1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 #include "tomcrypt_private.h"
4
5 /* automatically generated file, do not edit */
6
7 #define FOR(i,n) for (i = 0;i < n;++i)
8 #define sv static void
9
10 typedef unsigned char u8;
11 typedef ulong32 u32;
12 typedef ulong64 u64;
13 typedef long64 i64;
14 typedef i64 gf[16];
15
16 static const u8
17 nine[32] = {9};
18 static const gf
19 gf0,
20 gf1 = {1},
21 gf121665 = {0xDB41,1},
22 D = {0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203},
23 D2 = {0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406},
24 X = {0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169},
25 Y = {0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666},
26 I = {0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83};
27
vn(const u8 * x,const u8 * y,int n)28 static int vn(const u8 *x,const u8 *y,int n)
29 {
30 int i;
31 u32 d = 0;
32 FOR(i,n) d |= x[i]^y[i];
33 return (1 & ((d - 1) >> 8)) - 1;
34 }
35
tweetnacl_crypto_verify_32(const u8 * x,const u8 * y)36 static int tweetnacl_crypto_verify_32(const u8 *x,const u8 *y)
37 {
38 return vn(x,y,32);
39 }
40
set25519(gf r,const gf a)41 sv set25519(gf r, const gf a)
42 {
43 int i;
44 FOR(i,16) r[i]=a[i];
45 }
46
car25519(gf o)47 sv car25519(gf o)
48 {
49 int i;
50 i64 c;
51 FOR(i,16) {
52 o[i]+=(1LL<<16);
53 c=o[i]>>16;
54 o[(i+1)*(i<15)]+=c-1+37*(c-1)*(i==15);
55 o[i]-=c<<16;
56 }
57 }
58
sel25519(gf p,gf q,int b)59 sv sel25519(gf p,gf q,int b)
60 {
61 i64 t,i,c=~(b-1);
62 FOR(i,16) {
63 t= c&(p[i]^q[i]);
64 p[i]^=t;
65 q[i]^=t;
66 }
67 }
68
pack25519(u8 * o,const gf n)69 sv pack25519(u8 *o,const gf n)
70 {
71 int i,j,b;
72 gf m,t;
73 FOR(i,16) t[i]=n[i];
74 car25519(t);
75 car25519(t);
76 car25519(t);
77 FOR(j,2) {
78 m[0]=t[0]-0xffed;
79 for(i=1;i<15;i++) {
80 m[i]=t[i]-0xffff-((m[i-1]>>16)&1);
81 m[i-1]&=0xffff;
82 }
83 m[15]=t[15]-0x7fff-((m[14]>>16)&1);
84 b=(m[15]>>16)&1;
85 m[14]&=0xffff;
86 sel25519(t,m,1-b);
87 }
88 FOR(i,16) {
89 o[2*i]=t[i]&0xff;
90 o[2*i+1]=t[i]>>8;
91 }
92 }
93
neq25519(const gf a,const gf b)94 static int neq25519(const gf a, const gf b)
95 {
96 u8 c[32],d[32];
97 pack25519(c,a);
98 pack25519(d,b);
99 return tweetnacl_crypto_verify_32(c,d);
100 }
101
par25519(const gf a)102 static u8 par25519(const gf a)
103 {
104 u8 d[32];
105 pack25519(d,a);
106 return d[0]&1;
107 }
108
unpack25519(gf o,const u8 * n)109 sv unpack25519(gf o, const u8 *n)
110 {
111 int i;
112 FOR(i,16) o[i]=n[2*i]+((i64)n[2*i+1]<<8);
113 o[15]&=0x7fff;
114 }
115
A(gf o,const gf a,const gf b)116 sv A(gf o,const gf a,const gf b)
117 {
118 int i;
119 FOR(i,16) o[i]=a[i]+b[i];
