edhoc 1.0.1 → 1.0.3

package/external/libedhoc/externals/compact25519/src/compact_ed25519.c

@@ -0,0 +1,46 @@
+#include "compact_ed25519.h"
+
+#ifndef COMPACT_DISABLE_ED25519
+#include "c25519/edsign.h"
+#include "compact_wipe.h"
+#include <string.h>
+
+#define __PUBLIC_KEY_OFFSET (32)
+
+void compact_ed25519_keygen(
+    uint8_t private_key[ED25519_PRIVATE_KEY_SIZE], 
+    uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    uint8_t random_seed[ED25519_SEED_SIZE]
+) {
+    // private key is seed + public key, like golang and others
+    edsign_sec_to_pub(public_key, random_seed);
+    memcpy(private_key, random_seed, ED25519_SEED_SIZE);
+    memcpy(private_key + __PUBLIC_KEY_OFFSET, public_key, ED25519_PUBLIC_KEY_SIZE);
+    compact_wipe(random_seed, ED25519_SEED_SIZE);
+}
+
+void compact_ed25519_calc_public_key(
+    uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    const uint8_t private_key[ED25519_PRIVATE_KEY_SIZE]
+) {
+    memcpy(public_key, private_key + __PUBLIC_KEY_OFFSET, ED25519_PUBLIC_KEY_SIZE);
+}
+
+void compact_ed25519_sign(
+    uint8_t signature[ED25519_SIGNATURE_SIZE], 
+    const uint8_t private_key[ED25519_PRIVATE_KEY_SIZE], 
+    const void *message, 
+    size_t msg_length
+) {
+    edsign_sign(signature, private_key + __PUBLIC_KEY_OFFSET, private_key, message, msg_length);
+}
+
+bool compact_ed25519_verify(
+    const uint8_t signature[ED25519_SIGNATURE_SIZE], 
+    const uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    const void *message, 
+    size_t msg_length
+) {
+    return edsign_verify(signature, public_key, message, msg_length) != 0;
+}
+#endif

package/external/libedhoc/externals/compact25519/src/compact_ed25519.h

@@ -0,0 +1,110 @@
+#ifndef _COMPACT_ED25519_H
+#define _COMPACT_ED25519_H
+
+#ifndef COMPACT_DISABLE_ED25519
+/*
+ Ed25519 signs messages using Curve25519.
+ 
+ After pre-sharing a public key, it allows two parties to verify the other side
+ is who they say they are and that the communication is not altered.
+ 
+ A signature is a ED25519_SIGNATURE_SIZE size byte array that can be only be 
+ generated when you have the private key, but can be verified if you have 
+ the public key. 
+ 
+ As an example: two parties want to have rotating keys for their encryption.
+ The only thing they need to know about eachother is their long term Ed25519
+ public key. Per session they perform a X25519 key exchange, but sign their 
+ "Ephemeral" public key with their long-term Ed25519 private key. Now they can 
+ share this public key (and the signature) over a cleartext channel, nobody can
+ alter of impersonate this exchange.
+ 
+ (this is roughly how TLS works)
+*/
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define ED25519_SEED_SIZE (32)
+#define ED25519_PUBLIC_KEY_SIZE (32)
+#define ED25519_PRIVATE_KEY_SIZE (64)
+#define ED25519_SIGNATURE_SIZE (64)
+
+/*
+ Generate a private signing key from a random seed.
+ 
+ input:
+     - random_seed = random bytes that need to be filled from a good source of 
+         random entropy, PLEASE research the options on your platform!
+ 
+ output:
+     - private_key = signing key than can be used for compact_ed25519_sign
+     - public_key = key to share with other parties 
+ 
+ (internally the format of the private key is the seed + public key, 
+ this makes it compatible with keys coming from libsodium, golang, and 
+ implentations that derive from SUPERCOP/ref10)
+*/
+void compact_ed25519_keygen(
+    uint8_t private_key[ED25519_PRIVATE_KEY_SIZE], 
+    uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    uint8_t random_seed[ED25519_SEED_SIZE]
+);
+
+/*
+ Extract public key from private key
+ 
+ input:
+     - private_key = signing key generated with compact_ed25519_keygen
+ 
+ output:
+     - public_key = public key corresponding to this private key, share with
+         interested parties
+*/
+void compact_ed25519_calc_public_key(
+    uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    const uint8_t private_key[ED25519_PRIVATE_KEY_SIZE]
+);
+
+/*
+ Sign a message with the private key.
+ 
+ input:
+     - private_key = signing key generated with compact_ed25519_keygen or from a
+         compatible source
+     - message = pointer to the data that needs to be signed
+     - msg_length = how many bytes to read from the start of the message pointer
+ output:
+     - signature = the signature that proves you hold the private key and that
+         nobody tried to change the message. (the second property only holds
+         if the attacker cannot change the size of the message)
+*/
+void compact_ed25519_sign(
+    uint8_t signature[ED25519_SIGNATURE_SIZE], 
+    const uint8_t private_key[ED25519_PRIVATE_KEY_SIZE], 
+    const void *message, 
+    size_t msg_length
+);
+
+/*
+ Verify a signature against a public key.
+ 
+ input:
+     - signature = which signature to verify
+     - public_key = the public key that it should be verified against 
+         (should not have been part of the message that contained the signature)
+     - message = message to verify
+     - msg_length = size of the message to verify
+ 
+ returns:
+     true if verified
+*/
+bool compact_ed25519_verify(
+    const uint8_t signature[ED25519_SIGNATURE_SIZE], 
+    const uint8_t public_key[ED25519_PUBLIC_KEY_SIZE], 
+    const void *message, 
+    size_t msg_length
+);
+#endif
+
+#endif

