p1_to_p3(h,&r);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#include "ge.h"
|
||||
|
||||
/*
|
||||
r = p - q
|
||||
*/
|
||||
|
||||
void ge_sub(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
|
||||
{
|
||||
fe t0;
|
||||
#include "ge_sub.h"
|
||||
}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
|
||||
/* qhasm: enter ge_sub */
|
||||
|
||||
/* qhasm: fe X1 */
|
||||
|
||||
/* qhasm: fe Y1 */
|
||||
|
||||
/* qhasm: fe Z1 */
|
||||
|
||||
/* qhasm: fe Z2 */
|
||||
|
||||
/* qhasm: fe T1 */
|
||||
|
||||
/* qhasm: fe ZZ */
|
||||
|
||||
/* qhasm: fe YpX2 */
|
||||
|
||||
/* qhasm: fe YmX2 */
|
||||
|
||||
/* qhasm: fe T2d2 */
|
||||
|
||||
/* qhasm: fe X3 */
|
||||
|
||||
/* qhasm: fe Y3 */
|
||||
|
||||
/* qhasm: fe Z3 */
|
||||
|
||||
/* qhasm: fe T3 */
|
||||
|
||||
/* qhasm: fe YpX1 */
|
||||
|
||||
/* qhasm: fe YmX1 */
|
||||
|
||||
/* qhasm: fe A */
|
||||
|
||||
/* qhasm: fe B */
|
||||
|
||||
/* qhasm: fe C */
|
||||
|
||||
/* qhasm: fe D */
|
||||
|
||||
/* qhasm: YpX1 = Y1+X1 */
|
||||
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||
fe_add(r->X,p->Y,p->X);
|
||||
|
||||
/* qhasm: YmX1 = Y1-X1 */
|
||||
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||
fe_sub(r->Y,p->Y,p->X);
|
||||
|
||||
/* qhasm: A = YpX1*YmX2 */
|
||||
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YmX2=fe#16); */
|
||||
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YmX2=q->YminusX); */
|
||||
fe_mul(r->Z,r->X,q->YminusX);
|
||||
|
||||
/* qhasm: B = YmX1*YpX2 */
|
||||
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YpX2=fe#15); */
|
||||
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YpX2=q->YplusX); */
|
||||
fe_mul(r->Y,r->Y,q->YplusX);
|
||||
|
||||
/* qhasm: C = T2d2*T1 */
|
||||
/* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
|
||||
/* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
|
||||
fe_mul(r->T,q->T2d,p->T);
|
||||
|
||||
/* qhasm: ZZ = Z1*Z2 */
|
||||
/* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
|
||||
/* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
|
||||
fe_mul(r->X,p->Z,q->Z);
|
||||
|
||||
/* qhasm: D = 2*ZZ */
|
||||
/* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
|
||||
/* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
|
||||
fe_add(t0,r->X,r->X);
|
||||
|
||||
/* qhasm: X3 = A-B */
|
||||
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||
fe_sub(r->X,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Y3 = A+B */
|
||||
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||
fe_add(r->Y,r->Z,r->Y);
|
||||
|
||||
/* qhasm: Z3 = D-C */
|
||||
/* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||
fe_sub(r->Z,t0,r->T);
|
||||
|
||||
/* qhasm: T3 = D+C */
|
||||
/* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||
/* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
|
||||
fe_add(r->T,t0,r->T);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
#include "ge.h"
|
||||
|
||||
void ge_tobytes(unsigned char *s,const ge_p2 *h)
|
||||
{
|
||||
fe recip;
|
||||
fe x;
|
||||
fe y;
|
||||
|
||||
fe_invert(recip,h->Z);
|
||||
fe_mul(x,h->X,recip);
|
||||
fe_mul(y,h->Y,recip);
|
||||
fe_tobytes(s,y);
|
||||
s[31] ^= fe_isnegative(x) << 7;
|
||||
}
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "curve_sigs.h"
|
||||
|
||||
#define MSG_LEN 200
|
||||
|
||||
int main(int argc, char* argv[])
|
||||
{
|
||||
unsigned char privkey[32];
|
||||
unsigned char pubkey[32];
|
||||
unsigned char signature[64];
|
||||
unsigned char msg[MSG_LEN];
|
||||
unsigned char random[64];
|
||||
|
||||
/* Initialize pubkey, privkey, msg */
|
||||
memset(msg, 0, MSG_LEN);
|
||||
memset(privkey, 0, 32);
|
||||
memset(pubkey, 0, 32);
|
||||
privkey[0] &= 248;
|
||||
privkey[31] &= 63;
|
||||
privkey[31] |= 64;
|
||||
|
||||
privkey[8] = 189; /* just so there's some bits set */
|
||||
|
||||
|
||||
/* SHA512 test */
|
||||
unsigned char sha512_input[112] = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu";
|
||||
unsigned char sha512_correct_output[64] =
|
||||
{
|
||||
0x8E, 0x95, 0x9B, 0x75, 0xDA, 0xE3, 0x13, 0xDA,
|
||||
0x8C, 0xF4, 0xF7, 0x28, 0x14, 0xFC, 0x14, 0x3F,
|
||||
0x8F, 0x77, 0x79, 0xC6, 0xEB, 0x9F, 0x7F, 0xA1,
|
||||
0x72, 0x99, 0xAE, 0xAD, 0xB6, 0x88, 0x90, 0x18,
|
||||
0x50, 0x1D, 0x28, 0x9E, 0x49, 0x00, 0xF7, 0xE4,
|
||||
0x33, 0x1B, 0x99, 0xDE, 0xC4, 0xB5, 0x43, 0x3A,
|
||||
0xC7, 0xD3, 0x29, 0xEE, 0xB6, 0xDD, 0x26, 0x54,
|
||||
0x5E, 0x96, 0xE5, 0x5B, 0x87, 0x4B, 0xE9, 0x09
|
||||
};
|
||||
unsigned char sha512_actual_output[64];
|
||||
|
||||
crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input));
|
||||
if (memcmp(sha512_actual_output, sha512_correct_output, 64) != 0)
|
||||
printf("SHA512 bad #1\n");
|
||||
else
|
||||
printf("SHA512 good #1\n");
|
||||
|
||||
sha512_input[111] ^= 1;
|
||||
|
||||
crypto_hash_sha512(sha512_actual_output, sha512_input, sizeof(sha512_input));
|
||||
if (memcmp(sha512_actual_output, sha512_correct_output, 64) != 0)
|
||||
printf("SHA512 good #2\n");
|
||||
else
|
||||
printf("SHA512 bad #2\n");
|
||||
|
||||
/* Signature test */
|
||||
curve25519_keygen(pubkey, privkey);
|
||||
|
||||
curve25519_sign(signature, privkey, msg, MSG_LEN, random);
|
||||
|
||||
if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0)
|
||||
printf("Signature good #1\n");
|
||||
else
|
||||
printf("Signature bad #1\n");
|
||||
|
||||
signature[0] ^= 1;
|
||||
|
||||
if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0)
|
||||
printf("Signature bad #2\n");
|
||||
else
|
||||
printf("Signature good #2\n");
|
||||
|
||||
|
||||
printf("Random testing...\n");
|
||||
for (int count = 0; count < 10000; count++) {
|
||||
unsigned char b[64];
|
||||
crypto_hash_sha512(b, privkey, 32);
|
||||
memmove(privkey, b, 32);
|
||||
crypto_hash_sha512(b, privkey, 32);
|
||||
memmove(random, b, 64);
|
||||
|
||||
privkey[0] &= 248;
|
||||
privkey[31] &= 63;
|
||||
privkey[31] |= 64;
|
||||
|
||||
curve25519_keygen(pubkey, privkey);
|
||||
|
||||
curve25519_sign(signature, privkey, msg, MSG_LEN, random);
|
||||
|
||||
if (curve25519_verify(signature, pubkey, msg, MSG_LEN) != 0) {
|
||||
printf("failure #1 %d\n", count);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (b[63] & 1)
|
||||
signature[count % 64] ^= 1;
|
||||
else
|
||||
msg[count % MSG_LEN] ^= 1;
|
||||
if (curve25519_verify(signature, pubkey, msg, MSG_LEN) == 0) {
|
||||
printf("failure #2 %d\n", count);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
printf("OK\n");
|
||||
return 1;
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_int32_h
|
||||
#define crypto_int32_h
|
||||
|
||||
typedef int crypto_int32;
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_int64_h
|
||||
#define crypto_int64_h
|
||||
|
||||
typedef long long crypto_int64;
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
#ifndef crypto_sign_H
|
||||
#define crypto_sign_H
|
||||
|
||||
#include "crypto_sign_edwards25519sha512batch.h"
|
||||
|
||||
#define crypto_sign crypto_sign_edwards25519sha512batch
|
||||
#define crypto_sign_open crypto_sign_edwards25519sha512batch_open
|
||||
#define crypto_sign_keypair crypto_sign_edwards25519sha512batch_keypair
|
||||
#define crypto_sign_BYTES crypto_sign_edwards25519sha512batch_BYTES
|
||||
#define crypto_sign_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES
|
||||
#define crypto_sign_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_SECRETKEYBYTES
|
||||
#define crypto_sign_PRIMITIVE "edwards25519sha512batch"
|
||||
#define crypto_sign_IMPLEMENTATION crypto_sign_edwards25519sha512batch_IMPLEMENTATION
|
||||
#define crypto_sign_VERSION crypto_sign_edwards25519sha512batch_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
#ifndef crypto_sign_edwards25519sha512batch_H
|
||||
#define crypto_sign_edwards25519sha512batch_H
|
||||
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_SECRETKEYBYTES 64
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_PUBLICKEYBYTES 32
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_BYTES 64
|
||||
#ifdef __cplusplus
|
||||
#include <string>
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10(const std::string &,const std::string &);
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10_open(const std::string &,const std::string &);
|
||||
extern std::string crypto_sign_edwards25519sha512batch_ref10_keypair(std::string *);
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10_open(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *);
|
||||
extern int crypto_sign_edwards25519sha512batch_ref10_keypair(unsigned char *,unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_sign_edwards25519sha512batch crypto_sign_edwards25519sha512batch_ref10
|
||||
#define crypto_sign_edwards25519sha512batch_open crypto_sign_edwards25519sha512batch_ref10_open
|
||||
#define crypto_sign_edwards25519sha512batch_keypair crypto_sign_edwards25519sha512batch_ref10_keypair
|
||||
#define crypto_sign_edwards25519sha512batch_BYTES crypto_sign_edwards25519sha512batch_ref10_BYTES
|
||||
#define crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_ref10_PUBLICKEYBYTES
|
||||
#define crypto_sign_edwards25519sha512batch_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_ref10_SECRETKEYBYTES
|
||||
#define crypto_sign_edwards25519sha512batch_IMPLEMENTATION "crypto_sign/edwards25519sha512batch/ref10"
|
||||
#ifndef crypto_sign_edwards25519sha512batch_ref10_VERSION
|
||||
#define crypto_sign_edwards25519sha512batch_ref10_VERSION "-"
|
||||
#endif
|
||||
#define crypto_sign_edwards25519sha512batch_VERSION crypto_sign_edwards25519sha512batch_ref10_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_uint32_h
|
||||
#define crypto_uint32_h
|
||||
|
||||
typedef unsigned int crypto_uint32;
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_uint64_h
|
||||
#define crypto_uint64_h
|
||||
|
||||
typedef unsigned long long crypto_uint64;
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
#ifndef crypto_verify_32_H
|
||||
#define crypto_verify_32_H
|
||||
|
||||
#define crypto_verify_32_ref_BYTES 32
|
||||
#ifdef __cplusplus
|
||||
#include <string>
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_verify_32_ref(const unsigned char *,const unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_verify_32 crypto_verify_32_ref
|
||||
#define crypto_verify_32_BYTES crypto_verify_32_ref_BYTES
|
||||
#define crypto_verify_32_IMPLEMENTATION "crypto_verify/32/ref"
|
||||
#ifndef crypto_verify_32_ref_VERSION
|
||||
#define crypto_verify_32_ref_VERSION "-"
|
||||
#endif
|
||||
#define crypto_verify_32_VERSION crypto_verify_32_ref_VERSION
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,238 @@
|
|||
#include <stdint.h>
|
||||
typedef uint64_t uint64;
|
||||
|
||||
static uint64 load_bigendian(const unsigned char *x)
|
||||
{
|
||||
return
|
||||
(uint64) (x[7]) \
|
||||
| (((uint64) (x[6])) << 8) \
|
||||
| (((uint64) (x[5])) << 16) \
|
||||
| (((uint64) (x[4])) << 24) \
|
||||
| (((uint64) (x[3])) << 32) \
|
||||
| (((uint64) (x[2])) << 40) \
|
||||
| (((uint64) (x[1])) << 48) \
|
||||
| (((uint64) (x[0])) << 56)
|
||||
;
|
||||
}
|
||||
|
||||
static void store_bigendian(unsigned char *x,uint64 u)
|
||||
{
|
||||
x[7] = u; u >>= 8;
|
||||
x[6] = u; u >>= 8;
|
||||
x[5] = u; u >>= 8;
|
||||
x[4] = u; u >>= 8;
|
||||
x[3] = u; u >>= 8;
|
||||
x[2] = u; u >>= 8;
|
||||
x[1] = u; u >>= 8;
|
||||
x[0] = u;
|
||||
}
|
||||
|
||||
#define SHR(x,c) ((x) >> (c))
|
||||
#define ROTR(x,c) (((x) >> (c)) | ((x) << (64 - (c))))
|
||||
|
||||
#define Ch(x,y,z) ((x & y) ^ (~x & z))
|
||||
#define Maj(x,y,z) ((x & y) ^ (x & z) ^ (y & z))
|
||||
#define Sigma0(x) (ROTR(x,28) ^ ROTR(x,34) ^ ROTR(x,39))
|
||||
#define Sigma1(x) (ROTR(x,14) ^ ROTR(x,18) ^ ROTR(x,41))
|
||||
#define sigma0(x) (ROTR(x, 1) ^ ROTR(x, 8) ^ SHR(x,7))
|
||||
#define sigma1(x) (ROTR(x,19) ^ ROTR(x,61) ^ SHR(x,6))
|
||||
|
||||
#define M(w0,w14,w9,w1) w0 = sigma1(w14) + w9 + sigma0(w1) + w0;
|
||||
|
||||
#define EXPAND \
|
||||
M(w0 ,w14,w9 ,w1 ) \
|
||||
M(w1 ,w15,w10,w2 ) \
|
||||
M(w2 ,w0 ,w11,w3 ) \
|
||||
M(w3 ,w1 ,w12,w4 ) \
|
||||
M(w4 ,w2 ,w13,w5 ) \
|
||||
M(w5 ,w3 ,w14,w6 ) \
|
||||
M(w6 ,w4 ,w15,w7 ) \
|
||||
M(w7 ,w5 ,w0 ,w8 ) \
|
||||
M(w8 ,w6 ,w1 ,w9 ) \
|
||||
M(w9 ,w7 ,w2 ,w10) \
|
||||
M(w10,w8 ,w3 ,w11) \
|
||||
M(w11,w9 ,w4 ,w12) \
|
||||
M(w12,w10,w5 ,w13) \
|
||||
M(w13,w11,w6 ,w14) \
|
||||
M(w14,w12,w7 ,w15) \
|
||||
M(w15,w13,w8 ,w0 )
|
||||
|
||||
#define F(w,k) \
|
||||
T1 = h + Sigma1(e) + Ch(e,f,g) + k + w; \
|
||||
T2 = Sigma0(a) + Maj(a,b,c); \
|
||||
h = g; \
|
||||
g = f; \
|
||||
f = e; \
|
||||
e = d + T1; \
|
||||
d = c; \
|
||||
c = b; \
|
||||
b = a; \
|
||||
a = T1 + T2;
|
||||
|
||||
int crypto_hashblocks_sha512(unsigned char *statebytes,const unsigned char *in,unsigned long long inlen)
|
||||
{
|
||||
uint64 state[8];
|
||||
uint64 a;
|
||||
uint64 b;
|
||||
uint64 c;
|
||||
uint64 d;
|
||||
uint64 e;
|
||||
uint64 f;
|
||||
uint64 g;
|
||||
uint64 h;
|
||||
uint64 T1;
|
||||
uint64 T2;
|
||||
|
||||
a = load_bigendian(statebytes + 0); state[0] = a;
|
||||
b = load_bigendian(statebytes + 8); state[1] = b;
|
||||
c = load_bigendian(statebytes + 16); state[2] = c;
|
||||
d = load_bigendian(statebytes + 24); state[3] = d;
|
||||
e = load_bigendian(statebytes + 32); state[4] = e;
|
||||
f = load_bigendian(statebytes + 40); state[5] = f;
|
||||
g = load_bigendian(statebytes + 48); state[6] = g;
|
||||
h = load_bigendian(statebytes + 56); state[7] = h;
|
||||
|
||||
while (inlen >= 128) {
|
||||
uint64 w0 = load_bigendian(in + 0);
|
||||
uint64 w1 = load_bigendian(in + 8);
|
||||
uint64 w2 = load_bigendian(in + 16);
|
||||
uint64 w3 = load_bigendian(in + 24);
|
||||
uint64 w4 = load_bigendian(in + 32);
|
||||
uint64 w5 = load_bigendian(in + 40);
|
||||
uint64 w6 = load_bigendian(in + 48);
|
||||
uint64 w7 = load_bigendian(in + 56);
|
||||
uint64 w8 = load_bigendian(in + 64);
|
||||
uint64 w9 = load_bigendian(in + 72);
|
||||
uint64 w10 = load_bigendian(in + 80);
|
||||
uint64 w11 = load_bigendian(in + 88);
|
||||
uint64 w12 = load_bigendian(in + 96);
|
||||
uint64 w13 = load_bigendian(in + 104);
|
||||
uint64 w14 = load_bigendian(in + 112);
|
||||
uint64 w15 = load_bigendian(in + 120);
|
||||
|
||||
F(w0 ,0x428a2f98d728ae22ULL)
|
||||
F(w1 ,0x7137449123ef65cdULL)
|
||||
F(w2 ,0xb5c0fbcfec4d3b2fULL)
|
||||
F(w3 ,0xe9b5dba58189dbbcULL)
|
||||
F(w4 ,0x3956c25bf348b538ULL)
|
||||
F(w5 ,0x59f111f1b605d019ULL)
|
||||
F(w6 ,0x923f82a4af194f9bULL)
|
||||
F(w7 ,0xab1c5ed5da6d8118ULL)
|
||||
F(w8 ,0xd807aa98a3030242ULL)
|
||||
F(w9 ,0x12835b0145706fbeULL)
|
||||
F(w10,0x243185be4ee4b28cULL)
|
||||
F(w11,0x550c7dc3d5ffb4e2ULL)
|
||||
F(w12,0x72be5d74f27b896fULL)
|
||||
F(w13,0x80deb1fe3b1696b1ULL)
|
||||
F(w14,0x9bdc06a725c71235ULL)
|
||||
F(w15,0xc19bf174cf692694ULL)
|
||||
|
||||
EXPAND
|
||||
|
||||
F(w0 ,0xe49b69c19ef14ad2ULL)
|
||||
F(w1 ,0xefbe4786384f25e3ULL)