120 }
121
Z(gf o,const gf a,const gf b)122 sv Z(gf o,const gf a,const gf b)
123 {
124 int i;
125 FOR(i,16) o[i]=a[i]-b[i];
126 }
127
M(gf o,const gf a,const gf b)128 sv M(gf o,const gf a,const gf b)
129 {
130 i64 i,j,t[31];
131 FOR(i,31) t[i]=0;
132 FOR(i,16) FOR(j,16) t[i+j]+=a[i]*b[j];
133 FOR(i,15) t[i]+=38*t[i+16];
134 FOR(i,16) o[i]=t[i];
135 car25519(o);
136 car25519(o);
137 }
138
S(gf o,const gf a)139 sv S(gf o,const gf a)
140 {
141 M(o,a,a);
142 }
143
inv25519(gf o,const gf i)144 sv inv25519(gf o,const gf i)
145 {
146 gf c;
147 int a;
148 FOR(a,16) c[a]=i[a];
149 for(a=253;a>=0;a--) {
150 S(c,c);
151 if(a!=2&&a!=4) M(c,c,i);
152 }
153 FOR(a,16) o[a]=c[a];
154 }
155
pow2523(gf o,const gf i)156 sv pow2523(gf o,const gf i)
157 {
158 gf c;
159 int a;
160 FOR(a,16) c[a]=i[a];
161 for(a=250;a>=0;a--) {
162 S(c,c);
163 if(a!=1) M(c,c,i);
164 }
165 FOR(a,16) o[a]=c[a];
166 }
167
tweetnacl_crypto_scalarmult(u8 * q,const u8 * n,const u8 * p)168 int tweetnacl_crypto_scalarmult(u8 *q,const u8 *n,const u8 *p)
169 {
170 u8 z[32];
171 i64 x[80],r,i;
172 gf a,b,c,d,e,f;
173 FOR(i,31) z[i]=n[i];
174 z[31]=(n[31]&127)|64;
175 z[0]&=248;
176 unpack25519(x,p);
177 FOR(i,16) {
178 b[i]=x[i];
179 d[i]=a[i]=c[i]=0;
180 }
181 a[0]=d[0]=1;
182 for(i=254;i>=0;--i) {
183 r=(z[i>>3]>>(i&7))&1;
184 sel25519(a,b,r);
185 sel25519(c,d,r);
186 A(e,a,c);
187 Z(a,a,c);
188 A(c,b,d);
189 Z(b,b,d);
190 S(d,e);
191 S(f,a);
192 M(a,c,a);
193 M(c,b,e);
194 A(e,a,c);
195 Z(a,a,c);
196 S(b,a);
197 Z(c,d,f);
198 M(a,c,gf121665);
199 A(a,a,d);
200 M(c,c,a);
201 M(a,d,f);
202 M(d,b,x);
203 S(b,e);
204 sel25519(a,b,r);
205 sel25519(c,d,r);
206 }
207 FOR(i,16) {
208 x[i+16]=a[i];
209 x[i+32]=c[i];
210 x[i+48]=b[i];
211 x[i+64]=d[i];
212 }
213 inv25519(x+32,x+32);
214 M(x+16,x+16,x+32);
215 pack25519(q,x+16);
216 return 0;
217 }
218
tweetnacl_crypto_scalarmult_base(u8 * q,const u8 * n)219 int tweetnacl_crypto_scalarmult_base(u8 *q,const u8 *n)
220 {
221 return tweetnacl_crypto_scalarmult(q,n,nine);
222 }
223
tweetnacl_crypto_hash(u8 * out,const u8 * m,u64 n)224 static int tweetnacl_crypto_hash(u8 *out,const u8 *m,u64 n)
225 {
226 unsigned long len;
227 int err, hash_idx;
228
229 if (n > ULONG_MAX) return CRYPT_OVERFLOW;
230
231 hash_idx = find_hash("sha512");
232 len = 64;
233 if ((err = hash_memory(hash_idx, m, n, out, &len)) != CRYPT_OK) return err;
234
235 return 0;
236 }
237
add(gf p[4],gf q[4])238 sv add(gf p[4],gf q[4])
239 {
240 gf a,b,c,d,t,e,f,g,h;
241
242 Z(a, p[1], p[0]);
243 Z(t, q[1], q[0]);
244 M(a, a, t);
245 A(b, p[0], p[1]);
246 A(t, q[0], q[1]);
247 M(b, b, t);
