crypto_ed25519.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736
  1. /* Copyright (c) 2013-2016, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file crypto_ed25519.c
  5. *
  6. * \brief Wrapper code for an ed25519 implementation.
  7. *
  8. * Ed25519 is a Schnorr signature on a Twisted Edwards curve, defined
  9. * by Dan Bernstein. For more information, see https://ed25519.cr.yp.to/
  10. *
  11. * This module wraps our choice of Ed25519 backend, and provides a few
  12. * convenience functions for checking and generating signatures. It also
  13. * provides Tor-specific tools for key blinding and for converting Ed25519
  14. * keys to and from the corresponding Curve25519 keys.
  15. */
  16. #include "orconfig.h"
  17. #ifdef HAVE_SYS_STAT_H
  18. #include <sys/stat.h>
  19. #endif
  20. #include "crypto.h"
  21. #include "crypto_curve25519.h"
  22. #include "crypto_ed25519.h"
  23. #include "crypto_format.h"
  24. #include "torlog.h"
  25. #include "util.h"
  26. #include "ed25519/ref10/ed25519_ref10.h"
  27. #include "ed25519/donna/ed25519_donna_tor.h"
  28. #include <openssl/sha.h>
  29. static void pick_ed25519_impl(void);
  30. static int ed25519_impl_spot_check(void);
  31. /** An Ed25519 implementation, as a set of function pointers. */
  32. typedef struct {
  33. int (*selftest)(void);
  34. int (*seckey)(unsigned char *);
  35. int (*seckey_expand)(unsigned char *, const unsigned char *);
  36. int (*pubkey)(unsigned char *, const unsigned char *);
  37. int (*keygen)(unsigned char *, unsigned char *);
  38. int (*open)(const unsigned char *, const unsigned char *, size_t, const
  39. unsigned char *);
  40. int (*sign)(unsigned char *, const unsigned char *, size_t,
  41. const unsigned char *, const unsigned char *);
  42. int (*open_batch)(const unsigned char **, size_t *, const unsigned char **,
  43. const unsigned char **, size_t, int *);
  44. int (*blind_secret_key)(unsigned char *, const unsigned char *,
  45. const unsigned char *);
  46. int (*blind_public_key)(unsigned char *, const unsigned char *,
  47. const unsigned char *);
  48. int (*pubkey_from_curve25519_pubkey)(unsigned char *, const unsigned char *,
  49. int);
  50. } ed25519_impl_t;
  51. /** The Ref10 Ed25519 implementation. This one is pure C and lightly
  52. * optimized. */
  53. static const ed25519_impl_t impl_ref10 = {
  54. NULL,
  55. ed25519_ref10_seckey,
  56. ed25519_ref10_seckey_expand,
  57. ed25519_ref10_pubkey,
  58. ed25519_ref10_keygen,
  59. ed25519_ref10_open,
  60. ed25519_ref10_sign,
  61. NULL,
  62. ed25519_ref10_blind_secret_key,
  63. ed25519_ref10_blind_public_key,
  64. ed25519_ref10_pubkey_from_curve25519_pubkey,
  65. };
  66. /** The Ref10 Ed25519 implementation. This one is heavily optimized, but still
  67. * mostly C. The C still tends to be heavily platform-specific. */
  68. static const ed25519_impl_t impl_donna = {
  69. ed25519_donna_selftest,
  70. ed25519_donna_seckey,
  71. ed25519_donna_seckey_expand,
  72. ed25519_donna_pubkey,
  73. ed25519_donna_keygen,
  74. ed25519_donna_open,
  75. ed25519_donna_sign,
  76. ed25519_sign_open_batch_donna,
  77. ed25519_donna_blind_secret_key,
  78. ed25519_donna_blind_public_key,
  79. ed25519_donna_pubkey_from_curve25519_pubkey,
  80. };
  81. /** Which Ed25519 implementation are we using? NULL if we haven't decided
  82. * yet. */
  83. static const ed25519_impl_t *ed25519_impl = NULL;
  84. /** Helper: Return our chosen Ed25519 implementation.
  85. *
  86. * This should only be called after we've picked an implementation, but
  87. * it _does_ recover if you forget this.
