aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/curve25519.c

@@ -31,6 +31,28 @@
 #include "../internal.h"
 #include "../fipsmodule/cpucap/internal.h"
 
+// X25519 [1] and Ed25519 [2] is an ECDHE protocol and signature scheme,
+// respectively. This file contains an implementation of both using two
+// different backends:
+// 1) One backend is a pure C backend that should work on any platform.
+// 2) The other backend is machine-optimized using s2n-bignum [3] as backend.
+//
+// [1]: https://datatracker.ietf.org/doc/html/rfc7748
+// [2]: https://datatracker.ietf.org/doc/html/rfc8032
+// [3]: https://github.com/awslabs/s2n-bignum
+//
+// "Clamping":
+// Both X25519 and Ed25519 contain "clamping" steps; bit-twiddling, masking or
+// setting specific bits. Generally, the bit-twiddling is to avoid common
+// implementation errors and weak instances. Details can be found through the
+// following two references:
+// * https://mailarchive.ietf.org/arch/msg/cfrg/pt2bt3fGQbNF8qdEcorp-rJSJrc/
+// * https://neilmadden.blog/2020/05/28/whats-the-curve25519-clamping-all-about
+//
+// Ed25519 domain and pre-hash functions:
+// For Ed25519, dom2(F,C) is the empty string and PH the identify function,
+// cf. rfc8032 5.1.
+
 // If (1) x86_64 or aarch64, (2) linux or apple, and (3) OPENSSL_NO_ASM is not
 // set, s2n-bignum path is capable.
 #if ((defined(OPENSSL_X86_64) &&                                               \
@@ -43,7 +65,7 @@
 #endif
 
 
-OPENSSL_INLINE int x25519_s2n_bignum_capable(void) {
+OPENSSL_INLINE int curve25519_s2n_bignum_capable(void) {
 #if defined(CURVE25519_S2N_BIGNUM_CAPABLE)
   return 1;
 #else
@@ -51,6 +73,11 @@ OPENSSL_INLINE int x25519_s2n_bignum_capable(void) {
 #endif
 }
 
+// Return 0 until ED25519 lands in s2n-bignum
+OPENSSL_INLINE int ed25519_s2n_bignum_capable(void) {
+  return 0;
+}
+
 // Stub functions if implementations are not compiled.
 // These functions have to abort, otherwise we risk applications assuming they
 // did work without actually doing anything.
@@ -84,20 +111,20 @@ void curve25519_x25519base_byte_alt(uint8_t res[32], const uint8_t scalar[32]) {
 
 // Run-time detection for each implementation
 
-OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void);
-OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void);
+OPENSSL_INLINE int curve25519_s2n_bignum_alt_capable(void);
+OPENSSL_INLINE int curve25519_s2n_bignum_no_alt_capable(void);
 
-// For aarch64, |x25519_s2n_bignum_alt_capable| returns 1 if we categorize the
-// CPU as a CPU having a wide multiplier (i.e. "higher" throughput). CPUs with
-// this feature are e.g.: AWS Graviton 3 and Apple M1. Return 0 otherwise, so we
-// don't match CPUs without wide multipliers.
+// For aarch64, |curve25519_s2n_bignum_alt_capable| returns 1 if we categorize
+// the CPU as a CPU having a wide multiplier (i.e. "higher" throughput). CPUs
+// with this feature are e.g.: AWS Graviton 3 and Apple M1. Return 0 otherwise,
+// so we don't match CPUs without wide multipliers.
 //
-// For x86_64, |x25519_s2n_bignum_alt_capable| always returns 1. If x25519
+// For x86_64, |curve25519_s2n_bignum_alt_capable| always returns 1. If x25519
 // s2n-bignum capable, the x86_64 s2n-bignum-alt version should be supported on
 // pretty much any x86_64 CPU.
 //
 // For all other architectures, return 0.
-OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void) {
+OPENSSL_INLINE int curve25519_s2n_bignum_alt_capable(void) {
 #if defined(OPENSSL_X86_64)
   return 1;
 #elif defined(OPENSSL_AARCH64)
@@ -111,15 +138,15 @@ OPENSSL_INLINE int x25519_s2n_bignum_alt_capable(void) {
 #endif
 }
 
