mirror of
https://github.com/saymrwulf/xous-core.git
synced 2026-11-15 08:30:02 +00:00
2f47a9d4f2
While ideally we'd be as light-fingered as possible on the cryptographic APIs, unfortunately the reality is we have exactly one hardware hash engine and we can't just leave the context laying around. Given that the verification routine would consume the hash, that would make it unavailable for use later on to pass to the system. So, this patch set causes the pre-hash algorithm to take a simple slice-u8 instead of a whole hash context. The downside of this is it erases the type information about needing a 64-bit hash to go into the context. This is partially mitigated with an assert that gives us a run-time check of this property.
381 lines
13 KiB
Rust
381 lines
13 KiB
Rust
// -*- mode: rust; -*-
|
|
//
|
|
// This file is part of ed25519-dalek.
|
|
// Copyright (c) 2017-2019 isis lovecruft
|
|
// See LICENSE for licensing information.
|
|
//
|
|
// Authors:
|
|
// - isis agora lovecruft <isis@patternsinthevoid.net>
|
|
|
|
//! ed25519 public keys.
|
|
|
|
use core::convert::TryFrom;
|
|
use core::fmt::Debug;
|
|
|
|
use curve25519_dalek_loader::constants;
|
|
use curve25519_dalek_loader::digest::Digest;
|
|
use curve25519_dalek_loader::edwards::CompressedEdwardsY;
|
|
use curve25519_dalek_loader::edwards::EdwardsPoint;
|
|
use curve25519_dalek_loader::scalar::Scalar;
|
|
|
|
use ed25519::signature::Verifier;
|
|
|
|
pub use sha2_loader::Sha512;
|
|
|
|
#[cfg(feature = "serde")]
|
|
use serde::de::Error as SerdeError;
|
|
#[cfg(feature = "serde")]
|
|
use serde::{Deserialize, Deserializer, Serialize, Serializer};
|
|
#[cfg(feature = "serde")]
|
|
use serde_bytes::{Bytes as SerdeBytes, ByteBuf as SerdeByteBuf};
|
|
|
|
use crate::constants::*;
|
|
use crate::errors::*;
|
|
use crate::secret::*;
|
|
use crate::signature::*;
|
|
|
|
/// An ed25519 public key.
|
|
#[derive(Copy, Clone, Default, Eq, PartialEq)]
|
|
pub struct PublicKey(pub(crate) CompressedEdwardsY, pub(crate) EdwardsPoint);
|
|
|
|
impl Debug for PublicKey {
|
|
fn fmt(&self, f: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result {
|
|
write!(f, "PublicKey({:?}), {:?})", self.0, self.1)
|
|
}
|
|
}
|
|
|
|
impl AsRef<[u8]> for PublicKey {
|
|
fn as_ref(&self) -> &[u8] {
|
|
self.as_bytes()
|
|
}
|
|
}
|
|
|
|
impl<'a> From<&'a SecretKey> for PublicKey {
|
|
/// Derive this public key from its corresponding `SecretKey`.
|
|
fn from(secret_key: &SecretKey) -> PublicKey {
|
|
let mut h: Sha512 = Sha512::new();
|
|
let mut hash: [u8; 64] = [0u8; 64];
|
|
let mut digest: [u8; 32] = [0u8; 32];
|
|
|
|
h.update(secret_key.as_bytes());
|
|
hash.copy_from_slice(h.finalize().as_slice());
|
|
|
|
digest.copy_from_slice(&hash[..32]);
|
|
|
|
PublicKey::mangle_scalar_bits_and_multiply_by_basepoint_to_produce_public_key(&mut digest)
|
|
}
|
|
}
|
|
|
|
impl<'a> From<&'a ExpandedSecretKey> for PublicKey {
|
|
/// Derive this public key from its corresponding `ExpandedSecretKey`.
|
|
fn from(expanded_secret_key: &ExpandedSecretKey) -> PublicKey {
|
|
let mut bits: [u8; 32] = expanded_secret_key.key.to_bytes();
|
|
|
|
PublicKey::mangle_scalar_bits_and_multiply_by_basepoint_to_produce_public_key(&mut bits)
|
|
}
|
|
}
|
|
|
|
impl PublicKey {
|
|
/// Convert this public key to a byte array.