  88. **/
  89. static inline const ed25519_impl_t *
  90. get_ed_impl(void)
  91. {
  92. if (BUG(ed25519_impl == NULL)) {
  93. pick_ed25519_impl(); // LCOV_EXCL_LINE - We always call ed25519_init().
  94. }
  95. return ed25519_impl;
  96. }
  97. #ifdef TOR_UNIT_TESTS
  98. /** For testing: used to remember our actual choice of Ed25519
  99. * implementation */
  100. static const ed25519_impl_t *saved_ed25519_impl = NULL;
  101. /** For testing: Use the Ed25519 implementation called <b>name</b> until
  102. * crypto_ed25519_testing_restore_impl is called. Recognized names are
  103. * "donna" and "ref10". */
  104. void
  105. crypto_ed25519_testing_force_impl(const char *name)
  106. {
  107. tor_assert(saved_ed25519_impl == NULL);
  108. saved_ed25519_impl = ed25519_impl;
  109. if (! strcmp(name, "donna")) {
  110. ed25519_impl = &impl_donna;
  111. } else {
  112. tor_assert(!strcmp(name, "ref10"));
  113. ed25519_impl = &impl_ref10;
  114. }
  115. }
  116. /** For testing: go back to whatever Ed25519 implementation we had picked
  117. * before crypto_ed25519_testing_force_impl was called.
  118. */
  119. void
  120. crypto_ed25519_testing_restore_impl(void)
  121. {
  122. ed25519_impl = saved_ed25519_impl;
  123. saved_ed25519_impl = NULL;
  124. }
  125. #endif
  126. /**
  127. * Initialize a new ed25519 secret key in <b>seckey_out</b>. If
  128. * <b>extra_strong</b>, take the RNG inputs directly from the operating
  129. * system. Return 0 on success, -1 on failure.
  130. */
  131. int
  132. ed25519_secret_key_generate(ed25519_secret_key_t *seckey_out,
  133. int extra_strong)
  134. {
  135. int r;
  136. uint8_t seed[32];
  137. if (extra_strong)
  138. crypto_strongest_rand(seed, sizeof(seed));
  139. else
  140. crypto_rand((char*)seed, sizeof(seed));
  141. r = get_ed_impl()->seckey_expand(seckey_out->seckey, seed);
  142. memwipe(seed, 0, sizeof(seed));
  143. return r < 0 ? -1 : 0;
  144. }
  145. /**
  146. * Given a 32-byte random seed in <b>seed</b>, expand it into an ed25519
  147. * secret key in <b>seckey_out</b>. Return 0 on success, -1 on failure.
  148. */
  149. int
  150. ed25519_secret_key_from_seed(ed25519_secret_key_t *seckey_out,
  151. const uint8_t *seed)
  152. {
  153. if (get_ed_impl()->seckey_expand(seckey_out->seckey, seed) < 0)
  154. return -1;
  155. return 0;
  156. }
  157. /**
  158. * Given a secret key in <b>seckey</b>, expand it into an
  159. * ed25519 public key. Return 0 on success, -1 on failure.
