edhoc 1.4.0 → 2.0.0

package/external/libedhoc/externals/compact25519/src/c25519/ed25519.c

@@ -1,323 +0,0 @@
-/* Edwards curve operations
- * Daniel Beer <dlbeer@gmail.com>, 9 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#include "ed25519.h"
-
-#ifndef COMPACT_DISABLE_ED25519
-
-/* Base point is (numbers wrapped):
- *
- *     x = 151122213495354007725011514095885315114
- *         54012693041857206046113283949847762202
- *     y = 463168356949264781694283940034751631413
- *         07993866256225615783033603165251855960
- *
- * y is derived by transforming the original Montgomery base (u=9). x
- * is the corresponding positive coordinate for the new curve equation.
- * t is x*y.
- */
-const struct ed25519_pt ed25519_base = {
-	.x = {
-		0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9,
-		0xb2, 0xa7, 0x25, 0x95, 0x60, 0xc7, 0x2c, 0x69,
-		0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
-		0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21
-	},
-	.y = {
-		0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
-		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
-		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
-		0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66
-	},
-	.t = {
-		0xa3, 0xdd, 0xb7, 0xa5, 0xb3, 0x8a, 0xde, 0x6d,
-		0xf5, 0x52, 0x51, 0x77, 0x80, 0x9f, 0xf0, 0x20,
-		0x7d, 0xe3, 0xab, 0x64, 0x8e, 0x4e, 0xea, 0x66,
-		0x65, 0x76, 0x8b, 0xd7, 0x0f, 0x5f, 0x87, 0x67
-	},
-	.z = {1, 0}
-};
-
-const struct ed25519_pt ed25519_neutral = {
-	.x = {0},
-	.y = {1, 0},
-	.t = {0},
-	.z = {1, 0}
-};
-
-/* Conversion to and from projective coordinates */
-void ed25519_project(struct ed25519_pt *p,
-		     const uint8_t *x, const uint8_t *y)
-{
-	f25519_copy(p->x, x);
-	f25519_copy(p->y, y);
-	f25519_load(p->z, 1);
-	f25519_mul__distinct(p->t, x, y);
-}
-
-void ed25519_unproject(uint8_t *x, uint8_t *y,
-		       const struct ed25519_pt *p)
-{
-	uint8_t z1[F25519_SIZE];
-
-	f25519_inv__distinct(z1, p->z);
-	f25519_mul__distinct(x, p->x, z1);
-	f25519_mul__distinct(y, p->y, z1);
-
-	f25519_normalize(x);
-	f25519_normalize(y);
-}
-
-/* Compress/uncompress points. We compress points by storing the x
- * coordinate and the parity of the y coordinate.
- *
- * Rearranging the curve equation, we obtain explicit formulae for the
- * coordinates:
- *
- *     x = sqrt((y^2-1) / (1+dy^2))
- *     y = sqrt((x^2+1) / (1-dx^2))
- *
- * Where d = (-121665/121666), or:
- *
- *     d = 370957059346694393431380835087545651895
- *         42113879843219016388785533085940283555
- */
-
-static const uint8_t ed25519_d[F25519_SIZE] = {
-	0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
-	0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
-	0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
-	0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52
-};
-
-void ed25519_pack(uint8_t *c, const uint8_t *x, const uint8_t *y)
-{
-	uint8_t tmp[F25519_SIZE];
-	uint8_t parity;
-
-	f25519_copy(tmp, x);
-	f25519_normalize(tmp);
-	parity = (tmp[0] & 1) << 7;
-
-	f25519_copy(c, y);
-	f25519_normalize(c);
-	c[31] |= parity;
-}
-
-uint8_t ed25519_try_unpack(uint8_t *x, uint8_t *y, const uint8_t *comp)
-{
-	const int parity = comp[31] >> 7;
