You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

364 lines
10 KiB

  1. /*
  2. conversions
  3. */
  4. DONNA_INLINE static void
  5. ge25519_p1p1_to_partial(ge25519 *r, const ge25519_p1p1 *p) {
  6. curve25519_mul(r->x, p->x, p->t);
  7. curve25519_mul(r->y, p->y, p->z);
  8. curve25519_mul(r->z, p->z, p->t);
  9. }
  10. DONNA_INLINE static void
  11. ge25519_p1p1_to_full(ge25519 *r, const ge25519_p1p1 *p) {
  12. curve25519_mul(r->x, p->x, p->t);
  13. curve25519_mul(r->y, p->y, p->z);
  14. curve25519_mul(r->z, p->z, p->t);
  15. curve25519_mul(r->t, p->x, p->y);
  16. }
  17. static void
  18. ge25519_full_to_pniels(ge25519_pniels *p, const ge25519 *r) {
  19. curve25519_sub(p->ysubx, r->y, r->x);
  20. curve25519_add(p->xaddy, r->y, r->x);
  21. curve25519_copy(p->z, r->z);
  22. curve25519_mul(p->t2d, r->t, ge25519_ec2d);
  23. }
  24. /*
  25. adding & doubling
  26. */
  27. static void
  28. ge25519_add_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519 *q) {
  29. bignum25519 a,b,c,d,t,u;
  30. curve25519_sub(a, p->y, p->x);
  31. curve25519_add(b, p->y, p->x);
  32. curve25519_sub(t, q->y, q->x);
  33. curve25519_add(u, q->y, q->x);
  34. curve25519_mul(a, a, t);
  35. curve25519_mul(b, b, u);
  36. curve25519_mul(c, p->t, q->t);
  37. curve25519_mul(c, c, ge25519_ec2d);
  38. curve25519_mul(d, p->z, q->z);
  39. curve25519_add(d, d, d);
  40. curve25519_sub(r->x, b, a);
  41. curve25519_add(r->y, b, a);
  42. curve25519_add_after_basic(r->z, d, c);
  43. curve25519_sub_after_basic(r->t, d, c);
  44. }
  45. static void
  46. ge25519_double_p1p1(ge25519_p1p1 *r, const ge25519 *p) {
  47. bignum25519 a,b,c;
  48. curve25519_square(a, p->x);
  49. curve25519_square(b, p->y);
  50. curve25519_square(c, p->z);
  51. curve25519_add_reduce(c, c, c);
  52. curve25519_add(r->x, p->x, p->y);
  53. curve25519_square(r->x, r->x);
  54. curve25519_add(r->y, b, a);
  55. curve25519_sub(r->z, b, a);
  56. curve25519_sub_after_basic(r->x, r->x, r->y);
  57. curve25519_sub_after_basic(r->t, c, r->z);
  58. }
  59. static void
  60. ge25519_nielsadd2_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_niels *q, unsigned char signbit) {
  61. const bignum25519 *qb = (const bignum25519 *)q;
  62. bignum25519 *rb = (bignum25519 *)r;
  63. bignum25519 a,b,c;
  64. curve25519_sub(a, p->y, p->x);
  65. curve25519_add(b, p->y, p->x);
  66. curve25519_mul(a, a, qb[signbit]); /* x for +, y for - */
  67. curve25519_mul(r->x, b, qb[signbit^1]); /* y for +, x for - */
  68. curve25519_add(r->y, r->x, a);
  69. curve25519_sub(r->x, r->x, a);
  70. curve25519_mul(c, p->t, q->t2d);
  71. curve25519_add_reduce(r->t, p->z, p->z);
  72. curve25519_copy(r->z, r->t);
  73. curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
  74. curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
  75. }
  76. static void
  77. ge25519_pnielsadd_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_pniels *q, unsigned char signbit) {
  78. const bignum25519 *qb = (const bignum25519 *)q;
  79. bignum25519 *rb = (bignum25519 *)r;
  80. bignum25519 a,b,c;
  81. curve25519_sub(a, p->y, p->x);
  82. curve25519_add(b, p->y, p->x);
  83. curve25519_mul(a, a, qb[signbit]); /* ysubx for +, xaddy for - */
  84. curve25519_mul(r->x, b, qb[signbit^1]); /* xaddy for +, ysubx for - */
  85. curve25519_add(r->y, r->x, a);
  86. curve25519_sub(r->x, r->x, a);
  87. curve25519_mul(c, p->t, q->t2d);
  88. curve25519_mul(r->t, p->z, q->z);
  89. curve25519_add_reduce(r->t, r->t, r->t);
  90. curve25519_copy(r->z, r->t);
  91. curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */
  92. curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */
  93. }
  94. static void
  95. ge25519_double_partial(ge25519 *r, const ge25519 *p) {
  96. ge25519_p1p1 t;
  97. ge25519_double_p1p1(&t, p);
  98. ge25519_p1p1_to_partial(r, &t);
  99. }
  100. static void
  101. ge25519_double(ge25519 *r, const ge25519 *p) {
  102. ge25519_p1p1 t;