  160. */
  161. int
  162. ed25519_public_key_generate(ed25519_public_key_t *pubkey_out,
  163. const ed25519_secret_key_t *seckey)
  164. {
  165. if (get_ed_impl()->pubkey(pubkey_out->pubkey, seckey->seckey) < 0)
  166. return -1;
  167. return 0;
  168. }
  169. /** Generate a new ed25519 keypair in <b>keypair_out</b>. If
  170. * <b>extra_strong</b> is set, try to mix some system entropy into the key
  171. * generation process. Return 0 on success, -1 on failure. */
  172. int
  173. ed25519_keypair_generate(ed25519_keypair_t *keypair_out, int extra_strong)
  174. {
  175. if (ed25519_secret_key_generate(&keypair_out->seckey, extra_strong) < 0)
  176. return -1;
  177. if (ed25519_public_key_generate(&keypair_out->pubkey,
  178. &keypair_out->seckey)<0)
  179. return -1;
  180. return 0;
  181. }
  182. /* Return a heap-allocated array that contains <b>msg</b> prefixed by the
  183. * string <b>prefix_str</b>. Set <b>final_msg_len_out</b> to the size of the
  184. * final array. If an error occured, return NULL. It's the resonsibility of the
  185. * caller to free the returned array. */
  186. static uint8_t *
  187. get_prefixed_msg(const uint8_t *msg, size_t msg_len,
  188. const char *prefix_str,
  189. size_t *final_msg_len_out)
  190. {
  191. size_t prefixed_msg_len, prefix_len;
  192. uint8_t *prefixed_msg;
  193. tor_assert(prefix_str);
  194. tor_assert(final_msg_len_out);
  195. prefix_len = strlen(prefix_str);
  196. /* msg_len + strlen(prefix_str) must not overflow. */
  197. if (msg_len > SIZE_T_CEILING - prefix_len) {
  198. return NULL;
  199. }
  200. prefixed_msg_len = msg_len + prefix_len;
  201. prefixed_msg = tor_malloc_zero(prefixed_msg_len);
  202. memcpy(prefixed_msg, prefix_str, prefix_len);
  203. memcpy(prefixed_msg + prefix_len, msg, msg_len);
  204. *final_msg_len_out = prefixed_msg_len;
  205. return prefixed_msg;
  206. }
  207. /**
  208. * Set <b>signature_out</b> to a signature of the <b>len</b>-byte message
  209. * <b>msg</b>, using the secret and public key in <b>keypair</b>.
  210. *
  211. * Return 0 if we successfuly signed the message, otherwise return -1.
  212. */
  213. int
  214. ed25519_sign(ed25519_signature_t *signature_out,
  215. const uint8_t *msg, size_t len,
  216. const ed25519_keypair_t *keypair)
  217. {
  218. if (get_ed_impl()->sign(signature_out->sig, msg, len,
  219. keypair->seckey.seckey,
  220. keypair->pubkey.pubkey) < 0) {
  221. return -1;
  222. }
  223. return 0;
  224. }
  225. /**
  226. * Like ed25519_sign(), but also prefix <b>msg</b> with <b>prefix_str</b>
  227. * before signing. <b>prefix_str</b> must be a NUL-terminated string.
  228. */
  229. int
  230. ed25519_sign_prefixed(ed25519_signature_t *signature_out,
  231. const uint8_t *msg, size_t msg_len,
  232. const char *prefix_str,
  233. const ed25519_keypair_t *keypair)
  234. {
  235. int retval;
  236. size_t prefixed_msg_len;
  237. uint8_t *prefixed_msg;
  238. tor_assert(prefix_str);
  239. prefixed_msg = get_prefixed_msg(msg, msg_len, prefix_str,
  240. &prefixed_msg_len);
  241. if (!prefixed_msg) {
  242. log_warn(LD_GENERAL, "Failed to get prefixed msg.");
  243. return -1;
  244. }
  245. retval = ed25519_sign(signature_out,
  246. prefixed_msg, prefixed_msg_len,
  247. keypair);
  248. tor_free(prefixed_msg);
  249. return retval;
  250. }
  251. /**
  252. * Check whether if <b>signature</b> is a valid signature for the
  253. * <b>len</b>-byte message in <b>msg</b> made with the key <b>pubkey</b>.
  254. *
  255. * Return 0 if the signature is valid; -1 if it isn't.
  256. */
  257. int
  258. ed25519_checksig(const ed25519_signature_t *signature,
  259. const uint8_t *msg, size_t len,
  260. const ed25519_public_key_t *pubkey)
  261. {
  262. return
  263. get_ed_impl()->open(signature->sig, msg, len, pubkey->pubkey) < 0 ? -1 : 0;
  264. }
  265. /**
  266. * Like ed2519_checksig(), but also prefix <b>msg</b> with <b>prefix_str</b>
  267. * before verifying signature. <b>prefix_str</b> must be a NUL-terminated
  268. * string.
