crypto_ed25519.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353
  1. /* Copyright (c) 2013-2015, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /* Wrapper code for an ed25519 implementation. */
  4. #include "orconfig.h"
  5. #ifdef HAVE_SYS_STAT_H
  6. #include <sys/stat.h>
  7. #endif
  8. #include "crypto.h"
  9. #include "crypto_curve25519.h"
  10. #include "crypto_ed25519.h"
  11. #include "torlog.h"
  12. #include "util.h"
  13. #include "ed25519/ref10/ed25519_ref10.h"
  14. #include <openssl/sha.h>
  15. /**
  16. * Initialize a new ed25519 secret key in <b>seckey_out</b>. If
  17. * <b>extra_strong</b>, take the RNG inputs directly from the operating
  18. * system. Return 0 on success, -1 on failure.
  19. */
  20. int
  21. ed25519_secret_key_generate(ed25519_secret_key_t *seckey_out,
  22. int extra_strong)
  23. {
  24. int r;
  25. uint8_t seed[32];
  26. if (! extra_strong || crypto_strongest_rand(seed, sizeof(seed)) < 0)
  27. crypto_rand((char*)seed, sizeof(seed));
  28. r = ed25519_ref10_seckey_expand(seckey_out->seckey, seed);
  29. memwipe(seed, 0, sizeof(seed));
  30. return r < 0 ? -1 : 0;
  31. }
  32. /**
  33. * Given a 32-byte random seed in <b>seed</b>, expand it into an ed25519
  34. * secret key in <b>seckey_out</b>. Return 0 on success, -1 on failure.
  35. */
  36. int
  37. ed25519_secret_key_from_seed(ed25519_secret_key_t *seckey_out,
  38. const uint8_t *seed)
  39. {
  40. if (ed25519_ref10_seckey_expand(seckey_out->seckey, seed) < 0)
  41. return -1;
  42. return 0;
  43. }
  44. /**
  45. * Given a secret key in <b>seckey</b>, expand it into an
  46. * ed25519 public key. Return 0 on success, -1 on failure.
  47. */
  48. int
  49. ed25519_public_key_generate(ed25519_public_key_t *pubkey_out,
  50. const ed25519_secret_key_t *seckey)
  51. {
  52. if (ed25519_ref10_pubkey(pubkey_out->pubkey, seckey->seckey) < 0)
  53. return -1;
  54. return 0;
  55. }
  56. /** Generate a new ed25519 keypair in <b>keypair_out</b>. If
  57. * <b>extra_strong</b> is set, try to mix some system entropy into the key
  58. * generation process. Return 0 on success, -1 on failure. */
  59. int
  60. ed25519_keypair_generate(ed25519_keypair_t *keypair_out, int extra_strong)
  61. {
  62. if (ed25519_secret_key_generate(&keypair_out->seckey, extra_strong) < 0)
  63. return -1;
  64. if (ed25519_public_key_generate(&keypair_out->pubkey,
  65. &keypair_out->seckey)<0)
  66. return -1;
  67. return 0;
  68. }
  69. /**
  70. * Set <b>signature_out</b> to a signature of the <b>len</b>-byte message
  71. * <b>msg</b>, using the secret and public key in <b>keypair</b>.
  72. */
  73. int
  74. ed25519_sign(ed25519_signature_t *signature_out,
  75. const uint8_t *msg, size_t len,
  76. const ed25519_keypair_t *keypair)
  77. {
  78. if (ed25519_ref10_sign(signature_out->sig, msg, len,
  79. keypair->seckey.seckey,
  80. keypair->pubkey.pubkey) < 0) {
  81. return -1;
  82. }
  83. return 0;
  84. }
  85. /**
  86. * Check whether if <b>signature</b> is a valid signature for the
  87. * <b>len</b>-byte message in <b>msg</b> made with the key <b>pubkey</b>.
  88. *
  89. * Return 0 if the signature is valid; -1 if it isn't.
  90. */
  91. int
  92. ed25519_checksig(const ed25519_signature_t *signature,
  93. const uint8_t *msg, size_t len,
  94. const ed25519_public_key_t *pubkey)
  95. {
  96. return
  97. ed25519_ref10_open(signature->sig, msg, len, pubkey->pubkey) < 0 ? -1 : 0;
  98. }
  99. /** Validate every signature among those in <b>checkable</b>, which contains
  100. * exactly <b>n_checkable</b> elements. If <b>okay_out</b> is non-NULL, set
  101. * the i'th element of <b>okay_out</b> to 1 if the i'th element of
  102. * <b>checkable</b> is valid, and to 0 otherwise. Return 0 if every signature
  103. * was valid. Otherwise return -N, where N is the number of invalid
  104. * signatures.