|
|
#[inline]
|
|
pub fn to_bytes(&self) -> [u8; PUBLIC_KEY_LENGTH] {
|
|
self.0.to_bytes()
|
|
}
|
|
|
|
/// View this public key as a byte array.
|
|
#[inline]
|
|
pub fn as_bytes<'a>(&'a self) -> &'a [u8; PUBLIC_KEY_LENGTH] {
|
|
&(self.0).0
|
|
}
|
|
|
|
/// Construct a `PublicKey` from a slice of bytes.
|
|
///
|
|
/// # Warning
|
|
///
|
|
/// The caller is responsible for ensuring that the bytes passed into this
|
|
/// method actually represent a `curve25519_dalek_loader::curve::CompressedEdwardsY`
|
|
/// and that said compressed point is actually a point on the curve.
|
|
///
|
|
/// # Example
|
|
///
|
|
/// ```
|
|
/// # extern crate ed25519_dalek;
|
|
/// #
|
|
/// use ed25519_dalek::PublicKey;
|
|
/// use ed25519_dalek::PUBLIC_KEY_LENGTH;
|
|
/// use ed25519_dalek::SignatureError;
|
|
///
|
|
/// # fn doctest() -> Result<PublicKey, SignatureError> {
|
|
/// let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
|
|
/// 215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58,
|
|
/// 14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26];
|
|
///
|
|
/// let public_key = PublicKey::from_bytes(&public_key_bytes)?;
|
|
/// #
|
|
/// # Ok(public_key)
|
|
/// # }
|
|
/// #
|
|
/// # fn main() {
|
|
/// # doctest();
|
|
/// # }
|
|
/// ```
|
|
///
|
|
/// # Returns
|
|
///
|
|
/// A `Result` whose okay value is an EdDSA `PublicKey` or whose error value
|
|
/// is an `SignatureError` describing the error that occurred.
|
|
#[inline]
|
|
pub fn from_bytes(bytes: &[u8]) -> Result<PublicKey, SignatureError> {
|
|
if bytes.len() != PUBLIC_KEY_LENGTH {
|
|
return Err(InternalError::BytesLengthError {
|
|
name: "PublicKey",
|
|
length: PUBLIC_KEY_LENGTH,
|
|
}.into());
|
|
}
|
|
let mut bits: [u8; 32] = [0u8; 32];
|
|
bits.copy_from_slice(&bytes[..32]);
|
|
|
|
let compressed = CompressedEdwardsY(bits);
|
|
let point = compressed
|
|
.decompress()
|
|
.ok_or(InternalError::PointDecompressionError)?;
|
|
|
|
Ok(PublicKey(compressed, point))
|
|
}
|
|
|
|
/// Internal utility function for mangling the bits of a (formerly
|
|
/// mathematically well-defined) "scalar" and multiplying it to produce a
|
|
/// public key.
|
|
fn mangle_scalar_bits_and_multiply_by_basepoint_to_produce_public_key(
|
|
bits: &mut [u8; 32],
|
|
) -> PublicKey {
|
|
bits[0] &= 248;
|
|
bits[31] &= 127;
|
|
bits[31] |= 64;
|
|
|
|
let point = &Scalar::from_bits(*bits) * &constants::ED25519_BASEPOINT_TABLE;
|
|
let compressed = point.compress();
|
|
|
|
PublicKey(compressed, point)
|
|
}
|
|
|
|
/// Verify a `signature` on a `prehashed_message` using the Ed25519ph algorithm.
|
|
///
|
|
/// # Inputs
|
|
///
|
|
/// * `prehashed_message` is an instantiated hash digest with 512-bits of
|
|
/// output which has had the message to be signed previously fed into its
|
|
/// state.
|
|
/// * `context` is an optional context string, up to 255 bytes inclusive,
|
|
/// which may be used to provide additional domain separation. If not
|
|
/// set, this will default to an empty string.
|
|
/// * `signature` is a purported Ed25519ph [`Signature`] on the `prehashed_message`.
|
|
///
|
|
/// # Returns
|
|
///
|
|
/// Returns `true` if the `signature` was a valid signature created by this
|
|
/// `Keypair` on the `prehashed_message`.
