From 3fa3eac20968e42ac1fdb610aee6d10672b45cec Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 7 Apr 2026 23:11:49 +0200 Subject: [PATCH] Add X-Wing --- .gitignore | 1 + .../msvc/vs2010/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2012/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2013/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2015/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2017/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2019/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2022/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ .../msvc/vs2026/libsodium/libsodium.vcxproj | 7 + .../libsodium/libsodium.vcxproj.filters | 33 +++ ci/appveyor/libsodium.vcxproj | 7 + ci/appveyor/libsodium.vcxproj.filters | 21 ++ src/libsodium/Makefile.am | 1 + src/libsodium/Makefile.in | 66 +++++- src/libsodium/crypto_kem/xwing/kem_xwing.c | 210 +++++++++++++++++ src/libsodium/include/Makefile.am | 1 + src/libsodium/include/Makefile.in | 1 + src/libsodium/include/sodium.h | 1 + .../include/sodium/crypto_kem_xwing.h | 69 ++++++ test/default/Makefile.am | 2 +- test/default/Makefile.in | 129 ++++++----- test/default/kem_xwing.c | 217 ++++++++++++++++++ test/default/kem_xwing.exp | 12 + 30 files changed, 998 insertions(+), 60 deletions(-) create mode 100644 src/libsodium/crypto_kem/xwing/kem_xwing.c create mode 100644 src/libsodium/include/sodium/crypto_kem_xwing.h create mode 100644 test/default/kem_xwing.c create mode 100644 test/default/kem_xwing.exp diff --git a/.gitignore b/.gitignore index 0cf152c9..542abd54 100644 --- a/.gitignore +++ b/.gitignore @@ -137,6 +137,7 @@ test/default/keygen test/default/kx test/default/metamorphic test/default/kem_mlkem768 +test/default/kem_xwing test/default/misuse test/default/onetimeauth test/default/onetimeauth2 diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj index b0aa5c94..41bab1cc 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj @@ -193,6 +193,9 @@ + + + @@ -223,6 +226,7 @@ + @@ -234,6 +238,7 @@ + @@ -272,6 +277,7 @@ + @@ -361,6 +367,7 @@ + diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj index ca198b0a..c977d707 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj @@ -193,6 +193,9 @@ + + + @@ -223,6 +226,7 @@ + @@ -234,6 +238,7 @@ + @@ -272,6 +277,7 @@ + @@ -361,6 +367,7 @@ + diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj index f0e52997..de545c1e 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj @@ -193,6 +193,9 @@ + + + @@ -223,6 +226,7 @@ + @@ -234,6 +238,7 @@ + @@ -272,6 +277,7 @@ + @@ -361,6 +367,7 @@ + diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj index 0435fabf..674e8da2 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj @@ -193,6 +193,9 @@ + + + @@ -223,6 +226,7 @@ + @@ -234,6 +238,7 @@ + @@ -272,6 +277,7 @@ + @@ -361,6 +367,7 @@ + diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj index d638840c..e33db251 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj @@ -193,6 +193,9 @@ + + + @@ -223,6 +226,7 @@ + @@ -234,6 +238,7 @@ + @@ -272,6 +277,7 @@ + @@ -361,6 +367,7 @@ + diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj index f79e5879..432da651 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj @@ -217,6 +217,9 @@ + + + @@ -247,6 +250,7 @@ + @@ -258,6 +262,7 @@ + @@ -296,6 +301,7 @@ + @@ -385,6 +391,7 @@ + diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj index be8c01f6..c8ca1ac4 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj @@ -217,6 +217,9 @@ + + + @@ -247,6 +250,7 @@ + @@ -258,6 +262,7 @@ + @@ -296,6 +301,7 @@ + @@ -385,6 +391,7 @@ + diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj b/builds/msvc/vs2026/libsodium/libsodium.vcxproj index 15407d3e..cdeb634d 100644 --- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj @@ -217,6 +217,9 @@ + + + @@ -247,6 +250,7 @@ + @@ -258,6 +262,7 @@ + @@ -296,6 +301,7 @@ + @@ -385,6 +391,7 @@ + diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters index fef1108f..782789d5 100644 --- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters @@ -399,6 +399,15 @@ crypto_aead\chacha20poly1305 + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -485,6 +494,9 @@ include\sodium + + include\sodium + include\sodium @@ -518,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -632,6 +647,9 @@ include\sodium + + include\sodium + include\sodium @@ -899,6 +917,9 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref @@ -1057,6 +1078,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/ci/appveyor/libsodium.vcxproj b/ci/appveyor/libsodium.vcxproj index e699e39b..70b9430d 100644 --- a/ci/appveyor/libsodium.vcxproj +++ b/ci/appveyor/libsodium.vcxproj @@ -441,6 +441,9 @@ + + + @@ -471,6 +474,7 @@ + @@ -482,6 +486,7 @@ + @@ -520,6 +525,7 @@ + @@ -609,6 +615,7 @@ + diff --git a/ci/appveyor/libsodium.vcxproj.filters b/ci/appveyor/libsodium.vcxproj.filters index 83dff779..b98f5e2b 100644 --- a/ci/appveyor/libsodium.vcxproj.filters +++ b/ci/appveyor/libsodium.vcxproj.filters @@ -390,6 +390,15 @@ Source Files + + Source Files + + + Source Files + + + Source Files + Source Files @@ -476,6 +485,9 @@ Header Files + + Header Files + Header Files @@ -509,6 +521,9 @@ Header Files + + Header Files + Header Files @@ -623,6 +638,9 @@ Header Files + + Header Files + Header Files @@ -890,6 +908,9 @@ Header Files + + Header Files + Header Files diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am index 486fdbd1..8c0fdaa1 100644 --- a/src/libsodium/Makefile.am +++ b/src/libsodium/Makefile.am @@ -60,6 +60,7 @@ libsodium_la_SOURCES = \ crypto_kem/mlkem768/kem_mlkem768.c \ crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \ crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \ + crypto_kem/xwing/kem_xwing.c \ crypto_kx/crypto_kx.c \ crypto_onetimeauth/crypto_onetimeauth.