Crypto library: cryptographic operations

Provides cryptographic primitives. More...

Collaboration diagram for Crypto library: cryptographic operations:

Macros
#define	GNUNET_CRYPTO_eddsa_sign(priv, ps, sig)
	EdDSA sign a given block. More...
#define	GNUNET_CRYPTO_ecdsa_sign(priv, ps, sig)
	ECDSA sign a given block. More...
#define	GNUNET_CRYPTO_edx25519_sign(priv, ps, sig)
	Edx25519 sign a given block. More...
#define	GNUNET_CRYPTO_eddsa_verify(purp, ps, sig, pub)
	Verify EdDSA signature. More...
#define	GNUNET_CRYPTO_ecdsa_verify(purp, ps, sig, pub)
	Verify ECDSA signature. More...
#define	GNUNET_CRYPTO_edx25519_verify(purp, ps, sig, pub)
	Verify Edx25519 signature. More...

Enumerations
enum	GNUNET_CRYPTO_Quality { GNUNET_CRYPTO_QUALITY_WEAK , GNUNET_CRYPTO_QUALITY_STRONG , GNUNET_CRYPTO_QUALITY_NONCE }
	Desired quality level for random numbers. More...

Functions
void	GNUNET_CRYPTO_seed_weak_random (int32_t seed)
	Seed a weak random generator. More...
void	GNUNET_CRYPTO_zero_keys (void *buffer, size_t length)
	Zero out buffer, securely against compiler optimizations. More...
void	GNUNET_CRYPTO_random_block (enum GNUNET_CRYPTO_Quality mode, void *buffer, size_t length)
	Fill block with a random values. More...
void	GNUNET_CRYPTO_random_timeflake (enum GNUNET_CRYPTO_Quality mode, struct GNUNET_Uuid *uuid)
	Fill UUID with a timeflake pseudo-random value. More...
uint32_t	GNUNET_CRYPTO_random_u32 (enum GNUNET_CRYPTO_Quality mode, uint32_t i)
	Produce a random value. More...
uint64_t	GNUNET_CRYPTO_random_u64 (enum GNUNET_CRYPTO_Quality mode, uint64_t max)
	Generate a random unsigned 64-bit value. More...
unsigned int *	GNUNET_CRYPTO_random_permute (enum GNUNET_CRYPTO_Quality mode, unsigned int n)
	Get an array with a random permutation of the numbers 0...n-1. More...
void	GNUNET_CRYPTO_symmetric_create_session_key (struct GNUNET_CRYPTO_SymmetricSessionKey *key)
	Create a new random session key. More...
ssize_t	GNUNET_CRYPTO_symmetric_encrypt (const void *block, size_t size, const struct GNUNET_CRYPTO_SymmetricSessionKey *sessionkey, const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, void *result)
	Encrypt a block using a symmetric sessionkey. More...
ssize_t	GNUNET_CRYPTO_symmetric_decrypt (const void *block, size_t size, const struct GNUNET_CRYPTO_SymmetricSessionKey *sessionkey, const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, void *result)
	Decrypt a given block using a symmetric sessionkey. More...
void	GNUNET_CRYPTO_symmetric_derive_iv (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, const struct GNUNET_CRYPTO_SymmetricSessionKey *skey, const void *salt, size_t salt_len,...)
	Derive an IV. More...
void	GNUNET_CRYPTO_ecdsa_key_get_public (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_eddsa_key_get_public (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, struct GNUNET_CRYPTO_EddsaPublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_edx25519_key_get_public (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_ecdhe_key_get_public (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, struct GNUNET_CRYPTO_EcdhePublicKey *pub)
	Extract the public key for the given private key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_key_from_file (const char *filename, int do_create, struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey)
	Create a new private key by reading it from a file. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_key_from_file (const char *filename, int do_create, struct GNUNET_CRYPTO_EddsaPrivateKey *pkey)
	Create a new private key by reading it from a file. More...
struct GNUNET_CRYPTO_EddsaPrivateKey *	GNUNET_CRYPTO_eddsa_key_create_from_configuration (const struct GNUNET_CONFIGURATION_Handle *cfg)
	Create a new private key by reading our peer's key from the file specified in the configuration. More...
void	GNUNET_CRYPTO_ecdsa_key_create (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_edx25519_key_create (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_edx25519_key_create_from_seed (const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Create a new private key for Edx25519 from a given seed. More...
void	GNUNET_CRYPTO_ecdhe_key_create (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_eddsa_key_clear (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_ecdsa_key_clear (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_edx25519_key_clear (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_ecdhe_key_clear (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
	Clear memory that was used to store a private key. More...
const struct GNUNET_CRYPTO_EcdsaPrivateKey *	GNUNET_CRYPTO_ecdsa_key_get_anonymous (void)
	Get the shared private key we use for anonymous users. More...
void	GNUNET_CRYPTO_eddsa_setup_hostkey (const char *cfg_name)
	Setup a hostkey file for a peer given the name of the configuration file (!). More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_get_peer_identity (const struct GNUNET_CONFIGURATION_Handle *cfg, struct GNUNET_PeerIdentity *dst)
