saymrwulf/risc0-curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/risc0-curve25519-dalek-source.git synced 2026-09-05 20:10:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'release/0.4.0'

Browse source
This commit is contained in:
Isis Lovecruft 2017-08-02 19:43:48 +00:00
commit dcdd76b45e
Failed to extract signature
4 changed files with 254 additions and 146 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
Cargo.toml
View file

@ -1,6 +1,6 @@
[package]
name = "ed25519-dalek"
version = "0.3.2"
version = "0.4.0"
authors = ["Isis Lovecruft <isis@torproject.org>"]
readme = "README.md"
license = "CC0-1.0"
@ -9,7 +9,7 @@ homepage = "https://code.ciph.re/isis/ed25519-dalek"
documentation = "https://docs.rs/ed25519-dalek"
keywords = ["cryptography", "ed25519", "curve25519", "signature", "ECC"]
categories = ["cryptography", "no-std"]
description = "Fast and efficient ed25519 signing and verification in pure Rust."
description = "Fast and efficient ed25519 EdDSA key generations, signing, and verification in pure Rust."
exclude = [ ".gitignore", "TESTVECTORS", "res/*" ]
[badges]
@ -19,7 +19,11 @@ travis-ci = { repository = "isislovecruft/ed25519-dalek", branch = "master"}
arrayref = "0.3.3"
[dependencies.curve25519-dalek]
version = "^0.7"
version = "^0.10"
default-features = false
[dependencies.subtle]
version = "^0.2"
default-features = false
[dependencies.rand]
@ -27,18 +31,19 @@ optional = true
version = "^0.3"
[dependencies.digest]
version = "^0.5"
version = "^0.6"
[dependencies.generic-array]
# same version that digest depends on
version = "^0.6"
version = "^0.8"
[dev-dependencies]
rustc-serialize = "0.3"
sha2 = "^0.5"
sha2 = "^0.6"
[features]
default = ["std"]
std = ["rand", "curve25519-dalek/std"]
bench = []
nightly = ["curve25519-dalek/nightly"]
asm = ["sha2/asm"]

4
README.md
View file

@ -119,7 +119,7 @@ eventually support VXEdDSA in curve25519-dalek.
To install, add the following to your project's `Cargo.toml`:
[dependencies.ed25519-dalek]
version = "^0.3"
version = "^0.4"
Then, in your library or executable source, add:
@ -129,7 +129,7 @@ To cause your application to build `ed25519-dalek` with the nightly feature
enabled by default, instead do:
[dependencies.ed25519-dalek]
version = "^0.3"
version = "^0.4"
features = ["nightly"]
To cause your application to instead build with the nightly feature enabled

378
src/ed25519.rs
View file

@ -8,34 +8,46 @@
// Authors:
// - Isis Agora Lovecruft <isis@patternsinthevoid.net>
//! A Rust implementation of ed25519 key generation, signing, and verification.
//! A Rust implementation of ed25519 EdDSA key generation, signing, and
//! verification.
use core::fmt::Debug;
#[cfg(feature = "std")]
use rand::Rng;
use digest::BlockInput;
use digest::Digest;
use digest::Input;
use digest::FixedOutput;
use generic_array::typenum::U64;
use curve25519_dalek::constants;
use curve25519_dalek::curve::CompressedEdwardsY;
use curve25519_dalek::curve::ExtendedPoint;
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::subtle::arrays_equal_ct;
/// The length of an ed25519 `Signature`, in bytes.
use subtle::slices_equal;
/// The length of an ed25519 EdDSA `Signature`, in bytes.
pub const SIGNATURE_LENGTH: usize = 64;
/// An ed25519 signature.
/// The length of an ed25519 EdDSA `SecretKey`, in bytes.
pub const SECRET_KEY_LENGTH: usize = 32;
/// The length of an ed25519 EdDSA `PublicKey`, in bytes.
pub const PUBLIC_KEY_LENGTH: usize = 32;
/// An EdDSA signature.
///
/// # Note
///
/// These signatures, unlike the ed25519 reference implementation, are
/// "detached"—that is, they do **not** include a copy of the message which
/// has been signed.
/// These signatures, unlike the ed25519 signature reference implementation, are
/// "detached"—that is, they do **not** include a copy of the message which has
/// been signed.
#[derive(Copy)]
#[repr(C)]
pub struct Signature(pub [u8; SIGNATURE_LENGTH]);
impl Clone for Signature {
@ -44,17 +56,13 @@ impl Clone for Signature {
impl Debug for Signature {
fn fmt(&self, f: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
write!(f, "Signature: {:?}", &self.0[..])
write!(f, "Signature([{:?}])", &self.0[..])