-// For aarch64, |x25519_s2n_bignum_no_alt_capable| always returns 1. If x25519
-// s2n-bignum capable, the Armv8 s2n-bignum-alt version should be supported on
-// pretty much any Armv8 CPU.
+// For aarch64, |curve25519_s2n_bignum_no_alt_capable| always returns 1. If
+// x25519 s2n-bignum capable, the Armv8 s2n-bignum-alt version should be
+// supported on pretty much any Armv8 CPU.
 //
-// For x86_64, |x25519_s2n_bignum_alt_capable| returns 1 if we detect support
-// for bmi+adx instruction sets. Return 0 otherwise.
+// For x86_64, |curve25519_s2n_bignum_alt_capable| returns 1 if we detect
+// support for bmi+adx instruction sets. Return 0 otherwise.
 //
 // For all other architectures, return 0.
-OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void) {
+OPENSSL_INLINE int curve25519_s2n_bignum_no_alt_capable(void) {
 #if defined(OPENSSL_X86_64)
   if (CRYPTO_is_BMI2_capable() == 1 && CRYPTO_is_ADX_capable() == 1) {
     return 1;
@@ -152,9 +179,9 @@ OPENSSL_INLINE int x25519_s2n_bignum_no_alt_capable(void) {
 //   prefer s2n-bignum-no-alt over s2n-bignum-alt if the former is supported.
 // For aarch64: if a wide multiplier is supported, we prefer s2n-bignum-alt over
 //   s2n-bignum-no-alt if the former is supported.
-//   x25519_s2n_bignum_alt_capable() specifically looks to match CPUs that have
-//   wide multipliers. this ensures that s2n-bignum-alt will only be used on
-//   such CPUs.
+//   |curve25519_s2n_bignum_alt_capable| specifically looks to match CPUs that
+//   have wide multipliers. this ensures that s2n-bignum-alt will only be used
+//   on such CPUs.
 
 static void x25519_s2n_bignum(uint8_t out_shared_key[32],
   const uint8_t private_key[32], const uint8_t peer_public_value[32]) {
@@ -167,10 +194,10 @@ static void x25519_s2n_bignum(uint8_t out_shared_key[32],
 
 #if defined(OPENSSL_X86_64)
 
-  if (x25519_s2n_bignum_no_alt_capable() == 1) {
+  if (curve25519_s2n_bignum_no_alt_capable() == 1) {
     curve25519_x25519_byte(out_shared_key, private_key_internal_demask,
       peer_public_value);
-  } else if (x25519_s2n_bignum_alt_capable() == 1) {
+  } else if (curve25519_s2n_bignum_alt_capable() == 1) {
     curve25519_x25519_byte_alt(out_shared_key, private_key_internal_demask,
       peer_public_value);
   } else {
@@ -179,10 +206,10 @@ static void x25519_s2n_bignum(uint8_t out_shared_key[32],
 
 #elif defined(OPENSSL_AARCH64)
 
-  if (x25519_s2n_bignum_alt_capable() == 1) {
+  if (curve25519_s2n_bignum_alt_capable() == 1) {
     curve25519_x25519_byte_alt(out_shared_key, private_key_internal_demask,
       peer_public_value);
-  } else if (x25519_s2n_bignum_no_alt_capable() == 1) {
+  } else if (curve25519_s2n_bignum_no_alt_capable() == 1) {
     curve25519_x25519_byte(out_shared_key, private_key_internal_demask,
       peer_public_value);
   } else {
@@ -208,9 +235,9 @@ static void x25519_s2n_bignum_public_from_private(
 
 #if defined(OPENSSL_X86_64)
 
-  if (x25519_s2n_bignum_no_alt_capable() == 1) {
+  if (curve25519_s2n_bignum_no_alt_capable() == 1) {
     curve25519_x25519base_byte(out_public_value, private_key_internal_demask);
-  } else if (x25519_s2n_bignum_alt_capable() == 1) {
+  } else if (curve25519_s2n_bignum_alt_capable() == 1) {
     curve25519_x25519base_byte_alt(out_public_value, private_key_internal_demask);
   } else {
     abort();
@@ -218,9 +245,9 @@ static void x25519_s2n_bignum_public_from_private(
 