-	uint8_t a[F25519_SIZE];
-	uint8_t b[F25519_SIZE];
-	uint8_t c[F25519_SIZE];
-
-	/* Unpack y */
-	f25519_copy(y, comp);
-	y[31] &= 127;
-
-	/* Compute c = y^2 */
-	f25519_mul__distinct(c, y, y);
-
-	/* Compute b = (1+dy^2)^-1 */
-	f25519_mul__distinct(b, c, ed25519_d);
-	f25519_add(a, b, f25519_one);
-	f25519_inv__distinct(b, a);
-
-	/* Compute a = y^2-1 */
-	f25519_sub(a, c, f25519_one);
-
-	/* Compute c = a*b = (y^2-1)/(1-dy^2) */
-	f25519_mul__distinct(c, a, b);
-
-	/* Compute a, b = +/-sqrt(c), if c is square */
-	f25519_sqrt(a, c);
-	f25519_neg(b, a);
-
-	/* Select one of them, based on the compressed parity bit */
-	f25519_select(x, a, b, (a[0] ^ parity) & 1);
-
-	/* Verify that x^2 = c */
-	f25519_mul__distinct(a, x, x);
-	f25519_normalize(a);
-	f25519_normalize(c);
-
-	return f25519_eq(a, c);
-}
-
-/* k = 2d */
-static const uint8_t ed25519_k[F25519_SIZE] = {
-	0x59, 0xf1, 0xb2, 0x26, 0x94, 0x9b, 0xd6, 0xeb,
-	0x56, 0xb1, 0x83, 0x82, 0x9a, 0x14, 0xe0, 0x00,
-	0x30, 0xd1, 0xf3, 0xee, 0xf2, 0x80, 0x8e, 0x19,
-	0xe7, 0xfc, 0xdf, 0x56, 0xdc, 0xd9, 0x06, 0x24
-};
-
-void ed25519_add(struct ed25519_pt *r,
-		 const struct ed25519_pt *p1, const struct ed25519_pt *p2)
-{
-	/* Explicit formulas database: add-2008-hwcd-3
-	 *
-	 * source 2008 Hisil--Wong--Carter--Dawson,
-	 *     http://eprint.iacr.org/2008/522, Section 3.1
-	 * appliesto extended-1
-	 * parameter k
-	 * assume k = 2 d
-	 * compute A = (Y1-X1)(Y2-X2)
-	 * compute B = (Y1+X1)(Y2+X2)
-	 * compute C = T1 k T2
-	 * compute D = Z1 2 Z2
-	 * compute E = B - A
-	 * compute F = D - C
-	 * compute G = D + C
-	 * compute H = B + A
-	 * compute X3 = E F
-	 * compute Y3 = G H
-	 * compute T3 = E H
-	 * compute Z3 = F G
-	 */
-	uint8_t a[F25519_SIZE];
-	uint8_t b[F25519_SIZE];
-	uint8_t c[F25519_SIZE];
-	uint8_t d[F25519_SIZE];
-	uint8_t e[F25519_SIZE];
-	uint8_t f[F25519_SIZE];
-	uint8_t g[F25519_SIZE];
-	uint8_t h[F25519_SIZE];
-
-	/* A = (Y1-X1)(Y2-X2) */
-	f25519_sub(c, p1->y, p1->x);
-	f25519_sub(d, p2->y, p2->x);
-	f25519_mul__distinct(a, c, d);
-
-	/* B = (Y1+X1)(Y2+X2) */
-	f25519_add(c, p1->y, p1->x);
-	f25519_add(d, p2->y, p2->x);
-	f25519_mul__distinct(b, c, d);
-
-	/* C = T1 k T2 */
-	f25519_mul__distinct(d, p1->t, p2->t);
-	f25519_mul__distinct(c, d, ed25519_k);
-
-	/* D = Z1 2 Z2 */
-	f25519_mul__distinct(d, p1->z, p2->z);
-	f25519_add(d, d, d);
-
-	/* E = B - A */
-	f25519_sub(e, b, a);
-
-	/* F = D - C */
-	f25519_sub(f, d, c);
-
-	/* G = D + C */
-	f25519_add(g, d, c);
-
-	/* H = B + A */
-	f25519_add(h, b, a);
-
-	/* X3 = E F */
-	f25519_mul__distinct(r->x, e, f);
-
-	/* Y3 = G H */
-	f25519_mul__distinct(r->y, g, h);
-
-	/* T3 = E H */
-	f25519_mul__distinct(r->t, e, h);
-
-	/* Z3 = F G */
-	f25519_mul__distinct(r->z, f, g);
-}
-
-void ed25519_double(struct ed25519_pt *r, const struct ed25519_pt *p)
-{
-	/* Explicit formulas database: dbl-2008-hwcd
-	 *
-	 * source 2008 Hisil--Wong--Carter--Dawson,
-	 *     http://eprint.iacr.org/2008/522, Section 3.3
-	 * compute A = X1^2
-	 * compute B = Y1^2
-	 * compute C = 2 Z1^2
-	 * compute D = a A
-	 * compute E = (X1+Y1)^2-A-B
-	 * compute G = D + B
-	 * compute F = G - C
-	 * compute H = D - B
-	 * compute X3 = E F
