react-native-queue-player 1.0.0

package/android/src/main/cpp/third_party/curve25519/source/ed25519_sign.c

@@ -0,0 +1,419 @@
+/* The MIT License (MIT)
+ * 
+ * Copyright (c) 2015 mehdi sotoodeh
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining 
+ * a copy of this software and associated documentation files (the 
+ * "Software"), to deal in the Software without restriction, including 
+ * without limitation the rights to use, copy, modify, merge, publish, 
+ * distribute, sublicense, and/or sell copies of the Software, and to 
+ * permit persons to whom the Software is furnished to do so, subject to 
+ * the following conditions:
+ * 
+ * The above copyright notice and this permission notice shall be included 
+ * in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY 
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, 
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "../include/external_calls.h"
+#include "curve25519_mehdi.h"
+#include "../include/ed25519_signature.h"
+#include "sha512.h"
+
+/*
+ * Arithmetic on twisted Edwards curve y^2 - x^2 = 1 + dx^2y^2
+ * with d = -(121665/121666) mod p
+ *      d = 0x52036CEE2B6FFE738CC740797779E89800700A4D4141D8AB75EB4DCA135978A3
+ *      p = 2**255 - 19
+ *      p = 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED
+ * Base point: y=4/5 mod p
+ *      x = 0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A
+ *      y = 0x6666666666666666666666666666666666666666666666666666666666666658
+ * Base point order:
+ *      l = 2**252 + 27742317777372353535851937790883648493
+ *      l = 0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
+ */
+
+extern const U_WORD _w_maxP[K_WORDS];
+extern const U_WORD _w_NxBPO[16][K_WORDS];
+
+#define _w_BPO _w_NxBPO[1]
+
+/*
+// -- custom blind --------------------------------------------------------- 
+//
+// edp_custom_blinding is defined in source/custom_blind.c
+// source/custom_blind is created randomly on every new build
+//
+// -------------------------------------------------------------------------
+*/
+extern EDP_BLINDING_CTX edp_custom_blinding;
+
+const U_WORD _w_2d[K_WORDS] = /* 2*d */
+    W256(0x26B2F159,0xEBD69B94,0x8283B156,0x00E0149A,0xEEF3D130,0x198E80F2,0x56DFFCE7,0x2406D9DC);
+const U_WORD _w_di[K_WORDS] = /* 1/d */
+    W256(0xCDC9F843,0x25E0F276,0x4279542E,0x0B5DD698,0xCDB9CF66,0x2B162114,0x14D5CE43,0x40907ED2);
+
+#include "base_folding8.h"
+
+/*
+    Reference: http://eprint.iacr.org/2008/522
+    Cost: 7M + 7add
+    Return: R = P + BasePoint
+*/
+void edp_AddBasePoint(Ext_POINT *p)
+{
+    U_WORD a[K_WORDS], b[K_WORDS], c[K_WORDS], d[K_WORDS], e[K_WORDS];
+
+    ecp_SubReduce(a, p->y, p->x);           /* A = (Y1-X1)*(Y2-X2) */
+    ecp_MulReduce(a, a, _w_base_folding8[1].YmX);
+    ecp_AddReduce(b, p->y, p->x);           /* B = (Y1+X1)*(Y2+X2) */
+    ecp_MulReduce(b, b, _w_base_folding8[1].YpX);
+    ecp_MulReduce(c, p->t, _w_base_folding8[1].T2d); /* C = T1*2d*T2 */
+    ecp_AddReduce(d, p->z, p->z);           /* D = 2*Z1 */
+    ecp_SubReduce(e, b, a);                 /* E = B-A */
+    ecp_AddReduce(b, b, a);                 /* H = B+A */
+    ecp_SubReduce(a, d, c);                 /* F = D-C */