  269. */
  270. int
  271. ed25519_checksig_prefixed(const ed25519_signature_t *signature,
  272. const uint8_t *msg, size_t msg_len,
  273. const char *prefix_str,
  274. const ed25519_public_key_t *pubkey)
  275. {
  276. int retval;
  277. size_t prefixed_msg_len;
  278. uint8_t *prefixed_msg;
  279. prefixed_msg = get_prefixed_msg(msg, msg_len, prefix_str,
  280. &prefixed_msg_len);
  281. if (!prefixed_msg) {
  282. log_warn(LD_GENERAL, "Failed to get prefixed msg.");
  283. return -1;
  284. }
  285. retval = ed25519_checksig(signature,
  286. prefixed_msg, prefixed_msg_len,
  287. pubkey);
  288. tor_free(prefixed_msg);
  289. return retval;
  290. }
  291. /** Validate every signature among those in <b>checkable</b>, which contains
  292. * exactly <b>n_checkable</b> elements. If <b>okay_out</b> is non-NULL, set
  293. * the i'th element of <b>okay_out</b> to 1 if the i'th element of
  294. * <b>checkable</b> is valid, and to 0 otherwise. Return 0 if every signature
  295. * was valid. Otherwise return -N, where N is the number of invalid
  296. * signatures.
  297. */
  298. int
  299. ed25519_checksig_batch(int *okay_out,
  300. const ed25519_checkable_t *checkable,
  301. int n_checkable)
  302. {
  303. int i, res;
  304. const ed25519_impl_t *impl = get_ed_impl();
  305. if (impl->open_batch == NULL) {
  306. /* No batch verification implementation available, fake it by checking the
  307. * each signature individually.
  308. */
  309. res = 0;
  310. for (i = 0; i < n_checkable; ++i) {
  311. const ed25519_checkable_t *ch = &checkable[i];
  312. int r = ed25519_checksig(&ch->signature, ch->msg, ch->len, ch->pubkey);
  313. if (r < 0)
  314. --res;
  315. if (okay_out)
  316. okay_out[i] = (r == 0);
  317. }
  318. } else {
  319. /* ed25519-donna style batch verification available.
  320. *
  321. * Theoretically, this should only be called if n_checkable >= 3, since
  322. * that's the threshold where the batch verification actually kicks in,
  323. * but the only difference is a few mallocs/frees.
  324. */
  325. const uint8_t **ms;
  326. size_t *lens;
  327. const uint8_t **pks;
  328. const uint8_t **sigs;
  329. int *oks;
  330. int all_ok;
  331. ms = tor_calloc(n_checkable, sizeof(uint8_t*));
  332. lens = tor_calloc(n_checkable, sizeof(size_t));
  333. pks = tor_calloc(n_checkable, sizeof(uint8_t*));
  334. sigs = tor_calloc(n_checkable, sizeof(uint8_t*));
  335. oks = okay_out ? okay_out : tor_calloc(n_checkable, sizeof(int));
  336. for (i = 0; i < n_checkable; ++i) {
  337. ms[i] = checkable[i].msg;
  338. lens[i] = checkable[i].len;
  339. pks[i] = checkable[i].pubkey->pubkey;
  340. sigs[i] = checkable[i].signature.sig;
  341. oks[i] = 0;
  342. }
  343. res = 0;
  344. all_ok = impl->open_batch(ms, lens, pks, sigs, n_checkable, oks);
  345. for (i = 0; i < n_checkable; ++i) {
  346. if (!oks[i])
  347. --res;
  348. }
  349. /* XXX: For now sanity check oks with the return value. Once we have
  350. * more confidence in the code, if `all_ok == 0` we can skip iterating
  351. * over oks since all the signatures were found to be valid.
  352. */
  353. tor_assert(((res == 0) && !all_ok) || ((res < 0) && all_ok));
  354. tor_free(ms);
  355. tor_free(lens);
  356. tor_free(pks);
  357. tor_free(sigs);
  358. if (! okay_out)
  359. tor_free(oks);
  360. }
  361. return res;
  362. }
  363. /**
  364. * Given a curve25519 keypair in <b>inp</b>, generate a corresponding
  365. * ed25519 keypair in <b>out</b>, and set <b>signbit_out</b> to the
  366. * sign bit of the X coordinate of the ed25519 key.
  367. *
  368. * NOTE THAT IT IS PROBABLY NOT SAFE TO USE THE GENERATED KEY FOR ANYTHING
  369. * OUTSIDE OF WHAT'S PRESENTED IN PROPOSAL 228. In particular, it's probably
  370. * not a great idea to use it to sign attacker-supplied anything.
