mirror of
https://github.com/taigrr/arduinolibs
synced 2025-01-18 04:33:12 -08:00
580 lines
76 KiB
HTML
580 lines
76 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
|
|
<meta name="generator" content="Doxygen 1.8.6"/>
|
|
<title>ArduinoLibs: Ed25519.cpp Source File</title>
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="jquery.js"></script>
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="search/search.js"></script>
|
|
<script type="text/javascript">
|
|
$(document).ready(function() { searchBox.OnSelectItem(0); });
|
|
</script>
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr style="height: 56px;">
|
|
<td style="padding-left: 0.5em;">
|
|
<div id="projectname">ArduinoLibs
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.8.6 -->
|
|
<script type="text/javascript">
|
|
var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
|
</script>
|
|
<div id="navrow1" class="tabs">
|
|
<ul class="tablist">
|
|
<li><a href="index.html"><span>Main Page</span></a></li>
|
|
<li><a href="pages.html"><span>Related Pages</span></a></li>
|
|
<li><a href="modules.html"><span>Modules</span></a></li>
|
|
<li><a href="annotated.html"><span>Classes</span></a></li>
|
|
<li class="current"><a href="files.html"><span>Files</span></a></li>
|
|
<li>
|
|
<div id="MSearchBox" class="MSearchBoxInactive">
|
|
<span class="left">
|
|
<img id="MSearchSelect" src="search/mag_sel.png"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
alt=""/>
|
|
<input type="text" id="MSearchField" value="Search" accesskey="S"
|
|
onfocus="searchBox.OnSearchFieldFocus(true)"
|
|
onblur="searchBox.OnSearchFieldFocus(false)"
|
|
onkeyup="searchBox.OnSearchFieldChange(event)"/>
|
|
</span><span class="right">
|
|
<a id="MSearchClose" href="javascript:searchBox.CloseResultsWindow()"><img id="MSearchCloseImg" border="0" src="search/close.png" alt=""/></a>
|
|
</span>
|
|
</div>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div id="navrow2" class="tabs2">
|
|
<ul class="tablist">
|
|
<li><a href="files.html"><span>File List</span></a></li>
|
|
</ul>
|
|
</div>
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
<a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(0)"><span class="SelectionMark"> </span>All</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(1)"><span class="SelectionMark"> </span>Classes</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(2)"><span class="SelectionMark"> </span>Files</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(3)"><span class="SelectionMark"> </span>Functions</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(4)"><span class="SelectionMark"> </span>Variables</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(5)"><span class="SelectionMark"> </span>Typedefs</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(6)"><span class="SelectionMark"> </span>Enumerations</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(7)"><span class="SelectionMark"> </span>Enumerator</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(8)"><span class="SelectionMark"> </span>Friends</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(9)"><span class="SelectionMark"> </span>Groups</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(10)"><span class="SelectionMark"> </span>Pages</a></div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
|
name="MSearchResults" id="MSearchResults">
|
|
</iframe>
|
|
</div>
|
|
|
|
<div id="nav-path" class="navpath">
|
|
<ul>
|
|
<li class="navelem"><a class="el" href="dir_bc0718b08fb2015b8e59c47b2805f60c.html">libraries</a></li><li class="navelem"><a class="el" href="dir_e2ce51835550ba18edf07a8311722290.html">Crypto</a></li> </ul>
|
|
</div>
|
|
</div><!-- top -->
|
|
<div class="header">
|
|
<div class="headertitle">
|
|
<div class="title">Ed25519.cpp</div> </div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
<div class="fragment"><div class="line"><a name="l00001"></a><span class="lineno"> 1</span> <span class="comment">/*</span></div>
|
|
<div class="line"><a name="l00002"></a><span class="lineno"> 2</span> <span class="comment"> * Copyright (C) 2015 Southern Storm Software, Pty Ltd.</span></div>
|
|
<div class="line"><a name="l00003"></a><span class="lineno"> 3</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00004"></a><span class="lineno"> 4</span> <span class="comment"> * Permission is hereby granted, free of charge, to any person obtaining a</span></div>
|
|
<div class="line"><a name="l00005"></a><span class="lineno"> 5</span> <span class="comment"> * copy of this software and associated documentation files (the "Software"),</span></div>
|
|
<div class="line"><a name="l00006"></a><span class="lineno"> 6</span> <span class="comment"> * to deal in the Software without restriction, including without limitation</span></div>
|
|
<div class="line"><a name="l00007"></a><span class="lineno"> 7</span> <span class="comment"> * the rights to use, copy, modify, merge, publish, distribute, sublicense,</span></div>
|
|
<div class="line"><a name="l00008"></a><span class="lineno"> 8</span> <span class="comment"> * and/or sell copies of the Software, and to permit persons to whom the</span></div>
|
|
<div class="line"><a name="l00009"></a><span class="lineno"> 9</span> <span class="comment"> * Software is furnished to do so, subject to the following conditions:</span></div>
|
|
<div class="line"><a name="l00010"></a><span class="lineno"> 10</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00011"></a><span class="lineno"> 11</span> <span class="comment"> * The above copyright notice and this permission notice shall be included</span></div>
|
|
<div class="line"><a name="l00012"></a><span class="lineno"> 12</span> <span class="comment"> * in all copies or substantial portions of the Software.</span></div>
|
|
<div class="line"><a name="l00013"></a><span class="lineno"> 13</span> <span class="comment"> *</span></div>
|
|
<div class="line"><a name="l00014"></a><span class="lineno"> 14</span> <span class="comment"> * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS</span></div>
|
|
<div class="line"><a name="l00015"></a><span class="lineno"> 15</span> <span class="comment"> * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,</span></div>
|
|
<div class="line"><a name="l00016"></a><span class="lineno"> 16</span> <span class="comment"> * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE</span></div>
|
|
<div class="line"><a name="l00017"></a><span class="lineno"> 17</span> <span class="comment"> * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER</span></div>
|
|
<div class="line"><a name="l00018"></a><span class="lineno"> 18</span> <span class="comment"> * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING</span></div>
|
|
<div class="line"><a name="l00019"></a><span class="lineno"> 19</span> <span class="comment"> * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER</span></div>
|
|
<div class="line"><a name="l00020"></a><span class="lineno"> 20</span> <span class="comment"> * DEALINGS IN THE SOFTWARE.</span></div>
|
|
<div class="line"><a name="l00021"></a><span class="lineno"> 21</span> <span class="comment"> */</span></div>
|
|
<div class="line"><a name="l00022"></a><span class="lineno"> 22</span> </div>
|
|
<div class="line"><a name="l00023"></a><span class="lineno"> 23</span> <span class="preprocessor">#include "Ed25519.h"</span></div>
|
|
<div class="line"><a name="l00024"></a><span class="lineno"> 24</span> <span class="preprocessor">#include "Curve25519.h"</span></div>
|
|
<div class="line"><a name="l00025"></a><span class="lineno"> 25</span> <span class="preprocessor">#include "Crypto.h"</span></div>
|
|
<div class="line"><a name="l00026"></a><span class="lineno"> 26</span> <span class="preprocessor">#include "RNG.h"</span></div>
|
|
<div class="line"><a name="l00027"></a><span class="lineno"> 27</span> <span class="preprocessor">#include "utility/LimbUtil.h"</span></div>
|
|
<div class="line"><a name="l00028"></a><span class="lineno"> 28</span> <span class="preprocessor">#include <string.h></span></div>
|
|
<div class="line"><a name="l00029"></a><span class="lineno"> 29</span> </div>
|
|
<div class="line"><a name="l00078"></a><span class="lineno"> 78</span> <span class="comment">// 37095705934669439343138083508754565189542113879843219016388785533085940283555</span></div>
|
|
<div class="line"><a name="l00079"></a><span class="lineno"> 79</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numD[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00080"></a><span class="lineno"> 80</span>  LIMB_PAIR(0x135978A3, 0x75EB4DCA), LIMB_PAIR(0x4141D8AB, 0x00700A4D),</div>
|
|
<div class="line"><a name="l00081"></a><span class="lineno"> 81</span>  LIMB_PAIR(0x7779E898, 0x8CC74079), LIMB_PAIR(0x2B6FFE73, 0x52036CEE)</div>