|
||||
F(w2 ,0x0fc19dc68b8cd5b5ULL)
|
||||
F(w3 ,0x240ca1cc77ac9c65ULL)
|
||||
F(w4 ,0x2de92c6f592b0275ULL)
|
||||
F(w5 ,0x4a7484aa6ea6e483ULL)
|
||||
F(w6 ,0x5cb0a9dcbd41fbd4ULL)
|
||||
F(w7 ,0x76f988da831153b5ULL)
|
||||
F(w8 ,0x983e5152ee66dfabULL)
|
||||
F(w9 ,0xa831c66d2db43210ULL)
|
||||
F(w10,0xb00327c898fb213fULL)
|
||||
F(w11,0xbf597fc7beef0ee4ULL)
|
||||
F(w12,0xc6e00bf33da88fc2ULL)
|
||||
F(w13,0xd5a79147930aa725ULL)
|
||||
F(w14,0x06ca6351e003826fULL)
|
||||
F(w15,0x142929670a0e6e70ULL)
|
||||
|
||||
EXPAND
|
||||
|
||||
F(w0 ,0x27b70a8546d22ffcULL)
|
||||
F(w1 ,0x2e1b21385c26c926ULL)
|
||||
F(w2 ,0x4d2c6dfc5ac42aedULL)
|
||||
F(w3 ,0x53380d139d95b3dfULL)
|
||||
F(w4 ,0x650a73548baf63deULL)
|
||||
F(w5 ,0x766a0abb3c77b2a8ULL)
|
||||
F(w6 ,0x81c2c92e47edaee6ULL)
|
||||
F(w7 ,0x92722c851482353bULL)
|
||||
F(w8 ,0xa2bfe8a14cf10364ULL)
|
||||
F(w9 ,0xa81a664bbc423001ULL)
|
||||
F(w10,0xc24b8b70d0f89791ULL)
|
||||
F(w11,0xc76c51a30654be30ULL)
|
||||
F(w12,0xd192e819d6ef5218ULL)
|
||||
F(w13,0xd69906245565a910ULL)
|
||||
F(w14,0xf40e35855771202aULL)
|
||||
F(w15,0x106aa07032bbd1b8ULL)
|
||||
|
||||
EXPAND
|
||||
|
||||
F(w0 ,0x19a4c116b8d2d0c8ULL)
|
||||
F(w1 ,0x1e376c085141ab53ULL)
|
||||
F(w2 ,0x2748774cdf8eeb99ULL)
|
||||
F(w3 ,0x34b0bcb5e19b48a8ULL)
|
||||
F(w4 ,0x391c0cb3c5c95a63ULL)
|
||||
F(w5 ,0x4ed8aa4ae3418acbULL)
|
||||
F(w6 ,0x5b9cca4f7763e373ULL)
|
||||
F(w7 ,0x682e6ff3d6b2b8a3ULL)
|
||||
F(w8 ,0x748f82ee5defb2fcULL)
|
||||
F(w9 ,0x78a5636f43172f60ULL)
|
||||
F(w10,0x84c87814a1f0ab72ULL)
|
||||
F(w11,0x8cc702081a6439ecULL)
|
||||
F(w12,0x90befffa23631e28ULL)
|
||||
F(w13,0xa4506cebde82bde9ULL)
|
||||
F(w14,0xbef9a3f7b2c67915ULL)
|
||||
F(w15,0xc67178f2e372532bULL)
|
||||
|
||||
EXPAND
|
||||
|
||||
F(w0 ,0xca273eceea26619cULL)
|
||||
F(w1 ,0xd186b8c721c0c207ULL)
|
||||
F(w2 ,0xeada7dd6cde0eb1eULL)
|
||||
F(w3 ,0xf57d4f7fee6ed178ULL)
|
||||
F(w4 ,0x06f067aa72176fbaULL)
|
||||
F(w5 ,0x0a637dc5a2c898a6ULL)
|
||||
F(w6 ,0x113f9804bef90daeULL)
|
||||
F(w7 ,0x1b710b35131c471bULL)
|
||||
F(w8 ,0x28db77f523047d84ULL)
|
||||
F(w9 ,0x32caab7b40c72493ULL)
|
||||
F(w10,0x3c9ebe0a15c9bebcULL)
|
||||
F(w11,0x431d67c49c100d4cULL)
|
||||
F(w12,0x4cc5d4becb3e42b6ULL)
|
||||
F(w13,0x597f299cfc657e2aULL)
|
||||
F(w14,0x5fcb6fab3ad6faecULL)
|
||||
F(w15,0x6c44198c4a475817ULL)
|
||||
|
||||
a += state[0];
|
||||
b += state[1];
|
||||
c += state[2];
|
||||
d += state[3];
|
||||
e += state[4];
|
||||
f += state[5];
|
||||
g += state[6];
|
||||
h += state[7];
|
||||
|
||||
state[0] = a;
|
||||
state[1] = b;
|
||||
state[2] = c;
|
||||
state[3] = d;
|
||||
state[4] = e;
|
||||
state[5] = f;
|
||||
state[6] = g;
|
||||
state[7] = h;
|
||||
|
||||
in += 128;
|
||||
inlen -= 128;
|
||||
}
|
||||
|
||||
store_bigendian(statebytes + 0,state[0]);
|
||||
store_bigendian(statebytes + 8,state[1]);
|
||||
store_bigendian(statebytes + 16,state[2]);
|
||||
store_bigendian(statebytes + 24,state[3]);
|
||||
store_bigendian(statebytes + 32,state[4]);
|
||||
store_bigendian(statebytes + 40,state[5]);
|
||||
store_bigendian(statebytes + 48,state[6]);
|
||||
store_bigendian(statebytes + 56,state[7]);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
/*
|
||||
20080913
|
||||
D. J. Bernstein
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include <stdint.h>
|
||||
typedef uint64_t uint64;
|
||||
|
||||
extern int crypto_hashblocks_sha512(unsigned char *statebytes,const unsigned char *in,unsigned long long inlen);
|
||||
|
||||
#define blocks crypto_hashblocks_sha512
|
||||
|
||||
static const unsigned char iv[64] = {
|
||||
0x6a,0x09,0xe6,0x67,0xf3,0xbc,0xc9,0x08,
|
||||
0xbb,0x67,0xae,0x85,0x84,0xca,0xa7,0x3b,
|
||||
0x3c,0x6e,0xf3,0x72,0xfe,0x94,0xf8,0x2b,
|
||||
0xa5,0x4f,0xf5,0x3a,0x5f,0x1d,0x36,0xf1,
|
||||
0x51,0x0e,0x52,0x7f,0xad,0xe6,0x82,0xd1,
|
||||
0x9b,0x05,0x68,0x8c,0x2b,0x3e,0x6c,0x1f,
|
||||
0x1f,0x83,0xd9,0xab,0xfb,0x41,0xbd,0x6b,
|
||||
0x5b,0xe0,0xcd,0x19,0x13,0x7e,0x21,0x79
|
||||
} ;
|
||||
|
||||
int crypto_hash_sha512(unsigned char *out,const unsigned char *in,unsigned long long inlen)
|
||||
{
|
||||
unsigned char h[64];
|
||||
unsigned char padded[256];
|
||||
int i;
|
||||
unsigned long long bytes = inlen;
|
||||
|
||||
for (i = 0;i < 64;++i) h[i] = iv[i];
|
||||
|
||||
blocks(h,in,inlen);
|
||||
in += inlen;
|
||||
inlen &= 127;
|
||||
in -= inlen;
|
||||
|
||||
for (i = 0;i < inlen;++i) padded[i] = in[i];
|
||||
padded[inlen] = 0x80;
|
||||
|
||||
if (inlen < 112) {
|
||||
for (i = inlen + 1;i < 119;++i) padded[i] = 0;
|
||||
padded[119] = bytes >> 61;
|
||||
padded[120] = bytes >> 53;
|
||||
padded[121] = bytes >> 45;
|
||||
padded[122] = bytes >> 37;
|
||||
padded[123] = bytes >> 29;
|
||||
padded[124] = bytes >> 21;
|
||||
padded[125] = bytes >> 13;
|
||||
padded[126] = bytes >> 5;
|
||||
padded[127] = bytes << 3;
|
||||
blocks(h,padded,128);
|
||||
} else {
|
||||
for (i = inlen + 1;i < 247;++i) padded[i] = 0;
|
||||
padded[247] = bytes >> 61;
|
||||
padded[248] = bytes >> 53;
|
||||
padded[249] = bytes >> 45;
|
||||
padded[250] = bytes >> 37;
|
||||
padded[251] = bytes >> 29;
|
||||
padded[252] = bytes >> 21;
|
||||
padded[253] = bytes >> 13;
|
||||
padded[254] = bytes >> 5;
|
||||
padded[255] = bytes << 3;
|
||||
blocks(h,padded,256);
|
||||
}
|
||||
|
||||
for (i = 0;i < 64;++i) out[i] = h[i];
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "crypto_verify_32.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
|
||||
int crypto_sign_open(
|
||||
unsigned char *m,unsigned long long *mlen,
|
||||
const unsigned char *sm,unsigned long long smlen,
|
||||
const unsigned char *pk
|
||||
)
|
||||
{
|
||||
unsigned char pkcopy[32];
|
||||
unsigned char rcopy[32];
|
||||
unsigned char scopy[32];
|
||||
unsigned char h[64];
|
||||
unsigned char rcheck[32];
|
||||
ge_p3 A;
|
||||
ge_p2 R;
|
||||
|
||||
if (smlen < 64) goto badsig;
|
||||
if (sm[63] & 224) goto badsig;
|
||||
if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
|
||||
|
||||
memmove(pkcopy,pk,32);
|
||||
memmove(rcopy,sm,32);
|
||||
memmove(scopy,sm + 32,32);
|
||||
|
||||
memmove(m,sm,smlen);
|
||||
memmove(m + 32,pkcopy,32);
|
||||
crypto_hash_sha512(h,m,smlen);
|
||||
sc_reduce(h);
|
||||
|
||||
ge_double_scalarmult_vartime(&R,h,&A,scopy);
|
||||
ge_tobytes(rcheck,&R);
|
||||
if (crypto_verify_32(rcheck,rcopy) == 0) {
|
||||
memmove(m,m + 64,smlen - 64);
|
||||
memset(m + smlen - 64,0,64);
|
||||
*mlen = smlen - 64;
|
||||
return 0;
|
||||
}
|
||||
|
||||
badsig:
|
||||
*mlen = -1;
|
||||
memset(m,0,smlen);
|
||||
return -1;
|
||||
}
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
|
||||
/* qhasm: fe z1 */
|
||||
|
||||
/* qhasm: fe z2 */
|
||||
|
||||
/* qhasm: fe z8 */
|
||||
|
||||
/* qhasm: fe z9 */
|
||||
|
||||
/* qhasm: fe z11 */
|
||||
|
||||
/* qhasm: fe z22 */
|
||||
|
||||
/* qhasm: fe z_5_0 */
|
||||
|
||||
/* qhasm: fe z_10_5 */
|
||||
|
||||
/* qhasm: fe z_10_0 */
|
||||
|
||||
/* qhasm: fe z_20_10 */
|
||||
|
||||
/* qhasm: fe z_20_0 */
|
||||
|
||||
/* qhasm: fe z_40_20 */
|
||||
|
||||
/* qhasm: fe z_40_0 */
|
||||
|
||||
/* qhasm: fe z_50_10 */
|
||||
|
||||
/* qhasm: fe z_50_0 */
|
||||
|
||||
/* qhasm: fe z_100_50 */
|
||||
|
||||
/* qhasm: fe z_100_0 */
|
||||
|
||||
/* qhasm: fe z_200_100 */
|
||||
|
||||
/* qhasm: fe z_200_0 */
|
||||
|
||||
/* qhasm: fe z_250_50 */
|
||||
|
||||
/* qhasm: fe z_250_0 */
|
||||
|
||||
/* qhasm: fe z_252_2 */
|
||||
|
||||
/* qhasm: fe z_252_3 */
|
||||
|
||||
/* qhasm: enter pow22523 */
|
||||
|
||||
/* qhasm: z2 = z1^2^1 */
|
||||
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
||||
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
||||
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z8 = z2^2^2 */
|
||||
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
||||
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z9 = z1*z8 */
|
||||
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
||||
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
||||
fe_mul(t1,z,t1);
|
||||
|
||||
/* qhasm: z11 = z2*z9 */
|
||||
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
||||
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
||||
fe_mul(t0,t0,t1);
|
||||
|
||||
/* qhasm: z22 = z11^2^1 */
|
||||
/* asm 1: fe_sq(>z22=fe#1,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#1,>z22=fe#1); */
|
||||
/* asm 2: fe_sq(>z22=t0,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t0,>z22=t0); */
|
||||
fe_sq(t0,t0); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z_5_0 = z9*z22 */
|
||||
/* asm 1: fe_mul(>z_5_0=fe#1,<z9=fe#2,<z22=fe#1); */
|
||||
/* asm 2: fe_mul(>z_5_0=t0,<z9=t1,<z22=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_10_5 = z_5_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_10_5=fe#2,<z_5_0=fe#1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#2,>z_10_5=fe#2); */
|
||||
/* asm 2: fe_sq(>z_10_5=t1,<z_5_0=t0); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t1,>z_10_5=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
||||
/* asm 1: fe_mul(>z_10_0=fe#1,<z_10_5=fe#2,<z_5_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_10_0=t0,<z_10_5=t1,<z_5_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_20_10 = z_10_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_20_10=fe#2,<z_10_0=fe#1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#2,>z_20_10=fe#2); */
|
||||
/* asm 2: fe_sq(>z_20_10=t1,<z_10_0=t0); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t1,>z_20_10=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_20_0=fe#2,<z_20_10=fe#2,<z_10_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_20_0=t1,<z_20_10=t1,<z_10_0=t0); */
|
||||
fe_mul(t1,t1,t0);
|
||||
|
||||
/* qhasm: z_40_20 = z_20_0^2^20 */
|
||||
/* asm 1: fe_sq(>z_40_20=fe#3,<z_20_0=fe#2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#3,>z_40_20=fe#3); */
|
||||
/* asm 2: fe_sq(>z_40_20=t2,<z_20_0=t1); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t2,>z_40_20=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 20;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
||||
/* asm 1: fe_mul(>z_40_0=fe#2,<z_40_20=fe#3,<z_20_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_40_0=t1,<z_40_20=t2,<z_20_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_50_10 = z_40_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_50_10=fe#2,<z_40_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#2,>z_50_10=fe#2); */
|
||||
/* asm 2: fe_sq(>z_50_10=t1,<z_40_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t1,>z_50_10=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 10;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_50_0=fe#1,<z_50_10=fe#2,<z_10_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_50_0=t0,<z_50_10=t1,<z_10_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_100_50 = z_50_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_100_50=fe#2,<z_50_0=fe#1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#2,>z_100_50=fe#2); */
|
||||
/* asm 2: fe_sq(>z_100_50=t1,<z_50_0=t0); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t1,>z_100_50=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_100_0=fe#2,<z_100_50=fe#2,<z_50_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_100_0=t1,<z_100_50=t1,<z_50_0=t0); */
|
||||
fe_mul(t1,t1,t0);
|
||||
|
||||
/* qhasm: z_200_100 = z_100_0^2^100 */
|
||||
/* asm 1: fe_sq(>z_200_100=fe#3,<z_100_0=fe#2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#3,>z_200_100=fe#3); */
|
||||
/* asm 2: fe_sq(>z_200_100=t2,<z_100_0=t1); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t2,>z_200_100=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 100;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
||||
/* asm 1: fe_mul(>z_200_0=fe#2,<z_200_100=fe#3,<z_100_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_200_0=t1,<z_200_100=t2,<z_100_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_250_50 = z_200_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_250_50=fe#2,<z_200_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#2,>z_250_50=fe#2); */
|
||||
/* asm 2: fe_sq(>z_250_50=t1,<z_200_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t1,>z_250_50=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 50;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_250_0=fe#1,<z_250_50=fe#2,<z_50_0=fe#1); */
|
||||
/* asm 2: fe_mul(>z_250_0=t0,<z_250_50=t1,<z_50_0=t0); */
|
||||
fe_mul(t0,t1,t0);
|
||||
|
||||
/* qhasm: z_252_2 = z_250_0^2^2 */
|
||||
/* asm 1: fe_sq(>z_252_2=fe#1,<z_250_0=fe#1); for (i = 1;i < 2;++i) fe_sq(>z_252_2=fe#1,>z_252_2=fe#1); */
|
||||
/* asm 2: fe_sq(>z_252_2=t0,<z_250_0=t0); for (i = 1;i < 2;++i) fe_sq(>z_252_2=t0,>z_252_2=t0); */
|
||||
fe_sq(t0,t0); for (i = 1;i < 2;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z_252_3 = z_252_2*z1 */
|
||||
/* asm 1: fe_mul(>z_252_3=fe#12,<z_252_2=fe#1,<z1=fe#11); */
|
||||
/* asm 2: fe_mul(>z_252_3=out,<z_252_2=t0,<z1=z); */
|
||||
fe_mul(out,t0,z);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
|
||||
/* qhasm: fe z1 */
|
||||
|
||||
/* qhasm: fe z2 */
|
||||
|
||||
/* qhasm: fe z8 */
|
||||
|
||||
/* qhasm: fe z9 */
|
||||
|
||||
/* qhasm: fe z11 */
|
||||
|
||||
/* qhasm: fe z22 */
|
||||
|
||||
/* qhasm: fe z_5_0 */
|
||||
|
||||
/* qhasm: fe z_10_5 */
|
||||
|
||||
/* qhasm: fe z_10_0 */
|
||||
|
||||
/* qhasm: fe z_20_10 */
|
||||
|
||||
/* qhasm: fe z_20_0 */
|
||||
|
||||
/* qhasm: fe z_40_20 */
|
||||
|
||||
/* qhasm: fe z_40_0 */
|
||||
|
||||
/* qhasm: fe z_50_10 */
|
||||
|
||||
/* qhasm: fe z_50_0 */
|
||||
|
||||
/* qhasm: fe z_100_50 */
|
||||
|
||||
/* qhasm: fe z_100_0 */
|
||||
|
||||
/* qhasm: fe z_200_100 */
|
||||
|
||||
/* qhasm: fe z_200_0 */
|
||||
|
||||
/* qhasm: fe z_250_50 */
|
||||
|
||||
/* qhasm: fe z_250_0 */
|
||||
|
||||
/* qhasm: fe z_255_5 */
|
||||
|
||||
/* qhasm: fe z_255_21 */
|
||||
|
||||
/* qhasm: enter pow225521 */
|
||||
|
||||
/* qhasm: z2 = z1^2^1 */
|
||||
/* asm 1: fe_sq(>z2=fe#1,<z1=fe#11); for (i = 1;i < 1;++i) fe_sq(>z2=fe#1,>z2=fe#1); */
|
||||
/* asm 2: fe_sq(>z2=t0,<z1=z); for (i = 1;i < 1;++i) fe_sq(>z2=t0,>z2=t0); */
|
||||
fe_sq(t0,z); for (i = 1;i < 1;++i) fe_sq(t0,t0);
|
||||
|
||||
/* qhasm: z8 = z2^2^2 */
|
||||
/* asm 1: fe_sq(>z8=fe#2,<z2=fe#1); for (i = 1;i < 2;++i) fe_sq(>z8=fe#2,>z8=fe#2); */
|
||||
/* asm 2: fe_sq(>z8=t1,<z2=t0); for (i = 1;i < 2;++i) fe_sq(>z8=t1,>z8=t1); */
|
||||
fe_sq(t1,t0); for (i = 1;i < 2;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z9 = z1*z8 */
|
||||
/* asm 1: fe_mul(>z9=fe#2,<z1=fe#11,<z8=fe#2); */
|
||||
/* asm 2: fe_mul(>z9=t1,<z1=z,<z8=t1); */
|
||||
fe_mul(t1,z,t1);
|
||||
|
||||
/* qhasm: z11 = z2*z9 */
|
||||
/* asm 1: fe_mul(>z11=fe#1,<z2=fe#1,<z9=fe#2); */
|
||||
/* asm 2: fe_mul(>z11=t0,<z2=t0,<z9=t1); */
|
||||
fe_mul(t0,t0,t1);
|
||||
|
||||
/* qhasm: z22 = z11^2^1 */
|
||||
/* asm 1: fe_sq(>z22=fe#3,<z11=fe#1); for (i = 1;i < 1;++i) fe_sq(>z22=fe#3,>z22=fe#3); */