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \ diff --git a/src/libsodium/Makefile.in b/src/libsodium/Makefile.in index 5e47feac..dca767ba 100644 --- a/src/libsodium/Makefile.in +++ b/src/libsodium/Makefile.in @@ -320,8 +320,11 @@ am__libsodium_la_SOURCES_DIST = \ crypto_ipcrypt/implementations.h \ crypto_kdf/blake2b/kdf_blake2b.c crypto_kdf/crypto_kdf.c \ crypto_kdf/hkdf/kdf_hkdf_sha256.c \ - crypto_kdf/hkdf/kdf_hkdf_sha512.c crypto_kx/crypto_kx.c \ - crypto_onetimeauth/crypto_onetimeauth.c \ + crypto_kdf/hkdf/kdf_hkdf_sha512.c \ + crypto_kem/mlkem768/kem_mlkem768.c \ + crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \ + crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \ + crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \ crypto_onetimeauth/poly1305/donna/poly1305_donna.h \ @@ -509,6 +512,8 @@ am_libsodium_la_OBJECTS = \ crypto_kdf/libsodium_la-crypto_kdf.lo \ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha256.lo \ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo \ + crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo \ + crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo \ crypto_kx/libsodium_la-crypto_kx.lo \ crypto_onetimeauth/libsodium_la-crypto_onetimeauth.lo \ crypto_onetimeauth/poly1305/libsodium_la-onetimeauth_poly1305.lo \ @@ -665,6 +670,8 @@ am__depfiles_remade = crypto_aead/aegis128l/$(DEPDIR)/libaesni_la-aegis128l_aesn crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo \ crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo \ crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo \ + crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo \ + crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo \ crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo \ crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo \ crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo \ @@ -1079,8 +1086,11 @@ libsodium_la_SOURCES = crypto_aead/aegis128l/aead_aegis128l.c \ crypto_ipcrypt/implementations.h \ crypto_kdf/blake2b/kdf_blake2b.c crypto_kdf/crypto_kdf.c \ crypto_kdf/hkdf/kdf_hkdf_sha256.c \ - crypto_kdf/hkdf/kdf_hkdf_sha512.c crypto_kx/crypto_kx.c \ - crypto_onetimeauth/crypto_onetimeauth.c \ + crypto_kdf/hkdf/kdf_hkdf_sha512.c \ + crypto_kem/mlkem768/kem_mlkem768.c \ + crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \ + crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \ + crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \ crypto_onetimeauth/poly1305/donna/poly1305_donna.h \ @@ -1758,6 +1768,24 @@ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha256.lo: \ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo: \ crypto_kdf/hkdf/$(am__dirstamp) \ crypto_kdf/hkdf/$(DEPDIR)/$(am__dirstamp) +crypto_kem/mlkem768/$(am__dirstamp): + @$(MKDIR_P) crypto_kem/mlkem768 + @: >>crypto_kem/mlkem768/$(am__dirstamp) +crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_kem/mlkem768/$(DEPDIR) + @: >>crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp) +crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo: \ + crypto_kem/mlkem768/$(am__dirstamp) \ + crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp) +crypto_kem/mlkem768/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_kem/mlkem768/ref + @: >>crypto_kem/mlkem768/ref/$(am__dirstamp) +crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_kem/mlkem768/ref/$(DEPDIR) + @: >>crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp) +crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: \ + crypto_kem/mlkem768/ref/$(am__dirstamp) \ + crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp) crypto_kx/$(am__dirstamp): @$(MKDIR_P) crypto_kx @: >>crypto_kx/$(am__dirstamp) @@ -2393,6 +2421,10 @@ mostlyclean-compile: -rm -f crypto_kdf/blake2b/*.lo -rm -f crypto_kdf/hkdf/*.$(OBJEXT) -rm -f crypto_kdf/hkdf/*.lo + -rm -f crypto_kem/mlkem768/*.$(OBJEXT) + -rm -f crypto_kem/mlkem768/*.lo + -rm -f crypto_kem/mlkem768/ref/*.$(OBJEXT) + -rm -f crypto_kem/mlkem768/ref/*.lo -rm -f crypto_kx/*.$(OBJEXT) -rm -f crypto_kx/*.lo -rm -f crypto_onetimeauth/*.$(OBJEXT) @@ -2559,6 +2591,8 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo@am__quote@ # am--include-marker @@ -3103,6 +3137,20 @@ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo: crypto_kdf/hkdf/kdf_hkdf_sha512 @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo `test -f 'crypto_kdf/hkdf/kdf_hkdf_sha512.c' || echo '$(srcdir)/'`crypto_kdf/hkdf/kdf_hkdf_sha512.c +crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo: crypto_kem/mlkem768/kem_mlkem768.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo -MD -MP -MF crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Tpo -c -o crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo `test -f 'crypto_kem/mlkem768/kem_mlkem768.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/kem_mlkem768.