|
|
<div class="line"><a name="l00082"></a><span class="lineno"> 82</span> };</div>
|
|
<div class="line"><a name="l00083"></a><span class="lineno"> 83</span> </div>
|
|
<div class="line"><a name="l00084"></a><span class="lineno"> 84</span> <span class="comment">// d * 2</span></div>
|
|
<div class="line"><a name="l00085"></a><span class="lineno"> 85</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numDx2[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00086"></a><span class="lineno"> 86</span>  LIMB_PAIR(0x26B2F159, 0xEBD69B94), LIMB_PAIR(0x8283B156, 0x00E0149A),</div>
|
|
<div class="line"><a name="l00087"></a><span class="lineno"> 87</span>  LIMB_PAIR(0xEEF3D130, 0x198E80F2), LIMB_PAIR(0x56DFFCE7, 0x2406D9DC)</div>
|
|
<div class="line"><a name="l00088"></a><span class="lineno"> 88</span> };</div>
|
|
<div class="line"><a name="l00089"></a><span class="lineno"> 89</span> </div>
|
|
<div class="line"><a name="l00090"></a><span class="lineno"> 90</span> <span class="comment">// Extended homogenous co-ordinates for the base point.</span></div>
|
|
<div class="line"><a name="l00091"></a><span class="lineno"> 91</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numBx[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00092"></a><span class="lineno"> 92</span>  LIMB_PAIR(0x8F25D51A, 0xC9562D60), LIMB_PAIR(0x9525A7B2, 0x692CC760),</div>
|
|
<div class="line"><a name="l00093"></a><span class="lineno"> 93</span>  LIMB_PAIR(0xFDD6DC5C, 0xC0A4E231), LIMB_PAIR(0xCD6E53FE, 0x216936D3)</div>
|
|
<div class="line"><a name="l00094"></a><span class="lineno"> 94</span> };</div>
|
|
<div class="line"><a name="l00095"></a><span class="lineno"> 95</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numBy[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00096"></a><span class="lineno"> 96</span>  LIMB_PAIR(0x66666658, 0x66666666), LIMB_PAIR(0x66666666, 0x66666666),</div>
|
|
<div class="line"><a name="l00097"></a><span class="lineno"> 97</span>  LIMB_PAIR(0x66666666, 0x66666666), LIMB_PAIR(0x66666666, 0x66666666)</div>
|
|
<div class="line"><a name="l00098"></a><span class="lineno"> 98</span> };</div>
|
|
<div class="line"><a name="l00099"></a><span class="lineno"> 99</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numBz[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00100"></a><span class="lineno"> 100</span>  LIMB_PAIR(0x00000001, 0x00000000), LIMB_PAIR(0x00000000, 0x00000000),</div>
|
|
<div class="line"><a name="l00101"></a><span class="lineno"> 101</span>  LIMB_PAIR(0x00000000, 0x00000000), LIMB_PAIR(0x00000000, 0x00000000)</div>
|
|
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span> };</div>
|
|
<div class="line"><a name="l00103"></a><span class="lineno"> 103</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numBt[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00104"></a><span class="lineno"> 104</span>  LIMB_PAIR(0xA5B7DDA3, 0x6DDE8AB3), LIMB_PAIR(0x775152F5, 0x20F09F80),</div>
|
|
<div class="line"><a name="l00105"></a><span class="lineno"> 105</span>  LIMB_PAIR(0x64ABE37D, 0x66EA4E8E), LIMB_PAIR(0xD78B7665, 0x67875F0F)</div>
|
|
<div class="line"><a name="l00106"></a><span class="lineno"> 106</span> };</div>
|
|
<div class="line"><a name="l00107"></a><span class="lineno"> 107</span> </div>
|
|
<div class="line"><a name="l00108"></a><span class="lineno"> 108</span> <span class="comment">// 2^252 + 27742317777372353535851937790883648493</span></div>
|
|
<div class="line"><a name="l00109"></a><span class="lineno"> 109</span> <span class="keyword">static</span> limb_t <span class="keyword">const</span> numQ[NUM_LIMBS_256BIT] PROGMEM = {</div>
|
|
<div class="line"><a name="l00110"></a><span class="lineno"> 110</span>  LIMB_PAIR(0x5CF5D3ED, 0x5812631A), LIMB_PAIR(0xA2F79CD6, 0x14DEF9DE),</div>
|
|
<div class="line"><a name="l00111"></a><span class="lineno"> 111</span>  LIMB_PAIR(0x00000000, 0x00000000), LIMB_PAIR(0x00000000, 0x10000000)</div>
|
|
<div class="line"><a name="l00112"></a><span class="lineno"> 112</span> };</div>
|
|
<div class="line"><a name="l00113"></a><span class="lineno"> 113</span> </div>
|
|
<div class="line"><a name="l00127"></a><span class="lineno"><a class="line" href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5"> 127</a></span> <span class="keywordtype">void</span> <a class="code" href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5">Ed25519::sign</a>(uint8_t signature[64], <span class="keyword">const</span> uint8_t privateKey[32],</div>
|
|
<div class="line"><a name="l00128"></a><span class="lineno"> 128</span>  <span class="keyword">const</span> uint8_t publicKey[32], <span class="keyword">const</span> <span class="keywordtype">void</span> *message, <span class="keywordtype">size_t</span> len)</div>
|
|
<div class="line"><a name="l00129"></a><span class="lineno"> 129</span> {</div>
|
|
<div class="line"><a name="l00130"></a><span class="lineno"> 130</span>  <a class="code" href="classSHA512.html">SHA512</a> hash;</div>
|
|
<div class="line"><a name="l00131"></a><span class="lineno"> 131</span>  uint8_t *buf = (uint8_t *)(hash.state.w); <span class="comment">// Reuse hash buffer to save memory.</span></div>
|
|
<div class="line"><a name="l00132"></a><span class="lineno"> 132</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00133"></a><span class="lineno"> 133</span>  limb_t r[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00134"></a><span class="lineno"> 134</span>  limb_t k[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00135"></a><span class="lineno"> 135</span>  limb_t t[NUM_LIMBS_512BIT + 1];</div>
|
|
<div class="line"><a name="l00136"></a><span class="lineno"> 136</span>  Point rB;</div>
|
|
<div class="line"><a name="l00137"></a><span class="lineno"> 137</span> </div>
|
|
<div class="line"><a name="l00138"></a><span class="lineno"> 138</span>  <span class="comment">// Derive the secret scalar a and the message prefix from the private key.</span></div>
|
|
<div class="line"><a name="l00139"></a><span class="lineno"> 139</span>  deriveKeys(&hash, a, privateKey);</div>
|
|
<div class="line"><a name="l00140"></a><span class="lineno"> 140</span> </div>
|
|
<div class="line"><a name="l00141"></a><span class="lineno"> 141</span>  <span class="comment">// Hash the prefix and the message to derive r.</span></div>
|
|
<div class="line"><a name="l00142"></a><span class="lineno"> 142</span>  hash.<a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
|
<div class="line"><a name="l00143"></a><span class="lineno"> 143</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(buf + 32, 32);</div>
|
|
<div class="line"><a name="l00144"></a><span class="lineno"> 144</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(message, len);</div>
|
|
<div class="line"><a name="l00145"></a><span class="lineno"> 145</span>  hash.<a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(buf, 0);</div>
|
|
<div class="line"><a name="l00146"></a><span class="lineno"> 146</span>  reduceQFromBuffer(r, buf, t);</div>
|
|
<div class="line"><a name="l00147"></a><span class="lineno"> 147</span> </div>
|
|
<div class="line"><a name="l00148"></a><span class="lineno"> 148</span>  <span class="comment">// Encode rB into the first half of the signature buffer as R.</span></div>
|
|
<div class="line"><a name="l00149"></a><span class="lineno"> 149</span>  mul(rB, r);</div>
|
|
<div class="line"><a name="l00150"></a><span class="lineno"> 150</span>  encodePoint(signature, rB);</div>
|
|
<div class="line"><a name="l00151"></a><span class="lineno"> 151</span> </div>
|
|
<div class="line"><a name="l00152"></a><span class="lineno"> 152</span>  <span class="comment">// Hash R, A, and the message to get k.</span></div>
|
|
<div class="line"><a name="l00153"></a><span class="lineno"> 153</span>  hash.<a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
|
<div class="line"><a name="l00154"></a><span class="lineno"> 154</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(signature, 32); <span class="comment">// R</span></div>
|
|
<div class="line"><a name="l00155"></a><span class="lineno"> 155</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(publicKey, 32); <span class="comment">// A</span></div>
|
|
<div class="line"><a name="l00156"></a><span class="lineno"> 156</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(message, len);</div>
|
|
<div class="line"><a name="l00157"></a><span class="lineno"> 157</span>  hash.<a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(buf, 0);</div>
|
|
<div class="line"><a name="l00158"></a><span class="lineno"> 158</span>  reduceQFromBuffer(k, buf, t);</div>
|
|
<div class="line"><a name="l00159"></a><span class="lineno"> 159</span> </div>
|
|
