Line data    Source code

       1             : #include <stdint.h>
       2             : #include "../../third_party/s2n-bignum/include/s2n-bignum.h"
       3             : #include "../../util/sanitize/fd_msan.h"
       4             : 
       5             : #ifndef __ADX__
       6      245476 : #define edwards25519_scalarmulbase   edwards25519_scalarmulbase_alt
       7       72574 : #define edwards25519_scalarmuldouble edwards25519_scalarmuldouble_alt
       8             : #endif
       9             : 
      10             : /* s2n-bignum implementation of the Ed25519 scalar multiplications. */
      11             : 
      12             : /* fd_ed25519_scalar_mul_base_tobytes writes the RFC 8032 encoding of
      13             :    [n]B to out.  n can be a secret. */
      14             : static inline void FD_FN_SENSITIVE
      15             : fd_ed25519_scalar_mul_base_tobytes( uchar       out[ 32 ],
      16      245476 :                                     uchar const n[ 32 ] ) {
      17      245476 :   ulong s[ 4 ], res[ 8 ];
      18      245476 :   memcpy( s, n, 32UL );
      19      245476 :   edwards25519_scalarmulbase( res, s );
      20      245476 :   fd_msan_unpoison( res, 64UL );
      21      245476 :   memcpy( out, res+4, 32UL );
      22      245476 :   out[31] |= (uchar)( ( res[0] & 1UL )<<7 );
      23      245476 :   fd_memzero_explicit( s, 32UL );
      24      245476 : }
      25             : 
      26             : /* fd_ed25519_affine_to_limbs writes the canonical (x,y) of the
      27             :    affine point a as two 4x64-bit little-endian integers. */
      28             : static inline void
      29             : fd_ed25519_affine_to_limbs( ulong                      out[ 8 ],
      30      145148 :                             fd_ed25519_point_t const * a ) {
      31      145148 :   fd_f25519_t x[1], y[1], z[1], t[1];
      32      145148 :   fd_ed25519_point_to( x, y, z, t, a );
      33      145148 :   fd_f25519_tobytes( (uchar *)out,      x );
      34      145148 :   fd_f25519_tobytes( (uchar *)out + 32, y );
      35      145148 : }
      36             : 
      37             : /* fd_ed25519_verify_equation returns 1 iff [S]B == R + [k]A,
      38             :    computed as [k](-A) + [S]B == R.  A and R must be affine (Z==1).
      39             :    A is clobbered.  k and S are 32-byte little-endian scalars, S < L. */
      40             : static inline int
      41             : fd_ed25519_verify_equation( uchar const                k[ 32 ],
      42             :                             fd_ed25519_point_t *       A,
      43             :                             uchar const                S[ 32 ],
      44       72574 :                             fd_ed25519_point_t const * R ) {
      45       72574 :   ulong n[ 4 ], m[ 4 ], negA[ 8 ], expR[ 8 ], res[ 8 ];
      46       72574 :   memcpy( n, k, 32UL );
      47       72574 :   memcpy( m, S, 32UL );
      48       72574 :   fd_ed25519_point_neg( A, A );
      49       72574 :   fd_ed25519_affine_to_limbs( negA, A );
      50       72574 :   fd_ed25519_affine_to_limbs( expR, R );
      51       72574 :   edwards25519_scalarmuldouble( res, n, negA, m );
      52       72574 :   fd_msan_unpoison( res, 64UL );
      53       72574 :   return fd_memeq( res, expR, 64UL );
      54       72574 : }