From 23bba4a2b2f3833d82854084d8fcacf200f0f96c Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 21 May 2020 18:22:37 +0200 Subject: [PATCH 01/12] crypto_box_seal(): copy the key after encryption to support in-place encryption Fixes #961 --- src/libsodium/crypto_box/crypto_box_seal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libsodium/crypto_box/crypto_box_seal.c b/src/libsodium/crypto_box/crypto_box_seal.c index 71813345..e01d6498 100644 --- a/src/libsodium/crypto_box/crypto_box_seal.c +++ b/src/libsodium/crypto_box/crypto_box_seal.c @@ -32,10 +32,10 @@ crypto_box_seal(unsigned char *c, const unsigned char *m, if (crypto_box_keypair(epk, esk) != 0) { return -1; /* LCOV_EXCL_LINE */ } - memcpy(c, epk, crypto_box_PUBLICKEYBYTES); _crypto_box_seal_nonce(nonce, epk, pk); ret = crypto_box_easy(c + crypto_box_PUBLICKEYBYTES, m, mlen, nonce, pk, esk); + memcpy(c, epk, crypto_box_PUBLICKEYBYTES); sodium_memzero(esk, sizeof esk); sodium_memzero(epk, sizeof epk); sodium_memzero(nonce, sizeof nonce); From 1127c43278870a9cde46ab5fbefc0bbcb814c2b9 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 21 May 2020 18:37:50 +0200 Subject: [PATCH 02/12] Add extra box_seal() tests --- .../box_seal_curve25519xchacha20poly1305.c | 2 +- test/default/box_seal.c | 68 ++++++++++++++++++- 2 files changed, 67 insertions(+), 3 deletions(-) diff --git a/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_seal_curve25519xchacha20poly1305.c b/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_seal_curve25519xchacha20poly1305.c index 9e73a265..0240f036 100644 --- a/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_seal_curve25519xchacha20poly1305.c +++ b/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_seal_curve25519xchacha20poly1305.c @@ -38,11 +38,11 @@ crypto_box_curve25519xchacha20poly1305_seal(unsigned char *c, const unsigned cha if (crypto_box_curve25519xchacha20poly1305_keypair(epk, esk) != 0) { return -1; /* LCOV_EXCL_LINE */ } - memcpy(c, epk, crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES); _crypto_box_curve25519xchacha20poly1305_seal_nonce(nonce, epk, pk); ret = crypto_box_curve25519xchacha20poly1305_easy( c + crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES, m, mlen, nonce, pk, esk); + memcpy(c, epk, crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES); sodium_memzero(esk, sizeof esk); sodium_memzero(epk, sizeof epk); sodium_memzero(nonce, sizeof nonce); diff --git a/test/default/box_seal.c b/test/default/box_seal.c index 01765ca8..e0f32b13 100644 --- a/test/default/box_seal.c +++ b/test/default/box_seal.c @@ -41,9 +41,38 @@ void tv1(void) assert(crypto_box_sealbytes() == crypto_box_SEALBYTES); } -#ifndef SODIUM_LIBRARY_MINIMAL static void tv2(void) +{ + unsigned char pk[crypto_box_PUBLICKEYBYTES]; + unsigned char sk[crypto_box_SECRETKEYBYTES]; + unsigned char *cm; + unsigned char *m2; + size_t m_len; + size_t cm_len; + + crypto_box_keypair(pk, sk); + m_len = (size_t) randombytes_uniform(1000); + cm_len = crypto_box_SEALBYTES + m_len; + m2 = (unsigned char *) sodium_malloc(m_len); + cm = (unsigned char *) sodium_malloc(cm_len); + randombytes_buf(cm, m_len); + if (crypto_box_seal(cm, cm, m_len, pk) != 0) { + printf("crypto_box_seal() failure\n"); + return; + } + if (crypto_box_seal_open(m2, cm, cm_len, pk, sk) != 0) { + printf("crypto_box_seal_open() failure\n"); + return; + } + assert(memcmp(cm, m2, m_len) != 0); + sodium_free(cm); + sodium_free(m2); +} + +#ifndef SODIUM_LIBRARY_MINIMAL +static +void tv3(void) { unsigned char pk[crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES]; unsigned char sk[crypto_box_curve25519xchacha20poly1305_SECRETKEYBYTES]; @@ -82,13 +111,46 @@ void tv2(void) crypto_box_curve25519xchacha20poly1305_SEALBYTES); } +static +void tv4(void) +{ + unsigned char pk[crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES]; + unsigned char sk[crypto_box_curve25519xchacha20poly1305_SECRETKEYBYTES]; + unsigned char *cm; + unsigned char *m2; + size_t m_len; + size_t cm_len; + + crypto_box_curve25519xchacha20poly1305_keypair(pk, sk); + m_len = (size_t) randombytes_uniform(1000); + cm_len = crypto_box_curve25519xchacha20poly1305_SEALBYTES + m_len; + m2 = (unsigned char *) sodium_malloc(m_len); + cm = (unsigned char *) sodium_malloc(cm_len); + randombytes_buf(cm, m_len); + if (crypto_box_curve25519xchacha20poly1305_seal(cm, cm, m_len, pk) != 0) { + printf("crypto_box_curve25519xchacha20poly1305_seal() failure\n"); + return; + } + if (crypto_box_curve25519xchacha20poly1305_seal_open(m2, cm, cm_len, pk, sk) != 0) { + printf("crypto_box_curve25519xchacha20poly1305_seal_open() failure\n"); + return; + } + assert(memcmp(cm, m2, m_len) != 0); + sodium_free(cm); + sodium_free(m2); +} + #else static -void tv2(void) +void tv3(void) { printf("0\n-1\n-1\n-1\n"); } + +static +void tv4(void) +{ } #endif int @@ -96,6 +158,8 @@ main(void) { tv1(); tv2(); + tv3(); + tv4(); return 0; } From f911b56650b680ecfc5d32b11b090849fc2b5f92 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 21 May 2020 18:44:58 +0200 Subject: [PATCH 03/12] Travis CI: use autogen -d --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 7dcb1b8d..33910fcd 100644 --- a/.travis.yml +++ b/.travis.yml @@ -11,7 +11,7 @@ compiler: - g++ install: - - ./autogen.sh -f + - ./autogen.sh -s - env CC=tcc CFLAGS='-w' CPPFLAGS="-DDEV_MODE=1" ./configure --prefix=/tmp --disable-dependency-tracking --disable-shared || cat config.log - make -j $(nproc) && make check && make install - env CC=tcc CPPFLAGS='-I/tmp/include' LDFLAGS='-L/tmp/lib' LD_LIBRARY_PATH='/tmp/lib' ./test/constcheck.sh From 214076fc09bd3b5bbc237d870738259ff48cb604 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 25 May 2020 21:44:56 +0200 Subject: [PATCH 04/12] Replace the multiplication by the group order with an addition chain. Rename ge25519_{add,sub,madd,msub} for clarity. --- .../crypto_core/ed25519/core_ed25519.c | 4 +- .../crypto_core/ed25519/core_ristretto255.c | 4 +- .../crypto_core/ed25519/ref10/ed25519_ref10.c | 176 +++++++++++------- src/libsodium/include/sodium/private/quirks.h | 4 +- test/symbols/all-symbols.txt | 4 +- 5 files changed, 114 insertions(+), 78 deletions(-) diff --git a/src/libsodium/crypto_core/ed25519/core_ed25519.c b/src/libsodium/crypto_core/ed25519/core_ed25519.c index eb278e96..beb1a6ad 100644 --- a/src/libsodium/crypto_core/ed25519/core_ed25519.c +++ b/src/libsodium/crypto_core/ed25519/core_ed25519.c @@ -38,7 +38,7 @@ crypto_core_ed25519_add(unsigned char *r, return -1; } ge25519_p3_to_cached(&q_cached, &q_p3); - ge25519_add(&r_p1p1, &p_p3, &q_cached); + ge25519_add_cached(&r_p1p1, &p_p3, &q_cached); ge25519_p1p1_to_p3(&r_p3, &r_p1p1); ge25519_p3_tobytes(r, &r_p3); @@ -58,7 +58,7 @@ crypto_core_ed25519_sub(unsigned char *r, return -1; } ge25519_p3_to_cached(&q_cached, &q_p3); - ge25519_sub(&r_p1p1, &p_p3, &q_cached); + ge25519_sub_cached(&r_p1p1, &p_p3, &q_cached); ge25519_p1p1_to_p3(&r_p3, &r_p1p1); ge25519_p3_tobytes(r, &r_p3); diff --git a/src/libsodium/crypto_core/ed25519/core_ristretto255.c b/src/libsodium/crypto_core/ed25519/core_ristretto255.c index 26a5c1f3..ab3f7757 100644 --- a/src/libsodium/crypto_core/ed25519/core_ristretto255.c +++ b/src/libsodium/crypto_core/ed25519/core_ristretto255.c @@ -32,7 +32,7 @@ crypto_core_ristretto255_add(unsigned char *r, return -1; } ge25519_p3_to_cached(&q_cached, &q_p3); - ge25519_add(&r_p1p1, &p_p3, &q_cached); + ge25519_add_cached(&r_p1p1, &p_p3, &q_cached); ge25519_p1p1_to_p3(&r_p3, &r_p1p1); ristretto255_p3_tobytes(r, &r_p3); @@ -52,7 +52,7 @@ crypto_core_ristretto255_sub(unsigned char *r, return -1; } ge25519_p3_to_cached(&q_cached, &q_p3); - ge25519_sub(&r_p1p1, &p_p3, &q_cached); + ge25519_sub_cached(&r_p1p1, &p_p3, &q_cached); ge25519_p1p1_to_p3(&r_p3, &r_p1p1); ristretto255_p3_tobytes(r, &r_p3); diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index 0e743590..b37a212d 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -213,7 +213,7 @@ fe25519_sqrt(fe25519 x, const fe25519 x2) */ void -ge25519_add(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q) +ge25519_add_cached(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q) { fe25519 