diff --git a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/after_curve25519xsalsa20poly1305.c b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/after_curve25519xsalsa20poly1305.c index c35ca2e5..a64833d0 100644 --- a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/after_curve25519xsalsa20poly1305.c +++ b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/after_curve25519xsalsa20poly1305.c @@ -1,22 +1,22 @@ #include "crypto_box_curve25519xsalsa20poly1305.h" #include "crypto_secretbox_xsalsa20poly1305.h" -int crypto_box_curve25519xsalsa20poly1305_afternm( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_box_curve25519xsalsa20poly1305_afternm(unsigned char *c, + const unsigned char *m, + unsigned long long mlen, + const unsigned char *n, + const unsigned char *k) { - return crypto_secretbox_xsalsa20poly1305(c,m,mlen,n,k); + return crypto_secretbox_xsalsa20poly1305(c, m, mlen, n, k); } -int crypto_box_curve25519xsalsa20poly1305_open_afternm( - unsigned char *m, - const unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_box_curve25519xsalsa20poly1305_open_afternm(unsigned char *m, + const unsigned char *c, + unsigned long long clen, + const unsigned char *n, + const unsigned char *k) { - return crypto_secretbox_xsalsa20poly1305_open(m,c,clen,n,k); + return crypto_secretbox_xsalsa20poly1305_open(m, c, clen, n, k); } diff --git a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/before_curve25519xsalsa20poly1305.c b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/before_curve25519xsalsa20poly1305.c index 3835538f..67bd7742 100644 --- a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/before_curve25519xsalsa20poly1305.c +++ b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/before_curve25519xsalsa20poly1305.c @@ -2,17 +2,17 @@ #include "crypto_core_hsalsa20.h" #include "crypto_scalarmult_curve25519.h" -static const unsigned char n[16] = {0}; +static const unsigned char n[16] = { 0 }; -int crypto_box_curve25519xsalsa20poly1305_beforenm( - unsigned char *k, - const unsigned char *pk, - const unsigned char *sk -) +int +crypto_box_curve25519xsalsa20poly1305_beforenm(unsigned char *k, + const unsigned char *pk, + const unsigned char *sk) { - unsigned char s[32]; - if (crypto_scalarmult_curve25519(s,sk,pk) != 0) { - return -1; - } - return crypto_core_hsalsa20(k,n,s,NULL); + unsigned char s[32]; + + if (crypto_scalarmult_curve25519(s, sk, pk) != 0) { + return -1; + } + return crypto_core_hsalsa20(k, n, s, NULL); } diff --git a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/box_curve25519xsalsa20poly1305.c b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/box_curve25519xsalsa20poly1305.c index fdaa5e01..a3936a79 100644 --- a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/box_curve25519xsalsa20poly1305.c +++ b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/box_curve25519xsalsa20poly1305.c @@ -1,42 +1,38 @@ #include "crypto_box_curve25519xsalsa20poly1305.h" #include "utils.h" -int crypto_box_curve25519xsalsa20poly1305( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *pk, - const unsigned char *sk -) +int +crypto_box_curve25519xsalsa20poly1305(unsigned char *c, const unsigned char *m, + unsigned long long mlen, + const unsigned char *n, + const unsigned char *pk, + const unsigned char *sk) { - unsigned char k[crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES]; - int ret; + int ret; + unsigned char k[crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES]; - if (crypto_box_curve25519xsalsa20poly1305_beforenm(k,pk,sk) != 0) { - return -1; - } - ret = crypto_box_curve25519xsalsa20poly1305_afternm(c,m,mlen,n,k); - sodium_memzero(k, sizeof k); + if (crypto_box_curve25519xsalsa20poly1305_beforenm(k, pk, sk) != 0) { + return -1; + } + ret = crypto_box_curve25519xsalsa20poly1305_afternm(c, m, mlen, n, k); + sodium_memzero(k, sizeof k); - return ret; + return ret; } -int crypto_box_curve25519xsalsa20poly1305_open( - unsigned char *m, - const unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *pk, - const unsigned char *sk -) +int +crypto_box_curve25519xsalsa20poly1305_open( + unsigned char *m, const unsigned char *c, unsigned long long clen, + const unsigned char *n, const unsigned char *pk, const unsigned char *sk) { - unsigned char k[crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES]; - int ret; + int ret; + unsigned char k[crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES]; - if (crypto_box_curve25519xsalsa20poly1305_beforenm(k,pk,sk) != 0) { - return -1; - } - ret = crypto_box_curve25519xsalsa20poly1305_open_afternm(m,c,clen,n,k); - sodium_memzero(k, sizeof k); + if (crypto_box_curve25519xsalsa20poly1305_beforenm(k, pk, sk) != 0) { + return -1; + } + ret = crypto_box_curve25519xsalsa20poly1305_open_afternm(m, c, clen, n, k); + sodium_memzero(k, sizeof k); - return ret; + return ret; } diff --git a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/keypair_curve25519xsalsa20poly1305.c b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/keypair_curve25519xsalsa20poly1305.c index 60efce46..2b6aea63 100644 --- a/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/keypair_curve25519xsalsa20poly1305.c +++ b/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/keypair_curve25519xsalsa20poly1305.c @@ -6,24 +6,25 @@ #include "randombytes.h" #include "utils.h" -int crypto_box_curve25519xsalsa20poly1305_seed_keypair( - unsigned char *pk, - unsigned char *sk, - const unsigned char *seed -) +int +crypto_box_curve25519xsalsa20poly1305_seed_keypair(unsigned char *pk, + unsigned char *sk, + const unsigned char *seed) { - unsigned char hash[64]; - crypto_hash_sha512(hash,seed,32); - memmove(sk,hash,32); - sodium_memzero(hash, sizeof hash); - return crypto_scalarmult_curve25519_base(pk,sk); + unsigned char hash[64]; + + crypto_hash_sha512(hash, seed, 32); + memmove(sk, hash, 32); + sodium_memzero(hash, sizeof hash); + + return crypto_scalarmult_curve25519_base(pk, sk); } -int crypto_box_curve25519xsalsa20poly1305_keypair( - unsigned char *pk, - unsigned char *sk -) +int +crypto_box_curve25519xsalsa20poly1305_keypair(unsigned char *pk, + unsigned char *sk) { - randombytes_buf(sk,32); - return crypto_scalarmult_curve25519_base(pk,sk); + randombytes_buf(sk, 32); + + return crypto_scalarmult_curve25519_base(pk, sk); } diff --git a/src/libsodium/crypto_core/hsalsa20/ref2/core_hsalsa20.c b/src/libsodium/crypto_core/hsalsa20/ref2/core_hsalsa20.c index 2713bc8a..48f6ec2e 100644 --- a/src/libsodium/crypto_core/hsalsa20/ref2/core_hsalsa20.c +++ b/src/libsodium/crypto_core/hsalsa20/ref2/core_hsalsa20.c @@ -13,88 +13,89 @@ Public domain. #define ROUNDS 20 #define U32C(v) (v##U) -static uint32_t rotate(uint32_t u,int c) +static uint32_t +rotate(uint32_t u, int c) { - return (u << c) | (u >> (32 - c)); + return (u << c) | (u >> (32 - c)); } -int crypto_core_hsalsa20( - unsigned char *out, - const unsigned char *in, - const unsigned char *k, - const unsigned char *c -) +int +crypto_core_hsalsa20(unsigned char *out, + const unsigned char *in, + const unsigned char *k, + const unsigned char *c) { - uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; - int i; + uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, + x9, x10, x11, x12, x13, x14, x15; + int i; - if (c == NULL) { - x0 = U32C(0x61707865); - x5 = U32C(0x3320646e); - x10 = U32C(0x79622d32); - x15 = U32C(0x6b206574); - } else { - x0 = LOAD32_LE(c + 0); - x5 = LOAD32_LE(c + 4); - x10 = LOAD32_LE(c + 8); - x15 = LOAD32_LE(c + 12); - } - x1 = LOAD32_LE(k + 0); - x2 = LOAD32_LE(k + 4); - x3 = LOAD32_LE(k + 8); - x4 = LOAD32_LE(k + 12); - x11 = LOAD32_LE(k + 16); - x12 = LOAD32_LE(k + 20); - x13 = LOAD32_LE(k + 24); - x14 = LOAD32_LE(k + 28); - x6 = LOAD32_LE(in + 0); - x7 = LOAD32_LE(in + 4); - x8 = LOAD32_LE(in + 8); - x9 = LOAD32_LE(in + 12); + if (c == NULL) { + x0 = U32C(0x61707865); + x5 = U32C(0x3320646e); + x10 = U32C(0x79622d32); + x15 = U32C(0x6b206574); + } else { + x0 = LOAD32_LE(c + 0); + x5 = LOAD32_LE(c + 4); + x10 = LOAD32_LE(c + 8); + x15 = LOAD32_LE(c + 12); + } + x1 = LOAD32_LE(k + 0); + x2 = LOAD32_LE(k + 4); + x3 = LOAD32_LE(k + 8); + x4 = LOAD32_LE(k + 12); + x11 = LOAD32_LE(k + 16); + x12 = LOAD32_LE(k + 20); + x13 = LOAD32_LE(k + 24); + x14 = LOAD32_LE(k + 28); + x6 = LOAD32_LE(in + 0); + x7 = LOAD32_LE(in + 4); + x8 = LOAD32_LE(in + 8); + x9 = LOAD32_LE(in + 12); - for (i = ROUNDS;i > 0;i -= 2) { - x4 ^= rotate( x0+x12, 7); - x8 ^= rotate( x4+ x0, 9); - x12 ^= rotate( x8+ x4,13); - x0 ^= rotate(x12+ x8,18); - x9 ^= rotate( x5+ x1, 7); - x13 ^= rotate( x9+ x5, 9); - x1 ^= rotate(x13+ x9,13); - x5 ^= rotate( x1+x13,18); - x14 ^= rotate(x10+ x6, 7); - x2 ^= rotate(x14+x10, 9); - x6 ^= rotate( x2+x14,13); - x10 ^= rotate( x6+ x2,18); - x3 ^= rotate(x15+x11, 7); - x7 ^= rotate( x3+x15, 9); - x11 ^= rotate( x7+ x3,13); - x15 ^= rotate(x11+ x7,18); - x1 ^= rotate( x0+ x3, 7); - x2 ^= rotate( x1+ x0, 9); - x3 ^= rotate( x2+ x1,13); - x0 ^= rotate( x3+ x2,18); - x6 ^= rotate( x5+ x4, 7); - x7 ^= rotate( x6+ x5, 9); - x4 ^= rotate( x7+ x6,13); - x5 ^= rotate( x4+ x7,18); - x11 ^= rotate(x10+ x9, 7); - x8 ^= rotate(x11+x10, 9); - x9 ^= rotate( x8+x11,13); - x10 ^= rotate( x9+ x8,18); - x12 ^= rotate(x15+x14, 7); - x13 ^= rotate(x12+x15, 9); - x14 ^= rotate(x13+x12,13); - x15 ^= rotate(x14+x13,18); - } + for (i = ROUNDS; i > 0; i -= 2) { + x4 ^= rotate(x0 + x12, 7); + x8 ^= rotate(x4 + x0, 9); + x12 ^= rotate(x8 + x4, 13); + x0 ^= rotate(x12 + x8, 18); + x9 ^= rotate(x5 + x1, 7); + x13 ^= rotate(x9 + x5, 9); + x1 ^= rotate(x13 + x9, 13); + x5 ^= rotate(x1 + x13, 18); + x14 ^= rotate(x10 + x6, 7); + x2 ^= rotate(x14 + x10, 9); + x6 ^= rotate(x2 + x14, 13); + x10 ^= rotate(x6 + x2, 18); + x3 ^= rotate(x15 + x11, 7); + x7 ^= rotate(x3 + x15, 9); + x11 ^= rotate(x7 + x3, 13); + x15 ^= rotate(x11 + x7, 18); + x1 ^= rotate(x0 + x3, 7); + x2 ^= rotate(x1 + x0, 9); + x3 ^= rotate(x2 + x1, 13); + x0 ^= rotate(x3 + x2, 18); + x6 ^= rotate(x5 + x4, 7); + x7 ^= rotate(x6 + x5, 9); + x4 ^= rotate(x7 + x6, 13); + x5 ^= rotate(x4 + x7, 18); + x11 ^= rotate(x10 + x9, 7); + x8 ^= rotate(x11 + x10, 9); + x9 ^= rotate(x8 + x11, 13); + x10 ^= rotate(x9 + x8, 18); + x12 ^= rotate(x15 + x14, 7); + x13 ^= rotate(x12 + x15, 9); + x14 ^= rotate(x13 + x12, 13); + x15 ^= rotate(x14 + x13, 18); + } - STORE32_LE(out + 0,x0); - STORE32_LE(out + 4,x5); - STORE32_LE(out + 8,x10); - STORE32_LE(out + 12,x15); - STORE32_LE(out + 16,x6); - STORE32_LE(out + 20,x7); - STORE32_LE(out + 24,x8); - STORE32_LE(out + 28,x9); + STORE32_LE(out + 0, x0); + STORE32_LE(out + 4, x5); + STORE32_LE(out + 8, x10); + STORE32_LE(out + 12, x15); + STORE32_LE(out + 16, x6); + STORE32_LE(out + 20, x7); + STORE32_LE(out + 24, x8); + STORE32_LE(out + 28, x9); - return 0; + return 0; } diff --git a/src/libsodium/crypto_core/salsa20/ref/core_salsa20.c b/src/libsodium/crypto_core/salsa20/ref/core_salsa20.c index 26fb66fd..65a4f482 100644 --- a/src/libsodium/crypto_core/salsa20/ref/core_salsa20.c +++ b/src/libsodium/crypto_core/salsa20/ref/core_salsa20.c @@ -13,114 +13,116 @@ Public domain. #define ROUNDS 20 #define U32C(v) (v##U) -static uint32_t rotate(uint32_t u,int c) +static uint32_t +rotate(uint32_t u, int c) { - return (u << c) | (u >> (32 - c)); + return (u << c) | (u >> (32 - c)); } -int crypto_core_salsa20( - unsigned char *out, - const unsigned char *in, - const unsigned char *k, - const unsigned char *c -) +int +crypto_core_salsa20(unsigned char *out, + const unsigned char *in, + const unsigned char *k, + const unsigned char *c) { - uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; - uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15; - int i; + uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, + x9, x10, x11, x12, x13, x14, x15; + uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, + j9, j10, j11, j12, j13, j14, j15; + int i; - if (c == NULL) { - j0 = x0 = U32C(0x61707865); - j5 = x5 = U32C(0x3320646e); - j10 = x10 = U32C(0x79622d32); - j15 = x15 = U32C(0x6b206574); - } else { - j0 = x0 = LOAD32_LE(c + 0); - j5 = x5 = LOAD32_LE(c + 4); - j10 = x10 = LOAD32_LE(c + 8); - j15 = x15 = LOAD32_LE(c + 12); - } - j1 = x1 = LOAD32_LE(k + 0); - j2 = x2 = LOAD32_LE(k + 4); - j3 = x3 = LOAD32_LE(k + 8); - j4 = x4 = LOAD32_LE(k + 12); - j6 = x6 = LOAD32_LE(in + 0); - j7 = x7 = LOAD32_LE(in + 4); - j8 = x8 = LOAD32_LE(in + 8); - j9 = x9 = LOAD32_LE(in + 12); - j11 = x11 = LOAD32_LE(k + 16); - j12 = x12 = LOAD32_LE(k + 20); - j13 = x13 = LOAD32_LE(k + 24); - j14 = x14 = LOAD32_LE(k + 28); + if (c == NULL) { + j0 = x0 = U32C(0x61707865); + j5 = x5 = U32C(0x3320646e); + j10 = x10 = U32C(0x79622d32); + j15 = x15 = U32C(0x6b206574); + } else { + j0 = x0 = LOAD32_LE(c + 0); + j5 = x5 = LOAD32_LE(c + 4); + j10 = x10 = LOAD32_LE(c + 8); + j15 = x15 = LOAD32_LE(c + 12); + } + j1 = x1 = LOAD32_LE(k + 0); + j2 = x2 = LOAD32_LE(k + 4); + j3 = x3 = LOAD32_LE(k + 8); + j4 = x4 = LOAD32_LE(k + 12); + j6 = x6 = LOAD32_LE(in + 0); + j7 = x7 = LOAD32_LE(in + 4); + j8 = x8 = LOAD32_LE(in + 8); + j9 = x9 = LOAD32_LE(in + 12); + j11 = x11 = LOAD32_LE(k + 16); + j12 = x12 = LOAD32_LE(k + 20); + j13 = x13 = LOAD32_LE(k + 24); + j14 = x14 = LOAD32_LE(k + 28); - for (i = ROUNDS;i > 0;i -= 2) { - x4 ^= rotate( x0+x12, 7); - x8 ^= rotate( x4+ x0, 9); - x12 ^= rotate( x8+ x4,13); - x0 ^= rotate(x12+ x8,18); - x9 ^= rotate( x5+ x1, 7); - x13 ^= rotate( x9+ x5, 9); - x1 ^= rotate(x13+ x9,13); - x5 ^= rotate( x1+x13,18); - x14 ^= rotate(x10+ x6, 7); - x2 ^= rotate(x14+x10, 9); - x6 ^= rotate( x2+x14,13); - x10 ^= rotate( x6+ x2,18); - x3 ^= rotate(x15+x11, 7); - x7 ^= rotate( x3+x15, 9); - x11 ^= rotate( x7+ x3,13); - x15 ^= rotate(x11+ x7,18); - x1 ^= rotate( x0+ x3, 7); - x2 ^= rotate( x1+ x0, 9); - x3 ^= rotate( x2+ x1,13); - x0 ^= rotate( x3+ x2,18); - x6 ^= rotate( x5+ x4, 7); - x7 ^= rotate( x6+ x5, 9); - x4 ^= rotate( x7+ x6,13); - x5 ^= rotate( x4+ x7,18); - x11 ^= rotate(x10+ x9, 7); - x8 ^= rotate(x11+x10, 9); - x9 ^= rotate( x8+x11,13); - x10 ^= rotate( x9+ x8,18); - x12 ^= rotate(x15+x14, 7); - x13 ^= rotate(x12+x15, 9); - x14 ^= rotate(x13+x12,13); - x15 ^= rotate(x14+x13,18); - } + for (i = ROUNDS; i > 0; i -= 2) { + x4 ^= rotate(x0 + x12, 7); + x8 ^= rotate(x4 + x0, 9); + x12 ^= rotate(x8 + x4, 13); + x0 ^= rotate(x12 + x8, 18); + x9 ^= rotate(x5 + x1, 7); + x13 ^= rotate(x9 + x5, 9); + x1 ^= rotate(x13 + x9, 13); + x5 ^= rotate(x1 + x13, 18); + x14 ^= rotate(x10 + x6, 7); + x2 ^= rotate(x14 + x10, 9); + x6 ^= rotate(x2 + x14, 13); + x10 ^= rotate(x6 + x2, 18); + x3 ^= rotate(x15 + x11, 7); + x7 ^= rotate(x3 + x15, 9); + x11 ^= rotate(x7 + x3, 13); + x15 ^= rotate(x11 + x7, 18); + x1 ^= rotate(x0 + x3, 7); + x2 ^= rotate(x1 + x0, 9); + x3 ^= rotate(x2 + x1, 13); + x0 ^= rotate(x3 + x2, 18); + x6 ^= rotate(x5 + x4, 7); + x7 ^= rotate(x6 + x5, 9); + x4 ^= rotate(x7 + x6, 13); + x5 ^= rotate(x4 + x7, 18); + x11 ^= rotate(x10 + x9, 7); + x8 ^= rotate(x11 + x10, 9); + x9 ^= rotate(x8 + x11, 13); + x10 ^= rotate(x9 + x8, 18); + x12 ^= rotate(x15 + x14, 7); + x13 ^= rotate(x12 + x15, 9); + x14 ^= rotate(x13 + x12, 13); + x15 ^= rotate(x14 + x13, 18); + } - x0 += j0; - x1 += j1; - x2 += j2; - x3 += j3; - x4 += j4; - x5 += j5; - x6 += j6; - x7 += j7; - x8 += j8; - x9 += j9; - x10 += j10; - x11 += j11; - x12 += j12; - x13 += j13; - x14 += j14; - x15 += j15; + x0 += j0; + x1 += j1; + x2 += j2; + x3 += j3; + x4 += j4; + x5 += j5; + x6 += j6; + x7 += j7; + x8 += j8; + x9 += j9; + x10 += j10; + x11 += j11; + x12 += j12; + x13 += j13; + x14 += j14; + x15 += j15; - STORE32_LE(out + 0,x0); - STORE32_LE(out + 4,x1); - STORE32_LE(out + 8,x2); - STORE32_LE(out + 12,x3); - STORE32_LE(out + 16,x4); - STORE32_LE(out + 20,x5); - STORE32_LE(out + 24,x6); - STORE32_LE(out + 28,x7); - STORE32_LE(out + 32,x8); - STORE32_LE(out + 36,x9); - STORE32_LE(out + 40,x10); - STORE32_LE(out + 44,x11); - STORE32_LE(out + 48,x12); - STORE32_LE(out + 52,x13); - STORE32_LE(out + 56,x14); - STORE32_LE(out + 60,x15); + STORE32_LE(out + 0, x0); + STORE32_LE(out + 4, x1); + STORE32_LE(out + 8, x2); + STORE32_LE(out + 12, x3); + STORE32_LE(out + 16, x4); + STORE32_LE(out + 20, x5); + STORE32_LE(out + 24, x6); + STORE32_LE(out + 28, x7); + STORE32_LE(out + 32, x8); + STORE32_LE(out + 36, x9); + STORE32_LE(out + 40, x10); + STORE32_LE(out + 44, x11); + STORE32_LE(out + 48, x12); + STORE32_LE(out + 52, x13); + STORE32_LE(out + 56, x14); + STORE32_LE(out + 60, x15); - return 0; + return 0; } diff --git a/src/libsodium/crypto_core/salsa2012/ref/core_salsa2012.c b/src/libsodium/crypto_core/salsa2012/ref/core_salsa2012.c index 56581662..4c625715 100644 --- a/src/libsodium/crypto_core/salsa2012/ref/core_salsa2012.c +++ b/src/libsodium/crypto_core/salsa2012/ref/core_salsa2012.c @@ -13,114 +13,116 @@ Public domain. #define ROUNDS 12 #define U32C(v) (v##U) -static uint32_t rotate(uint32_t u,int c) +static uint32_t +rotate(uint32_t u, int c) { - return (u << c) | (u >> (32 - c)); + return (u << c) | (u >> (32 - c)); } -int crypto_core_salsa2012( - unsigned char *out, - const unsigned char *in, - const unsigned char *k, - const unsigned char *c -) +int +crypto_core_salsa2012(unsigned char *out, + const unsigned char *in, + const unsigned char *k, + const unsigned char *c) { - uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; - uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15; - int i; + uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, + x9, x10, x11, x12, x13, x14, x15; + uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, + j9, j10, j11, j12, j13, j14, j15; + int i; - if (c == NULL) { - j0 = x0 = U32C(0x61707865); - j5 = x5 = U32C(0x3320646e); - j10 = x10 = U32C(0x79622d32); - j15 = x15 = U32C(0x6b206574); - } else { - j0 = x0 = LOAD32_LE(c + 0); - j5 = x5 = LOAD32_LE(c + 4); - j10 = x10 = LOAD32_LE(c + 8); - j15 = x15 = LOAD32_LE(c + 12); - } - j1 = x1 = LOAD32_LE(k + 0); - j2 = x2 = LOAD32_LE(k + 4); - j3 = x3 = LOAD32_LE(k + 8); - j4 = x4 = LOAD32_LE(k + 12); - j6 = x6 = LOAD32_LE(in + 0); - j7 = x7 = LOAD32_LE(in + 4); - j8 = x8 = LOAD32_LE(in + 8); - j9 = x9 = LOAD32_LE(in + 12); - j11 = x11 = LOAD32_LE(k + 16); - j12 = x12 = LOAD32_LE(k + 20); - j13 = x13 = LOAD32_LE(k + 24); - j14 = x14 = LOAD32_LE(k + 28); + if (c == NULL) { + j0 = x0 = U32C(0x61707865); + j5 = x5 = U32C(0x3320646e); + j10 = x10 = U32C(0x79622d32); + j15 = x15 = U32C(0x6b206574); + } else { + j0 = x0 = LOAD32_LE(c + 0); + j5 = x5 = LOAD32_LE(c + 4); + j10 = x10 = LOAD32_LE(c + 8); + j15 = x15 = LOAD32_LE(c + 12); + } + j1 = x1 = LOAD32_LE(k + 0); + j2 = x2 = LOAD32_LE(k + 4); + j3 = x3 = LOAD32_LE(k + 8); + j4 = x4 = LOAD32_LE(k + 12); + j6 = x6 = LOAD32_LE(in + 0); + j7 = x7 = LOAD32_LE(in + 4); + j8 = x8 = LOAD32_LE(in + 8); + j9 = x9 = LOAD32_LE(in + 12); + j11 = x11 = LOAD32_LE(k + 16); + j12 = x12 = LOAD32_LE(k + 20); + j13 = x13 = LOAD32_LE(k + 24); + j14 = x14 = LOAD32_LE(k + 28); - for (i = ROUNDS;i > 0;i -= 2) { - x4 ^= rotate( x0+x12, 7); - x8 ^= rotate( x4+ x0, 9); - x12 ^= rotate( x8+ x4,13); - x0 ^= rotate(x12+ x8,18); - x9 ^= rotate( x5+ x1, 7); - x13 ^= rotate( x9+ x5, 9); - x1 ^= rotate(x13+ x9,13); - x5 ^= rotate( x1+x13,18); - x14 ^= rotate(x10+ x6, 7); - x2 ^= rotate(x14+x10, 9); - x6 ^= rotate( x2+x14,13); - x10 ^= rotate( x6+ x2,18); - x3 ^= rotate(x15+x11, 7); - x7 ^= rotate( x3+x15, 9); - x11 ^= rotate( x7+ x3,13); - x15 ^= rotate(x11+ x7,18); - x1 ^= rotate( x0+ x3, 7); - x2 ^= rotate( x1+ x0, 9); - x3 ^= rotate( x2+ x1,13); - x0 ^= rotate( x3+ x2,18); - x6 ^= rotate( x5+ x4, 7); - x7 ^= rotate( x6+ x5, 9); - x4 ^= rotate( x7+ x6,13); - x5 ^= rotate( x4+ x7,18); - x11 ^= rotate(x10+ x9, 7); - x8 ^= rotate(x11+x10, 9); - x9 ^= rotate( x8+x11,13); - x10 ^= rotate( x9+ x8,18); - x12 ^= rotate(x15+x14, 7); - x13 ^= rotate(x12+x15, 9); - x14 ^= rotate(x13+x12,13); - x15 ^= rotate(x14+x13,18); - } + for (i = ROUNDS; i > 0; i -= 2) { + x4 ^= rotate(x0 + x12, 7); + x8 ^= rotate(x4 + x0, 9); + x12 ^= rotate(x8 + x4, 13); + x0 ^= rotate(x12 + x8, 