package/external/libedhoc/externals/compact25519/src/compact_wipe.c

@@ -0,0 +1,12 @@
+#include "compact_wipe.h"
+#include <stdlib.h>
+#include <string.h>
+
+void *compact_wipe(void *data, size_t length) {
+// simplification of: https://www.cryptologie.net/article/419/zeroing-memory-compiler-optimizations-and-memset_s/
+	 volatile unsigned char *p = data;
+	 while (length--){
+		 *p++ = 0;
+	 }
+	return data;
+}

package/external/libedhoc/externals/compact25519/src/compact_wipe.h

@@ -0,0 +1,14 @@
+#ifndef __COMPACT_WIPE_H
+#define __COMPACT_WIPE_H
+#include <stdint.h>
+#include <stddef.h>
+/*
+    Try to wipe contents of a buffer, as best as we can.
+    (memset can be ignored by the compiler)
+
+    Use this to clear private key data if you do not need it anymore.
+
+    returns the data pointer, makes for easier chaining
+*/
+void *compact_wipe(void *data, size_t length);
+#endif

package/external/libedhoc/externals/compact25519/src/compact_x25519.c

@@ -0,0 +1,68 @@
+
+#ifndef COMPACT_DISABLE_X25519
+#include "compact_x25519.h"
+#include "c25519/c25519.h"
+#include "c25519/sha512.h"
+#include "compact_wipe.h"
+
+void compact_x25519_keygen(
+    uint8_t private_key[X25519_KEY_SIZE], 
+    uint8_t public_key[X25519_KEY_SIZE],
+    uint8_t random_seed[X25519_KEY_SIZE]
+) {
+    memcpy(private_key, random_seed, X25519_KEY_SIZE);
+    compact_wipe(random_seed, X25519_KEY_SIZE);
+    c25519_prepare(private_key);
+    c25519_smult(public_key, c25519_base_x, private_key);
+}
+
+void compact_x25519_shared(
+    uint8_t shared_secret[X25519_SHARED_SIZE], 
+    const uint8_t my_private_key[X25519_KEY_SIZE], 
+    const uint8_t their_public_key[X25519_KEY_SIZE]
+) {
+    // Ensure that supplied private key is clamped (fix issue #1).
+    // Calling `c25519_prepare` multiple times for the same private key
+    // is OK because it won't modify already clamped key.
+    uint8_t clamped_private_key[X25519_KEY_SIZE];
+    memcpy(clamped_private_key, my_private_key, X25519_KEY_SIZE);
+    c25519_prepare(clamped_private_key);
+    c25519_smult(shared_secret, their_public_key, clamped_private_key);
+    compact_wipe(clamped_private_key, X25519_KEY_SIZE);
+}
+
+#ifndef COMPACT_DISABLE_X25519_DERIVE
+#if (X25519_KEY_SIZE + (2 * X25519_KEY_SIZE)) > SHA512_BLOCK_SIZE 
+#error "Unexpected key sizes"
+#endif
+
+static uint8_t* append(uint8_t *dst, const void * source, size_t length) {
+    memcpy(dst, source, length);
+    return dst + length;
+}
+
+void compact_x25519_derive_encryption_key(
+    uint8_t *encryption_key, 
+    size_t key_size, 
+    const uint8_t shared_secret[X25519_SHARED_SIZE], 
+    const uint8_t public_key1[X25519_KEY_SIZE], 
+    const uint8_t public_key2[X25519_KEY_SIZE]
+) {
+    if (key_size > SHA512_HASH_SIZE) {
+        key_size = SHA512_HASH_SIZE;
+    }
+    uint8_t key_data[X25519_SHARED_SIZE + 2 * X25519_KEY_SIZE];
+    uint8_t *p = key_data;
+    p = append(p, shared_secret, X25519_SHARED_SIZE);
+    p = append(p, public_key1, X25519_KEY_SIZE);
+    append(p, public_key2, X25519_KEY_SIZE);
+
+    struct sha512_state hasher;
+    sha512_init(&hasher);
+    sha512_final(&hasher, key_data, sizeof(key_data));
+    sha512_get(&hasher, encryption_key, 0, key_size);
+
+    compact_wipe(key_data, X25519_SHARED_SIZE); // clear the session key at least
+}
+#endif
+#endif