-	 * compute Y3 = G H
-	 * compute T3 = E H
-	 * compute Z3 = F G
-	 */
-	uint8_t a[F25519_SIZE];
-	uint8_t b[F25519_SIZE];
-	uint8_t c[F25519_SIZE];
-	uint8_t e[F25519_SIZE];
-	uint8_t f[F25519_SIZE];
-	uint8_t g[F25519_SIZE];
-	uint8_t h[F25519_SIZE];
-
-	/* A = X1^2 */
-	f25519_mul__distinct(a, p->x, p->x);
-
-	/* B = Y1^2 */
-	f25519_mul__distinct(b, p->y, p->y);
-
-	/* C = 2 Z1^2 */
-	f25519_mul__distinct(c, p->z, p->z);
-	f25519_add(c, c, c);
-
-	/* D = a A (alter sign) */
-	/* E = (X1+Y1)^2-A-B */
-	f25519_add(f, p->x, p->y);
-	f25519_mul__distinct(e, f, f);
-	f25519_sub(e, e, a);
-	f25519_sub(e, e, b);
-
-	/* G = D + B */
-	f25519_sub(g, b, a);
-
-	/* F = G - C */
-	f25519_sub(f, g, c);
-
-	/* H = D - B */
-	f25519_neg(h, b);
-	f25519_sub(h, h, a);
-
-	/* X3 = E F */
-	f25519_mul__distinct(r->x, e, f);
-
-	/* Y3 = G H */
-	f25519_mul__distinct(r->y, g, h);
-
-	/* T3 = E H */
-	f25519_mul__distinct(r->t, e, h);
-
-	/* Z3 = F G */
-	f25519_mul__distinct(r->z, f, g);
-}
-
-void ed25519_smult(struct ed25519_pt *r_out, const struct ed25519_pt *p,
-		   const uint8_t *e)
-{
-	struct ed25519_pt r;
-	int i;
-
-	ed25519_copy(&r, &ed25519_neutral);
-
-	for (i = 255; i >= 0; i--) {
-		const uint8_t bit = (e[i >> 3] >> (i & 7)) & 1;
-		struct ed25519_pt s;
-
-		ed25519_double(&r, &r);
-		ed25519_add(&s, &r, p);
-
-		f25519_select(r.x, r.x, s.x, bit);
-		f25519_select(r.y, r.y, s.y, bit);
-		f25519_select(r.z, r.z, s.z, bit);
-		f25519_select(r.t, r.t, s.t, bit);
-	}
-
-	ed25519_copy(r_out, &r);
-}
-#endif

package/external/libedhoc/externals/compact25519/src/c25519/ed25519.h

@@ -1,84 +0,0 @@
-/* Edwards curve operations
- * Daniel Beer <dlbeer@gmail.com>, 9 Jan 2014
- *
- * This file is in the public domain.
- */
-
-#ifndef ED25519_H_
-#define ED25519_H_
-
-#ifndef COMPACT_DISABLE_ED25519
-#include "f25519.h"
-
-/* This is not the Ed25519 signature system. Rather, we're implementing
- * basic operations on the twisted Edwards curve over (Z mod 2^255-19):
- *
- *     -x^2 + y^2 = 1 - (121665/121666)x^2y^2
- *
- * With the positive-x base point y = 4/5.
- *
- * These functions will not leak secret data through timing.
- *
- * For more information, see:
- *
- *     Bernstein, D.J. & Lange, T. (2007) "Faster addition and doubling on
- *     elliptic curves". Document ID: 95616567a6ba20f575c5f25e7cebaf83.
- *
- *     Hisil, H. & Wong, K K. & Carter, G. & Dawson, E. (2008) "Twisted
- *     Edwards curves revisited". Advances in Cryptology, ASIACRYPT 2008,
- *     Vol. 5350, pp. 326-343.
- */
-
-/* Projective coordinates */
-struct ed25519_pt {
-	uint8_t  x[F25519_SIZE];
-	uint8_t  y[F25519_SIZE];
-	uint8_t  t[F25519_SIZE];
-	uint8_t  z[F25519_SIZE];
-};
-
-extern const struct ed25519_pt ed25519_base;
-extern const struct ed25519_pt ed25519_neutral;
-
-/* Convert between projective and affine coordinates (x/y in F25519) */
-void ed25519_project(struct ed25519_pt *p,
-		     const uint8_t *x, const uint8_t *y);
-
-void ed25519_unproject(uint8_t *x, uint8_t *y,
-		       const struct ed25519_pt *p);
-
-/* Compress/uncompress points. try_unpack() will check that the
- * compressed point is on the curve, returning 1 if the unpacked point
- * is valid, and 0 otherwise.