|
||||
/* asm 2: fe_sq(>z22=t2,<z11=t0); for (i = 1;i < 1;++i) fe_sq(>z22=t2,>z22=t2); */
|
||||
fe_sq(t2,t0); for (i = 1;i < 1;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_5_0 = z9*z22 */
|
||||
/* asm 1: fe_mul(>z_5_0=fe#2,<z9=fe#2,<z22=fe#3); */
|
||||
/* asm 2: fe_mul(>z_5_0=t1,<z9=t1,<z22=t2); */
|
||||
fe_mul(t1,t1,t2);
|
||||
|
||||
/* qhasm: z_10_5 = z_5_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_10_5=fe#3,<z_5_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_10_5=fe#3,>z_10_5=fe#3); */
|
||||
/* asm 2: fe_sq(>z_10_5=t2,<z_5_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_10_5=t2,>z_10_5=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 5;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_10_0 = z_10_5*z_5_0 */
|
||||
/* asm 1: fe_mul(>z_10_0=fe#2,<z_10_5=fe#3,<z_5_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_10_0=t1,<z_10_5=t2,<z_5_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_20_10 = z_10_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_20_10=fe#3,<z_10_0=fe#2); for (i = 1;i < 10;++i) fe_sq(>z_20_10=fe#3,>z_20_10=fe#3); */
|
||||
/* asm 2: fe_sq(>z_20_10=t2,<z_10_0=t1); for (i = 1;i < 10;++i) fe_sq(>z_20_10=t2,>z_20_10=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_20_0 = z_20_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_20_0=fe#3,<z_20_10=fe#3,<z_10_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_20_0=t2,<z_20_10=t2,<z_10_0=t1); */
|
||||
fe_mul(t2,t2,t1);
|
||||
|
||||
/* qhasm: z_40_20 = z_20_0^2^20 */
|
||||
/* asm 1: fe_sq(>z_40_20=fe#4,<z_20_0=fe#3); for (i = 1;i < 20;++i) fe_sq(>z_40_20=fe#4,>z_40_20=fe#4); */
|
||||
/* asm 2: fe_sq(>z_40_20=t3,<z_20_0=t2); for (i = 1;i < 20;++i) fe_sq(>z_40_20=t3,>z_40_20=t3); */
|
||||
fe_sq(t3,t2); for (i = 1;i < 20;++i) fe_sq(t3,t3);
|
||||
|
||||
/* qhasm: z_40_0 = z_40_20*z_20_0 */
|
||||
/* asm 1: fe_mul(>z_40_0=fe#3,<z_40_20=fe#4,<z_20_0=fe#3); */
|
||||
/* asm 2: fe_mul(>z_40_0=t2,<z_40_20=t3,<z_20_0=t2); */
|
||||
fe_mul(t2,t3,t2);
|
||||
|
||||
/* qhasm: z_50_10 = z_40_0^2^10 */
|
||||
/* asm 1: fe_sq(>z_50_10=fe#3,<z_40_0=fe#3); for (i = 1;i < 10;++i) fe_sq(>z_50_10=fe#3,>z_50_10=fe#3); */
|
||||
/* asm 2: fe_sq(>z_50_10=t2,<z_40_0=t2); for (i = 1;i < 10;++i) fe_sq(>z_50_10=t2,>z_50_10=t2); */
|
||||
fe_sq(t2,t2); for (i = 1;i < 10;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_50_0 = z_50_10*z_10_0 */
|
||||
/* asm 1: fe_mul(>z_50_0=fe#2,<z_50_10=fe#3,<z_10_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_50_0=t1,<z_50_10=t2,<z_10_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_100_50 = z_50_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_100_50=fe#3,<z_50_0=fe#2); for (i = 1;i < 50;++i) fe_sq(>z_100_50=fe#3,>z_100_50=fe#3); */
|
||||
/* asm 2: fe_sq(>z_100_50=t2,<z_50_0=t1); for (i = 1;i < 50;++i) fe_sq(>z_100_50=t2,>z_100_50=t2); */
|
||||
fe_sq(t2,t1); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_100_0 = z_100_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_100_0=fe#3,<z_100_50=fe#3,<z_50_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_100_0=t2,<z_100_50=t2,<z_50_0=t1); */
|
||||
fe_mul(t2,t2,t1);
|
||||
|
||||
/* qhasm: z_200_100 = z_100_0^2^100 */
|
||||
/* asm 1: fe_sq(>z_200_100=fe#4,<z_100_0=fe#3); for (i = 1;i < 100;++i) fe_sq(>z_200_100=fe#4,>z_200_100=fe#4); */
|
||||
/* asm 2: fe_sq(>z_200_100=t3,<z_100_0=t2); for (i = 1;i < 100;++i) fe_sq(>z_200_100=t3,>z_200_100=t3); */
|
||||
fe_sq(t3,t2); for (i = 1;i < 100;++i) fe_sq(t3,t3);
|
||||
|
||||
/* qhasm: z_200_0 = z_200_100*z_100_0 */
|
||||
/* asm 1: fe_mul(>z_200_0=fe#3,<z_200_100=fe#4,<z_100_0=fe#3); */
|
||||
/* asm 2: fe_mul(>z_200_0=t2,<z_200_100=t3,<z_100_0=t2); */
|
||||
fe_mul(t2,t3,t2);
|
||||
|
||||
/* qhasm: z_250_50 = z_200_0^2^50 */
|
||||
/* asm 1: fe_sq(>z_250_50=fe#3,<z_200_0=fe#3); for (i = 1;i < 50;++i) fe_sq(>z_250_50=fe#3,>z_250_50=fe#3); */
|
||||
/* asm 2: fe_sq(>z_250_50=t2,<z_200_0=t2); for (i = 1;i < 50;++i) fe_sq(>z_250_50=t2,>z_250_50=t2); */
|
||||
fe_sq(t2,t2); for (i = 1;i < 50;++i) fe_sq(t2,t2);
|
||||
|
||||
/* qhasm: z_250_0 = z_250_50*z_50_0 */
|
||||
/* asm 1: fe_mul(>z_250_0=fe#2,<z_250_50=fe#3,<z_50_0=fe#2); */
|
||||
/* asm 2: fe_mul(>z_250_0=t1,<z_250_50=t2,<z_50_0=t1); */
|
||||
fe_mul(t1,t2,t1);
|
||||
|
||||
/* qhasm: z_255_5 = z_250_0^2^5 */
|
||||
/* asm 1: fe_sq(>z_255_5=fe#2,<z_250_0=fe#2); for (i = 1;i < 5;++i) fe_sq(>z_255_5=fe#2,>z_255_5=fe#2); */
|
||||
/* asm 2: fe_sq(>z_255_5=t1,<z_250_0=t1); for (i = 1;i < 5;++i) fe_sq(>z_255_5=t1,>z_255_5=t1); */
|
||||
fe_sq(t1,t1); for (i = 1;i < 5;++i) fe_sq(t1,t1);
|
||||
|
||||
/* qhasm: z_255_21 = z_255_5*z11 */
|
||||
/* asm 1: fe_mul(>z_255_21=fe#12,<z_255_5=fe#2,<z11=fe#1); */
|
||||
/* asm 2: fe_mul(>z_255_21=out,<z_255_5=t1,<z11=t0); */
|
||||
fe_mul(out,t1,t0);
|
||||
|
||||
/* qhasm: return */
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
#ifndef SC_H
|
||||
#define SC_H
|
||||
|
||||
/*
|
||||
The set of scalars is \Z/l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
*/
|
||||
|
||||
#define sc_reduce crypto_sign_ed25519_ref10_sc_reduce
|
||||
#define sc_muladd crypto_sign_ed25519_ref10_sc_muladd
|
||||
|
||||
extern void sc_reduce(unsigned char *);
|
||||
extern void sc_muladd(unsigned char *,const unsigned char *,const unsigned char *,const unsigned char *);
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,368 @@
|
|||
#include "sc.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint32.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Input:
|
||||
a[0]+256*a[1]+...+256^31*a[31] = a
|
||||
b[0]+256*b[1]+...+256^31*b[31] = b
|
||||
c[0]+256*c[1]+...+256^31*c[31] = c
|
||||
|
||||
Output:
|
||||
s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
*/
|
||||
|
||||
void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,const unsigned char *c)
|
||||
{
|
||||
crypto_int64 a0 = 2097151 & load_3(a);
|
||||
crypto_int64 a1 = 2097151 & (load_4(a + 2) >> 5);
|
||||
crypto_int64 a2 = 2097151 & (load_3(a + 5) >> 2);
|
||||
crypto_int64 a3 = 2097151 & (load_4(a + 7) >> 7);
|
||||
crypto_int64 a4 = 2097151 & (load_4(a + 10) >> 4);
|
||||
crypto_int64 a5 = 2097151 & (load_3(a + 13) >> 1);
|
||||
crypto_int64 a6 = 2097151 & (load_4(a + 15) >> 6);
|
||||
crypto_int64 a7 = 2097151 & (load_3(a + 18) >> 3);
|
||||
crypto_int64 a8 = 2097151 & load_3(a + 21);
|
||||
crypto_int64 a9 = 2097151 & (load_4(a + 23) >> 5);
|
||||
crypto_int64 a10 = 2097151 & (load_3(a + 26) >> 2);
|
||||
crypto_int64 a11 = (load_4(a + 28) >> 7);
|
||||
crypto_int64 b0 = 2097151 & load_3(b);
|
||||
crypto_int64 b1 = 2097151 & (load_4(b + 2) >> 5);
|
||||
crypto_int64 b2 = 2097151 & (load_3(b + 5) >> 2);
|
||||
crypto_int64 b3 = 2097151 & (load_4(b + 7) >> 7);
|
||||
crypto_int64 b4 = 2097151 & (load_4(b + 10) >> 4);
|
||||
crypto_int64 b5 = 2097151 & (load_3(b + 13) >> 1);
|
||||
crypto_int64 b6 = 2097151 & (load_4(b + 15) >> 6);
|
||||
crypto_int64 b7 = 2097151 & (load_3(b + 18) >> 3);
|
||||
crypto_int64 b8 = 2097151 & load_3(b + 21);
|
||||
crypto_int64 b9 = 2097151 & (load_4(b + 23) >> 5);
|
||||
crypto_int64 b10 = 2097151 & (load_3(b + 26) >> 2);
|
||||
crypto_int64 b11 = (load_4(b + 28) >> 7);
|
||||
crypto_int64 c0 = 2097151 & load_3(c);
|
||||
crypto_int64 c1 = 2097151 & (load_4(c + 2) >> 5);
|
||||
crypto_int64 c2 = 2097151 & (load_3(c + 5) >> 2);
|
||||
crypto_int64 c3 = 2097151 & (load_4(c + 7) >> 7);
|
||||
crypto_int64 c4 = 2097151 & (load_4(c + 10) >> 4);
|
||||
crypto_int64 c5 = 2097151 & (load_3(c + 13) >> 1);
|
||||
crypto_int64 c6 = 2097151 & (load_4(c + 15) >> 6);
|
||||
crypto_int64 c7 = 2097151 & (load_3(c + 18) >> 3);
|
||||
crypto_int64 c8 = 2097151 & load_3(c + 21);
|
||||
crypto_int64 c9 = 2097151 & (load_4(c + 23) >> 5);
|
||||
crypto_int64 c10 = 2097151 & (load_3(c + 26) >> 2);
|
||||
crypto_int64 c11 = (load_4(c + 28) >> 7);
|
||||
crypto_int64 s0;
|
||||
crypto_int64 s1;
|
||||
crypto_int64 s2;
|
||||
crypto_int64 s3;
|
||||
crypto_int64 s4;
|
||||
crypto_int64 s5;
|
||||
crypto_int64 s6;
|
||||
crypto_int64 s7;
|
||||
crypto_int64 s8;
|
||||
crypto_int64 s9;
|
||||
crypto_int64 s10;
|
||||
crypto_int64 s11;
|
||||
crypto_int64 s12;
|
||||
crypto_int64 s13;
|
||||
crypto_int64 s14;
|
||||
crypto_int64 s15;
|
||||
crypto_int64 s16;
|
||||
crypto_int64 s17;
|
||||
crypto_int64 s18;
|
||||
crypto_int64 s19;
|
||||
crypto_int64 s20;
|
||||
crypto_int64 s21;
|
||||
crypto_int64 s22;
|
||||
crypto_int64 s23;
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
crypto_int64 carry10;
|
||||
crypto_int64 carry11;
|
||||
crypto_int64 carry12;
|
||||
crypto_int64 carry13;
|
||||
crypto_int64 carry14;
|
||||
crypto_int64 carry15;
|
||||
crypto_int64 carry16;
|
||||
crypto_int64 carry17;
|
||||
crypto_int64 carry18;
|
||||
crypto_int64 carry19;
|
||||
crypto_int64 carry20;
|
||||
crypto_int64 carry21;
|
||||
crypto_int64 carry22;
|
||||
|
||||
s0 = c0 + a0*b0;
|
||||
s1 = c1 + a0*b1 + a1*b0;
|
||||
s2 = c2 + a0*b2 + a1*b1 + a2*b0;
|
||||
s3 = c3 + a0*b3 + a1*b2 + a2*b1 + a3*b0;
|
||||
s4 = c4 + a0*b4 + a1*b3 + a2*b2 + a3*b1 + a4*b0;
|
||||
s5 = c5 + a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0;
|
||||
s6 = c6 + a0*b6 + a1*b5 + a2*b4 + a3*b3 + a4*b2 + a5*b1 + a6*b0;
|
||||
s7 = c7 + a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0;
|
||||
s8 = c8 + a0*b8 + a1*b7 + a2*b6 + a3*b5 + a4*b4 + a5*b3 + a6*b2 + a7*b1 + a8*b0;
|
||||
s9 = c9 + a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0;
|
||||
s10 = c10 + a0*b10 + a1*b9 + a2*b8 + a3*b7 + a4*b6 + a5*b5 + a6*b4 + a7*b3 + a8*b2 + a9*b1 + a10*b0;
|
||||
s11 = c11 + a0*b11 + a1*b10 + a2*b9 + a3*b8 + a4*b7 + a5*b6 + a6*b5 + a7*b4 + a8*b3 + a9*b2 + a10*b1 + a11*b0;
|
||||
s12 = a1*b11 + a2*b10 + a3*b9 + a4*b8 + a5*b7 + a6*b6 + a7*b5 + a8*b4 + a9*b3 + a10*b2 + a11*b1;
|
||||
s13 = a2*b11 + a3*b10 + a4*b9 + a5*b8 + a6*b7 + a7*b6 + a8*b5 + a9*b4 + a10*b3 + a11*b2;
|
||||
s14 = a3*b11 + a4*b10 + a5*b9 + a6*b8 + a7*b7 + a8*b6 + a9*b5 + a10*b4 + a11*b3;
|
||||
s15 = a4*b11 + a5*b10 + a6*b9 + a7*b8 + a8*b7 + a9*b6 + a10*b5 + a11*b4;
|
||||
s16 = a5*b11 + a6*b10 + a7*b9 + a8*b8 + a9*b7 + a10*b6 + a11*b5;
|
||||
s17 = a6*b11 + a7*b10 + a8*b9 + a9*b8 + a10*b7 + a11*b6;
|
||||
s18 = a7*b11 + a8*b10 + a9*b9 + a10*b8 + a11*b7;
|
||||
s19 = a8*b11 + a9*b10 + a10*b9 + a11*b8;
|
||||
s20 = a9*b11 + a10*b10 + a11*b9;
|
||||
s21 = a10*b11 + a11*b10;
|
||||
s22 = a11*b11;
|
||||
s23 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
carry18 = (s18 + (1<<20)) >> 21; s19 += carry18; s18 -= carry18 << 21;
|
||||
carry20 = (s20 + (1<<20)) >> 21; s21 += carry20; s20 -= carry20 << 21;
|
||||
carry22 = (s22 + (1<<20)) >> 21; s23 += carry22; s22 -= carry22 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
carry17 = (s17 + (1<<20)) >> 21; s18 += carry17; s17 -= carry17 << 21;
|
||||
carry19 = (s19 + (1<<20)) >> 21; s20 += carry19; s19 -= carry19 << 21;
|
||||
carry21 = (s21 + (1<<20)) >> 21; s22 += carry21; s21 -= carry21 << 21;
|
||||
|
||||
s11 += s23 * 666643;
|
||||
s12 += s23 * 470296;
|
||||
s13 += s23 * 654183;
|
||||
s14 -= s23 * 997805;
|
||||
s15 += s23 * 136657;
|
||||
s16 -= s23 * 683901;
|
||||
s23 = 0;
|
||||
|
||||
s10 += s22 * 666643;
|
||||
s11 += s22 * 470296;
|
||||
s12 += s22 * 654183;
|
||||
s13 -= s22 * 997805;
|
||||
s14 += s22 * 136657;
|
||||
s15 -= s22 * 683901;
|
||||
s22 = 0;
|
||||
|
||||
s9 += s21 * 666643;
|
||||
s10 += s21 * 470296;
|
||||
s11 += s21 * 654183;
|
||||
s12 -= s21 * 997805;
|
||||
s13 += s21 * 136657;
|
||||
s14 -= s21 * 683901;
|
||||
s21 = 0;
|
||||
|
||||
s8 += s20 * 666643;
|
||||
s9 += s20 * 470296;
|
||||
s10 += s20 * 654183;
|
||||
s11 -= s20 * 997805;
|
||||
s12 += s20 * 136657;
|
||||
s13 -= s20 * 683901;
|
||||
s20 = 0;
|
||||
|
||||
s7 += s19 * 666643;
|
||||
s8 += s19 * 470296;
|
||||
s9 += s19 * 654183;
|
||||
s10 -= s19 * 997805;
|
||||
s11 += s19 * 136657;
|
||||
s12 -= s19 * 683901;
|
||||
s19 = 0;
|
||||
|
||||
s6 += s18 * 666643;
|
||||
s7 += s18 * 470296;
|
||||
s8 += s18 * 654183;
|
||||
s9 -= s18 * 997805;
|
||||
s10 += s18 * 136657;
|
||||
s11 -= s18 * 683901;
|
||||
s18 = 0;
|
||||
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
|
||||
s5 += s17 * 666643;
|
||||
s6 += s17 * 470296;
|
||||
s7 += s17 * 654183;
|
||||
s8 -= s17 * 997805;
|
||||
s9 += s17 * 136657;
|
||||
s10 -= s17 * 683901;
|
||||
s17 = 0;
|
||||
|
||||
s4 += s16 * 666643;
|
||||
s5 += s16 * 470296;
|
||||
s6 += s16 * 654183;
|
||||
s7 -= s16 * 997805;
|
||||
s8 += s16 * 136657;
|
||||
s9 -= s16 * 683901;
|
||||
s16 = 0;
|
||||
|
||||
s3 += s15 * 666643;
|
||||
s4 += s15 * 470296;
|
||||
s5 += s15 * 654183;
|
||||
s6 -= s15 * 997805;
|
||||
s7 += s15 * 136657;
|
||||
s8 -= s15 * 683901;
|
||||
s15 = 0;
|
||||
|
||||
s2 += s14 * 666643;
|
||||
s3 += s14 * 470296;
|
||||
s4 += s14 * 654183;
|
||||
s5 -= s14 * 997805;
|
||||
s6 += s14 * 136657;
|
||||
s7 -= s14 * 683901;
|
||||
s14 = 0;
|
||||
|
||||
s1 += s13 * 666643;
|
||||
s2 += s13 * 470296;
|
||||
s3 += s13 * 654183;
|
||||
s4 -= s13 * 997805;
|
||||
s5 += s13 * 136657;
|
||||
s6 -= s13 * 683901;
|
||||
s13 = 0;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
s[0] = s0 >> 0;
|
||||
s[1] = s0 >> 8;
|
||||
s[2] = (s0 >> 16) | (s1 << 5);
|
||||
s[3] = s1 >> 3;
|
||||
s[4] = s1 >> 11;
|
||||
s[5] = (s1 >> 19) | (s2 << 2);
|
||||
s[6] = s2 >> 6;
|
||||
s[7] = (s2 >> 14) | (s3 << 7);
|
||||
s[8] = s3 >> 1;
|
||||
s[9] = s3 >> 9;
|
||||
s[10] = (s3 >> 17) | (s4 << 4);
|
||||
s[11] = s4 >> 4;
|
||||
s[12] = s4 >> 12;
|
||||
s[13] = (s4 >> 20) | (s5 << 1);
|
||||
s[14] = s5 >> 7;
|
||||
s[15] = (s5 >> 15) | (s6 << 6);
|
||||
s[16] = s6 >> 2;
|
||||
s[17] = s6 >> 10;
|
||||
s[18] = (s6 >> 18) | (s7 << 3);
|
||||
s[19] = s7 >> 5;
|
||||
s[20] = s7 >> 13;
|
||||
s[21] = s8 >> 0;
|
||||
s[22] = s8 >> 8;
|
||||
s[23] = (s8 >> 16) | (s9 << 5);
|
||||
s[24] = s9 >> 3;
|
||||
s[25] = s9 >> 11;
|
||||
s[26] = (s9 >> 19) | (s10 << 2);
|
||||
s[27] = s10 >> 6;
|
||||
s[28] = (s10 >> 14) | (s11 << 7);
|
||||
s[29] = s11 >> 1;
|
||||
s[30] = s11 >> 9;
|
||||
s[31] = s11 >> 17;
|
||||
}
|
||||
|
|
@ -0,0 +1,275 @@
|
|||
#include "sc.h"
|
||||
#include "crypto_int64.h"
|
||||
#include "crypto_uint32.h"
|
||||
#include "crypto_uint64.h"
|
||||
|
||||
static crypto_uint64 load_3(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
return result;
|
||||
}
|
||||
|
||||
static crypto_uint64 load_4(const unsigned char *in)
|
||||
{
|
||||
crypto_uint64 result;
|
||||
result = (crypto_uint64) in[0];
|
||||
result |= ((crypto_uint64) in[1]) << 8;
|
||||
result |= ((crypto_uint64) in[2]) << 16;
|
||||
result |= ((crypto_uint64) in[3]) << 24;
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
Input:
|
||||
s[0]+256*s[1]+...+256^63*s[63] = s
|
||||
|
||||
Output:
|
||||
s[0]+256*s[1]+...+256^31*s[31] = s mod l
|
||||
where l = 2^252 + 27742317777372353535851937790883648493.
|
||||
Overwrites s in place.
