From 353f2964299e575818ff5224fb2224676d146b54 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Wed, 7 May 2014 21:01:31 -0700
Subject: [PATCH] Bring changes from SUPERCOP 2014-04-25 to ed25519/ref10

---
 .../crypto_sign/ed25519/ref10/keypair.c       |  8 ++--
 .../crypto_sign/ed25519/ref10/open.c          | 46 ++++++++++++-------
 .../crypto_sign/ed25519/ref10/sign.c          | 23 ++++++----
 3 files changed, 48 insertions(+), 29 deletions(-)

diff --git a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
index d1969254..79556472 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
@@ -1,3 +1,6 @@
+
+#include <string.h>
+
 #include "api.h"
 #include "randombytes.h"
 #include "crypto_hash_sha512.h"
@@ -7,7 +10,6 @@ int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
                              const unsigned char *seed)
 {
     ge_p3 A;
-    int i;
 
     crypto_hash_sha512(sk,seed,32);
     sk[0] &= 248;
@@ -17,8 +19,8 @@ int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
     ge_scalarmult_base(&A,sk);
     ge_p3_tobytes(pk,&A);
 
-    for (i = 0;i < 32;++i) sk[i] = seed[i];
-    for (i = 0;i < 32;++i) sk[32 + i] = pk[i];
+    memmove(sk, seed, 32);
+    memmove(sk + 32, pk, 32);
     return 0;
 }
 
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c
index 94d50ef3..bddfa859 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/open.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c
@@ -1,3 +1,6 @@
+
+#include <string.h>
+
 #include "api.h"
 #include "crypto_hash_sha512.h"
 #include "crypto_verify_32.h"
@@ -10,34 +13,43 @@ int crypto_sign_open(
   const unsigned char *pk
 )
 {
+  unsigned char pkcopy[32];
+  unsigned char rcopy[32];
+  unsigned char scopy[32];
   unsigned char h[64];
-  unsigned char checkr[32];
+  unsigned char rcheck[32];
+  unsigned int  i;
   unsigned char d = 0;
   ge_p3 A;
   ge_p2 R;
-  unsigned long long i;
 
-  *mlen = -1;
-  if (smlen < 64) return -1;
-  if (sm[63] & 224) return -1;
-  if (ge_frombytes_negate_vartime(&A,pk) != 0) return -1;
+  if (smlen < 64) goto badsig;
+  if (sm[63] & 224) goto badsig;
+  if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
+
   for (i = 0; i < 32; ++i) d |= pk[i];
   if (d == 0) return -1;
 
-  for (i = 0;i < smlen;++i) m[i] = sm[i];
-  for (i = 0;i < 32;++i) m[32 + i] = pk[i];
+  memmove(pkcopy,pk,32);
+  memmove(rcopy,sm,32);
+  memmove(scopy,sm + 32,32);
+
+  memmove(m,sm,smlen);
+  memmove(m + 32,pkcopy,32);
   crypto_hash_sha512(h,m,smlen);
   sc_reduce(h);
 
-  ge_double_scalarmult_vartime(&R,h,&A,sm + 32);
-  ge_tobytes(checkr,&R);
-  if (crypto_verify_32(checkr,sm) != 0) {
-    for (i = 0;i < smlen;++i) m[i] = 0;
-    return -1;
+  ge_double_scalarmult_vartime(&R,h,&A,scopy);
+  ge_tobytes(rcheck,&R);
+  if (crypto_verify_32(rcheck,rcopy) == 0) {
+    memmove(m,m + 64,smlen - 64);
+    memset(m + smlen - 64,0,64);
+    *mlen = smlen - 64;
+    return 0;
   }
 
-  for (i = 0;i < smlen - 64;++i) m[i] = sm[64 + i];
-  for (i = smlen - 64;i < smlen;++i) m[i] = 0;
-  *mlen = smlen - 64;
-  return 0;
+badsig:
+  *mlen = -1;
+  memset(m,0,smlen);
+  return -1;
 }
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/sign.c b/src/libsodium/crypto_sign/ed25519/ref10/sign.c
index 49507b02..4840f500 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/sign.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/sign.c
@@ -1,3 +1,6 @@
+
+#include <string.h>
+
 #include "api.h"
 #include "crypto_hash_sha512.h"
 #include "ge.h"
@@ -9,11 +12,13 @@ int crypto_sign(
   const unsigned char *sk
 )
 {
+  unsigned char pk[32];
   unsigned char az[64];
-  unsigned char r[64];
+  unsigned char nonce[64];
   unsigned char hram[64];
   ge_p3 R;
-  unsigned long long i;
+
+  memmove(pk,sk + 32,32);
 
   crypto_hash_sha512(az,sk,32);
   az[0] &= 248;
@@ -21,18 +26,18 @@ int crypto_sign(
   az[31] |= 64;
 
   *smlen = mlen + 64;
-  for (i = 0;i < mlen;++i) sm[64 + i] = m[i];
-  for (i = 0;i < 32;++i) sm[32 + i] = az[32 + i];
-  crypto_hash_sha512(r,sm + 32,mlen + 32);
-  for (i = 0;i < 32;++i) sm[32 + i] = sk[32 + i];
+  memmove(sm + 64,m,mlen);
+  memmove(sm + 32,az + 32,32);
+  crypto_hash_sha512(nonce,sm + 32,mlen + 32);
+  memmove(sm + 32,pk,32);
 
-  sc_reduce(r);
-  ge_scalarmult_base(&R,r);
+  sc_reduce(nonce);
+  ge_scalarmult_base(&R,nonce);
   ge_p3_tobytes(sm,&R);
 
   crypto_hash_sha512(hram,sm,mlen + 64);
   sc_reduce(hram);
-  sc_muladd(sm + 32,hram,az,r);
+  sc_muladd(sm + 32,hram,az,nonce);
 
   return 0;
 }