Add crypto_core_ed25519_scalar_random()

src/libsodium/crypto_core/ed25519/core_ed25519.c

@@ -2,6 +2,7 @@
 #include "crypto_core_ed25519.h"
 #include "private/common.h"
 #include "private/ed25519_ref10.h"
+#include "randombytes.h"
 #include "utils.h"
 
 int
@@ -67,6 +68,15 @@ crypto_core_ed25519_from_uniform(unsigned char *p, const unsigned char *r)
     return - ge25519_has_small_order(p);
 }
 
+int
+crypto_core_ed25519_scalar_random(unsigned char *r)
+{
+    do {
+        randombytes_buf(r, crypto_core_ed25519_SCALARBYTES);
+        r[crypto_core_ed25519_SCALARBYTES - 1] &= 0x1f;
+    } while (sc25519_is_canonical(r) == 0);
+}
+
 int
 crypto_core_ed25519_scalar_invert(unsigned char *recip, const unsigned char *s)
 {
@@ -75,7 +85,6 @@ crypto_core_ed25519_scalar_invert(unsigned char *recip, const unsigned char *s)
     return - sodium_is_zero(s, crypto_core_ed25519_SCALARBYTES);
 }
 
-
 void
 crypto_core_ed25519_scalar_reduce(unsigned char *r, const unsigned char *s)
 {

src/libsodium/include/sodium/crypto_core_ed25519.h

@@ -38,6 +38,10 @@ SODIUM_EXPORT
 int crypto_core_ed25519_from_uniform(unsigned char *p, const unsigned char *r)
             __attribute__ ((nonnull));
 
+SODIUM_EXPORT
+int crypto_core_ed25519_scalar_random(unsigned char *r)
+            __attribute__ ((nonnull));
+
 SODIUM_EXPORT
 int crypto_core_ed25519_scalar_invert(unsigned char *recip, const unsigned char *s)
             __attribute__ ((nonnull));

test/default/core_ed25519.c

@@ -39,7 +39,7 @@ main(void)
 {
     unsigned char *h;
     unsigned char *p, *p2, *p3;
-    unsigned char *sc, *sc2;
+    unsigned char *sc;
     int            i, j;
 
     h = (unsigned char *) sodium_malloc(crypto_core_ed25519_UNIFORMBYTES);
@@ -138,8 +138,7 @@ main(void)
     for (i = 0; i < 1000; i++) {
         randombytes_buf(h, crypto_core_ed25519_UNIFORMBYTES);
         crypto_core_ed25519_from_uniform(p, h);
-        randombytes_buf(sc, crypto_core_ed25519_SCALARBYTES);
-        crypto_core_ed25519_scalar_reduce(sc, sc);
+        crypto_core_ed25519_scalar_random(sc);
         if (crypto_scalarmult_ed25519_noclamp(p2, sc, p) != 0) {
             printf("crypto_scalarmult_ed25519_noclamp() failed\n");
         }