crypto_curve25519.c 8.82 KB
Newer Older
1
/* Copyright (c) 2012-2015, The Tor Project, Inc. */
2
3
4
5
6
7
/* See LICENSE for licensing information */

/* Wrapper code for a curve25519 implementation. */

#define CRYPTO_CURVE25519_PRIVATE
#include "orconfig.h"
8
9
10
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
11
#include "container.h"
12
13
14
#include "crypto.h"
#include "crypto_curve25519.h"
#include "util.h"
15
#include "torlog.h"
16
17
18
19
20
21
22
23
24
25

/* ==============================
   Part 1: wrap a suitable curve25519 implementation as curve25519_impl
   ============================== */

#ifdef USE_CURVE25519_DONNA
int curve25519_donna(uint8_t *mypublic,
                     const uint8_t *secret, const uint8_t *basepoint);
#endif
#ifdef USE_CURVE25519_NACL
26
#ifdef HAVE_CRYPTO_SCALARMULT_CURVE25519_H
27
#include <crypto_scalarmult_curve25519.h>
28
29
30
#elif defined(HAVE_NACL_CRYPTO_SCALARMULT_CURVE25519_H)
#include <nacl/crypto_scalarmult_curve25519.h>
#endif
31
32
#endif

33
STATIC int
34
35
36
curve25519_impl(uint8_t *output, const uint8_t *secret,
                const uint8_t *basepoint)
{
37
38
39
40
41
  uint8_t bp[CURVE25519_PUBKEY_LEN];
  int r;
  memcpy(bp, basepoint, CURVE25519_PUBKEY_LEN);
  /* Clear the high bit, in case our backend foolishly looks at it. */
  bp[31] &= 0x7f;
42
#ifdef USE_CURVE25519_DONNA
43
  r = curve25519_donna(output, secret, bp);
44
#elif defined(USE_CURVE25519_NACL)
45
  r = crypto_scalarmult_curve25519(output, secret, bp);
46
47
48
#else
#error "No implementation of curve25519 is available."
#endif
49
50
  memwipe(bp, 0, sizeof(bp));
  return r;
51
52
53
54
55
56
57
58
59
60
61
62
63
}

/* ==============================
   Part 2: Wrap curve25519_impl with some convenience types and functions.
   ============================== */

/**
 * Return true iff a curve25519_public_key_t seems valid. (It's not necessary
 * to see if the point is on the curve, since the twist is also secure, but we
 * do need to make sure that it isn't the point at infinity.) */
int
curve25519_public_key_is_ok(const curve25519_public_key_t *key)
{
64
  return !safe_mem_is_zero(key->public_key, CURVE25519_PUBKEY_LEN);
65
66
}

67
68
69
70
71
72
73
74
75
/**
 * Generate CURVE25519_SECKEY_LEN random bytes in <b>out</b>. If
 * <b>extra_strong</b> is true, this key is possibly going to get used more
 * than once, so use a better-than-usual RNG. Return 0 on success, -1 on
 * failure.
 *
 * This function does not adjust the output of the RNG at all; the will caller
 * will need to clear or set the appropriate bits to make curve25519 work.
 */
76
int
77
curve25519_rand_seckey_bytes(uint8_t *out, int extra_strong)
78
{
79
  uint8_t k_tmp[CURVE25519_SECKEY_LEN];
80

81
  if (crypto_rand((char*)out, CURVE25519_SECKEY_LEN) < 0)
82
    return -1;
83
84
  if (extra_strong && !crypto_strongest_rand(k_tmp, CURVE25519_SECKEY_LEN)) {
    /* If they asked for extra-strong entropy and we have some, use it as an
85
     * HMAC key to improve not-so-good entropy rather than using it directly,
86
     * just in case the extra-strong entropy is less amazing than we hoped. */
87
88
89
    crypto_hmac_sha256((char*) out,
                       (const char *)k_tmp, sizeof(k_tmp),
                       (const char *)out, CURVE25519_SECKEY_LEN);
90
91
  }
  memwipe(k_tmp, 0, sizeof(k_tmp));
92
93
94
95
96
97
98
99
100
101
102
103
104
  return 0;
}

/** Generate a new keypair and return the secret key.  If <b>extra_strong</b>
 * is true, this key is possibly going to get used more than once, so
 * use a better-than-usual RNG. Return 0 on success, -1 on failure. */
int
curve25519_secret_key_generate(curve25519_secret_key_t *key_out,
                               int extra_strong)
{
  if (curve25519_rand_seckey_bytes(key_out->secret_key, extra_strong) < 0)
    return -1;

105
106
107
  key_out->secret_key[0] &= 248;
  key_out->secret_key[31] &= 127;
  key_out->secret_key[31] |= 64;
108
109

  return 0;
110
111
112
113
114
115
116
117
118
119
120
}

void
curve25519_public_key_generate(curve25519_public_key_t *key_out,
                               const curve25519_secret_key_t *seckey)
{
  static const uint8_t basepoint[32] = {9};

  curve25519_impl(key_out->public_key, seckey->secret_key, basepoint);
}

121
int
122
123
124
curve25519_keypair_generate(curve25519_keypair_t *keypair_out,
                            int extra_strong)
{
125
126
  if (curve25519_secret_key_generate(&keypair_out->seckey, extra_strong) < 0)
    return -1;
127
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
128
  return 0;
129
130
}