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Tpo crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_kem/mlkem768/kem_mlkem768.c' object='crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo `test -f 'crypto_kem/mlkem768/kem_mlkem768.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/kem_mlkem768.c + +crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: crypto_kem/mlkem768/ref/kem_mlkem768_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo -MD -MP -MF crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Tpo -c -o crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo `test -f 'crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/ref/kem_mlkem768_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Tpo crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' object='crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo `test -f 'crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/ref/kem_mlkem768_ref.c + crypto_kx/libsodium_la-crypto_kx.lo: crypto_kx/crypto_kx.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kx/libsodium_la-crypto_kx.lo -MD -MP -MF crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo -c -o crypto_kx/libsodium_la-crypto_kx.lo `test -f 'crypto_kx/crypto_kx.c' || echo '$(srcdir)/'`crypto_kx/crypto_kx.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo @@ -3712,6 +3760,8 @@ clean-libtool: -rm -rf crypto_kdf/.libs crypto_kdf/_libs -rm -rf crypto_kdf/blake2b/.libs crypto_kdf/blake2b/_libs -rm -rf crypto_kdf/hkdf/.libs crypto_kdf/hkdf/_libs + -rm -rf crypto_kem/mlkem768/.libs crypto_kem/mlkem768/_libs + -rm -rf crypto_kem/mlkem768/ref/.libs crypto_kem/mlkem768/ref/_libs -rm -rf crypto_kx/.libs crypto_kx/_libs -rm -rf crypto_onetimeauth/.libs crypto_onetimeauth/_libs -rm -rf crypto_onetimeauth/poly1305/.libs crypto_onetimeauth/poly1305/_libs @@ -4053,6 +4103,10 @@ distclean-generic: -$(am__rm_f) crypto_kdf/blake2b/$(am__dirstamp) -$(am__rm_f) crypto_kdf/hkdf/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) crypto_kdf/hkdf/$(am__dirstamp) + -$(am__rm_f) crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_kem/mlkem768/$(am__dirstamp) + -$(am__rm_f) crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_kem/mlkem768/ref/$(am__dirstamp) -$(am__rm_f) crypto_kx/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) crypto_kx/$(am__dirstamp) -$(am__rm_f) crypto_onetimeauth/$(DEPDIR)/$(am__dirstamp) @@ -4225,6 +4279,8 @@ distclean: distclean-recursive -rm -f crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo -rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo -rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo + -rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo + -rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo -rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo -rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo -rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo @@ -4409,6 +4465,8 @@ maintainer-clean: maintainer-clean-recursive -rm -f crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo -rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo -rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo + -rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo + -rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo -rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo -rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo -rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo diff --git a/src/libsodium/crypto_kem/xwing/kem_xwing.c b/src/libsodium/crypto_kem/xwing/kem_xwing.c new file mode 100644 index 00000000..0721ccf4 --- /dev/null +++ b/src/libsodium/crypto_kem/xwing/kem_xwing.c @@ -0,0 +1,210 @@ +#include +#include + +#include "crypto_hash_sha3.h" +#include "crypto_kem_mlkem768.h" +#include "crypto_kem_xwing.h" +#include "crypto_scalarmult_curve25519.h" +#include "crypto_xof_shake256.h" +#include "private/common.h" +#include "randombytes.h" +#include "utils.h" + +static const unsigned char xwing_label[6] = { 0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c }; + +static void +expand_decaps_key(unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES], + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES], + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES], + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES], + const unsigned char seed[crypto_kem_xwing_SEEDBYTES]) +{ + unsigned char expanded[96]; + unsigned char mlkem_seed[crypto_kem_mlkem768_SEEDBYTES]; + + crypto_xof_shake256(expanded, 96, seed, crypto_kem_xwing_SEEDBYTES); + + memcpy(mlkem_seed, expanded, 64); + memcpy(sk_x25519, expanded + 64, 32); + + crypto_kem_mlkem768_seed_keypair(pk_mlkem, sk_mlkem, mlkem_seed); + crypto_scalarmult_curve25519_base(pk_x25519, sk_x25519); + + sodium_memzero(expanded, sizeof expanded); + sodium_memzero(mlkem_seed, sizeof mlkem_seed); +} + +static void +combiner(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES], + const unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES], + const unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES], + const unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]) +{ + crypto_hash_sha3256_state state; + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, ss_mlkem, crypto_kem_mlkem768_SHAREDSECRETBYTES); + crypto_hash_sha3256_update(&state, ss_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, ct_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, pk_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, xwing_label, sizeof