package/external/libedhoc/externals/compact25519/src/compact_x25519.h

@@ -0,0 +1,101 @@
+#ifndef _COMPACT_X25519_H
+#define _COMPACT_X25519_H
+
+#ifndef COMPACT_DISABLE_X25519
+/* 
+ X25519 is a DH key exchange over Curve25519.
+ 
+ Two parties can share their public keys over an open channel and agree upon 
+ a shared secret, that a third party cannot derive.
+ 
+ Security concern: if a third party can intercept and change your connection in 
+ some way, then X25519 is not enough. The third party could for example run 
+ two X25519 sessions, one between themselfs and you, and another one between 
+ themselfs and the server. X25519 has no protection against this.
+ 
+ A possible solution is to use Ed25519 to sign the public keys exchanged, with a 
+ special set of keys that is known before hand. Depending on your scenario, this 
+ either means embedding a set of long-term keys in your application or setting up 
+ some kind of Public Key Infrastructure (PKI).
+ 
+ If that sounds to complicated or would not work for your case, checkout 
+ the Noise framework. It is a bit less compact than X25519 + Ed25519 but much 
+ more flexible in the kind of session setup styles.
+*/
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define X25519_KEY_SIZE (32)
+#define X25519_SHARED_SIZE (32)
+
+/*
+ Calculate public & private keypair for X25519 key exchange. 
+ Never transmit the private_key!
+ 
+ input:
+     - random_seed = random bytes that need to be filled from a good source of 
+         random entropy, PLEASE research the options on your platform!
+ 
+ output:
+     - private_key = resulting private key, never share this with the other party
+     - public_key = public key to be shared with the other party
+*/
+void compact_x25519_keygen(
+    uint8_t private_key[X25519_KEY_SIZE], 
+    uint8_t public_key[X25519_KEY_SIZE],
+    uint8_t random_seed[X25519_KEY_SIZE]
+);
+
+/*
+ Calculate shared secret based on the others side public key.
+ The shared secret does not have a uniform distribution so common advice 
+ is to avoid using it directly as a key. You can use 
+ compact_x25519_derive_encryption_key to get a more suitable encryption 
+ key out of this shared secret
+ 
+ input:
+     - my_private_key = private key that came out of compact_x25519_keygen
+     - their_public_key = public key that was shared by the other party
+ 
+ output:
+     - shared_secret = X25519_SHARED_SIZE bytes that both sides now share 
+*/
+void compact_x25519_shared(
+    uint8_t shared_secret[X25519_SHARED_SIZE], 
+    const uint8_t my_private_key[X25519_KEY_SIZE], 
+    const uint8_t their_public_key[X25519_KEY_SIZE]
+);
+
+#ifndef COMPACT_DISABLE_X25519_DERIVE
+/*
+ Derive an more suitable encryption key from the shared secret.
+ This is not part of the normal X25519 specification, but the specifications 
+ does warn that the shared secret is less suited as symmetric encryption key.
+ 
+ The encryption key is the result of 
+ sha512(concat(shared_secret, public_key1, public_key2))[0..key_size]
+ 
+ You have to make sure both parties agree which public key goes in first.
+ 
+ input:
+     - key_size = number between 1 and 64, of how big your encryption_key 
+         needs to be, make sure there is enough room where 
+         the encryption_key points to
+     - shared_secret = result of compact_x25519_shared
+     - public_key1 = first public key to mix in with the key
+     - public_key2 = second public key to mix in with the key
+ 
+ output:
+     - encryption_key = supplied buffer is filled with a encryption key
+*/
+void compact_x25519_derive_encryption_key(
+    uint8_t *encryption_key, 
+    size_t key_size, 
+    const uint8_t shared_secret[X25519_SHARED_SIZE], 
+    const uint8_t public_key1[X25519_KEY_SIZE], 
+    const uint8_t public_key2[X25519_KEY_SIZE]
+);
+#endif
+#endif
+#endif

