crypto_curve25519.c 8.16 KB
Newer Older
1
/* Copyright (c) 2012-2013, The Tor Project, Inc. */
2
3
4
5
6
7
/* See LICENSE for licensing information */

/* Wrapper code for a curve25519 implementation. */

#define CRYPTO_CURVE25519_PRIVATE
#include "orconfig.h"
8
9
10
#ifdef HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
11
#include "container.h"
12
13
14
#include "crypto.h"
#include "crypto_curve25519.h"
#include "util.h"
15
#include "torlog.h"
16
17
18
19
20
21
22
23
24
25

/* ==============================
   Part 1: wrap a suitable curve25519 implementation as curve25519_impl
   ============================== */

#ifdef USE_CURVE25519_DONNA
int curve25519_donna(uint8_t *mypublic,
                     const uint8_t *secret, const uint8_t *basepoint);
#endif
#ifdef USE_CURVE25519_NACL
26
#ifdef HAVE_CRYPTO_SCALARMULT_CURVE25519_H
27
#include <crypto_scalarmult_curve25519.h>
28
29
30
#elif defined(HAVE_NACL_CRYPTO_SCALARMULT_CURVE25519_H)
#include <nacl/crypto_scalarmult_curve25519.h>
#endif
31
32
#endif

33
STATIC int
34
35
36
curve25519_impl(uint8_t *output, const uint8_t *secret,
                const uint8_t *basepoint)
{
37
38
39
40
41
  uint8_t bp[CURVE25519_PUBKEY_LEN];
  int r;
  memcpy(bp, basepoint, CURVE25519_PUBKEY_LEN);
  /* Clear the high bit, in case our backend foolishly looks at it. */
  bp[31] &= 0x7f;
42
#ifdef USE_CURVE25519_DONNA
43
  r = curve25519_donna(output, secret, bp);
44
#elif defined(USE_CURVE25519_NACL)
45
  r = crypto_scalarmult_curve25519(output, secret, bp);
46
47
48
#else
#error "No implementation of curve25519 is available."
#endif
49
50
  memwipe(bp, 0, sizeof(bp));
  return r;
51
52
53
54
55
56
57
58
59
60
61
62
63
}

/* ==============================
   Part 2: Wrap curve25519_impl with some convenience types and functions.
   ============================== */

/**
 * Return true iff a curve25519_public_key_t seems valid. (It's not necessary
 * to see if the point is on the curve, since the twist is also secure, but we
 * do need to make sure that it isn't the point at infinity.) */
int
curve25519_public_key_is_ok(const curve25519_public_key_t *key)
{
64
  return !safe_mem_is_zero(key->public_key, CURVE25519_PUBKEY_LEN);
65
66
}

67
68
69
70
71
72
73
74
75
/**
 * Generate CURVE25519_SECKEY_LEN random bytes in <b>out</b>. If
 * <b>extra_strong</b> is true, this key is possibly going to get used more
 * than once, so use a better-than-usual RNG. Return 0 on success, -1 on
 * failure.
 *
 * This function does not adjust the output of the RNG at all; the will caller
 * will need to clear or set the appropriate bits to make curve25519 work.
 */
76
int
77
curve25519_rand_seckey_bytes(uint8_t *out, int extra_strong)
78
{
79
  uint8_t k_tmp[CURVE25519_SECKEY_LEN];
80

81
  if (crypto_rand((char*)out, CURVE25519_SECKEY_LEN) < 0)
82
    return -1;
83
84
  if (extra_strong && !crypto_strongest_rand(k_tmp, CURVE25519_SECKEY_LEN)) {
    /* If they asked for extra-strong entropy and we have some, use it as an
85
     * HMAC key to improve not-so-good entropy rather than using it directly,
86
     * just in case the extra-strong entropy is less amazing than we hoped. */
87
88
89
    crypto_hmac_sha256((char*) out,
                       (const char *)k_tmp, sizeof(k_tmp),
                       (const char *)out, CURVE25519_SECKEY_LEN);
90
91
  }
  memwipe(k_tmp, 0, sizeof(k_tmp));
92
93
94
95
96
97
98
99
100
101
102
103
104
  return 0;
}

/** Generate a new keypair and return the secret key.  If <b>extra_strong</b>
 * is true, this key is possibly going to get used more than once, so
 * use a better-than-usual RNG. Return 0 on success, -1 on failure. */
int
curve25519_secret_key_generate(curve25519_secret_key_t *key_out,
                               int extra_strong)
{
  if (curve25519_rand_seckey_bytes(key_out->secret_key, extra_strong) < 0)
    return -1;

105
106
107
  key_out->secret_key[0] &= 248;
  key_out->secret_key[31] &= 127;
  key_out->secret_key[31] |= 64;
108
109

  return 0;
110
111
112
113
114
115
116
117
118
119
120
}

void
curve25519_public_key_generate(curve25519_public_key_t *key_out,
                               const curve25519_secret_key_t *seckey)
{
  static const uint8_t basepoint[32] = {9};

  curve25519_impl(key_out->public_key, seckey->secret_key, basepoint);
}

121
int
122
123
124
curve25519_keypair_generate(curve25519_keypair_t *keypair_out,
                            int extra_strong)
{
125
126
  if (curve25519_secret_key_generate(&keypair_out->seckey, extra_strong) < 0)
    return -1;
127
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
128
  return 0;
129
130
}