  371. */
  372. int
  373. ed25519_keypair_from_curve25519_keypair(ed25519_keypair_t *out,
  374. int *signbit_out,
  375. const curve25519_keypair_t *inp)
  376. {
  377. const char string[] = "Derive high part of ed25519 key from curve25519 key";
  378. ed25519_public_key_t pubkey_check;
  379. SHA512_CTX ctx;
  380. uint8_t sha512_output[64];
  381. memcpy(out->seckey.seckey, inp->seckey.secret_key, 32);
  382. SHA512_Init(&ctx);
  383. SHA512_Update(&ctx, out->seckey.seckey, 32);
  384. SHA512_Update(&ctx, string, sizeof(string));
  385. SHA512_Final(sha512_output, &ctx);
  386. memcpy(out->seckey.seckey + 32, sha512_output, 32);
  387. ed25519_public_key_generate(&out->pubkey, &out->seckey);
  388. *signbit_out = out->pubkey.pubkey[31] >> 7;
  389. ed25519_public_key_from_curve25519_public_key(&pubkey_check, &inp->pubkey,
  390. *signbit_out);
  391. tor_assert(fast_memeq(pubkey_check.pubkey, out->pubkey.pubkey, 32));
  392. memwipe(&pubkey_check, 0, sizeof(pubkey_check));
  393. memwipe(&ctx, 0, sizeof(ctx));
  394. memwipe(sha512_output, 0, sizeof(sha512_output));
  395. return 0;
  396. }
  397. /**
  398. * Given a curve25519 public key and sign bit of X coordinate of the ed25519
  399. * public key, generate the corresponding ed25519 public key.
  400. */
  401. int
  402. ed25519_public_key_from_curve25519_public_key(ed25519_public_key_t *pubkey,
  403. const curve25519_public_key_t *pubkey_in,
  404. int signbit)
  405. {
  406. return get_ed_impl()->pubkey_from_curve25519_pubkey(pubkey->pubkey,
  407. pubkey_in->public_key,
  408. signbit);
  409. }
  410. /**
  411. * Given an ed25519 keypair in <b>inp</b>, generate a corresponding
  412. * ed25519 keypair in <b>out</b>, blinded by the corresponding 32-byte input
  413. * in 'param'.
  414. *
  415. * Tor uses key blinding for the "next-generation" hidden services design:
  416. * service descriptors are encrypted with a key derived from the service's
  417. * long-term public key, and then signed with (and stored at a position
  418. * indexed by) a short-term key derived by blinding the long-term keys.
  419. */
  420. int
  421. ed25519_keypair_blind(ed25519_keypair_t *out,
  422. const ed25519_keypair_t *inp,
  423. const uint8_t *param)
  424. {
  425. ed25519_public_key_t pubkey_check;
  426. get_ed_impl()->blind_secret_key(out->seckey.seckey,
  427. inp->seckey.seckey, param);
  428. ed25519_public_blind(&pubkey_check, &inp->pubkey, param);
  429. ed25519_public_key_generate(&out->pubkey, &out->seckey);
  430. tor_assert(fast_memeq(pubkey_check.pubkey, out->pubkey.pubkey, 32));
  431. memwipe(&pubkey_check, 0, sizeof(pubkey_check));
  432. return 0;
  433. }
  434. /**
  435. * Given an ed25519 public key in <b>inp</b>, generate a corresponding blinded
  436. * public key in <b>out</b>, blinded with the 32-byte parameter in
  437. * <b>param</b>. Return 0 on sucess, -1 on railure.
  438. */
  439. int
  440. ed25519_public_blind(ed25519_public_key_t *out,
  441. const ed25519_public_key_t *inp,
  442. const uint8_t *param)
  443. {
  444. get_ed_impl()->blind_public_key(out->pubkey, inp->pubkey, param);
  445. return 0;
  446. }
  447. /**
  448. * Store seckey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  449. * Return 0 on success, -1 on failure.