t0; @@ -368,7 +368,7 @@ ge25519_frombytes_negate_vartime(ge25519_p3 *h, const unsigned char *s) */ static void -ge25519_madd(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_precomp *q) +ge25519_add_precomp(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_precomp *q) { fe25519 t0; @@ -389,7 +389,7 @@ ge25519_madd(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_precomp *q) */ static void -ge25519_msub(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_precomp *q) +ge25519_sub_precomp(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_precomp *q) { fe25519 t0; @@ -657,7 +657,7 @@ ge25519_cmov8_cached(ge25519_cached *t, const ge25519_cached cached[8], const si */ void -ge25519_sub(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q) +ge25519_sub_cached(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q) { fe25519 t0; @@ -724,31 +724,31 @@ ge25519_double_scalarmult_vartime(ge25519_p2 *r, const unsigned char *a, ge25519_p3_dbl(&t, A); ge25519_p1p1_to_p3(&A2, &t); - ge25519_add(&t, &A2, &Ai[0]); + ge25519_add_cached(&t, &A2, &Ai[0]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[1], &u); - ge25519_add(&t, &A2, &Ai[1]); + ge25519_add_cached(&t, &A2, &Ai[1]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[2], &u); - ge25519_add(&t, &A2, &Ai[2]); + ge25519_add_cached(&t, &A2, &Ai[2]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[3], &u); - ge25519_add(&t, &A2, &Ai[3]); + ge25519_add_cached(&t, &A2, &Ai[3]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[4], &u); - ge25519_add(&t, &A2, &Ai[4]); + ge25519_add_cached(&t, &A2, &Ai[4]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[5], &u); - ge25519_add(&t, &A2, &Ai[5]); + ge25519_add_cached(&t, &A2, &Ai[5]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[6], &u); - ge25519_add(&t, &A2, &Ai[6]); + ge25519_add_cached(&t, &A2, &Ai[6]); ge25519_p1p1_to_p3(&u, &t); ge25519_p3_to_cached(&Ai[7], &u); @@ -765,18 +765,18 @@ ge25519_double_scalarmult_vartime(ge25519_p2 *r, const unsigned char *a, if (aslide[i] > 0) { ge25519_p1p1_to_p3(&u, &t); - ge25519_add(&t, &u, &Ai[aslide[i] / 2]); + ge25519_add_cached(&t, &u, &Ai[aslide[i] / 2]); } else if (aslide[i] < 0) { ge25519_p1p1_to_p3(&u, &t); - ge25519_sub(&t, &u, &Ai[(-aslide[i]) / 2]); + ge25519_sub_cached(&t, &u, &Ai[(-aslide[i]) / 2]); } if (bslide[i] > 0) { ge25519_p1p1_to_p3(&u, &t); - ge25519_madd(&t, &u, &Bi[bslide[i] / 2]); + ge25519_add_precomp(&t, &u, &Bi[bslide[i] / 2]); } else if (bslide[i] < 0) { ge25519_p1p1_to_p3(&u, &t); - ge25519_msub(&t, &u, &Bi[(-bslide[i]) / 2]); + ge25519_sub_precomp(&t, &u, &Bi[(-bslide[i]) / 2]); } ge25519_p1p1_to_p2(r, &t); @@ -812,7 +812,7 @@ ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a, const ge25519_p3 *p) ge25519_p1p1_to_p3(&p2, &t2); ge25519_p3_to_cached(&pi[2 - 1], &p2); /* 2p = 2*p */ - ge25519_add(&t3, p, &pi[2 - 1]); + ge25519_add_cached(&t3, p, &pi[2 - 1]); ge25519_p1p1_to_p3(&p3, &t3); ge25519_p3_to_cached(&pi[3 - 1], &p3); /* 3p = 2p+p */ @@ -820,7 +820,7 @@ ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a, const ge25519_p3 *p) ge25519_p1p1_to_p3(&p4, &t4); ge25519_p3_to_cached(&pi[4 - 1], &p4); /* 4p = 2*2p */ - ge25519_add(&t5, p, &pi[4 - 1]); + ge25519_add_cached(&t5, p, &pi[4 - 1]); ge25519_p1p1_to_p3(&p5, &t5); ge25519_p3_to_cached(&pi[5 - 1], &p5); /* 5p = 4p+p */ @@ -828,7 +828,7 @@ ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a, const ge25519_p3 *p) ge25519_p1p1_to_p3(&p6, &t6); ge25519_p3_to_cached(&pi[6 - 1], &p6); /* 6p = 2*3p */ - ge25519_add(&t7, p, &pi[6 - 1]); + ge25519_add_cached(&t7, p, &pi[6 - 1]); ge25519_p1p1_to_p3(&p7, &t7); ge25519_p3_to_cached(&pi[7 - 1], &p7); /* 7p = 6p+p */ @@ -857,7 +857,7 @@ ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a, const ge25519_p3 *p) for (i = 63; i != 0; i--) { ge25519_cmov8_cached(&t, pi, e[i]); - ge25519_add(&r, h, &t); + ge25519_add_cached(&r, h, &t); ge25519_p1p1_to_p2(&s, &r); ge25519_p2_dbl(&r, &s); @@ -871,7 +871,7 @@ ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a, const ge25519_p3 *p) ge25519_p1p1_to_p3(h, &r); /* *16 */ } ge25519_cmov8_cached(&t, pi, e[i]); - ge25519_add(&r, h, &t); + ge25519_add_cached(&r, h, &t); ge25519_p1p1_to_p3(h, &r); } @@ -917,7 +917,7 @@ ge25519_scalarmult_base(ge25519_p3 *h, const unsigned char *a) for (i = 1; i < 64; i += 2) { ge25519_cmov8_base(&t, i / 2, e[i]); - ge25519_madd(&r, h, &t); + ge25519_add_precomp(&r, h, &t); ge25519_p1p1_to_p3(h, &r); } @@ -932,64 +932,100 @@ ge25519_scalarmult_base(ge25519_p3 *h, const unsigned char *a) for (i = 0; i < 64; i += 2) { ge25519_cmov8_base(&t, i / 2, e[i]); - ge25519_madd(&r, h, &t); + ge25519_add_precomp(&r, h, &t); ge25519_p1p1_to_p3(h, &r); } } +static void +ge25519_p3_dbl_n(ge25519_p3 *r, const ge25519_p3 *p, const int n) +{ + ge25519_p2 p2; + ge25519_p1p1 p1p1; + int i; + + ge25519_p3_to_p2(&p2, p); + for (i = 0; i < n; i++) { + ge25519_p2_dbl(&p1p1, &p2); + ge25519_p1p1_to_p2(&p2, &p1p1); + } + ge25519_p1p1_to_p3(r, &p1p1); +} + +static void +ge25519_p3_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q) +{ + ge25519_cached q_cached; + ge25519_p1p1 p1p1; + + ge25519_p3_to_cached(&q_cached, q); + ge25519_add_cached(&p1p1, p, &q_cached); + ge25519_p1p1_to_p3(r, &p1p1); +} + /* multiply by the order of the main subgroup l = 2^252+27742317777372353535851937790883648493 */ static void -ge25519_mul_l(ge25519_p3 *r, const ge25519_p3 *A) +ge25519_mul_l(ge25519_p3 *r, const ge25519_p3 *p) { - static const signed char aslide[253] = { - 13, 0, 0, 0, 0, -1, 0, 0, 0, 0, -11, 0, 0, 0, 0, 0, 0, -5, 0, 0, 0, 0, 0, 0, -3, 0, 0, 0, 0, -13, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, -13, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, -13, 0, 0, 0, 0, 0, 0, -3, 0, 0, 0, 0, 0, -1, 0, 0, 0, 0, 3, 0, 0, 0, 0, -11, 0, 0, 0, 0, 0, 0, 0, 15, 0, 0, 0, 0, 0, -1, 0, 0, 0, 0, -1, 0, 0, 0, 0, 7, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1 - }; - ge25519_cached Ai[8]; - ge25519_p1p1 t; - ge25519_p3 u; - ge25519_p3 A2; - int i; + ge25519_p3 _10, _11, _100, _110, _1000, _1011, _10000, _100000, _100110, + _1000000, _1010000, _1010011, _1100011, _1100111, _1101011, _10010011, + _10010111, _10111101, _11010011, _11100111, _11101101, _11110101, + i160, i179, i209, i232, i263, res; - ge25519_p3_to_cached(&Ai[0], A); - ge25519_p3_dbl(&t, A); - ge25519_p1p1_to_p3(&A2, &t); - ge25519_add(&t, &A2, &Ai[0]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[1], &u); - ge25519_add(&t, &A2, &Ai[1]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[2], &u); - ge25519_add(&t, &A2, &Ai[2]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[3], &u); - ge25519_add(&t, &A2, &Ai[3]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[4], &u); - ge25519_add(&t, &A2, &Ai[4]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[5], &u); - ge25519_add(&t, &A2, &Ai[5]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[6], &u); - ge25519_add(&t, &A2, &Ai[6]); - ge25519_p1p1_to_p3(&u, &t); - ge25519_p3_to_cached(&Ai[7], &u); + ge25519_p3_dbl_n(&_10, p, 1); + ge25519_p3_add(&_11, p, &_10); + ge25519_p3_add(&_100, p, &_11); + ge25519_p3_add(&_110, &_10, &_100); + ge25519_p3_add(&_1000, &_10, &_110); + ge25519_p3_add(&_1011, &_11, &_1000); + ge25519_p3_dbl_n(&_10000, &_1000, 1); + ge25519_p3_dbl_n(&_100000, &_10000, 1); + ge25519_p3_add(&_100110, &_110, &_100000); + ge25519_p3_dbl_n(&_1000000, &_100000, 1); + ge25519_p3_add(&_1010000, &_10000, &_1000000); + ge25519_p3_add(&_1010011, &_11, &_1010000); + ge25519_p3_add(&_1100011, &_10000, &_1010011); + ge25519_p3_add(&_1100111, &_100, &_1100011); + ge25519_p3_add(&_1101011, &_100, &_1100111); + ge25519_p3_add(&_10010011, &_1000000, &_1010011); + ge25519_p3_add(&_10010111, &_100, &_10010011); + ge25519_p3_add(&_10111101, &_100110, &_10010111); + ge25519_p3_add(&_11010011, &_1000000, &_10010011); + ge25519_p3_add(&_11100111, &_1010000, &_10010111); + ge25519_p3_add(&_11101101, &_110, &_11100111); + ge25519_p3_add(&_11110101, &_1000, &_11101101); - ge25519_p3_0(r); + ge25519_p3_add(&i160, &_1011, &_11110101); + ge25519_p3_dbl_n(&i160, &i160, 