Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.bin/signify/mod_ed25519.c	Lines:	59	73	80.8 %
Date:	2017-11-07	Branches:	22	26	84.6 %


/* $OpenBSD: mod_ed25519.c,v 1.1 2014/01/08 05:00:01 tedu Exp $ */

/*
 * Public Domain, Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange,
 * Peter Schwabe, Bo-Yin Yang.
 * Copied from supercop-20130419/crypto_sign/ed25519/ref/ed25519.c
 */

#include "crypto_api.h"

#include "ge25519.h"

static void get_hram(unsigned char *hram, const unsigned char *sm, const unsigned char *pk, unsigned char *playground, unsigned long long smlen)
{
  unsigned long long i;

  for (i =  0;i < 32;++i)    playground[i] = sm[i];
  for (i = 32;i < 64;++i)    playground[i] = pk[i-32];
  for (i = 64;i < smlen;++i) playground[i] = sm[i];

  crypto_hash_sha512(hram,playground,smlen);
}

#ifndef VERIFYONLY
int crypto_sign_ed25519_keypair(
    unsigned char *pk,
    unsigned char *sk
    )
{
  sc25519 scsk;
  ge25519 gepk;
  unsigned char extsk[64];
  int i;

  randombytes(sk, 32);
  crypto_hash_sha512(extsk, sk, 32);
  extsk[0] &= 248;
  extsk[31] &= 127;
  extsk[31] |= 64;

  sc25519_from32bytes(&scsk,extsk);

  ge25519_scalarmult_base(&gepk, &scsk);
  ge25519_pack(pk, &gepk);
  for(i=0;i<32;i++)
    sk[32 + i] = pk[i];
  return 0;
}

int crypto_sign_ed25519(
    unsigned char *sm,unsigned long long *smlen,
    const unsigned char *m,unsigned long long mlen,
    const unsigned char *sk
    )
{
  sc25519 sck, scs, scsk;
  ge25519 ger;
  unsigned char r[32];
  unsigned char s[32];
  unsigned char extsk[64];
  unsigned long long i;
  unsigned char hmg[crypto_hash_sha512_BYTES];
  unsigned char hram[crypto_hash_sha512_BYTES];

  crypto_hash_sha512(extsk, sk, 32);
  extsk[0] &= 248;
  extsk[31] &= 127;
  extsk[31] |= 64;

  *smlen = mlen+64;
  for(i=0;i<mlen;i++)
    sm[64 + i] = m[i];
  for(i=0;i<32;i++)
    sm[32 + i] = extsk[32+i];

  crypto_hash_sha512(hmg, sm+32, mlen+32); /* Generate k as h(extsk[32],...,extsk[63],m) */

  /* Computation of R */
  sc25519_from64bytes(&sck, hmg);
  ge25519_scalarmult_base(&ger, &sck);
  ge25519_pack(r, &ger);

  /* Computation of s */
  for(i=0;i<32;i++)
    sm[i] = r[i];

  get_hram(hram, sm, sk+32, sm, mlen+64);

  sc25519_from64bytes(&scs, hram);
  sc25519_from32bytes(&scsk, extsk);
  sc25519_mul(&scs, &scs, &scsk);

  sc25519_add(&scs, &scs, &sck);

  sc25519_to32bytes(s,&scs); /* cat s */
  for(i=0;i<32;i++)
    sm[32 + i] = s[i];

  return 0;
}
#endif
int crypto_sign_ed25519_open(
    unsigned char *m,unsigned long long *mlen,
    const unsigned char *sm,unsigned long long smlen,
    const unsigned char *pk
    )
{
  unsigned int i;
  int ret;
  unsigned char t2[32];
  ge25519 get1, get2;
  sc25519 schram, scs;
  unsigned char hram[crypto_hash_sha512_BYTES];

  *mlen = (unsigned long long) -1;
  if (smlen < 64) return -1;

  if (ge25519_unpackneg_vartime(&get1, pk)) return -1;

  get_hram(hram,sm,pk,m,smlen);

  sc25519_from64bytes(&schram, hram);

  sc25519_from32bytes(&scs, sm+32);

  ge25519_double_scalarmult_vartime(&get2, &get1, &schram, &ge25519_base, &scs);
  ge25519_pack(t2, &get2);

  ret = crypto_verify_32(sm, t2);