  103. ge25519_double_p1p1(&t, p);
  104. ge25519_p1p1_to_full(r, &t);
  105. }
  106. static void
  107. ge25519_add(ge25519 *r, const ge25519 *p, const ge25519 *q) {
  108. ge25519_p1p1 t;
  109. ge25519_add_p1p1(&t, p, q);
  110. ge25519_p1p1_to_full(r, &t);
  111. }
  112. static void
  113. ge25519_nielsadd2(ge25519 *r, const ge25519_niels *q) {
  114. bignum25519 a,b,c,e,f,g,h;
  115. curve25519_sub(a, r->y, r->x);
  116. curve25519_add(b, r->y, r->x);
  117. curve25519_mul(a, a, q->ysubx);
  118. curve25519_mul(e, b, q->xaddy);
  119. curve25519_add(h, e, a);
  120. curve25519_sub(e, e, a);
  121. curve25519_mul(c, r->t, q->t2d);
  122. curve25519_add(f, r->z, r->z);
  123. curve25519_add_after_basic(g, f, c);
  124. curve25519_sub_after_basic(f, f, c);
  125. curve25519_mul(r->x, e, f);
  126. curve25519_mul(r->y, h, g);
  127. curve25519_mul(r->z, g, f);
  128. curve25519_mul(r->t, e, h);
  129. }
  130. static void
  131. ge25519_pnielsadd(ge25519_pniels *r, const ge25519 *p, const ge25519_pniels *q) {
  132. bignum25519 a,b,c,x,y,z,t;
  133. curve25519_sub(a, p->y, p->x);
  134. curve25519_add(b, p->y, p->x);
  135. curve25519_mul(a, a, q->ysubx);
  136. curve25519_mul(x, b, q->xaddy);
  137. curve25519_add(y, x, a);
  138. curve25519_sub(x, x, a);
  139. curve25519_mul(c, p->t, q->t2d);
  140. curve25519_mul(t, p->z, q->z);
  141. curve25519_add(t, t, t);
  142. curve25519_add_after_basic(z, t, c);
  143. curve25519_sub_after_basic(t, t, c);
  144. curve25519_mul(r->xaddy, x, t);
  145. curve25519_mul(r->ysubx, y, z);
  146. curve25519_mul(r->z, z, t);
  147. curve25519_mul(r->t2d, x, y);
  148. curve25519_copy(y, r->ysubx);
  149. curve25519_sub(r->ysubx, r->ysubx, r->xaddy);
  150. curve25519_add(r->xaddy, r->xaddy, y);
  151. curve25519_mul(r->t2d, r->t2d, ge25519_ec2d);
  152. }
  153. /*
  154. pack & unpack
  155. */
  156. static void
  157. ge25519_pack(unsigned char r[32], const ge25519 *p) {
  158. bignum25519 tx, ty, zi;
  159. unsigned char parity[32];
  160. curve25519_recip(zi, p->z);
  161. curve25519_mul(tx, p->x, zi);
  162. curve25519_mul(ty, p->y, zi);
  163. curve25519_contract(r, ty);
  164. curve25519_contract(parity, tx);
  165. r[31] ^= ((parity[0] & 1) << 7);
  166. }
  167. static int
  168. ge25519_unpack_negative_vartime(ge25519 *r, const unsigned char p[32]) {
  169. static const unsigned char zero[32] = {0};
  170. static const bignum25519 one = {1};
  171. unsigned char parity = p[31] >> 7;
  172. unsigned char check[32];
  173. bignum25519 t, root, num, den, d3;
  174. curve25519_expand(r->y, p);
  175. curve25519_copy(r->z, one);
  176. curve25519_square(num, r->y); /* x = y^2 */
  177. curve25519_mul(den, num, ge25519_ecd); /* den = dy^2 */
  178. curve25519_sub_reduce(num, num, r->z); /* x = y^1 - 1 */
  179. curve25519_add(den, den, r->z); /* den = dy^2 + 1 */
  180. /* Computation of sqrt(num/den) */
  181. /* 1.: computation of num^((p-5)/8)*den^((7p-35)/8) = (num*den^7)^((p-5)/8) */
  182. curve25519_square(t, den);
  183. curve25519_mul(d3, t, den);
  184. curve25519_square(r->x, d3);
  185. curve25519_mul(r->x, r->x, den);
  186. curve25519_mul(r->x, r->x, num);
  187. curve25519_pow_two252m3(r->x, r->x);
  188. /* 2. computation of r->x = num * den^3 * (num*den^7)^((p-5)/8) */
  189. curve25519_mul(r->x, r->x, d3);
  190. curve25519_mul(r->x, r->x, num);
  191. /* 3. Check if either of the roots works: */
  192. curve25519_square(t, r->x);
  193. curve25519_mul(t, t, den);
  194. curve25519_sub_reduce(root, t, num);
  195. curve25519_contract(check, root);
  196. if (!ed25519_verify(check, zero, 32)) {
  197. curve25519_add_reduce(t, t, num);
  198. curve25519_contract(check, t);
  199. if (!ed25519_verify(check, zero, 32))
  200. return 0;
  201. curve25519_mul(r->x, r->x, ge25519_sqrtneg1);
  202. }
  203. curve25519_contract(check, r->x);
  204. if ((check[0] & 1) == parity) {
  205. curve25519_copy(t, r->x);
  206. curve25519_neg(r->x, t);
  207. }