126); + ge25519_p3_add(&i160, &i160, &_1010011); + ge25519_p3_dbl_n(&i160, &i160, 9); + ge25519_p3_add(&i160, &i160, &_10); + ge25519_p3_add(&i179, &_11110101, &i160); + ge25519_p3_dbl_n(&i179, &i179, 7); + ge25519_p3_add(&i179, &i179, &_1100111); + ge25519_p3_dbl_n(&i179, &i179, 9); + ge25519_p3_add(&i179, &i179, &_11110101); + ge25519_p3_dbl_n(&i209, &i179, 11); + ge25519_p3_add(&i209, &i209, &_10111101); + ge25519_p3_dbl_n(&i209, &i209, 8); + ge25519_p3_add(&i209, &i209, &_11100111); + ge25519_p3_dbl_n(&i209, &i209, 9); + ge25519_p3_add(&i232, &_1101011, &i209); + ge25519_p3_dbl_n(&i232, &i232, 6); + ge25519_p3_add(&i232, &i232, &_1011); + ge25519_p3_dbl_n(&i232, &i232, 14); + ge25519_p3_add(&i232, &i232, &_10010011); + ge25519_p3_dbl_n(&i263, &i232, 10); + ge25519_p3_add(&i263, &i263, &_1100011); + ge25519_p3_dbl_n(&i263, &i263, 9); + ge25519_p3_add(&i263, &i263, &_10010111); + ge25519_p3_dbl_n(&i263, &i263, 10); - for (i = 252; i >= 0; --i) { - ge25519_p3_dbl(&t, r); - - if (aslide[i] > 0) { - ge25519_p1p1_to_p3(&u, &t); - ge25519_add(&t, &u, &Ai[aslide[i] / 2]); - } else if (aslide[i] < 0) { - ge25519_p1p1_to_p3(&u, &t); - ge25519_sub(&t, &u, &Ai[(-aslide[i]) / 2]); - } - - ge25519_p1p1_to_p3(r, &t); - } + ge25519_p3_add(&res, &_11110101, &i263); + ge25519_p3_dbl_n(&res, &res, 8); + ge25519_p3_add(&res, &res, &_11010011); + ge25519_p3_dbl_n(&res, &res, 8); + ge25519_p3_add(r, &res, &_11101101); } int @@ -2949,7 +2985,7 @@ ristretto255_from_hash(unsigned char s[32], const unsigned char h[64]) ristretto255_elligator(&p0, r0); ristretto255_elligator(&p1, r1); ge25519_p3_to_cached(&p1_cached, &p1); - ge25519_add(&p_p1p1, &p0, &p1_cached); + ge25519_add_cached(&p_p1p1, &p0, &p1_cached); ge25519_p1p1_to_p3(&p, &p_p1p1); ristretto255_p3_tobytes(s, &p); } diff --git a/src/libsodium/include/sodium/private/quirks.h b/src/libsodium/include/sodium/private/quirks.h index 858548da..96737cf4 100644 --- a/src/libsodium/include/sodium/private/quirks.h +++ b/src/libsodium/include/sodium/private/quirks.h @@ -50,7 +50,7 @@ #define fe25519_frombytes _sodium_fe25519_frombytes #define fe25519_invert _sodium_fe25519_invert #define fe25519_tobytes _sodium_fe25519_tobytes -#define ge25519_add _sodium_ge25519_add +#define ge25519_add_cached _sodium_ge25519_add_cached #define ge25519_double_scalarmult_vartime _sodium_ge25519_double_scalarmult_vartime #define ge25519_from_hash _sodium_ge25519_from_hash #define ge25519_from_uniform _sodium_ge25519_from_uniform @@ -66,7 +66,7 @@ #define ge25519_p3_tobytes _sodium_ge25519_p3_tobytes #define ge25519_scalarmult _sodium_ge25519_scalarmult #define ge25519_scalarmult_base _sodium_ge25519_scalarmult_base -#define ge25519_sub _sodium_ge25519_sub +#define ge25519_sub_cached _sodium_ge25519_sub_cached #define ge25519_tobytes _sodium_ge25519_tobytes #define ristretto255_from_hash _sodium_ristretto255_from_hash #define ristretto255_frombytes _sodium_ristretto255_frombytes diff --git a/test/symbols/all-symbols.txt b/test/symbols/all-symbols.txt index 18f4253f..c971bad5 100644 --- a/test/symbols/all-symbols.txt +++ b/test/symbols/all-symbols.txt @@ -637,7 +637,7 @@ escrypt_r fe25519_frombytes fe25519_invert fe25519_tobytes -ge25519_add +ge25519_add_cached ge25519_double_scalarmult_vartime ge25519_from_hash ge25519_from_uniform @@ -653,7 +653,7 @@ ge25519_p3_to_cached ge25519_p3_tobytes ge25519_scalarmult ge25519_scalarmult_base -ge25519_sub +ge25519_sub_cached ge25519_tobytes randombytes randombytes_buf From b0369e73919f9c85a350565bae2915127b7d2014 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 00:15:42 +0200 Subject: [PATCH 05/12] Update prototypes --- src/libsodium/include/sodium/private/ed25519_ref10.