248 M(c, p[3], q[3]);
249 M(c, c, D2);
250 M(d, p[2], q[2]);
251 A(d, d, d);
252 Z(e, b, a);
253 Z(f, d, c);
254 A(g, d, c);
255 A(h, b, a);
256
257 M(p[0], e, f);
258 M(p[1], h, g);
259 M(p[2], g, f);
260 M(p[3], e, h);
261 }
262
cswap(gf p[4],gf q[4],u8 b)263 sv cswap(gf p[4],gf q[4],u8 b)
264 {
265 int i;
266 FOR(i,4)
267 sel25519(p[i],q[i],b);
268 }
269
pack(u8 * r,gf p[4])270 sv pack(u8 *r,gf p[4])
271 {
272 gf tx, ty, zi;
273 inv25519(zi, p[2]);
274 M(tx, p[0], zi);
275 M(ty, p[1], zi);
276 pack25519(r, ty);
277 r[31] ^= par25519(tx) << 7;
278 }
279
scalarmult(gf p[4],gf q[4],const u8 * s)280 sv scalarmult(gf p[4],gf q[4],const u8 *s)
281 {
282 int i;
283 set25519(p[0],gf0);
284 set25519(p[1],gf1);
285 set25519(p[2],gf1);
286 set25519(p[3],gf0);
287 for (i = 255;i >= 0;--i) {
288 u8 b = (s[i/8]>>(i&7))&1;
289 cswap(p,q,b);
290 add(q,p);
291 add(p,p);
292 cswap(p,q,b);
293 }
294 }
295
scalarbase(gf p[4],const u8 * s)296 sv scalarbase(gf p[4],const u8 *s)
297 {
298 gf q[4];
299 set25519(q[0],X);
300 set25519(q[1],Y);
301 set25519(q[2],gf1);
302 M(q[3],X,Y);
303 scalarmult(p,q,s);
304 }
305
tweetnacl_crypto_sk_to_pk(u8 * pk,const u8 * sk)306 int tweetnacl_crypto_sk_to_pk(u8 *pk, const u8 *sk)
307 {
308 u8 d[64];
309 gf p[4];
310 tweetnacl_crypto_hash(d, sk, 32);
311 d[0] &= 248;
312 d[31] &= 127;
313 d[31] |= 64;
314
315 scalarbase(p,d);
316 pack(pk,p);
317
318 return 0;
319 }
320
tweetnacl_crypto_sign_keypair(prng_state * prng,int wprng,u8 * pk,u8 * sk)321 int tweetnacl_crypto_sign_keypair(prng_state *prng, int wprng, u8 *pk, u8 *sk)
322 {
323 int err;
324
325 /* randombytes(sk,32); */
326 if ((err = prng_is_valid(wprng)) != CRYPT_OK) {
327 return err;
328 }
329
330 if (prng_descriptor[wprng].read(sk,32, prng) != 32) {
331 return CRYPT_ERROR_READPRNG;
332 }
333
334 if ((err = tweetnacl_crypto_sk_to_pk(pk, sk)) != CRYPT_OK) {
335 return err;
336 }
337
338 /* FOR(i,32) sk[32 + i] = pk[i];
339 * we don't copy the pk in the sk */
340 return CRYPT_OK;
341 }
342
343 static const u64 L[32] = {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10};
344
modL(u8 * r,i64 x[64])345 sv modL(u8 *r,i64 x[64])
346 {
347 i64 carry,i,j;
348 for (i = 63;i >= 32;--i) {
349 carry = 0;
350 for (j = i - 32;j < i - 12;++j) {
351 x[j] += carry - 16 * x[i] * L[j - (i - 32)];
352 carry = (x[j] + 128) >> 8;
353 x[j] -= carry << 8;
354 }
355 x[j] += carry;
356 x[i] = 0;
357 }
358 carry = 0;
359 FOR(j,32) {
360 x[j] += carry - (x[31] >> 4) * L[j];
361 carry = x[j] >> 8;
362 x[j] &= 255;
363 }
364 FOR(j,32) x[j] -= carry * L[j];
365 FOR(i,32) {
366 x[i+1] += x[i] >> 8;
