edhoc 1.3.3 → 2.0.0

package/external/libedhoc/externals/compact25519/src/c25519/f25519.c

@@ -1,330 +0,0 @@
-/* Arithmetic mod p = 2^255-19
- * Daniel Beer <dlbeer@gmail.com>, 5 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#include "f25519.h"
-
-#ifdef FULL_C25519_CODE
-const uint8_t f25519_zero[F25519_SIZE] = {0};
-#endif
-const uint8_t f25519_one[F25519_SIZE] = {1};
-
-void f25519_load(uint8_t *x, uint32_t c)
-{
-	unsigned int i;
-
-	for (i = 0; i < sizeof(c); i++) {
-		x[i] = c;
-		c >>= 8;
-	}
-
-	for (; i < F25519_SIZE; i++)
-		x[i] = 0;
-}
-
-void f25519_normalize(uint8_t *x)
-{
-	uint8_t minusp[F25519_SIZE];
-	uint16_t c;
-	int i;
-
-	/* Reduce using 2^255 = 19 mod p */
-	c = (x[31] >> 7) * 19;
-	x[31] &= 127;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += x[i];
-		x[i] = c;
-		c >>= 8;
-	}
-
-	/* The number is now less than 2^255 + 18, and therefore less than
-	 * 2p. Try subtracting p, and conditionally load the subtracted
-	 * value if underflow did not occur.
-	 */
-	c = 19;
-
-	for (i = 0; i + 1 < F25519_SIZE; i++) {
-		c += x[i];
-		minusp[i] = c;
-		c >>= 8;
-	}
-
-	c += ((uint16_t)x[i]) - 128;
-	minusp[31] = c;
-
-	/* Load x-p if no underflow */
-	f25519_select(x, minusp, x, (c >> 15) & 1);
-}
-
-uint8_t f25519_eq(const uint8_t *x, const uint8_t *y)
-{
-	uint8_t sum = 0;
-	int i;
-
-	for (i = 0; i < F25519_SIZE; i++)
-		sum |= x[i] ^ y[i];
-
-	sum |= (sum >> 4);
-	sum |= (sum >> 2);
-	sum |= (sum >> 1);
-
-	return (sum ^ 1) & 1;
-}
-
-void f25519_select(uint8_t *dst,
-		   const uint8_t *zero, const uint8_t *one,
-		   uint8_t condition)
-{
-	const uint8_t mask = -condition;
-	int i;
-
-	for (i = 0; i < F25519_SIZE; i++)
-		dst[i] = zero[i] ^ (mask & (one[i] ^ zero[i]));
-}
-
-void f25519_add(uint8_t *r, const uint8_t *a, const uint8_t *b)
-{
-	uint16_t c = 0;
-	int i;
-
-	/* Add */
-	for (i = 0; i < F25519_SIZE; i++) {
-		c >>= 8;
-		c += ((uint16_t)a[i]) + ((uint16_t)b[i]);
-		r[i] = c;
-	}
-
-	/* Reduce with 2^255 = 19 mod p */
-	r[31] &= 127;
-	c = (c >> 7) * 19;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += r[i];
-		r[i] = c;
-		c >>= 8;
-	}
-}
-
-void f25519_sub(uint8_t *r, const uint8_t *a, const uint8_t *b)
-{
-	uint32_t c = 0;
-	int i;
-
-	/* Calculate a + 2p - b, to avoid underflow */
-	c = 218;
-	for (i = 0; i + 1 < F25519_SIZE; i++) {
-		c += 65280 + ((uint32_t)a[i]) - ((uint32_t)b[i]);
-		r[i] = c;
-		c >>= 8;
-	}
-
-	c += ((uint32_t)a[31]) - ((uint32_t)b[31]);
-	r[31] = c & 127;
-	c = (c >> 7) * 19;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += r[i];
-		r[i] = c;
-		c >>= 8;
-	}
-}
-
-void f25519_neg(uint8_t *r, const uint8_t *a)
-{
-	uint32_t c = 0;
-	int i;
-
-	/* Calculate 2p - a, to avoid underflow */
-	c = 218;
-	for (i = 0; i + 1 < F25519_SIZE; i++) {
-		c += 65280 - ((uint32_t)a[i]);
-		r[i] = c;
-		c >>= 8;
-	}
-
-	c -= ((uint32_t)a[31]);
-	r[31] = c & 127;
-	c = (c >> 7) * 19;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += r[i];
-		r[i] = c;
-		c >>= 8;
-	}
-}
-
-void f25519_mul__distinct(uint8_t *r, const uint8_t *a, const uint8_t *b)
-{
-	uint32_t c = 0;
-	int i;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		int j;
-
-		c >>= 8;
-		for (j = 0; j <= i; j++)
-			c += ((uint32_t)a[j]) * ((uint32_t)b[i - j]);
-
-		for (; j < F25519_SIZE; j++)
-			c += ((uint32_t)a[j]) *
-			     ((uint32_t)b[i + F25519_SIZE - j]) * 38;
-
-		r[i] = c;
-	}
-
-	r[31] &= 127;