}
}
impl Eq for Signature {}
impl PartialEq for Signature {
/// # Note
///
/// This function happens to be constant time, even though that is not
/// really necessary.
fn eq(&self, other: &Signature) -> bool {
let mut equal: u8 = 0;
@ -71,12 +79,18 @@ impl PartialEq for Signature {
}
impl Signature {
/// View this signature as an array of 64 bytes.
/// View this `Signature` as a byte array.
#[inline]
pub fn to_bytes(&self) -> [u8; SIGNATURE_LENGTH] {
self.0
}
/// View this `Signature` as a byte array.
#[inline]
pub fn as_bytes<'a>(&'a self) -> &'a [u8; SIGNATURE_LENGTH] {
&self.0
}
/// Construct a `Signature` from a slice of bytes.
#[inline]
pub fn from_bytes(bytes: &[u8]) -> Signature {
@ -84,8 +98,9 @@ impl Signature {
}
}
/// An ed25519 private key.
pub struct SecretKey(pub [u8; 64]);
/// An EdDSA secret key.
#[repr(C)]
pub struct SecretKey(pub [u8; SECRET_KEY_LENGTH]);
impl Debug for SecretKey {
fn fmt(&self, f: &mut ::core::fmt::Formatter) -> ::core::fmt::Result {
@ -94,99 +109,117 @@ impl Debug for SecretKey {
}
impl SecretKey {
/// View this secret key as an array of 32 bytes.
/// Convert this secret key to a byte array.
#[inline]
pub fn to_bytes(&self) -> [u8; 64] {
pub fn to_bytes(&self) -> [u8; SECRET_KEY_LENGTH] {
self.0
}
/// View this secret key as a byte array.
#[inline]
pub fn as_bytes<'a>(&'a self) -> &'a [u8; SECRET_KEY_LENGTH] {
&self.0
}
/// Construct a `SecretKey` from a slice of bytes.
///
/// # Warning
///
/// **The caller is responsible for ensuring that the bytes represent a
/// *masked* secret key. If you do not understand what this means, DO NOT
/// USE THIS CONSTRUCTOR.**
///
/// # Example
///
/// ```ignore
/// ```
/// # extern crate ed25519_dalek;
/// # fn main() {
/// use ed25519_dalek::SecretKey;
/// use ed25519_dalek::SECRET_KEY_LENGTH;
///
/// let secret_key_bytes: [u8; 64] = [
/// 157, 97, 177, 157, 239, 253, 90, 96, 186, 132, 74, 244, 146, 236, 44, 196,
/// 68, 73, 197, 105, 123, 50, 105, 25, 112, 59, 172, 3, 28, 174, 127, 96,
/// 215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58,
/// 14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26];
/// let public_key_bytes: [u8; 32] = [
/// 215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58,
/// 14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26];
/// let secret_key_bytes: [u8; SECRET_KEY_LENGTH] = [
/// 157, 097, 177, 157, 239, 253, 090, 096,
/// 186, 132, 074, 244, 146, 236, 044, 196,
/// 068, 073, 197, 105, 123, 050, 105, 025,
/// 112, 059, 172, 003, 028, 174, 127, 096, ];
///
/// let secret_key: SecretKey = SecretKey::from_bytes(&[&secret_key_bytes[..32],
/// &public_key_bytes[..32]].concat()[..]);
/// let secret_key: SecretKey = SecretKey::from_bytes(&secret_key_bytes[..]);
/// # }
/// ```
///
/// # Returns
///
/// A `SecretKey`.
/// An EdDSA `SecretKey`.
#[inline]
pub fn from_bytes(bytes: &[u8]) -> SecretKey {
SecretKey(*array_ref!(bytes, 0, 64))
SecretKey(*array_ref!(bytes, 0, SECRET_KEY_LENGTH))
}
/// Sign a message with this keypair's secret key.
pub fn sign<D>(&self, message: &[u8]) -> Signature
where D: FixedOutput<OutputSize = U64> + Default + Input {
/// Generate a `SecretKey` from a `csprng`.