18); + x9 ^= rotate(x5 + x1, 7); + x13 ^= rotate(x9 + x5, 9); + x1 ^= rotate(x13 + x9, 13); + x5 ^= rotate(x1 + x13, 18); + x14 ^= rotate(x10 + x6, 7); + x2 ^= rotate(x14 + x10, 9); + x6 ^= rotate(x2 + x14, 13); + x10 ^= rotate(x6 + x2, 18); + x3 ^= rotate(x15 + x11, 7); + x7 ^= rotate(x3 + x15, 9); + x11 ^= rotate(x7 + x3, 13); + x15 ^= rotate(x11 + x7, 18); + x1 ^= rotate(x0 + x3, 7); + x2 ^= rotate(x1 + x0, 9); + x3 ^= rotate(x2 + x1, 13); + x0 ^= rotate(x3 + x2, 18); + x6 ^= rotate(x5 + x4, 7); + x7 ^= rotate(x6 + x5, 9); + x4 ^= rotate(x7 + x6, 13); + x5 ^= rotate(x4 + x7, 18); + x11 ^= rotate(x10 + x9, 7); + x8 ^= rotate(x11 + x10, 9); + x9 ^= rotate(x8 + x11, 13); + x10 ^= rotate(x9 + x8, 18); + x12 ^= rotate(x15 + x14, 7); + x13 ^= rotate(x12 + x15, 9); + x14 ^= rotate(x13 + x12, 13); + x15 ^= rotate(x14 + x13, 18); + } - x0 += j0; - x1 += j1; - x2 += j2; - x3 += j3; - x4 += j4; - x5 += j5; - x6 += j6; - x7 += j7; - x8 += j8; - x9 += j9; - x10 += j10; - x11 += j11; - x12 += j12; - x13 += j13; - x14 += j14; - x15 += j15; + x0 += j0; + x1 += j1; + x2 += j2; + x3 += j3; + x4 += j4; + x5 += j5; + x6 += j6; + x7 += j7; + x8 += j8; + x9 += j9; + x10 += j10; + x11 += j11; + x12 += j12; + x13 += j13; + x14 += j14; + x15 += j15; - STORE32_LE(out + 0,x0); - STORE32_LE(out + 4,x1); - STORE32_LE(out + 8,x2); - STORE32_LE(out + 12,x3); - STORE32_LE(out + 16,x4); - STORE32_LE(out + 20,x5); - STORE32_LE(out + 24,x6); - STORE32_LE(out + 28,x7); - STORE32_LE(out + 32,x8); - STORE32_LE(out + 36,x9); - STORE32_LE(out + 40,x10); - STORE32_LE(out + 44,x11); - STORE32_LE(out + 48,x12); - STORE32_LE(out + 52,x13); - STORE32_LE(out + 56,x14); - STORE32_LE(out + 60,x15); + STORE32_LE(out + 0, x0); + STORE32_LE(out + 4, x1); + STORE32_LE(out + 8, x2); + STORE32_LE(out + 12, x3); + STORE32_LE(out + 16, x4); + STORE32_LE(out + 20, x5); + STORE32_LE(out + 24, x6); + STORE32_LE(out + 28, x7); + STORE32_LE(out + 32, x8); + STORE32_LE(out + 36, x9); + STORE32_LE(out + 40, x10); + STORE32_LE(out + 44, x11); + STORE32_LE(out + 48, x12); + STORE32_LE(out + 52, x13); + STORE32_LE(out + 56, x14); + STORE32_LE(out + 60, x15); - return 0; + return 0; } diff --git a/src/libsodium/crypto_core/salsa208/ref/core_salsa208.c b/src/libsodium/crypto_core/salsa208/ref/core_salsa208.c index c350e84e..8c234afd 100644 --- a/src/libsodium/crypto_core/salsa208/ref/core_salsa208.c +++ b/src/libsodium/crypto_core/salsa208/ref/core_salsa208.c @@ -13,114 +13,116 @@ Public domain. #define ROUNDS 8 #define U32C(v) (v##U) -static uint32_t rotate(uint32_t u,int c) +static uint32_t +rotate(uint32_t u, int c) { - return (u << c) | (u >> (32 - c)); + return (u << c) | (u >> (32 - c)); } -int crypto_core_salsa208( - unsigned char *out, - const unsigned char *in, - const unsigned char *k, - const unsigned char *c -) +int +crypto_core_salsa208(unsigned char *out, + const unsigned char *in, + const unsigned char *k, + const unsigned char *c) { - uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; - uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15; - int i; + uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, + x9, x10, x11, x12, x13, x14, x15; + uint32_t j0, j1, j2, j3, j4, j5, j6, j7, j8, + j9, j10, j11, j12, j13, j14, j15; + int i; - if (c == NULL) { - j0 = x0 = U32C(0x61707865); - j5 = x5 = U32C(0x3320646e); - j10 = x10 = U32C(0x79622d32); - j15 = x15 = U32C(0x6b206574); - } else { - j0 = x0 = LOAD32_LE(c + 0); - j5 = x5 = LOAD32_LE(c + 4); - j10 = x10 = LOAD32_LE(c + 8); - j15 = x15 = LOAD32_LE(c + 12); - } - j1 = x1 = LOAD32_LE(k + 0); - j2 = x2 = LOAD32_LE(k + 4); - j3 = x3 = LOAD32_LE(k + 8); - j4 = x4 = LOAD32_LE(k + 12); - j6 = x6 = LOAD32_LE(in + 0); - j7 = x7 = LOAD32_LE(in + 4); - j8 = x8 = LOAD32_LE(in + 8); - j9 = x9 = LOAD32_LE(in + 12); - j11 = x11 = LOAD32_LE(k + 16); - j12 = x12 = LOAD32_LE(k + 20); - j13 = x13 = LOAD32_LE(k + 24); - j14 = x14 = LOAD32_LE(k + 28); + if (c == NULL) { + j0 = x0 = U32C(0x61707865); + j5 = x5 = U32C(0x3320646e); + j10 = x10 = U32C(0x79622d32); + j15 = x15 = U32C(0x6b206574); + } else { + j0 = x0 = LOAD32_LE(c + 0); + j5 = x5 = LOAD32_LE(c + 4); + j10 = x10 = LOAD32_LE(c + 8); + j15 = x15 = LOAD32_LE(c + 12); + } + j1 = x1 = LOAD32_LE(k + 0); + j2 = x2 = LOAD32_LE(k + 4); + j3 = x3 = LOAD32_LE(k + 8); + j4 = x4 = LOAD32_LE(k + 12); + j6 = x6 = LOAD32_LE(in + 0); + j7 = x7 = LOAD32_LE(in + 4); + j8 = x8 = LOAD32_LE(in + 8); + j9 = x9 = LOAD32_LE(in + 12); + j11 = x11 = LOAD32_LE(k + 16); + j12 = x12 = LOAD32_LE(k + 20); + j13 = x13 = LOAD32_LE(k + 24); + j14 = x14 = LOAD32_LE(k + 28); - for (i = ROUNDS;i > 0;i -= 2) { - x4 ^= rotate( x0+x12, 7); - x8 ^= rotate( x4+ x0, 9); - x12 ^= rotate( x8+ x4,13); - x0 ^= rotate(x12+ x8,18); - x9 ^= rotate( x5+ x1, 7); - x13 ^= rotate( x9+ x5, 9); - x1 ^= rotate(x13+ x9,13); - x5 ^= rotate( x1+x13,18); - x14 ^= rotate(x10+ x6, 7); - x2 ^= rotate(x14+x10, 9); - x6 ^= rotate( x2+x14,13); - x10 ^= rotate( x6+ x2,18); - x3 ^= rotate(x15+x11, 7); - x7 ^= rotate( x3+x15, 9); - x11 ^= rotate( x7+ x3,13); - x15 ^= rotate(x11+ x7,18); - x1 ^= rotate( x0+ x3, 7); - x2 ^= rotate( x1+ x0, 9); - x3 ^= rotate( x2+ x1,13); - x0 ^= rotate( x3+ x2,18); - x6 ^= rotate( x5+ x4, 7); - x7 ^= rotate( x6+ x5, 9); - x4 ^= rotate( x7+ x6,13); - x5 ^= rotate( x4+ x7,18); - x11 ^= rotate(x10+ x9, 7); - x8 ^= rotate(x11+x10, 9); - x9 ^= rotate( x8+x11,13); - x10 ^= rotate( x9+ x8,18); - x12 ^= rotate(x15+x14, 7); - x13 ^= rotate(x12+x15, 9); - x14 ^= rotate(x13+x12,13); - x15 ^= rotate(x14+x13,18); - } + for (i = ROUNDS; i > 0; i -= 2) { + x4 ^= rotate(x0 + x12, 7); + x8 ^= rotate(x4 + x0, 9); + x12 ^= rotate(x8 + x4, 13); + x0 ^= rotate(x12 + x8, 18); + x9 ^= rotate(x5 + x1, 7); + x13 ^= rotate(x9 + x5, 9); + x1 ^= rotate(x13 + x9, 13); + x5 ^= rotate(x1 + x13, 18); + x14 ^= rotate(x10 + x6, 7); + x2 ^= rotate(x14 + x10, 9); + x6 ^= rotate(x2 + x14, 13); + x10 ^= rotate(x6 + x2, 18); + x3 ^= rotate(x15 + x11, 7); + x7 ^= rotate(x3 + x15, 9); + x11 ^= rotate(x7 + x3, 13); + x15 ^= rotate(x11 + x7, 18); + x1 ^= rotate(x0 + x3, 7); + x2 ^= rotate(x1 + x0, 9); + x3 ^= rotate(x2 + x1, 13); + x0 ^= rotate(x3 + x2, 18); + x6 ^= rotate(x5 + x4, 7); + x7 ^= rotate(x6 + x5, 9); + x4 ^= rotate(x7 + x6, 13); + x5 ^= rotate(x4 + x7, 18); + x11 ^= rotate(x10 + x9, 7); + x8 ^= rotate(x11 + x10, 9); + x9 ^= rotate(x8 + x11, 13); + x10 ^= rotate(x9 + x8, 18); + x12 ^= rotate(x15 + x14, 7); + x13 ^= rotate(x12 + x15, 9); + x14 ^= rotate(x13 + x12, 13); + x15 ^= rotate(x14 + x13, 18); + } - x0 += j0; - x1 += j1; - x2 += j2; - x3 += j3; - x4 += j4; - x5 += j5; - x6 += j6; - x7 += j7; - x8 += j8; - x9 += j9; - x10 += j10; - x11 += j11; - x12 += j12; - x13 += j13; - x14 += j14; - x15 += j15; + x0 += j0; + x1 += j1; + x2 += j2; + x3 += j3; + x4 += j4; + x5 += j5; + x6 += j6; + x7 += j7; + x8 += j8; + x9 += j9; + x10 += j10; + x11 += j11; + x12 += j12; + x13 += j13; + x14 += j14; + x15 += j15; - STORE32_LE(out + 0,x0); - STORE32_LE(out + 4,x1); - STORE32_LE(out + 8,x2); - STORE32_LE(out + 12,x3); - STORE32_LE(out + 16,x4); - STORE32_LE(out + 20,x5); - STORE32_LE(out + 24,x6); - STORE32_LE(out + 28,x7); - STORE32_LE(out + 32,x8); - STORE32_LE(out + 36,x9); - STORE32_LE(out + 40,x10); - STORE32_LE(out + 44,x11); - STORE32_LE(out + 48,x12); - STORE32_LE(out + 52,x13); - STORE32_LE(out + 56,x14); - STORE32_LE(out + 60,x15); + STORE32_LE(out + 0, x0); + STORE32_LE(out + 4, x1); + STORE32_LE(out + 8, x2); + STORE32_LE(out + 12, x3); + STORE32_LE(out + 16, x4); + STORE32_LE(out + 20, x5); + STORE32_LE(out + 24, x6); + STORE32_LE(out + 28, x7); + STORE32_LE(out + 32, x8); + STORE32_LE(out + 36, x9); + STORE32_LE(out + 40, x10); + STORE32_LE(out + 44, x11); + STORE32_LE(out + 48, x12); + STORE32_LE(out + 52, x13); + STORE32_LE(out + 56, x14); + STORE32_LE(out + 60, x15); - return 0; + return 0; } diff --git a/src/libsodium/crypto_scalarmult/curve25519/donna_c64/curve25519_donna_c64.c b/src/libsodium/crypto_scalarmult/curve25519/donna_c64/curve25519_donna_c64.c index 22f3bf55..84ea326c 100644 --- a/src/libsodium/crypto_scalarmult/curve25519/donna_c64/curve25519_donna_c64.c +++ b/src/libsodium/crypto_scalarmult/curve25519/donna_c64/curve25519_donna_c64.c @@ -22,29 +22,30 @@ * from the sample implementation. */ -#include #include +#include #ifdef HAVE_TI_MODE -#include "utils.h" -#include "curve25519_donna_c64.h" #include "../scalarmult_curve25519.h" +#include "curve25519_donna_c64.h" +#include "utils.h" typedef uint8_t u8; typedef uint64_t limb; typedef limb felem[5]; /* Special gcc mode for 128-bit integers */ -typedef unsigned uint128_t __attribute__ ((mode(TI))); +typedef unsigned uint128_t __attribute__((mode(TI))); /* Sum two numbers: output += in */ static inline void -fsum(limb *output, const limb *in) { - output[0] += in[0]; - output[1] += in[1]; - output[2] += in[2]; - output[3] += in[3]; - output[4] += in[4]; +fsum(limb *output, const limb *in) +{ + output[0] += in[0]; + output[1] += in[1]; + output[2] += in[2]; + output[3] += in[3]; + output[4] += in[4]; } /* Find the difference of two numbers: output = in - output @@ -54,39 +55,41 @@ fsum(limb *output, const limb *in) { * On return, out[i] < 2**55 */ static inline void -fdifference_backwards(felem out, const felem in) { - /* 152 is 19 << 3 */ - static const limb two54m152 = (((limb)1) << 54) - 152; - static const limb two54m8 = (((limb)1) << 54) - 8; +fdifference_backwards(felem out, const felem in) +{ + /* 152 is 19 << 3 */ + static const limb two54m152 = (((limb)1) << 54) - 152; + static const limb two54m8 = (((limb)1) << 54) - 8; - out[0] = in[0] + two54m152 - out[0]; - out[1] = in[1] + two54m8 - out[1]; - out[2] = in[2] + two54m8 - out[2]; - out[3] = in[3] + two54m8 - out[3]; - out[4] = in[4] + two54m8 - out[4]; + out[0] = in[0] + two54m152 - out[0]; + out[1] = in[1] + two54m8 - out[1]; + out[2] = in[2] + two54m8 - out[2]; + out[3] = in[3] + two54m8 - out[3]; + out[4] = in[4] + two54m8 - out[4]; } /* Multiply a number by a scalar: output = in * scalar */ static inline void -fscalar_product(felem output, const felem in, const limb scalar) { - uint128_t a; +fscalar_product(felem output, const felem in, const limb scalar) +{ + uint128_t a; - a = in[0] * (uint128_t) scalar; - output[0] = ((limb)a) & 0x7ffffffffffff; + a = in[0] * (uint128_t)scalar; + output[0] = ((limb)a) & 0x7ffffffffffff; - a = in[1] * (uint128_t) scalar + ((limb) (a >> 51)); - output[1] = ((limb)a) & 0x7ffffffffffff; + a = in[1] * (uint128_t)scalar + ((limb)(a >> 51)); + output[1] = ((limb)a) & 0x7ffffffffffff; - a = in[2] * (uint128_t) scalar + ((limb) (a >> 51)); - output[2] = ((limb)a) & 0x7ffffffffffff; + a = in[2] * (uint128_t)scalar + ((limb)(a >> 51)); + output[2] = ((limb)a) & 0x7ffffffffffff; - a = in[3] * (uint128_t) scalar + ((limb) (a >> 51)); - output[3] = ((limb)a) & 0x7ffffffffffff; + a = in[3] * (uint128_t)scalar + ((limb)(a >> 51)); + output[3] = ((limb)a) & 0x7ffffffffffff; - a = in[4] * (uint128_t) scalar + ((limb) (a >> 51)); - output[4] = ((limb)a) & 0x7ffffffffffff; + a = in[4] * (uint128_t)scalar + ((limb)(a >> 51)); + output[4] = ((limb)a) & 0x7ffffffffffff; - output[0] += (a >> 51) * 19; + output[0] += (a >> 51) * 19; } /* Multiply two numbers: output = in2 * in @@ -98,200 +101,257 @@ fscalar_product(felem output, const felem in, const limb scalar) { * On return, output[i] < 2**52 */ static inline void -fmul(felem output, const felem in2, const felem in) { - uint128_t t[5]; - limb r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c; +fmul(felem output, const felem in2, const felem in) +{ + uint128_t t[5]; + limb r0, r1, r2, r3, r4, s0, s1, s2, s3, s4, c; - r0 = in[0]; - r1 = in[1]; - r2 = in[2]; - r3 = in[3]; - r4 = in[4]; + r0 = in[0]; + r1 = in[1]; + r2 = in[2]; + r3 = in[3]; + r4 = in[4]; - s0 = in2[0]; - s1 = in2[1]; - s2 = in2[2]; - s3 = in2[3]; - s4 = in2[4]; + s0 = in2[0]; + s1 = in2[1]; + s2 = in2[2]; + s3 = in2[3]; + s4 = in2[4]; - t[0] = ((uint128_t) r0) * s0; - t[1] = ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0; - t[2] = ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1; - t[3] = ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1; - t[4] = ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2; + t[0] = ((uint128_t)r0) * s0; + t[1] = ((uint128_t)r0) * s1 + ((uint128_t)r1) * s0; + t[2] = ((uint128_t)r0) * s2 + ((uint128_t)r2) * s0 + ((uint128_t)r1) * s1; + t[3] = ((uint128_t)r0) * s3 + ((uint128_t)r3) * s0 + ((uint128_t)r1) * s2 + + ((uint128_t)r2) * s1; + t[4] = ((uint128_t)r0) * s4 + ((uint128_t)r4) * s0 + ((uint128_t)r3) * s1 + + ((uint128_t)r1) * s3 + ((uint128_t)r2) * s2; - r4 *= 19; - r1 *= 19; - r2 *= 19; - r3 *= 19; + r4 *= 19; + r1 *= 19; + r2 *= 19; + r3 *= 19; - t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2; - t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3; - t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4; - t[3] += ((uint128_t) r4) * s4; + t[0] += ((uint128_t)r4) * s1 + ((uint128_t)r1) * s4 + ((uint128_t)r2) * s3 + + ((uint128_t)r3) * s2; + t[1] += ((uint128_t)r4) * s2 + ((uint128_t)r2) * s4 + ((uint128_t)r3) * s3; + t[2] += ((uint128_t)r4) * s3 + ((uint128_t)r3) * s4; + t[3] += ((uint128_t)r4) * s4; - r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); - t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); - t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); - t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); - t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); - r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; - r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; - r2 += c; + r0 = (limb)t[0] & 0x7ffffffffffff; + c = (limb)(t[0] >> 51); + t[1] += c; + r1 = (limb)t[1] & 0x7ffffffffffff; + c = (limb)(t[1] >> 51); + t[2] += c; + r2 = (limb)t[2] & 0x7ffffffffffff; + c = (limb)(t[2] >> 51); + t[3] += c; + r3 = (limb)t[3] & 0x7ffffffffffff; + c = (limb)(t[3] >> 51); + t[4] += c; + r4 = (limb)t[4] & 0x7ffffffffffff; + c = (limb)(t[4] >> 51); + r0 += c * 19; + c = r0 >> 51; + r0 = r0 & 0x7ffffffffffff; + r1 += c; + c = r1 >> 51; + r1 = r1 & 0x7ffffffffffff; + r2 += c; - output[0] = r0; - output[1] = r1; - output[2] = r2; - output[3] = r3; - output[4] = r4; + output[0] = r0; + output[1] = r1; + output[2] = r2; + output[3] = r3; + output[4] = r4; } static inline void -fsquare_times(felem output, const felem in, limb count) { - uint128_t t[5]; - limb r0,r1,r2,r3,r4,c; - limb d0,d1,d2,d4,d419; +fsquare_times(felem output, const felem in, limb count) +{ + uint128_t t[5]; + limb r0, r1, r2, r3, r4, c; + limb d0, d1, d2, d4, d419; - r0 = in[0]; - r1 = in[1]; - r2 = in[2]; - r3 = in[3]; - r4 = in[4]; + r0 = in[0]; + r1 = in[1]; + r2 = in[2]; + r3 = in[3]; + r4 = in[4]; - do { - d0 = r0 * 2; - d1 = r1 * 2; - d2 = r2 * 2 * 19; - d419 = r4 * 19; - d4 = d419 * 2; + do { + d0 = r0 * 2; + d1 = r1 * 2; + d2 = r2 * 2 * 19; + d419 = r4 * 19; + d4 = d419 * 2; - t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3 )); - t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19)); - t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3 )); - t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419 )); - t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2 )); + t[0] = ((uint128_t)r0) * r0 + ((uint128_t)d4) * r1 + + (((uint128_t)d2) * (r3)); + t[1] = ((uint128_t)d0) * r1 + ((uint128_t)d4) * r2 + + (((uint128_t)r3) * (r3 * 19)); + t[2] = ((uint128_t)d0) * r2 + ((uint128_t)r1) * r1 + + (((uint128_t)d4) * (r3)); + t[3] = ((uint128_t)d0) * r3 + ((uint128_t)d1) * r2 + + (((uint128_t)r4) * (d419)); + t[4] = ((uint128_t)d0) * r4 + ((uint128_t)d1) * r3 + + (((uint128_t)r2) * (r2)); - r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); - t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); - t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); - t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); - t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); - r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; - r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; - r2 += c; - } while(--count); + r0 = (limb)t[0] & 0x7ffffffffffff; + c = (limb)(t[0] >> 51); + t[1] += c; + r1 = (limb)t[1] & 0x7ffffffffffff; + c = (limb)(t[1] >> 51); + t[2] += c; + r2 = (limb)t[2] & 0x7ffffffffffff; + c = (limb)(t[2] >> 51); + t[3] += c; + r3 = (limb)t[3] & 0x7ffffffffffff; + c = (limb)(t[3] >> 51); + t[4] += c; + r4 = (limb)t[4] & 0x7ffffffffffff; + c = (limb)(t[4] >> 51); + r0 += c * 19; + c = r0 >> 51; + r0 = r0 & 0x7ffffffffffff; + r1 += c; + c = r1 >> 51; + r1 = r1 & 0x7ffffffffffff; + r2 += c; + } while (--count); - output[0] = r0; - output[1] = r1; - output[2] = r2; - output[3] = r3; - output[4] = r4; + output[0] = r0; + output[1] = r1; + output[2] = r2; + output[3] = r3; + output[4] = r4; } #ifdef NATIVE_LITTLE_ENDIAN static inline limb -load_limb(const u8 *in) { +load_limb(const u8 *in) +{ limb out; - memcpy(&out, in, sizeof (limb)); + + memcpy(&out, in, sizeof(limb)); return out; } static inline void -store_limb(u8 *out, limb in) { - memcpy(out, &in, sizeof (limb)); +store_limb(u8 *out, limb in) +{ + memcpy(out, &in, sizeof(limb)); } #else static inline limb -load_limb(const u8 *in) { - return - ((limb)in[0]) | - (((limb)in[1]) << 8) | - (((limb)in[2]) << 16) | - (((limb)in[3]) << 24) | - (((limb)in[4]) << 32) | - (((limb)in[5]) << 40) | - (((limb)in[6]) << 48) | - (((limb)in[7]) << 56); +load_limb(const u8 *in) +{ + return ((limb)in[0]) | (((limb)in[1]) << 8) | (((limb)in[2]) << 16) + | (((limb)in[3]) << 24) | (((limb)in[4]) << 32) + | (((limb)in[5]) << 40) | (((limb)in[6]) << 48) + | (((limb)in[7]) << 56); } static inline void -store_limb(u8 *out, limb in) { - out[0] = in & 0xff; - out[1] = (in >> 8) & 0xff; - out[2] = (in >> 16) & 0xff; - out[3] = (in >> 24) & 0xff; - out[4] = (in >> 32) & 0xff; - out[5] = (in >> 40) & 0xff; - out[6] = (in >> 48) & 0xff; - out[7] = (in >> 56) & 0xff; +store_limb(u8 *out, limb in) +{ + out[0] = in & 0xff; + out[1] = (in >> 8) & 0xff; + out[2] = (in >> 16) & 0xff; + out[3] = (in >> 24) & 0xff; + out[4] = (in >> 32) & 0xff; + out[5] = (in >> 40) & 0xff; + out[6] = (in >> 48) & 0xff; + out[7] = (in >> 56) & 0xff; } #endif /* Take a little-endian, 32-byte number and expand it into polynomial form */ static void -fexpand(limb *output, const u8 *in) { - output[0] = load_limb(in) & 0x7ffffffffffff; - output[1] = (load_limb(in+6) >> 3) & 0x7ffffffffffff; - output[2] = (load_limb(in+12) >> 6) & 0x7ffffffffffff; - output[3] = (load_limb(in+19) >> 1) & 0x7ffffffffffff; - output[4] = (load_limb(in+24) >> 12) & 0x7ffffffffffff; +fexpand(limb *output, const u8 *in) +{ + output[0] = load_limb(in) & 0x7ffffffffffff; + output[1] = (load_limb(in + 6) >> 3) & 0x7ffffffffffff; + output[2] = (load_limb(in + 12) >> 6) & 0x7ffffffffffff; + output[3] = (load_limb(in + 19) >> 1) & 0x7ffffffffffff; + output[4] = (load_limb(in + 24) >> 12) & 0x7ffffffffffff; } /* Take a fully reduced polynomial form number and contract it into a * little-endian, 32-byte array */ static void -fcontract(u8 *output, const felem input) { - uint128_t t[5]; +fcontract(u8 *output, const felem input) +{ + uint128_t t[5]; - t[0] = input[0]; - t[1] = input[1]; - t[2] = input[2]; - t[3] = input[3]; - t[4] = input[4]; + t[0] = input[0]; + t[1] = input[1]; + t[2] = input[2]; + t[3] = input[3]; + t[4] = input[4]; - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; + t[1] += t[0] >> 51; + t[0] &= 0x7ffffffffffff; + t[2] += t[1] >> 51; + t[1] &= 0x7ffffffffffff; + t[3] += t[2] >> 51; + t[2] &= 0x7ffffffffffff; + t[4] += t[3] >> 51; + t[3] &= 0x7ffffffffffff; + t[0] += 19 * (t[4] >> 51); + t[4] &= 0x7ffffffffffff; - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; + t[1] += t[0] >> 51; + t[0] &= 0x7ffffffffffff; + t[2] += t[1] >> 51; + t[1] &= 0x7ffffffffffff; + t[3] += t[2] >> 51; + t[2] &= 0x7ffffffffffff; + t[4] += t[3] >> 51; + t[3] &= 0x7ffffffffffff; + t[0] += 19 * (t[4] >> 51); + t[4] &= 0x7ffffffffffff; - /* now t is between 0 and 2^255-1, properly