-	c = (c >> 7) * 19;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += r[i];
-		r[i] = c;
-		c >>= 8;
-	}
-}
-
-#ifdef FULL_C25519_CODE
-void f25519_mul(uint8_t *r, const uint8_t *a, const uint8_t *b)
-{
-	uint8_t tmp[F25519_SIZE];
-
-	f25519_mul__distinct(tmp, a, b);
-	f25519_copy(r, tmp);
-}
-#endif
-
-void f25519_mul_c(uint8_t *r, const uint8_t *a, uint32_t b)
-{
-	uint32_t c = 0;
-	int i;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c >>= 8;
-		c += b * ((uint32_t)a[i]);
-		r[i] = c;
-	}
-
-	r[31] &= 127;
-	c >>= 7;
-	c *= 19;
-
-	for (i = 0; i < F25519_SIZE; i++) {
-		c += r[i];
-		r[i] = c;
-		c >>= 8;
-	}
-}
-
-void f25519_inv__distinct(uint8_t *r, const uint8_t *x)
-{
-	uint8_t s[F25519_SIZE];
-	int i;
-
-	/* This is a prime field, so by Fermat's little theorem:
-	 *
-	 *     x^(p-1) = 1 mod p
-	 *
-	 * Therefore, raise to (p-2) = 2^255-21 to get a multiplicative
-	 * inverse.
-	 *
-	 * This is a 255-bit binary number with the digits:
-	 *
-	 *     11111111... 01011
-	 *
-	 * We compute the result by the usual binary chain, but
-	 * alternate between keeping the accumulator in r and s, so as
-	 * to avoid copying temporaries.
-	 */
-
-	/* 1 1 */
-	f25519_mul__distinct(s, x, x);
-	f25519_mul__distinct(r, s, x);
-
-	/* 1 x 248 */
-	for (i = 0; i < 248; i++) {
-		f25519_mul__distinct(s, r, r);
-		f25519_mul__distinct(r, s, x);
-	}
-
-	/* 0 */
-	f25519_mul__distinct(s, r, r);
-
-	/* 1 */
-	f25519_mul__distinct(r, s, s);
-	f25519_mul__distinct(s, r, x);
-
-	/* 0 */
-	f25519_mul__distinct(r, s, s);
-
-	/* 1 */
-	f25519_mul__distinct(s, r, r);
-	f25519_mul__distinct(r, s, x);
-
-	/* 1 */
-	f25519_mul__distinct(s, r, r);
-	f25519_mul__distinct(r, s, x);
-}
-
-#ifdef FULL_C25519_CODE
-void f25519_inv(uint8_t *r, const uint8_t *x)
-{
-	uint8_t tmp[F25519_SIZE];
-
-	f25519_inv__distinct(tmp, x);
-	f25519_copy(r, tmp);
-}
-#endif
-
-/* Raise x to the power of (p-5)/8 = 2^252-3, using s for temporary
- * storage.
- */
-static void exp2523(uint8_t *r, const uint8_t *x, uint8_t *s)
-{
-	int i;
-
-	/* This number is a 252-bit number with the binary expansion:
-	 *
-	 *     111111... 01
-	 */
-
-	/* 1 1 */
-	f25519_mul__distinct(r, x, x);
-	f25519_mul__distinct(s, r, x);
-
-	/* 1 x 248 */
-	for (i = 0; i < 248; i++) {
-		f25519_mul__distinct(r, s, s);
-		f25519_mul__distinct(s, r, x);
-	}
-
-	/* 0 */
-	f25519_mul__distinct(r, s, s);
-
-	/* 1 */
-	f25519_mul__distinct(s, r, r);
-	f25519_mul__distinct(r, s, x);
-}
-
-void f25519_sqrt(uint8_t *r, const uint8_t *a)
-{
-	uint8_t v[F25519_SIZE];
-	uint8_t i[F25519_SIZE];
-	uint8_t x[F25519_SIZE];
-	uint8_t y[F25519_SIZE];
-
-	/* v = (2a)^((p-5)/8) [x = 2a] */
-	f25519_mul_c(x, a, 2);
-	exp2523(v, x, y);
-
-	/* i = 2av^2 - 1 */
-	f25519_mul__distinct(y, v, v);
-	f25519_mul__distinct(i, x, y);
-	f25519_load(y, 1);
-	f25519_sub(i, i, y);
-
-	/* r = avi */
-	f25519_mul__distinct(x, v, a);
-	f25519_mul__distinct(r, x, i);
-}

package/external/libedhoc/externals/compact25519/src/c25519/f25519.h

@@ -1,98 +0,0 @@
-/* Arithmetic mod p = 2^255-19
- * Daniel Beer <dlbeer@gmail.com>, 8 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#ifndef F25519_H_
-#define F25519_H_
-
-#include <stdint.h>
-#include <string.h>
-
-/* Field elements are represented as little-endian byte strings. All
- * operations have timings which are independent of input data, so they
- * can be safely used for cryptography.