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsodium/include/sodium/private/ed25519_ref10.h b/src/libsodium/include/sodium/private/ed25519_ref10.h index 0d3bd373..fa6ca280 100644 --- a/src/libsodium/include/sodium/private/ed25519_ref10.h +++ b/src/libsodium/include/sodium/private/ed25519_ref10.h @@ -89,9 +89,9 @@ void ge25519_p1p1_to_p2(ge25519_p2 *r, const ge25519_p1p1 *p); void ge25519_p1p1_to_p3(ge25519_p3 *r, const ge25519_p1p1 *p); -void ge25519_add(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q); +void ge25519_add_cached(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q); -void ge25519_sub(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q); +void ge25519_sub_cached(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q); void ge25519_scalarmult_base(ge25519_p3 *h, const unsigned char *a); From f9ef57db0b06b0b7d0c5527d7e65599e3d514d6d Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 13:01:00 +0200 Subject: [PATCH 06/12] Faster sc25519 inversion, with one less squaring --- .../crypto_core/ed25519/ref10/ed25519_ref10.c | 80 ++++++++++--------- 1 file changed, 43 insertions(+), 37 deletions(-) diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index b37a212d..1f29da86 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -2136,46 +2136,52 @@ sc25519_sqmul(unsigned char s[32], const int n, const unsigned char a[32]) void sc25519_invert(unsigned char recip[32], const unsigned char s[32]) { - unsigned char _10[32], _100[32], _11[32], _101[32], _111[32], - _1001[32], _1011[32], _1111[32]; + unsigned char _10[32], _100[32], _1000[32], _10000[32], _100000[32], + _1000000[32], _10010011[32], _10010111[32], _100110[32], _1010[32], + _1010000[32], _1010011[32], _1011[32], _10110[32], _10111101[32], + _11[32], _1100011[32], _1100111[32], _11010011[32], _1101011[32], + _11100111[32], _11101011[32], _11110101[32]; sc25519_sq(_10, s); - sc25519_sq(_100, _10); - sc25519_mul(_11, _10, s); - sc25519_mul(_101, _10, _11); - sc25519_mul(_111, _10, _101); - sc25519_mul(_1001, _10, _111); - sc25519_mul(_1011, _10, _1001); - sc25519_mul(_1111, _100, _1011); - sc25519_mul(recip, _1111, s); + sc25519_mul(_11, s, _10); + sc25519_mul(_100, s, _11); + sc25519_sq(_1000, _100); + sc25519_mul(_1010, _10, _1000); + sc25519_mul(_1011, s, _1010); + sc25519_sq(_10000, _1000); + sc25519_sq(_10110, _1011); + sc25519_mul(_100000, _1010, _10110); + sc25519_mul(_100110, _10000, _10110); + sc25519_sq(_1000000, _100000); + sc25519_mul(_1010000, _10000, _1000000); + sc25519_mul(_1010011, _11, _1010000); + sc25519_mul(_1100011, _10000, _1010011); + sc25519_mul(_1100111, _100, _1100011); + sc25519_mul(_1101011, _100, _1100111); + sc25519_mul(_10010011, _1000000, _1010011); + sc25519_mul(_10010111, _100, _10010011); + sc25519_mul(_10111101, _100110, _10010111); + sc25519_mul(_11010011, _10110, _10111101); + sc25519_mul(_11100111, _1010000, _10010111); + sc25519_mul(_11101011, _100, _11100111); + sc25519_mul(_11110101, _1010, _11101011); - sc25519_sqmul(recip, 123 + 3, _101); - sc25519_sqmul(recip, 2 + 2, _11); - sc25519_sqmul(recip, 1 + 4, _1111); - sc25519_sqmul(recip, 1 + 4, _1111); - sc25519_sqmul(recip, 4, _1001); - sc25519_sqmul(recip, 2, _11); - sc25519_sqmul(recip, 1 + 4, _1111); - sc25519_sqmul(recip, 1 + 3, _101); - sc25519_sqmul(recip, 3 + 3, _101); - sc25519_sqmul(recip, 3, _111); - sc25519_sqmul(recip, 1 + 4, _1111); - sc25519_sqmul(recip, 2 + 3, _111); - sc25519_sqmul(recip, 2 + 2, _11); - sc25519_sqmul(recip, 1 + 4, _1011); - sc25519_sqmul(recip, 2 + 4, _1011); - sc25519_sqmul(recip, 6 + 4, _1001); - sc25519_sqmul(recip, 2 + 2, _11); - sc25519_sqmul(recip, 3 + 2, _11); - sc25519_sqmul(recip, 3 + 2, _11); - sc25519_sqmul(recip, 1 + 4, _1001); - sc25519_sqmul(recip, 1 + 3, _111); - sc25519_sqmul(recip, 2 + 4, _1111); - sc25519_sqmul(recip, 1 + 4, _1011); - sc25519_sqmul(recip, 3, _101); - sc25519_sqmul(recip, 2 + 4, _1111); - sc25519_sqmul(recip, 3, _101); - sc25519_sqmul(recip, 1 + 2, _11); + sc25519_mul(recip, _1011, _11110101); + sc25519_sqmul(recip, 126, _1010011); + sc25519_sqmul(recip, 9, _10); + sc25519_mul(recip, recip, _11110101); + sc25519_sqmul(recip, 7, _1100111); + sc25519_sqmul(recip, 9, _11110101); + sc25519_sqmul(recip, 11, _10111101); + sc25519_sqmul(recip, 8, _11100111); + sc25519_sqmul(recip, 9, _1101011); + sc25519_sqmul(recip, 6, _1011); + sc25519_sqmul(recip, 14, _10010011); + sc25519_sqmul(recip, 10, _1100011); + sc25519_sqmul(recip, 9, _10010111); + sc25519_sqmul(recip, 