  if (!ret)
  {
    for(i=0;i<smlen-64;i++)
      m[i] = sm[i + 64];
    *mlen = smlen-64;
  }
  else
  {
    for(i=0;i<smlen-64;i++)
      m[i] = 0;
  }
  return ret;
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: mod_ed25519.c,v 1.1 2014/01/08 05:00:01 tedu Exp $ */
2
3			/*
4			* Public Domain, Authors: Daniel J. Bernstein, Niels Duif, Tanja Lange,
5			* Peter Schwabe, Bo-Yin Yang.
6			* Copied from supercop-20130419/crypto_sign/ed25519/ref/ed25519.c
7			*/
8
9			#include "crypto_api.h"
10
11			#include "ge25519.h"
12
13			static void get_hram(unsigned char hram, const unsigned char sm, const unsigned char pk, unsigned char playground, unsigned long long smlen)
14			{
15			unsigned long long i;
16
17	✓✓	7571	for (i = 0;i < 32;++i) playground[i] = sm[i];
18	✓✓	7458	for (i = 32;i < 64;++i) playground[i] = pk[i-32];
19	✓✓	64504	for (i = 64;i < smlen;++i) playground[i] = sm[i];
20
21		113	crypto_hash_sha512(hram,playground,smlen);
22		113	}
23
24			#ifndef VERIFYONLY
25			int crypto_sign_ed25519_keypair(
26			unsigned char *pk,
27			unsigned char *sk
28			)
29			{
30			sc25519 scsk;
31			ge25519 gepk;
32			unsigned char extsk[64];
33			int i;
34
35			randombytes(sk, 32);
36			crypto_hash_sha512(extsk, sk, 32);
37			extsk[0] &= 248;
38			extsk[31] &= 127;
39			extsk[31] \|= 64;
40
41			sc25519_from32bytes(&scsk,extsk);
42
43			ge25519_scalarmult_base(&gepk, &scsk);
44			ge25519_pack(pk, &gepk);
45			for(i=0;i<32;i++)
46			sk[32 + i] = pk[i];
47			return 0;
48			}
49
50			int crypto_sign_ed25519(
51			unsigned char sm,unsigned long long smlen,
52			const unsigned char *m,unsigned long long mlen,
53			const unsigned char *sk
54			)
55			{
56		48	sc25519 sck, scs, scsk;
57		24	ge25519 ger;
58		24	unsigned char r[32];
59		24	unsigned char s[32];
60		24	unsigned char extsk[64];
61			unsigned long long i;
62		24	unsigned char hmg[crypto_hash_sha512_BYTES];
63		24	unsigned char hram[crypto_hash_sha512_BYTES];
64
65		24	crypto_hash_sha512(extsk, sk, 32);
66		24	extsk[0] &= 248;
67		24	extsk[31] &= 127;
68		24	extsk[31] \|= 64;
69
70		24	*smlen = mlen+64;
71	✓✓	10220	for(i=0;i<mlen;i++)
72		5086	sm[64 + i] = m[i];
73	✓✓	1584	for(i=0;i<32;i++)
74		768	sm[32 + i] = extsk[32+i];
75
76		24	crypto_hash_sha512(hmg, sm+32, mlen+32); /* Generate k as h(extsk[32],...,extsk[63],m) */
77
78			/* Computation of R */
79		24	sc25519_from64bytes(&sck, hmg);
80		24	ge25519_scalarmult_base(&ger, &sck);
81		24	ge25519_pack(r, &ger);
82
83			/* Computation of s */
84	✓✓	1584	for(i=0;i<32;i++)
85		768	sm[i] = r[i];
86
87		24	get_hram(hram, sm, sk+32, sm, mlen+64);
88
89		24	sc25519_from64bytes(&scs, hram);
90		24	sc25519_from32bytes(&scsk, extsk);
91		24	sc25519_mul(&scs, &scs, &scsk);
92
93		24	sc25519_add(&scs, &scs, &sck);
94
95		24	sc25519_to32bytes(s,&scs); /* cat s */
96	✓✓	1584	for(i=0;i<32;i++)
97		768	sm[32 + i] = s[i];
98
99		24	return 0;
100		24	}
101			#endif
102			int crypto_sign_ed25519_open(
103			unsigned char m,unsigned long long mlen,
104			const unsigned char *sm,unsigned long long smlen,
105			const unsigned char *pk
106			)
107			{
108			unsigned int i;
109			int ret;
110		178	unsigned char t2[32];
111		89	ge25519 get1, get2;
112		89	sc25519 schram, scs;
113		89	unsigned char hram[crypto_hash_sha512_BYTES];
114
115		89	*mlen = (unsigned long long) -1;
116	✗✓	89	if (smlen < 64) return -1;
117
118	✗✓	89	if (ge25519_unpackneg_vartime(&get1, pk)) return -1;
119
120		89	get_hram(hram,sm,pk,m,smlen);
121
122		89	sc25519_from64bytes(&schram, hram);
123
124		89	sc25519_from32bytes(&scs, sm+32);
125
126		89	ge25519_double_scalarmult_vartime(&get2, &get1, &schram, &ge25519_base, &scs);
127		89	ge25519_pack(t2, &get2);
128
129		89	ret = crypto_verify_32(sm, t2);
130
131	✓✓	89	if (!ret)
132			{
133	✓✓	53964	for(i=0;i<smlen-64;i++)
134		26941	m[i] = sm[i + 64];
135		82	*mlen = smlen-64;
136		82	}
137			else
138			{
139	✓✓	231	for(i=0;i<smlen-64;i++)
140		112	m[i] = 0;
141			}
142		89	return ret;
143		89	}