- *
- * Computation is performed on un-normalized elements. These are byte
- * strings which fall into the range 0 <= x < 2p. Use f25519_normalize()
- * to convert to a value 0 <= x < p.
- *
- * Elements received from the outside may greater even than 2p.
- * f25519_normalize() will correctly deal with these numbers too.
- */
-#define F25519_SIZE  32
-
-/* Identity constants */
-#ifdef FULL_C25519_CODE
-extern const uint8_t f25519_zero[F25519_SIZE];
-#endif
-extern const uint8_t f25519_one[F25519_SIZE];
-
-/* Load a small constant */
-void f25519_load(uint8_t *x, uint32_t c);
-
-/* Copy two points */
-static inline void f25519_copy(uint8_t *x, const uint8_t *a)
-{
-	memcpy(x, a, F25519_SIZE);
-}
-
-/* Normalize a field point x < 2*p by subtracting p if necessary */
-void f25519_normalize(uint8_t *x);
-
-/* Compare two field points in constant time. Return one if equal, zero
- * otherwise. This should be performed only on normalized values.
- */
-uint8_t f25519_eq(const uint8_t *x, const uint8_t *y);
-
-/* Conditional copy. If condition == 0, then zero is copied to dst. If
- * condition == 1, then one is copied to dst. Any other value results in
- * undefined behaviour.
- */
-void f25519_select(uint8_t *dst,
-		   const uint8_t *zero, const uint8_t *one,
-		   uint8_t condition);
-
-/* Add/subtract two field points. The three pointers are not required to
- * be distinct.
- */
-void f25519_add(uint8_t *r, const uint8_t *a, const uint8_t *b);
-void f25519_sub(uint8_t *r, const uint8_t *a, const uint8_t *b);
-
-/* Unary negation */
-void f25519_neg(uint8_t *r, const uint8_t *a);
-
-/* Multiply two field points. The __distinct variant is used when r is
- * known to be in a different location to a and b.
- */
-#ifdef FULL_C25519_CODE
-void f25519_mul(uint8_t *r, const uint8_t *a, const uint8_t *b);
-#endif
-void f25519_mul__distinct(uint8_t *r, const uint8_t *a, const uint8_t *b);
-
-/* Multiply a point by a small constant. The two pointers are not
- * required to be distinct.
- *
- * The constant must be less than 2^24.
- */
-void f25519_mul_c(uint8_t *r, const uint8_t *a, uint32_t b);
-
-/* Take the reciprocal of a field point. The __distinct variant is used
- * when r is known to be in a different location to x.
- */
-#ifdef FULL_C25519_CODE
-void f25519_inv(uint8_t *r, const uint8_t *x);
-#endif
-void f25519_inv__distinct(uint8_t *r, const uint8_t *x);
-
-/* Compute one of the square roots of the field element, if the element
- * is square. The other square is -r.
- *
- * If the input is not square, the returned value is a valid field
- * element, but not the correct answer. If you don't already know that
- * your element is square, you should square the return value and test.