///
/// # Example
///
/// ```
/// extern crate rand;
/// extern crate sha2;
/// extern crate ed25519_dalek;
///
/// # fn main() {
///
/// use rand::Rng;
/// use rand::OsRng;
/// use sha2::Sha512;
/// use ed25519_dalek::PublicKey;
/// use ed25519_dalek::SecretKey;
/// use ed25519_dalek::Signature;
///
/// let mut csprng: OsRng = OsRng::new().unwrap();
/// let secret_key: SecretKey = SecretKey::generate(&mut csprng);
///
/// # }
/// ```
///
/// Afterwards, you can generate the corresponding public—provided you also
/// supply a hash function which implements the `Digest` and `Default`
/// traits, and which returns 512 bits of output—via:
///
/// ```
/// # extern crate rand;
/// # extern crate sha2;
/// # extern crate ed25519_dalek;
/// #
/// # fn main() {
/// #
/// # use rand::Rng;
/// # use rand::OsRng;
/// # use sha2::Sha512;
/// # use ed25519_dalek::PublicKey;
/// # use ed25519_dalek::SecretKey;
/// # use ed25519_dalek::Signature;
/// #
/// # let mut csprng: OsRng = OsRng::new().unwrap();
/// # let secret_key: SecretKey = SecretKey::generate(&mut csprng);
///
/// let public_key: PublicKey = PublicKey::from_secret::<Sha512>(&secret_key);
/// # }
/// ```
///
/// The standard hash function used for most ed25519 libraries is SHA-512,
/// which is available with `use sha2::Sha512` as in the example above.
/// Other suitable hash functions include Keccak-512 and Blake2b-512.
///
/// # Input
///
/// A CSPRING with a `fill_bytes()` method, e.g. the one returned
/// from `rand::OsRng::new()` (in the `rand` crate).
///
#[cfg(feature = "std")]
pub fn generate(csprng: &mut Rng) -> SecretKey {
let mut sk: SecretKey = SecretKey([0u8; 32]);
let mut h: D = D::default();
let mut hash: [u8; 64] = [0u8; 64];
let mut signature_bytes: [u8; 64] = [0u8; SIGNATURE_LENGTH];
let mut expanded_key_secret: Scalar;
let mesg_digest: Scalar;
let hram_digest: Scalar;
let r: ExtendedPoint;
let s: Scalar;
let t: CompressedEdwardsY;
csprng.fill_bytes(&mut sk.0);
let secret_key: &[u8; 32] = array_ref!(&self.0, 0, 32);
let public_key: &[u8; 32] = array_ref!(&self.0, 32, 32);
h.digest(secret_key);
hash.copy_from_slice(h.fixed_result().as_slice());
expanded_key_secret = Scalar(*array_ref!(&hash, 0, 32));
expanded_key_secret[0] &= 248;
expanded_key_secret[31] &= 63;
expanded_key_secret[31] |= 64;
h = D::default();
h.digest(&hash[32..]);
h.digest(&message);
hash.copy_from_slice(h.fixed_result().as_slice());
mesg_digest = Scalar::reduce(&hash);
r = &mesg_digest * &constants::ED25519_BASEPOINT;
h = D::default();
h.digest(&r.compress_edwards().to_bytes()[..]);
h.digest(public_key);
h.digest(&message);
hash.copy_from_slice(h.fixed_result().as_slice());
hram_digest = Scalar::reduce(&hash);
s = Scalar::multiply_add(&hram_digest, &expanded_key_secret, &mesg_digest);
t = r.compress_edwards();
signature_bytes[..32].copy_from_slice(&t.0);
signature_bytes[32..64].copy_from_slice(&s.0);
Signature(*array_ref!(&signature_bytes, 0, 64))
sk
}
}
/// An ed25519 public key.
#[derive(Copy, Clone)]
#[repr(C)]
pub struct PublicKey(pub CompressedEdwardsY);
impl Debug for PublicKey {
@ -196,12 +229,18 @@ impl Debug for PublicKey {
}
impl PublicKey {
/// View this public key as an array of 32 bytes.
/// Convert this public key to a byte array.
#[inline]
pub fn to_bytes(&self) -> [u8; 32] {
pub fn to_bytes(&self) -> [u8; PUBLIC_KEY_LENGTH] {
self.0.to_bytes()
}
/// View this public key as a byte array.
#[inline]
pub fn as_bytes<'a>(&'a self) -> &'a [u8; PUBLIC_KEY_LENGTH] {
&(self.0).0
}
/// Construct a `PublicKey` from a slice of bytes.
///
/// # Warning
@ -212,15 +251,18 @@ impl PublicKey {
///
/// # Example
///
/// ```ignore
/// ```
/// # extern crate ed25519_dalek;
/// # fn main() {
/// use ed25519_dalek::PublicKey;
/// use ed25519_dalek::PUBLIC_KEY_LENGTH;
///
/// let public_key_bytes: [u8; 32] = [
/// let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
/// 215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58,
/// 14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26];
///
/// let public_key: PublicKey = PublicKey::from_bytes(&public_key_bytes);
///
/// # }
/// ```
///
/// # Returns
@ -237,6 +279,30 @@ impl PublicKey {
self.0.decompress()
}
/// Derive this public key from its corresponding `SecretKey`.