carried. */ - /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */ + /* now t is between 0 and 2^255-1, properly carried. */ + /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */ - t[0] += 19; + t[0] += 19; - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; + t[1] += t[0] >> 51; + t[0] &= 0x7ffffffffffff; + t[2] += t[1] >> 51; + t[1] &= 0x7ffffffffffff; + t[3] += t[2] >> 51; + t[2] &= 0x7ffffffffffff; + t[4] += t[3] >> 51; + t[3] &= 0x7ffffffffffff; + t[0] += 19 * (t[4] >> 51); + t[4] &= 0x7ffffffffffff; - /* now between 19 and 2^255-1 in both cases, and offset by 19. */ + /* now between 19 and 2^255-1 in both cases, and offset by 19. */ - t[0] += 0x8000000000000 - 19; - t[1] += 0x8000000000000 - 1; - t[2] += 0x8000000000000 - 1; - t[3] += 0x8000000000000 - 1; - t[4] += 0x8000000000000 - 1; + t[0] += 0x8000000000000 - 19; + t[1] += 0x8000000000000 - 1; + t[2] += 0x8000000000000 - 1; + t[3] += 0x8000000000000 - 1; + t[4] += 0x8000000000000 - 1; - /* now between 2^255 and 2^256-20, and offset by 2^255. */ + /* now between 2^255 and 2^256-20, and offset by 2^255. */ - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[4] &= 0x7ffffffffffff; + t[1] += t[0] >> 51; + t[0] &= 0x7ffffffffffff; + t[2] += t[1] >> 51; + t[1] &= 0x7ffffffffffff; + t[3] += t[2] >> 51; + t[2] &= 0x7ffffffffffff; + t[4] += t[3] >> 51; + t[3] &= 0x7ffffffffffff; + t[4] &= 0x7ffffffffffff; - store_limb(output, t[0] | (t[1] << 51)); - store_limb(output + 8, (t[1] >> 13) | (t[2] << 38)); - store_limb(output + 16, (t[2] >> 26) | (t[3] << 25)); - store_limb(output + 24, (t[3] >> 39) | (t[4] << 12)); + store_limb(output, t[0] | (t[1] << 51)); + store_limb(output + 8, (t[1] >> 13) | (t[2] << 38)); + store_limb(output + 16, (t[2] >> 26) | (t[3] << 25)); + store_limb(output + 24, (t[3] >> 39) | (t[4] << 12)); } /* Input: Q, Q', Q-Q' @@ -304,37 +364,38 @@ fcontract(u8 *output, const felem input) { * qmqp: short form, preserved */ static void -fmonty(limb *x2, limb *z2, /* output 2Q */ - limb *x3, limb *z3, /* output Q + Q' */ - limb *x, limb *z, /* input Q */ +fmonty(limb *x2, limb *z2, /* output 2Q */ + limb *x3, limb *z3, /* output Q + Q' */ + limb *x, limb *z, /* input Q */ limb *xprime, limb *zprime, /* input Q' */ - const limb *qmqp /* input Q - Q' */) { - limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5], - zzprime[5], zzzprime[5]; + const limb *qmqp /* input Q - Q' */) +{ + limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5], zzprime[5], + zzzprime[5]; - memcpy(origx, x, 5 * sizeof(limb)); - fsum(x, z); - fdifference_backwards(z, origx); /* does x - z */ + memcpy(origx, x, 5 * sizeof(limb)); + fsum(x, z); + fdifference_backwards(z, origx); /* does x - z */ - memcpy(origxprime, xprime, sizeof(limb) * 5); - fsum(xprime, zprime); - fdifference_backwards(zprime, origxprime); - fmul(xxprime, xprime, z); - fmul(zzprime, x, zprime); - memcpy(origxprime, xxprime, sizeof(limb) * 5); - fsum(xxprime, zzprime); - fdifference_backwards(zzprime, origxprime); - fsquare_times(x3, xxprime, 1); - fsquare_times(zzzprime, zzprime, 1); - fmul(z3, zzzprime, qmqp); + memcpy(origxprime, xprime, sizeof(limb) * 5); + fsum(xprime, zprime); + fdifference_backwards(zprime, origxprime); + fmul(xxprime, xprime, z); + fmul(zzprime, x, zprime); + memcpy(origxprime, xxprime, sizeof(limb) * 5); + fsum(xxprime, zzprime); + fdifference_backwards(zzprime, origxprime); + fsquare_times(x3, xxprime, 1); + fsquare_times(zzzprime, zzprime, 1); + fmul(z3, zzzprime, qmqp); - fsquare_times(xx, x, 1); - fsquare_times(zz, z, 1); - fmul(x2, xx, zz); - fdifference_backwards(zz, xx); /* does zz = xx - zz */ - fscalar_product(zzz, zz, 121665); - fsum(zzz, xx); - fmul(z2, zz, zzz); + fsquare_times(xx, x, 1); + fsquare_times(zz, z, 1); + fmul(x2, xx, zz); + fdifference_backwards(zz, xx); /* does zz = xx - zz */ + fscalar_product(zzz, zz, 121665); + fsum(zzz, xx); + fmul(z2, zz, zzz); } /* ----------------------------------------------------------------------------- @@ -343,17 +404,19 @@ fmonty(limb *x2, limb *z2, /* output 2Q */ This function performs the swap without leaking any side-channel information. - ----------------------------------------------------------------------------- */ + ----------------------------------------------------------------------------- + */ static void -swap_conditional(limb a[5], limb b[5], limb iswap) { - unsigned i; - const limb swap = -iswap; +swap_conditional(limb a[5], limb b[5], limb iswap) +{ + const limb swap = -iswap; + unsigned i; - for (i = 0; i < 5; ++i) { - const limb x = swap & (a[i] ^ b[i]); - a[i] ^= x; - b[i] ^= x; - } + for (i = 0; i < 5; ++i) { + const limb x = swap & (a[i] ^ b[i]); + a[i] ^= x; + b[i] ^= x; + } } /* Calculates nQ where Q is the x-coordinate of a point on the curve @@ -363,118 +426,120 @@ swap_conditional(limb a[5], limb b[5], limb iswap) { * q: a point of the curve (short form) */ static void -cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) { - limb a[5] = {0}, b[5] = {1}, c[5] = {1}, d[5] = {0}; - limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t; - limb e[5] = {0}, f[5] = {1}, g[5] = {0}, h[5] = {1}; - limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h; +cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) +{ + limb a[5] = { 0 }, b[5] = { 1 }, c[5] = { 1 }, d[5] = { 0 }; + limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t; + limb e[5] = { 0 }, f[5] = { 1 }, g[5] = { 0 }, h[5] = { 1 }; + limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h; - unsigned i, j; + unsigned i, j; - memcpy(nqpqx, q, sizeof(limb) * 5); + memcpy(nqpqx, q, sizeof(limb) * 5); - for (i = 0; i < 32; ++i) { - u8 byte = n[31 - i]; - for (j = 0; j < 8; ++j) { - const limb bit = byte >> 7; + for (i = 0; i < 32; ++i) { + u8 byte = n[31 - i]; + for (j = 0; j < 8; ++j) { + const limb bit = byte >> 7; - swap_conditional(nqx, nqpqx, bit); - swap_conditional(nqz, nqpqz, bit); - fmonty(nqx2, nqz2, - nqpqx2, nqpqz2, - nqx, nqz, - nqpqx, nqpqz, - q); - swap_conditional(nqx2, nqpqx2, bit); - swap_conditional(nqz2, nqpqz2, bit); + swap_conditional(nqx, nqpqx, bit); + swap_conditional(nqz, nqpqz, bit); + fmonty(nqx2, nqz2, nqpqx2, nqpqz2, nqx, nqz, nqpqx, nqpqz, q); + swap_conditional(nqx2, nqpqx2, bit); + swap_conditional(nqz2, nqpqz2, bit); - t = nqx; - nqx = nqx2; - nqx2 = t; - t = nqz; - nqz = nqz2; - nqz2 = t; - t = nqpqx; - nqpqx = nqpqx2; - nqpqx2 = t; - t = nqpqz; - nqpqz = nqpqz2; - nqpqz2 = t; + t = nqx; + nqx = nqx2; + nqx2 = t; + t = nqz; + nqz = nqz2; + nqz2 = t; + t = nqpqx; + nqpqx = nqpqx2; + nqpqx2 = t; + t = nqpqz; + nqpqz = nqpqz2; + nqpqz2 = t; - byte <<= 1; + byte <<= 1; + } } - } - memcpy(resultx, nqx, sizeof(limb) * 5); - memcpy(resultz, nqz, sizeof(limb) * 5); + memcpy(resultx, nqx, sizeof(limb) * 5); + memcpy(resultz, nqz, sizeof(limb) * 5); } - /* ----------------------------------------------------------------------------- Shamelessly copied from djb's code, tightened a little - ----------------------------------------------------------------------------- */ + ----------------------------------------------------------------------------- + */ static void -crecip(felem out, const felem z) { - felem a,t0,b,c; +crecip(felem out, const felem z) +{ + felem a, t0, b, c; - /* 2 */ fsquare_times(a, z, 1); /* a = 2 */ - /* 8 */ fsquare_times(t0, a, 2); - /* 9 */ fmul(b, t0, z); /* b = 9 */ - /* 11 */ fmul(a, b, a); /* a = 11 */ - /* 22 */ fsquare_times(t0, a, 1); - /* 2^5 - 2^0 = 31 */ fmul(b, t0, b); - /* 2^10 - 2^5 */ fsquare_times(t0, b, 5); - /* 2^10 - 2^0 */ fmul(b, t0, b); - /* 2^20 - 2^10 */ fsquare_times(t0, b, 10); - /* 2^20 - 2^0 */ fmul(c, t0, b); - /* 2^40 - 2^20 */ fsquare_times(t0, c, 20); - /* 2^40 - 2^0 */ fmul(t0, t0, c); - /* 2^50 - 2^10 */ fsquare_times(t0, t0, 10); - /* 2^50 - 2^0 */ fmul(b, t0, b); - /* 2^100 - 2^50 */ fsquare_times(t0, b, 50); - /* 2^100 - 2^0 */ fmul(c, t0, b); - /* 2^200 - 2^100 */ fsquare_times(t0, c, 100); - /* 2^200 - 2^0 */ fmul(t0, t0, c); - /* 2^250 - 2^50 */ fsquare_times(t0, t0, 50); - /* 2^250 - 2^0 */ fmul(t0, t0, b); - /* 2^255 - 2^5 */ fsquare_times(t0, t0, 5); - /* 2^255 - 21 */ fmul(out, t0, a); + /* 2 */ fsquare_times(a, z, 1); /* a = 2 */ + /* 8 */ fsquare_times(t0, a, 2); + /* 9 */ fmul(b, t0, z); /* b = 9 */ + /* 11 */ fmul(a, b, a); /* a = 11 */ + /* 22 */ fsquare_times(t0, a, 1); + /* 2^5 - 2^0 = 31 */ fmul(b, t0, b); + /* 2^10 - 2^5 */ fsquare_times(t0, b, 5); + /* 2^10 - 2^0 */ fmul(b, t0, b); + /* 2^20 - 2^10 */ fsquare_times(t0, b, 10); + /* 2^20 - 2^0 */ fmul(c, t0, b); + /* 2^40 - 2^20 */ fsquare_times(t0, c, 20); + /* 2^40 - 2^0 */ fmul(t0, t0, c); + /* 2^50 - 2^10 */ fsquare_times(t0, t0, 10); + /* 2^50 - 2^0 */ fmul(b, t0, b); + /* 2^100 - 2^50 */ fsquare_times(t0, b, 50); + /* 2^100 - 2^0 */ fmul(c, t0, b); + /* 2^200 - 2^100 */ fsquare_times(t0, c, 100); + /* 2^200 - 2^0 */ fmul(t0, t0, c); + /* 2^250 - 2^50 */ fsquare_times(t0, t0, 50); + /* 2^250 - 2^0 */ fmul(t0, t0, b); + /* 2^255 - 2^5 */ fsquare_times(t0, t0, 5); + /* 2^255 - 21 */ fmul(out, t0, a); } -static const unsigned char basepoint[32] = {9}; +static const unsigned char basepoint[32] = { 9 }; static int crypto_scalarmult_curve25519_donna_c64(unsigned char *mypublic, const unsigned char *secret, - const unsigned char *basepoint) { - limb bp[5], x[5], z[5], zmone[5]; - uint8_t e[32]; - int i; + const unsigned char *basepoint) +{ + limb bp[5], x[5], z[5], zmone[5]; + uint8_t e[32]; + int i; - for (i = 0;i < 32;++i) e[i] = secret[i]; - e[0] &= 248; - e[31] &= 127; - e[31] |= 64; + for (i = 0; i < 32; ++i) { + e[i] = secret[i]; + } + e[0] &= 248; + e[31] &= 127; + e[31] |= 64; - fexpand(bp, basepoint); - cmult(x, z, e, bp); - crecip(zmone, z); - fmul(z, x, zmone); - fcontract(mypublic, z); - return 0; + fexpand(bp, basepoint); + cmult(x, z, e, bp); + crecip(zmone, z); + fmul(z, x, zmone); + fcontract(mypublic, z); + + return 0; } static int crypto_scalarmult_curve25519_donna_c64_base(unsigned char *q, const unsigned char *n) { - return