|
||||
*/
|
||||
|
||||
void sc_reduce(unsigned char *s)
|
||||
{
|
||||
crypto_int64 s0 = 2097151 & load_3(s);
|
||||
crypto_int64 s1 = 2097151 & (load_4(s + 2) >> 5);
|
||||
crypto_int64 s2 = 2097151 & (load_3(s + 5) >> 2);
|
||||
crypto_int64 s3 = 2097151 & (load_4(s + 7) >> 7);
|
||||
crypto_int64 s4 = 2097151 & (load_4(s + 10) >> 4);
|
||||
crypto_int64 s5 = 2097151 & (load_3(s + 13) >> 1);
|
||||
crypto_int64 s6 = 2097151 & (load_4(s + 15) >> 6);
|
||||
crypto_int64 s7 = 2097151 & (load_3(s + 18) >> 3);
|
||||
crypto_int64 s8 = 2097151 & load_3(s + 21);
|
||||
crypto_int64 s9 = 2097151 & (load_4(s + 23) >> 5);
|
||||
crypto_int64 s10 = 2097151 & (load_3(s + 26) >> 2);
|
||||
crypto_int64 s11 = 2097151 & (load_4(s + 28) >> 7);
|
||||
crypto_int64 s12 = 2097151 & (load_4(s + 31) >> 4);
|
||||
crypto_int64 s13 = 2097151 & (load_3(s + 34) >> 1);
|
||||
crypto_int64 s14 = 2097151 & (load_4(s + 36) >> 6);
|
||||
crypto_int64 s15 = 2097151 & (load_3(s + 39) >> 3);
|
||||
crypto_int64 s16 = 2097151 & load_3(s + 42);
|
||||
crypto_int64 s17 = 2097151 & (load_4(s + 44) >> 5);
|
||||
crypto_int64 s18 = 2097151 & (load_3(s + 47) >> 2);
|
||||
crypto_int64 s19 = 2097151 & (load_4(s + 49) >> 7);
|
||||
crypto_int64 s20 = 2097151 & (load_4(s + 52) >> 4);
|
||||
crypto_int64 s21 = 2097151 & (load_3(s + 55) >> 1);
|
||||
crypto_int64 s22 = 2097151 & (load_4(s + 57) >> 6);
|
||||
crypto_int64 s23 = (load_4(s + 60) >> 3);
|
||||
crypto_int64 carry0;
|
||||
crypto_int64 carry1;
|
||||
crypto_int64 carry2;
|
||||
crypto_int64 carry3;
|
||||
crypto_int64 carry4;
|
||||
crypto_int64 carry5;
|
||||
crypto_int64 carry6;
|
||||
crypto_int64 carry7;
|
||||
crypto_int64 carry8;
|
||||
crypto_int64 carry9;
|
||||
crypto_int64 carry10;
|
||||
crypto_int64 carry11;
|
||||
crypto_int64 carry12;
|
||||
crypto_int64 carry13;
|
||||
crypto_int64 carry14;
|
||||
crypto_int64 carry15;
|
||||
crypto_int64 carry16;
|
||||
|
||||
s11 += s23 * 666643;
|
||||
s12 += s23 * 470296;
|
||||
s13 += s23 * 654183;
|
||||
s14 -= s23 * 997805;
|
||||
s15 += s23 * 136657;
|
||||
s16 -= s23 * 683901;
|
||||
s23 = 0;
|
||||
|
||||
s10 += s22 * 666643;
|
||||
s11 += s22 * 470296;
|
||||
s12 += s22 * 654183;
|
||||
s13 -= s22 * 997805;
|
||||
s14 += s22 * 136657;
|
||||
s15 -= s22 * 683901;
|
||||
s22 = 0;
|
||||
|
||||
s9 += s21 * 666643;
|
||||
s10 += s21 * 470296;
|
||||
s11 += s21 * 654183;
|
||||
s12 -= s21 * 997805;
|
||||
s13 += s21 * 136657;
|
||||
s14 -= s21 * 683901;
|
||||
s21 = 0;
|
||||
|
||||
s8 += s20 * 666643;
|
||||
s9 += s20 * 470296;
|
||||
s10 += s20 * 654183;
|
||||
s11 -= s20 * 997805;
|
||||
s12 += s20 * 136657;
|
||||
s13 -= s20 * 683901;
|
||||
s20 = 0;
|
||||
|
||||
s7 += s19 * 666643;
|
||||
s8 += s19 * 470296;
|
||||
s9 += s19 * 654183;
|
||||
s10 -= s19 * 997805;
|
||||
s11 += s19 * 136657;
|
||||
s12 -= s19 * 683901;
|
||||
s19 = 0;
|
||||
|
||||
s6 += s18 * 666643;
|
||||
s7 += s18 * 470296;
|
||||
s8 += s18 * 654183;
|
||||
s9 -= s18 * 997805;
|
||||
s10 += s18 * 136657;
|
||||
s11 -= s18 * 683901;
|
||||
s18 = 0;
|
||||
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry12 = (s12 + (1<<20)) >> 21; s13 += carry12; s12 -= carry12 << 21;
|
||||
carry14 = (s14 + (1<<20)) >> 21; s15 += carry14; s14 -= carry14 << 21;
|
||||
carry16 = (s16 + (1<<20)) >> 21; s17 += carry16; s16 -= carry16 << 21;
|
||||
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
carry13 = (s13 + (1<<20)) >> 21; s14 += carry13; s13 -= carry13 << 21;
|
||||
carry15 = (s15 + (1<<20)) >> 21; s16 += carry15; s15 -= carry15 << 21;
|
||||
|
||||
s5 += s17 * 666643;
|
||||
s6 += s17 * 470296;
|
||||
s7 += s17 * 654183;
|
||||
s8 -= s17 * 997805;
|
||||
s9 += s17 * 136657;
|
||||
s10 -= s17 * 683901;
|
||||
s17 = 0;
|
||||
|
||||
s4 += s16 * 666643;
|
||||
s5 += s16 * 470296;
|
||||
s6 += s16 * 654183;
|
||||
s7 -= s16 * 997805;
|
||||
s8 += s16 * 136657;
|
||||
s9 -= s16 * 683901;
|
||||
s16 = 0;
|
||||
|
||||
s3 += s15 * 666643;
|
||||
s4 += s15 * 470296;
|
||||
s5 += s15 * 654183;
|
||||
s6 -= s15 * 997805;
|
||||
s7 += s15 * 136657;
|
||||
s8 -= s15 * 683901;
|
||||
s15 = 0;
|
||||
|
||||
s2 += s14 * 666643;
|
||||
s3 += s14 * 470296;
|
||||
s4 += s14 * 654183;
|
||||
s5 -= s14 * 997805;
|
||||
s6 += s14 * 136657;
|
||||
s7 -= s14 * 683901;
|
||||
s14 = 0;
|
||||
|
||||
s1 += s13 * 666643;
|
||||
s2 += s13 * 470296;
|
||||
s3 += s13 * 654183;
|
||||
s4 -= s13 * 997805;
|
||||
s5 += s13 * 136657;
|
||||
s6 -= s13 * 683901;
|
||||
s13 = 0;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = (s0 + (1<<20)) >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry2 = (s2 + (1<<20)) >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry4 = (s4 + (1<<20)) >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry6 = (s6 + (1<<20)) >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry8 = (s8 + (1<<20)) >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry10 = (s10 + (1<<20)) >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
carry1 = (s1 + (1<<20)) >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry3 = (s3 + (1<<20)) >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry5 = (s5 + (1<<20)) >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry7 = (s7 + (1<<20)) >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry9 = (s9 + (1<<20)) >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry11 = (s11 + (1<<20)) >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 << 21;
|
||||
|
||||
s0 += s12 * 666643;
|
||||
s1 += s12 * 470296;
|
||||
s2 += s12 * 654183;
|
||||
s3 -= s12 * 997805;
|
||||
s4 += s12 * 136657;
|
||||
s5 -= s12 * 683901;
|
||||
s12 = 0;
|
||||
|
||||
carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 << 21;
|
||||
carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 << 21;
|
||||
carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 << 21;
|
||||
carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 << 21;
|
||||
carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 << 21;
|
||||
carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 << 21;
|
||||
carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 << 21;
|
||||
carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 << 21;
|
||||
carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 << 21;
|
||||
carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 << 21;
|
||||
carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 << 21;
|
||||
|
||||
s[0] = s0 >> 0;
|
||||
s[1] = s0 >> 8;
|
||||
s[2] = (s0 >> 16) | (s1 << 5);
|
||||
s[3] = s1 >> 3;
|
||||
s[4] = s1 >> 11;
|
||||
s[5] = (s1 >> 19) | (s2 << 2);
|
||||
s[6] = s2 >> 6;
|
||||
s[7] = (s2 >> 14) | (s3 << 7);
|
||||
s[8] = s3 >> 1;
|
||||
s[9] = s3 >> 9;
|
||||
s[10] = (s3 >> 17) | (s4 << 4);
|
||||
s[11] = s4 >> 4;
|
||||
s[12] = s4 >> 12;
|
||||
s[13] = (s4 >> 20) | (s5 << 1);
|
||||
s[14] = s5 >> 7;
|
||||
s[15] = (s5 >> 15) | (s6 << 6);
|
||||
s[16] = s6 >> 2;
|
||||
s[17] = s6 >> 10;
|
||||
s[18] = (s6 >> 18) | (s7 << 3);
|
||||
s[19] = s7 >> 5;
|
||||
s[20] = s7 >> 13;
|
||||
s[21] = s8 >> 0;
|
||||
s[22] = s8 >> 8;
|
||||
s[23] = (s8 >> 16) | (s9 << 5);
|
||||
s[24] = s9 >> 3;
|
||||
s[25] = s9 >> 11;
|
||||
s[26] = (s9 >> 19) | (s10 << 2);
|
||||
s[27] = s10 >> 6;
|
||||
s[28] = (s10 >> 14) | (s11 << 7);
|
||||
s[29] = s11 >> 1;
|
||||
s[30] = s11 >> 9;
|
||||
s[31] = s11 >> 17;
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
#include <string.h>
|
||||
#include "crypto_sign.h"
|
||||
#include "crypto_hash_sha512.h"
|
||||
#include "ge.h"
|
||||
#include "sc.h"
|
||||
|
||||
int crypto_sign(
|
||||
unsigned char *sm,unsigned long long *smlen,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *sk
|
||||
)
|
||||
{
|
||||
unsigned char pk[32];
|
||||
unsigned char az[64];
|
||||
unsigned char nonce[64];
|
||||
unsigned char hram[64];
|
||||
ge_p3 R;
|
||||
|
||||
memmove(pk,sk + 32,32);
|
||||
|
||||
crypto_hash_sha512(az,sk,32);
|
||||
az[0] &= 248;
|
||||
az[31] &= 63;
|
||||
az[31] |= 64;
|
||||
|
||||
*smlen = mlen + 64;
|
||||
memmove(sm + 64,m,mlen);
|
||||
memmove(sm + 32,az + 32,32);
|
||||
crypto_hash_sha512(nonce,sm + 32,mlen + 32);
|
||||
memmove(sm + 32,pk,32);
|
||||
|
||||
sc_reduce(nonce);
|
||||
ge_scalarmult_base(&R,nonce);
|
||||
ge_p3_tobytes(sm,&R);
|
||||
|
||||
crypto_hash_sha512(hram,sm,mlen + 64);
|
||||
sc_reduce(hram);
|
||||
sc_muladd(sm + 32,hram,az,nonce);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
-32595792,-7943725,9377950,3500415,12389472,-272473,-25146209,-2005654,326686,11406482
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,112 @@
|
|||
package textsecure;
|
||||
|
||||
option java_package = "org.whispersystems.libaxolotl.state";
|
||||
option java_outer_classname = "StorageProtos";
|
||||
|
||||
message SessionStructure {
|
||||
message Chain {
|
||||
optional bytes senderRatchetKey = 1;
|
||||
optional bytes senderRatchetKeyPrivate = 2;
|
||||
|
||||
message ChainKey {
|
||||
optional uint32 index = 1;
|
||||
optional bytes key = 2;
|
||||
}
|
||||
|
||||
optional ChainKey chainKey = 3;
|
||||
|
||||
message MessageKey {
|
||||
optional uint32 index = 1;
|
||||
optional bytes cipherKey = 2;
|
||||
optional bytes macKey = 3;
|
||||
optional bytes iv = 4;
|
||||
}
|
||||
|
||||
repeated MessageKey messageKeys = 4;
|
||||
}
|
||||
|
||||
message PendingKeyExchange {
|
||||
optional uint32 sequence = 1;
|
||||
optional bytes localBaseKey = 2;
|
||||
optional bytes localBaseKeyPrivate = 3;
|
||||
optional bytes localRatchetKey = 4;
|
||||
optional bytes localRatchetKeyPrivate = 5;
|
||||
optional bytes localIdentityKey = 7;
|
||||
optional bytes localIdentityKeyPrivate = 8;
|
||||
}
|
||||
|
||||
message PendingPreKey {
|
||||
optional uint32 preKeyId = 1;
|
||||
optional int32 signedPreKeyId = 3;
|
||||
optional bytes baseKey = 2;
|
||||
}
|
||||
|
||||
optional uint32 sessionVersion = 1;
|
||||
optional bytes localIdentityPublic = 2;
|
||||
optional bytes remoteIdentityPublic = 3;
|
||||
|
||||
optional bytes rootKey = 4;
|
||||
optional uint32 previousCounter = 5;
|
||||
|
||||
optional Chain senderChain = 6;
|
||||
repeated Chain receiverChains = 7;
|
||||
|
||||
optional PendingKeyExchange pendingKeyExchange = 8;
|
||||
optional PendingPreKey pendingPreKey = 9;
|
||||
|
||||
optional uint32 remoteRegistrationId = 10;
|
||||
optional uint32 localRegistrationId = 11;
|
||||
|
||||
optional bool needsRefresh = 12;
|
||||
optional bytes aliceBaseKey = 13;
|
||||
}
|
||||
|
||||
message RecordStructure {
|
||||
optional SessionStructure currentSession = 1;
|
||||
repeated SessionStructure previousSessions = 2;
|
||||
}
|
||||
|
||||
message PreKeyRecordStructure {
|
||||
optional uint32 id = 1;
|
||||
optional bytes publicKey = 2;
|
||||
optional bytes privateKey = 3;
|
||||
}
|
||||
|
||||
message SignedPreKeyRecordStructure {
|
||||
optional uint32 id = 1;
|
||||
optional bytes publicKey = 2;
|
||||
optional bytes privateKey = 3;
|
||||
optional bytes signature = 4;
|
||||
optional fixed64 timestamp = 5;
|
||||
}
|
||||
|
||||
message IdentityKeyPairStructure {
|
||||
optional bytes publicKey = 1;
|
||||
optional bytes privateKey = 2;
|
||||
}
|
||||
|
||||
message SenderKeyStateStructure {
|
||||
message SenderChainKey {
|
||||
optional uint32 iteration = 1;
|
||||
optional bytes seed = 2;
|
||||
}
|
||||
|
||||
message SenderMessageKey {
|
||||
optional uint32 iteration = 1;
|
||||
optional bytes seed = 2;
|
||||
}
|
||||
|
||||
message SenderSigningKey {
|
||||
optional bytes public = 1;
|
||||
optional bytes private = 2;
|
||||
}
|
||||
|
||||
optional uint32 senderKeyId = 1;
|
||||
optional SenderChainKey senderChainKey = 2;
|
||||
optional SenderSigningKey senderSigningKey = 3;
|
||||
repeated SenderMessageKey senderMessageKeys = 4;
|
||||
}
|
||||
|
||||
message SenderKeyRecordStructure {
|
||||
repeated SenderKeyStateStructure senderKeyStates = 1;
|
||||
}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
|
||||
all:
|
||||
protoc --java_out=../src/main/java/ WhisperTextProtocol.proto LocalStorageProtocol.proto
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
package textsecure;
|
||||
|
||||
option java_package = "org.whispersystems.libaxolotl.protocol";
|
||||
option java_outer_classname = "WhisperProtos";
|
||||
|
||||
message WhisperMessage {
|
||||
optional bytes ratchetKey = 1;
|
||||
optional uint32 counter = 2;
|
||||
optional uint32 previousCounter = 3;
|
||||
optional bytes ciphertext = 4;
|
||||
}
|
||||
|
||||
message PreKeyWhisperMessage {
|
||||
optional uint32 registrationId = 5;
|
||||
optional uint32 preKeyId = 1;
|
||||
optional uint32 signedPreKeyId = 6;
|
||||
optional bytes baseKey = 2;
|
||||
optional bytes identityKey = 3;
|
||||
optional bytes message = 4; // WhisperMessage
|
||||
}
|
||||
|
||||
message KeyExchangeMessage {
|
||||
optional uint32 id = 1;
|
||||
optional bytes baseKey = 2;
|
||||
optional bytes ratchetKey = 3;
|
||||
optional bytes identityKey = 4;
|
||||
optional bytes baseKeySignature = 5;
|
||||
}
|
||||
|
||||
message SenderKeyMessage {
|
||||
optional uint32 id = 1;
|
||||
optional uint32 iteration = 2;
|
||||
optional bytes ciphertext = 3;
|
||||
}
|
||||
|
||||
message SenderKeyDistributionMessage {
|
||||
optional uint32 id = 1;
|
||||
optional uint32 iteration = 2;
|
||||
optional bytes chainKey = 3;
|
||||
optional bytes signingKey = 4;
|
||||
}
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import org.whispersystems.libaxolotl.IdentityKey;
|
||||
import org.whispersystems.libaxolotl.IdentityKeyPair;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyIdException;
|
||||
import org.whispersystems.libaxolotl.state.AxolotlStore;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.state.SessionRecord;
|
||||
import org.whispersystems.libaxolotl.state.SignedPreKeyRecord;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
public class InMemoryAxolotlStore implements AxolotlStore {
|
||||
|
||||
private final InMemoryIdentityKeyStore identityKeyStore = new InMemoryIdentityKeyStore();
|
||||
private final InMemoryPreKeyStore preKeyStore = new InMemoryPreKeyStore();
|
||||
private final InMemorySessionStore sessionStore = new InMemorySessionStore();
|
||||
private final InMemorySignedPreKeyStore signedPreKeyStore = new InMemorySignedPreKeyStore();
|
||||
|
||||
|
||||
@Override
|
||||
public IdentityKeyPair getIdentityKeyPair() {
|
||||
return identityKeyStore.getIdentityKeyPair();
|
||||
}
|
||||
|
||||
@Override
|
||||
public int getLocalRegistrationId() {
|
||||
return identityKeyStore.getLocalRegistrationId();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void saveIdentity(long recipientId, IdentityKey identityKey) {
|
||||
identityKeyStore.saveIdentity(recipientId, identityKey);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isTrustedIdentity(long recipientId, IdentityKey identityKey) {
|
||||
return identityKeyStore.isTrustedIdentity(recipientId, identityKey);
|
||||
}
|
||||
|
||||
@Override
|
||||
public PreKeyRecord loadPreKey(int preKeyId) throws InvalidKeyIdException {
|
||||
return preKeyStore.loadPreKey(preKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void storePreKey(int preKeyId, PreKeyRecord record) {
|
||||
preKeyStore.storePreKey(preKeyId, record);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean containsPreKey(int preKeyId) {
|
||||
return preKeyStore.containsPreKey(preKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void removePreKey(int preKeyId) {
|
||||
preKeyStore.removePreKey(preKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public SessionRecord loadSession(long recipientId, int deviceId) {
|
||||
return sessionStore.loadSession(recipientId, deviceId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<Integer> getSubDeviceSessions(long recipientId) {
|
||||
return sessionStore.getSubDeviceSessions(recipientId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void storeSession(long recipientId, int deviceId, SessionRecord record) {
|
||||
sessionStore.storeSession(recipientId, deviceId, record);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean containsSession(long recipientId, int deviceId) {
|
||||
return sessionStore.containsSession(recipientId, deviceId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void deleteSession(long recipientId, int deviceId) {
|
||||
sessionStore.deleteSession(recipientId, deviceId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void deleteAllSessions(long recipientId) {
|
||||
sessionStore.deleteAllSessions(recipientId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public SignedPreKeyRecord loadSignedPreKey(int signedPreKeyId) throws InvalidKeyIdException {
|
||||
return signedPreKeyStore.loadSignedPreKey(signedPreKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<SignedPreKeyRecord> loadSignedPreKeys() {
|
||||
return signedPreKeyStore.loadSignedPreKeys();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void storeSignedPreKey(int signedPreKeyId, SignedPreKeyRecord record) {
|
||||
signedPreKeyStore.storeSignedPreKey(signedPreKeyId, record);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean containsSignedPreKey(int signedPreKeyId) {
|
||||
return signedPreKeyStore.containsSignedPreKey(signedPreKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void removeSignedPreKey(int signedPreKeyId) {
|
||||
signedPreKeyStore.removeSignedPreKey(signedPreKeyId);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import org.whispersystems.libaxolotl.IdentityKey;
|
||||
import org.whispersystems.libaxolotl.IdentityKeyPair;
|
||||
import org.whispersystems.libaxolotl.ecc.Curve;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.state.IdentityKeyStore;
|
||||
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.SecureRandom;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
public class InMemoryIdentityKeyStore implements IdentityKeyStore {
|
||||
|
||||
private final Map<Long, IdentityKey> trustedKeys = new HashMap<>();
|
||||
|
||||
private final IdentityKeyPair identityKeyPair;
|
||||
private final int localRegistrationId;
|
||||
|
||||
public InMemoryIdentityKeyStore() {
|
||||
try {
|
||||
ECKeyPair identityKeyPairKeys = Curve.generateKeyPair();
|
||||
|
||||
this.identityKeyPair = new IdentityKeyPair(new IdentityKey(identityKeyPairKeys.getPublicKey()),
|
||||
identityKeyPairKeys.getPrivateKey());
|
||||
this.localRegistrationId = SecureRandom.getInstance("SHA1PRNG").nextInt(16380) + 1;
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public IdentityKeyPair getIdentityKeyPair() {
|
||||
return identityKeyPair;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int getLocalRegistrationId() {
|
||||
return localRegistrationId;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void saveIdentity(long recipientId, IdentityKey identityKey) {
|
||||
trustedKeys.put(recipientId, identityKey);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isTrustedIdentity(long recipientId, IdentityKey identityKey) {
|
||||
IdentityKey trusted = trustedKeys.get(recipientId);
|
||||
return (trusted == null || trusted.equals(identityKey));
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import org.whispersystems.libaxolotl.InvalidKeyIdException;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyStore;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
public class InMemoryPreKeyStore implements PreKeyStore {
|
||||
|
||||
private final Map<Integer, byte[]> store = new HashMap<>();
|
||||
|
||||
@Override
|
||||
public PreKeyRecord loadPreKey(int preKeyId) throws InvalidKeyIdException {