367 r[i] = x[i] & 255;
368 }
369 }
370
reduce(u8 * r)371 sv reduce(u8 *r)
372 {
373 i64 x[64],i;
374 FOR(i,64) x[i] = (u64) r[i];
375 FOR(i,64) r[i] = 0;
376 modL(r,x);
377 }
378
tweetnacl_crypto_sign(u8 * sm,u64 * smlen,const u8 * m,u64 mlen,const u8 * sk,const u8 * pk)379 int tweetnacl_crypto_sign(u8 *sm,u64 *smlen,const u8 *m,u64 mlen,const u8 *sk,const u8 *pk)
380 {
381 u8 d[64],h[64],r[64];
382 i64 i,j,x[64];
383 gf p[4];
384
385 tweetnacl_crypto_hash(d, sk, 32);
386 d[0] &= 248;
387 d[31] &= 127;
388 d[31] |= 64;
389
390 *smlen = mlen+64;
391 FOR(i,(i64)mlen) sm[64 + i] = m[i];
392 FOR(i,32) sm[32 + i] = d[32 + i];
393
394 tweetnacl_crypto_hash(r, sm+32, mlen+32);
395 reduce(r);
396 scalarbase(p,r);
397 pack(sm,p);
398
399 FOR(i,32) sm[i+32] = pk[i];
400 tweetnacl_crypto_hash(h,sm,mlen + 64);
401 reduce(h);
402
403 FOR(i,64) x[i] = 0;
404 FOR(i,32) x[i] = (u64) r[i];
405 FOR(i,32) FOR(j,32) x[i+j] += h[i] * (u64) d[j];
406 modL(sm + 32,x);
407
408 return 0;
409 }
410
unpackneg(gf r[4],const u8 p[32])411 static int unpackneg(gf r[4],const u8 p[32])
412 {
413 gf t, chk, num, den, den2, den4, den6;
414 set25519(r[2],gf1);
415 unpack25519(r[1],p);
416 S(num,r[1]);
417 M(den,num,D);
418 Z(num,num,r[2]);
419 A(den,r[2],den);
420
421 S(den2,den);
422 S(den4,den2);
423 M(den6,den4,den2);
424 M(t,den6,num);
425 M(t,t,den);
426
427 pow2523(t,t);
428 M(t,t,num);
429 M(t,t,den);
430 M(t,t,den);
431 M(r[0],t,den);
432
433 S(chk,r[0]);
434 M(chk,chk,den);
435 if (neq25519(chk, num)) M(r[0],r[0],I);
436
437 S(chk,r[0]);
438 M(chk,chk,den);
439 if (neq25519(chk, num)) return -1;
440
441 if (par25519(r[0]) == (p[31]>>7)) Z(r[0],gf0,r[0]);
442
443 M(r[3],r[0],r[1]);
444 return 0;
445 }
446
tweetnacl_crypto_sign_open(int * stat,u8 * m,u64 * mlen,const u8 * sm,u64 smlen,const u8 * pk)447 int tweetnacl_crypto_sign_open(int *stat, u8 *m,u64 *mlen,const u8 *sm,u64 smlen,const u8 *pk)
448 {
449 u64 i;
450 u8 s[32],t[32],h[64];
451 gf p[4],q[4];
452
453 *stat = 0;
454 if (*mlen < smlen) return CRYPT_BUFFER_OVERFLOW;
455 *mlen = -1;
456 if (smlen < 64) return CRYPT_INVALID_ARG;
457
458 if (unpackneg(q,pk)) return CRYPT_ERROR;
459
460 XMEMMOVE(m,sm,smlen);
461 XMEMMOVE(s,m + 32,32);
462 XMEMMOVE(m + 32,pk,32);
463 tweetnacl_crypto_hash(h,m,smlen);
464 reduce(h);
465 scalarmult(p,q,h);
466
467 scalarbase(q,s);
468 add(p,q);
469 pack(t,p);
470
471 smlen -= 64;
472 if (tweetnacl_crypto_verify_32(sm, t)) {
473 FOR(i,smlen) m[i] = 0;
474 zeromem(m, smlen);
475 return CRYPT_OK;
476 }
477
478 *stat = 1;
479 XMEMMOVE(m,m + 64,smlen);
480 *mlen = smlen;
481 return CRYPT_OK;
482 }
483