crypto_scalarmult_curve25519_donna_c64(q, n, basepoint); + return crypto_scalarmult_curve25519_donna_c64(q, n, basepoint); } struct crypto_scalarmult_curve25519_implementation -crypto_scalarmult_curve25519_donna_c64_implementation = { - SODIUM_C99(.mult = ) crypto_scalarmult_curve25519_donna_c64, - SODIUM_C99(.mult_base = ) crypto_scalarmult_curve25519_donna_c64_base -}; + crypto_scalarmult_curve25519_donna_c64_implementation = { + SODIUM_C99(.mult =) crypto_scalarmult_curve25519_donna_c64, + SODIUM_C99(.mult_base =) crypto_scalarmult_curve25519_donna_c64_base + }; #endif diff --git a/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c b/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c index f9bb8155..7314d737 100644 --- a/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c +++ b/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c @@ -4,10 +4,10 @@ #ifndef HAVE_TI_MODE -#include "utils.h" -#include "x25519_ref10.h" #include "../scalarmult_curve25519.h" #include "private/curve25519_ref10.h" +#include "utils.h" +#include "x25519_ref10.h" /* Replace (f,g) with (g,f) if b == 1; @@ -17,69 +17,70 @@ Preconditions: b in {0,1}. */ static void -fe_cswap(fe f,fe g,unsigned int b) +fe_cswap(fe f, fe g, unsigned int b) { - int32_t f0 = f[0]; - int32_t f1 = f[1]; - int32_t f2 = f[2]; - int32_t f3 = f[3]; - int32_t f4 = f[4]; - int32_t f5 = f[5]; - int32_t f6 = f[6]; - int32_t f7 = f[7]; - int32_t f8 = f[8]; - int32_t f9 = f[9]; - int32_t g0 = g[0]; - int32_t g1 = g[1]; - int32_t g2 = g[2]; - int32_t g3 = g[3]; - int32_t g4 = g[4]; - int32_t g5 = g[5]; - int32_t g6 = g[6]; - int32_t g7 = g[7]; - int32_t g8 = g[8]; - int32_t g9 = g[9]; - int32_t x0 = f0 ^ g0; - int32_t x1 = f1 ^ g1; - int32_t x2 = f2 ^ g2; - int32_t x3 = f3 ^ g3; - int32_t x4 = f4 ^ g4; - int32_t x5 = f5 ^ g5; - int32_t x6 = f6 ^ g6; - int32_t x7 = f7 ^ g7; - int32_t x8 = f8 ^ g8; - int32_t x9 = f9 ^ g9; - b = (unsigned int) (- (int) b); - x0 &= b; - x1 &= b; - x2 &= b; - x3 &= b; - x4 &= b; - x5 &= b; - x6 &= b; - x7 &= b; - x8 &= b; - x9 &= b; - f[0] = f0 ^ x0; - f[1] = f1 ^ x1; - f[2] = f2 ^ x2; - f[3] = f3 ^ x3; - f[4] = f4 ^ x4; - f[5] = f5 ^ x5; - f[6] = f6 ^ x6; - f[7] = f7 ^ x7; - f[8] = f8 ^ x8; - f[9] = f9 ^ x9; - g[0] = g0 ^ x0; - g[1] = g1 ^ x1; - g[2] = g2 ^ x2; - g[3] = g3 ^ x3; - g[4] = g4 ^ x4; - g[5] = g5 ^ x5; - g[6] = g6 ^ x6; - g[7] = g7 ^ x7; - g[8] = g8 ^ x8; - g[9] = g9 ^ x9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t x0 = f0 ^ g0; + int32_t x1 = f1 ^ g1; + int32_t x2 = f2 ^ g2; + int32_t x3 = f3 ^ g3; + int32_t x4 = f4 ^ g4; + int32_t x5 = f5 ^ g5; + int32_t x6 = f6 ^ g6; + int32_t x7 = f7 ^ g7; + int32_t x8 = f8 ^ g8; + int32_t x9 = f9 ^ g9; + + b = (unsigned int)(-(int)b); + x0 &= b; + x1 &= b; + x2 &= b; + x3 &= b; + x4 &= b; + x5 &= b; + x6 &= b; + x7 &= b; + x8 &= b; + x9 &= b; + f[0] = f0 ^ x0; + f[1] = f1 ^ x1; + f[2] = f2 ^ x2; + f[3] = f3 ^ x3; + f[4] = f4 ^ x4; + f[5] = f5 ^ x5; + f[6] = f6 ^ x6; + f[7] = f7 ^ x7; + f[8] = f8 ^ x8; + f[9] = f9 ^ x9; + g[0] = g0 ^ x0; + g[1] = g1 ^ x1; + g[2] = g2 ^ x2; + g[3] = g3 ^ x3; + g[4] = g4 ^ x4; + g[5] = g5 ^ x5; + g[6] = g6 ^ x6; + g[7] = g7 ^ x7; + g[8] = g8 ^ x8; + g[9] = g9 ^ x9; } /* @@ -94,61 +95,81 @@ Postconditions: */ static void -fe_mul121666(fe h,const fe f) +fe_mul121666(fe h, const fe f) { - int32_t f0 = f[0]; - int32_t f1 = f[1]; - int32_t f2 = f[2]; - int32_t f3 = f[3]; - int32_t f4 = f[4]; - int32_t f5 = f[5]; - int32_t f6 = f[6]; - int32_t f7 = f[7]; - int32_t f8 = f[8]; - int32_t f9 = f[9]; - int64_t h0 = f0 * (int64_t) 121666; - int64_t h1 = f1 * (int64_t) 121666; - int64_t h2 = f2 * (int64_t) 121666; - int64_t h3 = f3 * (int64_t) 121666; - int64_t h4 = f4 * (int64_t) 121666; - int64_t h5 = f5 * (int64_t) 121666; - int64_t h6 = f6 * (int64_t) 121666; - int64_t h7 = f7 * (int64_t) 121666; - int64_t h8 = f8 * (int64_t) 121666; - int64_t h9 = f9 * (int64_t) 121666; - int64_t carry0; - int64_t carry1; - int64_t carry2; - int64_t carry3; - int64_t carry4; - int64_t carry5; - int64_t carry6; - int64_t carry7; - int64_t carry8; - int64_t carry9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int64_t h0 = f0 * (int64_t)121666; + int64_t h1 = f1 * (int64_t)121666; + int64_t h2 = f2 * (int64_t)121666; + int64_t h3 = f3 * (int64_t)121666; + int64_t h4 = f4 * (int64_t)121666; + int64_t h5 = f5 * (int64_t)121666; + int64_t h6 = f6 * (int64_t)121666; + int64_t h7 = f7 * (int64_t)121666; + int64_t h8 = f8 * (int64_t)121666; + int64_t h9 = f9 * (int64_t)121666; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; - carry9 = (h9 + ((int64_t) 1 << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((int64_t) 1 << 25); - carry1 = (h1 + ((int64_t) 1 << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((int64_t) 1 << 25); - carry3 = (h3 + ((int64_t) 1 << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((int64_t) 1 << 25); - carry5 = (h5 + ((int64_t) 1 << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((int64_t) 1 << 25); - carry7 = (h7 + ((int64_t) 1 << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((int64_t) 1 << 25); + carry9 = (h9 + ((int64_t)1 << 24)) >> 25; + h0 += carry9 * 19; + h9 -= carry9 * ((int64_t)1 << 25); + carry1 = (h1 + ((int64_t)1 << 24)) >> 25; + h2 += carry1; + h1 -= carry1 * ((int64_t)1 << 25); + carry3 = (h3 + ((int64_t)1 << 24)) >> 25; + h4 += carry3; + h3 -= carry3 * ((int64_t)1 << 25); + carry5 = (h5 + ((int64_t)1 << 24)) >> 25; + h6 += carry5; + h5 -= carry5 * ((int64_t)1 << 25); + carry7 = (h7 + ((int64_t)1 << 24)) >> 25; + h8 += carry7; + h7 -= carry7 * ((int64_t)1 << 25); - carry0 = (h0 + ((int64_t) 1 << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((int64_t) 1 << 26); - carry2 = (h2 + ((int64_t) 1 << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((int64_t) 1 << 26); - carry4 = (h4 + ((int64_t) 1 << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((int64_t) 1 << 26); - carry6 = (h6 + ((int64_t) 1 << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((int64_t) 1 << 26); - carry8 = (h8 + ((int64_t) 1 << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((int64_t) 1 << 26); + carry0 = (h0 + ((int64_t)1 << 25)) >> 26; + h1 += carry0; + h0 -= carry0 * ((int64_t)1 << 26); + carry2 = (h2 + ((int64_t)1 << 25)) >> 26; + h3 += carry2; + h2 -= carry2 * ((int64_t)1 << 26); + carry4 = (h4 + ((int64_t)1 << 25)) >> 26; + h5 += carry4; + h4 -= carry4 * ((int64_t)1 << 26); + carry6 = (h6 + ((int64_t)1 << 25)) >> 26; + h7 += carry6; + h6 -= carry6 * ((int64_t)1 << 26); + carry8 = (h8 + ((int64_t)1 << 25)) >> 26; + h9 += carry8; + h8 -= carry8 * ((int64_t)1 << 26); - h[0] = h0; - h[1] = h1; - h[2] = h2; - h[3] = h3; - h[4] = h4; - h[5] = h5; - h[6] = h6; - h[7] = h7; - h[8] = h8; - h[9] = h9; + h[0] = h0; + h[1] = h1; + h[2] = h2; + h[3] = h3; + h[4] = h4; + h[5] = h5; + h[6] = h6; + h[7] = h7; + h[8] = h8; + h[9] = h9; } static int @@ -156,100 +177,106 @@ crypto_scalarmult_curve25519_ref10(unsigned char *q, const unsigned char *n, const unsigned char *p) { - unsigned char e[32]; - unsigned int i; - fe x1; - fe x2; - fe z2; - fe x3; - fe z3; - fe tmp0; - fe tmp1; - int pos; - unsigned int swap; - unsigned int b; + unsigned char e[32]; + unsigned int i; + fe x1; + fe x2; + fe z2; + fe x3; + fe z3; + fe tmp0; + fe tmp1; + int pos; + unsigned int swap; + unsigned int b; - for (i = 0;i < 32;++i) e[i] = n[i]; - e[0] &= 248; - e[31] &= 127; - e[31] |= 64; - fe_frombytes(x1,p); - fe_1(x2); - fe_0(z2); - fe_copy(x3,x1); - fe_1(z3); + for (i = 0; i < 32; ++i) { + e[i] = n[i]; + } + e[0] &= 248; + e[31] &= 127; + e[31] |= 64; + fe_frombytes(x1, p); + fe_1(x2); + fe_0(z2); + fe_copy(x3, x1); + fe_1(z3); - swap = 0; - for (pos = 254;pos >= 0;--pos) { - b = e[pos / 8] >> (pos & 7); - b &= 1; - swap ^= b; - fe_cswap(x2,x3,swap); - fe_cswap(z2,z3,swap); - swap = b; - fe_sub(tmp0,x3,z3); - fe_sub(tmp1,x2,z2); - fe_add(x2,x2,z2); - fe_add(z2,x3,z3); - fe_mul(z3,tmp0,x2); - fe_mul(z2,z2,tmp1); - fe_sq(tmp0,tmp1); - fe_sq(tmp1,x2); - fe_add(x3,z3,z2); - fe_sub(z2,z3,z2); - fe_mul(x2,tmp1,tmp0); - fe_sub(tmp1,tmp1,tmp0); - fe_sq(z2,z2); - fe_mul121666(z3,tmp1); - fe_sq(x3,x3); - fe_add(tmp0,tmp0,z3); - fe_mul(z3,x1,z2); - fe_mul(z2,tmp1,tmp0); - } - fe_cswap(x2,x3,swap); - fe_cswap(z2,z3,swap); + swap = 0; + for (pos = 254; pos >= 0; --pos) { + b = e[pos / 8] >> (pos & 7); + b &= 1; + swap ^= b; + fe_cswap(x2, x3, swap); + fe_cswap(z2, z3, swap); + swap = b; + fe_sub(tmp0, x3, z3); + fe_sub(tmp1, x2, z2); + fe_add(x2, x2, z2); + fe_add(z2, x3, z3); + fe_mul(z3, tmp0, x2); + fe_mul(z2, z2, tmp1); + fe_sq(tmp0, tmp1); + fe_sq(tmp1, x2); + fe_add(x3, z3, z2); + fe_sub(z2, z3, z2); + fe_mul(x2, tmp1, tmp0); + fe_sub(tmp1, tmp1, tmp0); + fe_sq(z2, z2); + fe_mul121666(z3, tmp1); + fe_sq(x3, x3); + fe_add(tmp0, tmp0, z3); + fe_mul(z3, x1, z2); + fe_mul(z2, tmp1, tmp0); + } + fe_cswap(x2, x3, swap); + fe_cswap(z2, z3, swap); - fe_invert(z2,z2); - fe_mul(x2,x2,z2); - fe_tobytes(q,x2); - return 0; + fe_invert(z2, z2); + fe_mul(x2, x2, z2); + fe_tobytes(q, x2); + + return 0; } static void edwards_to_montgomery(fe montgomeryX, const fe edwardsY, const fe edwardsZ) { - fe tempX; - fe tempZ; + fe tempX; + fe tempZ; - fe_add(tempX, edwardsZ, edwardsY); - fe_sub(tempZ, edwardsZ, edwardsY); - fe_invert(tempZ, tempZ); - fe_mul(montgomeryX, tempX, tempZ); + fe_add(tempX, edwardsZ, edwardsY); + fe_sub(tempZ, edwardsZ, edwardsY); + fe_invert(tempZ, tempZ); + fe_mul(montgomeryX, tempX, tempZ); } static int crypto_scalarmult_curve25519_ref10_base(unsigned char *q, const unsigned char *n) { - unsigned char e[32]; - ge_p3 A; - fe pk; - unsigned int i; + unsigned char e[32]; + ge_p3 A; + fe pk; + unsigned int i; - for (i = 0;i < 32;++i) e[i] = n[i]; - e[0] &= 248; - e[31] &= 127; - e[31] |= 64; - ge_scalarmult_base(&A, e); - edwards_to_montgomery(pk, A.Y, A.Z); - fe_tobytes(q, pk); - return 0; + for (i = 0; i < 32; ++i) { + e[i] = n[i]; + } + e[0] &= 248; + e[31] &= 127; + e[31] |= 