|
||||
try {
|
||||
if (!store.containsKey(preKeyId)) {
|
||||
throw new InvalidKeyIdException("No such prekeyrecord!");
|
||||
}
|
||||
|
||||
return new PreKeyRecord(store.get(preKeyId));
|
||||
} catch (IOException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void storePreKey(int preKeyId, PreKeyRecord record) {
|
||||
store.put(preKeyId, record.serialize());
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean containsPreKey(int preKeyId) {
|
||||
return store.containsKey(preKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void removePreKey(int preKeyId) {
|
||||
store.remove(preKeyId);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import org.whispersystems.libaxolotl.state.SessionRecord;
|
||||
import org.whispersystems.libaxolotl.state.SessionStore;
|
||||
import org.whispersystems.libaxolotl.util.Pair;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.HashMap;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class InMemorySessionStore implements SessionStore {
|
||||
|
||||
private Map<Pair<Long, Integer>, byte[]> sessions = new HashMap<>();
|
||||
|
||||
public InMemorySessionStore() {}
|
||||
|
||||
@Override
|
||||
public synchronized SessionRecord loadSession(long recipientId, int deviceId) {
|
||||
try {
|
||||
if (containsSession(recipientId, deviceId)) {
|
||||
return new SessionRecord(sessions.get(new Pair<>(recipientId, deviceId)));
|
||||
} else {
|
||||
return new SessionRecord();
|
||||
}
|
||||
} catch (IOException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized List<Integer> getSubDeviceSessions(long recipientId) {
|
||||
List<Integer> deviceIds = new LinkedList<>();
|
||||
|
||||
for (Pair<Long, Integer> key : sessions.keySet()) {
|
||||
if (key.first() == recipientId) {
|
||||
deviceIds.add(key.second());
|
||||
}
|
||||
}
|
||||
|
||||
return deviceIds;
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized void storeSession(long recipientId, int deviceId, SessionRecord record) {
|
||||
sessions.put(new Pair<>(recipientId, deviceId), record.serialize());
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized boolean containsSession(long recipientId, int deviceId) {
|
||||
return sessions.containsKey(new Pair<>(recipientId, deviceId));
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized void deleteSession(long recipientId, int deviceId) {
|
||||
sessions.remove(new Pair<>(recipientId, deviceId));
|
||||
}
|
||||
|
||||
@Override
|
||||
public synchronized void deleteAllSessions(long recipientId) {
|
||||
for (Pair<Long, Integer> key : sessions.keySet()) {
|
||||
if (key.first() == recipientId) {
|
||||
sessions.remove(key);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import org.whispersystems.libaxolotl.InvalidKeyIdException;
|
||||
import org.whispersystems.libaxolotl.state.SignedPreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.state.SignedPreKeyStore;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.HashMap;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
public class InMemorySignedPreKeyStore implements SignedPreKeyStore {
|
||||
|
||||
private final Map<Integer, byte[]> store = new HashMap<>();
|
||||
|
||||
@Override
|
||||
public SignedPreKeyRecord loadSignedPreKey(int signedPreKeyId) throws InvalidKeyIdException {
|
||||
try {
|
||||
if (!store.containsKey(signedPreKeyId)) {
|
||||
throw new InvalidKeyIdException("No such signedprekeyrecord! " + signedPreKeyId);
|
||||
}
|
||||
|
||||
return new SignedPreKeyRecord(store.get(signedPreKeyId));
|
||||
} catch (IOException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<SignedPreKeyRecord> loadSignedPreKeys() {
|
||||
try {
|
||||
List<SignedPreKeyRecord> results = new LinkedList<>();
|
||||
|
||||
for (byte[] serialized : store.values()) {
|
||||
results.add(new SignedPreKeyRecord(serialized));
|
||||
}
|
||||
|
||||
return results;
|
||||
} catch (IOException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void storeSignedPreKey(int signedPreKeyId, SignedPreKeyRecord record) {
|
||||
store.put(signedPreKeyId, record.serialize());
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean containsSignedPreKey(int signedPreKeyId) {
|
||||
return store.containsKey(signedPreKeyId);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void removeSignedPreKey(int signedPreKeyId) {
|
||||
store.remove(signedPreKeyId);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,601 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
|
||||
import org.whispersystems.libaxolotl.DuplicateMessageException;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyException;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyIdException;
|
||||
import org.whispersystems.libaxolotl.InvalidMessageException;
|
||||
import org.whispersystems.libaxolotl.InvalidVersionException;
|
||||
import org.whispersystems.libaxolotl.LegacyMessageException;
|
||||
import org.whispersystems.libaxolotl.NoSessionException;
|
||||
import org.whispersystems.libaxolotl.SessionBuilder;
|
||||
import org.whispersystems.libaxolotl.SessionCipher;
|
||||
import org.whispersystems.libaxolotl.StaleKeyExchangeException;
|
||||
import org.whispersystems.libaxolotl.UntrustedIdentityException;
|
||||
import org.whispersystems.libaxolotl.ecc.Curve;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.protocol.CiphertextMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.KeyExchangeMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.PreKeyWhisperMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.WhisperMessage;
|
||||
import org.whispersystems.libaxolotl.state.AxolotlStore;
|
||||
import org.whispersystems.libaxolotl.state.IdentityKeyStore;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyBundle;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.state.SignedPreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.util.Pair;
|
||||
|
||||
import java.util.HashSet;
|
||||
import java.util.Set;
|
||||
|
||||
public class SessionBuilderTest extends AndroidTestCase {
|
||||
|
||||
private static final long ALICE_RECIPIENT_ID = 5L;
|
||||
private static final long BOB_RECIPIENT_ID = 2L;
|
||||
|
||||
public void testBasicPreKeyV2()
|
||||
throws InvalidKeyException, InvalidVersionException, InvalidMessageException, InvalidKeyIdException, DuplicateMessageException, LegacyMessageException, UntrustedIdentityException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
0, null, null,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
assertTrue(aliceStore.containsSession(BOB_RECIPIENT_ID, 1));
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 2);
|
||||
|
||||
String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessage.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(outgoingMessage.serialize());
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
byte[] plaintext = bobSessionCipher.decrypt(incomingMessage);
|
||||
|
||||
assertTrue(bobStore.containsSession(ALICE_RECIPIENT_ID, 1));
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 2);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
CiphertextMessage bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
assertTrue(bobOutgoingMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt((WhisperMessage)bobOutgoingMessage);
|
||||
assertTrue(new String(alicePlaintext).equals(originalMessage));
|
||||
|
||||
runInteraction(aliceStore, bobStore);
|
||||
|
||||
aliceStore = new InMemoryAxolotlStore();
|
||||
aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
bobPreKeyPair = Curve.generateKeyPair();
|
||||
bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(),
|
||||
1, 31338, bobPreKeyPair.getPublicKey(),
|
||||
0, null, null, bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storePreKey(31338, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
outgoingMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
try {
|
||||
bobSessionCipher.decrypt(new PreKeyWhisperMessage(outgoingMessage.serialize()));
|
||||
throw new AssertionError("shouldn't be trusted!");
|
||||
} catch (UntrustedIdentityException uie) {
|
||||
bobStore.saveIdentity(ALICE_RECIPIENT_ID, new PreKeyWhisperMessage(outgoingMessage.serialize()).getIdentityKey());
|
||||
}
|
||||
|
||||
plaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(outgoingMessage.serialize()));
|
||||
|
||||
assertTrue(new String(plaintext).equals(originalMessage));
|
||||
|
||||
bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, Curve.generateKeyPair().getPublicKey(),
|
||||
0, null, null,
|
||||
aliceStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
try {
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
throw new AssertionError("shoulnd't be trusted!");
|
||||
} catch (UntrustedIdentityException uie) {
|
||||
// good
|
||||
}
|
||||
}
|
||||
|
||||
public void testBasicPreKeyV3()
|
||||
throws InvalidKeyException, InvalidVersionException, InvalidMessageException, InvalidKeyIdException, DuplicateMessageException, LegacyMessageException, UntrustedIdentityException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
final AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
22, bobSignedPreKeyPair.getPublicKey(),
|
||||
bobSignedPreKeySignature,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
assertTrue(aliceStore.containsSession(BOB_RECIPIENT_ID, 1));
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
final String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessage.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(outgoingMessage.serialize());
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(22, new SignedPreKeyRecord(22, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
byte[] plaintext = bobSessionCipher.decrypt(incomingMessage, new SessionCipher.DecryptionCallback() {
|
||||
@Override
|
||||
public void handlePlaintext(byte[] plaintext) {
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
assertFalse(bobStore.containsSession(ALICE_RECIPIENT_ID, 1));
|
||||
}
|
||||
});
|
||||
|
||||
assertTrue(bobStore.containsSession(ALICE_RECIPIENT_ID, 1));
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getAliceBaseKey() != null);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
CiphertextMessage bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
assertTrue(bobOutgoingMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobOutgoingMessage.serialize()));
|
||||
assertTrue(new String(alicePlaintext).equals(originalMessage));
|
||||
|
||||
runInteraction(aliceStore, bobStore);
|
||||
|
||||
aliceStore = new InMemoryAxolotlStore();
|
||||
aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
bobPreKeyPair = Curve.generateKeyPair();
|
||||
bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(), bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(),
|
||||
1, 31338, bobPreKeyPair.getPublicKey(),
|
||||
23, bobSignedPreKeyPair.getPublicKey(), bobSignedPreKeySignature,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storePreKey(31338, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(23, new SignedPreKeyRecord(23, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
outgoingMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
try {
|
||||
plaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(outgoingMessage.serialize()));
|
||||
throw new AssertionError("shouldn't be trusted!");
|
||||
} catch (UntrustedIdentityException uie) {
|
||||
bobStore.saveIdentity(ALICE_RECIPIENT_ID, new PreKeyWhisperMessage(outgoingMessage.serialize()).getIdentityKey());
|
||||
}
|
||||
|
||||
plaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(outgoingMessage.serialize()));
|
||||
assertTrue(new String(plaintext).equals(originalMessage));
|
||||
|
||||
bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, Curve.generateKeyPair().getPublicKey(),
|
||||
23, bobSignedPreKeyPair.getPublicKey(), bobSignedPreKeySignature,
|
||||
aliceStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
try {
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
throw new AssertionError("shoulnd't be trusted!");
|
||||
} catch (UntrustedIdentityException uie) {
|
||||
// good
|
||||
}
|
||||
}
|
||||
|
||||
public void testBadSignedPreKeySignature() throws InvalidKeyException, UntrustedIdentityException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
IdentityKeyStore bobIdentityKeyStore = new InMemoryIdentityKeyStore();
|
||||
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobIdentityKeyStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
|
||||
for (int i=0;i<bobSignedPreKeySignature.length * 8;i++) {
|
||||
byte[] modifiedSignature = new byte[bobSignedPreKeySignature.length];
|
||||
System.arraycopy(bobSignedPreKeySignature, 0, modifiedSignature, 0, modifiedSignature.length);
|
||||
|
||||
modifiedSignature[i/8] ^= (0x01 << (i % 8));
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobIdentityKeyStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
22, bobSignedPreKeyPair.getPublicKey(), modifiedSignature,
|
||||
bobIdentityKeyStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
try {
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
throw new AssertionError("Accepted modified device key signature!");
|
||||
} catch (InvalidKeyException ike) {
|
||||
// good
|
||||
}
|
||||
}
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobIdentityKeyStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
22, bobSignedPreKeyPair.getPublicKey(), bobSignedPreKeySignature,
|
||||
bobIdentityKeyStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
}
|
||||
|
||||
public void testRepeatBundleMessageV2() throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException, InvalidMessageException, InvalidKeyIdException, DuplicateMessageException, LegacyMessageException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
0, null, null,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(22, new SignedPreKeyRecord(22, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessageOne = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
CiphertextMessage outgoingMessageTwo = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessageOne.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(outgoingMessageOne.serialize());
|
||||
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
byte[] plaintext = bobSessionCipher.decrypt(incomingMessage);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
CiphertextMessage bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobOutgoingMessage.serialize()));
|
||||
assertTrue(originalMessage.equals(new String(alicePlaintext)));
|
||||
|
||||
// The test
|
||||
|
||||
PreKeyWhisperMessage incomingMessageTwo = new PreKeyWhisperMessage(outgoingMessageTwo.serialize());
|
||||
|
||||
plaintext = bobSessionCipher.decrypt(incomingMessageTwo);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
alicePlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobOutgoingMessage.serialize()));
|
||||
assertTrue(originalMessage.equals(new String(alicePlaintext)));
|
||||
|
||||
}
|
||||
|
||||
public void testRepeatBundleMessageV3() throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException, InvalidMessageException, InvalidKeyIdException, DuplicateMessageException, LegacyMessageException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
22, bobSignedPreKeyPair.getPublicKey(), bobSignedPreKeySignature,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(22, new SignedPreKeyRecord(22, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessageOne = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
CiphertextMessage outgoingMessageTwo = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessageOne.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(outgoingMessageTwo.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(outgoingMessageOne.serialize());
|
||||
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
byte[] plaintext = bobSessionCipher.decrypt(incomingMessage);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
CiphertextMessage bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobOutgoingMessage.serialize()));
|
||||
assertTrue(originalMessage.equals(new String(alicePlaintext)));
|
||||
|
||||
// The test
|
||||
|
||||
PreKeyWhisperMessage incomingMessageTwo = new PreKeyWhisperMessage(outgoingMessageTwo.serialize());
|
||||
|
||||
plaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(incomingMessageTwo.serialize()));
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
|
||||
bobOutgoingMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
alicePlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobOutgoingMessage.serialize()));
|
||||
assertTrue(originalMessage.equals(new String(alicePlaintext)));
|
||||
|
||||
}
|
||||
|
||||
public void testBadMessageBundle() throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException, InvalidMessageException, DuplicateMessageException, LegacyMessageException, InvalidKeyIdException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
31337, bobPreKeyPair.getPublicKey(),
|
||||
22, bobSignedPreKeyPair.getPublicKey(), bobSignedPreKeySignature,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(22, new SignedPreKeyRecord(22, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessageOne = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessageOne.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
byte[] goodMessage = outgoingMessageOne.serialize();
|
||||
byte[] badMessage = new byte[goodMessage.length];
|
||||
System.arraycopy(goodMessage, 0, badMessage, 0, badMessage.length);
|
||||
|
||||
badMessage[badMessage.length-10] ^= 0x01;
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(badMessage);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
byte[] plaintext = new byte[0];
|
||||
|
||||
try {
|
||||
plaintext = bobSessionCipher.decrypt(incomingMessage);
|
||||
throw new AssertionError("Decrypt should have failed!");
|
||||
} catch (InvalidMessageException e) {
|
||||
// good.
|
||||
}
|
||||
|
||||
assertTrue(bobStore.containsPreKey(31337));
|
||||
|
||||
plaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(goodMessage));
|
||||
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
assertTrue(!bobStore.containsPreKey(31337));
|
||||
}
|
||||
|
||||
public void testBasicKeyExchange() throws InvalidKeyException, LegacyMessageException, InvalidMessageException, DuplicateMessageException, UntrustedIdentityException, StaleKeyExchangeException, InvalidVersionException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
KeyExchangeMessage aliceKeyExchangeMessage = aliceSessionBuilder.process();
|
||||
assertTrue(aliceKeyExchangeMessage != null);
|
||||
|
||||
byte[] aliceKeyExchangeMessageBytes = aliceKeyExchangeMessage.serialize();
|
||||
KeyExchangeMessage bobKeyExchangeMessage = bobSessionBuilder.process(new KeyExchangeMessage(aliceKeyExchangeMessageBytes));
|
||||
|
||||
assertTrue(bobKeyExchangeMessage != null);
|
||||
|
||||
byte[] bobKeyExchangeMessageBytes = bobKeyExchangeMessage.serialize();
|
||||
KeyExchangeMessage response = aliceSessionBuilder.process(new KeyExchangeMessage(bobKeyExchangeMessageBytes));
|
||||
|
||||
assertTrue(response == null);
|
||||
assertTrue(aliceStore.containsSession(BOB_RECIPIENT_ID, 1));
|
||||
assertTrue(bobStore.containsSession(ALICE_RECIPIENT_ID, 1));
|
||||
|
||||
runInteraction(aliceStore, bobStore);
|
||||
|
||||
aliceStore = new InMemoryAxolotlStore();
|
||||
aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
aliceKeyExchangeMessage = aliceSessionBuilder.process();
|
||||
|
||||
try {
|