<div class="line"><a name="l00160"></a><span class="lineno"> 160</span>  <span class="comment">// Compute s = (r + k * a) mod q.</span></div>
|
|
<div class="line"><a name="l00161"></a><span class="lineno"> 161</span>  Curve25519::mulNoReduce(t, k, a);</div>
|
|
<div class="line"><a name="l00162"></a><span class="lineno"> 162</span>  t[NUM_LIMBS_512BIT] = 0;</div>
|
|
<div class="line"><a name="l00163"></a><span class="lineno"> 163</span>  reduceQ(t, t);</div>
|
|
<div class="line"><a name="l00164"></a><span class="lineno"> 164</span>  <a class="code" href="classBigNumberUtil.html#aa6904b2727af6b767fe041b1b7f27414">BigNumberUtil::add</a>(t, t, r, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00165"></a><span class="lineno"> 165</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(t, t, numQ, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00166"></a><span class="lineno"> 166</span>  <a class="code" href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a>(signature + 32, 32, t, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00167"></a><span class="lineno"> 167</span> </div>
|
|
<div class="line"><a name="l00168"></a><span class="lineno"> 168</span>  <span class="comment">// Clean up.</span></div>
|
|
<div class="line"><a name="l00169"></a><span class="lineno"> 169</span>  clean(a);</div>
|
|
<div class="line"><a name="l00170"></a><span class="lineno"> 170</span>  clean(r);</div>
|
|
<div class="line"><a name="l00171"></a><span class="lineno"> 171</span>  clean(k);</div>
|
|
<div class="line"><a name="l00172"></a><span class="lineno"> 172</span>  clean(t);</div>
|
|
<div class="line"><a name="l00173"></a><span class="lineno"> 173</span>  clean(rB);</div>
|
|
<div class="line"><a name="l00174"></a><span class="lineno"> 174</span> }</div>
|
|
<div class="line"><a name="l00175"></a><span class="lineno"> 175</span> </div>
|
|
<div class="line"><a name="l00189"></a><span class="lineno"><a class="line" href="classEd25519.html#ae3e2fc405c9cd8cb1d3ab9b8b452d3e4"> 189</a></span> <span class="keywordtype">bool</span> <a class="code" href="classEd25519.html#ae3e2fc405c9cd8cb1d3ab9b8b452d3e4">Ed25519::verify</a>(<span class="keyword">const</span> uint8_t signature[64], <span class="keyword">const</span> uint8_t publicKey[32],</div>
|
|
<div class="line"><a name="l00190"></a><span class="lineno"> 190</span>  <span class="keyword">const</span> <span class="keywordtype">void</span> *message, <span class="keywordtype">size_t</span> len)</div>
|
|
<div class="line"><a name="l00191"></a><span class="lineno"> 191</span> {</div>
|
|
<div class="line"><a name="l00192"></a><span class="lineno"> 192</span>  <a class="code" href="classSHA512.html">SHA512</a> hash;</div>
|
|
<div class="line"><a name="l00193"></a><span class="lineno"> 193</span>  Point A;</div>
|
|
<div class="line"><a name="l00194"></a><span class="lineno"> 194</span>  Point R;</div>
|
|
<div class="line"><a name="l00195"></a><span class="lineno"> 195</span>  Point sB;</div>
|
|
<div class="line"><a name="l00196"></a><span class="lineno"> 196</span>  Point kA;</div>
|
|
<div class="line"><a name="l00197"></a><span class="lineno"> 197</span>  uint8_t *k = (uint8_t *)(hash.state.w); <span class="comment">// Reuse hash buffer to save memory.</span></div>
|
|
<div class="line"><a name="l00198"></a><span class="lineno"> 198</span>  <span class="keywordtype">bool</span> result = <span class="keyword">false</span>;</div>
|
|
<div class="line"><a name="l00199"></a><span class="lineno"> 199</span> </div>
|
|
<div class="line"><a name="l00200"></a><span class="lineno"> 200</span>  <span class="comment">// Decode the public key and the R component of the signature.</span></div>
|
|
<div class="line"><a name="l00201"></a><span class="lineno"> 201</span>  <span class="keywordflow">if</span> (decodePoint(A, publicKey) && decodePoint(R, signature)) {</div>
|
|
<div class="line"><a name="l00202"></a><span class="lineno"> 202</span>  <span class="comment">// Reconstruct the k value from the signing step.</span></div>
|
|
<div class="line"><a name="l00203"></a><span class="lineno"> 203</span>  hash.<a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
|
<div class="line"><a name="l00204"></a><span class="lineno"> 204</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(signature, 32);</div>
|
|
<div class="line"><a name="l00205"></a><span class="lineno"> 205</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(publicKey, 32);</div>
|
|
<div class="line"><a name="l00206"></a><span class="lineno"> 206</span>  hash.<a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(message, len);</div>
|
|
<div class="line"><a name="l00207"></a><span class="lineno"> 207</span>  hash.<a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(k, 0);</div>
|
|
<div class="line"><a name="l00208"></a><span class="lineno"> 208</span> </div>
|
|
<div class="line"><a name="l00209"></a><span class="lineno"> 209</span>  <span class="comment">// Calculate s * B. The s value is stored temporarily in kA.t.</span></div>
|
|
<div class="line"><a name="l00210"></a><span class="lineno"> 210</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(kA.t, NUM_LIMBS_256BIT, signature + 32, 32);</div>
|
|
<div class="line"><a name="l00211"></a><span class="lineno"> 211</span>  mul(sB, kA.t, <span class="keyword">false</span>);</div>
|
|
<div class="line"><a name="l00212"></a><span class="lineno"> 212</span> </div>
|
|
<div class="line"><a name="l00213"></a><span class="lineno"> 213</span>  <span class="comment">// Calculate R + k * A. We don't need sB.t in equal() below,</span></div>
|
|
<div class="line"><a name="l00214"></a><span class="lineno"> 214</span>  <span class="comment">// so we reuse that as a temporary buffer when reducing k.</span></div>
|
|
<div class="line"><a name="l00215"></a><span class="lineno"> 215</span>  reduceQFromBuffer(sB.t, k, kA.x);</div>
|
|
<div class="line"><a name="l00216"></a><span class="lineno"> 216</span>  mul(kA, sB.t, A, <span class="keyword">false</span>);</div>
|
|
<div class="line"><a name="l00217"></a><span class="lineno"> 217</span>  add(R, kA);</div>
|
|
<div class="line"><a name="l00218"></a><span class="lineno"> 218</span> </div>
|
|
<div class="line"><a name="l00219"></a><span class="lineno"> 219</span>  <span class="comment">// Compare s * B and R + k * A for equality.</span></div>
|
|
<div class="line"><a name="l00220"></a><span class="lineno"> 220</span>  result = equal(sB, R);</div>
|
|
<div class="line"><a name="l00221"></a><span class="lineno"> 221</span>  }</div>
|
|
<div class="line"><a name="l00222"></a><span class="lineno"> 222</span> </div>
|
|
<div class="line"><a name="l00223"></a><span class="lineno"> 223</span>  <span class="comment">// Clean up and exit.</span></div>
|
|
<div class="line"><a name="l00224"></a><span class="lineno"> 224</span>  clean(A);</div>
|
|
<div class="line"><a name="l00225"></a><span class="lineno"> 225</span>  clean(R);</div>
|
|
<div class="line"><a name="l00226"></a><span class="lineno"> 226</span>  clean(sB);</div>
|
|
<div class="line"><a name="l00227"></a><span class="lineno"> 227</span>  clean(kA);</div>
|
|
<div class="line"><a name="l00228"></a><span class="lineno"> 228</span>  <span class="keywordflow">return</span> result;</div>
|
|
<div class="line"><a name="l00229"></a><span class="lineno"> 229</span> }</div>
|
|
<div class="line"><a name="l00230"></a><span class="lineno"> 230</span> </div>
|
|
<div class="line"><a name="l00243"></a><span class="lineno"><a class="line" href="classEd25519.html#ab8be5115ac5adc8a556dbac7d7e90d2e"> 243</a></span> <span class="keywordtype">void</span> <a class="code" href="classEd25519.html#ab8be5115ac5adc8a556dbac7d7e90d2e">Ed25519::generatePrivateKey</a>(uint8_t privateKey[32])</div>
|
|
<div class="line"><a name="l00244"></a><span class="lineno"> 244</span> {</div>
|
|
<div class="line"><a name="l00245"></a><span class="lineno"> 245</span>  RNG.<a class="code" href="classRNGClass.html#a418a833cf18198fd7e5d6dbd78c99c29">rand</a>(privateKey, 32);</div>
|
|
<div class="line"><a name="l00246"></a><span class="lineno"> 246</span> }</div>
|
|
<div class="line"><a name="l00247"></a><span class="lineno"> 247</span> </div>
|
|
<div class="line"><a name="l00256"></a><span class="lineno"><a class="line" href="classEd25519.html#ab62bac52ed07f77f76f3ff0fccd71cb2"> 256</a></span> <span class="keywordtype">void</span> <a class="code" href="classEd25519.html#ab62bac52ed07f77f76f3ff0fccd71cb2">Ed25519::derivePublicKey</a>(uint8_t publicKey[32], <span class="keyword">const</span> uint8_t privateKey[32])</div>
|
|
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span> {</div>
|
|
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span>  <a class="code" href="classSHA512.html">SHA512</a> hash;</div>