131
132
133
134
135
136
137
/** Write the <b>datalen</b> bytes from <b>data</b> to the file named
 * <b>fname</b> in the tagged-data format.  This format contains a
 * 32-byte header, followed by the data itself.  The header is the
 * NUL-padded string "== <b>typestring</b>: <b>tag</b> ==".  The length
 * of <b>typestring</b> and <b>tag</b> must therefore be no more than
 * 24.
 **/
138
int
139
140
141
142
143
crypto_write_tagged_contents_to_file(const char *fname,
                                     const char *typestring,
                                     const char *tag,
                                     const uint8_t *data,
                                     size_t datalen)
144
{
145
146
147
148
  char header[32];
  smartlist_t *chunks = smartlist_new();
  sized_chunk_t ch0, ch1;
  int r = -1;
149

150
151
152
153
154
155
156
157
158
159
  memset(header, 0, sizeof(header));
  if (tor_snprintf(header, sizeof(header),
                   "== %s: %s ==", typestring, tag) < 0)
    goto end;
  ch0.bytes = header;
  ch0.len = 32;
  ch1.bytes = (const char*) data;
  ch1.len = datalen;
  smartlist_add(chunks, &ch0);
  smartlist_add(chunks, &ch1);
160

161
  r = write_chunks_to_file(fname, chunks, 1, 0);
162

163
164
 end:
  smartlist_free(chunks);
165
166
167
  return r;
}

168
169
170
171
172
/** Read a tagged-data file from <b>fname</b> into the
 * <b>data_out_len</b>-byte buffer in <b>data_out</b>. Check that the
 * typestring matches <b>typestring</b>; store the tag into a newly allocated
 * string in <b>tag_out</b>. Return -1 on failure, and the number of bytes of
 * data on success. */
173
174
175
176
177
178
ssize_t
crypto_read_tagged_contents_from_file(const char *fname,
                                      const char *typestring,
                                      char **tag_out,
                                      uint8_t *data_out,
                                      ssize_t data_out_len)
179
180
{
  char prefix[33];
181
  char *content = NULL;
182
  struct stat st;
183
  ssize_t r = -1;
Nick Mathewson's avatar
Nick Mathewson committed
184
  size_t st_size = 0;
185
186
187
188
189
190

  *tag_out = NULL;
  st.st_size = 0;
  content = read_file_to_str(fname, RFTS_BIN|RFTS_IGNORE_MISSING, &st);
  if (! content)
    goto end;
191
  if (st.st_size < 32 || st.st_size > 32 + data_out_len)
192
    goto end;
193
  st_size = (size_t)st.st_size;
194
195

  memcpy(prefix, content, 32);
196
197
198
199
  prefix[32] = 0;
  /* Check type, extract tag. */
  if (strcmpstart(prefix, "== ") || strcmpend(prefix, " ==") ||
      ! tor_mem_is_zero(prefix+strlen(prefix), 32-strlen(prefix)))
200
201
    goto end;

202
203
204
205
206
207
208
209
  if (strcmpstart(prefix+3, typestring) ||
      3+strlen(typestring) >= 32 ||
      strcmpstart(prefix+3+strlen(typestring), ": "))
    goto end;

  *tag_out = tor_strndup(prefix+5+strlen(typestring),
                         strlen(prefix)-8-strlen(typestring));

210
211
  memcpy(data_out, content+32, st_size-32);
  r = st_size - 32;
212
213
214

 end:
  if (content)
215
    memwipe(content, 0, st_size);
216
217
218
219
220
221
222
223
224
225
226
227
  tor_free(content);
  return r;
}

/** DOCDOC */
int
curve25519_keypair_write_to_file(const curve25519_keypair_t *keypair,
                                 const char *fname,
                                 const char *tag)
{
  uint8_t contents[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  int r;
228

229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
  memcpy(contents, keypair->seckey.secret_key, CURVE25519_SECKEY_LEN);
  memcpy(contents+CURVE25519_SECKEY_LEN,
         keypair->pubkey.public_key, CURVE25519_PUBKEY_LEN);

  r = crypto_write_tagged_contents_to_file(fname,
                                           "c25519v1",
                                           tag,
                                           contents,
                                           sizeof(contents));

  memwipe(contents, 0, sizeof(contents));
  return r;
}

/** DOCDOC */
int
curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out,
                                  char **tag_out,
                                  const char *fname)
{
  uint8_t content[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  ssize_t len;
  int r = -1;

  len = crypto_read_tagged_contents_from_file(fname, "c25519v1", tag_out,
                                              content, sizeof(content));
  if (len != sizeof(content))
    goto end;

  memcpy(keypair_out->seckey.secret_key, content, CURVE25519_SECKEY_LEN);
259
260
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
  if (tor_memneq(keypair_out->pubkey.public_key,
261
                 content + CURVE25519_SECKEY_LEN,
262
263
264
265
266
267
                 CURVE25519_PUBKEY_LEN))
    goto end;

  r = 0;

 end:
268
  memwipe(content, 0, sizeof(content));
269
270
271
272
273
274
275
  if (r != 0) {
    memset(keypair_out, 0, sizeof(*keypair_out));
    tor_free(*tag_out);
  }
  return r;
}

276
277
278
279
280
281
282
283
284
285
/** Perform the curve25519 ECDH handshake with <b>skey</b> and <b>pkey</b>,
 * writing CURVE25519_OUTPUT_LEN bytes of output into <b>output</b>. */
void
curve25519_handshake(uint8_t *output,
                     const curve25519_secret_key_t *skey,
                     const curve25519_public_key_t *pkey)
{
  curve25519_impl(output, skey->secret_key, pkey->public_key);
}