|
|
///
|
|
/// [rfc8032]: https://tools.ietf.org/html/rfc8032#section-5.1
|
|
#[allow(non_snake_case)]
|
|
pub fn verify_prehashed(
|
|
&self,
|
|
// note: this used to be D: Digest<OutputSize = U64>, but because we have only
|
|
// one hardware hasher, this has to be finalized before handing down to the function.
|
|
prehashed_message: &[u8],
|
|
context: Option<&[u8]>,
|
|
signature: &ed25519::Signature,
|
|
) -> Result<(), SignatureError>
|
|
{
|
|
// This assert does a run-time check on what would otherwise be a static check in Rust
|
|
// due to the original type bounds on this function. However, because we have to finalize
|
|
// the hash (due to there being only a single hardware hash engine) prior to passing into
|
|
// this function, we also erase the type information. This assert somewhat makes up for that.
|
|
assert!(prehashed_message.len() == 64, "Incorrect pre-hash length");
|
|
|
|
let signature = InternalSignature::try_from(signature)?;
|
|
|
|
let mut h: Sha512 = Sha512::default();
|
|
let R: EdwardsPoint;
|
|
let k: Scalar;
|
|
|
|
let ctx: &[u8] = context.unwrap_or(b"");
|
|
debug_assert!(ctx.len() <= 255, "The context must not be longer than 255 octets.");
|
|
|
|
let minus_A: EdwardsPoint = -self.1;
|
|
|
|
h.update(b"SigEd25519 no Ed25519 collisions");
|
|
h.update(&[1]); // Ed25519ph
|
|
h.update(&[ctx.len() as u8]);
|
|
h.update(ctx);
|
|
h.update(signature.R.as_bytes());
|
|
h.update(self.as_bytes());
|
|
h.update(prehashed_message);
|
|
|
|
k = Scalar::from_hash(h);
|
|
R = EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &(minus_A), &signature.s);
|
|
|
|
if R.compress() == signature.R {
|
|
Ok(())
|
|
} else {
|
|
Err(InternalError::VerifyError.into())
|
|
}
|
|
}
|
|
|
|
/// Strictly verify a signature on a message with this keypair's public key.
|
|
///
|
|
/// # On The (Multiple) Sources of Malleability in Ed25519 Signatures
|
|
///
|
|
/// This version of verification is technically non-RFC8032 compliant. The
|
|
/// following explains why.
|
|
///
|
|
/// 1. Scalar Malleability
|
|
///
|
|
/// The authors of the RFC explicitly stated that verification of an ed25519
|
|
/// signature must fail if the scalar `s` is not properly reduced mod \ell:
|
|
///
|
|
/// > To verify a signature on a message M using public key A, with F
|
|
/// > being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or
|
|
/// > Ed25519ph is being used, C being the context, first split the
|
|
/// > signature into two 32-octet halves. Decode the first half as a
|
|
/// > point R, and the second half as an integer S, in the range
|
|
/// > 0 <= s < L. Decode the public key A as point A'. If any of the
|
|
/// > decodings fail (including S being out of range), the signature is
|
|
/// > invalid.)
|
|
///
|
|
/// All `verify_*()` functions within ed25519-dalek perform this check.
|
|
///
|
|
/// 2. Point malleability
|
|
///
|
|
/// The authors of the RFC added in a malleability check to step #3 in
|
|
/// §5.1.7, for small torsion components in the `R` value of the signature,
|
|
/// *which is not strictly required*, as they state:
|
|
///
|
|
/// > Check the group equation \[8\]\[S\]B = \[8\]R + \[8\]\[k\]A'. It's
|
|
/// > sufficient, but not required, to instead check \[S\]B = R + \[k\]A'.
|
|
///
|
|
/// # History of Malleability Checks
|
|
///
|
|
/// As originally defined (cf. the "Malleability" section in the README of
|
|
/// this repo), ed25519 signatures didn't consider *any* form of
|
|
/// malleability to be an issue. Later the scalar malleability was
|
|
/// considered important. Still later, particularly with interests in
|
|
/// cryptocurrency design and in unique identities (e.g. for Signal users,
|
|
/// Tor onion services, etc.), the group element malleability became a
|
|
/// concern.