64; + ge_scalarmult_base(&A, e); + edwards_to_montgomery(pk, A.Y, A.Z); + fe_tobytes(q, pk); + + return 0; } struct crypto_scalarmult_curve25519_implementation -crypto_scalarmult_curve25519_ref10_implementation = { - SODIUM_C99(.mult = ) crypto_scalarmult_curve25519_ref10, - SODIUM_C99(.mult_base = ) crypto_scalarmult_curve25519_ref10_base -}; + crypto_scalarmult_curve25519_ref10_implementation = { + SODIUM_C99(.mult =) crypto_scalarmult_curve25519_ref10, + SODIUM_C99(.mult_base =) crypto_scalarmult_curve25519_ref10_base + }; #endif diff --git a/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c b/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c index 123b90b2..db812342 100644 --- a/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c +++ b/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c @@ -2,34 +2,45 @@ #include "crypto_secretbox_xsalsa20poly1305.h" #include "crypto_stream_xsalsa20.h" -int crypto_secretbox_xsalsa20poly1305( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_secretbox_xsalsa20poly1305(unsigned char *c, const unsigned char *m, + unsigned long long mlen, + const unsigned char *n, + const unsigned char *k) { - int i; - if (mlen < 32) return -1; - crypto_stream_xsalsa20_xor(c,m,mlen,n,k); - crypto_onetimeauth_poly1305(c + 16,c + 32,mlen - 32,c); - for (i = 0;i < 16;++i) c[i] = 0; - return 0; + int i; + + if (mlen < 32) { + return -1; + } + crypto_stream_xsalsa20_xor(c, m, mlen, n, k); + crypto_onetimeauth_poly1305(c + 16, c + 32, mlen - 32, c); + for (i = 0; i < 16; ++i) { + c[i] = 0; + } + return 0; } -int crypto_secretbox_xsalsa20poly1305_open( - unsigned char *m, - const unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_secretbox_xsalsa20poly1305_open(unsigned char *m, const unsigned char *c, + unsigned long long clen, + const unsigned char *n, + const unsigned char *k) { - int i; - unsigned char subkey[32]; - if (clen < 32) return -1; - crypto_stream_xsalsa20(subkey,32,n,k); - if (crypto_onetimeauth_poly1305_verify(c + 16,c + 32,clen - 32,subkey) != 0) return -1; - crypto_stream_xsalsa20_xor(m,c,clen,n,k); - for (i = 0;i < 32;++i) m[i] = 0; - return 0; + unsigned char subkey[32]; + int i; + + if (clen < 32) { + return -1; + } + crypto_stream_xsalsa20(subkey, 32, n, k); + if (crypto_onetimeauth_poly1305_verify(c + 16, c + 32, + clen - 32, subkey) != 0) { + return -1; + } + crypto_stream_xsalsa20_xor(m, c, clen, n, k); + for (i = 0; i < 32; ++i) { + m[i] = 0; + } + return 0; } diff --git a/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c b/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c index 3ab68b16..67c4100a 100644 --- a/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c +++ b/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c @@ -1,26 +1,31 @@ #include "crypto_secretbox_xsalsa20poly1305.h" size_t -crypto_secretbox_xsalsa20poly1305_keybytes(void) { +crypto_secretbox_xsalsa20poly1305_keybytes(void) +{ return crypto_secretbox_xsalsa20poly1305_KEYBYTES; } size_t -crypto_secretbox_xsalsa20poly1305_noncebytes(void) { +crypto_secretbox_xsalsa20poly1305_noncebytes(void) +{ return crypto_secretbox_xsalsa20poly1305_NONCEBYTES; } size_t -crypto_secretbox_xsalsa20poly1305_zerobytes(void) { +crypto_secretbox_xsalsa20poly1305_zerobytes(void) +{ return crypto_secretbox_xsalsa20poly1305_ZEROBYTES; } size_t -crypto_secretbox_xsalsa20poly1305_boxzerobytes(void) { +crypto_secretbox_xsalsa20poly1305_boxzerobytes(void) +{ return crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES; } size_t -crypto_secretbox_xsalsa20poly1305_macbytes(void) { +crypto_secretbox_xsalsa20poly1305_macbytes(void) +{ return crypto_secretbox_xsalsa20poly1305_MACBYTES; } diff --git a/src/libsodium/crypto_sign/ed25519/description b/src/libsodium/crypto_sign/ed25519/description deleted file mode 100644 index 0dba8c46..00000000 --- a/src/libsodium/crypto_sign/ed25519/description +++ /dev/null @@ -1 +0,0 @@ -EdDSA signatures using Curve25519 diff --git a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c index de1c652b..8a752c81 100644 --- a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c +++ b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c @@ -1,32 +1,35 @@ #include -#include "crypto_sign_ed25519.h" #include "crypto_hash_sha512.h" #include "crypto_scalarmult_curve25519.h" +#include "crypto_sign_ed25519.h" +#include "private/curve25519_ref10.h" #include "randombytes.h" #include "utils.h" -#include "private/curve25519_ref10.h" -int crypto_sign_ed25519_seed_keypair(unsigned char *pk, unsigned char *sk, - const unsigned char *seed) +int +crypto_sign_ed25519_seed_keypair(unsigned char *pk, unsigned char *sk, + const unsigned char *seed) { ge_p3 A; - crypto_hash_sha512(sk,seed,32); + crypto_hash_sha512(sk, seed, 32); sk[0] &= 248; sk[31] &= 63; sk[31] |= 64; - ge_scalarmult_base(&A,sk); - ge_p3_tobytes(pk,&A); + ge_scalarmult_base(&A, sk); + ge_p3_tobytes(pk, &A); memmove(sk, seed, 32); memmove(sk + 32, pk, 32); + return 0; } -int crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk) +int +crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk) { unsigned char seed[32]; int ret; @@ -38,8 +41,9 @@ int crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk) return ret; } -int crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk, - const unsigned char *ed25519_pk) +int +crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk, + const unsigned char *ed25519_pk) { ge_p3 A; fe x; @@ -59,14 +63,14 @@ int crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk, return 0; } -int crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk, - const unsigned char *ed25519_sk) +int +crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk, + const unsigned char *ed25519_sk) { unsigned char h[crypto_hash_sha512_BYTES]; - crypto_hash_sha512(h, ed25519_sk, - crypto_sign_ed25519_SECRETKEYBYTES - - crypto_sign_ed25519_PUBLICKEYBYTES); + crypto_hash_sha512(h, ed25519_sk, crypto_sign_ed25519_SECRETKEYBYTES + - crypto_sign_ed25519_PUBLICKEYBYTES); h[0] &= 248; h[31] &= 127; h[31] |= 64; diff --git a/src/libsodium/crypto_sign/ed25519/sign_ed25519_api.c b/src/libsodium/crypto_sign/ed25519/sign_ed25519_api.c index 7ba6b4c3..1bfc3305 100644 --- a/src/libsodium/crypto_sign/ed25519/sign_ed25519_api.c +++ b/src/libsodium/crypto_sign/ed25519/sign_ed25519_api.c @@ -27,6 +27,7 @@ int crypto_sign_ed25519_sk_to_seed(unsigned char *seed, const unsigned char *sk) { memmove(seed, sk, crypto_sign_ed25519_SEEDBYTES); + return 0; } diff --git a/src/libsodium/crypto_stream/aes128ctr/portable/int128.h b/src/libsodium/crypto_stream/aes128ctr/portable/int128.h index 91350b2f..d095e94c 100644 --- a/src/libsodium/crypto_stream/aes128ctr/portable/int128.h +++ b/src/libsodium/crypto_stream/aes128ctr/portable/int128.h @@ -12,9 +12,9 @@ #endif typedef union { - uint64_t u64[2]; - uint32_t u32[4]; - uint8_t u8[16]; + uint64_t u64[2]; + uint32_t u32[4]; + uint8_t u8[16]; } aes_uint128_t; #define xor2 crypto_stream_aes128ctr_portable_xor2 diff --git a/src/libsodium/crypto_stream/aes128ctr/portable/stream_aes128ctr.c b/src/libsodium/crypto_stream/aes128ctr/portable/stream_aes128ctr.c index 2aa1a00e..d0d4bb4f 100644 --- a/src/libsodium/crypto_stream/aes128ctr/portable/stream_aes128ctr.c +++ b/src/libsodium/crypto_stream/aes128ctr/portable/stream_aes128ctr.c @@ -7,6 +7,7 @@ int crypto_stream_aes128ctr(unsigned char *out, const unsigned char *k) { unsigned char d[crypto_stream_aes128ctr_BEFORENMBYTES]; + crypto_stream_aes128ctr_beforenm(d, k); crypto_stream_aes128ctr_afternm(out, outlen, n, d); @@ -20,6 +21,7 @@ int crypto_stream_aes128ctr_xor(unsigned char *out, const unsigned char *k) { unsigned char d[crypto_stream_aes128ctr_BEFORENMBYTES]; + crypto_stream_aes128ctr_beforenm(d, k); crypto_stream_aes128ctr_xor_afternm(out, in, inlen, n, d); diff --git a/src/libsodium/crypto_stream/salsa20/ref/stream_salsa20_ref.c b/src/libsodium/crypto_stream/salsa20/ref/stream_salsa20_ref.c index 5a17b4bc..8d1000c1 100644 --- a/src/libsodium/crypto_stream/salsa20/ref/stream_salsa20_ref.c +++ b/src/libsodium/crypto_stream/salsa20/ref/stream_salsa20_ref.c @@ -10,46 +10,52 @@ Public domain. #ifndef HAVE_AMD64_ASM -int crypto_stream_salsa20( - unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_salsa20(unsigned char *c, unsigned long long clen, + const unsigned char *n, const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!clen) return 0; + if (!clen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = 0; + } + while (clen >= 64) { + crypto_core_salsa20(c, in, kcopy, NULL); - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) in[i] = 0; + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - while (clen >= 64) { - crypto_core_salsa20(c,in,kcopy,NULL); - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + clen -= 64; + c += 64; } - clen -= 64; - c += 64; - } + if (clen) { + crypto_core_salsa20(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)clen; ++i) { + c[i] = block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); - if (clen) { - crypto_core_salsa20(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) clen;++i) c[i] = block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); - - return 0; + return 0; } #endif diff --git a/src/libsodium/crypto_stream/salsa20/ref/xor_salsa20_ref.c b/src/libsodium/crypto_stream/salsa20/ref/xor_salsa20_ref.c index d5984965..03e08d62 100644 --- a/src/libsodium/crypto_stream/salsa20/ref/xor_salsa20_ref.c +++ b/src/libsodium/crypto_stream/salsa20/ref/xor_salsa20_ref.c @@ -12,52 +12,58 @@ Public domain. #ifndef HAVE_AMD64_ASM -int crypto_stream_salsa20_xor_ic( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, uint64_t ic, - const unsigned char *k -) +int +crypto_stream_salsa20_xor_ic(unsigned char *c, const unsigned char *m, + unsigned long long mlen, const unsigned char *n, + uint64_t ic, const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!mlen) return 0; - - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) { - in[i] = (unsigned char) (ic & 0xff); - ic >>= 8; - } - - while (mlen >= 