crypto_curve25519.c 9.02 KB
Newer Older
Nick Mathewson's avatar
Nick Mathewson committed
1
/* Copyright (c) 2012-2016, The Tor Project, Inc. */
2
3
/* See LICENSE for licensing information */

4
5
6
7
8
/**
 * \file crypto_curve25519.c
 *
 * \brief Wrapper code for a curve25519 implementation.
 */
9
10
11

#define CRYPTO_CURVE25519_PRIVATE
#include "orconfig.h"
12
13
14
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
15
#include "container.h"
16
17
#include "crypto.h"
#include "crypto_curve25519.h"
18
#include "crypto_format.h"
19
#include "util.h"
20
#include "torlog.h"
21

22
23
#include "ed25519/donna/ed25519_donna_tor.h"

24
25
26
27
28
29
30
31
32
/* ==============================
   Part 1: wrap a suitable curve25519 implementation as curve25519_impl
   ============================== */

#ifdef USE_CURVE25519_DONNA
int curve25519_donna(uint8_t *mypublic,
                     const uint8_t *secret, const uint8_t *basepoint);
#endif
#ifdef USE_CURVE25519_NACL
33
#ifdef HAVE_CRYPTO_SCALARMULT_CURVE25519_H
34
#include <crypto_scalarmult_curve25519.h>
35
36
37
#elif defined(HAVE_NACL_CRYPTO_SCALARMULT_CURVE25519_H)
#include <nacl/crypto_scalarmult_curve25519.h>
#endif
38
39
#endif

40
41
42
43
static void pick_curve25519_basepoint_impl(void);

static int curve25519_use_ed = -1;

44
STATIC int
45
46
47
curve25519_impl(uint8_t *output, const uint8_t *secret,
                const uint8_t *basepoint)
{
48
49
50
51
52
  uint8_t bp[CURVE25519_PUBKEY_LEN];
  int r;
  memcpy(bp, basepoint, CURVE25519_PUBKEY_LEN);
  /* Clear the high bit, in case our backend foolishly looks at it. */
  bp[31] &= 0x7f;
53
#ifdef USE_CURVE25519_DONNA
54
  r = curve25519_donna(output, secret, bp);
55
#elif defined(USE_CURVE25519_NACL)
56
  r = crypto_scalarmult_curve25519(output, secret, bp);
57
58
59
#else
#error "No implementation of curve25519 is available."
#endif
60
61
  memwipe(bp, 0, sizeof(bp));
  return r;
62
63
}

64
65
66
67
STATIC int
curve25519_basepoint_impl(uint8_t *output, const uint8_t *secret)
{
  int r = 0;
68
69
  if (BUG(curve25519_use_ed == -1)) {
    /* LCOV_EXCL_START - Only reached if we forgot to call curve25519_init() */
70
    pick_curve25519_basepoint_impl();
71
    /* LCOV_EXCL_STOP */
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
  }

  /* TODO: Someone should benchmark curved25519_scalarmult_basepoint versus
   * an optimized NaCl build to see which should be used when compiled with
   * NaCl available.  I suspected that the ed25519 optimization always wins.
   */
  if (PREDICT_LIKELY(curve25519_use_ed == 1)) {
    curved25519_scalarmult_basepoint_donna(output, secret);
    r = 0;
  } else {
    static const uint8_t basepoint[32] = {9};
    r = curve25519_impl(output, secret, basepoint);
  }
  return r;
}

void
curve25519_set_impl_params(int use_ed)
{
  curve25519_use_ed = use_ed;
}

94
95
96
97
98
99
100
101
102
103
104
/* ==============================
   Part 2: Wrap curve25519_impl with some convenience types and functions.
   ============================== */

/**
 * Return true iff a curve25519_public_key_t seems valid. (It's not necessary
 * to see if the point is on the curve, since the twist is also secure, but we
 * do need to make sure that it isn't the point at infinity.) */
int
curve25519_public_key_is_ok(const curve25519_public_key_t *key)
{
105
  return !safe_mem_is_zero(key->public_key, CURVE25519_PUBKEY_LEN);
106
107
}