|
|
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>  Point ptA;</div>
|
|
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span> </div>
|
|
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span>  <span class="comment">// Derive the secret scalar a from the private key.</span></div>
|
|
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>  deriveKeys(&hash, a, privateKey);</div>
|
|
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span> </div>
|
|
<div class="line"><a name="l00265"></a><span class="lineno"> 265</span>  <span class="comment">// Compute the point A = aB and encode it.</span></div>
|
|
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span>  mul(ptA, a);</div>
|
|
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span>  encodePoint(publicKey, ptA);</div>
|
|
<div class="line"><a name="l00268"></a><span class="lineno"> 268</span> </div>
|
|
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span>  <span class="comment">// Clean up and exit.</span></div>
|
|
<div class="line"><a name="l00270"></a><span class="lineno"> 270</span>  clean(a);</div>
|
|
<div class="line"><a name="l00271"></a><span class="lineno"> 271</span>  clean(ptA);</div>
|
|
<div class="line"><a name="l00272"></a><span class="lineno"> 272</span> }</div>
|
|
<div class="line"><a name="l00273"></a><span class="lineno"> 273</span> </div>
|
|
<div class="line"><a name="l00283"></a><span class="lineno"> 283</span> <span class="keywordtype">void</span> Ed25519::reduceQFromBuffer(limb_t *result, <span class="keyword">const</span> uint8_t buf[64], limb_t *temp)</div>
|
|
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span> {</div>
|
|
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(temp, NUM_LIMBS_512BIT, buf, 64);</div>
|
|
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>  temp[NUM_LIMBS_512BIT] = 0;</div>
|
|
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>  reduceQ(result, temp);</div>
|
|
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span> }</div>
|
|
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span> </div>
|
|
<div class="line"><a name="l00302"></a><span class="lineno"> 302</span> <span class="keywordtype">void</span> Ed25519::reduceQ(limb_t *result, limb_t *r)</div>
|
|
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span> {</div>
|
|
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span>  <span class="comment">// Algorithm from: http://en.wikipedia.org/wiki/Barrett_reduction</span></div>
|
|
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>  <span class="comment">//</span></div>
|
|
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>  <span class="comment">// We assume that r is less than or equal to (q - 1)^2.</span></div>
|
|
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>  <span class="comment">//</span></div>
|
|
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>  <span class="comment">// We want to compute result = r mod q. Find the smallest k such</span></div>
|
|
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>  <span class="comment">// that 2^k > q. In our case, k = 253. Then set m = floor(4^k / q)</span></div>
|
|
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>  <span class="comment">// and let r = r - q * floor(m * r / 4^k). This will be the result</span></div>
|
|
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>  <span class="comment">// or it will be at most one subtraction of q away from the result.</span></div>
|
|
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>  <span class="comment">//</span></div>
|
|
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>  <span class="comment">// Note: 4^k = 4^253 = 2^506 = 2^512/2^6. We can more easily compute</span></div>
|
|
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>  <span class="comment">// the result we want if we set m = floor(4^k * 2^6 / q) instead and</span></div>
|
|
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>  <span class="comment">// then r = r - q * floor(m * r / 2^512). Because the slight extra</span></div>
|
|
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>  <span class="comment">// precision in m, r is at most two subtractions of q away from the</span></div>
|
|
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>  <span class="comment">// final result.</span></div>
|
|
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>  <span class="keyword">static</span> limb_t <span class="keyword">const</span> numM[NUM_LIMBS_256BIT + 1] PROGMEM = {</div>
|
|
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>  LIMB_PAIR(0x0A2C131B, 0xED9CE5A3), LIMB_PAIR(0x086329A7, 0x2106215D),</div>
|
|
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>  LIMB_PAIR(0xFFFFFFEB, 0xFFFFFFFF), LIMB_PAIR(0xFFFFFFFF, 0xFFFFFFFF),</div>
|
|
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>  0x0F</div>
|
|
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>  };</div>
|
|
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>  limb_t temp[NUM_LIMBS_512BIT + NUM_LIMBS_256BIT + 1];</div>
|
|
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span> </div>
|
|
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>  <span class="comment">// Multiply r by m.</span></div>
|
|
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, r, NUM_LIMBS_512BIT, numM, NUM_LIMBS_256BIT + 1);</div>
|
|
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span> </div>
|
|
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>  <span class="comment">// Multiply (m * r) / 2^512 by q and subtract it from r.</span></div>
|
|
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>  <span class="comment">// We can ignore the high words of the subtraction result</span></div>
|
|
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>  <span class="comment">// because they will all turn into zero after the subtraction.</span></div>
|
|
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>  <a class="code" href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a>(temp, temp + NUM_LIMBS_512BIT, NUM_LIMBS_256BIT + 1,</div>
|
|
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>  numQ, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>  <a class="code" href="classBigNumberUtil.html#a6618e03bfcb3086961df508b40cc1e67">BigNumberUtil::sub</a>(r, r, temp, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span> </div>
|
|
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span>  <span class="comment">// Perform two subtractions of q from the result to reduce it.</span></div>
|
|
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, r, numQ, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>  <a class="code" href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a>(result, result, numQ, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span> </div>
|
|
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>  <span class="comment">// Clean up and exit.</span></div>
|
|
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>  clean(temp);</div>
|
|
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span> }</div>
|
|
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span> </div>
|
|
<div class="line"><a name="l00352"></a><span class="lineno"> 352</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, Point &p, <span class="keywordtype">bool</span> constTime)</div>
|
|
<div class="line"><a name="l00353"></a><span class="lineno"> 353</span> {</div>
|
|
<div class="line"><a name="l00354"></a><span class="lineno"> 354</span>  Point q;</div>
|
|
<div class="line"><a name="l00355"></a><span class="lineno"> 355</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00356"></a><span class="lineno"> 356</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00357"></a><span class="lineno"> 357</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00358"></a><span class="lineno"> 358</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00359"></a><span class="lineno"> 359</span>  limb_t mask, select;</div>
|
|
<div class="line"><a name="l00360"></a><span class="lineno"> 360</span>  uint8_t sposn, t;</div>
|
|
<div class="line"><a name="l00361"></a><span class="lineno"> 361</span> </div>
|
|
<div class="line"><a name="l00362"></a><span class="lineno"> 362</span>  <span class="comment">// Initialize the result to (0, 1, 1, 0).</span></div>
|
|
<div class="line"><a name="l00363"></a><span class="lineno"> 363</span>  memset(&result, 0, <span class="keyword">sizeof</span>(Point));</div>
|
|
<div class="line"><a name="l00364"></a><span class="lineno"> 364</span>  result.y[0] = 1;</div>
|
|
<div class="line"><a name="l00365"></a><span class="lineno"> 365</span>  result.z[0] = 1;</div>
|
|
<div class="line"><a name="l00366"></a><span class="lineno"> 366</span> </div>