- */
-#define ED25519_PACK_SIZE  F25519_SIZE
-
-void ed25519_pack(uint8_t *c, const uint8_t *x, const uint8_t *y);
-uint8_t ed25519_try_unpack(uint8_t *x, uint8_t *y, const uint8_t *c);
-
-/* Add, double and scalar multiply */
-#define ED25519_EXPONENT_SIZE  32
-
-/* Prepare an exponent by clamping appropriate bits */
-static inline void ed25519_prepare(uint8_t *e)
-{
-	e[0] &= 0xf8;
-	e[31] &= 0x7f;
-	e[31] |= 0x40;
-}
-
-/* Order of the group generated by the base point */
-static inline void ed25519_copy(struct ed25519_pt *dst,
-				const struct ed25519_pt *src)
-{
-	memcpy(dst, src, sizeof(*dst));
-}
-
-void ed25519_add(struct ed25519_pt *r,
-		 const struct ed25519_pt *a, const struct ed25519_pt *b);
-void ed25519_double(struct ed25519_pt *r, const struct ed25519_pt *a);
-void ed25519_smult(struct ed25519_pt *r, const struct ed25519_pt *a,
-		   const uint8_t *e);
-
-#endif
-#endif

package/external/libedhoc/externals/compact25519/src/c25519/edsign.c

@@ -1,171 +0,0 @@
-/* Edwards curve signature system
- * Daniel Beer <dlbeer@gmail.com>, 22 Apr 2014
- *
- * This file is in the public domain.
- */
-
-#include "ed25519.h"
-
-#ifndef COMPACT_DISABLE_ED25519
-#include "sha512.h"
-#include "fprime.h"
-#include "edsign.h"
-
-#define EXPANDED_SIZE  64
-
-static const uint8_t ed25519_order[FPRIME_SIZE] = {
-	0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
-	0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
-};
-
-static void expand_key(uint8_t *expanded, const uint8_t *secret)
-{
-	struct sha512_state s;
-
-	sha512_init(&s);
-	sha512_final(&s, secret, EDSIGN_SECRET_KEY_SIZE);
-	sha512_get(&s, expanded, 0, EXPANDED_SIZE);
-	ed25519_prepare(expanded);
-}
-
-static uint8_t upp(struct ed25519_pt *p, const uint8_t *packed)
-{
-	uint8_t x[F25519_SIZE];
-	uint8_t y[F25519_SIZE];
-	uint8_t ok = ed25519_try_unpack(x, y, packed);
-
-	ed25519_project(p, x, y);
-	return ok;
-}
-
-static void pp(uint8_t *packed, const struct ed25519_pt *p)
-{
-	uint8_t x[F25519_SIZE];
-	uint8_t y[F25519_SIZE];
-
-	ed25519_unproject(x, y, p);
-	ed25519_pack(packed, x, y);
-}
-
-static void sm_pack(uint8_t *r, const uint8_t *k)
-{
-	struct ed25519_pt p;
-
-	ed25519_smult(&p, &ed25519_base, k);
-	pp(r, &p);
-}
-
-void edsign_sec_to_pub(uint8_t *pub, const uint8_t *secret)
-{
-	uint8_t expanded[EXPANDED_SIZE];
-
-	expand_key(expanded, secret);
-	sm_pack(pub, expanded);
-}
-
-static void hash_with_prefix(uint8_t *out_fp,
-			     uint8_t *init_block, unsigned int prefix_size,
-			     const uint8_t *message, size_t len)
-{
-	struct sha512_state s;
-
-	sha512_init(&s);
-
-	if (len < SHA512_BLOCK_SIZE && len + prefix_size < SHA512_BLOCK_SIZE) {
-		memcpy(init_block + prefix_size, message, len);
-		sha512_final(&s, init_block, len + prefix_size);
-	} else {
-		size_t i;
-
-		memcpy(init_block + prefix_size, message,
-		       SHA512_BLOCK_SIZE - prefix_size);
-		sha512_block(&s, init_block);
-
-		for (i = SHA512_BLOCK_SIZE - prefix_size;
-		     i + SHA512_BLOCK_SIZE <= len;
-		     i += SHA512_BLOCK_SIZE)
-			sha512_block(&s, message + i);
-
-		sha512_final(&s, message + i, len + prefix_size);
-	}
-
-	sha512_get(&s, init_block, 0, SHA512_HASH_SIZE);
-	fprime_from_bytes(out_fp, init_block, SHA512_HASH_SIZE, ed25519_order);
-}
-
-static void generate_k(uint8_t *k, const uint8_t *kgen_key,
-		       const uint8_t *message, size_t len)
-{
-	uint8_t block[SHA512_BLOCK_SIZE];
-
-	memcpy(block, kgen_key, 32);