10, _11110101); + sc25519_sqmul(recip, 8, _11010011); + sc25519_sqmul(recip, 8, _11101011); } /* From d854d39b516f54efe3c790fa7d388451e75124fb Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 13:29:37 +0200 Subject: [PATCH 07/12] Shorten --- .../crypto_core/ed25519/ref10/ed25519_ref10.c | 87 +++++++++---------- 1 file changed, 42 insertions(+), 45 deletions(-) diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index 1f29da86..77bb3244 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -937,21 +937,17 @@ ge25519_scalarmult_base(ge25519_p3 *h, const unsigned char *a) } } +/* r = 2p */ static void -ge25519_p3_dbl_n(ge25519_p3 *r, const ge25519_p3 *p, const int n) +ge25519_p3p3_dbl(ge25519_p3 *r, const ge25519_p3 *p) { - ge25519_p2 p2; ge25519_p1p1 p1p1; - int i; - ge25519_p3_to_p2(&p2, p); - for (i = 0; i < n; i++) { - ge25519_p2_dbl(&p1p1, &p2); - ge25519_p1p1_to_p2(&p2, &p1p1); - } + ge25519_p3_dbl(&p1p1, p); ge25519_p1p1_to_p3(r, &p1p1); } +/* r = p+q */ static void ge25519_p3_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q) { @@ -963,25 +959,41 @@ ge25519_p3_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q) ge25519_p1p1_to_p3(r, &p1p1); } +/* r = r*(2^n)+q */ +static void +ge25519_p3_dbladd(ge25519_p3 *r, const int n, const ge25519_p3 *q) +{ + ge25519_p2 p2; + ge25519_p1p1 p1p1; + int i; + + ge25519_p3_to_p2(&p2, r); + for (i = 0; i < n; i++) { + ge25519_p2_dbl(&p1p1, &p2); + ge25519_p1p1_to_p2(&p2, &p1p1); + } + ge25519_p1p1_to_p3(r, &p1p1); + ge25519_p3_add(r, r, q); +} + /* multiply by the order of the main subgroup l = 2^252+27742317777372353535851937790883648493 */ static void ge25519_mul_l(ge25519_p3 *r, const ge25519_p3 *p) { ge25519_p3 _10, _11, _100, _110, _1000, _1011, _10000, _100000, _100110, _1000000, _1010000, _1010011, _1100011, _1100111, _1101011, _10010011, - _10010111, _10111101, _11010011, _11100111, _11101101, _11110101, - i160, i179, i209, i232, i263, res; + _10010111, _10111101, _11010011, _11100111, _11101101, _11110101; - ge25519_p3_dbl_n(&_10, p, 1); + ge25519_p3p3_dbl(&_10, p); ge25519_p3_add(&_11, p, &_10); ge25519_p3_add(&_100, p, &_11); ge25519_p3_add(&_110, &_10, &_100); ge25519_p3_add(&_1000, &_10, &_110); ge25519_p3_add(&_1011, &_11, &_1000); - ge25519_p3_dbl_n(&_10000, &_1000, 1); - ge25519_p3_dbl_n(&_100000, &_10000, 1); + ge25519_p3p3_dbl(&_10000, &_1000); + ge25519_p3p3_dbl(&_100000, &_10000); ge25519_p3_add(&_100110, &_110, &_100000); - ge25519_p3_dbl_n(&_1000000, &_100000, 1); + ge25519_p3p3_dbl(&_1000000, &_100000); ge25519_p3_add(&_1010000, &_10000, &_1000000); ge25519_p3_add(&_1010011, &_11, &_1010000); ge25519_p3_add(&_1100011, &_10000, &_1010011); @@ -995,37 +1007,22 @@ ge25519_mul_l(ge25519_p3 *r, const ge25519_p3 *p) ge25519_p3_add(&_11101101, &_110, &_11100111); ge25519_p3_add(&_11110101, &_1000, &_11101101); - ge25519_p3_add(&i160, &_1011, &_11110101); - ge25519_p3_dbl_n(&i160, &i160, 126); - ge25519_p3_add(&i160, &i160, &_1010011); - ge25519_p3_dbl_n(&i160, &i160, 9); - ge25519_p3_add(&i160, &i160, &_10); - ge25519_p3_add(&i179, &_11110101, &i160); - ge25519_p3_dbl_n(&i179, &i179, 7); - ge25519_p3_add(&i179, &i179, &_1100111); - ge25519_p3_dbl_n(&i179, &i179, 9); - ge25519_p3_add(&i179, &i179, &_11110101); - ge25519_p3_dbl_n(&i209, &i179, 11); - ge25519_p3_add(&i209, &i209, &_10111101); - ge25519_p3_dbl_n(&i209, &i209, 8); - ge25519_p3_add(&i209, &i209, &_11100111); - ge25519_p3_dbl_n(&i209, &i209, 9); - ge25519_p3_add(&i232, &_1101011, &i209); - ge25519_p3_dbl_n(&i232, &i232, 6); - ge25519_p3_add(&i232, &i232, &_1011); - ge25519_p3_dbl_n(&i232, &i232, 14); - ge25519_p3_add(&i232, &i232, &_10010011); - ge25519_p3_dbl_n(&i263, &i232, 10); - ge25519_p3_add(&i263, &i263, &_1100011); - ge25519_p3_dbl_n(&i263, &i263, 9); - ge25519_p3_add(&i263, &i263, &_10010111); - ge25519_p3_dbl_n(&i263, &i263, 10); - - ge25519_p3_add(&res, &_11110101, &i263); - ge25519_p3_dbl_n(&res, &res, 8); - ge25519_p3_add(&res, &res, &_11010011); - ge25519_p3_dbl_n(&res, &res, 8); - ge25519_p3_add(r, &res, &_11101101); + ge25519_p3_add(r, &_1011, &_11110101); + ge25519_p3_dbladd(r, 