  105. */
  106. int
  107. ed25519_checksig_batch(int *okay_out,
  108. const ed25519_checkable_t *checkable,
  109. int n_checkable)
  110. {
  111. int res, i;
  112. res = 0;
  113. for (i = 0; i < n_checkable; ++i) {
  114. const ed25519_checkable_t *ch = &checkable[i];
  115. int r = ed25519_checksig(&ch->signature, ch->msg, ch->len, ch->pubkey);
  116. if (r < 0)
  117. --res;
  118. if (okay_out)
  119. okay_out[i] = (r == 0);
  120. }
  121. #if 0
  122. /* This is how we'd do it if we were using ed25519_donna. I'll keep this
  123. * code around here in case we ever do that. */
  124. const uint8_t **ms;
  125. size_t *lens;
  126. const uint8_t **pks;
  127. const uint8_t **sigs;
  128. int *oks;
  129. ms = tor_malloc(sizeof(uint8_t*)*n_checkable);
  130. lens = tor_malloc(sizeof(size_t)*n_checkable);
  131. pks = tor_malloc(sizeof(uint8_t*)*n_checkable);
  132. sigs = tor_malloc(sizeof(uint8_t*)*n_checkable);
  133. oks = okay_out ? okay_out : tor_malloc(sizeof(int)*n_checkable);
  134. for (i = 0; i < n_checkable; ++i) {
  135. ms[i] = checkable[i].msg;
  136. lens[i] = checkable[i].len;
  137. pks[i] = checkable[i].pubkey->pubkey;
  138. sigs[i] = checkable[i].signature.sig;
  139. oks[i] = 0;
  140. }
  141. ed25519_sign_open_batch_donna_fb(ms, lens, pks, sigs, n_checkable, oks);
  142. res = 0;
  143. for (i = 0; i < n_checkable; ++i) {
  144. if (!oks[i])
  145. --res;
  146. }
  147. tor_free(ms);
  148. tor_free(lens);
  149. tor_free(pks);
  150. if (! okay_out)
  151. tor_free(oks);
  152. #endif
  153. return res;
  154. }
  155. /**
  156. * Given a curve25519 keypair in <b>inp</b>, generate a corresponding
  157. * ed25519 keypair in <b>out</b>, and set <b>signbit_out</b> to the
  158. * sign bit of the X coordinate of the ed25519 key.
  159. *
  160. * NOTE THAT IT IS PROBABLY NOT SAFE TO USE THE GENERATED KEY FOR ANYTHING
  161. * OUTSIDE OF WHAT'S PRESENTED IN PROPOSAL 228. In particular, it's probably
  162. * not a great idea to use it to sign attacker-supplied anything.
  163. */
  164. int
  165. ed25519_keypair_from_curve25519_keypair(ed25519_keypair_t *out,
  166. int *signbit_out,
  167. const curve25519_keypair_t *inp)
  168. {
  169. const char string[] = "Derive high part of ed25519 key from curve25519 key";
  170. ed25519_public_key_t pubkey_check;
  171. SHA512_CTX ctx;
  172. uint8_t sha512_output[64];
  173. memcpy(out->seckey.seckey, inp->seckey.secret_key, 32);
  174. SHA512_Init(&ctx);
  175. SHA512_Update(&ctx, out->seckey.seckey, 32);
  176. SHA512_Update(&ctx, string, sizeof(string));
  177. SHA512_Final(sha512_output, &ctx);
  178. memcpy(out->seckey.seckey + 32, sha512_output, 32);
  179. ed25519_public_key_generate(&out->pubkey, &out->seckey);
  180. *signbit_out = out->pubkey.pubkey[31] >> 7;
  181. ed25519_public_key_from_curve25519_public_key(&pubkey_check, &inp->pubkey,
  182. *signbit_out);
  183. tor_assert(fast_memeq(pubkey_check.pubkey, out->pubkey.pubkey, 32));
  184. memwipe(&pubkey_check, 0, sizeof(pubkey_check));
  185. memwipe(&ctx, 0, sizeof(ctx));
  186. memwipe(sha512_output, 0, sizeof(sha512_output));
  187. return 0;
  188. }
  189. /**
  190. * Given a curve25519 public key and sign bit of X coordinate of the ed25519
  191. * public key, generate the corresponding ed25519 public key.