|
|
<div class="line"><a name="l00367"></a><span class="lineno"> 367</span>  <span class="comment">// Iterate over the 255 bits of "s" to calculate "s * p".</span></div>
|
|
<div class="line"><a name="l00368"></a><span class="lineno"> 368</span>  mask = 1;</div>
|
|
<div class="line"><a name="l00369"></a><span class="lineno"> 369</span>  sposn = 0;</div>
|
|
<div class="line"><a name="l00370"></a><span class="lineno"> 370</span>  <span class="keywordflow">for</span> (t = 255; t > 0; --t) {</div>
|
|
<div class="line"><a name="l00371"></a><span class="lineno"> 371</span>  <span class="comment">// Add p to the result to produce q. The specification refers</span></div>
|
|
<div class="line"><a name="l00372"></a><span class="lineno"> 372</span>  <span class="comment">// to temporary variables A to H. We can dispense with E to H</span></div>
|
|
<div class="line"><a name="l00373"></a><span class="lineno"> 373</span>  <span class="comment">// by using B, D, q.z, and q.t to hold those values temporarily.</span></div>
|
|
<div class="line"><a name="l00374"></a><span class="lineno"> 374</span>  select = s[sposn] & mask;</div>
|
|
<div class="line"><a name="l00375"></a><span class="lineno"> 375</span>  <span class="keywordflow">if</span> (constTime || select) {</div>
|
|
<div class="line"><a name="l00376"></a><span class="lineno"> 376</span>  Curve25519::sub(A, result.y, result.x);</div>
|
|
<div class="line"><a name="l00377"></a><span class="lineno"> 377</span>  Curve25519::sub(C, p.y, p.x);</div>
|
|
<div class="line"><a name="l00378"></a><span class="lineno"> 378</span>  Curve25519::mul(A, A, C);</div>
|
|
<div class="line"><a name="l00379"></a><span class="lineno"> 379</span>  Curve25519::add(B, result.y, result.x);</div>
|
|
<div class="line"><a name="l00380"></a><span class="lineno"> 380</span>  Curve25519::add(C, p.y, p.x);</div>
|
|
<div class="line"><a name="l00381"></a><span class="lineno"> 381</span>  Curve25519::mul(B, B, C);</div>
|
|
<div class="line"><a name="l00382"></a><span class="lineno"> 382</span>  Curve25519::mul(C, result.t, p.t);</div>
|
|
<div class="line"><a name="l00383"></a><span class="lineno"> 383</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
|
<div class="line"><a name="l00384"></a><span class="lineno"> 384</span>  Curve25519::mul(D, result.z, p.z);</div>
|
|
<div class="line"><a name="l00385"></a><span class="lineno"> 385</span>  Curve25519::add(D, D, D);</div>
|
|
<div class="line"><a name="l00386"></a><span class="lineno"> 386</span>  Curve25519::sub(q.t, B, A); <span class="comment">// E = B - A</span></div>
|
|
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span>  Curve25519::sub(q.z, D, C); <span class="comment">// F = D - C</span></div>
|
|
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
|
<div class="line"><a name="l00389"></a><span class="lineno"> 389</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
|
<div class="line"><a name="l00390"></a><span class="lineno"> 390</span>  <span class="keywordflow">if</span> (constTime) {</div>
|
|
<div class="line"><a name="l00391"></a><span class="lineno"> 391</span>  <span class="comment">// Put the intermediate value into q.</span></div>
|
|
<div class="line"><a name="l00392"></a><span class="lineno"> 392</span>  Curve25519::mul(q.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
|
<div class="line"><a name="l00393"></a><span class="lineno"> 393</span>  Curve25519::mul(q.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
|
<div class="line"><a name="l00394"></a><span class="lineno"> 394</span>  Curve25519::mul(q.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
|
<div class="line"><a name="l00395"></a><span class="lineno"> 395</span>  Curve25519::mul(q.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
|
<div class="line"><a name="l00396"></a><span class="lineno"> 396</span> </div>
|
|
<div class="line"><a name="l00397"></a><span class="lineno"> 397</span>  <span class="comment">// Copy q into the result if the current bit of s is 1.</span></div>
|
|
<div class="line"><a name="l00398"></a><span class="lineno"> 398</span>  Curve25519::cmove(select, result.x, q.x);</div>
|
|
<div class="line"><a name="l00399"></a><span class="lineno"> 399</span>  Curve25519::cmove(select, result.y, q.y);</div>
|
|
<div class="line"><a name="l00400"></a><span class="lineno"> 400</span>  Curve25519::cmove(select, result.z, q.z);</div>
|
|
<div class="line"><a name="l00401"></a><span class="lineno"> 401</span>  Curve25519::cmove(select, result.t, q.t);</div>
|
|
<div class="line"><a name="l00402"></a><span class="lineno"> 402</span>  } <span class="keywordflow">else</span> {</div>
|
|
<div class="line"><a name="l00403"></a><span class="lineno"> 403</span>  <span class="comment">// Put the intermediate value directly into the result.</span></div>
|
|
<div class="line"><a name="l00404"></a><span class="lineno"> 404</span>  Curve25519::mul(result.x, q.t, q.z); <span class="comment">// q.x = E * F</span></div>
|
|
<div class="line"><a name="l00405"></a><span class="lineno"> 405</span>  Curve25519::mul(result.y, D, B); <span class="comment">// q.y = G * H</span></div>
|
|
<div class="line"><a name="l00406"></a><span class="lineno"> 406</span>  Curve25519::mul(result.z, q.z, D); <span class="comment">// q.z = F * G</span></div>
|
|
<div class="line"><a name="l00407"></a><span class="lineno"> 407</span>  Curve25519::mul(result.t, q.t, B); <span class="comment">// q.t = E * H</span></div>
|
|
<div class="line"><a name="l00408"></a><span class="lineno"> 408</span>  }</div>
|
|
<div class="line"><a name="l00409"></a><span class="lineno"> 409</span>  }</div>
|
|
<div class="line"><a name="l00410"></a><span class="lineno"> 410</span> </div>
|
|
<div class="line"><a name="l00411"></a><span class="lineno"> 411</span>  <span class="comment">// Double p for the next iteration.</span></div>
|
|
<div class="line"><a name="l00412"></a><span class="lineno"> 412</span>  Curve25519::sub(A, p.y, p.x);</div>
|
|
<div class="line"><a name="l00413"></a><span class="lineno"> 413</span>  Curve25519::square(A, A);</div>
|
|
<div class="line"><a name="l00414"></a><span class="lineno"> 414</span>  Curve25519::add(B, p.y, p.x);</div>
|
|
<div class="line"><a name="l00415"></a><span class="lineno"> 415</span>  Curve25519::square(B, B);</div>
|
|
<div class="line"><a name="l00416"></a><span class="lineno"> 416</span>  Curve25519::square(C, p.t);</div>
|
|
<div class="line"><a name="l00417"></a><span class="lineno"> 417</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
|
<div class="line"><a name="l00418"></a><span class="lineno"> 418</span>  Curve25519::square(D, p.z);</div>
|
|
<div class="line"><a name="l00419"></a><span class="lineno"> 419</span>  Curve25519::add(D, D, D);</div>
|
|
<div class="line"><a name="l00420"></a><span class="lineno"> 420</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
|
<div class="line"><a name="l00421"></a><span class="lineno"> 421</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
|
<div class="line"><a name="l00422"></a><span class="lineno"> 422</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
|
<div class="line"><a name="l00423"></a><span class="lineno"> 423</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
|
<div class="line"><a name="l00424"></a><span class="lineno"> 424</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
|
<div class="line"><a name="l00425"></a><span class="lineno"> 425</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
|
<div class="line"><a name="l00426"></a><span class="lineno"> 426</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
|
<div class="line"><a name="l00427"></a><span class="lineno"> 427</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
|
<div class="line"><a name="l00428"></a><span class="lineno"> 428</span> </div>
|
|
<div class="line"><a name="l00429"></a><span class="lineno"> 429</span>  <span class="comment">// Move onto the next bit of s from lowest to highest.</span></div>
|
|
<div class="line"><a name="l00430"></a><span class="lineno"> 430</span>  <span class="keywordflow">if</span> (mask != (((limb_t)1) << (LIMB_BITS - 1))) {</div>
|
|
<div class="line"><a name="l00431"></a><span class="lineno"> 431</span>  mask <<= 1;</div>
|
|
<div class="line"><a name="l00432"></a><span class="lineno"> 432</span>  } <span class="keywordflow">else</span> {</div>
|
|
<div class="line"><a name="l00433"></a><span class="lineno"> 433</span>  ++sposn;</div>
|
|
<div class="line"><a name="l00434"></a><span class="lineno"> 434</span>  mask = 1;</div>
|
|
<div class="line"><a name="l00435"></a><span class="lineno"> 435</span>  }</div>
|
|
<div class="line"><a name="l00436"></a><span class="lineno"> 436</span>  }</div>
