authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-15 10:15:42+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-08-16 22:35:27-07:00
logbcef123d902b9d1d8a27b0414932b1b92f6f1a7e
tree22ad97205c0a529cc5d832ba21ec709d11442843
parent263c44473896597346bc244d82a2b436d7d2da02

Address more review issues

5 files changed, 49 insertions(+), 54 deletions(-)

lib/std/crypto/25519/curve25519.zig+3-5
......@@ -19,10 +19,8 @@ pub const Curve25519 = struct {
1919 return p.x.toBytes();
2020 }
2121
22 /// Return the Curve25519 base point.
23 pub inline fn basePoint() Curve25519 {
24 return .{ .x = Fe.curve25519BasePoint };
25 }
22 /// The Curve25519 base point.
23 pub const basePoint = Curve25519{ .x = Fe.curve25519BasePoint };
2624
2725 /// Check that the encoding of a Curve25519 point is canonical.
2826 pub fn rejectNonCanonical(s: [32]u8) !void {
......@@ -103,7 +101,7 @@ pub const Curve25519 = struct {
103101
104102test "curve25519" {
105103 var s = [32]u8{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
106 const p = try Curve25519.basePoint().clampedMul(s);
104 const p = try Curve25519.basePoint.clampedMul(s);
107105 try p.rejectIdentity();
108106 var buf: [128]u8 = undefined;
109107 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{p.toBytes()}), "E6F2A4D1C28EE5C7AD0329268255A468AD407D2672824C0C0EB30EA6EF450145");
lib/std/crypto/25519/ed25519.zig+10-3
......@@ -19,12 +19,19 @@ pub const Ed25519 = struct {
1919 pub const noise_length = 32;
2020
2121 /// Derive a key pair from a secret seed.
22 ///
23 /// As in RFC 8032, an Ed25519 public key is generated by hashing
24 /// the secret key using the SHA-512 function, and interpreting the
25 /// bit-swapped, clamped lower-half of the output as the secret scalar.
26 ///
27 /// For this reason, an EdDSA secret key is commonly called a seed,
28 /// from which the actual secret is derived.
2229 pub fn createKeyPair(seed: [seed_length]u8) ![keypair_length]u8 {
2330 var az: [Sha512.digest_length]u8 = undefined;
2431 var h = Sha512.init();
2532 h.update(&seed);
2633 h.final(&az);
27 const p = try Curve.basePoint().clampedMul(az[0..32].*);
34 const p = try Curve.basePoint.clampedMul(az[0..32].*);
2835 var keypair: [keypair_length]u8 = undefined;
2936 mem.copy(u8, &keypair, &seed);
3037 mem.copy(u8, keypair[seed_length..], &p.toBytes());
......@@ -57,7 +64,7 @@ pub const Ed25519 = struct {
5764 var nonce64: [64]u8 = undefined;
5865 h.final(&nonce64);
5966 const nonce = Curve.scalar.reduce64(nonce64);
60 const r = try Curve.basePoint().mul(nonce);
67 const r = try Curve.basePoint.mul(nonce);
6168
6269 var sig: [signature_length]u8 = undefined;
6370 mem.copy(u8, sig[0..32], &r.toBytes());
......@@ -95,7 +102,7 @@ pub const Ed25519 = struct {
95102 const hram = Curve.scalar.reduce64(hram64);
96103
97104 const p = try a.neg().mul(hram);
98 const check = (try Curve.basePoint().mul(s.*)).add(p).toBytes();
105 const check = (try Curve.basePoint.mul(s.*)).add(p).toBytes();
99106 if (mem.eql(u8, &check, r) == false) {
100107 return error.InvalidSignature;
101108 }
lib/std/crypto/25519/edwards25519.zig+20-28
......@@ -50,20 +50,16 @@ pub const Edwards25519 = struct {
5050 return Fe.rejectNonCanonical(s, true);
5151 }
5252
53 /// Return the Edwards25519 base point.
54 pub inline fn basePoint() Edwards25519 {
55 return .{
56 .x = Fe{ .limbs = .{ 3990542415680775, 3398198340507945, 4322667446711068, 2814063955482877, 2839572215813860 } },
57 .y = Fe{ .limbs = .{ 1801439850948184, 1351079888211148, 450359962737049, 900719925474099, 1801439850948198 } },
58 .z = Fe.one,
59 .t = Fe{ .limbs = .{ 1841354044333475, 16398895984059, 755974180946558, 900171276175154, 1821297809914039 } },
60 .is_base = true,
61 };
62 }
53 /// The edwards25519 base point.