+    ecp_AddReduce(d, d, c);                 /* G = D+C */
+
+    ecp_MulReduce(p->x, e, a);              /* E*F */
+    ecp_MulReduce(p->y, b, d);              /* H*G */
+    ecp_MulReduce(p->t, e, b);              /* E*H */
+    ecp_MulReduce(p->z, d, a);              /* G*F */
+}
+
+/*
+    Assumptions: pre-computed q, q->Z=1
+    Cost: 7M + 7add
+    Return: P = P + Q
+*/
+void edp_AddAffinePoint(Ext_POINT *p, const PA_POINT *q)
+{
+    U_WORD a[K_WORDS], b[K_WORDS], c[K_WORDS], d[K_WORDS], e[K_WORDS];
+    ecp_SubReduce(a, p->y, p->x);           /* A = (Y1-X1)*(Y2-X2) */
+    ecp_MulReduce(a, a, q->YmX);
+    ecp_AddReduce(b, p->y, p->x);           /* B = (Y1+X1)*(Y2+X2) */
+    ecp_MulReduce(b, b, q->YpX);
+    ecp_MulReduce(c, p->t, q->T2d);         /* C = T1*2d*T2 */
+    ecp_AddReduce(d, p->z, p->z);           /* D = Z1*2*Z2 (Z2=1)*/
+    ecp_SubReduce(e, b, a);                 /* E = B-A */
+    ecp_AddReduce(b, b, a);                 /* H = B+A */
+    ecp_SubReduce(a, d, c);                 /* F = D-C */
+    ecp_AddReduce(d, d, c);                 /* G = D+C */
+
+    ecp_MulReduce(p->x, e, a);              /* E*F */
+    ecp_MulReduce(p->y, b, d);              /* H*G */
+    ecp_MulReduce(p->t, e, b);              /* E*H */
+    ecp_MulReduce(p->z, d, a);              /* G*F */
+}
+
+/*
+    Reference: http://eprint.iacr.org/2008/522
+    Cost: 4M + 4S + 7add
+    Return: P = 2*P
+*/
+void edp_DoublePoint(Ext_POINT *p)
+{
+    U_WORD a[K_WORDS], b[K_WORDS], c[K_WORDS], d[K_WORDS], e[K_WORDS];
+
+    ecp_SqrReduce(a, p->x);         /* A = X1^2 */
+    ecp_SqrReduce(b, p->y);         /* B = Y1^2 */
+    ecp_SqrReduce(c, p->z);         /* C = 2*Z1^2 */
+    ecp_AddReduce(c, c, c);
+    ecp_SubReduce(d, _w_maxP, a);   /* D = -A */
+
+    ecp_SubReduce(a, d, b);         /* H = D-B */
+    ecp_AddReduce(d, d, b);         /* G = D+B */
+    ecp_SubReduce(b, d, c);         /* F = G-C */
+    ecp_AddReduce(e, p->x, p->y);   /* E = (X1+Y1)^2-A-B = (X1+Y1)^2+H */
+    ecp_SqrReduce(e, e);
+    ecp_AddReduce(e, e, a);
+
+    ecp_MulReduce(p->x, e, b);      /* E*F */
+    ecp_MulReduce(p->y, a, d);      /* H*G */
+    ecp_MulReduce(p->z, d, b);      /* G*F */
+    ecp_MulReduce(p->t, e, a);      /* E*H */
+}
+
+/* -- FOLDING ---------------------------------------------------------------
+//
+//    The performance boost is achieved by a process that I call it FOLDING.
+//    Folding can be viewed as an extension of Shamir's trick but it is based
+//    on break down of the scalar multiplier of a*P into a polynomial of the
+//    form:
+//
+//        a*P = SUM(a_i*2^(i*w))*P    for i = 0,1,2,...n-1
+//
+//        a*P = SUM(a_i*P_i)
+//
+//        where P_i = (2^(i*w))*P
+//              n = number of folds
+//              w = bit-length of a_i
+//
+//    For folding of 8, 256-bit multiplier 'a' is chopped into 8 limbs of 
+//    32-bits each (a_0, a_1,...a_7). P_0 - P_7 can be pre-calculated and 
+//    their 256-different permutations can be cached or hard-coded 
+//    directly into the code.
+//    This arrangement combined with double-and-add approach reduces the 
+//    number of EC point calculations by a factor of 8. We only need 31
+//    double & add operations.