|
|
<div class="line"><a name="l00437"></a><span class="lineno"> 437</span> </div>
|
|
<div class="line"><a name="l00438"></a><span class="lineno"> 438</span>  <span class="comment">// Clean up.</span></div>
|
|
<div class="line"><a name="l00439"></a><span class="lineno"> 439</span>  clean(q);</div>
|
|
<div class="line"><a name="l00440"></a><span class="lineno"> 440</span>  clean(A);</div>
|
|
<div class="line"><a name="l00441"></a><span class="lineno"> 441</span>  clean(B);</div>
|
|
<div class="line"><a name="l00442"></a><span class="lineno"> 442</span>  clean(C);</div>
|
|
<div class="line"><a name="l00443"></a><span class="lineno"> 443</span>  clean(D);</div>
|
|
<div class="line"><a name="l00444"></a><span class="lineno"> 444</span> }</div>
|
|
<div class="line"><a name="l00445"></a><span class="lineno"> 445</span> </div>
|
|
<div class="line"><a name="l00454"></a><span class="lineno"> 454</span> <span class="keywordtype">void</span> Ed25519::mul(Point &result, <span class="keyword">const</span> limb_t *s, <span class="keywordtype">bool</span> constTime)</div>
|
|
<div class="line"><a name="l00455"></a><span class="lineno"> 455</span> {</div>
|
|
<div class="line"><a name="l00456"></a><span class="lineno"> 456</span>  Point P;</div>
|
|
<div class="line"><a name="l00457"></a><span class="lineno"> 457</span>  memcpy_P(P.x, numBx, <span class="keyword">sizeof</span>(P.x));</div>
|
|
<div class="line"><a name="l00458"></a><span class="lineno"> 458</span>  memcpy_P(P.y, numBy, <span class="keyword">sizeof</span>(P.y));</div>
|
|
<div class="line"><a name="l00459"></a><span class="lineno"> 459</span>  memcpy_P(P.z, numBz, <span class="keyword">sizeof</span>(P.z));</div>
|
|
<div class="line"><a name="l00460"></a><span class="lineno"> 460</span>  memcpy_P(P.t, numBt, <span class="keyword">sizeof</span>(P.t));</div>
|
|
<div class="line"><a name="l00461"></a><span class="lineno"> 461</span>  mul(result, s, P, constTime);</div>
|
|
<div class="line"><a name="l00462"></a><span class="lineno"> 462</span>  clean(P);</div>
|
|
<div class="line"><a name="l00463"></a><span class="lineno"> 463</span> }</div>
|
|
<div class="line"><a name="l00464"></a><span class="lineno"> 464</span> </div>
|
|
<div class="line"><a name="l00471"></a><span class="lineno"> 471</span> <span class="keywordtype">void</span> Ed25519::add(Point &p, <span class="keyword">const</span> Point &q)</div>
|
|
<div class="line"><a name="l00472"></a><span class="lineno"> 472</span> {</div>
|
|
<div class="line"><a name="l00473"></a><span class="lineno"> 473</span>  limb_t A[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00474"></a><span class="lineno"> 474</span>  limb_t B[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00475"></a><span class="lineno"> 475</span>  limb_t C[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00476"></a><span class="lineno"> 476</span>  limb_t D[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00477"></a><span class="lineno"> 477</span> </div>
|
|
<div class="line"><a name="l00478"></a><span class="lineno"> 478</span>  Curve25519::sub(A, p.y, p.x);</div>
|
|
<div class="line"><a name="l00479"></a><span class="lineno"> 479</span>  Curve25519::sub(C, q.y, q.x);</div>
|
|
<div class="line"><a name="l00480"></a><span class="lineno"> 480</span>  Curve25519::mul(A, A, C);</div>
|
|
<div class="line"><a name="l00481"></a><span class="lineno"> 481</span>  Curve25519::add(B, p.y, p.x);</div>
|
|
<div class="line"><a name="l00482"></a><span class="lineno"> 482</span>  Curve25519::add(C, q.y, q.x);</div>
|
|
<div class="line"><a name="l00483"></a><span class="lineno"> 483</span>  Curve25519::mul(B, B, C);</div>
|
|
<div class="line"><a name="l00484"></a><span class="lineno"> 484</span>  Curve25519::mul(C, p.t, q.t);</div>
|
|
<div class="line"><a name="l00485"></a><span class="lineno"> 485</span>  Curve25519::mul_P(C, C, numDx2);</div>
|
|
<div class="line"><a name="l00486"></a><span class="lineno"> 486</span>  Curve25519::mul(D, p.z, q.z);</div>
|
|
<div class="line"><a name="l00487"></a><span class="lineno"> 487</span>  Curve25519::add(D, D, D);</div>
|
|
<div class="line"><a name="l00488"></a><span class="lineno"> 488</span>  Curve25519::sub(p.t, B, A); <span class="comment">// E = B - A</span></div>
|
|
<div class="line"><a name="l00489"></a><span class="lineno"> 489</span>  Curve25519::sub(p.z, D, C); <span class="comment">// F = D - C</span></div>
|
|
<div class="line"><a name="l00490"></a><span class="lineno"> 490</span>  Curve25519::add(D, D, C); <span class="comment">// G = D + C</span></div>
|
|
<div class="line"><a name="l00491"></a><span class="lineno"> 491</span>  Curve25519::add(B, B, A); <span class="comment">// H = B + A</span></div>
|
|
<div class="line"><a name="l00492"></a><span class="lineno"> 492</span>  Curve25519::mul(p.x, p.t, p.z); <span class="comment">// p.x = E * F</span></div>
|
|
<div class="line"><a name="l00493"></a><span class="lineno"> 493</span>  Curve25519::mul(p.y, D, B); <span class="comment">// p.y = G * H</span></div>
|
|
<div class="line"><a name="l00494"></a><span class="lineno"> 494</span>  Curve25519::mul(p.z, p.z, D); <span class="comment">// p.z = F * G</span></div>
|
|
<div class="line"><a name="l00495"></a><span class="lineno"> 495</span>  Curve25519::mul(p.t, p.t, B); <span class="comment">// p.t = E * H</span></div>
|
|
<div class="line"><a name="l00496"></a><span class="lineno"> 496</span> </div>
|
|
<div class="line"><a name="l00497"></a><span class="lineno"> 497</span>  clean(A);</div>
|
|
<div class="line"><a name="l00498"></a><span class="lineno"> 498</span>  clean(B);</div>
|
|
<div class="line"><a name="l00499"></a><span class="lineno"> 499</span>  clean(C);</div>
|
|
<div class="line"><a name="l00500"></a><span class="lineno"> 500</span>  clean(D);</div>
|
|
<div class="line"><a name="l00501"></a><span class="lineno"> 501</span> }</div>
|
|
<div class="line"><a name="l00502"></a><span class="lineno"> 502</span> </div>
|
|
<div class="line"><a name="l00511"></a><span class="lineno"> 511</span> <span class="keywordtype">bool</span> Ed25519::equal(<span class="keyword">const</span> Point &p, <span class="keyword">const</span> Point &q)</div>
|
|
<div class="line"><a name="l00512"></a><span class="lineno"> 512</span> {</div>
|
|
<div class="line"><a name="l00513"></a><span class="lineno"> 513</span>  limb_t a[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00514"></a><span class="lineno"> 514</span>  limb_t b[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00515"></a><span class="lineno"> 515</span>  <span class="keywordtype">bool</span> result = <span class="keyword">true</span>;</div>
|
|
<div class="line"><a name="l00516"></a><span class="lineno"> 516</span> </div>
|
|
<div class="line"><a name="l00517"></a><span class="lineno"> 517</span>  Curve25519::mul(a, p.x, q.z);</div>
|
|
<div class="line"><a name="l00518"></a><span class="lineno"> 518</span>  Curve25519::mul(b, q.x, p.z);</div>
|
|
<div class="line"><a name="l00519"></a><span class="lineno"> 519</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
|
<div class="line"><a name="l00520"></a><span class="lineno"> 520</span> </div>
|
|
<div class="line"><a name="l00521"></a><span class="lineno"> 521</span>  Curve25519::mul(a, p.y, q.z);</div>
|
|
<div class="line"><a name="l00522"></a><span class="lineno"> 522</span>  Curve25519::mul(b, q.y, p.z);</div>
|
|
<div class="line"><a name="l00523"></a><span class="lineno"> 523</span>  result &= secure_compare(a, b, <span class="keyword">sizeof</span>(a));</div>
|
|
<div class="line"><a name="l00524"></a><span class="lineno"> 524</span> </div>
|
|
<div class="line"><a name="l00525"></a><span class="lineno"> 525</span>  clean(a);</div>
|
|
<div class="line"><a name="l00526"></a><span class="lineno"> 526</span>  clean(b);</div>
|
|
<div class="line"><a name="l00527"></a><span class="lineno"> 527</span>  <span class="keywordflow">return</span> result;</div>
|
|
<div class="line"><a name="l00528"></a><span class="lineno"> 528</span> }</div>
|
|
<div class="line"><a name="l00529"></a><span class="lineno"> 529</span> </div>
|
|
<div class="line"><a name="l00539"></a><span class="lineno"> 539</span> <span class="keywordtype">void</span> Ed25519::encodePoint(uint8_t *buf, Point &point)</div>
|
|
<div class="line"><a name="l00540"></a><span class="lineno"> 540</span> {</div>
|
|
<div class="line"><a name="l00541"></a><span class="lineno"> 541</span>  <span class="comment">// Convert the homogeneous coordinates into plain (x, y) coordinates:</span></div>
|
|
<div class="line"><a name="l00542"></a><span class="lineno"> 542</span>  <span class="comment">// zinv = z^(-1) mod p</span></div>
|
|