108
109
110
111
112
113
114
115
116
/**
 * Generate CURVE25519_SECKEY_LEN random bytes in <b>out</b>. If
 * <b>extra_strong</b> is true, this key is possibly going to get used more
 * than once, so use a better-than-usual RNG. Return 0 on success, -1 on
 * failure.
 *
 * This function does not adjust the output of the RNG at all; the will caller
 * will need to clear or set the appropriate bits to make curve25519 work.
 */
117
int
118
curve25519_rand_seckey_bytes(uint8_t *out, int extra_strong)
119
{
120
121
122
123
124
  if (extra_strong)
    crypto_strongest_rand(out, CURVE25519_SECKEY_LEN);
  else
    crypto_rand((char*)out, CURVE25519_SECKEY_LEN);

125
126
127
128
129
130
131
132
133
134
135
136
137
  return 0;
}

/** Generate a new keypair and return the secret key.  If <b>extra_strong</b>
 * is true, this key is possibly going to get used more than once, so
 * use a better-than-usual RNG. Return 0 on success, -1 on failure. */
int
curve25519_secret_key_generate(curve25519_secret_key_t *key_out,
                               int extra_strong)
{
  if (curve25519_rand_seckey_bytes(key_out->secret_key, extra_strong) < 0)
    return -1;

138
139
140
  key_out->secret_key[0] &= 248;
  key_out->secret_key[31] &= 127;
  key_out->secret_key[31] |= 64;
141
142

  return 0;
143
144
145
146
147
148
}

void
curve25519_public_key_generate(curve25519_public_key_t *key_out,
                               const curve25519_secret_key_t *seckey)
{
149
  curve25519_basepoint_impl(key_out->public_key, seckey->secret_key);
150
151
}

152
int
153
154
155
curve25519_keypair_generate(curve25519_keypair_t *keypair_out,
                            int extra_strong)
{
156
157
  if (curve25519_secret_key_generate(&keypair_out->seckey, extra_strong) < 0)
    return -1;
158
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
159
  return 0;
160
161
}

162
/* DOCDOC */
163
164
165
166
167
168
169
int
curve25519_keypair_write_to_file(const curve25519_keypair_t *keypair,
                                 const char *fname,
                                 const char *tag)
{
  uint8_t contents[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  int r;
170

171
172
173
174
175
176
177
178
179
180
181
182
183
184
  memcpy(contents, keypair->seckey.secret_key, CURVE25519_SECKEY_LEN);
  memcpy(contents+CURVE25519_SECKEY_LEN,
         keypair->pubkey.public_key, CURVE25519_PUBKEY_LEN);

  r = crypto_write_tagged_contents_to_file(fname,
                                           "c25519v1",
                                           tag,
                                           contents,
                                           sizeof(contents));

  memwipe(contents, 0, sizeof(contents));
  return r;
}

185
/* DOCDOC */
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
int
curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out,
                                  char **tag_out,
                                  const char *fname)
{
  uint8_t content[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  ssize_t len;
  int r = -1;

  len = crypto_read_tagged_contents_from_file(fname, "c25519v1", tag_out,
                                              content, sizeof(content));
  if (len != sizeof(content))
    goto end;

  memcpy(keypair_out->seckey.secret_key, content, CURVE25519_SECKEY_LEN);
201
202
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
  if (tor_memneq(keypair_out->pubkey.public_key,
203
                 content + CURVE25519_SECKEY_LEN,
204
205
206
207
208
209
                 CURVE25519_PUBKEY_LEN))
    goto end;

  r = 0;

 end:
210
  memwipe(content, 0, sizeof(content));
211
212
213
214
215
216
217
  if (r != 0) {
    memset(keypair_out, 0, sizeof(*keypair_out));
    tor_free(*tag_out);
  }
  return r;
}