||||
bobKeyExchangeMessage = bobSessionBuilder.process(aliceKeyExchangeMessage);
|
||||
throw new AssertionError("This identity shouldn't be trusted!");
|
||||
} catch (UntrustedIdentityException uie) {
|
||||
bobStore.saveIdentity(ALICE_RECIPIENT_ID, aliceKeyExchangeMessage.getIdentityKey());
|
||||
bobKeyExchangeMessage = bobSessionBuilder.process(aliceKeyExchangeMessage);
|
||||
}
|
||||
|
||||
assertTrue(aliceSessionBuilder.process(bobKeyExchangeMessage) == null);
|
||||
|
||||
runInteraction(aliceStore, bobStore);
|
||||
}
|
||||
|
||||
public void testSimultaneousKeyExchange()
|
||||
throws InvalidKeyException, DuplicateMessageException, LegacyMessageException, InvalidMessageException, UntrustedIdentityException, StaleKeyExchangeException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
KeyExchangeMessage aliceKeyExchange = aliceSessionBuilder.process();
|
||||
KeyExchangeMessage bobKeyExchange = bobSessionBuilder.process();
|
||||
|
||||
assertTrue(aliceKeyExchange != null);
|
||||
assertTrue(bobKeyExchange != null);
|
||||
|
||||
KeyExchangeMessage aliceResponse = aliceSessionBuilder.process(bobKeyExchange);
|
||||
KeyExchangeMessage bobResponse = bobSessionBuilder.process(aliceKeyExchange);
|
||||
|
||||
assertTrue(aliceResponse != null);
|
||||
assertTrue(bobResponse != null);
|
||||
|
||||
KeyExchangeMessage aliceAck = aliceSessionBuilder.process(bobResponse);
|
||||
KeyExchangeMessage bobAck = bobSessionBuilder.process(aliceResponse);
|
||||
|
||||
assertTrue(aliceAck == null);
|
||||
assertTrue(bobAck == null);
|
||||
|
||||
runInteraction(aliceStore, bobStore);
|
||||
}
|
||||
|
||||
public void testOptionalOneTimePreKey() throws Exception {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
ECKeyPair bobPreKeyPair = Curve.generateKeyPair();
|
||||
ECKeyPair bobSignedPreKeyPair = Curve.generateKeyPair();
|
||||
byte[] bobSignedPreKeySignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKeyPair.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKey = new PreKeyBundle(bobStore.getLocalRegistrationId(), 1,
|
||||
0, null,
|
||||
22, bobSignedPreKeyPair.getPublicKey(),
|
||||
bobSignedPreKeySignature,
|
||||
bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
aliceSessionBuilder.process(bobPreKey);
|
||||
|
||||
assertTrue(aliceStore.containsSession(BOB_RECIPIENT_ID, 1));
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
String originalMessage = "L'homme est condamné à être libre";
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
CiphertextMessage outgoingMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(outgoingMessage.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
PreKeyWhisperMessage incomingMessage = new PreKeyWhisperMessage(outgoingMessage.serialize());
|
||||
assertTrue(!incomingMessage.getPreKeyId().isPresent());
|
||||
|
||||
bobStore.storePreKey(31337, new PreKeyRecord(bobPreKey.getPreKeyId(), bobPreKeyPair));
|
||||
bobStore.storeSignedPreKey(22, new SignedPreKeyRecord(22, System.currentTimeMillis(), bobSignedPreKeyPair, bobSignedPreKeySignature));
|
||||
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
byte[] plaintext = bobSessionCipher.decrypt(incomingMessage);
|
||||
|
||||
assertTrue(bobStore.containsSession(ALICE_RECIPIENT_ID, 1));
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getAliceBaseKey() != null);
|
||||
assertTrue(originalMessage.equals(new String(plaintext)));
|
||||
}
|
||||
|
||||
|
||||
private void runInteraction(AxolotlStore aliceStore, AxolotlStore bobStore)
|
||||
throws DuplicateMessageException, LegacyMessageException, InvalidMessageException, NoSessionException
|
||||
{
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPIENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
String originalMessage = "smert ze smert";
|
||||
CiphertextMessage aliceMessage = aliceSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(aliceMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] plaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceMessage.serialize()));
|
||||
assertTrue(new String(plaintext).equals(originalMessage));
|
||||
|
||||
CiphertextMessage bobMessage = bobSessionCipher.encrypt(originalMessage.getBytes());
|
||||
|
||||
assertTrue(bobMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
plaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobMessage.serialize()));
|
||||
assertTrue(new String(plaintext).equals(originalMessage));
|
||||
|
||||
for (int i=0;i<10;i++) {
|
||||
String loopingMessage = ("What do we mean by saying that existence precedes essence? " +
|
||||
"We mean that man first of all exists, encounters himself, " +
|
||||
"surges up in the world--and defines himself aftward. " + i);
|
||||
CiphertextMessage aliceLoopingMessage = aliceSessionCipher.encrypt(loopingMessage.getBytes());
|
||||
|
||||
byte[] loopingPlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceLoopingMessage.serialize()));
|
||||
assertTrue(new String(loopingPlaintext).equals(loopingMessage));
|
||||
}
|
||||
|
||||
for (int i=0;i<10;i++) {
|
||||
String loopingMessage = ("What do we mean by saying that existence precedes essence? " +
|
||||
"We mean that man first of all exists, encounters himself, " +
|
||||
"surges up in the world--and defines himself aftward. " + i);
|
||||
CiphertextMessage bobLoopingMessage = bobSessionCipher.encrypt(loopingMessage.getBytes());
|
||||
|
||||
byte[] loopingPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobLoopingMessage.serialize()));
|
||||
assertTrue(new String(loopingPlaintext).equals(loopingMessage));
|
||||
}
|
||||
|
||||
Set<Pair<String, CiphertextMessage>> aliceOutOfOrderMessages = new HashSet<>();
|
||||
|
||||
for (int i=0;i<10;i++) {
|
||||
String loopingMessage = ("What do we mean by saying that existence precedes essence? " +
|
||||
"We mean that man first of all exists, encounters himself, " +
|
||||
"surges up in the world--and defines himself aftward. " + i);
|
||||
CiphertextMessage aliceLoopingMessage = aliceSessionCipher.encrypt(loopingMessage.getBytes());
|
||||
|
||||
aliceOutOfOrderMessages.add(new Pair<>(loopingMessage, aliceLoopingMessage));
|
||||
}
|
||||
|
||||
for (int i=0;i<10;i++) {
|
||||
String loopingMessage = ("What do we mean by saying that existence precedes essence? " +
|
||||
"We mean that man first of all exists, encounters himself, " +
|
||||
"surges up in the world--and defines himself aftward. " + i);
|
||||
CiphertextMessage aliceLoopingMessage = aliceSessionCipher.encrypt(loopingMessage.getBytes());
|
||||
|
||||
byte[] loopingPlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceLoopingMessage.serialize()));
|
||||
assertTrue(new String(loopingPlaintext).equals(loopingMessage));
|
||||
}
|
||||
|
||||
for (int i=0;i<10;i++) {
|
||||
String loopingMessage = ("You can only desire based on what you know: " + i);
|
||||
CiphertextMessage bobLoopingMessage = bobSessionCipher.encrypt(loopingMessage.getBytes());
|
||||
|
||||
byte[] loopingPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(bobLoopingMessage.serialize()));
|
||||
assertTrue(new String(loopingPlaintext).equals(loopingMessage));
|
||||
}
|
||||
|
||||
for (Pair<String, CiphertextMessage> aliceOutOfOrderMessage : aliceOutOfOrderMessages) {
|
||||
byte[] outOfOrderPlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceOutOfOrderMessage.second().serialize()));
|
||||
assertTrue(new String(outOfOrderPlaintext).equals(aliceOutOfOrderMessage.first()));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,206 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
|
||||
import org.whispersystems.libaxolotl.DuplicateMessageException;
|
||||
import org.whispersystems.libaxolotl.IdentityKey;
|
||||
import org.whispersystems.libaxolotl.IdentityKeyPair;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyException;
|
||||
import org.whispersystems.libaxolotl.InvalidMessageException;
|
||||
import org.whispersystems.libaxolotl.LegacyMessageException;
|
||||
import org.whispersystems.libaxolotl.NoSessionException;
|
||||
import org.whispersystems.libaxolotl.SessionCipher;
|
||||
import org.whispersystems.libaxolotl.ecc.Curve;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.ecc.ECPublicKey;
|
||||
import org.whispersystems.libaxolotl.protocol.CiphertextMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.WhisperMessage;
|
||||
import org.whispersystems.libaxolotl.ratchet.AliceAxolotlParameters;
|
||||
import org.whispersystems.libaxolotl.ratchet.BobAxolotlParameters;
|
||||
import org.whispersystems.libaxolotl.ratchet.RatchetingSession;
|
||||
import org.whispersystems.libaxolotl.state.AxolotlStore;
|
||||
import org.whispersystems.libaxolotl.state.SessionRecord;
|
||||
import org.whispersystems.libaxolotl.state.SessionState;
|
||||
import org.whispersystems.libaxolotl.util.guava.Optional;
|
||||
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Random;
|
||||
|
||||
|
||||
public class SessionCipherTest extends AndroidTestCase {
|
||||
|
||||
public void testBasicSessionV2()
|
||||
throws InvalidKeyException, DuplicateMessageException,
|
||||
LegacyMessageException, InvalidMessageException, NoSuchAlgorithmException, NoSessionException
|
||||
{
|
||||
SessionRecord aliceSessionRecord = new SessionRecord();
|
||||
SessionRecord bobSessionRecord = new SessionRecord();
|
||||
|
||||
initializeSessionsV2(aliceSessionRecord.getSessionState(), bobSessionRecord.getSessionState());
|
||||
runInteraction(aliceSessionRecord, bobSessionRecord);
|
||||
}
|
||||
|
||||
public void testBasicSessionV3()
|
||||
throws InvalidKeyException, DuplicateMessageException,
|
||||
LegacyMessageException, InvalidMessageException, NoSuchAlgorithmException, NoSessionException
|
||||
{
|
||||
SessionRecord aliceSessionRecord = new SessionRecord();
|
||||
SessionRecord bobSessionRecord = new SessionRecord();
|
||||
|
||||
initializeSessionsV3(aliceSessionRecord.getSessionState(), bobSessionRecord.getSessionState());
|
||||
runInteraction(aliceSessionRecord, bobSessionRecord);
|
||||
}
|
||||
|
||||
private void runInteraction(SessionRecord aliceSessionRecord, SessionRecord bobSessionRecord)
|
||||
throws DuplicateMessageException, LegacyMessageException, InvalidMessageException, NoSuchAlgorithmException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
aliceStore.storeSession(2L, 1, aliceSessionRecord);
|
||||
bobStore.storeSession(3L, 1, bobSessionRecord);
|
||||
|
||||
SessionCipher aliceCipher = new SessionCipher(aliceStore, 2L, 1);
|
||||
SessionCipher bobCipher = new SessionCipher(bobStore, 3L, 1);
|
||||
|
||||
byte[] alicePlaintext = "This is a plaintext message.".getBytes();
|
||||
CiphertextMessage message = aliceCipher.encrypt(alicePlaintext);
|
||||
byte[] bobPlaintext = bobCipher.decrypt(new WhisperMessage(message.serialize()));
|
||||
|
||||
assertTrue(Arrays.equals(alicePlaintext, bobPlaintext));
|
||||
|
||||
byte[] bobReply = "This is a message from Bob.".getBytes();
|
||||
CiphertextMessage reply = bobCipher.encrypt(bobReply);
|
||||
byte[] receivedReply = aliceCipher.decrypt(new WhisperMessage(reply.serialize()));
|
||||
|
||||
assertTrue(Arrays.equals(bobReply, receivedReply));
|
||||
|
||||
List<CiphertextMessage> aliceCiphertextMessages = new ArrayList<>();
|
||||
List<byte[]> alicePlaintextMessages = new ArrayList<>();
|
||||
|
||||
for (int i=0;i<50;i++) {
|
||||
alicePlaintextMessages.add(("смерть за смерть " + i).getBytes());
|
||||
aliceCiphertextMessages.add(aliceCipher.encrypt(("смерть за смерть " + i).getBytes()));
|
||||
}
|
||||
|
||||
long seed = System.currentTimeMillis();
|
||||
|
||||
Collections.shuffle(aliceCiphertextMessages, new Random(seed));
|
||||
Collections.shuffle(alicePlaintextMessages, new Random(seed));
|
||||
|
||||
for (int i=0;i<aliceCiphertextMessages.size() / 2;i++) {
|
||||
byte[] receivedPlaintext = bobCipher.decrypt(new WhisperMessage(aliceCiphertextMessages.get(i).serialize()));
|
||||
assertTrue(Arrays.equals(receivedPlaintext, alicePlaintextMessages.get(i)));
|
||||
}
|
||||
|
||||
List<CiphertextMessage> bobCiphertextMessages = new ArrayList<>();
|
||||
List<byte[]> bobPlaintextMessages = new ArrayList<>();
|
||||
|
||||
for (int i=0;i<20;i++) {
|
||||
bobPlaintextMessages.add(("смерть за смерть " + i).getBytes());
|
||||
bobCiphertextMessages.add(bobCipher.encrypt(("смерть за смерть " + i).getBytes()));
|
||||
}
|
||||
|
||||
seed = System.currentTimeMillis();
|
||||
|
||||
Collections.shuffle(bobCiphertextMessages, new Random(seed));
|
||||
Collections.shuffle(bobPlaintextMessages, new Random(seed));
|
||||
|
||||
for (int i=0;i<bobCiphertextMessages.size() / 2;i++) {
|
||||
byte[] receivedPlaintext = aliceCipher.decrypt(new WhisperMessage(bobCiphertextMessages.get(i).serialize()));
|
||||
assertTrue(Arrays.equals(receivedPlaintext, bobPlaintextMessages.get(i)));
|
||||
}
|
||||
|
||||
for (int i=aliceCiphertextMessages.size()/2;i<aliceCiphertextMessages.size();i++) {
|
||||
byte[] receivedPlaintext = bobCipher.decrypt(new WhisperMessage(aliceCiphertextMessages.get(i).serialize()));
|
||||
assertTrue(Arrays.equals(receivedPlaintext, alicePlaintextMessages.get(i)));
|
||||
}
|
||||
|
||||
for (int i=bobCiphertextMessages.size() / 2;i<bobCiphertextMessages.size();i++) {
|
||||
byte[] receivedPlaintext = aliceCipher.decrypt(new WhisperMessage(bobCiphertextMessages.get(i).serialize()));
|
||||
assertTrue(Arrays.equals(receivedPlaintext, bobPlaintextMessages.get(i)));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
private void initializeSessionsV2(SessionState aliceSessionState, SessionState bobSessionState)
|
||||
throws InvalidKeyException
|
||||
{
|
||||
ECKeyPair aliceIdentityKeyPair = Curve.generateKeyPair();
|
||||
IdentityKeyPair aliceIdentityKey = new IdentityKeyPair(new IdentityKey(aliceIdentityKeyPair.getPublicKey()),
|
||||
aliceIdentityKeyPair.getPrivateKey());
|
||||
ECKeyPair aliceBaseKey = Curve.generateKeyPair();
|
||||
ECKeyPair aliceEphemeralKey = Curve.generateKeyPair();
|
||||
|
||||
ECKeyPair bobIdentityKeyPair = Curve.generateKeyPair();
|
||||
IdentityKeyPair bobIdentityKey = new IdentityKeyPair(new IdentityKey(bobIdentityKeyPair.getPublicKey()),
|
||||
bobIdentityKeyPair.getPrivateKey());
|
||||
ECKeyPair bobBaseKey = Curve.generateKeyPair();
|
||||
ECKeyPair bobEphemeralKey = bobBaseKey;
|
||||
|
||||
AliceAxolotlParameters aliceParameters = AliceAxolotlParameters.newBuilder()
|
||||
.setOurIdentityKey(aliceIdentityKey)
|
||||
.setOurBaseKey(aliceBaseKey)
|
||||
.setTheirIdentityKey(bobIdentityKey.getPublicKey())
|
||||
.setTheirSignedPreKey(bobEphemeralKey.getPublicKey())
|
||||
.setTheirRatchetKey(bobEphemeralKey.getPublicKey())
|
||||
.setTheirOneTimePreKey(Optional.<ECPublicKey>absent())
|
||||
.create();
|
||||
|
||||
BobAxolotlParameters bobParameters = BobAxolotlParameters.newBuilder()
|
||||
.setOurIdentityKey(bobIdentityKey)
|
||||
.setOurOneTimePreKey(Optional.<ECKeyPair>absent())
|
||||
.setOurRatchetKey(bobEphemeralKey)
|
||||
.setOurSignedPreKey(bobBaseKey)
|
||||
.setTheirBaseKey(aliceBaseKey.getPublicKey())
|
||||
.setTheirIdentityKey(aliceIdentityKey.getPublicKey())
|
||||
.create();
|
||||
|
||||
RatchetingSession.initializeSession(aliceSessionState, 2, aliceParameters);
|
||||
RatchetingSession.initializeSession(bobSessionState, 2, bobParameters);
|
||||
}
|
||||
|
||||
private void initializeSessionsV3(SessionState aliceSessionState, SessionState bobSessionState)
|
||||
throws InvalidKeyException
|
||||
{
|
||||
ECKeyPair aliceIdentityKeyPair = Curve.generateKeyPair();
|
||||
IdentityKeyPair aliceIdentityKey = new IdentityKeyPair(new IdentityKey(aliceIdentityKeyPair.getPublicKey()),
|
||||
aliceIdentityKeyPair.getPrivateKey());
|
||||
ECKeyPair aliceBaseKey = Curve.generateKeyPair();
|
||||
ECKeyPair aliceEphemeralKey = Curve.generateKeyPair();
|
||||
|
||||
ECKeyPair alicePreKey = aliceBaseKey;
|
||||
|
||||
ECKeyPair bobIdentityKeyPair = Curve.generateKeyPair();
|
||||
IdentityKeyPair bobIdentityKey = new IdentityKeyPair(new IdentityKey(bobIdentityKeyPair.getPublicKey()),
|
||||
bobIdentityKeyPair.getPrivateKey());
|
||||
ECKeyPair bobBaseKey = Curve.generateKeyPair();
|
||||
ECKeyPair bobEphemeralKey = bobBaseKey;
|
||||
|
||||
ECKeyPair bobPreKey = Curve.generateKeyPair();
|
||||
|
||||
AliceAxolotlParameters aliceParameters = AliceAxolotlParameters.newBuilder()
|
||||
.setOurBaseKey(aliceBaseKey)
|
||||
.setOurIdentityKey(aliceIdentityKey)
|
||||
.setTheirOneTimePreKey(Optional.<ECPublicKey>absent())
|
||||
.setTheirRatchetKey(bobEphemeralKey.getPublicKey())
|
||||
.setTheirSignedPreKey(bobBaseKey.getPublicKey())
|
||||
.setTheirIdentityKey(bobIdentityKey.getPublicKey())
|
||||
.create();
|
||||
|
||||
BobAxolotlParameters bobParameters = BobAxolotlParameters.newBuilder()
|
||||
.setOurRatchetKey(bobEphemeralKey)
|
||||
.setOurSignedPreKey(bobBaseKey)
|
||||
.setOurOneTimePreKey(Optional.<ECKeyPair>absent())
|
||||
.setOurIdentityKey(bobIdentityKey)
|
||||
.setTheirIdentityKey(aliceIdentityKey.getPublicKey())
|
||||
.setTheirBaseKey(aliceBaseKey.getPublicKey())
|
||||
.create();
|
||||
|
||||
RatchetingSession.initializeSession(aliceSessionState, 3, aliceParameters);
|
||||
RatchetingSession.initializeSession(bobSessionState, 3, bobParameters);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,501 @@
|
|||
package org.whispersystems.test;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
import android.util.Log;
|
||||
|
||||
import org.whispersystems.libaxolotl.DuplicateMessageException;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyException;
|
||||
import org.whispersystems.libaxolotl.InvalidKeyIdException;
|
||||
import org.whispersystems.libaxolotl.InvalidMessageException;
|
||||
import org.whispersystems.libaxolotl.InvalidVersionException;
|
||||
import org.whispersystems.libaxolotl.LegacyMessageException;
|
||||
import org.whispersystems.libaxolotl.NoSessionException;
|
||||
import org.whispersystems.libaxolotl.SessionBuilder;
|
||||
import org.whispersystems.libaxolotl.SessionCipher;
|
||||
import org.whispersystems.libaxolotl.UntrustedIdentityException;
|
||||
import org.whispersystems.libaxolotl.ecc.Curve;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.protocol.CiphertextMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.PreKeyWhisperMessage;
|
||||
import org.whispersystems.libaxolotl.protocol.WhisperMessage;
|
||||
import org.whispersystems.libaxolotl.state.AxolotlStore;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyBundle;
|
||||
import org.whispersystems.libaxolotl.state.PreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.state.SignedPreKeyRecord;
|
||||
import org.whispersystems.libaxolotl.util.Medium;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Random;
|
||||
|
||||
public class SimultaneousInitiateTests extends AndroidTestCase {
|
||||
|
||||
private static final long BOB_RECIPENT_ID = 12345;
|
||||
private static final long ALICE_RECIPIENT_ID = 6789;
|
||||
|
||||
private static final ECKeyPair aliceSignedPreKey = Curve.generateKeyPair();
|
||||
private static final ECKeyPair bobSignedPreKey = Curve.generateKeyPair();
|
||||
|
||||
private static final int aliceSignedPreKeyId = new Random().nextInt(Medium.MAX_VALUE);
|
||||
private static final int bobSignedPreKeyId = new Random().nextInt(Medium.MAX_VALUE);
|
||||
|
||||
public void testBasicSimultaneousInitiate()
|
||||
throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException,
|
||||
InvalidMessageException, DuplicateMessageException, LegacyMessageException,
|
||||