+//
+//       +---+---+---+---+---+---+- .... -+---+---+---+---+---+---+
+//  a = (|255|254|253|252|251|250|        | 5 | 4 | 3 | 2 | 1 | 0 |)
+//       +---+---+---+---+---+---+- .... -+---+---+---+---+---+---+
+//
+//                     a_i                       P_i
+//       +---+---+---+ .... -+---+---+---+    ----------
+// a7 = (|255|254|253|       |226|225|224|) * (2**224)*P
+//       +---+---+---+ .... -+---+---+---+
+// a6 = (|225|224|223|       |194|193|192|) * (2**192)*P
+//       +---+---+---+ .... -+---+---+---+
+// a5 = (|191|190|189|       |162|161|160|) * (2**160)*P
+//       +---+---+---+ .... -+---+---+---+
+// a4 = (|159|158|157|       |130|129|128|) * (2**128)*P
+//       +---+---+---+ .... -+---+---+---+
+// a3 = (|127|126|125|       | 98| 97| 96|) * (2**96)*P
+//       +---+---+---+ .... -+---+---+---+
+// a2 = (| 95| 94| 93|       | 66| 65| 64|) * (2**64)*P
+//       +---+---+---+ .... -+---+---+---+
+// a1 = (| 63| 62| 61|       | 34| 33| 32|) * (2**32)*P
+//       +---+---+---+ .... -+---+---+---+
+// a0 = (| 31| 30| 29|       | 2 | 1 | 0 |) * (2**0)*P
+//       +---+---+---+ .... -+---+---+---+
+//         |   |                   |   |
+//         |   +--+                |   +--+
+//         |      |                |      |
+//         V      V     slices     V      V
+//       +---+  +---+    ....    +---+  +---+
+//       |255|  |254|            |225|  |224|   P7
+//       +---+  +---+    ....    +---+  +---+
+//       |225|  |224|            |193|  |192|   P6
+//       +---+  +---+    ....    +---+  +---+
+//       |191|  |190|            |161|  |160|   P5
+//       +---+  +---+    ....    +---+  +---+
+//       |159|  |158|            |129|  |128|   P4
+//       +---+  +---+    ....    +---+  +---+
+//       |127|  |126|            | 97|  | 96|   P3
+//       +---+  +---+    ....    +---+  +---+
+//       | 95|  | 94|            | 65|  | 64|   P2
+//       +---+  +---+    ....    +---+  +---+
+//       | 63|  | 62|            | 33|  | 32|   P1
+//       +---+  +---+    ....    +---+  +---+
+//       | 31|  | 30|            | 1 |  | 0 |   P0
+//       +---+  +---+    ....    +---+  +---+
+// cut[]:  0      1      ....      30     31
+// --------------------------------------------------------------------------
+// Return S = a*P where P is ed25519 base point and R is random
+*/
+void edp_BasePointMult(
+    OUT Ext_POINT *S, 
+    IN const U_WORD *sk, 
+    IN const U_WORD *R)
+{
+    int i = 1;
+    U8 cut[32];
+    const PA_POINT *p0;
+
+    ecp_8Folds(cut, sk);
+
+    p0 = &_w_base_folding8[cut[0]];
+
+    ecp_SubReduce(S->x, p0->YpX, p0->YmX);  /* 2x */
+    ecp_AddReduce(S->y, p0->YpX, p0->YmX);  /* 2y */
+    ecp_MulReduce(S->t, p0->T2d, _w_di);    /* 2xy */
+
+    /* Randomize starting point */
+
+    ecp_AddReduce(S->z, R, R);              /* Z = 2R */
+    ecp_MulReduce(S->x, S->x, R);           /* X = 2xR */
+    ecp_MulReduce(S->t, S->t, R);           /* T = 2xyR */
+    ecp_MulReduce(S->y, S->y, R);           /* Y = 2yR */
+
+    do 
+    {
+        edp_DoublePoint(S);
+        edp_AddAffinePoint(S, &_w_base_folding8[cut[i]]);
+    } while (i++ < 31);
+}
+
+void edp_BasePointMultiply(
+    OUT Affine_POINT *R, 
+    IN const U_WORD *sk, 
+    IN const void *blinding)
+{
+    Ext_POINT S;
+    U_WORD t[K_WORDS];
+
+    if (blinding)
+    {
+        eco_AddReduce(t, sk, ((EDP_BLINDING_CTX*)blinding)->bl);
+        edp_BasePointMult(&S, t, ((EDP_BLINDING_CTX*)blinding)->zr);
+        edp_AddPoint(&S, &S, &((EDP_BLINDING_CTX*)blinding)->BP);
+    }
+    else
+    {
+        edp_BasePointMult(&S, sk, edp_custom_blinding.zr);
+    }
+
+    ecp_Inverse(S.z, S.z);
+    ecp_MulMod(R->x, S.x, S.z);
+    ecp_MulMod(R->y, S.y, S.z);
+}
+
+void edp_ExtPoint2PE(PE_POINT *r, const Ext_POINT *p)
+{
+    ecp_AddReduce(r->YpX, p->y, p->x);
+    ecp_SubReduce(r->YmX, p->y, p->x);
+    ecp_MulReduce(r->T2d, p->t, _w_2d);
+    ecp_AddReduce(r->Z2, p->z, p->z);
+}
+
+/* -- Blinding -------------------------------------------------------------
+//
+//  Blinding is a measure to protect against side channel attacks. 
+//  Blinding randomizes the scalar multiplier.