- */
-void f25519_sqrt(uint8_t *r, const uint8_t *x);
-
-#endif

package/external/libedhoc/externals/compact25519/src/c25519/fprime.c

@@ -1,226 +0,0 @@
-/* Arithmetic in prime fields
- * Daniel Beer <dlbeer@gmail.com>, 10 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#include "fprime.h"
-
-#ifndef COMPACT_DISABLE_ED25519
-#ifdef FULL_C25519_CODE
-const uint8_t fprime_zero[FPRIME_SIZE] = {0};
-const uint8_t fprime_one[FPRIME_SIZE] = {1};
-#endif
-
-static void raw_add(uint8_t *x, const uint8_t *p)
-{
-	uint16_t c = 0;
-	int i;
-
-	for (i = 0; i < FPRIME_SIZE; i++) {
-		c += ((uint16_t)x[i]) + ((uint16_t)p[i]);
-		x[i] = c;
-		c >>= 8;
-	}
-}
-
-static void raw_try_sub(uint8_t *x, const uint8_t *p)
-{
-	uint8_t minusp[FPRIME_SIZE];
-	uint16_t c = 0;
-	int i;
-
-	for (i = 0; i < FPRIME_SIZE; i++) {
-		c = ((uint16_t)x[i]) - ((uint16_t)p[i]) - c;
-		minusp[i] = c;
-		c = (c >> 8) & 1;
-	}
-
-	fprime_select(x, minusp, x, c);
-}
-
-/* Warning: this function is variable-time */
-static int prime_msb(const uint8_t *p)
-{
-	int i;
-	uint8_t x;
-
-	for (i = FPRIME_SIZE - 1; i >= 0; i--)
-		if (p[i])
-			break;
-
-	x = p[i];
-	i <<= 3;
-
-	while (x) {
-		x >>= 1;
-		i++;
-	}
-
-	return i - 1;
-}
-
-/* Warning: this function may be variable-time in the argument n */
-static void shift_n_bits(uint8_t *x, int n)
-{
-	uint16_t c = 0;
-	int i;
-
-	for (i = 0; i < FPRIME_SIZE; i++) {
-		c |= ((uint16_t)x[i]) << n;
-		x[i] = c;
-		c >>= 8;
-	}
-}
-
-#ifdef FULL_C25519_CODE
-void fprime_load(uint8_t *x, uint32_t c)
-{
-	unsigned int i;
-
-	for (i = 0; i < sizeof(c); i++) {
-		x[i] = c;
-		c >>= 8;
-	}
-
-	for (; i < FPRIME_SIZE; i++)
-		x[i] = 0;
-}
-#endif
-
-static inline int min_int(int a, int b)
-{
-	return a < b ? a : b;
-}
-
-void fprime_from_bytes(uint8_t *n,
-		       const uint8_t *x, size_t len,
-		       const uint8_t *modulus)
-{
-	const int preload_total = min_int(prime_msb(modulus) - 1, len << 3);
-	const int preload_bytes = preload_total >> 3;
-	const int preload_bits = preload_total & 7;
-	const int rbits = (len << 3) - preload_total;
-	int i;
-
-	memset(n, 0, FPRIME_SIZE);
-
-	for (i = 0; i < preload_bytes; i++)
-		n[i] = x[len - preload_bytes + i];
-
-	if (preload_bits) {
-		shift_n_bits(n, preload_bits);
-		n[0] |= x[len - preload_bytes - 1] >> (8 - preload_bits);
-	}
-
-	for (i = rbits - 1; i >= 0; i--) {
-		const uint8_t bit = (x[i >> 3] >> (i & 7)) & 1;
-
-		shift_n_bits(n, 1);
-		n[0] |= bit;
-		raw_try_sub(n, modulus);
-	}
-}
-
-#ifdef FULL_C25519_CODE
-void fprime_normalize(uint8_t *x, const uint8_t *modulus)
-{
-	uint8_t n[FPRIME_SIZE];
-
-	fprime_from_bytes(n, x, FPRIME_SIZE, modulus);
-	fprime_copy(x, n);
-}
-
-uint8_t fprime_eq(const uint8_t *x, const uint8_t *y)
-{
-	uint8_t sum = 0;
-	int i;
-
-	for (i = 0; i < FPRIME_SIZE; i++)
-		sum |= x[i] ^ y[i];
-
-	sum |= (sum >> 4);
-	sum |= (sum >> 2);
-	sum |= (sum >> 1);
-
-	return (sum ^ 1) & 1;
-}
-#endif
-void fprime_select(uint8_t *dst,
-		   const uint8_t *zero, const uint8_t *one,
-		   uint8_t condition)
-{
-	const uint8_t mask = -condition;
-	int i;
-
-	for (i = 0; i < FPRIME_SIZE; i++)
-		dst[i] = zero[i] ^ (mask & (one[i] ^ zero[i]));
-}
-
-void fprime_add(uint8_t *r, const uint8_t *a, const uint8_t *modulus)
-{
-	raw_add(r, a);
-	raw_try_sub(r, modulus);
-}
-
-#ifdef FULL_C25519_CODE
-void fprime_sub(uint8_t *r, const uint8_t *a, const uint8_t *modulus)
-{
-	raw_add(r, modulus);
-	raw_try_sub(r, a);
-	raw_try_sub(r, modulus);
-}
-#endif
-
