authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-08-03 15:25:15+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-08-03 15:25:15+02:00
logfa321a07cd985c672879c091db6dd0aa6b66f0b7
tree637adcd8edf84f08e4f2f1129abd4e7e45d2d337
parent447a4cc115f5d105d49fcb3e970082b89e5a46dd
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

crypto.sign.ed25519: include a context string in blind key signatures (#12316)

The next revision of the specification is going to include a context string in the way blinded scalars are computed. See: https://github.com/cfrg/draft-irtf-cfrg-signature-key-blinding/issues/30#issuecomment-1180516152 https://github.com/cfrg/draft-irtf-cfrg-signature-key-blinding/pull/37

1 files changed, 18 insertions(+), 9 deletions(-)

lib/std/crypto/25519/ed25519.zig+18-9
......@@ -229,15 +229,14 @@ pub const Ed25519 = struct {
229229 blind_secret_key: BlindSecretKey,
230230 };
231231
232 /// Blind an existing key pair with a blinding seed.
233 pub fn blind(key_pair: Ed25519.KeyPair, blind_seed: [blind_seed_length]u8) !BlindKeyPair {
232 /// Blind an existing key pair with a blinding seed and a context.
233 pub fn blind(key_pair: Ed25519.KeyPair, blind_seed: [blind_seed_length]u8, ctx: []const u8) !BlindKeyPair {
234234 var h: [Sha512.digest_length]u8 = undefined;
235235 Sha512.hash(key_pair.secret_key[0..32], &h, .{});
236236 Curve.scalar.clamp(h[0..32]);
237237 const scalar = Curve.scalar.reduce(h[0..32].*);
238238
239 var blind_h: [Sha512.digest_length]u8 = undefined;
240 Sha512.hash(blind_seed[0..], &blind_h, .{});
239 const blind_h = blindCtx(blind_seed, ctx);
241240 const blind_factor = Curve.scalar.reduce(blind_h[0..32].*);
242241
243242 const blind_scalar = Curve.scalar.mul(scalar, blind_factor);
......@@ -259,9 +258,8 @@ pub const Ed25519 = struct {
259258 }
260259
261260 /// Recover a public key from a blind version of it.
262 pub fn unblindPublicKey(blind_public_key: [public_length]u8, blind_seed: [blind_seed_length]u8) ![public_length]u8 {
263 var blind_h: [Sha512.digest_length]u8 = undefined;
264 Sha512.hash(&blind_seed, &blind_h, .{});
261 pub fn unblindPublicKey(blind_public_key: [public_length]u8, blind_seed: [blind_seed_length]u8, ctx: []const u8) ![public_length]u8 {
262 const blind_h = blindCtx(blind_seed, ctx);
265263 const inv_blind_factor = Scalar.fromBytes(blind_h[0..32].*).invert().toBytes();
266264 const public_key = try (try Curve.fromBytes(blind_public_key)).mul(inv_blind_factor);
267265 return public_key.toBytes();
......@@ -297,6 +295,17 @@ pub const Ed25519 = struct {
297295 mem.copy(u8, sig[32..], s[0..]);
298296 return sig;
299297 }
298
299 /// Compute a blind context from a blinding seed and a context.
300 fn blindCtx(blind_seed: [blind_seed_length]u8, ctx: []const u8) [Sha512.digest_length]u8 {
301 var blind_h: [Sha512.digest_length]u8 = undefined;
302 var hx = Sha512.init(.{});
303 hx.update(&blind_seed);
304 hx.update(&[1]u8{0});
305 hx.update(ctx);
306 hx.final(&blind_h);
307 return blind_h;
308 }
300309 };
301310};
302311
......@@ -458,7 +467,7 @@ test "ed25519 with blind keys" {
458467 crypto.random.bytes(&blind);
459468
460469 // Blind the key pair
461 const blind_kp = try BlindKeySignatures.blind(kp, blind);
470 const blind_kp = try BlindKeySignatures.blind(kp, blind, "ctx");
462471
463472 // Sign a message and check that it can be verified with the blind public key
464473 const msg = "test";
......@@ -466,6 +475,6 @@ test "ed25519 with blind keys" {
466475 try Ed25519.verify(sig, msg, blind_kp.blind_public_key);
467476
468477 // Unblind the public key
469 const pk = try BlindKeySignatures.unblindPublicKey(blind_kp.blind_public_key, blind);
478 const pk = try BlindKeySignatures.unblindPublicKey(blind_kp.blind_public_key, blind, "ctx");
470479 try std.testing.expectEqualSlices(u8, &pk, &kp.public_key);
471480}