  192. */
  193. int
  194. ed25519_public_key_from_curve25519_public_key(ed25519_public_key_t *pubkey,
  195. const curve25519_public_key_t *pubkey_in,
  196. int signbit)
  197. {
  198. return ed25519_ref10_pubkey_from_curve25519_pubkey(pubkey->pubkey,
  199. pubkey_in->public_key,
  200. signbit);
  201. }
  202. /**
  203. * Given an ed25519 keypair in <b>inp</b>, generate a corresponding
  204. * ed25519 keypair in <b>out</b>, blinded by the corresponding 32-byte input
  205. * in 'param'.
  206. *
  207. * Tor uses key blinding for the "next-generation" hidden services design:
  208. * service descriptors are encrypted with a key derived from the service's
  209. * long-term public key, and then signed with (and stored at a position
  210. * indexed by) a short-term key derived by blinding the long-term keys.
  211. */
  212. int
  213. ed25519_keypair_blind(ed25519_keypair_t *out,
  214. const ed25519_keypair_t *inp,
  215. const uint8_t *param)
  216. {
  217. ed25519_public_key_t pubkey_check;
  218. ed25519_ref10_blind_secret_key(out->seckey.seckey,
  219. inp->seckey.seckey, param);
  220. ed25519_public_blind(&pubkey_check, &inp->pubkey, param);
  221. ed25519_public_key_generate(&out->pubkey, &out->seckey);
  222. tor_assert(fast_memeq(pubkey_check.pubkey, out->pubkey.pubkey, 32));
  223. memwipe(&pubkey_check, 0, sizeof(pubkey_check));
  224. return 0;
  225. }
  226. /**
  227. * Given an ed25519 public key in <b>inp</b>, generate a corresponding blinded
  228. * public key in <b>out</b>, blinded with the 32-byte parameter in
  229. * <b>param</b>. Return 0 on sucess, -1 on railure.
  230. */
  231. int
  232. ed25519_public_blind(ed25519_public_key_t *out,
  233. const ed25519_public_key_t *inp,
  234. const uint8_t *param)
  235. {
  236. ed25519_ref10_blind_public_key(out->pubkey, inp->pubkey, param);
  237. return 0;
  238. }
  239. /**
  240. * Store seckey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  241. * Return 0 on success, -1 on failure.
  242. */
  243. int
  244. ed25519_seckey_write_to_file(const ed25519_secret_key_t *seckey,
  245. const char *filename,
  246. const char *tag)
  247. {
  248. return crypto_write_tagged_contents_to_file(filename,
  249. "ed25519v1-secret",
  250. tag,
  251. seckey->seckey,
  252. sizeof(seckey->seckey));
  253. }
  254. /**
  255. * Read seckey unencrypted from <b>filename</b>, storing it into
  256. * <b>seckey_out</b>. Set *<b>tag_out</> to the tag it was marked with.
  257. * Return 0 on success, -1 on failure.
  258. */
  259. int
  260. ed25519_seckey_read_from_file(ed25519_secret_key_t *seckey_out,
  261. char **tag_out,
  262. const char *filename)
  263. {
  264. ssize_t len;
  265. len = crypto_read_tagged_contents_from_file(filename, "ed25519v1-secret",
  266. tag_out, seckey_out->seckey,
  267. sizeof(seckey_out->seckey));
  268. if (len != sizeof(seckey_out->seckey))
  269. return -1;
  270. return 0;
  271. }
  272. /**
  273. * Store pubkey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  274. * Return 0 on success, -1 on failure.
  275. */
  276. int
  277. ed25519_pubkey_write_to_file(const ed25519_public_key_t *pubkey,
  278. const char *filename,
  279. const char *tag)
  280. {
  281. return crypto_write_tagged_contents_to_file(filename,
  282. "ed25519v1-public",
  283. tag,
  284. pubkey->pubkey,
  285. sizeof(pubkey->pubkey));
  286. }
  287. /**
  288. * Store pubkey unencrypted to <b>filename</b>, marking it with <b>tag</b>.
  289. * Return 0 on success, -1 on failure.
  290. */
  291. int
  292. ed25519_pubkey_read_from_file(ed25519_public_key_t *pubkey_out,
  293. char **tag_out,
  294. const char *filename)
  295. {
  296. ssize_t len;
  297. len = crypto_read_tagged_contents_from_file(filename, "ed25519v1-public",
  298. tag_out, pubkey_out->pubkey,
  299. sizeof(pubkey_out->pubkey));
  300. if (len != sizeof(pubkey_out->pubkey))
  301. return -1;
  302. return 0;
  303. }