 #elif defined(OPENSSL_AARCH64)
 
-  if (x25519_s2n_bignum_alt_capable() == 1) {
+  if (curve25519_s2n_bignum_alt_capable() == 1) {
     curve25519_x25519base_byte_alt(out_public_value, private_key_internal_demask);
-  } else if (x25519_s2n_bignum_no_alt_capable() == 1) {
+  } else if (curve25519_s2n_bignum_no_alt_capable() == 1) {
     curve25519_x25519base_byte(out_public_value, private_key_internal_demask);
   } else {
     abort();
@@ -234,96 +261,152 @@ static void x25519_s2n_bignum_public_from_private(
 #endif
 }
 
+// Stub function until ED25519 lands in s2n-bignum
+static void ed25519_public_key_from_hashed_seed_s2n_bignum(
+  uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
+  uint8_t az[SHA512_DIGEST_LENGTH]) {
+  abort();
+}
+
+// Stub function until Ed25519 lands in s2n-bignum
+// |s| is of length |ED25519_PRIVATE_KEY_SEED_LEN|
+// |A| is of length |ED25519_PUBLIC_KEY_LEN|.
+static void ed25519_sign_s2n_bignum(
+  uint8_t out_sig[ED25519_SIGNATURE_LEN],
+  uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
+  const void *message, size_t message_len) {
+  abort();
+}
+
+static int ed25519_verify_s2n_bignum(uint8_t R_computed_encoded[32],
+  const uint8_t public_key[32], uint8_t R_expected[32],
+  uint8_t S[32], const uint8_t *message, size_t message_len) {
+  abort();
+}
+
+void ed25519_sha512(uint8_t out[SHA512_DIGEST_LENGTH],
+  const void *input1, size_t len1, const void *input2, size_t len2,
+  const void *input3, size_t len3) {
+
+  SHA512_CTX hash_ctx;
+  SHA512_Init(&hash_ctx);
+  SHA512_Update(&hash_ctx, input1, len1);
+  SHA512_Update(&hash_ctx, input2, len2);
+  if (len3 != 0) {
+    SHA512_Update(&hash_ctx, input3, len3);
+  }
+  SHA512_Final(out, &hash_ctx);
+}
+
+void ED25519_keypair_from_seed(uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
+  uint8_t out_private_key[ED25519_PRIVATE_KEY_LEN],
+  const uint8_t seed[ED25519_SEED_LEN]) {
 
-void ED25519_keypair_from_seed(uint8_t out_public_key[32],
-                               uint8_t out_private_key[64],
-                               const uint8_t seed[ED25519_SEED_LEN]) {
+  // Step: rfc8032 5.1.5.1
+  // Compute SHA512(seed).
   uint8_t az[SHA512_DIGEST_LENGTH];
   SHA512(seed, ED25519_SEED_LEN, az);
 
-  az[0] &= 248;
-  az[31] &= 127;
-  az[31] |= 64;
+  // Step: rfc8032 5.1.5.2
+  az[0] &= 248; // 11111000_2
+  az[31] &= 127; // 01111111_2
+  az[31] |= 64; // 01000000_2
 
-  ge_p3 A;
-  x25519_ge_scalarmult_base(&A, az);
-  ge_p3_tobytes(out_public_key, &A);
+  // Step: rfc8032 5.1.5.[3,4]
+  // Compute [az]B and encode public key to a 32 byte octet.
+  if (ed25519_s2n_bignum_capable() == 1) {
+    ed25519_public_key_from_hashed_seed_s2n_bignum(out_public_key, az);
+  } else {
+    ed25519_public_key_from_hashed_seed_nohw(out_public_key, az);
+  }
 
+  // Encoded public key is a suffix in the private key. Avoids having to
+  // generate the public key from the private key when signing. 
+  OPENSSL_STATIC_ASSERT(ED25519_PRIVATE_KEY_LEN == (ED25519_SEED_LEN + ED25519_PUBLIC_KEY_LEN), ed25519_parameter_length_mismatch)
   OPENSSL_memcpy(out_private_key, seed, ED25519_SEED_LEN);
-  OPENSSL_memcpy(out_private_key + ED25519_SEED_LEN, out_public_key, 32);
+  OPENSSL_memcpy(out_private_key + ED25519_SEED_LEN, out_public_key,
+    ED25519_PUBLIC_KEY_LEN);
 }
 
-void ED25519_keypair(uint8_t out_public_key[32], uint8_t out_private_key[64]) {
+void ED25519_keypair(uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
+  uint8_t out_private_key[ED25519_PRIVATE_KEY_LEN]) {
+
+  // Ed25519 key generation: rfc8032 5.1.5
+  // Private key is 32 octets of random data.
   uint8_t seed[ED25519_SEED_LEN];
   RAND_bytes(seed, ED25519_SEED_LEN);
+
+  // Public key generation is handled in a separate function. See function
+  // description why this is useful.
   ED25519_keypair_from_seed(out_public_key, out_private_key, seed);
   OPENSSL_cleanse(seed, ED25519_SEED_LEN);
 }
 
-int ED25519_sign(uint8_t out_sig[64], const uint8_t *message,
-                 size_t message_len, const uint8_t private_key[64]) {
+int ED25519_sign(uint8_t out_sig[ED25519_SIGNATURE_LEN],
+                 const uint8_t *message, size_t message_len,
+                 const uint8_t private_key[ED25519_PRIVATE_KEY_LEN]) {
   // NOTE: The documentation on this function says that it returns zero on
   // allocation failure. While that can't happen with the current
   // implementation, we want to reserve the ability to allocate in this
   // implementation in the future.
 
+  // Ed25519 sign: rfc8032 5.1.6
+  //
+  // Step: rfc8032 5.1.6.1
+  // This step is a repeat of rfc8032 5.1.5.[1,2].
+  // seed = private_key[0:31]
+  // A = private_key[32:61] (per 5.1.5.4)
+  // Compute az = SHA512(seed).
   uint8_t az[SHA512_DIGEST_LENGTH];
-  SHA512(private_key, 32, az);
-
-  az[0] &= 248;
-  az[31] &= 63;
-  az[31] |= 64;
-
-  SHA512_CTX hash_ctx;
-  SHA512_Init(&hash_ctx);
-  SHA512_Update(&hash_ctx, az + 32, 32);
-  SHA512_Update(&hash_ctx, message, message_len);
-  uint8_t nonce[SHA512_DIGEST_LENGTH];
-  SHA512_Final(nonce, &hash_ctx);
-
-  x25519_sc_reduce(nonce);
-  ge_p3 R;
-  x25519_ge_scalarmult_base(&R, nonce);
-  ge_p3_tobytes(out_sig, &R);
-
-  SHA512_Init(&hash_ctx);
-  SHA512_Update(&hash_ctx, out_sig, 32);
-  SHA512_Update(&hash_ctx, private_key + 32, 32);
-  SHA512_Update(&hash_ctx, message, message_len);
-  uint8_t hram[SHA512_DIGEST_LENGTH];
-  SHA512_Final(hram, &hash_ctx);
-
-  x25519_sc_reduce(hram);
-  sc_muladd(out_sig + 32, hram, az, nonce);
+  SHA512(private_key, ED25519_PRIVATE_KEY_SEED_LEN, az);
+  // s = az[0:31]
+  // prefix = az[32:61]
+  az[0] &= 248; // 11111000_2
+  az[31] &= 63; // 00111111_2
+  az[31] |= 64; // 01000000_2
+
+  // Step: rfc8032 5.1.6.2
+  // Compute r = SHA512(prefix || message).
+  uint8_t r[SHA512_DIGEST_LENGTH];
+  ed25519_sha512(r, az + ED25519_PRIVATE_KEY_SEED_LEN,
+    ED25519_PRIVATE_KEY_SEED_LEN, message, message_len, NULL, 0);
+
+  // Step: rfc8032 5.1.6.[3,5,6,7]
+  if (ed25519_s2n_bignum_capable() == 1) {
+    ed25519_sign_s2n_bignum(out_sig, r, az,
+      private_key + ED25519_PRIVATE_KEY_SEED_LEN, message, message_len);
+  } else {
+    ed25519_sign_nohw(out_sig, r, az,
+      private_key + ED25519_PRIVATE_KEY_SEED_LEN, message, message_len);
+  }
 
   return 1;
 }
 
 int ED25519_verify(const uint8_t *message, size_t message_len,
-                   const uint8_t signature[64], const uint8_t public_key[32]) {
-  ge_p3 A;
-  if ((signature[63] & 224) != 0 ||
-      !x25519_ge_frombytes_vartime(&A, public_key)) {
+                   const uint8_t signature[ED25519_SIGNATURE_LEN],
+                   const uint8_t public_key[ED25519_PUBLIC_KEY_LEN]) {
+
+  // Ed25519 verify: rfc8032 5.1.7
+
+  // Step: rfc8032 5.1.7.1 (up to decoding the public key)
+  // Decode signature as:
+  //  - signature[0:31]: encoded point R, aliased to R_expected.
+  //  - signature[32:61]: integer S.
+  uint8_t R_expected[32];
+  OPENSSL_memcpy(R_expected, signature, 32);
+  uint8_t S[32];
+  OPENSSL_memcpy(S, signature + 32, 32);
+
+  // Per rfc8032 5.1.6.6
+  // "the three most significant bits of the final octet are always zero"
+  // 224 = 11100000_2
+  if ((signature[63] & 224) != 0) {
     return 0;
   }
 
-  fe_loose t;
-  fe_neg(&t, &A.X);
-  fe_carry(&A.X, &t);
-  fe_neg(&t, &A.T);
-  fe_carry(&A.T, &t);
-
-  uint8_t pkcopy[32];
-  OPENSSL_memcpy(pkcopy, public_key, 32);
-  uint8_t rcopy[32];
-  OPENSSL_memcpy(rcopy, signature, 32);
-  uint8_t scopy[32];
-  OPENSSL_memcpy(scopy, signature + 32, 32);
-
-  // https://tools.ietf.org/html/rfc8032#section-5.1.7 requires that s be in
-  // the range [0, order) in order to prevent signature malleability.
-
-  // kOrder is the order of Curve25519 in little-endian form.
+  // S must be in the range [0, order) in order to prevent signature
+  // malleability. kOrder is the order of curve25519 in little-endian form.
   static const uint64_t kOrder[4] = {
     UINT64_C(0x5812631a5cf5d3ed),
     UINT64_C(0x14def9dea2f79cd6),
@@ -331,7 +414,7 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
     UINT64_C(0x1000000000000000),
   };
   for (size_t i = 3;; i--) {
-    uint64_t word = CRYPTO_load_u64_le(scopy + i * 8);
+    uint64_t word = CRYPTO_load_u64_le(S + i * 8);
     if (word > kOrder[i]) {
       return 0;
     } else if (word < kOrder[i]) {
@@ -341,30 +424,28 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
     }
   }
 
-  SHA512_CTX hash_ctx;
-  SHA512_Init(&hash_ctx);
-  SHA512_Update(&hash_ctx, signature, 32);
-  SHA512_Update(&hash_ctx, public_key, 32);
-  SHA512_Update(&hash_ctx, message, message_len);
-  uint8_t h[SHA512_DIGEST_LENGTH];
-  SHA512_Final(h, &hash_ctx);
-
-  x25519_sc_reduce(h);
-
-  ge_p2 R;
-  ge_double_scalarmult_vartime(&R, h, &A, scopy);
-
-  uint8_t rcheck[32];
-  x25519_ge_tobytes(rcheck, &R);
+  // Step: rfc8032 5.1.7.[1,2,3]
+  // Verification works by computing [S]B - [k]A' and comparing against R_expected.
+  int res = 0;
+  uint8_t R_computed_encoded[32];
+  if (ed25519_s2n_bignum_capable() == 1) {
+    res = ed25519_verify_s2n_bignum(R_computed_encoded, public_key, R_expected, S,
+      message, message_len);
+  } else {
+    res = ed25519_verify_nohw(R_computed_encoded, public_key, R_expected, S,
+      message, message_len);
+  }
 
-  return CRYPTO_memcmp(rcheck, rcopy, sizeof(rcheck)) == 0;
+  // Comparison [S]B - [k]A' =? R_expected. Short-circuits if decoding failed.
+  return (res == 1) &&
+         CRYPTO_memcmp(R_computed_encoded, R_expected, sizeof(R_computed_encoded)) == 0;
 }
 
 
 void X25519_public_from_private(uint8_t out_public_value[32],
                                 const uint8_t private_key[32]) {
 
-  if (x25519_s2n_bignum_capable() == 1) {
+  if (curve25519_s2n_bignum_capable() == 1) {
     x25519_s2n_bignum_public_from_private(out_public_value, private_key);
   } else {
     x25519_public_from_private_nohw(out_public_value, private_key);
@@ -399,13 +480,13 @@ int X25519(uint8_t out_shared_key[32], const uint8_t private_key[32],
 
   static const uint8_t kZeros[32] = {0};
 
-  if (x25519_s2n_bignum_capable() == 1) {
+  if (curve25519_s2n_bignum_capable() == 1) {
     x25519_s2n_bignum(out_shared_key, private_key, peer_public_value);
   } else {
     x25519_scalar_mult_generic_nohw(out_shared_key, private_key, peer_public_value);
   }
 
   // The all-zero output results when the input is a point of small order.
-  // See https://www.rfc-editor.org/rfc/rfc7748#section-6.1.
-  return CRYPTO_memcmp(kZeros, out_shared_key, 32) != 0;
+  return constant_time_declassify_int(
+             CRYPTO_memcmp(kZeros, out_shared_key, 32)) != 0;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/curve25519_nohw.c

@@ -201,7 +201,7 @@ static void fe_sub(fe_loose *h, const fe *f, const fe *g) {
   assert_fe_loose(h->v);
 }
 
-void fe_carry(fe *h, const fe_loose* f) {
+static void fe_carry(fe *h, const fe_loose* f) {
   assert_fe_loose(f->v);
   fiat_25519_carry(h->v, f->v);
   assert_fe(h->v);
@@ -273,7 +273,7 @@ static void fe_mul121666(fe *h, const fe_loose *f) {
 }
 
 // h = -f
-void fe_neg(fe_loose *h, const fe *f) {
+static void fe_neg(fe_loose *h, const fe *f) {
   assert_fe(f->v);
   fiat_25519_opp(h->v, f->v);
   assert_fe_loose(h->v);
@@ -481,7 +481,7 @@ void x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h) {
   s[31] ^= fe_isnegative(&x) << 7;
 }
 
-void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
+static void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
   fe recip;
   fe x;
   fe y;
@@ -956,7 +956,7 @@ static void slide(signed char *r, const uint8_t *a) {
 // where a = a[0]+256*a[1]+...+256^31 a[31].
 // and b = b[0]+256*b[1]+...+256^31 b[31].
 // B is the Ed25519 base point (x,4/5) with x positive.
-void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
+static void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
                                          const ge_p3 *A, const uint8_t *b) {
   signed char aslide[256];
   signed char bslide[256];
@@ -1382,7 +1382,7 @@ void x25519_sc_reduce(uint8_t s[64]) {
 // Output:
 //   s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
 //   where l = 2^252 + 27742317777372353535851937790883648493.
-void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
+static void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
                       const uint8_t *c) {
   int64_t a0 = 2097151 & load_3(a);
   int64_t a1 = 2097151 & (load_4(a + 2) >> 5);
@@ -1946,7 +1946,7 @@ void x25519_scalar_mult_generic_nohw(uint8_t out[32],
 }
 
 void x25519_public_from_private_nohw(uint8_t out_public_value[32],
-                                      const uint8_t private_key[32]) {
+                                     const uint8_t private_key[32]) {
 
   uint8_t e[32];
   OPENSSL_memcpy(e, private_key, 32);
@@ -1966,4 +1966,76 @@ void x25519_public_from_private_nohw(uint8_t out_public_value[32],
   fe_loose_invert(&zminusy_inv, &zminusy);
   fe_mul_tlt(&zminusy_inv, &zplusy, &zminusy_inv);
   fe_tobytes(out_public_value, &zminusy_inv);
+  CONSTTIME_DECLASSIFY(out_public_value, 32);
+}
+
+void ed25519_public_key_from_hashed_seed_nohw(uint8_t out_public_key[32],
+    uint8_t az[SHA512_DIGEST_LENGTH]) {
+  ge_p3 A;
+  x25519_ge_scalarmult_base(&A, az);
+  ge_p3_tobytes(out_public_key, &A);
+}
+
+void ed25519_sign_nohw(
+  uint8_t out_sig[ED25519_SIGNATURE_LEN],
+  uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
+  const void *message, size_t message_len) {
+
+  // Reduce r modulo the order of the base-point B.
+  x25519_sc_reduce(r);
+  ge_p3 R;
+  // Compute [r]B.
+  x25519_ge_scalarmult_base(&R, r);
+  ge_p3_tobytes(out_sig, &R);
+
+  // Compute k = SHA512(R || A || message)
+  // R is of length 32 octets
+  uint8_t k[SHA512_DIGEST_LENGTH];
+  ed25519_sha512(k, out_sig, 32, A, ED25519_PUBLIC_KEY_LEN, message, message_len);
+
+  // Reduce k modulo the order of the base-point B.
+  x25519_sc_reduce(k);
+  // Compute S = r + k * s modulo the order of the base-point B.
+  // out_sig = R || S
+  sc_muladd(out_sig + 32, k, s, r);
+}
+
+int ed25519_verify_nohw(uint8_t R_computed_encoded[32],
+  const uint8_t public_key[ED25519_PUBLIC_KEY_LEN], uint8_t R_expected[32],
+  uint8_t S[32], const uint8_t *message, size_t message_len) {
+
+  // Decode public key as A'.
+  ge_p3 A;
+  if (!x25519_ge_frombytes_vartime(&A, public_key)) {
+    return 0;
+  }
+
+  // Step: rfc8032 5.1.7.2
+  // Compute k = SHA512(R_expected || public_key || message).
+  uint8_t k[SHA512_DIGEST_LENGTH];
+  ed25519_sha512(k, R_expected, 32, public_key, ED25519_PUBLIC_KEY_LEN, message,
+    message_len);
+
+  // Reduce k modulo the order of the base-point B. Saves compute in the
+  // subsequent scalar multiplication.
+  x25519_sc_reduce(k);
+
+  // Step: rfc8032 5.1.7.3
+  // Recall, we must compute [S]B - [k]A'.
+  // First negate A'. Point negation for the twisted edwards curve when points
+  // are represented in the extended coordinate system is simply:
+  //   -(X,Y,Z,T) = (-X,Y,Z,-T).
+  // See "Twisted Edwards curves revisited" https://ia.cr/2008/522.
+  fe_loose t;
+  fe_neg(&t, &A.X);
+  fe_carry(&A.X, &t);
+  fe_neg(&t, &A.T);
+  fe_carry(&A.T, &t);
+
+  // Compute R_have <- [S]B - [k]A'.
+  ge_p2 R_computed;
+  ge_double_scalarmult_vartime(&R_computed, k, &A, S);
+  x25519_ge_tobytes(R_computed_encoded, &R_computed);
+
+  return 1;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/ed25519_test.cc

@@ -35,9 +35,15 @@ TEST(Ed25519Test, TestVectors) {
     ASSERT_TRUE(t->GetBytes(&expected_signature, "SIG"));
     ASSERT_EQ(64u, expected_signature.size());
 
+    // Signing should not leak the private key or the message.
+    CONSTTIME_SECRET(private_key.data(), private_key.size());
+    CONSTTIME_SECRET(message.data(), message.size());
     uint8_t signature[64];
     ASSERT_TRUE(ED25519_sign(signature, message.data(), message.size(),
                              private_key.data()));
+    CONSTTIME_DECLASSIFY(signature, sizeof(signature));
+    CONSTTIME_DECLASSIFY(message.data(), message.size());
+
     EXPECT_EQ(Bytes(expected_signature), Bytes(signature));
     EXPECT_TRUE(ED25519_verify(message.data(), message.size(), signature,
                                public_key.data()));
@@ -114,9 +120,12 @@ TEST(Ed25519Test, KeypairFromSeed) {
 
   uint8_t seed[32];
   OPENSSL_memcpy(seed, private_key1, sizeof(seed));
+  CONSTTIME_SECRET(seed, sizeof(seed));
 
   uint8_t public_key2[32], private_key2[64];
   ED25519_keypair_from_seed(public_key2, private_key2, seed);
+  CONSTTIME_DECLASSIFY(public_key2, sizeof(public_key2));
+  CONSTTIME_DECLASSIFY(private_key2, sizeof(private_key2));
 
   EXPECT_EQ(Bytes(public_key1), Bytes(public_key2));
   EXPECT_EQ(Bytes(private_key1), Bytes(private_key2));

data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/internal.h

@@ -20,6 +20,7 @@ extern "C" {
 #endif
 
 #include <openssl/base.h>
+#include <openssl/curve25519.h>
 
 #include "../internal.h"
 
@@ -114,16 +115,29 @@ void x25519_scalar_mult_generic_nohw(uint8_t out[32],
                                       const uint8_t point[32]);
 void x25519_public_from_private_nohw(uint8_t out_public_value[32],
                                       const uint8_t private_key[32]);
-
-// Port to internal linkage in curve25519_nohw.c when adding implementation
-// from s2n-bignum ed25519
-void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h);
-void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b,
-                      const uint8_t *c);
-void fe_neg(fe_loose *h, const fe *f);
-void fe_carry(fe *h, const fe_loose* f);
-void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
-                                         const ge_p3 *A, const uint8_t *b);
+void ed25519_public_key_from_hashed_seed_nohw(
+  uint8_t out_public_key[ED25519_PUBLIC_KEY_LEN],
+  uint8_t az[SHA512_DIGEST_LENGTH]);
+
+// Computes the SHA512 of three input pairs: (|input1|, |len1|),
+// (|input2|, |len2|), (|input3|, |len3|). Specifically, the hash is computed
+// over the concatenation: |input1| || |input2| || |input3|.
+// The final pair might have |len3| == 0, meaning this input will be ignored.
+// The result is written to |out|.
+void ed25519_sha512(uint8_t out[SHA512_DIGEST_LENGTH],
+  const void *input1, size_t len1, const void *input2, size_t len2,
+  const void *input3, size_t len3);
+
+// |s| is of length |ED25519_PRIVATE_KEY_SEED_LEN|
+// |A| is of length |ED25519_PUBLIC_KEY_LEN|.
+void ed25519_sign_nohw(
+  uint8_t out_sig[ED25519_SIGNATURE_LEN],
+  uint8_t r[SHA512_DIGEST_LENGTH], const uint8_t *s, const uint8_t *A,
+  const void *message, size_t message_len);
+
+int ed25519_verify_nohw(uint8_t R_computed_encoded[32],
+  const uint8_t public_key[ED25519_PUBLIC_KEY_LEN], uint8_t R_expected[32],
+  uint8_t S[32], const uint8_t *message, size_t message_len);
 
 enum spake2_state_t {
   spake2_state_init = 0,

data/aws-crt-ffi/crt/aws-lc/crypto/curve25519/spake25519.c

@@ -384,7 +384,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
   // bit and so one for all the bottom three bits.
 
   scalar password_scalar;
-  OPENSSL_memcpy(&password_scalar, password_tmp, sizeof(password_scalar));
+  bn_little_endian_to_words(password_scalar.words, sizeof(password_scalar) / BN_BYTES,
+                            password_tmp, sizeof(password_scalar));
 
   // |password_scalar| is the result of |x25519_sc_reduce| and thus is, at
   // most, $l-1$ (where $l$ is |kOrder|, the order of the prime-order subgroup
@@ -414,9 +415,8 @@ int SPAKE2_generate_msg(SPAKE2_CTX *ctx, uint8_t *out, size_t *out_len,
 
     assert((password_scalar.words[0] & 7) == 0);
   }
-
-  OPENSSL_memcpy(ctx->password_scalar, password_scalar.words,
-                 sizeof(ctx->password_scalar));
+  bn_words_to_little_endian(ctx->password_scalar, sizeof(ctx->password_scalar),
+                            password_scalar.words, sizeof(password_scalar) / BN_BYTES);
 
   ge_p3 mask;
   x25519_ge_scalarmult_small_precomp(&mask, ctx->password_scalar,