<div class="line"><a name="l00543"></a><span class="lineno"> 543</span>  <span class="comment">// x = x * zinv mod p</span></div>
|
|
<div class="line"><a name="l00544"></a><span class="lineno"> 544</span>  <span class="comment">// y = y * zinv mod p</span></div>
|
|
<div class="line"><a name="l00545"></a><span class="lineno"> 545</span>  <span class="comment">// We don't need the t coordinate, so use that to store zinv temporarily.</span></div>
|
|
<div class="line"><a name="l00546"></a><span class="lineno"> 546</span>  Curve25519::recip(point.t, point.z);</div>
|
|
<div class="line"><a name="l00547"></a><span class="lineno"> 547</span>  Curve25519::mul(point.x, point.x, point.t);</div>
|
|
<div class="line"><a name="l00548"></a><span class="lineno"> 548</span>  Curve25519::mul(point.y, point.y, point.t);</div>
|
|
<div class="line"><a name="l00549"></a><span class="lineno"> 549</span> </div>
|
|
<div class="line"><a name="l00550"></a><span class="lineno"> 550</span>  <span class="comment">// Copy the lowest bit of x to the highest bit of y.</span></div>
|
|
<div class="line"><a name="l00551"></a><span class="lineno"> 551</span>  point.y[NUM_LIMBS_256BIT - 1] |= (point.x[0] << (LIMB_BITS - 1));</div>
|
|
<div class="line"><a name="l00552"></a><span class="lineno"> 552</span> </div>
|
|
<div class="line"><a name="l00553"></a><span class="lineno"> 553</span>  <span class="comment">// Convert y into little-endian in the return buffer.</span></div>
|
|
<div class="line"><a name="l00554"></a><span class="lineno"> 554</span>  <a class="code" href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a>(buf, 32, point.y, NUM_LIMBS_256BIT);</div>
|
|
<div class="line"><a name="l00555"></a><span class="lineno"> 555</span> }</div>
|
|
<div class="line"><a name="l00556"></a><span class="lineno"> 556</span> </div>
|
|
<div class="line"><a name="l00569"></a><span class="lineno"> 569</span> <span class="keywordtype">bool</span> Ed25519::decodePoint(Point &point, <span class="keyword">const</span> uint8_t *buf)</div>
|
|
<div class="line"><a name="l00570"></a><span class="lineno"> 570</span> {</div>
|
|
<div class="line"><a name="l00571"></a><span class="lineno"> 571</span>  limb_t temp[NUM_LIMBS_256BIT];</div>
|
|
<div class="line"><a name="l00572"></a><span class="lineno"> 572</span> </div>
|
|
<div class="line"><a name="l00573"></a><span class="lineno"> 573</span>  <span class="comment">// Convert the input buffer from little-endian into the limbs of y.</span></div>
|
|
<div class="line"><a name="l00574"></a><span class="lineno"> 574</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(point.y, NUM_LIMBS_256BIT, buf, 32);</div>
|
|
<div class="line"><a name="l00575"></a><span class="lineno"> 575</span> </div>
|
|
<div class="line"><a name="l00576"></a><span class="lineno"> 576</span>  <span class="comment">// The high bit of y is the sign bit for x.</span></div>
|
|
<div class="line"><a name="l00577"></a><span class="lineno"> 577</span>  limb_t <a class="code" href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5">sign</a> = point.y[NUM_LIMBS_256BIT - 1] >> (LIMB_BITS - 1);</div>
|
|
<div class="line"><a name="l00578"></a><span class="lineno"> 578</span>  point.y[NUM_LIMBS_256BIT - 1] &= ~(((limb_t)1) << (LIMB_BITS - 1));</div>
|
|
<div class="line"><a name="l00579"></a><span class="lineno"> 579</span> </div>
|
|
<div class="line"><a name="l00580"></a><span class="lineno"> 580</span>  <span class="comment">// Set z to 1.</span></div>
|
|
<div class="line"><a name="l00581"></a><span class="lineno"> 581</span>  memcpy_P(point.z, numBz, <span class="keyword">sizeof</span>(point.z));</div>
|
|
<div class="line"><a name="l00582"></a><span class="lineno"> 582</span> </div>
|
|
<div class="line"><a name="l00583"></a><span class="lineno"> 583</span>  <span class="comment">// Compute t = (y * y - 1) * modinv(d * y * y + 1).</span></div>
|
|
<div class="line"><a name="l00584"></a><span class="lineno"> 584</span>  Curve25519::square(point.t, point.y);</div>
|
|
<div class="line"><a name="l00585"></a><span class="lineno"> 585</span>  Curve25519::sub(point.x, point.t, point.z);</div>
|
|
<div class="line"><a name="l00586"></a><span class="lineno"> 586</span>  Curve25519::mul_P(point.t, point.t, numD);</div>
|
|
<div class="line"><a name="l00587"></a><span class="lineno"> 587</span>  Curve25519::add(point.t, point.t, point.z);</div>
|
|
<div class="line"><a name="l00588"></a><span class="lineno"> 588</span>  Curve25519::recip(temp, point.t);</div>
|
|
<div class="line"><a name="l00589"></a><span class="lineno"> 589</span>  Curve25519::mul(point.t, point.x, temp);</div>
|
|
<div class="line"><a name="l00590"></a><span class="lineno"> 590</span>  clean(temp);</div>
|
|
<div class="line"><a name="l00591"></a><span class="lineno"> 591</span> </div>
|
|
<div class="line"><a name="l00592"></a><span class="lineno"> 592</span>  <span class="comment">// Check for t = 0.</span></div>
|
|
<div class="line"><a name="l00593"></a><span class="lineno"> 593</span>  limb_t check = point.t[0];</div>
|
|
<div class="line"><a name="l00594"></a><span class="lineno"> 594</span>  <span class="keywordflow">for</span> (uint8_t posn = 1; posn < NUM_LIMBS_256BIT; ++posn)</div>
|
|
<div class="line"><a name="l00595"></a><span class="lineno"> 595</span>  check |= point.t[posn];</div>
|
|
<div class="line"><a name="l00596"></a><span class="lineno"> 596</span>  if (!check) {</div>
|
|
<div class="line"><a name="l00597"></a><span class="lineno"> 597</span>  <span class="comment">// If the sign bit is set, then decoding has failed.</span></div>
|
|
<div class="line"><a name="l00598"></a><span class="lineno"> 598</span>  <span class="comment">// Otherwise x is zero and we're done.</span></div>
|
|
<div class="line"><a name="l00599"></a><span class="lineno"> 599</span>  <span class="keywordflow">if</span> (sign)</div>
|
|
<div class="line"><a name="l00600"></a><span class="lineno"> 600</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
<div class="line"><a name="l00601"></a><span class="lineno"> 601</span>  memset(point.x, 0, <span class="keyword">sizeof</span>(point.x));</div>
|
|
<div class="line"><a name="l00602"></a><span class="lineno"> 602</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
<div class="line"><a name="l00603"></a><span class="lineno"> 603</span>  }</div>
|
|
<div class="line"><a name="l00604"></a><span class="lineno"> 604</span> </div>
|
|
<div class="line"><a name="l00605"></a><span class="lineno"> 605</span>  <span class="comment">// Recover x by taking the sqrt of t and flipping the sign if necessary.</span></div>
|
|
<div class="line"><a name="l00606"></a><span class="lineno"> 606</span>  <span class="keywordflow">if</span> (!Curve25519::sqrt(point.x, point.t))</div>
|
|
<div class="line"><a name="l00607"></a><span class="lineno"> 607</span>  <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
<div class="line"><a name="l00608"></a><span class="lineno"> 608</span>  <span class="keywordflow">if</span> (sign != (point.x[0] & ((limb_t)1))) {</div>
|
|
<div class="line"><a name="l00609"></a><span class="lineno"> 609</span>  <span class="comment">// The signs are different so we want the other square root.</span></div>
|
|
<div class="line"><a name="l00610"></a><span class="lineno"> 610</span>  memset(point.t, 0, <span class="keyword">sizeof</span>(point.t));</div>
|
|
<div class="line"><a name="l00611"></a><span class="lineno"> 611</span>  Curve25519::sub(point.x, point.t, point.x);</div>
|
|
<div class="line"><a name="l00612"></a><span class="lineno"> 612</span>  }</div>
|
|
<div class="line"><a name="l00613"></a><span class="lineno"> 613</span> </div>
|
|
<div class="line"><a name="l00614"></a><span class="lineno"> 614</span>  <span class="comment">// Finally, t = x * y.</span></div>
|
|
<div class="line"><a name="l00615"></a><span class="lineno"> 615</span>  Curve25519::mul(point.t, point.x, point.y);</div>
|
|
<div class="line"><a name="l00616"></a><span class="lineno"> 616</span>  <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
<div class="line"><a name="l00617"></a><span class="lineno"> 617</span> }</div>
|
|
<div class="line"><a name="l00618"></a><span class="lineno"> 618</span> </div>
|
|
<div class="line"><a name="l00629"></a><span class="lineno"> 629</span> <span class="keywordtype">void</span> Ed25519::deriveKeys(<a class="code" href="classSHA512.html">SHA512</a> *hash, limb_t *a, <span class="keyword">const</span> uint8_t privateKey[32])</div>
|
|
<div class="line"><a name="l00630"></a><span class="lineno"> 630</span> {</div>
|
|
<div class="line"><a name="l00631"></a><span class="lineno"> 631</span>  <span class="comment">// Hash the private key to get the "a" scalar and the message prefix.</span></div>
|
|