64) { - crypto_core_salsa20(block,in,kcopy,NULL); - for (i = 0;i < 64;++i) c[i] = m[i] ^ block[i]; - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + if (!mlen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = (unsigned char)(ic & 0xff); + ic >>= 8; } - mlen -= 64; - c += 64; - m += 64; - } + while (mlen >= 64) { + crypto_core_salsa20(block, in, kcopy, NULL); + for (i = 0; i < 64; ++i) { + c[i] = m[i] ^ block[i]; + } + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - if (mlen) { - crypto_core_salsa20(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) mlen;++i) c[i] = m[i] ^ block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); + mlen -= 64; + c += 64; + m += 64; + } - return 0; + if (mlen) { + crypto_core_salsa20(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)mlen; ++i) { + c[i] = m[i] ^ block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); + + return 0; } #endif diff --git a/src/libsodium/crypto_stream/salsa2012/ref/stream_salsa2012.c b/src/libsodium/crypto_stream/salsa2012/ref/stream_salsa2012.c index 5a3a3c1e..64ee11bb 100644 --- a/src/libsodium/crypto_stream/salsa2012/ref/stream_salsa2012.c +++ b/src/libsodium/crypto_stream/salsa2012/ref/stream_salsa2012.c @@ -8,44 +8,50 @@ Public domain. #include "crypto_stream_salsa2012.h" #include "utils.h" -int crypto_stream_salsa2012( - unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_salsa2012(unsigned char *c, unsigned long long clen, + const unsigned char *n, const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!clen) return 0; + if (!clen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = 0; + } + while (clen >= 64) { + crypto_core_salsa2012(c, in, kcopy, NULL); - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) in[i] = 0; + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - while (clen >= 64) { - crypto_core_salsa2012(c,in,kcopy,NULL); - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + clen -= 64; + c += 64; } - clen -= 64; - c += 64; - } + if (clen) { + crypto_core_salsa2012(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)clen; ++i) { + c[i] = block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); - if (clen) { - crypto_core_salsa2012(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) clen;++i) c[i] = block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); - - return 0; + return 0; } diff --git a/src/libsodium/crypto_stream/salsa2012/ref/xor_salsa2012.c b/src/libsodium/crypto_stream/salsa2012/ref/xor_salsa2012.c index f885b30f..58d8f842 100644 --- a/src/libsodium/crypto_stream/salsa2012/ref/xor_salsa2012.c +++ b/src/libsodium/crypto_stream/salsa2012/ref/xor_salsa2012.c @@ -8,47 +8,54 @@ Public domain. #include "crypto_stream_salsa2012.h" #include "utils.h" -int crypto_stream_salsa2012_xor( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_salsa2012_xor(unsigned char *c, const unsigned char *m, + unsigned long long mlen, const unsigned char *n, + const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!mlen) return 0; + if (!mlen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = 0; + } + while (mlen >= 64) { + crypto_core_salsa2012(block, in, kcopy, NULL); + for (i = 0; i < 64; ++i) { + c[i] = m[i] ^ block[i]; + } + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) in[i] = 0; - - while (mlen >= 64) { - crypto_core_salsa2012(block,in,kcopy,NULL); - for (i = 0;i < 64;++i) c[i] = m[i] ^ block[i]; - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + mlen -= 64; + c += 64; + m += 64; } - mlen -= 64; - c += 64; - m += 64; - } + if (mlen) { + crypto_core_salsa2012(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)mlen; ++i) { + c[i] = m[i] ^ block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); - if (mlen) { - crypto_core_salsa2012(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) mlen;++i) c[i] = m[i] ^ block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); - - return 0; + return 0; } diff --git a/src/libsodium/crypto_stream/salsa208/ref/stream_salsa208.c b/src/libsodium/crypto_stream/salsa208/ref/stream_salsa208.c index 0b81ce1d..2f96a4f2 100644 --- a/src/libsodium/crypto_stream/salsa208/ref/stream_salsa208.c +++ b/src/libsodium/crypto_stream/salsa208/ref/stream_salsa208.c @@ -8,44 +8,50 @@ Public domain. #include "crypto_stream_salsa208.h" #include "utils.h" -int crypto_stream_salsa208( - unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_salsa208(unsigned char *c, unsigned long long clen, + const unsigned char *n, const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!clen) return 0; + if (!clen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = 0; + } + while (clen >= 64) { + crypto_core_salsa208(c, in, kcopy, NULL); - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) in[i] = 0; + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - while (clen >= 64) { - crypto_core_salsa208(c,in,kcopy,NULL); - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + clen -= 64; + c += 64; } - clen -= 64; - c += 64; - } + if (clen) { + crypto_core_salsa208(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)clen; ++i) { + c[i] = block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); - if (clen) { - crypto_core_salsa208(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) clen;++i) c[i] = block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); - - return 0; + return 0; } diff --git a/src/libsodium/crypto_stream/salsa208/ref/xor_salsa208.c b/src/libsodium/crypto_stream/salsa208/ref/xor_salsa208.c index fdbd5938..d790507c 100644 --- a/src/libsodium/crypto_stream/salsa208/ref/xor_salsa208.c +++ b/src/libsodium/crypto_stream/salsa208/ref/xor_salsa208.c @@ -8,47 +8,54 @@ Public domain. #include "crypto_stream_salsa208.h" #include "utils.h" -int crypto_stream_salsa208_xor( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_salsa208_xor(unsigned char *c, const unsigned char *m, + unsigned long long mlen, const unsigned char *n, + const unsigned char *k) { - unsigned char in[16]; - unsigned char block[64]; - unsigned char kcopy[32]; - unsigned int i; - unsigned int u; + unsigned char in[16]; + unsigned char block[64]; + unsigned char kcopy[32]; + unsigned int i; + unsigned int u; - if (!mlen) return 0; + if (!mlen) { + return 0; + } + for (i = 0; i < 32; ++i) { + kcopy[i] = k[i]; + } + for (i = 0; i < 8; ++i) { + in[i] = n[i]; + } + for (i = 8; i < 16; ++i) { + in[i] = 0; + } + while (mlen >= 64) { + crypto_core_salsa208(block, in, kcopy, NULL); + for (i = 0; i < 64; ++i) { + c[i] = m[i] ^ block[i]; + } + u = 1; + for (i = 8; i < 16; ++i) { + u += (unsigned int)in[i]; + in[i] = u; + u >>= 8; + } - for (i = 0;i < 32;++i) kcopy[i] = k[i]; - for (i = 0;i < 8;++i) in[i] = n[i]; - for (i = 8;i < 16;++i) in[i] = 0; - - while (mlen >= 64) { - crypto_core_salsa208(block,in,kcopy,NULL); - for (i = 0;i < 64;++i) c[i] = m[i] ^ block[i]; - - u = 1; - for (i = 8;i < 16;++i) { - u += (unsigned int) in[i]; - in[i] = u; - u >>= 8; + mlen -= 64; + c += 64; + m += 64; } - mlen -= 64; - c += 64; - m += 64; - } + if (mlen) { + crypto_core_salsa208(block, in, kcopy, NULL); + for (i = 0; i < (unsigned int)mlen; ++i) { + c[i] = m[i] ^ block[i]; + } + } + sodium_memzero(block, sizeof block); + sodium_memzero(kcopy, sizeof kcopy); - if (mlen) { - crypto_core_salsa208(block,in,kcopy,NULL); - for (i = 0;i < (unsigned int) mlen;++i) c[i] = m[i] ^ block[i]; - } - sodium_memzero(block, sizeof block); - sodium_memzero(kcopy, sizeof kcopy); - - return 0; + return 0; } diff --git a/src/libsodium/crypto_stream/xsalsa20/ref/stream_xsalsa20.c b/src/libsodium/crypto_stream/xsalsa20/ref/stream_xsalsa20.c index 1e6513a8..07f1aa9c 100644 --- a/src/libsodium/crypto_stream/xsalsa20/ref/stream_xsalsa20.c +++ b/src/libsodium/crypto_stream/xsalsa20/ref/stream_xsalsa20.c @@ -9,16 +9,16 @@ Public domain. #include "crypto_stream_xsalsa20.h" #include "utils.h" -int crypto_stream_xsalsa20( - unsigned char *c,unsigned long long clen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_xsalsa20(unsigned char *c, unsigned long long clen, + const unsigned char *n, const unsigned char *k) { - unsigned char subkey[32]; - int ret; - crypto_core_hsalsa20(subkey,n,k,NULL); - ret = crypto_stream_salsa20(c,clen,n + 16,subkey); - sodium_memzero(subkey, sizeof subkey); - return ret; + unsigned char subkey[32]; + int ret; + + crypto_core_hsalsa20(subkey, n, k, NULL); + ret = crypto_stream_salsa20(c, clen, n + 16, subkey); + sodium_memzero(subkey, sizeof subkey); + + return ret; } diff --git a/src/libsodium/crypto_stream/xsalsa20/ref/xor_xsalsa20.c b/src/libsodium/crypto_stream/xsalsa20/ref/xor_xsalsa20.c index 7a4562b6..76bd35ea 100644 --- a/src/libsodium/crypto_stream/xsalsa20/ref/xor_xsalsa20.c +++ b/src/libsodium/crypto_stream/xsalsa20/ref/xor_xsalsa20.c @@ -9,27 +9,25 @@ Public domain. #include "crypto_stream_xsalsa20.h" #include "utils.h" -int crypto_stream_xsalsa20_xor_ic( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n,uint64_t ic, - const unsigned char *k -) +int +crypto_stream_xsalsa20_xor_ic(unsigned char *c, const unsigned char *m, + unsigned long long mlen, const unsigned char *n, + uint64_t ic, const unsigned char *k) { - unsigned char subkey[32]; - int ret; - crypto_core_hsalsa20(subkey,n,k,NULL); - ret = crypto_stream_salsa20_xor_ic(c,m,mlen,n + 16,ic,subkey); - sodium_memzero(subkey, sizeof subkey); - return ret; + unsigned char subkey[32]; + int ret; + + crypto_core_hsalsa20(subkey, n, k, NULL); + ret = crypto_stream_salsa20_xor_ic(c, m, mlen, n + 16, ic, subkey); + sodium_memzero(subkey, sizeof subkey); + + return ret; } -int crypto_stream_xsalsa20_xor( - unsigned char *c, - const unsigned char *m,unsigned long long mlen, - const unsigned char *n, - const unsigned char *k -) +int +crypto_stream_xsalsa20_xor(unsigned char *c, const unsigned char *m, + unsigned long long mlen, const unsigned char *n, + const unsigned char *k) { - return crypto_stream_xsalsa20_xor_ic(c, m, mlen, n, 0ULL, k); + return crypto_stream_xsalsa20_xor_ic(c, m, mlen, n, 0ULL, k); }