  450. */
  451. int
  452. ed25519_seckey_write_to_file(const ed25519_secret_key_t *seckey,
  453. const char *filename,
  454. const char *tag)
  455. {
  456. return crypto_write_tagged_contents_to_file(filename,
  457. "ed25519v1-secret",
  458. tag,
  459. seckey->seckey,
  460. sizeof(seckey->seckey));
  461. }
  462. /**
  463. * Read seckey unencrypted from <b>filename</b>, storing it into
  464. * <b>seckey_out</b>. Set *<b>tag_out</b> to the tag it was marked with.
  465. * Return 0 on success, -1 on failure.
  466. */
  467. int
  468. ed25519_seckey_read_from_file(ed25519_secret_key_t *seckey_out,
  469. char **tag_out,
  470. const char *filename)
  471. {
  472. ssize_t len;
  473. len = crypto_read_tagged_contents_from_file(filename, "ed25519v1-secret",
  474. tag_out, seckey_out->seckey,
  475. sizeof(seckey_out->seckey));
  476. if (len == sizeof(seckey_out->seckey)) {
  477. return 0;
  478. } else if (len >= 0) {
  479. errno = EINVAL;
  480. }
  481. tor_free(*tag_out);
  482. return -1;
  483. }
  484. /**
  485. * Store pubkey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  486. * Return 0 on success, -1 on failure.
  487. */
  488. int
  489. ed25519_pubkey_write_to_file(const ed25519_public_key_t *pubkey,
  490. const char *filename,
  491. const char *tag)
  492. {
  493. return crypto_write_tagged_contents_to_file(filename,
  494. "ed25519v1-public",
  495. tag,
  496. pubkey->pubkey,
  497. sizeof(pubkey->pubkey));
  498. }
  499. /**
  500. * Store pubkey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  501. * Return 0 on success, -1 on failure.
  502. */
  503. int
  504. ed25519_pubkey_read_from_file(ed25519_public_key_t *pubkey_out,
  505. char **tag_out,
  506. const char *filename)
  507. {
  508. ssize_t len;
  509. len = crypto_read_tagged_contents_from_file(filename, "ed25519v1-public",
  510. tag_out, pubkey_out->pubkey,
  511. sizeof(pubkey_out->pubkey));
  512. if (len == sizeof(pubkey_out->pubkey)) {
  513. return 0;
  514. } else if (len >= 0) {
  515. errno = EINVAL;
  516. }
  517. tor_free(*tag_out);
  518. return -1;
  519. }
  520. /** Release all storage held for <b>kp</b>. */
  521. void
  522. ed25519_keypair_free(ed25519_keypair_t *kp)
  523. {
  524. if (! kp)
  525. return;
  526. memwipe(kp, 0, sizeof(*kp));
  527. tor_free(kp);
  528. }
  529. /** Return true iff <b>key1</b> and <b>key2</b> are the same public key. */
  530. int
  531. ed25519_pubkey_eq(const ed25519_public_key_t *key1,
  532. const ed25519_public_key_t *key2)
  533. {
  534. tor_assert(key1);
  535. tor_assert(key2);
  536. return tor_memeq(key1->pubkey, key2->pubkey, ED25519_PUBKEY_LEN);
  537. }
  538. /** Check whether the given Ed25519 implementation seems to be working.