<div class="line"><a name="l00632"></a><span class="lineno"> 632</span>  uint8_t *buf = (uint8_t *)(hash->state.w); <span class="comment">// Reuse hash buffer to save memory.</span></div>
|
|
<div class="line"><a name="l00633"></a><span class="lineno"> 633</span>  hash-><a class="code" href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">reset</a>();</div>
|
|
<div class="line"><a name="l00634"></a><span class="lineno"> 634</span>  hash-><a class="code" href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">update</a>(privateKey, 32);</div>
|
|
<div class="line"><a name="l00635"></a><span class="lineno"> 635</span>  hash-><a class="code" href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">finalize</a>(buf, 0);</div>
|
|
<div class="line"><a name="l00636"></a><span class="lineno"> 636</span>  buf[0] &= 0xF8;</div>
|
|
<div class="line"><a name="l00637"></a><span class="lineno"> 637</span>  buf[31] &= 0x7F;</div>
|
|
<div class="line"><a name="l00638"></a><span class="lineno"> 638</span>  buf[31] |= 0x40;</div>
|
|
<div class="line"><a name="l00639"></a><span class="lineno"> 639</span> </div>
|
|
<div class="line"><a name="l00640"></a><span class="lineno"> 640</span>  <span class="comment">// Unpack the first half of the hash value into "a".</span></div>
|
|
<div class="line"><a name="l00641"></a><span class="lineno"> 641</span>  <a class="code" href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a>(a, NUM_LIMBS_256BIT, buf, 32);</div>
|
|
<div class="line"><a name="l00642"></a><span class="lineno"> 642</span> }</div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a00c9cde0b626788a60552a6bc9ce058b"><div class="ttname"><a href="classBigNumberUtil.html#a00c9cde0b626788a60552a6bc9ce058b">BigNumberUtil::reduceQuick_P</a></div><div class="ttdeci">static void reduceQuick_P(limb_t *result, const limb_t *x, const limb_t *y, size_t size)</div><div class="ttdoc">Reduces x modulo y using subtraction where y is in program memory. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00734">BigNumberUtil.cpp:734</a></div></div>
|
|
<div class="ttc" id="classEd25519_html_ab8be5115ac5adc8a556dbac7d7e90d2e"><div class="ttname"><a href="classEd25519.html#ab8be5115ac5adc8a556dbac7d7e90d2e">Ed25519::generatePrivateKey</a></div><div class="ttdeci">static void generatePrivateKey(uint8_t privateKey[32])</div><div class="ttdoc">Generates a private key for Ed25519 signing operations. </div><div class="ttdef"><b>Definition:</b> <a href="Ed25519_8cpp_source.html#l00243">Ed25519.cpp:243</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_aa6904b2727af6b767fe041b1b7f27414"><div class="ttname"><a href="classBigNumberUtil.html#aa6904b2727af6b767fe041b1b7f27414">BigNumberUtil::add</a></div><div class="ttdeci">static limb_t add(limb_t *result, const limb_t *x, const limb_t *y, size_t size)</div><div class="ttdoc">Adds two big numbers. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00495">BigNumberUtil.cpp:495</a></div></div>
|
|
<div class="ttc" id="classRNGClass_html_a418a833cf18198fd7e5d6dbd78c99c29"><div class="ttname"><a href="classRNGClass.html#a418a833cf18198fd7e5d6dbd78c99c29">RNGClass::rand</a></div><div class="ttdeci">void rand(uint8_t *data, size_t len)</div><div class="ttdoc">Generates random bytes into a caller-supplied buffer. </div><div class="ttdef"><b>Definition:</b> <a href="RNG_8cpp_source.html#l00566">RNG.cpp:566</a></div></div>
|
|
<div class="ttc" id="classEd25519_html_ae3e2fc405c9cd8cb1d3ab9b8b452d3e4"><div class="ttname"><a href="classEd25519.html#ae3e2fc405c9cd8cb1d3ab9b8b452d3e4">Ed25519::verify</a></div><div class="ttdeci">static bool verify(const uint8_t signature[64], const uint8_t publicKey[32], const void *message, size_t len)</div><div class="ttdoc">Verifies a signature using a specific Ed25519 public key. </div><div class="ttdef"><b>Definition:</b> <a href="Ed25519_8cpp_source.html#l00189">Ed25519.cpp:189</a></div></div>
|
|
<div class="ttc" id="classSHA512_html"><div class="ttname"><a href="classSHA512.html">SHA512</a></div><div class="ttdoc">SHA-512 hash algorithm. </div><div class="ttdef"><b>Definition:</b> <a href="SHA512_8h_source.html#l00030">SHA512.h:30</a></div></div>
|
|
<div class="ttc" id="classSHA512_html_a0d009e8d9157c3f14323e68631c33e97"><div class="ttname"><a href="classSHA512.html#a0d009e8d9157c3f14323e68631c33e97">SHA512::reset</a></div><div class="ttdeci">void reset()</div><div class="ttdoc">Resets the hash ready for a new hashing process. </div><div class="ttdef"><b>Definition:</b> <a href="SHA512_8cpp_source.html#l00066">SHA512.cpp:66</a></div></div>
|
|
<div class="ttc" id="classSHA512_html_a7d37a20d7ab431ab15d094f768b6a695"><div class="ttname"><a href="classSHA512.html#a7d37a20d7ab431ab15d094f768b6a695">SHA512::update</a></div><div class="ttdeci">void update(const void *data, size_t len)</div><div class="ttdoc">Updates the hash with more data. </div><div class="ttdef"><b>Definition:</b> <a href="SHA512_8cpp_source.html#l00079">SHA512.cpp:79</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a6618e03bfcb3086961df508b40cc1e67"><div class="ttname"><a href="classBigNumberUtil.html#a6618e03bfcb3086961df508b40cc1e67">BigNumberUtil::sub</a></div><div class="ttdeci">static limb_t sub(limb_t *result, const limb_t *x, const limb_t *y, size_t size)</div><div class="ttdoc">Subtracts one big number from another. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00522">BigNumberUtil.cpp:522</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_aacdee1806a239eb9e58753ef1ddb964a"><div class="ttname"><a href="classBigNumberUtil.html#aacdee1806a239eb9e58753ef1ddb964a">BigNumberUtil::mul_P</a></div><div class="ttdeci">static void mul_P(limb_t *result, const limb_t *x, size_t xcount, const limb_t *y, size_t ycount)</div><div class="ttdoc">Multiplies two big numbers where one is in program memory. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00680">BigNumberUtil.cpp:680</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a25041f898c417c8dd63f30536287ed79"><div class="ttname"><a href="classBigNumberUtil.html#a25041f898c417c8dd63f30536287ed79">BigNumberUtil::unpackLE</a></div><div class="ttdeci">static void unpackLE(limb_t *limbs, size_t count, const uint8_t *bytes, size_t len)</div><div class="ttdoc">Unpacks the little-endian byte representation of a big number into a limb array. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00055">BigNumberUtil.cpp:55</a></div></div>
|
|
<div class="ttc" id="classSHA512_html_afc136ad0e77de527b031db3fb8b32464"><div class="ttname"><a href="classSHA512.html#afc136ad0e77de527b031db3fb8b32464">SHA512::finalize</a></div><div class="ttdeci">void finalize(void *hash, size_t len)</div><div class="ttdoc">Finalizes the hashing process and returns the hash. </div><div class="ttdef"><b>Definition:</b> <a href="SHA512_8cpp_source.html#l00105">SHA512.cpp:105</a></div></div>
|
|
<div class="ttc" id="classBigNumberUtil_html_a989cd5f389ac5adc798d8767383e2810"><div class="ttname"><a href="classBigNumberUtil.html#a989cd5f389ac5adc798d8767383e2810">BigNumberUtil::packLE</a></div><div class="ttdeci">static void packLE(uint8_t *bytes, size_t len, const limb_t *limbs, size_t count)</div><div class="ttdoc">Packs the little-endian byte representation of a big number into a byte array. </div><div class="ttdef"><b>Definition:</b> <a href="BigNumberUtil_8cpp_source.html#l00264">BigNumberUtil.cpp:264</a></div></div>
|
|
<div class="ttc" id="classEd25519_html_a36ecf67b4c5d2d39a31888f56af1f8a5"><div class="ttname"><a href="classEd25519.html#a36ecf67b4c5d2d39a31888f56af1f8a5">Ed25519::sign</a></div><div class="ttdeci">static void sign(uint8_t signature[64], const uint8_t privateKey[32], const uint8_t publicKey[32], const void *message, size_t len)</div><div class="ttdoc">Signs a message using a specific Ed25519 private key. </div><div class="ttdef"><b>Definition:</b> <a href="Ed25519_8cpp_source.html#l00127">Ed25519.cpp:127</a></div></div>
|
|
<div class="ttc" id="classEd25519_html_ab62bac52ed07f77f76f3ff0fccd71cb2"><div class="ttname"><a href="classEd25519.html#ab62bac52ed07f77f76f3ff0fccd71cb2">Ed25519::derivePublicKey</a></div><div class="ttdeci">static void derivePublicKey(uint8_t publicKey[32], const uint8_t privateKey[32])</div><div class="ttdoc">Derives the public key from a private key. </div><div class="ttdef"><b>Definition:</b> <a href="Ed25519_8cpp_source.html#l00256">Ed25519.cpp:256</a></div></div>
|
|
</div><!-- fragment --></div><!-- contents -->
|
|
<!-- start footer part -->
|
|
<hr class="footer"/><address class="footer"><small>
|
|
Generated on Mon Apr 2 2018 18:36:52 for ArduinoLibs by  <a href="http://www.doxygen.org/index.html">
|
|
<img class="footer" src="doxygen.png" alt="doxygen"/>
|
|
</a> 1.8.6
|
|
</small></address>
|
|
</body>
|
|
</html>
|