126, &_1010011); + ge25519_p3_dbladd(r, 9, &_10); + ge25519_p3_add(r, r, &_11110101); + ge25519_p3_dbladd(r, 7, &_1100111); + ge25519_p3_dbladd(r, 9, &_11110101); + ge25519_p3_dbladd(r, 11, &_10111101); + ge25519_p3_dbladd(r, 8, &_11100111); + ge25519_p3_dbladd(r, 9, &_1101011); + ge25519_p3_dbladd(r, 6, &_1011); + ge25519_p3_dbladd(r, 14, &_10010011); + ge25519_p3_dbladd(r, 10, &_1100011); + ge25519_p3_dbladd(r, 9, &_10010111); + ge25519_p3_dbladd(r, 10, &_11110101); + ge25519_p3_dbladd(r, 8, &_11010011); + ge25519_p3_dbladd(r, 8, &_11101101); } int From ef70441654bef5fe18f971dee95a71d62f79357d Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 14:26:24 +0200 Subject: [PATCH 08/12] Move AC_USE_SYSTEM_EXTENSIONS up --- configure.ac | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index bbfdc60e..3633cf6c 100644 --- a/configure.ac +++ b/configure.ac @@ -44,6 +44,10 @@ AS_IF([pwd | fgrep ' ' > /dev/null 2>&1], [AC_MSG_ERROR([The build directory contains whitespaces - This can cause tests/installation to fail due to limitations of some libtool versions])] ) +AC_PROG_CC_C99 +AM_PROG_AS +AC_USE_SYSTEM_EXTENSIONS + dnl Switches AC_ARG_ENABLE(ssp, @@ -210,9 +214,6 @@ AX_VALGRIND_CHECK dnl Checks -AC_PROG_CC_C99 -AM_PROG_AS -AC_USE_SYSTEM_EXTENSIONS AC_C_VARARRAYS AC_CHECK_DEFINE([__wasi__], [WASI="yes"], []) From 30e7c6f8a76db83ab4590aeb1a6023b3250e2935 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 14:38:51 +0200 Subject: [PATCH 09/12] Don't use autoreconf --- autogen.sh | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/autogen.sh b/autogen.sh index 87fc49cc..383533b0 100755 --- a/autogen.sh +++ b/autogen.sh @@ -84,14 +84,10 @@ if [ "$overwrite_config" = false ]; then mv build-aux/config.sub build-aux/config.sub.stable fi fi -if autoreconf --version >/dev/null 2>&1; then - autoreconf -ivf -else - $LIBTOOLIZE && - aclocal && - automake --add-missing --force-missing --include-deps && - autoconf -fi +$LIBTOOLIZE && + aclocal && + automake --add-missing --force-missing --include-deps && + autoconf if [ "$overwrite_config" = false ]; then if [ -f build-aux/config.guess.stable ]; then mv build-aux/config.guess.stable build-aux/config.guess From 3bb6ee1b5250e5b9dbfbe8626210a3311c5081b3 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 14:42:02 +0200 Subject: [PATCH 10/12] Always copy aux files --- autogen.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/autogen.sh b/autogen.sh index 383533b0..2546ced7 100755 --- a/autogen.sh +++ b/autogen.sh @@ -86,7 +86,7 @@ if [ "$overwrite_config" = false ]; then fi $LIBTOOLIZE && aclocal && - automake --add-missing --force-missing --include-deps && + automake --add-missing --copy --force-missing --include-deps && autoconf if [ "$overwrite_config" = false ]; then if [ -f build-aux/config.guess.stable ]; then From 470f70d510133ea92920ec7ee03eb43079e11eaf Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 14:44:44 +0200 Subject: [PATCH 11/12] libtoolize copy --- autogen.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/autogen.sh b/autogen.sh index 2546ced7..4d5627d8 100755 --- a/autogen.sh +++ b/autogen.sh @@ -84,7 +84,7 @@ if [ "$overwrite_config" = false ]; then mv build-aux/config.sub build-aux/config.sub.stable fi fi -$LIBTOOLIZE && +$LIBTOOLIZE --copy --install && aclocal && automake --add-missing --copy --force-missing --include-deps && autoconf From 0055072fa8399f377cc2c02258d705cc25710b08 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 26 May 2020 14:50:48 +0200 Subject: [PATCH 12/12] Print something after auto* are done --- autogen.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/autogen.sh b/autogen.sh index 4d5627d8..62d76cff 100755 --- a/autogen.sh +++ b/autogen.sh @@ -87,7 +87,7 @@ fi $LIBTOOLIZE --copy --install && aclocal && automake --add-missing --copy --force-missing --include-deps && - autoconf + autoconf && echo Done. if [ "$overwrite_config" = false ]; then if [ -f build-aux/config.guess.stable ]; then mv build-aux/config.guess.stable build-aux/config.guess