package/external/libedhoc/externals/compact25519/test/pcg_random.h

@@ -0,0 +1,25 @@
+#ifndef PCG_RANDOM_H
+#define PCG_RANDOM_H
+
+// WARNING: this is a BAD source for random data for this library
+// it is only used as an easy way to make the tests more cross platform.
+// Good randomness is platform specific, PLEASE USE THAT SOURCE, NOT THIS
+
+
+// *Really* minimal PCG32 code / (c) 2014 M.E. O'Neill / pcg-random.org
+// Licensed under Apache License 2.0 (NO WARRANTY, etc. see website)
+
+#include <stdint.h>
+typedef struct { uint64_t state;  uint64_t inc; } pcg32_random_t;
+
+static uint32_t pcg32_random_r(pcg32_random_t* rng)
+{
+    uint64_t oldstate = rng->state;
+    // Advance internal state
+    rng->state = oldstate * 6364136223846793005ULL + (rng->inc|1);
+    // Calculate output function (XSH RR), uses old state for max ILP
+    uint32_t xorshifted = ((oldstate >> 18u) ^ oldstate) >> 27u;
+    uint32_t rot = oldstate >> 59u;
+    return (xorshifted >> rot) | (xorshifted << ((-rot) & 31));
+}
+#endif

package/external/libedhoc/externals/compact25519/test/run-all.c

@@ -0,0 +1,178 @@
+#ifndef COMPACT_DISABLE_ED25519
+#include "../src/compact_ed25519.h"
+#endif
+#ifndef COMPACT_DISABLE_X25519
+#include "../src/compact_x25519.h"
+#endif
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <time.h>
+#include <stdlib.h>
+#include "pcg_random.h"
+
+
+static void fill_crappy_random(void* target, size_t length, pcg32_random_t* rng) {
+    if (length >= sizeof(uint32_t)) {
+        uint32_t *p = target;
+        uint32_t *last = p + (length / sizeof(uint32_t));
+        while (p < last) {
+            *p++ = pcg32_random_r(rng);
+        }
+    }
+    size_t tail_size = length % sizeof(uint32_t);
+    if (tail_size != 0) {
+        uint32_t tail = pcg32_random_r(rng);
+        memcpy((((uint8_t*)target) + length) - tail_size, &tail, tail_size);
+    }
+}
+
+#ifndef COMPACT_DISABLE_X25519
+static int testX25519(pcg32_random_t* rng) {
+    printf("Testing X25519: ");
+    uint8_t seed1[X25519_KEY_SIZE];
+    uint8_t seed2[X25519_KEY_SIZE];
+    fill_crappy_random(seed1, X25519_KEY_SIZE, rng);
+    fill_crappy_random(seed2, X25519_KEY_SIZE, rng);
+
+    uint8_t sec1[X25519_KEY_SIZE];
+    uint8_t pub1[X25519_KEY_SIZE];
+    uint8_t sec2[X25519_KEY_SIZE];
+    uint8_t pub2[X25519_KEY_SIZE];
+    compact_x25519_keygen(sec1, pub1, seed1);
+    compact_x25519_keygen(sec2, pub2, seed2);
+
+    uint8_t shared1[X25519_SHARED_SIZE];
+    uint8_t shared2[X25519_SHARED_SIZE];
+    compact_x25519_shared(shared1, sec1, pub2);
+    compact_x25519_shared(shared2, sec2, pub1);
+
+#ifndef COMPACT_DISABLE_X25519_DERIVE
+    uint8_t derived[64];
+    compact_x25519_derive_encryption_key(derived, sizeof(derived), shared1, pub1, pub2);
+#endif
+
+    if (memcmp(shared1, shared2, X25519_SHARED_SIZE) == 0) {
+        printf("Success\n");
+        return 0;
+    }
+    else {
+        printf("Fail\n");
+        return -1;
+    }
+}
+
+int testX25519WithRfc7748Vectors(void) {
+    printf("Testing X25519 using rfc7748 test vectors: ");
+    int r = 0;
+    uint8_t alice_sec[X25519_KEY_SIZE] = {
+        0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d,
+        0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45,
+        0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
+        0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a
+    };
+
+    uint8_t alice_pub[X25519_KEY_SIZE] = {
+        0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54,
+        0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a,