#[cfg(feature = "std")]
#[allow(unused_assignments)]
pub fn from_secret<D>(secret_key: &SecretKey) -> PublicKey
where D: Digest<OutputSize = U64> + Default {
let mut h: D = D::default();
let mut hash: [u8; 64] = [0u8; 64];
let pk: [u8; 32];
let mut digest: &mut [u8; 32];
h.input(secret_key.as_bytes());
hash.copy_from_slice(h.fixed_result().as_slice());
digest = array_mut_ref!(&mut hash, 0, 32);
digest[0] &= 248;
digest[31] &= 127;
digest[31] |= 64;
pk = (&Scalar(*digest) * &constants::ED25519_BASEPOINT).compress_edwards().to_bytes();
PublicKey(CompressedEdwardsY(pk))
}
/// Verify a signature on a message with this keypair's public key.
///
/// # Return
@ -244,7 +310,7 @@ impl PublicKey {
/// Returns true if the signature was successfully verified, and
/// false otherwise.
pub fn verify<D>(&self, message: &[u8], signature: &Signature) -> bool
where D: FixedOutput<OutputSize = U64> + Default + Input {
where D: Digest<OutputSize = U64> + Default {
let mut h: D = D::default();
let mut a: ExtendedPoint;
@ -268,16 +334,16 @@ impl PublicKey {
let top_half: &[u8; 32] = array_ref!(&signature.0, 32, 32);
let bottom_half: &[u8; 32] = array_ref!(&signature.0, 0, 32);
h.digest(&bottom_half[..]);
h.digest(&self.to_bytes());
h.digest(&message);
h.input(&bottom_half[..]);
h.input(&self.to_bytes());
h.input(&message);
let digest_bytes = h.fixed_result();
digest = *array_ref!(digest_bytes, 0, 64);
digest_reduced = Scalar::reduce(&digest);
r = &(&digest_reduced * &a) + &(&Scalar(*top_half) * &constants::ED25519_BASEPOINT);
if arrays_equal_ct(bottom_half, &r.compress_edwards().to_bytes()) == 1 {
if slices_equal(bottom_half, &r.compress_edwards().to_bytes()) == 1 {
return true
} else {
return false
@ -287,6 +353,7 @@ impl PublicKey {
/// An ed25519 keypair.
#[derive(Debug)]
#[repr(C)]
pub struct Keypair {
/// The public half of this keypair.
pub public: PublicKey,
@ -295,6 +362,29 @@ pub struct Keypair {
}
impl Keypair {
/// Construct a `Keypair` from the bytes of a `PublicKey` and `SecretKey`.
///
/// # Inputs
///
/// * `public`: a `[u8; 32]` representing the compressed Edwards-Y
/// coordinate of a point on curve25519.
/// * `secret`: a `[u8; 32]` representing the corresponding secret key.
///
/// # Warning
///
/// Absolutely no validation is done on the key. If you give this function
/// bytes which do not represent a valid point, or which do not represent
/// corresponding parts of the key, then your `Keypair` will be broken and
/// it will be your fault.
///
/// # Returns
///
/// A `Keypair`.
pub fn from_bytes<'a>(public: &'a [u8; 32], secret: &'a [u8; 32]) -> Keypair {
Keypair{ public: PublicKey::from_bytes(public),
secret: SecretKey::from_bytes(secret), }
}
/// Generate an ed25519 keypair.
///
/// # Example
@ -320,7 +410,7 @@ impl Keypair {
///
/// # Input
///
/// A CSPRING with a `fill_bytes()` method, e.g. the one returned
/// A CSPRNG with a `fill_bytes()` method, e.g. the one returned
/// from `rand::OsRng::new()` (in the `rand` crate).
///
/// The caller must also supply a hash function which implements the
@ -328,53 +418,68 @@ impl Keypair {
/// The standard hash function used for most ed25519 libraries is SHA-512,
/// which is available with `use sha2::Sha512` as in the example above.
/// Other suitable hash functions include Keccak-512 and Blake2b-512.