131
/** DOCDOC */
132
int
133
134
135
136
137
crypto_write_tagged_contents_to_file(const char *fname,
                                     const char *typestring,
                                     const char *tag,
                                     const uint8_t *data,
                                     size_t datalen)
138
{
139
140
141
142
  char header[32];
  smartlist_t *chunks = smartlist_new();
  sized_chunk_t ch0, ch1;
  int r = -1;
143

144
145
146
147
148
149
150
151
152
153
  memset(header, 0, sizeof(header));
  if (tor_snprintf(header, sizeof(header),
                   "== %s: %s ==", typestring, tag) < 0)
    goto end;
  ch0.bytes = header;
  ch0.len = 32;
  ch1.bytes = (const char*) data;
  ch1.len = datalen;
  smartlist_add(chunks, &ch0);
  smartlist_add(chunks, &ch1);
154

155
  r = write_chunks_to_file(fname, chunks, 1, 0);
156

157
158
 end:
  smartlist_free(chunks);
159
160
161
  return r;
}

162
163
164
165
166
167
168
/** DOCDOC */
ssize_t
crypto_read_tagged_contents_from_file(const char *fname,
                                      const char *typestring,
                                      char **tag_out,
                                      uint8_t *data_out,
                                      ssize_t data_out_len)
169
170
{
  char prefix[33];
171
  char *content = NULL;
172
  struct stat st;
173
  ssize_t r = -1;
174
175
176
177
178
179

  *tag_out = NULL;
  st.st_size = 0;
  content = read_file_to_str(fname, RFTS_BIN|RFTS_IGNORE_MISSING, &st);
  if (! content)
    goto end;
180
  if (st.st_size < 32 || st.st_size > 32 + data_out_len)
181
182
183
    goto end;

  memcpy(prefix, content, 32);
184
185
186
187
  prefix[32] = 0;
  /* Check type, extract tag. */
  if (strcmpstart(prefix, "== ") || strcmpend(prefix, " ==") ||
      ! tor_mem_is_zero(prefix+strlen(prefix), 32-strlen(prefix)))
188
189
    goto end;

190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
  if (strcmpstart(prefix+3, typestring) ||
      3+strlen(typestring) >= 32 ||
      strcmpstart(prefix+3+strlen(typestring), ": "))
    goto end;

  *tag_out = tor_strndup(prefix+5+strlen(typestring),
                         strlen(prefix)-8-strlen(typestring));

  memcpy(data_out, content+32, st.st_size-32);
  r = st.st_size - 32;

 end:
  if (content)
    memwipe(content, 0, st.st_size);
  tor_free(content);
  return r;
}

/** DOCDOC */
int
curve25519_keypair_write_to_file(const curve25519_keypair_t *keypair,
                                 const char *fname,
                                 const char *tag)
{
  uint8_t contents[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  int r;
216

217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
  memcpy(contents, keypair->seckey.secret_key, CURVE25519_SECKEY_LEN);
  memcpy(contents+CURVE25519_SECKEY_LEN,
         keypair->pubkey.public_key, CURVE25519_PUBKEY_LEN);

  r = crypto_write_tagged_contents_to_file(fname,
                                           "c25519v1",
                                           tag,
                                           contents,
                                           sizeof(contents));

  memwipe(contents, 0, sizeof(contents));
  return r;
}

/** DOCDOC */
int
curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out,
                                  char **tag_out,
                                  const char *fname)
{
  uint8_t content[CURVE25519_SECKEY_LEN + CURVE25519_PUBKEY_LEN];
  ssize_t len;
  int r = -1;

  len = crypto_read_tagged_contents_from_file(fname, "c25519v1", tag_out,
                                              content, sizeof(content));
  if (len != sizeof(content))
    goto end;

  memcpy(keypair_out->seckey.secret_key, content, CURVE25519_SECKEY_LEN);
247
248
  curve25519_public_key_generate(&keypair_out->pubkey, &keypair_out->seckey);
  if (tor_memneq(keypair_out->pubkey.public_key,
249
                 content + CURVE25519_SECKEY_LEN,
250
251
252
253
254
255
                 CURVE25519_PUBKEY_LEN))
    goto end;

  r = 0;

 end:
256
  memwipe(content, 0, sizeof(content));
257
258
259
260
261
262
263
  if (r != 0) {
    memset(keypair_out, 0, sizeof(*keypair_out));
    tor_free(*tag_out);
  }
  return r;
}

264
265
266
267
268
269
270
271
272
273
/** Perform the curve25519 ECDH handshake with <b>skey</b> and <b>pkey</b>,
 * writing CURVE25519_OUTPUT_LEN bytes of output into <b>output</b>. */
void
curve25519_handshake(uint8_t *output,
                     const curve25519_secret_key_t *skey,
                     const curve25519_public_key_t *pkey)
{
  curve25519_impl(output, skey->secret_key, pkey->public_key);
}