xwing_label); + crypto_hash_sha3256_final(&state, ss); +} + +size_t +crypto_kem_xwing_publickeybytes(void) +{ + return crypto_kem_xwing_PUBLICKEYBYTES; +} + +size_t +crypto_kem_xwing_secretkeybytes(void) +{ + return crypto_kem_xwing_SECRETKEYBYTES; +} + +size_t +crypto_kem_xwing_ciphertextbytes(void) +{ + return crypto_kem_xwing_CIPHERTEXTBYTES; +} + +size_t +crypto_kem_xwing_sharedsecretbytes(void) +{ + return crypto_kem_xwing_SHAREDSECRETBYTES; +} + +size_t +crypto_kem_xwing_seedbytes(void) +{ + return crypto_kem_xwing_SEEDBYTES; +} + +int +crypto_kem_xwing_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned char *seed) +{ + unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES]; + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES]; + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES]; + + expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, seed); + + memcpy(pk, pk_mlkem, crypto_kem_mlkem768_PUBLICKEYBYTES); + memcpy(pk + crypto_kem_mlkem768_PUBLICKEYBYTES, pk_x25519, crypto_scalarmult_curve25519_BYTES); + + memcpy(sk, seed, crypto_kem_xwing_SEEDBYTES); + + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + + return 0; +} + +int +crypto_kem_xwing_keypair(unsigned char *pk, unsigned char *sk) +{ + unsigned char seed[crypto_kem_xwing_SEEDBYTES]; + + randombytes_buf(seed, crypto_kem_xwing_SEEDBYTES); + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + sodium_memzero(seed, sizeof seed); + + return 0; +} + +int +crypto_kem_xwing_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsigned char *pk, + const unsigned char *seed) +{ + const unsigned char *pk_mlkem = pk; + const unsigned char *pk_x25519 = pk + crypto_kem_mlkem768_PUBLICKEYBYTES; + + const unsigned char *seed_mlkem = seed; + const unsigned char *sk_e_x25519 = seed + 32; + + unsigned char ct_mlkem[crypto_kem_mlkem768_CIPHERTEXTBYTES]; + unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES]; + unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES]; + + if (crypto_kem_mlkem768_enc_deterministic(ct_mlkem, ss_mlkem, pk_mlkem, seed_mlkem) != 0) { + return -1; /* LCOV_EXCL_LINE */ + } + + crypto_scalarmult_curve25519_base(ct_x25519, sk_e_x25519); + + if (crypto_scalarmult_curve25519(ss_x25519, sk_e_x25519, pk_x25519) != 0) { + sodium_memzero(ss_mlkem, sizeof ss_mlkem); /* LCOV_EXCL_LINE */ + return -1; /* LCOV_EXCL_LINE */ + } + + memcpy(ct, ct_mlkem, crypto_kem_mlkem768_CIPHERTEXTBYTES); + memcpy(ct + crypto_kem_mlkem768_CIPHERTEXTBYTES, ct_x25519, crypto_scalarmult_curve25519_BYTES); + + combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519); + + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(ss_x25519, sizeof ss_x25519); + + return 0; +} + +int +crypto_kem_xwing_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) +{ + unsigned char seed[64]; + + randombytes_buf(seed, 64); + if (crypto_kem_xwing_enc_deterministic(ct, ss, pk, seed) != 0) { + sodium_memzero(seed, sizeof seed); /* LCOV_EXCL_LINE */ + return -1; /* LCOV_EXCL_LINE */ + } + sodium_memzero(seed, sizeof seed); + + return 0; +} + +int +crypto_kem_xwing_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) +{ + unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES]; + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES]; + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES]; + + const unsigned char *ct_mlkem = ct; + const unsigned char *ct_x25519 = ct + crypto_kem_mlkem768_CIPHERTEXTBYTES; + + unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES]; + unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES]; + + expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, sk); + + /* LCOV_EXCL_START */ + if (crypto_kem_mlkem768_dec(ss_mlkem, ct_mlkem, sk_mlkem) != 0) { + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + return -1; + } + + if (crypto_scalarmult_curve25519(ss_x25519, sk_x25519, ct_x25519) != 0) { + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + return -1; + } + /* LCOV_EXCL_STOP */ + + combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519); + + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(ss_x25519, sizeof ss_x25519); + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + + return 0; +} diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am index d411a242..3fdadfbb 100644 --- a/src/libsodium/include/Makefile.am +++ b/src/libsodium/include/Makefile.am @@ -34,6 +34,7 @@ SODIUM_EXPORT = \ sodium/crypto_kdf_hkdf_sha512.h \ sodium/crypto_kdf_blake2b.h \ sodium/crypto_kem_mlkem768.h \ + sodium/crypto_kem_xwing.h \ sodium/crypto_kx.h \ sodium/crypto_onetimeauth.h \ sodium/crypto_onetimeauth_poly1305.h \ diff --git a/src/libsodium/include/Makefile.in b/src/libsodium/include/Makefile.in index 092fd02d..3c4ae2db 100644 --- a/src/libsodium/include/Makefile.in +++ b/src/libsodium/include/Makefile.in @@ -383,6 +383,7 @@ SODIUM_EXPORT = \ sodium/crypto_kdf_hkdf_sha256.h \ sodium/crypto_kdf_hkdf_sha512.h \ sodium/crypto_kdf_blake2b.h \ + sodium/crypto_kem_mlkem768.h \ sodium/crypto_kx.h \ sodium/crypto_onetimeauth.h \ sodium/crypto_onetimeauth_poly1305.h \ diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h index 43015093..f1f48f39 100644 --- a/src/libsodium/include/sodium.h +++ b/src/libsodium/include/sodium.h @@ -34,6 +34,7 @@ #include "sodium/crypto_kdf_hkdf_sha256.h" #include "sodium/crypto_kdf_hkdf_sha512.h" #include "sodium/crypto_kem_mlkem768.h" +#include "sodium/crypto_kem_xwing.h" #include "sodium/crypto_kx.h" #include "sodium/crypto_onetimeauth.h" #include "sodium/crypto_onetimeauth_poly1305.h" diff --git a/src/libsodium/include/sodium/crypto_kem_xwing.h b/src/libsodium/include/sodium/crypto_kem_xwing.h new file mode 100644 index 00000000..d1be2d08 --- /dev/null +++ b/src/libsodium/include/sodium/crypto_kem_xwing.h @@ -0,0 +1,69 @@ +#ifndef crypto_kem_xwing_H +#define crypto_kem_xwing_H + +#include + +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +#define crypto_kem_xwing_PUBLICKEYBYTES 1216U +SODIUM_EXPORT +size_t crypto_kem_xwing_publickeybytes(void); + +#define crypto_kem_xwing_SECRETKEYBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_secretkeybytes(void); + +#define crypto_kem_xwing_CIPHERTEXTBYTES 1120U +SODIUM_EXPORT +size_t crypto_kem_xwing_ciphertextbytes(void); + +#define crypto_kem_xwing_SHAREDSECRETBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_sharedsecretbytes(void); + +#define crypto_kem_xwing_SEEDBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_seedbytes(void); + +SODIUM_EXPORT +int crypto_kem_xwing_seed_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES], + const unsigned char seed[crypto_kem_xwing_SEEDBYTES]) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_enc(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_enc_deterministic(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + const unsigned char seed[64]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_dec(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + const unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/test/default/Makefile.am b/test/default/Makefile.am index b1d0ff79..8820548f 100644 --- a/test/default/Makefile.am +++ b/test/default/Makefile.am @@ -265,6 +265,7 @@ TESTS_TARGETS = \ ipcrypt \ kdf \ kem_mlkem768 \ + kem_xwing \ keygen \ kx \ metamorphic \ @@ -472,7 +473,6 @@ kem_mlkem768_LDADD = $(TESTS_LDADD) kem_xwing_SOURCE = cmptest.h kem_xwing.c kem_xwing_LDADD = $(TESTS_LDADD) - keygen_SOURCE = cmptest.h keygen.c keygen_LDADD = $(TESTS_LDADD) diff --git a/test/default/Makefile.in b/test/default/Makefile.in index c657354e..ec6e0d39 100644 --- a/test/default/Makefile.in +++ b/test/default/Makefile.in @@ -159,15 +159,16 @@ am__EXEEXT_3 = aead_aegis128l$(EXEEXT) aead_aegis256$(EXEEXT) \ generichash$(EXEEXT) generichash2$(EXEEXT) \ generichash3$(EXEEXT) hash$(EXEEXT) hash3$(EXEEXT) \ hash_sha3256$(EXEEXT) hash_sha3512$(EXEEXT) ipcrypt$(EXEEXT) \ - kdf$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) metamorphic$(EXEEXT) \ - misuse$(EXEEXT) onetimeauth$(EXEEXT) onetimeauth2$(EXEEXT) \ - onetimeauth7$(EXEEXT) pwhash_argon2i$(EXEEXT) \ - pwhash_argon2id$(EXEEXT) pwhash_argon2id2$(EXEEXT) \ - randombytes$(EXEEXT) scalarmult$(EXEEXT) scalarmult2$(EXEEXT) \ - scalarmult5$(EXEEXT) scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) \ - scalarmult8$(EXEEXT) secretbox$(EXEEXT) secretbox2$(EXEEXT) \ - secretbox7$(EXEEXT) secretbox8$(EXEEXT) \ - secretbox_easy$(EXEEXT) secretbox_easy2$(EXEEXT) \ + kdf$(EXEEXT) kem_mlkem768$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) \ + metamorphic$(EXEEXT) misuse$(EXEEXT) onetimeauth$(EXEEXT) \ + onetimeauth2$(EXEEXT) onetimeauth7$(EXEEXT) \ + pwhash_argon2i$(EXEEXT) pwhash_argon2id$(EXEEXT) \ + pwhash_argon2id2$(EXEEXT) randombytes$(EXEEXT) \ + scalarmult$(EXEEXT) scalarmult2$(EXEEXT) scalarmult5$(EXEEXT) \ + scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) scalarmult8$(EXEEXT) \ + secretbox$(EXEEXT) secretbox2$(EXEEXT) secretbox7$(EXEEXT) \ + secretbox8$(EXEEXT) secretbox_easy$(EXEEXT) \ + secretbox_easy2$(EXEEXT) \ secretstream_xchacha20poly1305$(EXEEXT) shorthash$(EXEEXT) \ sign$(EXEEXT) sodium_core$(EXEEXT) sodium_utils$(EXEEXT) \ sodium_version$(EXEEXT) stream$(EXEEXT) stream2$(EXEEXT) \ @@ -323,6 +324,9 @@ kdf_hkdf3_DEPENDENCIES = $(TESTS_LDADD) kdf_hkdf4_SOURCES = kdf_hkdf4.c kdf_hkdf4_OBJECTS = kdf_hkdf4.$(OBJEXT) kdf_hkdf4_DEPENDENCIES = $(TESTS_LDADD) +kem_mlkem768_SOURCES = kem_mlkem768.c +kem_mlkem768_OBJECTS = kem_mlkem768.$(OBJEXT) +kem_mlkem768_DEPENDENCIES = $(TESTS_LDADD) keygen_SOURCES = keygen.c keygen_OBJECTS = keygen.$(OBJEXT) keygen_DEPENDENCIES = $(TESTS_LDADD) @@ -514,16 +518,17 @@ am__depfiles_remade = ./$(DEPDIR)/aead_aegis128l.Po \ ./$(DEPDIR)/ipcrypt.Po ./$(DEPDIR)/kdf.Po \ ./$(DEPDIR)/kdf_hkdf.Po ./$(DEPDIR)/kdf_hkdf2.Po \ ./$(DEPDIR)/kdf_hkdf3.Po ./$(DEPDIR)/kdf_hkdf4.Po \ - ./$(DEPDIR)/keygen.Po ./$(DEPDIR)/kx.Po \ - ./$(DEPDIR)/metamorphic.Po ./$(DEPDIR)/misuse.Po \ - ./$(DEPDIR)/onetimeauth.Po ./$(DEPDIR)/onetimeauth2.Po \ - ./$(DEPDIR)/onetimeauth7.Po ./$(DEPDIR)/pwhash_argon2i.Po \ - ./$(DEPDIR)/pwhash_argon2id.Po ./$(DEPDIR)/pwhash_argon2id2.Po \ - ./$(DEPDIR)/pwhash_scrypt.Po ./$(DEPDIR)/pwhash_scrypt_ll.Po \ - ./$(DEPDIR)/randombytes.Po ./$(DEPDIR)/scalarmult.Po \ - ./$(DEPDIR)/scalarmult2.Po ./$(DEPDIR)/scalarmult5.Po \ - ./$(DEPDIR)/scalarmult6.Po ./$(DEPDIR)/scalarmult7.Po \ - ./$(DEPDIR)/scalarmult8.Po ./$(DEPDIR)/scalarmult_ed25519.Po \ + ./$(DEPDIR)/kem_mlkem768.Po ./$(DEPDIR)/keygen.Po \ + ./$(DEPDIR)/kx.Po ./$(DEPDIR)/metamorphic.Po \ + ./$(DEPDIR)/misuse.Po ./$(DEPDIR)/onetimeauth.Po \ + ./$(DEPDIR)/onetimeauth2.Po ./$(DEPDIR)/onetimeauth7.Po \ + ./$(DEPDIR)/pwhash_argon2i.Po ./$(DEPDIR)/pwhash_argon2id.Po \ + ./$(DEPDIR)/pwhash_argon2id2.Po ./$(DEPDIR)/pwhash_scrypt.Po \ + ./$(DEPDIR)/pwhash_scrypt_ll.Po ./$(DEPDIR)/randombytes.Po \ + ./$(DEPDIR)/scalarmult.Po ./$(DEPDIR)/scalarmult2.Po \ + ./$(DEPDIR)/scalarmult5.Po ./$(DEPDIR)/scalarmult6.Po \ + ./$(DEPDIR)/scalarmult7.Po ./$(DEPDIR)/scalarmult8.Po \ + ./$(DEPDIR)/scalarmult_ed25519.Po \ ./$(DEPDIR)/scalarmult_ristretto255.Po \ ./$(DEPDIR)/secretbox.Po ./$(DEPDIR)/secretbox2.Po \ ./$(DEPDIR)/secretbox7.Po ./$(DEPDIR)/secretbox8.Po \ @@ -570,20 +575,20 @@ SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \ core_ristretto255.c ed25519_convert.c generichash.c \ generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \ hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \ - kdf_hkdf3.c kdf_hkdf4.c keygen.c kx.c metamorphic.c misuse.c \ - onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \ - pwhash_argon2id.c pwhash_argon2id2.c pwhash_scrypt.c \ - pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \ - scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \ - scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \ - secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \ - secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \ - sign.c siphashx24.c sodium_core.c sodium_utils.c \ - sodium_utils2.c sodium_utils3.c sodium_utils4.c \ - sodium_version.c stream.c stream2.c stream3.c stream4.c \ - stream5.c stream6.c verify1.c xchacha20.c xof2.c \ - xof_shake128.c xof_shake256.c xof_turboshake128.c \ - xof_turboshake256.c + kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \ + metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \ + onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \ + pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \ + randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \ + scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \ + scalarmult_ristretto255.c secretbox.c secretbox2.c \ + secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \ + secretstream_xchacha20poly1305.c shorthash.c sign.c \ + siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \ + sodium_utils3.c sodium_utils4.c sodium_version.c stream.c \ + stream2.c stream3.c stream4.c stream5.c stream6.c verify1.c \ + xchacha20.c xof2.c xof_shake128.c xof_shake256.c \ + xof_turboshake128.c xof_turboshake256.c DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \ aead_aes256gcm2.c aead_chacha20poly1305.c \ aead_chacha20poly13052.c aead_xchacha20poly1305.c auth.c \ @@ -594,20 +599,20 @@ DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \ core_ristretto255.c ed25519_convert.c generichash.c \ generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \ hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \ - kdf_hkdf3.c kdf_hkdf4.c keygen.c kx.c metamorphic.c misuse.c \ - onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \ - pwhash_argon2id.c pwhash_argon2id2.c pwhash_scrypt.c \ - pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \ - scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \ - scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \ - secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \ - secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \ - sign.c siphashx24.c sodium_core.c sodium_utils.c \ - sodium_utils2.c sodium_utils3.c sodium_utils4.c \ - sodium_version.c stream.c stream2.c stream3.c stream4.c \ - stream5.c stream6.c verify1.c xchacha20.c xof2.c \ - xof_shake128.c xof_shake256.c xof_turboshake128.c \ - xof_turboshake256.c + kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \ + metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \ + onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \ + pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \ + randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \ + scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \ + scalarmult_ristretto255.c secretbox.c secretbox2.c \ + secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \ + secretstream_xchacha20poly1305.c shorthash.c sign.c \ + siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \ + sodium_utils3.c sodium_utils4.c sodium_version.c stream.c \ + stream2.c stream3.c stream4.c stream5.c stream6.c verify1.c \ + xchacha20.c xof2.c xof_shake128.c xof_shake256.c \ + xof_turboshake128.c xof_turboshake256.c am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ @@ -1243,14 +1248,14 @@ TESTS_TARGETS = aead_aegis128l aead_aegis256 aead_aes256gcm \ codecs codecs2 codecs3 core_keccak1600 core1 core2 core3 core4 \ core5 core6 ed25519_convert generichash generichash2 \ generichash3 hash hash3 hash_sha3256 hash_sha3512 ipcrypt kdf \ - keygen kx metamorphic misuse onetimeauth onetimeauth2 \ - onetimeauth7 pwhash_argon2i pwhash_argon2id pwhash_argon2id2 \ - randombytes scalarmult scalarmult2 scalarmult5 scalarmult6 \ - scalarmult7 scalarmult8 secretbox secretbox2 secretbox7 \ - secretbox8 secretbox_easy secretbox_easy2 \ - secretstream_xchacha20poly1305 shorthash sign sodium_core \ - sodium_utils sodium_version stream stream2 stream3 stream4 \ - verify1 xof_shake128 xof_shake256 xof_turboshake128 \ + kem_mlkem768 keygen kx metamorphic misuse onetimeauth \ + onetimeauth2 