///
// we reassign 0 bytes to the temp variable t to overwrite it
#[cfg(feature = "std")]
#[allow(unused_assignments)]
pub fn generate<D>(cspring: &mut Rng) -> Keypair
where D: FixedOutput<OutputSize = U64> + Default + Input {
pub fn generate<D>(csprng: &mut Rng) -> Keypair
where D: Digest<OutputSize = U64> + Default {
let sk: SecretKey = SecretKey::generate(csprng);
let pk: PublicKey = PublicKey::from_secret::<D>(&sk);
let mut h: D = D::default();
let mut hash: [u8; 64] = [0u8; 64];
let mut t: [u8; 32] = [0u8; 32];
let mut sk: [u8; 64] = [0u8; 64];
let pk: [u8; 32];
let mut digest: &mut [u8; 32];
cspring.fill_bytes(&mut t);
h.digest(&t);
hash.copy_from_slice(h.fixed_result().as_slice());
digest = array_mut_ref!(&mut hash, 0, 32);
digest[0] &= 248;
digest[31] &= 127;
digest[31] |= 64;
pk = (&Scalar(*digest) * &constants::ED25519_BASEPOINT).compress_edwards().to_bytes();
for i in 0..32 {
sk[i] = t[i];
sk[i+32] = pk[i];
t[i] = 0;
}
Keypair{
public: PublicKey(CompressedEdwardsY(pk)),
secret: SecretKey(sk),
}
Keypair{ public: pk, secret: sk }
}
/// Sign a message with this keypair's secret key.
pub fn sign<D>(&self, message: &[u8]) -> Signature
where D: FixedOutput<OutputSize = U64> + Default + Input {
self.secret.sign::<D>(message)
where D: Digest<OutputSize = U64> + Default {
let mut h: D = D::default();
let mut hash: [u8; 64] = [0u8; 64];
let mut signature_bytes: [u8; 64] = [0u8; SIGNATURE_LENGTH];
let mut expanded_key_secret: Scalar;
let mesg_digest: Scalar;
let hram_digest: Scalar;
let r: ExtendedPoint;
let s: Scalar;
let t: CompressedEdwardsY;
let secret_key: &[u8; 32] = self.secret.as_bytes();
let public_key: &[u8; 32] = self.public.as_bytes();
h.input(secret_key);
hash.copy_from_slice(h.fixed_result().as_slice());
expanded_key_secret = Scalar(*array_ref!(&hash, 0, 32));
expanded_key_secret[0] &= 248;
expanded_key_secret[31] &= 63;
expanded_key_secret[31] |= 64;
h = D::default();
h.input(&hash[32..]);
h.input(&message);
hash.copy_from_slice(h.fixed_result().as_slice());
mesg_digest = Scalar::reduce(&hash);
r = &mesg_digest * &constants::ED25519_BASEPOINT;
h = D::default();
h.input(&r.compress_edwards().to_bytes()[..]);
h.input(public_key);
h.input(&message);
hash.copy_from_slice(h.fixed_result().as_slice());
hram_digest = Scalar::reduce(&hash);
s = Scalar::multiply_add(&hram_digest, &expanded_key_secret, &mesg_digest);
t = r.compress_edwards();
signature_bytes[..32].copy_from_slice(&t.0);
signature_bytes[32..64].copy_from_slice(&s.0);
Signature(*array_ref!(&signature_bytes, 0, 64))
}
/// Verify a signature on a message with this keypair's public key.
pub fn verify<D>(&self, message: &[u8], signature: &Signature) -> bool
where D: FixedOutput<OutputSize = U64> + Default + Input {
where D: FixedOutput<OutputSize = U64> + BlockInput + Default + Input {
self.public.verify::<D>(message, signature)
}
}
@ -475,17 +580,14 @@ mod test {
// at the end, but we just want R and S.
let sig1: Signature = Signature::from_bytes(sig_bytes);
assert_eq!(pub_bytes.len(), 32);
let keypair: Keypair = Keypair::from_bytes(
array_ref!(*pub_bytes, 0, PUBLIC_KEY_LENGTH),
array_ref!(*sec_bytes, 0, SECRET_KEY_LENGTH));
let secret_key: SecretKey = SecretKey::from_bytes(&sec_bytes);
let public_key: PublicKey = PublicKey::from_bytes(&pub_bytes);
let sig2: Signature = secret_key.sign::<Sha512>(&message);
println!("{:?}", sec_bytes);
println!("{:?}", pub_bytes);
let sig2: Signature = keypair.sign::<Sha512>(&message);
assert!(sig1 == sig2, "Signature bytes not equal on line {}", lineno);
assert!(public_key.verify::<Sha512>(&message, &sig2),
assert!(keypair.verify::<Sha512>(&message, &sig2),
"Signature verification failed on line {}", lineno);
}
}

1
src/lib.rs
View file

@ -115,6 +115,7 @@ extern crate arrayref;
extern crate curve25519_dalek;
extern crate generic_array;
extern crate digest;
extern crate subtle;
#[cfg(feature = "std")]
extern crate rand;