|
|
///
|
|
/// However, libraries had already been created to conform to the original
|
|
/// definition. One well-used library in particular even implemented the
|
|
/// group element malleability check, *but only for batch verification*!
|
|
/// Which meant that even using the same library, a single signature could
|
|
/// verify fine individually, but suddenly, when verifying it with a bunch
|
|
/// of other signatures, the whole batch would fail!
|
|
///
|
|
/// # "Strict" Verification
|
|
///
|
|
/// This method performs *both* of the above signature malleability checks.
|
|
///
|
|
/// It must be done as a separate method because one doesn't simply get to
|
|
/// change the definition of a cryptographic primitive ten years
|
|
/// after-the-fact with zero consideration for backwards compatibility in
|
|
/// hardware and protocols which have it already have the older definition
|
|
/// baked in.
|
|
///
|
|
/// # Return
|
|
///
|
|
/// Returns `Ok(())` if the signature is valid, and `Err` otherwise.
|
|
#[allow(non_snake_case)]
|
|
pub fn verify_strict(
|
|
&self,
|
|
message: &[u8],
|
|
signature: &ed25519::Signature,
|
|
) -> Result<(), SignatureError>
|
|
{
|
|
let signature = InternalSignature::try_from(signature)?;
|
|
|
|
let mut h: Sha512 = Sha512::new();
|
|
let R: EdwardsPoint;
|
|
let k: Scalar;
|
|
let minus_A: EdwardsPoint = -self.1;
|
|
let signature_R: EdwardsPoint;
|
|
|
|
match signature.R.decompress() {
|
|
None => return Err(InternalError::VerifyError.into()),
|
|
Some(x) => signature_R = x,
|
|
}
|
|
|
|
// Logical OR is fine here as we're not trying to be constant time.
|
|
if signature_R.is_small_order() || self.1.is_small_order() {
|
|
return Err(InternalError::VerifyError.into());
|
|
}
|
|
|
|
h.update(signature.R.as_bytes());
|
|
h.update(self.as_bytes());
|
|
h.update(&message);
|
|
|
|
k = Scalar::from_hash(h);
|
|
R = EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &(minus_A), &signature.s);
|
|
|
|
if R == signature_R {
|
|
Ok(())
|
|
} else {
|
|
Err(InternalError::VerifyError.into())
|
|
}
|
|
}
|
|
}
|
|
|
|
impl Verifier<ed25519::Signature> for PublicKey {
|
|
/// Verify a signature on a message with this keypair's public key.
|
|
///
|
|
/// # Return
|
|
///
|
|
/// Returns `Ok(())` if the signature is valid, and `Err` otherwise.
|
|
#[allow(non_snake_case)]
|
|
fn verify(
|
|
&self,
|
|
message: &[u8],
|
|
signature: &ed25519::Signature
|
|
) -> Result<(), SignatureError>
|
|
{
|
|
let signature = InternalSignature::try_from(signature)?;
|
|
|
|
let mut h: Sha512 = Sha512::new();
|
|
let R: EdwardsPoint;
|
|
let k: Scalar;
|
|
let minus_A: EdwardsPoint = -self.1;
|
|
|
|
h.update(signature.R.as_bytes());
|
|
h.update(self.as_bytes());
|
|
h.update(&message);
|
|
|
|
k = Scalar::from_hash(h);
|
|
R = EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &(minus_A), &signature.s);
|
|
|
|
if R.compress() == signature.R {
|
|
Ok(())
|
|
} else {
|
|
Err(InternalError::VerifyError.into())
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(feature = "serde")]
|
|
impl Serialize for PublicKey {
|
|
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
|
|
where
|
|
S: Serializer,
|
|
{
|
|
SerdeBytes::new(self.as_bytes()).serialize(serializer)
|
|
}
|
|
}
|
|
|
|
#[cfg(feature = "serde")]
|
|
impl<'d> Deserialize<'d> for PublicKey {
|
|
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
|
|
where
|
|
D: Deserializer<'d>,
|
|
{
|
|
let bytes = <SerdeByteBuf>::deserialize(deserializer)?;
|
|
PublicKey::from_bytes(bytes.as_ref()).map_err(SerdeError::custom)
|
|
}
|
|
}
|