+//
+//  Instead of calculating a*P, calculate (a+b mod BPO)*P + B
+//
+//  Where b = random blinding and B = -b*P
+//
+// -------------------------------------------------------------------------
+*/
+void *ed25519_Blinding_Init(
+    void *context,                      /* IO: null or ptr blinding context */
+    const unsigned char *seed,          /* IN: [size bytes] random blinding seed */
+    size_t size)                        /* IN: size of blinding seed */
+{
+    struct {
+        Ext_POINT T;
+        U_WORD t[K_WORDS];
+        SHA512_CTX H;
+        U8 digest[SHA512_DIGEST_LENGTH];
+    } d;
+
+    EDP_BLINDING_CTX *ctx = (EDP_BLINDING_CTX*)context;
+
+    if (ctx == 0)
+    {
+        ctx = (EDP_BLINDING_CTX*)mem_alloc(sizeof(EDP_BLINDING_CTX));
+        if (ctx == 0) return 0;
+    }
+
+    /* Use edp_custom_blinding to protect generation of the new blinder */
+
+    SHA512_Init(&d.H);
+    SHA512_Update(&d.H, edp_custom_blinding.zr, 32);
+    SHA512_Update(&d.H, seed, size);
+    SHA512_Final(d.digest, &d.H);
+
+    ecp_BytesToWords(ctx->zr, d.digest+32);
+    ecp_BytesToWords(d.t, d.digest);
+    eco_Mod(d.t);
+    ecp_Sub(ctx->bl, _w_BPO, d.t);
+
+    eco_AddReduce(d.t, d.t, edp_custom_blinding.bl);
+    edp_BasePointMult(&d.T, d.t, edp_custom_blinding.zr);
+    edp_AddPoint(&d.T, &d.T, &edp_custom_blinding.BP);
+
+    edp_ExtPoint2PE(&ctx->BP, &d.T);
+
+    /* clear potentially sensitive data */
+    mem_clear (&d, sizeof(d));
+
+    return ctx;
+}
+
+void ed25519_Blinding_Finish(
+    void *context)                      /* IN: blinding context */
+{
+    if (context)
+    {
+        mem_clear (context, sizeof(EDP_BLINDING_CTX));
+        mem_free (context);
+    }
+}
+
+/* Generate public and private key pair associated with the secret key */
+void ed25519_CreateKeyPair(
+    unsigned char *pubKey,              /* OUT: public key */
+    unsigned char *privKey,             /* OUT: private key */
+    const void *blinding,               /* IN: [optional] null or blinding context */
+    const unsigned char *sk)            /* IN: secret key (32 bytes) */
+{
+    U8 md[SHA512_DIGEST_LENGTH];
+    U_WORD t[K_WORDS];
+    SHA512_CTX H;
+    Affine_POINT Q;
+
+    /* [a:b] = H(sk) */
+    SHA512_Init(&H);
+    SHA512_Update(&H, sk, 32);
+    SHA512_Final(md, &H);
+    ecp_TrimSecretKey(md);
+
+    ecp_BytesToWords(t, md);
+    edp_BasePointMultiply(&Q, t, blinding);
+    ed25519_PackPoint(pubKey, Q.y, Q.x[0]);
+
+    memcpy(privKey, sk, 32);
+    memcpy(privKey+32, pubKey, 32);
+}
+
+/*
+ * Generate message signature
+ */
+void ed25519_SignMessage(
+    unsigned char *signature,           /* OUT: [64 bytes] signature (R,S) */
+    const unsigned char *privKey,       /*  IN: [64 bytes] private key (sk,pk) */
+    const void *blinding,               /*  IN: [optional] null or blinding context */
+    const unsigned char *msg,           /*  IN: [msg_size bytes] message to sign */
+    size_t msg_size)
+{
+    SHA512_CTX H;
+    Affine_POINT R;
+    U_WORD a[K_WORDS], t[K_WORDS], r[K_WORDS];
+    U8 md[SHA512_DIGEST_LENGTH];
+
+    /* [a:b] = H(sk) */
+    SHA512_Init(&H);
+    SHA512_Update(&H, privKey, 32);
+    SHA512_Final(md, &H);
+    ecp_TrimSecretKey(md);              /* a = first 32 bytes */
+    ecp_BytesToWords(a, md);
+
+    /* r = H(b + m) mod BPO */
+    SHA512_Init(&H);
+    SHA512_Update(&H, md+32, 32);
+    SHA512_Update(&H, msg, msg_size);
+    SHA512_Final(md, &H);
+    eco_DigestToWords(r, md);
+    eco_Mod(r);                         /* r mod BPO */
+
+    /* R = r*P */
+    edp_BasePointMultiply(&R, r, blinding);
+    ed25519_PackPoint(signature, R.y, R.x[0]); /* R part of signature */
+
+    /* S = r + H(encoded(R) + pk + m) * a  mod BPO */
+    SHA512_Init(&H);
+    SHA512_Update(&H, signature, 32);   /* encoded(R) */
+    SHA512_Update(&H, privKey+32, 32);  /* pk */
+    SHA512_Update(&H, msg, msg_size);   /* m */
+    SHA512_Final(md, &H);
+    eco_DigestToWords(t, md);
+
+    eco_MulReduce(t, t, a);             /* h()*a */
+    eco_AddReduce(t, t, r);
+    eco_Mod(t);