InvalidKeyIdException, NoSessionException
|
||||
{
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new PreKeyWhisperMessage(messageForAlice.serialize()));
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintext).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] responsePlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceResponse.serialize()));
|
||||
|
||||
assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
public void testLostSimultaneousInitiate() throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException, InvalidMessageException, DuplicateMessageException, LegacyMessageException, InvalidKeyIdException, NoSessionException {
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
byte[] responsePlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(aliceResponse.serialize()));
|
||||
|
||||
assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
public void testSimultaneousInitiateLostMessage()
|
||||
throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException,
|
||||
InvalidMessageException, DuplicateMessageException, LegacyMessageException,
|
||||
InvalidKeyIdException, NoSessionException
|
||||
{
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new PreKeyWhisperMessage(messageForAlice.serialize()));
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintext).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
// byte[] responsePlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceResponse.serialize()));
|
||||
//
|
||||
// assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
// assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
public void testSimultaneousInitiateRepeatedMessages()
|
||||
throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException,
|
||||
InvalidMessageException, DuplicateMessageException, LegacyMessageException,
|
||||
InvalidKeyIdException, NoSessionException
|
||||
{
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new PreKeyWhisperMessage(messageForAlice.serialize()));
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintext).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
for (int i=0;i<50;i++) {
|
||||
Log.w("SimultaneousInitiateTests", "Iteration: " + i);
|
||||
CiphertextMessage messageForBobRepeat = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAliceRepeat = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBobRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
assertTrue(messageForAliceRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintextRepeat = aliceSessionCipher.decrypt(new WhisperMessage(messageForAliceRepeat.serialize()));
|
||||
byte[] bobPlaintextRepeat = bobSessionCipher.decrypt(new WhisperMessage(messageForBobRepeat.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintextRepeat).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintextRepeat).equals("hey there"));
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] responsePlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceResponse.serialize()));
|
||||
|
||||
assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
public void testRepeatedSimultaneousInitiateRepeatedMessages()
|
||||
throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException,
|
||||
InvalidMessageException, DuplicateMessageException, LegacyMessageException,
|
||||
InvalidKeyIdException, NoSessionException
|
||||
{
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
for (int i=0;i<15;i++) {
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new PreKeyWhisperMessage(messageForAlice.serialize()));
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintext).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
for (int i=0;i<50;i++) {
|
||||
Log.w("SimultaneousInitiateTests", "Iteration: " + i);
|
||||
CiphertextMessage messageForBobRepeat = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAliceRepeat = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBobRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
assertTrue(messageForAliceRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintextRepeat = aliceSessionCipher.decrypt(new WhisperMessage(messageForAliceRepeat.serialize()));
|
||||
byte[] bobPlaintextRepeat = bobSessionCipher.decrypt(new WhisperMessage(messageForBobRepeat.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintextRepeat).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintextRepeat).equals("hey there"));
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] responsePlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceResponse.serialize()));
|
||||
|
||||
assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
public void testRepeatedSimultaneousInitiateLostMessageRepeatedMessages()
|
||||
throws InvalidKeyException, UntrustedIdentityException, InvalidVersionException,
|
||||
InvalidMessageException, DuplicateMessageException, LegacyMessageException,
|
||||
InvalidKeyIdException, NoSessionException
|
||||
{
|
||||
AxolotlStore aliceStore = new InMemoryAxolotlStore();
|
||||
AxolotlStore bobStore = new InMemoryAxolotlStore();
|
||||
|
||||
|
||||
SessionBuilder aliceSessionBuilder = new SessionBuilder(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionBuilder bobSessionBuilder = new SessionBuilder(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
SessionCipher aliceSessionCipher = new SessionCipher(aliceStore, BOB_RECIPENT_ID, 1);
|
||||
SessionCipher bobSessionCipher = new SessionCipher(bobStore, ALICE_RECIPIENT_ID, 1);
|
||||
|
||||
// PreKeyBundle aliceLostPreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobLostPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
aliceSessionBuilder.process(bobLostPreKeyBundle);
|
||||
// bobSessionBuilder.process(aliceLostPreKeyBundle);
|
||||
|
||||
CiphertextMessage lostMessageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
// CiphertextMessage lostMessageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
for (int i=0;i<15;i++) {
|
||||
PreKeyBundle alicePreKeyBundle = createAlicePreKeyBundle(aliceStore);
|
||||
PreKeyBundle bobPreKeyBundle = createBobPreKeyBundle(bobStore);
|
||||
|
||||
aliceSessionBuilder.process(bobPreKeyBundle);
|
||||
bobSessionBuilder.process(alicePreKeyBundle);
|
||||
|
||||
CiphertextMessage messageForBob = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAlice = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBob.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
assertTrue(messageForAlice.getType() == CiphertextMessage.PREKEY_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintext = aliceSessionCipher.decrypt(new PreKeyWhisperMessage(messageForAlice.serialize()));
|
||||
byte[] bobPlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(messageForBob.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintext).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintext).equals("hey there"));
|
||||
|
||||
assertTrue(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
assertTrue(bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getSessionVersion() == 3);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
for (int i=0;i<50;i++) {
|
||||
Log.w("SimultaneousInitiateTests", "Iteration: " + i);
|
||||
CiphertextMessage messageForBobRepeat = aliceSessionCipher.encrypt("hey there".getBytes());
|
||||
CiphertextMessage messageForAliceRepeat = bobSessionCipher.encrypt("sample message".getBytes());
|
||||
|
||||
assertTrue(messageForBobRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
assertTrue(messageForAliceRepeat.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] alicePlaintextRepeat = aliceSessionCipher.decrypt(new WhisperMessage(messageForAliceRepeat.serialize()));
|
||||
byte[] bobPlaintextRepeat = bobSessionCipher.decrypt(new WhisperMessage(messageForBobRepeat.serialize()));
|
||||
|
||||
assertTrue(new String(alicePlaintextRepeat).equals("sample message"));
|
||||
assertTrue(new String(bobPlaintextRepeat).equals("hey there"));
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
CiphertextMessage aliceResponse = aliceSessionCipher.encrypt("second message".getBytes());
|
||||
|
||||
assertTrue(aliceResponse.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] responsePlaintext = bobSessionCipher.decrypt(new WhisperMessage(aliceResponse.serialize()));
|
||||
|
||||
assertTrue(new String(responsePlaintext).equals("second message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage finalMessage = bobSessionCipher.encrypt("third message".getBytes());
|
||||
|
||||
assertTrue(finalMessage.getType() == CiphertextMessage.WHISPER_TYPE);
|
||||
|
||||
byte[] finalPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(finalMessage.serialize()));
|
||||
|
||||
assertTrue(new String(finalPlaintext).equals("third message"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
byte[] lostMessagePlaintext = bobSessionCipher.decrypt(new PreKeyWhisperMessage(lostMessageForBob.serialize()));
|
||||
assertTrue(new String(lostMessagePlaintext).equals("hey there"));
|
||||
|
||||
assertFalse(isSessionIdEqual(aliceStore, bobStore));
|
||||
|
||||
CiphertextMessage blastFromThePast = bobSessionCipher.encrypt("unexpected!".getBytes());
|
||||
byte[] blastFromThePastPlaintext = aliceSessionCipher.decrypt(new WhisperMessage(blastFromThePast.serialize()));
|
||||
|
||||
assertTrue(new String(blastFromThePastPlaintext).equals("unexpected!"));
|
||||
assertTrue(isSessionIdEqual(aliceStore, bobStore));
|
||||
}
|
||||
|
||||
private boolean isSessionIdEqual(AxolotlStore aliceStore, AxolotlStore bobStore) {
|
||||
return Arrays.equals(aliceStore.loadSession(BOB_RECIPENT_ID, 1).getSessionState().getAliceBaseKey(),
|
||||
bobStore.loadSession(ALICE_RECIPIENT_ID, 1).getSessionState().getAliceBaseKey());
|
||||
}
|
||||
|
||||
private PreKeyBundle createAlicePreKeyBundle(AxolotlStore aliceStore) throws InvalidKeyException {
|
||||
ECKeyPair aliceUnsignedPreKey = Curve.generateKeyPair();
|
||||
int aliceUnsignedPreKeyId = new Random().nextInt(Medium.MAX_VALUE);
|
||||
byte[] aliceSignature = Curve.calculateSignature(aliceStore.getIdentityKeyPair().getPrivateKey(),
|
||||
aliceSignedPreKey.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle alicePreKeyBundle = new PreKeyBundle(1, 1,
|
||||
aliceUnsignedPreKeyId, aliceUnsignedPreKey.getPublicKey(),
|
||||
aliceSignedPreKeyId, aliceSignedPreKey.getPublicKey(),
|
||||
aliceSignature, aliceStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
aliceStore.storeSignedPreKey(aliceSignedPreKeyId, new SignedPreKeyRecord(aliceSignedPreKeyId, System.currentTimeMillis(), aliceSignedPreKey, aliceSignature));
|
||||
aliceStore.storePreKey(aliceUnsignedPreKeyId, new PreKeyRecord(aliceUnsignedPreKeyId, aliceUnsignedPreKey));
|
||||
|
||||
return alicePreKeyBundle;
|
||||
}
|
||||
|
||||
private PreKeyBundle createBobPreKeyBundle(AxolotlStore bobStore) throws InvalidKeyException {
|
||||
ECKeyPair bobUnsignedPreKey = Curve.generateKeyPair();
|
||||
int bobUnsignedPreKeyId = new Random().nextInt(Medium.MAX_VALUE);
|
||||
byte[] bobSignature = Curve.calculateSignature(bobStore.getIdentityKeyPair().getPrivateKey(),
|
||||
bobSignedPreKey.getPublicKey().serialize());
|
||||
|
||||
PreKeyBundle bobPreKeyBundle = new PreKeyBundle(1, 1,
|
||||
bobUnsignedPreKeyId, bobUnsignedPreKey.getPublicKey(),
|
||||
bobSignedPreKeyId, bobSignedPreKey.getPublicKey(),
|
||||
bobSignature, bobStore.getIdentityKeyPair().getPublicKey());
|
||||
|
||||
bobStore.storeSignedPreKey(bobSignedPreKeyId, new SignedPreKeyRecord(bobSignedPreKeyId, System.currentTimeMillis(), bobSignedPreKey, bobSignature));
|
||||
bobStore.storePreKey(bobUnsignedPreKeyId, new PreKeyRecord(bobUnsignedPreKeyId, bobUnsignedPreKey));
|
||||
|
||||
return bobPreKeyBundle;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
package org.whispersystems.test.ecc;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
|
||||
import org.whispersystems.libaxolotl.InvalidKeyException;
|
||||
import org.whispersystems.libaxolotl.ecc.Curve;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.ecc.ECPrivateKey;
|
||||
import org.whispersystems.libaxolotl.ecc.ECPublicKey;
|
||||
|
||||
import java.util.Arrays;
|
||||
|
||||
|
||||
public class Curve25519Test extends AndroidTestCase {
|
||||
|
||||
public void testAgreement() throws InvalidKeyException {
|
||||
|
||||
byte[] alicePublic = {(byte) 0x05, (byte) 0x1b, (byte) 0xb7, (byte) 0x59, (byte) 0x66,
|
||||
(byte) 0xf2, (byte) 0xe9, (byte) 0x3a, (byte) 0x36, (byte) 0x91,
|
||||
(byte) 0xdf, (byte) 0xff, (byte) 0x94, (byte) 0x2b, (byte) 0xb2,
|
||||
(byte) 0xa4, (byte) 0x66, (byte) 0xa1, (byte) 0xc0, (byte) 0x8b,
|
||||
(byte) 0x8d, (byte) 0x78, (byte) 0xca, (byte) 0x3f, (byte) 0x4d,
|
||||
(byte) 0x6d, (byte) 0xf8, (byte) 0xb8, (byte) 0xbf, (byte) 0xa2,
|
||||
(byte) 0xe4, (byte) 0xee, (byte) 0x28};
|
||||
|
||||
byte[] alicePrivate = {(byte) 0xc8, (byte) 0x06, (byte) 0x43, (byte) 0x9d, (byte) 0xc9,
|
||||
(byte) 0xd2, (byte) 0xc4, (byte) 0x76, (byte) 0xff, (byte) 0xed,
|
||||
(byte) 0x8f, (byte) 0x25, (byte) 0x80, (byte) 0xc0, (byte) 0x88,
|
||||
(byte) 0x8d, (byte) 0x58, (byte) 0xab, (byte) 0x40, (byte) 0x6b,
|
||||
(byte) 0xf7, (byte) 0xae, (byte) 0x36, (byte) 0x98, (byte) 0x87,
|
||||
(byte) 0x90, (byte) 0x21, (byte) 0xb9, (byte) 0x6b, (byte) 0xb4,
|
||||
(byte) 0xbf, (byte) 0x59};
|
||||
|
||||
byte[] bobPublic = {(byte) 0x05, (byte) 0x65, (byte) 0x36, (byte) 0x14, (byte) 0x99,
|
||||
(byte) 0x3d, (byte) 0x2b, (byte) 0x15, (byte) 0xee, (byte) 0x9e,
|
||||
(byte) 0x5f, (byte) 0xd3, (byte) 0xd8, (byte) 0x6c, (byte) 0xe7,
|
||||
(byte) 0x19, (byte) 0xef, (byte) 0x4e, (byte) 0xc1, (byte) 0xda,
|
||||
(byte) 0xae, (byte) 0x18, (byte) 0x86, (byte) 0xa8, (byte) 0x7b,
|
||||
(byte) 0x3f, (byte) 0x5f, (byte) 0xa9, (byte) 0x56, (byte) 0x5a,
|
||||
(byte) 0x27, (byte) 0xa2, (byte) 0x2f};
|
||||
|
||||
byte[] bobPrivate = {(byte) 0xb0, (byte) 0x3b, (byte) 0x34, (byte) 0xc3, (byte) 0x3a,
|
||||
(byte) 0x1c, (byte) 0x44, (byte) 0xf2, (byte) 0x25, (byte) 0xb6,
|
||||
(byte) 0x62, (byte) 0xd2, (byte) 0xbf, (byte) 0x48, (byte) 0x59,
|
||||
(byte) 0xb8, (byte) 0x13, (byte) 0x54, (byte) 0x11, (byte) 0xfa,
|
||||
(byte) 0x7b, (byte) 0x03, (byte) 0x86, (byte) 0xd4, (byte) 0x5f,
|
||||
(byte) 0xb7, (byte) 0x5d, (byte) 0xc5, (byte) 0xb9, (byte) 0x1b,
|
||||
(byte) 0x44, (byte) 0x66};
|
||||
|
||||
byte[] shared = {(byte) 0x32, (byte) 0x5f, (byte) 0x23, (byte) 0x93, (byte) 0x28,
|
||||
(byte) 0x94, (byte) 0x1c, (byte) 0xed, (byte) 0x6e, (byte) 0x67,
|
||||
(byte) 0x3b, (byte) 0x86, (byte) 0xba, (byte) 0x41, (byte) 0x01,
|
||||
(byte) 0x74, (byte) 0x48, (byte) 0xe9, (byte) 0x9b, (byte) 0x64,
|
||||
(byte) 0x9a, (byte) 0x9c, (byte) 0x38, (byte) 0x06, (byte) 0xc1,
|
||||
(byte) 0xdd, (byte) 0x7c, (byte) 0xa4, (byte) 0xc4, (byte) 0x77,
|
||||
(byte) 0xe6, (byte) 0x29};
|
||||
|
||||
ECPublicKey alicePublicKey = Curve.decodePoint(alicePublic, 0);
|
||||
ECPrivateKey alicePrivateKey = Curve.decodePrivatePoint(alicePrivate);
|
||||
|
||||
ECPublicKey bobPublicKey = Curve.decodePoint(bobPublic, 0);
|
||||
ECPrivateKey bobPrivateKey = Curve.decodePrivatePoint(bobPrivate);
|
||||
|
||||
byte[] sharedOne = Curve.calculateAgreement(alicePublicKey, bobPrivateKey);
|
||||
byte[] sharedTwo = Curve.calculateAgreement(bobPublicKey, alicePrivateKey);
|
||||
|
||||
assertTrue(Arrays.equals(sharedOne, shared));
|
||||
assertTrue(Arrays.equals(sharedTwo, shared));
|
||||
}
|
||||
|
||||
public void testRandomAgreements() throws InvalidKeyException {
|
||||
for (int i=0;i<50;i++) {
|
||||
ECKeyPair alice = Curve.generateKeyPair();
|
||||
ECKeyPair bob = Curve.generateKeyPair();
|
||||
|
||||
byte[] sharedAlice = Curve.calculateAgreement(bob.getPublicKey(), alice.getPrivateKey());
|
||||
byte[] sharedBob = Curve.calculateAgreement(alice.getPublicKey(), bob.getPrivateKey());
|
||||
|
||||
assertTrue(Arrays.equals(sharedAlice, sharedBob));
|
||||
}
|
||||
}
|
||||
|
||||
public void testSignature() throws InvalidKeyException {
|
||||
byte[] aliceIdentityPrivate = {(byte)0xc0, (byte)0x97, (byte)0x24, (byte)0x84, (byte)0x12,
|
||||
(byte)0xe5, (byte)0x8b, (byte)0xf0, (byte)0x5d, (byte)0xf4,
|
||||
(byte)0x87, (byte)0x96, (byte)0x82, (byte)0x05, (byte)0x13,
|
||||
(byte)0x27, (byte)0x94, (byte)0x17, (byte)0x8e, (byte)0x36,
|
||||
(byte)0x76, (byte)0x37, (byte)0xf5, (byte)0x81, (byte)0x8f,
|
||||
(byte)0x81, (byte)0xe0, (byte)0xe6, (byte)0xce, (byte)0x73,
|
||||
(byte)0xe8, (byte)0x65};
|
||||
|
||||
byte[] aliceIdentityPublic = {(byte)0x05, (byte)0xab, (byte)0x7e, (byte)0x71, (byte)0x7d,
|
||||
(byte)0x4a, (byte)0x16, (byte)0x3b, (byte)0x7d, (byte)0x9a,
|
||||
(byte)0x1d, (byte)0x80, (byte)0x71, (byte)0xdf, (byte)0xe9,
|
||||
(byte)0xdc, (byte)0xf8, (byte)0xcd, (byte)0xcd, (byte)0x1c,
|
||||
(byte)0xea, (byte)0x33, (byte)0x39, (byte)0xb6, (byte)0x35,
|
||||
(byte)0x6b, (byte)0xe8, (byte)0x4d, (byte)0x88, (byte)0x7e,
|
||||
(byte)0x32, (byte)0x2c, (byte)0x64};
|
||||
|
||||
byte[] aliceEphemeralPublic = {(byte)0x05, (byte)0xed, (byte)0xce, (byte)0x9d, (byte)0x9c,
|
||||
(byte)0x41, (byte)0x5c, (byte)0xa7, (byte)0x8c, (byte)0xb7,
|
||||
(byte)0x25, (byte)0x2e, (byte)0x72, (byte)0xc2, (byte)0xc4,
|
||||
(byte)0xa5, (byte)0x54, (byte)0xd3, (byte)0xeb, (byte)0x29,
|
||||
(byte)0x48, (byte)0x5a, (byte)0x0e, (byte)0x1d, (byte)0x50,
|
||||
(byte)0x31, (byte)0x18, (byte)0xd1, (byte)0xa8, (byte)0x2d,
|
||||
(byte)0x99, (byte)0xfb, (byte)0x4a};
|
||||
|
||||
byte[] aliceSignature = {(byte)0x5d, (byte)0xe8, (byte)0x8c, (byte)0xa9, (byte)0xa8,
|
||||
(byte)0x9b, (byte)0x4a, (byte)0x11, (byte)0x5d, (byte)0xa7,
|
||||
(byte)0x91, (byte)0x09, (byte)0xc6, (byte)0x7c, (byte)0x9c,
|
||||
(byte)0x74, (byte)0x64, (byte)0xa3, (byte)0xe4, (byte)0x18,
|
||||
(byte)0x02, (byte)0x74, (byte)0xf1, (byte)0xcb, (byte)0x8c,
|
||||
(byte)0x63, (byte)0xc2, (byte)0x98, (byte)0x4e, (byte)0x28,
|
||||
(byte)0x6d, (byte)0xfb, (byte)0xed, (byte)0xe8, (byte)0x2d,
|
||||
(byte)0xeb, (byte)0x9d, (byte)0xcd, (byte)0x9f, (byte)0xae,
|
||||
(byte)0x0b, (byte)0xfb, (byte)0xb8, (byte)0x21, (byte)0x56,
|
||||
(byte)0x9b, (byte)0x3d, (byte)0x90, (byte)0x01, (byte)0xbd,
|
||||
(byte)0x81, (byte)0x30, (byte)0xcd, (byte)0x11, (byte)0xd4,
|
||||
(byte)0x86, (byte)0xce, (byte)0xf0, (byte)0x47, (byte)0xbd,
|
||||
(byte)0x60, (byte)0xb8, (byte)0x6e, (byte)0x88};
|
||||
|
||||
ECPrivateKey alicePrivateKey = Curve.decodePrivatePoint(aliceIdentityPrivate);
|
||||
ECPublicKey alicePublicKey = Curve.decodePoint(aliceIdentityPublic, 0);
|
||||
ECPublicKey aliceEphemeral = Curve.decodePoint(aliceEphemeralPublic, 0);
|
||||
|
||||
if (!Curve.verifySignature(alicePublicKey, aliceEphemeral.serialize(), aliceSignature)) {
|
||||
throw new AssertionError("Sig verification failed!");
|
||||
}
|
||||
|
||||
for (int i=0;i<aliceSignature.length;i++) {
|
||||
byte[] modifiedSignature = new byte[aliceSignature.length];
|
||||
System.arraycopy(aliceSignature, 0, modifiedSignature, 0, modifiedSignature.length);
|
||||
|
||||
modifiedSignature[i] ^= 0x01;
|
||||
|
||||
if (Curve.verifySignature(alicePublicKey, aliceEphemeral.serialize(), modifiedSignature)) {
|
||||
throw new AssertionError("Sig verification succeeded!");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public void testSignatureOverflow() throws InvalidKeyException {
|
||||
ECKeyPair keys = Curve.generateKeyPair();
|
||||
byte[] message = new byte[4096];
|
||||
|
||||
try {
|
||||
byte[] signature = Curve.calculateSignature(keys.getPrivateKey(), message);
|
||||
throw new InvalidKeyException("Should have asserted!");
|
||||
} catch (AssertionError e) {
|
||||
// Success!