  208. curve25519_mul(r->t, r->x, r->y);
  209. return 1;
  210. }
  211. /*
  212. scalarmults
  213. */
  214. #define S1_SWINDOWSIZE 5
  215. #define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2))
  216. #define S2_SWINDOWSIZE 7
  217. #define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2))
  218. /* computes [s1]p1 + [s2]basepoint */
  219. static void
  220. ge25519_double_scalarmult_vartime(ge25519 *r, const ge25519 *p1, const bignum256modm s1, const bignum256modm s2) {
  221. signed char slide1[256], slide2[256];
  222. ge25519_pniels pre1[S1_TABLE_SIZE];
  223. ge25519 d1;
  224. ge25519_p1p1 t;
  225. int32_t i;
  226. contract256_slidingwindow_modm(slide1, s1, S1_SWINDOWSIZE);
  227. contract256_slidingwindow_modm(slide2, s2, S2_SWINDOWSIZE);
  228. ge25519_double(&d1, p1);
  229. ge25519_full_to_pniels(pre1, p1);
  230. for (i = 0; i < S1_TABLE_SIZE - 1; i++)
  231. ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);
  232. /* set neutral */
  233. memset(r, 0, sizeof(ge25519));
  234. r->y[0] = 1;
  235. r->z[0] = 1;
  236. i = 255;
  237. while ((i >= 0) && !(slide1[i] | slide2[i]))
  238. i--;
  239. for (; i >= 0; i--) {
  240. ge25519_double_p1p1(&t, r);
  241. if (slide1[i]) {
  242. ge25519_p1p1_to_full(r, &t);
  243. ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (unsigned char)slide1[i] >> 7);
  244. }
  245. if (slide2[i]) {
  246. ge25519_p1p1_to_full(r, &t);
  247. ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (unsigned char)slide2[i] >> 7);
  248. }
  249. ge25519_p1p1_to_partial(r, &t);
  250. }
  251. }
  252. #if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS)
  253. static uint32_t
  254. ge25519_windowb_equal(uint32_t b, uint32_t c) {
  255. return ((b ^ c) - 1) >> 31;
  256. }
  257. static void
  258. ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const uint8_t table[256][96], uint32_t pos, signed char b) {
  259. bignum25519 neg;
  260. uint32_t sign = (uint32_t)((unsigned char)b >> 7);
  261. uint32_t mask = ~(sign - 1);
  262. uint32_t u = (b + mask) ^ mask;
  263. uint32_t i;
  264. /* ysubx, xaddy, t2d in packed form. initialize to ysubx = 1, xaddy = 1, t2d = 0 */
  265. uint8_t packed[96] = {0};
  266. packed[0] = 1;
  267. packed[32] = 1;
  268. for (i = 0; i < 8; i++)
  269. curve25519_move_conditional_bytes(packed, table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));
  270. /* expand in to t */
  271. curve25519_expand(t->ysubx, packed + 0);
  272. curve25519_expand(t->xaddy, packed + 32);
  273. curve25519_expand(t->t2d , packed + 64);
  274. /* adjust for sign */
  275. curve25519_swap_conditional(t->ysubx, t->xaddy, sign);
  276. curve25519_neg(neg, t->t2d);
  277. curve25519_swap_conditional(t->t2d, neg, sign);
  278. }
  279. #endif /* HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS */
  280. /* computes [s]basepoint */
  281. static void
  282. ge25519_scalarmult_base_niels(ge25519 *r, const uint8_t basepoint_table[256][96], const bignum256modm s) {
  283. signed char b[64];
  284. uint32_t i;
  285. ge25519_niels t;
  286. contract256_window4_modm(b, s);
  287. ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[1]);
  288. curve25519_sub_reduce(r->x, t.xaddy, t.ysubx);
  289. curve25519_add_reduce(r->y, t.xaddy, t.ysubx);
  290. memset(r->z, 0, sizeof(bignum25519));
  291. curve25519_copy(r->t, t.t2d);
  292. r->z[0] = 2;
  293. for (i = 3; i < 64; i += 2) {
  294. ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
  295. ge25519_nielsadd2(r, &t);
  296. }
  297. ge25519_double_partial(r, r);
  298. ge25519_double_partial(r, r);
  299. ge25519_double_partial(r, r);
  300. ge25519_double(r, r);
  301. ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[0]);
  302. curve25519_mul(t.t2d, t.t2d, ge25519_ecd);
  303. ge25519_nielsadd2(r, &t);
  304. for(i = 2; i < 64; i += 2) {
  305. ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);
  306. ge25519_nielsadd2(r, &t);
  307. }
  308. }