+    ecp_WordsToBytes(signature+32, t);  /* S part of signature */
+
+    /* Clear sensitive data */
+    ecp_SetValue(a, 0);
+    ecp_SetValue(r, 0);
+}

package/android/src/main/cpp/third_party/curve25519/source/ed25519_signature.h

@@ -0,0 +1,98 @@
+/* The MIT License (MIT)
+ * 
+ * Copyright (c) 2015 mehdi sotoodeh
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining 
+ * a copy of this software and associated documentation files (the 
+ * "Software"), to deal in the Software without restriction, including 
+ * without limitation the rights to use, copy, modify, merge, publish, 
+ * distribute, sublicense, and/or sell copies of the Software, and to 
+ * permit persons to whom the Software is furnished to do so, subject to 
+ * the following conditions:
+ * 
+ * The above copyright notice and this permission notice shall be included 
+ * in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY 
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, 
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __ed25519_signature_h__
+#define __ed25519_signature_h__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* -- ed25519-sign ------------------------------------------------------------- */
+
+#define ed25519_public_key_size     32
+#define ed25519_secret_key_size     32
+#define ed25519_private_key_size    64
+#define ed25519_signature_size      64
+
+/* Generate public key associated with the secret key */
+void ed25519_CreateKeyPair(
+    unsigned char *pubKey,              /* OUT: public key */
+    unsigned char *privKey,             /* OUT: private key */
+    const void *blinding,               /* IN: [optional] null or blinding context */
+    const unsigned char *sk);           /* IN: secret key (32 bytes) */
+
+/* Generate message signature */
+void ed25519_SignMessage(
+    unsigned char *signature,           /* OUT:[64 bytes] signature (R,S) */
+    const unsigned char *privKey,       /* IN: [64 bytes] private key (sk,pk) */
+    const void *blinding,               /* IN: [optional] null or blinding context */
+    const unsigned char *msg,           /* IN: [msg_size bytes] message to sign */
+    size_t msg_size);                   /* IN: size of message */
+
+void *ed25519_Blinding_Init(
+    void *context,                      /* IO: null or ptr blinding context */
+    const unsigned char *seed,          /* IN: [size bytes] random blinding seed */
+    size_t size);                       /* IN: size of blinding seed */
+
+void ed25519_Blinding_Finish(
+    void *context);                     /* IN: blinding context */
+
+/* -- ed25519-verify ----------------------------------------------------------- */
+
+/*  Single-phased signature validation.
+    Returns 1 for SUCCESS and 0 for FAILURE
+*/
+int ed25519_VerifySignature(
+    const unsigned char *signature,     /* IN: [64 bytes] signature (R,S) */
+    const unsigned char *publicKey,     /* IN: [32 bytes] public key */
+    const unsigned char *msg,           /* IN: [msg_size bytes] message to sign */
+    size_t msg_size);                   /* IN: size of message */
+
+/*  First part of two-phase signature validation.
+    This function creates context specifc to a given public key.
+    Needs to be called once per public key
+*/
+void * ed25519_Verify_Init(
+    void *context,                      /* IO: null or verify context to use */
+    const unsigned char *publicKey);    /* IN: [32 bytes] public key */
+
+/*  Second part of two-phase signature validation.
+    Input context is output of ed25519_Verify_Init() for associated public key.
+    Call it once for each message/signature pairs
+    Returns 1 for SUCCESS and 0 for FAILURE
+*/
+int ed25519_Verify_Check(
+    const void          *context,       /* IN: created by ed25519_Verify_Init */
+    const unsigned char *signature,     /* IN: signature (R,S) */
+    const unsigned char *msg,           /* IN: message to sign */
+    size_t msg_size);                   /* IN: size of message */
+
+/* Free up context memory */
+void ed25519_Verify_Finish(void *ctx);
+
+#ifdef __cplusplus
+}
+#endif
+#endif  /* __ed25519_signature_h__ */