+        0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4,
+        0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a
+    };
+
+    uint8_t bob_sec[X25519_KEY_SIZE] = {
+        0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b,
+        0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6,
+        0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd,
+        0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb
+    };
+
+    uint8_t bob_pub[X25519_KEY_SIZE] = {
+        0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4,
+        0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37,
+        0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
+        0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f
+    };
+
+    uint8_t expected_shared[X25519_KEY_SIZE] = {
+        0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
+        0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
+        0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
+        0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42
+    };
+
+
+    uint8_t shared1[X25519_SHARED_SIZE];
+    uint8_t shared2[X25519_SHARED_SIZE];
+
+    compact_x25519_shared(shared1, alice_sec, bob_pub);
+    compact_x25519_shared(shared2, bob_sec, alice_pub);
+
+    if (memcmp(shared1, shared2, X25519_SHARED_SIZE) != 0) {
+        printf("Fail\n");
+        r--;
+    }
+
+    if (memcmp(shared1, expected_shared, X25519_KEY_SIZE) != 0) {
+        printf("Fail\n");
+        r--;
+    }
+    if (r == 0) printf("Success\n");
+    return r;
+}
+#endif
+
+#ifndef COMPACT_DISABLE_ED25519
+#define MSG_TEST_SIZE (ED25519_PRIVATE_KEY_SIZE * 2)
+static int testEd25519(pcg32_random_t* rng) {
+    printf("Testing Ed25519: ");
+    uint8_t seed[ED25519_SEED_SIZE];
+    fill_crappy_random(seed, ED25519_SEED_SIZE, rng);
+
+    uint8_t sec[ED25519_PRIVATE_KEY_SIZE];
+    uint8_t pub[ED25519_PUBLIC_KEY_SIZE];
+    compact_ed25519_keygen(sec, pub, seed);
+
+    uint8_t msg[MSG_TEST_SIZE];
+    fill_crappy_random(msg, MSG_TEST_SIZE, rng);
+
+    uint8_t sig[ED25519_SIGNATURE_SIZE];
+    compact_ed25519_sign(sig, sec, msg, MSG_TEST_SIZE);
+
+    if (!compact_ed25519_verify(sig, pub, msg, MSG_TEST_SIZE)) {
+        printf("Failed normal signature\n");
+        return -1;
+    }
+
+    msg[3] ^= 0x10; // flip a single bit
+    if (compact_ed25519_verify(sig, pub, msg, MSG_TEST_SIZE)) {
+        printf("Failed on changed data\n");
+        return -1;
+    }
+    else {
+        printf("Success\n");
+    }
+    return 0;
+}
+#endif
+
+int main(void) {
+    srand(time(NULL)); 
+    pcg32_random_t rng;
+    rng.state = rand();
+    rng.inc = rand() | 1;
+
+    int result = 0;
+#ifndef COMPACT_DISABLE_X25519
+    testX25519WithRfc7748Vectors();
+    for (int i = 0; i < 5; i++) {
+        result += testX25519(&rng);
+    }
+#endif
+
+#ifndef COMPACT_DISABLE_ED25519
+    for (int i = 0; i < 5; i++) {
+        result += testEd25519(&rng);
+    }
+#endif
+    return result;
+}

package/external/libedhoc/externals/mbedtls/3rdparty/everest/include/everest/Hacl_Curve25519.h

@@ -0,0 +1,21 @@
+/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
+   Licensed under the Apache 2.0 License. */
+
+/* This file was generated by KreMLin <https://github.com/FStarLang/kremlin>
+ * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c
+ * F* version: 059db0c8
+ * KreMLin version: 916c37ac
+ */
+
+
+
+#ifndef __Hacl_Curve25519_H
+#define __Hacl_Curve25519_H
+
+
+#include "kremlib.h"
+
+void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint);
+
+#define __Hacl_Curve25519_H_DEFINED
+#endif