onetimeauth7 pwhash_argon2i pwhash_argon2id \ + pwhash_argon2id2 randombytes scalarmult scalarmult2 \ + scalarmult5 scalarmult6 scalarmult7 scalarmult8 secretbox \ + secretbox2 secretbox7 secretbox8 secretbox_easy \ + secretbox_easy2 secretstream_xchacha20poly1305 shorthash sign \ + sodium_core sodium_utils sodium_version stream stream2 stream3 \ + stream4 verify1 xof_shake128 xof_shake256 xof_turboshake128 \ xof_turboshake256 xof2 $(am__append_1) $(am__append_2) TESTS_LDADD = \ ${top_builddir}/src/libsodium/libsodium.la @@ -1688,6 +1693,10 @@ kdf_hkdf4$(EXEEXT): $(kdf_hkdf4_OBJECTS) $(kdf_hkdf4_DEPENDENCIES) $(EXTRA_kdf_h @rm -f kdf_hkdf4$(EXEEXT) $(AM_V_CCLD)$(LINK) $(kdf_hkdf4_OBJECTS) $(kdf_hkdf4_LDADD) $(LIBS) +kem_mlkem768$(EXEEXT): $(kem_mlkem768_OBJECTS) $(kem_mlkem768_DEPENDENCIES) $(EXTRA_kem_mlkem768_DEPENDENCIES) + @rm -f kem_mlkem768$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(kem_mlkem768_OBJECTS) $(kem_mlkem768_LDADD) $(LIBS) + keygen$(EXEEXT): $(keygen_OBJECTS) $(keygen_DEPENDENCIES) $(EXTRA_keygen_DEPENDENCIES) @rm -f keygen$(EXEEXT) $(AM_V_CCLD)$(LINK) $(keygen_OBJECTS) $(keygen_LDADD) $(LIBS) @@ -1942,6 +1951,7 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf2.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf3.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf4.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kem_mlkem768.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/keygen.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kx.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/metamorphic.Po@am__quote@ # am--include-marker @@ -2541,6 +2551,13 @@ kdf.log: kdf$(EXEEXT) --log-file $$b.log --trs-file $$b.trs \ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ "$$tst" $(AM_TESTS_FD_REDIRECT) +kem_mlkem768.log: kem_mlkem768$(EXEEXT) + @p='kem_mlkem768$(EXEEXT)'; \ + b='kem_mlkem768'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) keygen.log: keygen$(EXEEXT) @p='keygen$(EXEEXT)'; \ b='keygen'; \ @@ -3075,6 +3092,7 @@ distclean: distclean-am -rm -f ./$(DEPDIR)/kdf_hkdf2.Po -rm -f ./$(DEPDIR)/kdf_hkdf3.Po -rm -f ./$(DEPDIR)/kdf_hkdf4.Po + -rm -f ./$(DEPDIR)/kem_mlkem768.Po -rm -f ./$(DEPDIR)/keygen.Po -rm -f ./$(DEPDIR)/kx.Po -rm -f ./$(DEPDIR)/metamorphic.Po @@ -3218,6 +3236,7 @@ maintainer-clean: maintainer-clean-am -rm -f ./$(DEPDIR)/kdf_hkdf2.Po -rm -f ./$(DEPDIR)/kdf_hkdf3.Po -rm -f ./$(DEPDIR)/kdf_hkdf4.Po + -rm -f ./$(DEPDIR)/kem_mlkem768.Po -rm -f ./$(DEPDIR)/keygen.Po -rm -f ./$(DEPDIR)/kx.Po -rm -f ./$(DEPDIR)/metamorphic.Po diff --git a/test/default/kem_xwing.c b/test/default/kem_xwing.c new file mode 100644 index 00000000..c008c97e --- /dev/null +++ b/test/default/kem_xwing.c @@ -0,0 +1,217 @@ +#define TEST_NAME "kem_xwing" +#include "cmptest.h" + +static const char tv0_seed[] = + "0000000000000000000000000000000000000000000000000000000000000000"; +static const char tv0_randomness[] = + "6464646464646464646464646464646464646464646464646464646464646464" + "6464646464646464646464646464646464646464646464646464646464646464"; +static const char tv0_ek_prefix[] = + "3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978"; +static const char tv0_ct_prefix[] = + "d81018a94f8078e02105beaa814e003390befa4589bb614f7739"; +static const char tv0_ss[] = + "e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a"; + +static const char tv1_seed[] = + "0101010101010101010101010101010101010101010101010101010101010101"; +static const char tv1_randomness[] = + "6565656565656565656565656565656565656565656565656565656565656565" + "6565656565656565656565656565656565656565656565656565656565656565"; +static const char tv1_ek_prefix[] = + "ec7b50cddc8360f98b189bac73d395ef947b37d8453886a253269f7b18b9eb78"; +static const char tv1_ct_prefix[] = + "600ecf4026683898d0e339eeea9ebd437a4a802952bf32bfa326"; +static const char tv1_ss[] = + "750300db25bff9620e893c2c6fcab9bf04d7f2e543b5b39420485626fa274908"; + +static const char tv2_seed[] = + "0202020202020202020202020202020202020202020202020202020202020202"; +static const char tv2_randomness[] = + "6666666666666666666666666666666666666666666666666666666666666666" + "6666666666666666666666666666666666666666666666666666666666666666"; +static const char tv2_ek_prefix[] = + "08118d8819772292c976ec971ee3039195800c823544484595cc63450b9db941"; +static const char tv2_ct_prefix[] = + "413c55d5710bae6376761dada807daffd4dc45f9f70d825e0d46"; +static const char tv2_ss[] = + "87292f18b2e7af74bb8839ddee15e832d2f4bfac14dc84f824906d951436aafa"; + +static int +test_kat_vector(const char *seed_hex, const char *randomness_hex, + const char *ek_prefix_hex, const char *ct_prefix_hex, + const char *ss_hex) +{ + unsigned char seed[crypto_kem_xwing_SEEDBYTES]; + unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES]; + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]; + unsigned char randomness[64]; + unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES]; + unsigned char ss_enc[crypto_kem_xwing_SHAREDSECRETBYTES]; + unsigned char ss_dec[crypto_kem_xwing_SHAREDSECRETBYTES]; + unsigned char expected_ek_prefix[32]; + unsigned char expected_ct_prefix[26]; + unsigned char expected_ss[32]; + char hex[65]; + + sodium_hex2bin(seed, sizeof seed, seed_hex, strlen(seed_hex), NULL, NULL, NULL); + sodium_hex2bin(randomness, sizeof