-	hash_with_prefix(k, block, 32, message, len);
-}
-
-static void hash_message(uint8_t *z, const uint8_t *r, const uint8_t *a,
-			 const uint8_t *m, size_t len)
-{
-	uint8_t block[SHA512_BLOCK_SIZE];
-
-	memcpy(block, r, 32);
-	memcpy(block + 32, a, 32);
-	hash_with_prefix(z, block, 64, m, len);
-}
-
-void edsign_sign(uint8_t *signature, const uint8_t *pub,
-		 const uint8_t *secret,
-		 const uint8_t *message, size_t len)
-{
-	uint8_t expanded[EXPANDED_SIZE];
-	uint8_t e[FPRIME_SIZE];
-	uint8_t s[FPRIME_SIZE];
-	uint8_t k[FPRIME_SIZE];
-	uint8_t z[FPRIME_SIZE];
-
-	expand_key(expanded, secret);
-
-	/* Generate k and R = kB */
-	generate_k(k, expanded + 32, message, len);
-	sm_pack(signature, k);
-
-	/* Compute z = H(R, A, M) */
-	hash_message(z, signature, pub, message, len);
-
-	/* Obtain e */
-	fprime_from_bytes(e, expanded, 32, ed25519_order);
-
-	/* Compute s = ze + k */
-	fprime_mul(s, z, e, ed25519_order);
-	fprime_add(s, k, ed25519_order);
-	memcpy(signature + 32, s, 32);
-}
-
-uint8_t edsign_verify(const uint8_t *signature, const uint8_t *pub,
-		      const uint8_t *message, size_t len)
-{
-	struct ed25519_pt p;
-	struct ed25519_pt q;
-	uint8_t lhs[F25519_SIZE];
-	uint8_t rhs[F25519_SIZE];
-	uint8_t z[FPRIME_SIZE];
-	uint8_t ok = 1;
-
-	/* Compute z = H(R, A, M) */
-	hash_message(z, signature, pub, message, len);
-
-	/* sB = (ze + k)B = ... */
-	sm_pack(lhs, signature + 32);
-
-	/* ... = zA + R */
-	ok &= upp(&p, pub);
-	ed25519_smult(&p, &p, z);
-	ok &= upp(&q, signature);
-	ed25519_add(&p, &p, &q);
-	pp(rhs, &p);
-
-	/* Equal? */
-	return ok & f25519_eq(lhs, rhs);
-}
-#endif

package/external/libedhoc/externals/compact25519/src/c25519/edsign.h

@@ -1,53 +0,0 @@
-/* Edwards curve signature system
- * Daniel Beer <dlbeer@gmail.com>, 22 Apr 2014
- *
- * This file is in the public domain.
- */
-
-#ifndef EDSIGN_H_
-#define EDSIGN_H_
-
-#ifndef COMPACT_DISABLE_ED25519
-#include <stdint.h>
-#include <stddef.h>
-
-/* This is the Ed25519 signature system, as described in:
- *
- *     Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin
- *     Yang. High-speed high-security signatures. Journal of Cryptographic
- *     Engineering 2 (2012), 77-89. Document ID:
- *     a1a62a2f76d23f65d622484ddd09caf8. URL:
- *     http://cr.yp.to/papers.html#ed25519. Date: 2011.09.26.
- *
- * The format and calculation of signatures is compatible with the
- * Ed25519 implementation in SUPERCOP. Note, however, that our secret
- * keys are half the size: we don't store a copy of the public key in
- * the secret key (we generate it on demand).
- */
-
-/* Any string of 32 random bytes is a valid secret key. There is no
- * clamping of bits, because we don't use the key directly as an
- * exponent (the exponent is derived from part of a key expansion).
- */
-#define EDSIGN_SECRET_KEY_SIZE  32
-
-/* Given a secret key, produce the public key (a packed Edwards-curve
- * point).
- */
-#define EDSIGN_PUBLIC_KEY_SIZE  32
-
-void edsign_sec_to_pub(uint8_t *pub, const uint8_t *secret);
-
-/* Produce a signature for a message. */
-#define EDSIGN_SIGNATURE_SIZE  64
-
-void edsign_sign(uint8_t *signature, const uint8_t *pub,
-		 const uint8_t *secret,
-		 const uint8_t *message, size_t len);
-
-/* Verify a message signature. Returns non-zero if ok. */
-uint8_t edsign_verify(const uint8_t *signature, const uint8_t *pub,
-		      const uint8_t *message, size_t len);
-
-#endif
-#endif