  539. * If so, return 0; otherwise return -1. */
  540. static int
  541. ed25519_impl_spot_check(void)
  542. {
  543. static const uint8_t alicesk[32] = {
  544. 0xc5,0xaa,0x8d,0xf4,0x3f,0x9f,0x83,0x7b,
  545. 0xed,0xb7,0x44,0x2f,0x31,0xdc,0xb7,0xb1,
  546. 0x66,0xd3,0x85,0x35,0x07,0x6f,0x09,0x4b,
  547. 0x85,0xce,0x3a,0x2e,0x0b,0x44,0x58,0xf7
  548. };
  549. static const uint8_t alicepk[32] = {
  550. 0xfc,0x51,0xcd,0x8e,0x62,0x18,0xa1,0xa3,
  551. 0x8d,0xa4,0x7e,0xd0,0x02,0x30,0xf0,0x58,
  552. 0x08,0x16,0xed,0x13,0xba,0x33,0x03,0xac,
  553. 0x5d,0xeb,0x91,0x15,0x48,0x90,0x80,0x25
  554. };
  555. static const uint8_t alicemsg[2] = { 0xaf, 0x82 };
  556. static const uint8_t alicesig[64] = {
  557. 0x62,0x91,0xd6,0x57,0xde,0xec,0x24,0x02,
  558. 0x48,0x27,0xe6,0x9c,0x3a,0xbe,0x01,0xa3,
  559. 0x0c,0xe5,0x48,0xa2,0x84,0x74,0x3a,0x44,
  560. 0x5e,0x36,0x80,0xd7,0xdb,0x5a,0xc3,0xac,
  561. 0x18,0xff,0x9b,0x53,0x8d,0x16,0xf2,0x90,
  562. 0xae,0x67,0xf7,0x60,0x98,0x4d,0xc6,0x59,
  563. 0x4a,0x7c,0x15,0xe9,0x71,0x6e,0xd2,0x8d,
  564. 0xc0,0x27,0xbe,0xce,0xea,0x1e,0xc4,0x0a
  565. };
  566. const ed25519_impl_t *impl = get_ed_impl();
  567. uint8_t sk[ED25519_SECKEY_LEN];
  568. uint8_t pk[ED25519_PUBKEY_LEN];
  569. uint8_t sig[ED25519_SIG_LEN];
  570. int r = 0;
  571. /* Some implementations (eg: The modified Ed25519-donna) have handy self-test
  572. * code that sanity-checks the internals. If present, use that to screen out
  573. * catastrophic errors like massive compiler failure.
  574. */
  575. if (impl->selftest && impl->selftest() != 0)
  576. goto fail;
  577. /* Validate results versus known answer tests. People really should be
  578. * running "make test" instead of relying on this, but it's better than
  579. * nothing.
  580. *
  581. * Test vectors taken from "EdDSA & Ed25519 - 6. Test Vectors for Ed25519
  582. * (TEST3)" (draft-josefsson-eddsa-ed25519-03).
  583. */
  584. /* Key expansion, public key derivation. */
  585. if (impl->seckey_expand(sk, alicesk) < 0)
  586. goto fail;
  587. if (impl->pubkey(pk, sk) < 0)
  588. goto fail;
  589. if (fast_memneq(pk, alicepk, ED25519_PUBKEY_LEN))
  590. goto fail;
  591. /* Signing, verification. */
  592. if (impl->sign(sig, alicemsg, sizeof(alicemsg), sk, pk) < 0)
  593. return -1;
  594. if (fast_memneq(sig, alicesig, ED25519_SIG_LEN))
  595. return -1;
  596. if (impl->open(sig, alicemsg, sizeof(alicemsg), pk) < 0)
  597. return -1;
  598. /* XXX/yawning: Someone that's more paranoid than I am, can write "Assume
  599. * ref0 is cannonical, and fuzz impl against it" if they want, but I doubt
  600. * that will catch anything that the known answer tests won't.
  601. */
  602. goto end;
  603. fail:
  604. r = -1;
  605. end:
  606. return r;
  607. }
  608. /** Force the Ed25519 implementation to a given one, without sanity checking
  609. * the output. Used for testing.
  610. */
  611. void
  612. ed25519_set_impl_params(int use_donna)
  613. {
  614. if (use_donna)
  615. ed25519_impl = &impl_donna;
  616. else
  617. ed25519_impl = &impl_ref10;
  618. }
  619. /** Choose whether to use the Ed25519-donna implementation. */
  620. static void
  621. pick_ed25519_impl(void)
  622. {
  623. ed25519_impl = &impl_donna;
  624. if (ed25519_impl_spot_check() == 0)
  625. return;
  626. /* LCOV_EXCL_START
  627. * unreachable unless ed25519_donna is broken */
  628. log_warn(LD_CRYPTO, "The Ed25519-donna implementation seems broken; using "
  629. "the ref10 implementation.");
  630. ed25519_impl = &impl_ref10;
  631. /* LCOV_EXCL_STOP */
  632. }
  633. /* Initialize the Ed25519 implementation. This is neccessary if you're
  634. * going to use them in a multithreaded setting, and not otherwise. */
  635. void
  636. ed25519_init(void)
  637. {
  638. pick_ed25519_impl();
  639. }