randomness, randomness_hex, strlen(randomness_hex), + NULL, NULL, NULL); + sodium_hex2bin(expected_ek_prefix, sizeof expected_ek_prefix, ek_prefix_hex, + strlen(ek_prefix_hex), NULL, NULL, NULL); + sodium_hex2bin(expected_ct_prefix, sizeof expected_ct_prefix, ct_prefix_hex, + strlen(ct_prefix_hex), NULL, NULL, NULL); + sodium_hex2bin(expected_ss, sizeof expected_ss, ss_hex, strlen(ss_hex), NULL, NULL, NULL); + + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + if (memcmp(pk, expected_ek_prefix, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, pk, 32); + printf("pk mismatch: got %s\n", hex); + return -1; + } + + assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0); + + if (memcmp(ct, expected_ct_prefix, 26) != 0) { + sodium_bin2hex(hex, sizeof hex, ct, 26); + printf("ct mismatch: got %s\n", hex); + return -1; + } + + if (memcmp(ss_enc, expected_ss, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, ss_enc, 32); + printf("ss_enc mismatch: got %s\n", hex); + return -1; + } + + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + + if (memcmp(ss_dec, expected_ss, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, ss_dec, 32); + printf("ss_dec mismatch: got %s\n", hex); + return -1; + } + + return 0; +} + +static void +tv_kem_xwing(void) +{ + unsigned char *pk; + unsigned char *sk; + unsigned char *seed; + unsigned char *ct; + unsigned char *ss_enc; + unsigned char *ss_dec; + unsigned char *randomness; + char hex[65]; + int i; + + pk = (unsigned char *) sodium_malloc(crypto_kem_xwing_PUBLICKEYBYTES); + sk = (unsigned char *) sodium_malloc(crypto_kem_xwing_SECRETKEYBYTES); + seed = (unsigned char *) sodium_malloc(crypto_kem_xwing_SEEDBYTES); + ct = (unsigned char *) sodium_malloc(crypto_kem_xwing_CIPHERTEXTBYTES); + ss_enc = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES); + ss_dec = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES); + randomness = (unsigned char *) sodium_malloc(64); + + for (i = 0; i < (int) crypto_kem_xwing_SEEDBYTES; i++) { + seed[i] = (unsigned char) i; + } + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + sodium_bin2hex(hex, sizeof hex, pk, 32); + printf("pk (first 32 bytes): [%s]\n", hex); + sodium_bin2hex(hex, sizeof hex, sk, 32); + printf("sk: [%s]\n", hex); + + for (i = 0; i < 64; i++) { + randomness[i] = (unsigned char)(i + 64); + } + assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0); + + sodium_bin2hex(hex, sizeof hex, ct, 32); + printf("ct (first 32 bytes): [%s]\n", hex); + sodium_bin2hex(hex, sizeof hex, ss_enc, crypto_kem_xwing_SHAREDSECRETBYTES); + printf("ss_enc: [%s]\n", hex); + + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + + sodium_bin2hex(hex, sizeof hex, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES); + printf("ss_dec: [%s]\n", hex); + + if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match!\n"); + } else { + printf("shared secrets match: ok\n"); + } + + crypto_kem_xwing_keypair(pk, sk); + assert(crypto_kem_xwing_enc(ct, ss_enc, pk) == 0); + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match (random keys)!\n"); + } else { + printf("random keypair test: ok\n"); + } + + assert(crypto_kem_xwing_publickeybytes() == crypto_kem_xwing_PUBLICKEYBYTES); + assert(crypto_kem_xwing_secretkeybytes() == crypto_kem_xwing_SECRETKEYBYTES); + assert(crypto_kem_xwing_ciphertextbytes() == crypto_kem_xwing_CIPHERTEXTBYTES); + assert(crypto_kem_xwing_sharedsecretbytes() == crypto_kem_xwing_SHAREDSECRETBYTES); + assert(crypto_kem_xwing_seedbytes() == crypto_kem_xwing_SEEDBYTES); + + assert(crypto_kem_xwing_PUBLICKEYBYTES == 1216U); + assert(crypto_kem_xwing_SECRETKEYBYTES == 32U); + assert(crypto_kem_xwing_CIPHERTEXTBYTES == 1120U); + assert(crypto_kem_xwing_SHAREDSECRETBYTES == 32U); + assert(crypto_kem_xwing_SEEDBYTES == 32U); + + printf("constants: ok\n"); + + sodium_free(randomness); + sodium_free(ss_dec); + sodium_free(ss_enc); + sodium_free(ct); + sodium_free(seed); + sodium_free(sk); + sodium_free(pk); + + printf("tv_kem_xwing: ok\n"); +} + +static void +tv_kem_xwing_kat(void) +{ + printf("IETF KAT vector 0: "); + if (test_kat_vector(tv0_seed, tv0_randomness, tv0_ek_prefix, tv0_ct_prefix, tv0_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } + + printf("IETF KAT vector 1: "); + if (test_kat_vector(tv1_seed, tv1_randomness, tv1_ek_prefix, tv1_ct_prefix, tv1_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } + + printf("IETF KAT vector 2: "); + if (test_kat_vector(tv2_seed, tv2_randomness, tv2_ek_prefix, tv2_ct_prefix, tv2_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } +} + +int +main(void) +{ + tv_kem_xwing(); + tv_kem_xwing_kat(); + + return 0; +} diff --git a/test/default/kem_xwing.exp b/test/default/kem_xwing.exp new file mode 100644 index 00000000..0f74c945 --- /dev/null +++ b/test/default/kem_xwing.exp @@ -0,0 +1,12 @@ +pk (first 32 bytes): [6f54098a0a0e641146614b6960ba60d8603d62f447f9ab499b47bd6906cc40b0] +sk: [000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f] +ct (first 32 bytes): [332c248ecac774a5b9e28b7018565b7e07b57733b8e68a432084b39b9221e497] +ss_enc: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c] +ss_dec: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c] +shared secrets match: ok +random keypair test: ok +constants: ok +tv_kem_xwing: ok +IETF KAT vector 0: ok +IETF KAT vector 1: ok +IETF KAT vector 2: ok