QPQ-AG/libsodium
12
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-08-25 08:37:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

Use SHA-256 for the hash-to-ristretto255 operation

Browse Source 
We may eventually revert to SHA-512
This commit is contained in:
Frank Denis
2021-01-23 19:00:05 +01:00
parent 89916bbe11
commit 41e6cb3368
2 changed files with 38 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsodium/crypto_core/ed25519/core_ed25519.c
+1 -1
View File
@@ -82,7 +82,7 @@ _string_to_points(unsigned char * const px, size_t n,
const char *ctx, const unsigned char *msg, size_t msg_len)
{
crypto_hash_sha512_state st;
const unsigned char empty_block[128] = { 0 };
const unsigned char empty_block[HASH_BLOCKBYTES] = { 0 };
unsigned char u0[HASH_BYTES], u[2 * HASH_BYTES];
unsigned char t[3] = { 0U, n * HASH_L, 0U};
unsigned char ctx_len_u8;
src/libsodium/crypto_core/ed25519/core_ristretto255.c
+37 -23
View File
@@ -3,7 +3,7 @@
#include "crypto_core_ed25519.h"
#include "crypto_core_ristretto255.h"
#include "crypto_hash_sha512.h"
#include "crypto_hash_sha256.h"
#include "private/common.h"
#include "private/ed25519_ref10.h"
#include "randombytes.h"
@@ -68,52 +68,66 @@ crypto_core_ristretto255_from_hash(unsigned char *p, const unsigned char *r)
return 0;
}
#define HASH_BYTES crypto_hash_sha512_BYTES
#define HASH_BLOCKBYTES 128U
#define HASH_BYTES crypto_hash_sha256_BYTES
#define HASH_BLOCKBYTES 64U
#define HASH_L crypto_core_ristretto255_HASHBYTES
static int
_string_to_element(unsigned char *p,
const char *ctx, const unsigned char *msg, size_t msg_len)
{
crypto_hash_sha512_state st;
const unsigned char empty_block[128] = { 0 };
crypto_hash_sha256_state st;
const unsigned char empty_block[HASH_BLOCKBYTES] = { 0 };
unsigned char u0[HASH_BYTES];
unsigned char u[2 * HASH_BYTES];
unsigned char t[3] = { 0U, HASH_L, 0U};
unsigned char ctx_len_u8;
size_t ctx_len = ctx != NULL ? strlen(ctx) : 0U;
size_t i;
COMPILER_ASSERT(HASH_L == sizeof u);
COMPILER_ASSERT(HASH_L <= 0xff);
if (ctx_len > (size_t) 0xff) {
crypto_hash_sha512_init(&st);
crypto_hash_sha512_update(&st,
crypto_hash_sha256_init(&st);
crypto_hash_sha256_update(&st,
(const unsigned char *) "H2C-OVERSIZE-DST-",
sizeof "H2C-OVERSIZE-DST-" - 1U);
crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha512_final(&st, u0);
crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha256_final(&st, u0);
ctx = (const char *) u0;
ctx_len = HASH_BYTES;
COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff);
}
ctx_len_u8 = (unsigned char) ctx_len;
crypto_hash_sha512_init(&st);
crypto_hash_sha512_update(&st, empty_block, sizeof empty_block);
crypto_hash_sha512_update(&st, msg, msg_len);
crypto_hash_sha512_update(&st, t, 3U);
crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
crypto_hash_sha512_final(&st, u0);
crypto_hash_sha256_init(&st);
crypto_hash_sha256_update(&st, empty_block, sizeof empty_block);
crypto_hash_sha256_update(&st, msg, msg_len);
crypto_hash_sha256_update(&st, t, 3U);
crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
crypto_hash_sha256_final(&st, u0);
t[2]++;
crypto_hash_sha512_init(&st);
crypto_hash_sha512_update(&st, u0, HASH_BYTES);
crypto_hash_sha512_update(&st, &t[2], 1U);
crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
crypto_hash_sha512_final(&st, u0);
crypto_hash_sha256_init(&st);
crypto_hash_sha256_update(&st, u0, HASH_BYTES);
crypto_hash_sha256_update(&st, &t[2], 1U);
crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
crypto_hash_sha256_final(&st, u);
t[2]++;
crypto_hash_sha256_init(&st);
for (i = 0; i < HASH_BYTES; i++) {
u[32 + i] = u[i] ^ u0[i];
}
crypto_hash_sha256_update(&st, &u[32], HASH_BYTES);
crypto_hash_sha256_update(&st, &t[2], 1U);
crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
crypto_hash_sha256_final(&st, &u[32]);
COMPILER_ASSERT(crypto_core_ristretto255_HASHBYTES == HASH_L);
ristretto255_from_hash(p, u0);
ristretto255_from_hash(p, u);
return 0;
}