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
package org.whispersystems.test.groups;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
import android.util.Log;
|
||||
|
||||
import org.whispersystems.libaxolotl.DuplicateMessageException;
|
||||
import org.whispersystems.libaxolotl.InvalidMessageException;
|
||||
import org.whispersystems.libaxolotl.LegacyMessageException;
|
||||
import org.whispersystems.libaxolotl.NoSessionException;
|
||||
import org.whispersystems.libaxolotl.ecc.ECKeyPair;
|
||||
import org.whispersystems.libaxolotl.groups.GroupCipher;
|
||||
import org.whispersystems.libaxolotl.groups.GroupSessionBuilder;
|
||||
import org.whispersystems.libaxolotl.protocol.SenderKeyDistributionMessage;
|
||||
import org.whispersystems.libaxolotl.util.KeyHelper;
|
||||
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.SecureRandom;
|
||||
import java.util.ArrayList;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
|
||||
public class GroupCipherTest extends AndroidTestCase {
|
||||
|
||||
public void testBasicEncryptDecrypt()
|
||||
throws LegacyMessageException, DuplicateMessageException, InvalidMessageException, NoSessionException
|
||||
{
|
||||
InMemorySenderKeyStore aliceStore = new InMemorySenderKeyStore();
|
||||
InMemorySenderKeyStore bobStore = new InMemorySenderKeyStore();
|
||||
|
||||
GroupSessionBuilder aliceSessionBuilder = new GroupSessionBuilder(aliceStore);
|
||||
GroupSessionBuilder bobSessionBuilder = new GroupSessionBuilder(bobStore);
|
||||
|
||||
GroupCipher aliceGroupCipher = new GroupCipher(aliceStore, "groupWithBobInIt");
|
||||
GroupCipher bobGroupCipher = new GroupCipher(bobStore, "groupWithBobInIt::aliceUserName");
|
||||
|
||||
byte[] aliceSenderKey = KeyHelper.generateSenderKey();
|
||||
ECKeyPair aliceSenderSigningKey = KeyHelper.generateSenderSigningKey();
|
||||
int aliceSenderKeyId = KeyHelper.generateSenderKeyId();
|
||||
|
||||
SenderKeyDistributionMessage aliceDistributionMessage =
|
||||
aliceSessionBuilder.process("groupWithBobInIt", aliceSenderKeyId, 0,
|
||||
aliceSenderKey, aliceSenderSigningKey);
|
||||
|
||||
bobSessionBuilder.process("groupWithBobInIt::aliceUserName", aliceDistributionMessage);
|
||||
|
||||
byte[] ciphertextFromAlice = aliceGroupCipher.encrypt("smert ze smert".getBytes());
|
||||
byte[] plaintextFromAlice = bobGroupCipher.decrypt(ciphertextFromAlice);
|
||||
|
||||
assertTrue(new String(plaintextFromAlice).equals("smert ze smert"));
|
||||
}
|
||||
|
||||
public void testBasicRatchet()
|
||||
throws LegacyMessageException, DuplicateMessageException, InvalidMessageException, NoSessionException
|
||||
{
|
||||
InMemorySenderKeyStore aliceStore = new InMemorySenderKeyStore();
|
||||
InMemorySenderKeyStore bobStore = new InMemorySenderKeyStore();
|
||||
|
||||
GroupSessionBuilder aliceSessionBuilder = new GroupSessionBuilder(aliceStore);
|
||||
GroupSessionBuilder bobSessionBuilder = new GroupSessionBuilder(bobStore);
|
||||
|
||||
GroupCipher aliceGroupCipher = new GroupCipher(aliceStore, "groupWithBobInIt");
|
||||
GroupCipher bobGroupCipher = new GroupCipher(bobStore, "groupWithBobInIt::aliceUserName");
|
||||
|
||||
byte[] aliceSenderKey = KeyHelper.generateSenderKey();
|
||||
ECKeyPair aliceSenderSigningKey = KeyHelper.generateSenderSigningKey();
|
||||
int aliceSenderKeyId = KeyHelper.generateSenderKeyId();
|
||||
|
||||
SenderKeyDistributionMessage aliceDistributionMessage =
|
||||
aliceSessionBuilder.process("groupWithBobInIt", aliceSenderKeyId, 0,
|
||||
aliceSenderKey, aliceSenderSigningKey);
|
||||
|
||||
bobSessionBuilder.process("groupWithBobInIt::aliceUserName", aliceDistributionMessage);
|
||||
|
||||
byte[] ciphertextFromAlice = aliceGroupCipher.encrypt("smert ze smert".getBytes());
|
||||
byte[] ciphertextFromAlice2 = aliceGroupCipher.encrypt("smert ze smert2".getBytes());
|
||||
byte[] ciphertextFromAlice3 = aliceGroupCipher.encrypt("smert ze smert3".getBytes());
|
||||
|
||||
byte[] plaintextFromAlice = bobGroupCipher.decrypt(ciphertextFromAlice);
|
||||
|
||||
try {
|
||||
bobGroupCipher.decrypt(ciphertextFromAlice);
|
||||
throw new AssertionError("Should have ratcheted forward!");
|
||||
} catch (DuplicateMessageException dme) {
|
||||
// good
|
||||
}
|
||||
|
||||
byte[] plaintextFromAlice2 = bobGroupCipher.decrypt(ciphertextFromAlice2);
|
||||
byte[] plaintextFromAlice3 = bobGroupCipher.decrypt(ciphertextFromAlice3);
|
||||
|
||||
assertTrue(new String(plaintextFromAlice).equals("smert ze smert"));
|
||||
assertTrue(new String(plaintextFromAlice2).equals("smert ze smert2"));
|
||||
assertTrue(new String(plaintextFromAlice3).equals("smert ze smert3"));
|
||||
}
|
||||
|
||||
public void testOutOfOrder()
|
||||
throws LegacyMessageException, DuplicateMessageException, InvalidMessageException, NoSessionException
|
||||
{
|
||||
InMemorySenderKeyStore aliceStore = new InMemorySenderKeyStore();
|
||||
InMemorySenderKeyStore bobStore = new InMemorySenderKeyStore();
|
||||
|
||||
GroupSessionBuilder aliceSessionBuilder = new GroupSessionBuilder(aliceStore);
|
||||
GroupSessionBuilder bobSessionBuilder = new GroupSessionBuilder(bobStore);
|
||||
|
||||
GroupCipher aliceGroupCipher = new GroupCipher(aliceStore, "groupWithBobInIt");
|
||||
GroupCipher bobGroupCipher = new GroupCipher(bobStore, "groupWithBobInIt::aliceUserName");
|
||||
|
||||
byte[] aliceSenderKey = KeyHelper.generateSenderKey();
|
||||
ECKeyPair aliceSenderSigningKey = KeyHelper.generateSenderSigningKey();
|
||||
int aliceSenderKeyId = KeyHelper.generateSenderKeyId();
|
||||
|
||||
SenderKeyDistributionMessage aliceDistributionMessage =
|
||||
aliceSessionBuilder.process("groupWithBobInIt", aliceSenderKeyId, 0,
|
||||
aliceSenderKey, aliceSenderSigningKey);
|
||||
|
||||
bobSessionBuilder.process("groupWithBobInIt::aliceUserName", aliceDistributionMessage);
|
||||
|
||||
|
||||
ArrayList<byte[]> ciphertexts = new ArrayList<>(100);
|
||||
|
||||
for (int i=0;i<100;i++) {
|
||||
ciphertexts.add(aliceGroupCipher.encrypt("up the punks".getBytes()));
|
||||
}
|
||||
|
||||
while (ciphertexts.size() > 0) {
|
||||
int index = randomInt() % ciphertexts.size();
|
||||
byte[] ciphertext = ciphertexts.remove(index);
|
||||
byte[] plaintext = bobGroupCipher.decrypt(ciphertext);
|
||||
|
||||
assertTrue(new String(plaintext).equals("up the punks"));
|
||||
}
|
||||
}
|
||||
|
||||
public void testEncryptNoSession() {
|
||||
InMemorySenderKeyStore aliceStore = new InMemorySenderKeyStore();
|
||||
GroupCipher aliceGroupCipher = new GroupCipher(aliceStore, "groupWithBobInIt");
|
||||
try {
|
||||
aliceGroupCipher.encrypt("up the punks".getBytes());
|
||||
throw new AssertionError("Should have failed!");
|
||||
} catch (NoSessionException nse) {
|
||||
// good
|
||||
}
|
||||
}
|
||||
|
||||
private int randomInt() {
|
||||
try {
|
||||
return SecureRandom.getInstance("SHA1PRNG").nextInt(Integer.MAX_VALUE);
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
package org.whispersystems.test.groups;
|
||||
|
||||
import org.whispersystems.libaxolotl.groups.state.SenderKeyRecord;
|
||||
import org.whispersystems.libaxolotl.groups.state.SenderKeyStore;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
public class InMemorySenderKeyStore implements SenderKeyStore {
|
||||
|
||||
private final Map<String, SenderKeyRecord> store = new HashMap<>();
|
||||
|
||||
@Override
|
||||
public void storeSenderKey(String senderKeyId, SenderKeyRecord record) {
|
||||
store.put(senderKeyId, record);
|
||||
}
|
||||
|
||||
@Override
|
||||
public SenderKeyRecord loadSenderKey(String senderKeyId) {
|
||||
try {
|
||||
SenderKeyRecord record = store.get(senderKeyId);
|
||||
|
||||
if (record == null) {
|
||||
return new SenderKeyRecord();
|
||||
} else {
|
||||
return new SenderKeyRecord(record.serialize());
|
||||
}
|
||||
} catch (IOException e) {
|
||||
throw new AssertionError(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
package org.whispersystems.test.kdf;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
|
||||
import org.whispersystems.libaxolotl.kdf.HKDF;
|
||||
|
||||
import java.util.Arrays;
|
||||
|
||||
public class HKDFTest extends AndroidTestCase {
|
||||
|
||||
public void testVectorV3() {
|
||||
byte[] ikm = {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
|
||||
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
|
||||
0x0b, 0x0b};
|
||||
|
||||
byte[] salt = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
|
||||
0x0a, 0x0b, 0x0c};
|
||||
|
||||
byte[] info = {(byte) 0xf0, (byte) 0xf1, (byte) 0xf2, (byte) 0xf3, (byte) 0xf4,
|
||||
(byte) 0xf5, (byte) 0xf6, (byte) 0xf7, (byte) 0xf8, (byte) 0xf9};
|
||||
|
||||
byte[] okm = {(byte) 0x3c, (byte) 0xb2, (byte) 0x5f, (byte) 0x25, (byte) 0xfa,
|
||||
(byte) 0xac, (byte) 0xd5, (byte) 0x7a, (byte) 0x90, (byte) 0x43,
|
||||
(byte) 0x4f, (byte) 0x64, (byte) 0xd0, (byte) 0x36, (byte) 0x2f,
|
||||
(byte) 0x2a, (byte) 0x2d, (byte) 0x2d, (byte) 0x0a, (byte) 0x90,
|
||||
(byte) 0xcf, (byte) 0x1a, (byte) 0x5a, (byte) 0x4c, (byte) 0x5d,
|
||||
(byte) 0xb0, (byte) 0x2d, (byte) 0x56, (byte) 0xec, (byte) 0xc4,
|
||||
(byte) 0xc5, (byte) 0xbf, (byte) 0x34, (byte) 0x00, (byte) 0x72,
|
||||
(byte) 0x08, (byte) 0xd5, (byte) 0xb8, (byte) 0x87, (byte) 0x18,
|
||||
(byte) 0x58, (byte) 0x65};
|
||||
|
||||
byte[] actualOutput = HKDF.createFor(3).deriveSecrets(ikm, salt, info, 42);
|
||||
|
||||
assertTrue(Arrays.equals(okm, actualOutput));
|
||||
}
|
||||
|
||||
public void testVectorLongV3() {
|
||||
byte[] ikm = {(byte) 0x00, (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0x04,
|
||||
(byte) 0x05, (byte) 0x06, (byte) 0x07, (byte) 0x08, (byte) 0x09,
|
||||
(byte) 0x0a, (byte) 0x0b, (byte) 0x0c, (byte) 0x0d, (byte) 0x0e,
|
||||
(byte) 0x0f, (byte) 0x10, (byte) 0x11, (byte) 0x12, (byte) 0x13,
|
||||
(byte) 0x14, (byte) 0x15, (byte) 0x16, (byte) 0x17, (byte) 0x18,
|
||||
(byte) 0x19, (byte) 0x1a, (byte) 0x1b, (byte) 0x1c, (byte) 0x1d,
|
||||
(byte) 0x1e, (byte) 0x1f, (byte) 0x20, (byte) 0x21, (byte) 0x22,
|
||||
(byte) 0x23, (byte) 0x24, (byte) 0x25, (byte) 0x26, (byte) 0x27,
|
||||
(byte) 0x28, (byte) 0x29, (byte) 0x2a, (byte) 0x2b, (byte) 0x2c,
|
||||
(byte) 0x2d, (byte) 0x2e, (byte) 0x2f, (byte) 0x30, (byte) 0x31,
|
||||
(byte) 0x32, (byte) 0x33, (byte) 0x34, (byte) 0x35, (byte) 0x36,
|
||||
(byte) 0x37, (byte) 0x38, (byte) 0x39, (byte) 0x3a, (byte) 0x3b,
|
||||
(byte) 0x3c, (byte) 0x3d, (byte) 0x3e, (byte) 0x3f, (byte) 0x40,
|
||||
(byte) 0x41, (byte) 0x42, (byte) 0x43, (byte) 0x44, (byte) 0x45,
|
||||
(byte) 0x46, (byte) 0x47, (byte) 0x48, (byte) 0x49, (byte) 0x4a,
|
||||
(byte) 0x4b, (byte) 0x4c, (byte) 0x4d, (byte) 0x4e, (byte) 0x4f};
|
||||
|
||||
byte[] salt = {(byte) 0x60, (byte) 0x61, (byte) 0x62, (byte) 0x63, (byte) 0x64,
|
||||
(byte) 0x65, (byte) 0x66, (byte) 0x67, (byte) 0x68, (byte) 0x69,
|
||||
(byte) 0x6a, (byte) 0x6b, (byte) 0x6c, (byte) 0x6d, (byte) 0x6e,
|
||||
(byte) 0x6f, (byte) 0x70, (byte) 0x71, (byte) 0x72, (byte) 0x73,
|
||||
(byte) 0x74, (byte) 0x75, (byte) 0x76, (byte) 0x77, (byte) 0x78,
|
||||
(byte) 0x79, (byte) 0x7a, (byte) 0x7b, (byte) 0x7c, (byte) 0x7d,
|
||||
(byte) 0x7e, (byte) 0x7f, (byte) 0x80, (byte) 0x81, (byte) 0x82,
|
||||
(byte) 0x83, (byte) 0x84, (byte) 0x85, (byte) 0x86, (byte) 0x87,
|
||||
(byte) 0x88, (byte) 0x89, (byte) 0x8a, (byte) 0x8b, (byte) 0x8c,
|
||||
(byte) 0x8d, (byte) 0x8e, (byte) 0x8f, (byte) 0x90, (byte) 0x91,
|
||||
(byte) 0x92, (byte) 0x93, (byte) 0x94, (byte) 0x95, (byte) 0x96,
|
||||
(byte) 0x97, (byte) 0x98, (byte) 0x99, (byte) 0x9a, (byte) 0x9b,
|
||||
(byte) 0x9c, (byte) 0x9d, (byte) 0x9e, (byte) 0x9f, (byte) 0xa0,
|
||||
(byte) 0xa1, (byte) 0xa2, (byte) 0xa3, (byte) 0xa4, (byte) 0xa5,
|
||||
(byte) 0xa6, (byte) 0xa7, (byte) 0xa8, (byte) 0xa9, (byte) 0xaa,
|
||||
(byte) 0xab, (byte) 0xac, (byte) 0xad, (byte) 0xae, (byte) 0xaf};
|
||||
|
||||
byte[] info = {(byte) 0xb0, (byte) 0xb1, (byte) 0xb2, (byte) 0xb3, (byte) 0xb4,
|
||||
(byte) 0xb5, (byte) 0xb6, (byte) 0xb7, (byte) 0xb8, (byte) 0xb9,
|
||||
(byte) 0xba, (byte) 0xbb, (byte) 0xbc, (byte) 0xbd, (byte) 0xbe,
|
||||
(byte) 0xbf, (byte) 0xc0, (byte) 0xc1, (byte) 0xc2, (byte) 0xc3,
|
||||
(byte) 0xc4, (byte) 0xc5, (byte) 0xc6, (byte) 0xc7, (byte) 0xc8,
|
||||
(byte) 0xc9, (byte) 0xca, (byte) 0xcb, (byte) 0xcc, (byte) 0xcd,
|
||||
(byte) 0xce, (byte) 0xcf, (byte) 0xd0, (byte) 0xd1, (byte) 0xd2,
|
||||
(byte) 0xd3, (byte) 0xd4, (byte) 0xd5, (byte) 0xd6, (byte) 0xd7,
|
||||
(byte) 0xd8, (byte) 0xd9, (byte) 0xda, (byte) 0xdb, (byte) 0xdc,
|
||||
(byte) 0xdd, (byte) 0xde, (byte) 0xdf, (byte) 0xe0, (byte) 0xe1,
|
||||
(byte) 0xe2, (byte) 0xe3, (byte) 0xe4, (byte) 0xe5, (byte) 0xe6,
|
||||
(byte) 0xe7, (byte) 0xe8, (byte) 0xe9, (byte) 0xea, (byte) 0xeb,
|
||||
(byte) 0xec, (byte) 0xed, (byte) 0xee, (byte) 0xef, (byte) 0xf0,
|
||||
(byte) 0xf1, (byte) 0xf2, (byte) 0xf3, (byte) 0xf4, (byte) 0xf5,
|
||||
(byte) 0xf6, (byte) 0xf7, (byte) 0xf8, (byte) 0xf9, (byte) 0xfa,
|
||||
(byte) 0xfb, (byte) 0xfc, (byte) 0xfd, (byte) 0xfe, (byte) 0xff};
|
||||
|
||||
byte[] okm = {(byte) 0xb1, (byte) 0x1e, (byte) 0x39, (byte) 0x8d, (byte) 0xc8,
|
||||
(byte) 0x03, (byte) 0x27, (byte) 0xa1, (byte) 0xc8, (byte) 0xe7,
|
||||
(byte) 0xf7, (byte) 0x8c, (byte) 0x59, (byte) 0x6a, (byte) 0x49,
|
||||
(byte) 0x34, (byte) 0x4f, (byte) 0x01, (byte) 0x2e, (byte) 0xda,
|
||||
(byte) 0x2d, (byte) 0x4e, (byte) 0xfa, (byte) 0xd8, (byte) 0xa0,
|
||||
(byte) 0x50, (byte) 0xcc, (byte) 0x4c, (byte) 0x19, (byte) 0xaf,
|
||||
(byte) 0xa9, (byte) 0x7c, (byte) 0x59, (byte) 0x04, (byte) 0x5a,
|
||||
(byte) 0x99, (byte) 0xca, (byte) 0xc7, (byte) 0x82, (byte) 0x72,
|
||||
(byte) 0x71, (byte) 0xcb, (byte) 0x41, (byte) 0xc6, (byte) 0x5e,
|
||||
(byte) 0x59, (byte) 0x0e, (byte) 0x09, (byte) 0xda, (byte) 0x32,
|
||||
(byte) 0x75, (byte) 0x60, (byte) 0x0c, (byte) 0x2f, (byte) 0x09,
|
||||
(byte) 0xb8, (byte) 0x36, (byte) 0x77, (byte) 0x93, (byte) 0xa9,
|
||||
(byte) 0xac, (byte) 0xa3, (byte) 0xdb, (byte) 0x71, (byte) 0xcc,
|
||||
(byte) 0x30, (byte) 0xc5, (byte) 0x81, (byte) 0x79, (byte) 0xec,
|
||||
(byte) 0x3e, (byte) 0x87, (byte) 0xc1, (byte) 0x4c, (byte) 0x01,
|
||||
(byte) 0xd5, (byte) 0xc1, (byte) 0xf3, (byte) 0x43, (byte) 0x4f,
|
||||
(byte) 0x1d, (byte) 0x87};
|
||||
|
||||
byte[] actualOutput = HKDF.createFor(3).deriveSecrets(ikm, salt, info, 82);
|
||||
assertTrue(Arrays.equals(okm, actualOutput));
|
||||
}
|
||||
|
||||
public void testVectorV2() {
|
||||
byte[] ikm = {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
|
||||
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
|
||||
0x0b, 0x0b};
|
||||
|
||||
byte[] salt = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
|
||||
0x0a, 0x0b, 0x0c};
|
||||
|
||||
byte[] info = {(byte)0xf0, (byte)0xf1, (byte)0xf2, (byte)0xf3, (byte)0xf4,
|
||||
(byte)0xf5, (byte)0xf6, (byte)0xf7, (byte)0xf8, (byte)0xf9};
|
||||
|
||||
byte[] okm = {(byte)0x6e, (byte)0xc2, (byte)0x55, (byte)0x6d, (byte)0x5d,
|
||||
(byte)0x7b, (byte)0x1d, (byte)0x81, (byte)0xde, (byte)0xe4,
|
||||
(byte)0x22, (byte)0x2a, (byte)0xd7, (byte)0x48, (byte)0x36,
|
||||
(byte)0x95, (byte)0xdd, (byte)0xc9, (byte)0x8f, (byte)0x4f,
|
||||
(byte)0x5f, (byte)0xab, (byte)0xc0, (byte)0xe0, (byte)0x20,
|
||||
(byte)0x5d, (byte)0xc2, (byte)0xef, (byte)0x87, (byte)0x52,
|
||||
(byte)0xd4, (byte)0x1e, (byte)0x04, (byte)0xe2, (byte)0xe2,
|
||||
(byte)0x11, (byte)0x01, (byte)0xc6, (byte)0x8f, (byte)0xf0,
|
||||
(byte)0x93, (byte)0x94, (byte)0xb8, (byte)0xad, (byte)0x0b,
|
||||
(byte)0xdc, (byte)0xb9, (byte)0x60, (byte)0x9c, (byte)0xd4,
|
||||
(byte)0xee, (byte)0x82, (byte)0xac, (byte)0x13, (byte)0x19,
|
||||
(byte)0x9b, (byte)0x4a, (byte)0xa9, (byte)0xfd, (byte)0xa8,
|
||||
(byte)0x99, (byte)0xda, (byte)0xeb, (byte)0xec};
|
||||
|
||||
byte[] actualOutput = HKDF.createFor(2).deriveSecrets(ikm, salt, info, 64);
|
||||
assertTrue(Arrays.equals(okm, actualOutput));
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
package org.whispersystems.test.ratchet;
|
||||
|
||||
import android.test.AndroidTestCase;
|
||||
|
||||
import org.whispersystems.libaxolotl.kdf.HKDF;
|
||||
import org.whispersystems.libaxolotl.ratchet.ChainKey;
|
||||
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.util.Arrays;
|
||||
|
||||
public class ChainKeyTest extends AndroidTestCase {
|
||||
|
||||
public void testChainKeyDerivationV2() throws NoSuchAlgorithmException {
|
||||
|
||||
byte[] seed = {(byte) 0x8a, (byte) 0xb7, (byte) 0x2d, (byte) 0x6f, (byte) 0x4c,
|
||||
(byte) 0xc5, (byte) 0xac, (byte) 0x0d, (byte) 0x38, (byte) 0x7e,
|
||||
(byte) 0xaf, (byte) 0x46, (byte) 0x33, (byte) 0x78, (byte) 0xdd,
|
||||
(byte) 0xb2, (byte) 0x8e, (byte) 0xdd, (byte) 0x07, (byte) 0x38,
|
||||
(byte) 0x5b, (byte) 0x1c, (byte) 0xb0, (byte) 0x12, (byte) 0x50,
|
||||
(byte) 0xc7, (byte) 0x15, (byte) 0x98, (byte) 0x2e, (byte) 0x7a,
|
||||
(byte) 0xd4, (byte) 0x8f};
|
||||
|
||||
byte[] messageKey = {(byte) 0x02, (byte) 0xa9, (byte) 0xaa, (byte) 0x6c, (byte) 0x7d,
|
||||
(byte) 0xbd, (byte) 0x64, (byte) 0xf9, (byte) 0xd3, (byte) 0xaa,
|
||||
(byte) 0x92, (byte) 0xf9, (byte) 0x2a, (byte) 0x27, (byte) 0x7b,
|
||||
(byte) 0xf5, (byte) 0x46, (byte) 0x09, (byte) 0xda, (byte) 0xdf,
|
||||
(byte) 0x0b, (byte) 0x00, (byte) 0x82, (byte) 0x8a, (byte) 0xcf,
|
||||
(byte) 0xc6, (byte) 0x1e, (byte) 0x3c, (byte) 0x72, (byte) 0x4b,
|
||||
(byte) 0x84, (byte) 0xa7};
|
||||
|
||||
byte[] macKey = {(byte) 0xbf, (byte) 0xbe, (byte) 0x5e, (byte) 0xfb, (byte) 0x60,
|
||||
(byte) 0x30, (byte) 0x30, (byte) 0x52, (byte) 0x67, (byte) 0x42,
|
||||
(byte) 0xe3, (byte) 0xee, (byte) 0x89, (byte) 0xc7, (byte) 0x02,
|
||||
(byte) 0x4e, (byte) 0x88, (byte) 0x4e, (byte) 0x44, (byte) 0x0f,
|
||||
(byte) 0x1f, (byte) 0xf3, (byte) 0x76, (byte) 0xbb, (byte) 0x23,
|
||||
(byte) 0x17, (byte) 0xb2, (byte) 0xd6, (byte) 0x4d, (byte) 0xeb,
|
||||
(byte) 0x7c, (byte) 0x83};
|
||||
|
||||
byte[] nextChainKey = {(byte) 0x28, (byte) 0xe8, (byte) 0xf8, (byte) 0xfe, (byte) 0xe5,
|
||||
(byte) 0x4b, (byte) 0x80, (byte) 0x1e, (byte) 0xef, (byte) 0x7c,
|
||||
(byte) 0x5c, (byte) 0xfb, (byte) 0x2f, (byte) 0x17, (byte) 0xf3,
|
||||
(byte) 0x2c, (byte) 0x7b, (byte) 0x33, (byte) 0x44, (byte) 0x85,
|
||||
(byte) 0xbb, (byte) 0xb7, (byte) 0x0f, (byte) 0xac, (byte) 0x6e,
|
||||
(byte) 0xc1, (byte) 0x03, (byte) 0x42, (byte) 0xa2, (byte) 0x46,
|
||||
(byte) 0xd1, (byte) 0x5d};
|
||||
|
||||
ChainKey chainKey = new ChainKey(HKDF.createFor(2), seed, 0);
|
||||
|
||||
assertTrue(Arrays.equals(chainKey.getKey(), seed));
|
||||
assertTrue(Arrays.equals(chainKey.getMessageKeys().getCipherKey().getEncoded(), messageKey));
|
||||
assertTrue(Arrays.equals(chainKey.getMessageKeys().getMacKey().getEncoded(), macKey));
|
||||
assertTrue(Arrays.equals(chainKey.getNextChainKey().getKey(), nextChainKey));
|
||||
assertTrue(chainKey.getIndex() == 0);
|
||||
assertTrue(chainKey.getMessageKeys().getCounter() == 0);
|
||||
assertTrue(chainKey.getNextChainKey().getIndex() == 1);
|
||||
assertTrue(chainKey.getNextChainKey().getMessageKeys().getCounter() == 1);
|
||||
}
|
||||
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue