edhoc 1.0.0 → 1.0.2

package/external/libedhoc/externals/compact25519/src/c25519/ed25519.h

@@ -0,0 +1,84 @@
+/* Edwards curve operations
+ * Daniel Beer <dlbeer@gmail.com>, 9 Jan 2014
+ *
+ * This file is in the public domain.
+ */
+
+#ifndef ED25519_H_
+#define ED25519_H_
+
+#ifndef COMPACT_DISABLE_ED25519
+#include "f25519.h"
+
+/* This is not the Ed25519 signature system. Rather, we're implementing
+ * basic operations on the twisted Edwards curve over (Z mod 2^255-19):
+ *
+ *     -x^2 + y^2 = 1 - (121665/121666)x^2y^2
+ *
+ * With the positive-x base point y = 4/5.
+ *
+ * These functions will not leak secret data through timing.
+ *
+ * For more information, see:
+ *
+ *     Bernstein, D.J. & Lange, T. (2007) "Faster addition and doubling on
+ *     elliptic curves". Document ID: 95616567a6ba20f575c5f25e7cebaf83.
+ *
+ *     Hisil, H. & Wong, K K. & Carter, G. & Dawson, E. (2008) "Twisted
+ *     Edwards curves revisited". Advances in Cryptology, ASIACRYPT 2008,
+ *     Vol. 5350, pp. 326-343.
+ */
+
+/* Projective coordinates */
+struct ed25519_pt {
+	uint8_t  x[F25519_SIZE];
+	uint8_t  y[F25519_SIZE];
+	uint8_t  t[F25519_SIZE];
+	uint8_t  z[F25519_SIZE];
+};
+
+extern const struct ed25519_pt ed25519_base;
+extern const struct ed25519_pt ed25519_neutral;
+
+/* Convert between projective and affine coordinates (x/y in F25519) */
+void ed25519_project(struct ed25519_pt *p,
+		     const uint8_t *x, const uint8_t *y);
+
+void ed25519_unproject(uint8_t *x, uint8_t *y,
+		       const struct ed25519_pt *p);
+
+/* Compress/uncompress points. try_unpack() will check that the
+ * compressed point is on the curve, returning 1 if the unpacked point
+ * is valid, and 0 otherwise.
+ */
+#define ED25519_PACK_SIZE  F25519_SIZE
+
+void ed25519_pack(uint8_t *c, const uint8_t *x, const uint8_t *y);
+uint8_t ed25519_try_unpack(uint8_t *x, uint8_t *y, const uint8_t *c);
+
+/* Add, double and scalar multiply */
+#define ED25519_EXPONENT_SIZE  32
+
+/* Prepare an exponent by clamping appropriate bits */
+static inline void ed25519_prepare(uint8_t *e)
+{
+	e[0] &= 0xf8;
+	e[31] &= 0x7f;
+	e[31] |= 0x40;
+}
+
+/* Order of the group generated by the base point */
+static inline void ed25519_copy(struct ed25519_pt *dst,
+				const struct ed25519_pt *src)
+{
+	memcpy(dst, src, sizeof(*dst));
+}
+
+void ed25519_add(struct ed25519_pt *r,
+		 const struct ed25519_pt *a, const struct ed25519_pt *b);
+void ed25519_double(struct ed25519_pt *r, const struct ed25519_pt *a);
+void ed25519_smult(struct ed25519_pt *r, const struct ed25519_pt *a,
+		   const uint8_t *e);
+
+#endif
+#endif

package/external/libedhoc/externals/compact25519/src/c25519/edsign.c

@@ -0,0 +1,171 @@
+/* Edwards curve signature system
+ * Daniel Beer <dlbeer@gmail.com>, 22 Apr 2014
+ *
+ * This file is in the public domain.
+ */
+
+#include "ed25519.h"
+
+#ifndef COMPACT_DISABLE_ED25519
+#include "sha512.h"
+#include "fprime.h"
+#include "edsign.h"
+
+#define EXPANDED_SIZE  64
+
+static const uint8_t ed25519_order[FPRIME_SIZE] = {
+	0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
+	0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
+};
+
+static void expand_key(uint8_t *expanded, const uint8_t *secret)
+{
+	struct sha512_state s;
+
+	sha512_init(&s);
+	sha512_final(&s, secret, EDSIGN_SECRET_KEY_SIZE);
+	sha512_get(&s, expanded, 0, EXPANDED_SIZE);
+	ed25519_prepare(expanded);
+}
+
+static uint8_t upp(struct ed25519_pt *p, const uint8_t *packed)
+{
+	uint8_t x[F25519_SIZE];
+	uint8_t y[F25519_SIZE];
+	uint8_t ok = ed25519_try_unpack(x, y, packed);
+
+	ed25519_project(p, x, y);
+	return ok;
+}
+
+static void pp(uint8_t *packed, const struct ed25519_pt *p)
+{
+	uint8_t x[F25519_SIZE];
+	uint8_t y[F25519_SIZE];
+
+	ed25519_unproject(x, y, p);
+	ed25519_pack(packed, x, y);
+}
+
+static void sm_pack(uint8_t *r, const uint8_t *k)
+{
+	struct ed25519_pt p;
+
+	ed25519_smult(&p, &ed25519_base, k);
+	pp(r, &p);
+}
+
+void edsign_sec_to_pub(uint8_t *pub, const uint8_t *secret)
+{
+	uint8_t expanded[EXPANDED_SIZE];
+
+	expand_key(expanded, secret);
+	sm_pack(pub, expanded);
+}
+
+static void hash_with_prefix(uint8_t *out_fp,
+			     uint8_t *init_block, unsigned int prefix_size,
+			     const uint8_t *message, size_t len)
+{
+	struct sha512_state s;
+
+	sha512_init(&s);
+
+	if (len < SHA512_BLOCK_SIZE && len + prefix_size < SHA512_BLOCK_SIZE) {
+		memcpy(init_block + prefix_size, message, len);
+		sha512_final(&s, init_block, len + prefix_size);
+	} else {
+		size_t i;
+
+		memcpy(init_block + prefix_size, message,
+		       SHA512_BLOCK_SIZE - prefix_size);
+		sha512_block(&s, init_block);
+
+		for (i = SHA512_BLOCK_SIZE - prefix_size;
+		     i + SHA512_BLOCK_SIZE <= len;
+		     i += SHA512_BLOCK_SIZE)
+			sha512_block(&s, message + i);
+
+		sha512_final(&s, message + i, len + prefix_size);
+	}
+
+	sha512_get(&s, init_block, 0, SHA512_HASH_SIZE);
+	fprime_from_bytes(out_fp, init_block, SHA512_HASH_SIZE, ed25519_order);
+}
+
+static void generate_k(uint8_t *k, const uint8_t *kgen_key,
+		       const uint8_t *message, size_t len)
+{
+	uint8_t block[SHA512_BLOCK_SIZE];
+
+	memcpy(block, kgen_key, 32);
+	hash_with_prefix(k, block, 32, message, len);
+}
+
+static void hash_message(uint8_t *z, const uint8_t *r, const uint8_t *a,
+			 const uint8_t *m, size_t len)
+{
+	uint8_t block[SHA512_BLOCK_SIZE];
+
+	memcpy(block, r, 32);
+	memcpy(block + 32, a, 32);
+	hash_with_prefix(z, block, 64, m, len);
+}
+
+void edsign_sign(uint8_t *signature, const uint8_t *pub,
+		 const uint8_t *secret,
+		 const uint8_t *message, size_t len)
+{
+	uint8_t expanded[EXPANDED_SIZE];
+	uint8_t e[FPRIME_SIZE];
+	uint8_t s[FPRIME_SIZE];
+	uint8_t k[FPRIME_SIZE];
+	uint8_t z[FPRIME_SIZE];
+
+	expand_key(expanded, secret);
+
+	/* Generate k and R = kB */
+	generate_k(k, expanded + 32, message, len);
+	sm_pack(signature, k);
+
+	/* Compute z = H(R, A, M) */
+	hash_message(z, signature, pub, message, len);
+
+	/* Obtain e */
+	fprime_from_bytes(e, expanded, 32, ed25519_order);
+
+	/* Compute s = ze + k */
+	fprime_mul(s, z, e, ed25519_order);
+	fprime_add(s, k, ed25519_order);
+	memcpy(signature + 32, s, 32);
+}
+
+uint8_t edsign_verify(const uint8_t *signature, const uint8_t *pub,
+		      const uint8_t *message, size_t len)
+{
+	struct ed25519_pt p;
+	struct ed25519_pt q;
+	uint8_t lhs[F25519_SIZE];
+	uint8_t rhs[F25519_SIZE];
+	uint8_t z[FPRIME_SIZE];
+	uint8_t ok = 1;
+
+	/* Compute z = H(R, A, M) */
+	hash_message(z, signature, pub, message, len);
+
+	/* sB = (ze + k)B = ... */
+	sm_pack(lhs, signature + 32);
+
+	/* ... = zA + R */
+	ok &= upp(&p, pub);
+	ed25519_smult(&p, &p, z);
+	ok &= upp(&q, signature);
+	ed25519_add(&p, &p, &q);
+	pp(rhs, &p);
+
+	/* Equal? */
+	return ok & f25519_eq(lhs, rhs);
+}
+#endif

package/external/libedhoc/externals/compact25519/src/c25519/edsign.h

@@ -0,0 +1,53 @@
+/* Edwards curve signature system
+ * Daniel Beer <dlbeer@gmail.com>, 22 Apr 2014
+ *
+ * This file is in the public domain.
+ */
+
+#ifndef EDSIGN_H_
+#define EDSIGN_H_
+
+#ifndef COMPACT_DISABLE_ED25519
+#include <stdint.h>
+#include <stddef.h>
+
+/* This is the Ed25519 signature system, as described in:
+ *
+ *     Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin
+ *     Yang. High-speed high-security signatures. Journal of Cryptographic
+ *     Engineering 2 (2012), 77-89. Document ID:
+ *     a1a62a2f76d23f65d622484ddd09caf8. URL:
+ *     http://cr.yp.to/papers.html#ed25519. Date: 2011.09.26.
+ *
+ * The format and calculation of signatures is compatible with the
+ * Ed25519 implementation in SUPERCOP. Note, however, that our secret
+ * keys are half the size: we don't store a copy of the public key in
+ * the secret key (we generate it on demand).
+ */
+
+/* Any string of 32 random bytes is a valid secret key. There is no
+ * clamping of bits, because we don't use the key directly as an
+ * exponent (the exponent is derived from part of a key expansion).
+ */
+#define EDSIGN_SECRET_KEY_SIZE  32
+
+/* Given a secret key, produce the public key (a packed Edwards-curve
+ * point).
+ */
+#define EDSIGN_PUBLIC_KEY_SIZE  32
+
+void edsign_sec_to_pub(uint8_t *pub, const uint8_t *secret);
+
+/* Produce a signature for a message. */
+#define EDSIGN_SIGNATURE_SIZE  64
+
+void edsign_sign(uint8_t *signature, const uint8_t *pub,
+		 const uint8_t *secret,
+		 const uint8_t *message, size_t len);
+
+/* Verify a message signature. Returns non-zero if ok. */
+uint8_t edsign_verify(const uint8_t *signature, const uint8_t *pub,
+		      const uint8_t *message, size_t len);
+
+#endif
+#endif

package/external/libedhoc/externals/compact25519/src/c25519/f25519.c

@@ -0,0 +1,330 @@
+/* Arithmetic mod p = 2^255-19
+ * Daniel Beer <dlbeer@gmail.com>, 5 Jan 2014
+ *
+ * This file is in the public domain.
+ */
+
+#include "f25519.h"
+
+#ifdef FULL_C25519_CODE
+const uint8_t f25519_zero[F25519_SIZE] = {0};
+#endif
+const uint8_t f25519_one[F25519_SIZE] = {1};
+
+void f25519_load(uint8_t *x, uint32_t c)
+{
+	unsigned int i;
+
+	for (i = 0; i < sizeof(c); i++) {
+		x[i] = c;
+		c >>= 8;
+	}
+
+	for (; i < F25519_SIZE; i++)
+		x[i] = 0;
+}
+
+void f25519_normalize(uint8_t *x)
+{
+	uint8_t minusp[F25519_SIZE];
+	uint16_t c;
+	int i;
+
+	/* Reduce using 2^255 = 19 mod p */
+	c = (x[31] >> 7) * 19;
+	x[31] &= 127;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += x[i];
+		x[i] = c;
+		c >>= 8;
+	}
+
+	/* The number is now less than 2^255 + 18, and therefore less than
+	 * 2p. Try subtracting p, and conditionally load the subtracted
+	 * value if underflow did not occur.
+	 */
+	c = 19;
+
+	for (i = 0; i + 1 < F25519_SIZE; i++) {
+		c += x[i];
+		minusp[i] = c;
+		c >>= 8;
+	}
+
+	c += ((uint16_t)x[i]) - 128;
+	minusp[31] = c;
+
+	/* Load x-p if no underflow */
+	f25519_select(x, minusp, x, (c >> 15) & 1);
+}
+
+uint8_t f25519_eq(const uint8_t *x, const uint8_t *y)
+{
+	uint8_t sum = 0;
+	int i;
+
+	for (i = 0; i < F25519_SIZE; i++)
+		sum |= x[i] ^ y[i];
+
+	sum |= (sum >> 4);
+	sum |= (sum >> 2);
+	sum |= (sum >> 1);
+
+	return (sum ^ 1) & 1;
+}
+
+void f25519_select(uint8_t *dst,
+		   const uint8_t *zero, const uint8_t *one,
+		   uint8_t condition)
+{
+	const uint8_t mask = -condition;
+	int i;
+
+	for (i = 0; i < F25519_SIZE; i++)
+		dst[i] = zero[i] ^ (mask & (one[i] ^ zero[i]));
+}
+
+void f25519_add(uint8_t *r, const uint8_t *a, const uint8_t *b)
+{
+	uint16_t c = 0;
+	int i;
+
+	/* Add */
+	for (i = 0; i < F25519_SIZE; i++) {
+		c >>= 8;
+		c += ((uint16_t)a[i]) + ((uint16_t)b[i]);
+		r[i] = c;
+	}
+
+	/* Reduce with 2^255 = 19 mod p */
+	r[31] &= 127;
+	c = (c >> 7) * 19;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += r[i];
+		r[i] = c;
+		c >>= 8;
+	}
+}
+
+void f25519_sub(uint8_t *r, const uint8_t *a, const uint8_t *b)
+{
+	uint32_t c = 0;
+	int i;
+
+	/* Calculate a + 2p - b, to avoid underflow */
+	c = 218;
+	for (i = 0; i + 1 < F25519_SIZE; i++) {
+		c += 65280 + ((uint32_t)a[i]) - ((uint32_t)b[i]);
+		r[i] = c;
+		c >>= 8;
+	}
+
+	c += ((uint32_t)a[31]) - ((uint32_t)b[31]);
+	r[31] = c & 127;
+	c = (c >> 7) * 19;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += r[i];
+		r[i] = c;
+		c >>= 8;
+	}
+}
+
+void f25519_neg(uint8_t *r, const uint8_t *a)
+{
+	uint32_t c = 0;
+	int i;
+
+	/* Calculate 2p - a, to avoid underflow */
+	c = 218;
+	for (i = 0; i + 1 < F25519_SIZE; i++) {
+		c += 65280 - ((uint32_t)a[i]);
+		r[i] = c;
+		c >>= 8;
+	}
+
+	c -= ((uint32_t)a[31]);
+	r[31] = c & 127;
+	c = (c >> 7) * 19;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += r[i];
+		r[i] = c;
+		c >>= 8;
+	}
+}
+
+void f25519_mul__distinct(uint8_t *r, const uint8_t *a, const uint8_t *b)
+{
+	uint32_t c = 0;
+	int i;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		int j;
+
+		c >>= 8;
+		for (j = 0; j <= i; j++)
+			c += ((uint32_t)a[j]) * ((uint32_t)b[i - j]);
+
+		for (; j < F25519_SIZE; j++)
+			c += ((uint32_t)a[j]) *
+			     ((uint32_t)b[i + F25519_SIZE - j]) * 38;
+
+		r[i] = c;
+	}
+
+	r[31] &= 127;
+	c = (c >> 7) * 19;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += r[i];
+		r[i] = c;
+		c >>= 8;
+	}
+}
+
+#ifdef FULL_C25519_CODE
+void f25519_mul(uint8_t *r, const uint8_t *a, const uint8_t *b)
+{
+	uint8_t tmp[F25519_SIZE];
+
+	f25519_mul__distinct(tmp, a, b);
+	f25519_copy(r, tmp);
+}
+#endif
+
+void f25519_mul_c(uint8_t *r, const uint8_t *a, uint32_t b)
+{
+	uint32_t c = 0;
+	int i;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c >>= 8;
+		c += b * ((uint32_t)a[i]);
+		r[i] = c;
+	}
+
+	r[31] &= 127;
+	c >>= 7;
+	c *= 19;
+
+	for (i = 0; i < F25519_SIZE; i++) {
+		c += r[i];
+		r[i] = c;
+		c >>= 8;
+	}
+}
+
+void f25519_inv__distinct(uint8_t *r, const uint8_t *x)
+{
+	uint8_t s[F25519_SIZE];
+	int i;
+
+	/* This is a prime field, so by Fermat's little theorem:
+	 *
+	 *     x^(p-1) = 1 mod p
+	 *
+	 * Therefore, raise to (p-2) = 2^255-21 to get a multiplicative
+	 * inverse.
+	 *
+	 * This is a 255-bit binary number with the digits:
+	 *
+	 *     11111111... 01011
+	 *
+	 * We compute the result by the usual binary chain, but
+	 * alternate between keeping the accumulator in r and s, so as
+	 * to avoid copying temporaries.
+	 */
+
+	/* 1 1 */
+	f25519_mul__distinct(s, x, x);
+	f25519_mul__distinct(r, s, x);
+
+	/* 1 x 248 */
+	for (i = 0; i < 248; i++) {
+		f25519_mul__distinct(s, r, r);
+		f25519_mul__distinct(r, s, x);
+	}
+
+	/* 0 */
+	f25519_mul__distinct(s, r, r);
+
+	/* 1 */
+	f25519_mul__distinct(r, s, s);
+	f25519_mul__distinct(s, r, x);
+
+	/* 0 */
+	f25519_mul__distinct(r, s, s);
+
+	/* 1 */
+	f25519_mul__distinct(s, r, r);
+	f25519_mul__distinct(r, s, x);
+
+	/* 1 */
+	f25519_mul__distinct(s, r, r);
+	f25519_mul__distinct(r, s, x);
+}
+
+#ifdef FULL_C25519_CODE
+void f25519_inv(uint8_t *r, const uint8_t *x)
+{
+	uint8_t tmp[F25519_SIZE];
+
+	f25519_inv__distinct(tmp, x);
+	f25519_copy(r, tmp);
+}
+#endif
+
+/* Raise x to the power of (p-5)/8 = 2^252-3, using s for temporary
+ * storage.
+ */
+static void exp2523(uint8_t *r, const uint8_t *x, uint8_t *s)
+{
+	int i;
+
+	/* This number is a 252-bit number with the binary expansion:
+	 *
+	 *     111111... 01
+	 */
+
+	/* 1 1 */
+	f25519_mul__distinct(r, x, x);
+	f25519_mul__distinct(s, r, x);
+
+	/* 1 x 248 */
+	for (i = 0; i < 248; i++) {
+		f25519_mul__distinct(r, s, s);
+		f25519_mul__distinct(s, r, x);
+	}
+
+	/* 0 */
+	f25519_mul__distinct(r, s, s);
+
+	/* 1 */
+	f25519_mul__distinct(s, r, r);
+	f25519_mul__distinct(r, s, x);
+}
+
+void f25519_sqrt(uint8_t *r, const uint8_t *a)
+{
+	uint8_t v[F25519_SIZE];
+	uint8_t i[F25519_SIZE];
+	uint8_t x[F25519_SIZE];
+	uint8_t y[F25519_SIZE];
+
+	/* v = (2a)^((p-5)/8) [x = 2a] */
+	f25519_mul_c(x, a, 2);
+	exp2523(v, x, y);
+
+	/* i = 2av^2 - 1 */
+	f25519_mul__distinct(y, v, v);
+	f25519_mul__distinct(i, x, y);
+	f25519_load(y, 1);
+	f25519_sub(i, i, y);
+
+	/* r = avi */
+	f25519_mul__distinct(x, v, a);
+	f25519_mul__distinct(r, x, i);
+}