/* curve25519.c * * Copyright (C) 2006-2015 wolfSSL Inc. * * This file is part of wolfSSL. (formerly known as CyaSSL) * * wolfSSL is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * wolfSSL is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA */ /* Based On Daniel J Bernstein's curve25519 Public Domain ref10 work. */ #ifdef HAVE_CONFIG_H #include #endif #include #ifdef HAVE_CURVE25519 #include #include #ifdef NO_INLINE #include #else #include #endif const curve25519_set_type curve25519_sets[] = { { 32, "CURVE25519", } }; int wc_curve25519_make_key(RNG* rng, int keysize, curve25519_key* key) { unsigned char basepoint[CURVE25519_KEYSIZE] = {9}; unsigned char n[CURVE25519_KEYSIZE]; unsigned char p[CURVE25519_KEYSIZE]; int i; int ret; if (key == NULL || rng == NULL) return ECC_BAD_ARG_E; /* currently only a key size of 32 bytes is used */ if (keysize != CURVE25519_KEYSIZE) return ECC_BAD_ARG_E; /* get random number from RNG */ ret = wc_RNG_GenerateBlock(rng, n, keysize); if (ret != 0) return ret; for (i = 0; i < keysize; ++i) key->k.point[i] = n[i]; key->k.point[ 0] &= 248; key->k.point[31] &= 127; key->k.point[31] |= 64; /* compute public key */ ret = curve25519(p, key->k.point, basepoint); /* store keys in big endian format */ for (i = 0; i < keysize; ++i) n[i] = key->k.point[i]; for (i = 0; i < keysize; ++i) { key->p.point[keysize - i - 1] = p[i]; key->k.point[keysize - i - 1] = n[i]; } ForceZero(n, keysize); ForceZero(p, keysize); return ret; } int wc_curve25519_shared_secret(curve25519_key* private_key, curve25519_key* public_key, byte* out, word32* outlen) { unsigned char k[CURVE25519_KEYSIZE]; unsigned char p[CURVE25519_KEYSIZE]; unsigned char o[CURVE25519_KEYSIZE]; int ret = 0; int i; /* sanity check */ if (private_key == NULL || public_key == NULL || out == NULL || outlen == NULL) return BAD_FUNC_ARG; /* avoid implementation fingerprinting */ if (public_key->p.point[0] > 0x7F) return ECC_BAD_ARG_E; XMEMSET(p, 0, sizeof(p)); XMEMSET(k, 0, sizeof(k)); XMEMSET(out, 0, CURVE25519_KEYSIZE); for (i = 0; i < CURVE25519_KEYSIZE; ++i) { p[i] = public_key->p.point [CURVE25519_KEYSIZE - i - 1]; k[i] = private_key->k.point[CURVE25519_KEYSIZE - i - 1]; } ret = curve25519(o , k, p); *outlen = CURVE25519_KEYSIZE; for (i = 0; i < CURVE25519_KEYSIZE; ++i) { out[i] = o[CURVE25519_KEYSIZE - i -1]; } ForceZero(p, sizeof(p)); ForceZero(k, sizeof(k)); ForceZero(o, sizeof(o)); return ret; } /* curve25519 uses a serialized string for key representation */ int wc_curve25519_export_public(curve25519_key* key, byte* out, word32* outLen) { word32 keySz; if (key == NULL || out == NULL || outLen == NULL) return BAD_FUNC_ARG; /* check size of outgoing key */ keySz = wc_curve25519_size(key); /* copy in public key */ XMEMCPY(out, key->p.point, keySz); *outLen = keySz; return 0; } /* import curve25519 public key return 0 on success */ int wc_curve25519_import_public(const byte* in, word32 inLen, curve25519_key* key) { word32 keySz; /* sanity check */ if (key == NULL || in == NULL) return ECC_BAD_ARG_E; /* check size of incoming keys */ keySz = wc_curve25519_size(key); if (inLen != keySz) return ECC_BAD_ARG_E; XMEMCPY(key->p.point, in, inLen); key->dp = &curve25519_sets[0]; return 0; } /* export curve25519 private key only raw, outLen is in/out size return 0 on success */ int wc_curve25519_export_private_raw(curve25519_key* key, byte* out, word32* outLen) { word32 keySz; /* sanity check */ if (key == NULL || out == NULL || outLen == NULL) return ECC_BAD_ARG_E; keySz = wc_curve25519_size(key); *outLen = keySz; XMEMSET(out, 0, keySz); XMEMCPY(out, key->k.point, keySz); return 0; } /* curve25519 private key import. Public key to match private key needs to be imported too */ int wc_curve25519_import_private_raw(const byte* priv, word32 privSz, const byte* pub, word32 pubSz, curve25519_key* key) { int ret = 0; word32 keySz; /* sanity check */ if (key == NULL || priv == NULL || pub == NULL) return ECC_BAD_ARG_E; /* check size of incoming keys */ keySz = wc_curve25519_size(key); if (privSz != keySz || pubSz != keySz) return ECC_BAD_ARG_E; XMEMCPY(key->k.point, priv, privSz); XMEMCPY(key->p.point, pub, pubSz); return ret; } int wc_curve25519_init(curve25519_key* key) { word32 keySz; if (key == NULL) return ECC_BAD_ARG_E; /* currently the format for curve25519 */ key->dp = &curve25519_sets[0]; keySz = key->dp->size; XMEMSET(key->k.point, 0, keySz); XMEMSET(key->p.point, 0, keySz); return 0; } /* Clean the memory of a key */ void wc_curve25519_free(curve25519_key* key) { if (key == NULL) return; key->dp = NULL; ForceZero(key->p.point, sizeof(key->p.point)); ForceZero(key->k.point, sizeof(key->k.point)); } /* get key size */ int wc_curve25519_size(curve25519_key* key) { if (key == NULL) return 0; return key->dp->size; } #endif /*HAVE_CURVE25519*/