54 pub const basePoint = Edwards25519{
55 .x = Fe{ .limbs = .{ 3990542415680775, 3398198340507945, 4322667446711068, 2814063955482877, 2839572215813860 } },
56 .y = Fe{ .limbs = .{ 1801439850948184, 1351079888211148, 450359962737049, 900719925474099, 1801439850948198 } },
57 .z = Fe.one,
58 .t = Fe{ .limbs = .{ 1841354044333475, 16398895984059, 755974180946558, 900171276175154, 1821297809914039 } },
59 .is_base = true,
60 };
6361
64 inline fn identityElement() Edwards25519 {
65 return .{ .x = Fe.zero, .y = Fe.one, .z = Fe.one, .t = Fe.zero };
66 }
62 const identityElement = Edwards25519{ .x = Fe.zero, .y = Fe.one, .z = Fe.one, .t = Fe.zero };
6763
6864 /// Reject the neutral element.
6965 pub fn rejectIdentity(p: Edwards25519) !void {
......@@ -121,16 +117,16 @@ pub const Edwards25519 = struct {
121117 }
122118
123119 inline fn pcSelect(pc: [16]Edwards25519, b: u8) Edwards25519 {
124 var t = Edwards25519.identityElement();
120 var t = Edwards25519.identityElement;
125121 comptime var i: u8 = 0;
126122 inline while (i < 16) : (i += 1) {
127 t.cMov(pc[i], ((@as(usize, (b ^ i)) -% 1) >> 8) & 1);
123 t.cMov(pc[i], ((@as(usize, b ^ i) -% 1) >> 8) & 1);
128124 }
129125 return t;
130126 }
131127
132128 fn pcMul(pc: [16]Edwards25519, s: [32]u8) !Edwards25519 {
133 var q = Edwards25519.identityElement();
129 var q = Edwards25519.identityElement;
134130 var pos: usize = 252;
135131 while (true) : (pos -= 4) {
136132 q = q.dbl().dbl().dbl().dbl();
......@@ -144,7 +140,7 @@ pub const Edwards25519 = struct {
144140
145141 fn precompute(p: Edwards25519) [16]Edwards25519 {
146142 var pc: [16]Edwards25519 = undefined;
147 pc[0] = Edwards25519.identityElement();
143 pc[0] = Edwards25519.identityElement;
148144 pc[1] = p;
149145 var i: usize = 2;
150146 while (i < 16) : (i += 1) {
......@@ -153,11 +149,14 @@ pub const Edwards25519 = struct {
153149 return pc;
154150 }
155151
156 fn _mul(p: Edwards25519, s: [32]u8) !Edwards25519 {
152 /// Multiply an Edwards25519 point by a scalar without clamping it.
153 /// Return error.WeakPublicKey if the resulting point is
154 /// the identity element.
155 pub fn mul(p: Edwards25519, s: [32]u8) !Edwards25519 {
157156 var pc: [16]Edwards25519 = undefined;
158157 if (p.is_base) {
159158 @setEvalBranchQuota(10000);
160 pc = comptime precompute(Edwards25519.basePoint());
159 pc = comptime precompute(Edwards25519.basePoint);
161160 } else {
162161 pc = precompute(p);
163162 pc[4].rejectIdentity() catch |_| return error.WeakPublicKey;
......@@ -174,20 +173,13 @@ pub const Edwards25519 = struct {
174173 pub fn clampedMul(p: Edwards25519, s: [32]u8) !Edwards25519 {
175174 var t: [32]u8 = s;
176175 scalar.clamp(&t);
177 return _mul(p, t);
178 }
179
180 /// Multiply an Edwards25519 point by a scalar without clamping it.
181 /// Return error.WeakPublicKey if the resulting point is
182 /// the identity element.
183 pub fn mul(p: Edwards25519, s: [32]u8) !Edwards25519 {
184 return _mul(p, s);
176 return mul(p, t);
185177 }
186178};
187179
188180test "edwards25519 packing/unpacking" {
189181 const s = [_]u8{170} ++ [_]u8{0} ** 31;
190 var b = Edwards25519.basePoint();
182 var b = Edwards25519.basePoint;
191183 const pk = try b.mul(s);
192184 var buf: [128]u8 = undefined;
193185 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{pk.toBytes()}), "074BC7E0FCBD587FDBC0969444245FADC562809C8F6E97E949AF62484B5B81A6");
lib/std/crypto/25519/ristretto255.zig+3-5
......@@ -43,10 +43,8 @@ pub const Ristretto255 = struct {
4343 return p.p.rejectIdentity();
4444 }
4545
46 /// Return the base point (Ristretto is a curve in desguise).
47 pub inline fn basePoint() Ristretto255 {
48 return .{ .p = Curve.basePoint() };
49 }
46 /// The base point (Ristretto is a curve in desguise).