218
219
220
221
222
223
224
225
226
227
/** Perform the curve25519 ECDH handshake with <b>skey</b> and <b>pkey</b>,
 * writing CURVE25519_OUTPUT_LEN bytes of output into <b>output</b>. */
void
curve25519_handshake(uint8_t *output,
                     const curve25519_secret_key_t *skey,
                     const curve25519_public_key_t *pkey)
{
  curve25519_impl(output, skey->secret_key, pkey->public_key);
}

228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
/** Check whether the ed25519-based curve25519 basepoint optimization seems to
 * be working. If so, return 0; otherwise return -1. */
static int
curve25519_basepoint_spot_check(void)
{
  static const uint8_t alicesk[32] = {
    0x77,0x07,0x6d,0x0a,0x73,0x18,0xa5,0x7d,
    0x3c,0x16,0xc1,0x72,0x51,0xb2,0x66,0x45,
    0xdf,0x4c,0x2f,0x87,0xeb,0xc0,0x99,0x2a,
    0xb1,0x77,0xfb,0xa5,0x1d,0xb9,0x2c,0x2a
  };
  static const uint8_t alicepk[32] = {
    0x85,0x20,0xf0,0x09,0x89,0x30,0xa7,0x54,
    0x74,0x8b,0x7d,0xdc,0xb4,0x3e,0xf7,0x5a,
    0x0d,0xbf,0x3a,0x0d,0x26,0x38,0x1a,0xf4,
    0xeb,0xa4,0xa9,0x8e,0xaa,0x9b,0x4e,0x6a
  };
  const int loop_max=200;
  int save_use_ed = curve25519_use_ed;
  unsigned char e1[32] = { 5 };
  unsigned char e2[32] = { 5 };
  unsigned char x[32],y[32];
  int i;
  int r=0;

  /* Check the most basic possible sanity via the test secret/public key pair
   * used in "Cryptography in NaCl - 2. Secret keys and public keys".  This
Nick Mathewson's avatar
Nick Mathewson committed
255
   * may catch catastrophic failures on systems where Curve25519 is expensive,
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
   * without requiring a ton of key generation.
   */
  curve25519_use_ed = 1;
  r |= curve25519_basepoint_impl(x, alicesk);
  if (fast_memneq(x, alicepk, 32))
    goto fail;

  /* Ok, the optimization appears to produce passable results, try a few more
   * values, maybe there's something subtle wrong.
   */
  for (i = 0; i < loop_max; ++i) {
    curve25519_use_ed = 0;
    r |= curve25519_basepoint_impl(x, e1);
    curve25519_use_ed = 1;
    r |= curve25519_basepoint_impl(y, e2);
    if (fast_memneq(x,y,32))
      goto fail;
    memcpy(e1, x, 32);
    memcpy(e2, x, 32);
  }

  goto end;
 fail:
  r = -1;
 end:
  curve25519_use_ed = save_use_ed;
  return r;
}

/** Choose whether to use the ed25519-based curve25519-basepoint
 * implementation. */
static void
pick_curve25519_basepoint_impl(void)
{
  curve25519_use_ed = 1;

  if (curve25519_basepoint_spot_check() == 0)
    return;

295
296
297
  /* LCOV_EXCL_START
   * only reachable if our basepoint implementation broken */
  log_warn(LD_BUG|LD_CRYPTO, "The ed25519-based curve25519 basepoint "
298
299
300
           "multiplication seems broken; using the curve25519 "
           "implementation.");
  curve25519_use_ed = 0;
301
  /* LCOV_EXCL_STOP */
302
303
304
305
306
307
308
309
310
311
}

/** Initialize the curve25519 implementations. This is necessary if you're
 * going to use them in a multithreaded setting, and not otherwise. */
void
curve25519_init(void)
{
  pick_curve25519_basepoint_impl();
}