-void fprime_mul(uint8_t *r, const uint8_t *a, const uint8_t *b,
-		const uint8_t *modulus)
-{
-	int i;
-
-	memset(r, 0, FPRIME_SIZE);
-
-	for (i = prime_msb(modulus); i >= 0; i--) {
-		const uint8_t bit = (b[i >> 3] >> (i & 7)) & 1;
-		uint8_t plusa[FPRIME_SIZE];
-
-		shift_n_bits(r, 1);
-		raw_try_sub(r, modulus);
-
-		fprime_copy(plusa, r);
-		fprime_add(plusa, a, modulus);
-
-		fprime_select(r, r, plusa, bit);
-	}
-}
-
-#ifdef FULL_C25519_CODE
-void fprime_inv(uint8_t *r, const uint8_t *a, const uint8_t *modulus)
-{
-	uint8_t pm2[FPRIME_SIZE];
-	uint16_t c = 2;
-	int i;
-
-	/* Compute (p-2) */
-	fprime_copy(pm2, modulus);
-	for (i = 0; i < FPRIME_SIZE; i++) {
-		c = modulus[i] - c;
-		pm2[i] = c;
-		c >>= 8;
-	}
-
-	/* Binary exponentiation */
-	fprime_load(r, 1);
-
-	for (i = prime_msb(modulus); i >= 0; i--) {
-		uint8_t r2[FPRIME_SIZE];
-
-		fprime_mul(r2, r, r, modulus);
-
-		if ((pm2[i >> 3] >> (i & 7)) & 1)
-			fprime_mul(r, r2, a, modulus);
-		else
-			fprime_copy(r, r2);
-	}
-}
-#endif
-#endif

package/external/libedhoc/externals/compact25519/src/c25519/fprime.h

@@ -1,81 +0,0 @@
-/* Arithmetic in prime fields
- * Daniel Beer <dlbeer@gmail.com>, 10 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#ifndef FPRIME_H_
-#define FPRIME_H_
-
-#ifndef COMPACT_DISABLE_ED25519
-#include <stdint.h>
-#include <string.h>
-
-/* Maximum size of a field element (or a prime). Field elements are
- * always manipulated and stored in normalized form, with 0 <= x < p.
- * You can use normalize() to convert a denormalized bitstring to normal
- * form.
- *
- * Operations are constant with respect to the value of field elements,
- * but not with respect to the modulus.
- *
- * The modulus is a number p, such that 2p-1 fits in FPRIME_SIZE bytes.
- */
-#define FPRIME_SIZE  32
-
-#ifdef FULL_C25519_CODE
-/* Useful constants */
-extern const uint8_t fprime_zero[FPRIME_SIZE];
-extern const uint8_t fprime_one[FPRIME_SIZE];
-#endif
-
-#ifdef FULL_C25519_CODE
-/* Load a small constant */
-void fprime_load(uint8_t *x, uint32_t c);
-#endif
-
-/* Load a large constant */
-void fprime_from_bytes(uint8_t *n,
-		       const uint8_t *x, size_t len,
-		       const uint8_t *modulus);
-
-/* Copy an element */
-static inline void fprime_copy(uint8_t *x, const uint8_t *a)
-{
-	memcpy(x, a, FPRIME_SIZE);
-}
-
-#ifdef FULL_C25519_CODE
-/* Normalize a field element */
-void fprime_normalize(uint8_t *x, const uint8_t *modulus);
-
-/* Compare two field points in constant time. Return one if equal, zero
- * otherwise. This should be performed only on normalized values.
- */
-uint8_t fprime_eq(const uint8_t *x, const uint8_t *y);
-
-#endif
-/* Conditional copy. If condition == 0, then zero is copied to dst. If
- * condition == 1, then one is copied to dst. Any other value results in
- * undefined behaviour.
- */
-void fprime_select(uint8_t *dst,
-		   const uint8_t *zero, const uint8_t *one,
-		   uint8_t condition);
-
-/* Add one value to another. The two pointers must be distinct. */
-void fprime_add(uint8_t *r, const uint8_t *a, const uint8_t *modulus);
-#ifdef FULL_C25519_CODE
-void fprime_sub(uint8_t *r, const uint8_t *a, const uint8_t *modulus);
-#endif
-
-/* Multiply two values to get a third. r must be distinct from a and b */
-void fprime_mul(uint8_t *r, const uint8_t *a, const uint8_t *b,
-		const uint8_t *modulus);
-
-#ifdef FULL_C25519_CODE
-/* Compute multiplicative inverse. r must be distinct from a */
-void fprime_inv(uint8_t *r, const uint8_t *a, const uint8_t *modulus);
-#endif
-#endif
-#endif