47 pub const basePoint = Ristretto255{ .p = Curve.basePoint };
5048
5149 /// Decode a Ristretto255 representative.
5250 pub fn fromBytes(s: [32]u8) !Ristretto255 {
......@@ -130,7 +128,7 @@ pub const Ristretto255 = struct {
130128};
131129
132130test "ristretto255" {
133 const p = Ristretto255.basePoint();
131 const p = Ristretto255.basePoint;
134132 var buf: [256]u8 = undefined;
135133 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{p.toBytes()}), "E2F2AE0A6ABC4E71A884A961C500515F58E30B6AA582DD8DB6A65945E08D2D76");
136134
lib/std/crypto/25519/x25519.zig+13-13
......@@ -17,7 +17,7 @@ pub const X25519 = struct {
1717 std.debug.assert(public_key.len >= minimum_key_length);
1818 var s: [32]u8 = undefined;
1919 mem.copy(u8, &s, private_key[0..32]);
20 if (Curve.basePoint().clampedMul(s)) |q| {
20 if (Curve.basePoint.clampedMul(s)) |q| {
2121 mem.copy(u8, public_key, q.toBytes()[0..]);
2222 return true;
2323 } else |_| {
......@@ -52,7 +52,7 @@ test "x25519 public key calculation from secret key" {
5252 try fmt.hexToBytes(sk[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");
5353 try fmt.hexToBytes(pk_expected[0..], "f1814f0e8ff1043d8a44d25babff3cedcae6c22c3edaa48f857ae70de2baae50");
5454 std.testing.expect(X25519.createPublicKey(pk_calculated[0..], &sk));
55 std.testing.expect(std.mem.eql(u8, &pk_calculated, &pk_expected));
55 std.testing.expectEqual(pk_calculated, pk_expected);
5656}
5757
5858test "x25519 rfc7748 vector1" {
......@@ -64,7 +64,7 @@ test "x25519 rfc7748 vector1" {
6464 var output: [32]u8 = undefined;
6565
6666 std.testing.expect(X25519.create(output[0..], secret_key[0..], public_key[0..]));
67 std.testing.expect(std.mem.eql(u8, &output, expected_output[0..]));
67 std.testing.expectEqual(output, expected_output);
6868}
6969
7070test "x25519 rfc7748 vector2" {
......@@ -76,7 +76,7 @@ test "x25519 rfc7748 vector2" {
7676 var output: [32]u8 = undefined;
7777
7878 std.testing.expect(X25519.create(output[0..], secret_key[0..], public_key[0..]));
79 std.testing.expect(std.mem.eql(u8, &output, expected_output[0..]));
79 std.testing.expectEqual(output, expected_output);
8080}
8181
8282test "x25519 rfc7748 one iteration" {
......@@ -91,11 +91,11 @@ test "x25519 rfc7748 one iteration" {
9191 var output: [32]u8 = undefined;
9292 std.testing.expect(X25519.create(output[0..], &k, &u));
9393
94 std.mem.copy(u8, u[0..], k[0..]);
95 std.mem.copy(u8, k[0..], output[0..]);
94 mem.copy(u8, u[0..], k[0..]);
95 mem.copy(u8, k[0..], output[0..]);
9696 }
9797
98 std.testing.expect(std.mem.eql(u8, k[0..], expected_output[0..]));
98 std.testing.expectEqual(k, expected_output);
9999}
100100
101101test "x25519 rfc7748 1,000 iterations" {
......@@ -115,11 +115,11 @@ test "x25519 rfc7748 1,000 iterations" {
115115 var output: [32]u8 = undefined;
116116 std.testing.expect(X25519.create(output[0..], &k, &u));
117117
118 std.mem.copy(u8, u[0..], k[0..]);
119 std.mem.copy(u8, k[0..], output[0..]);
118 mem.copy(u8, u[0..], k[0..]);
119 mem.copy(u8, k[0..], output[0..]);
120120 }
121121
122 std.testing.expect(std.mem.eql(u8, k[0..], expected_output));
122 std.testing.expectEqual(k, expected_output);
123123}
124124
125125test "x25519 rfc7748 1,000,000 iterations" {
......@@ -138,9 +138,9 @@ test "x25519 rfc7748 1,000,000 iterations" {
138138 var output: [32]u8 = undefined;
139139 std.testing.expect(X25519.create(output[0..], &k, &u));
140140
141 std.mem.copy(u8, u[0..], k[0..]);
142 std.mem.copy(u8, k[0..], output[0..]);
141 mem.copy(u8, u[0..], k[0..]);
142 mem.copy(u8, k[0..], output[0..]);
143143 }
144144
145 std.testing.expect(std.mem.eql(u8, k[0..], expected_output));
145 std.testing.expectEqual(k[0..], expected_output);
146146}