	Retrieve the identity of the host's peer. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecc_ecdh (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a public and a private ECC key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_ecdh (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a ECDH public key and a private EdDSA key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *c, struct GNUNET_HashCode *key_material)
	Decapsulate a key for a private EdDSA key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_CRYPTO_EcdhePublicKey *c, struct GNUNET_HashCode *key_material)
	Encapsulate key material for a EdDSA public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_fo_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_CRYPTO_FoKemC *c, struct GNUNET_HashCode *key_material)
	Encapsulate key material using a CCA-secure KEM. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_fo_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_FoKemC *c, struct GNUNET_HashCode *key_material)
	Decapsulate key material using a CCA-secure KEM. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_fo_kem_encaps (const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, struct GNUNET_CRYPTO_FoKemC *c, struct GNUNET_HashCode *key_material)
	Encapsulate key material using a CCA-secure KEM. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_fo_kem_decaps (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, struct GNUNET_CRYPTO_FoKemC *c, struct GNUNET_HashCode *key_material)
	Decapsulate key material using a CCA-secure KEM. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_ecdh (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a ECDH public key and a private ECDSA key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdh_eddsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a EdDSA public key and a private ECDH key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdh_ecdsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a EcDSA public key and a private ECDH key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_sign_ (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EddsaSignature *sig)
	EdDSA sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_sign_ (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EcdsaSignature *sig)
	ECDSA Sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_edx25519_sign_ (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_Edx25519Signature *sig)
	Edx25519 sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_EddsaSignature *sig, const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
	Verify EdDSA signature. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_EcdsaSignature *sig, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Verify ECDSA signature. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_edx25519_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_Edx25519Signature *sig, const struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
	Verify Edx25519 signature. More...
struct GNUNET_CRYPTO_EcdsaPrivateKey *	GNUNET_CRYPTO_ecdsa_private_key_derive (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const char *label, const char *context)
	Derive a private key from a given private key and a label. More...
void	GNUNET_CRYPTO_ecdsa_public_key_derive (const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EcdsaPublicKey *result)
	Derive a public key from a given public key and a label. More...
void	GNUNET_CRYPTO_eddsa_private_key_derive (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPrivateScalar *result)
	Derive a private scalar from a given private key and a label. More...
void	GNUNET_CRYPTO_eddsa_public_key_derive (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPublicKey *result)
	Derive a public key from a given public key and a label. More...
void	GNUNET_CRYPTO_edx25519_private_key_derive (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PrivateKey *result)
	Derive a private scalar from a given private key and a label. More...
void	GNUNET_CRYPTO_edx25519_public_key_derive (const struct GNUNET_CRYPTO_Edx25519PublicKey *pub, const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PublicKey *result)
	Derive a public key from a given public key and a label. More...

Detailed Description

Provides cryptographic primitives.

See also

Documentation

Macro Definition Documentation

GNUNET_CRYPTO_eddsa_sign

#define GNUNET_CRYPTO_eddsa_sign	(		priv,
			ps,
			sig
	)

Value:

          do {                 \
          /* check size is set correctly */                              \
          GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*ps));    \
          /* check 'ps' begins with the purpose */                       \
          GNUNET_static_assert (((void*) (ps)) ==                        \
                                ((void*) &(ps)->purpose));               \
          GNUNET_assert (GNUNET_OK ==                                    \
                         GNUNET_CRYPTO_eddsa_sign_ (priv,                \
                                                    &(ps)->purpose,      \
                                                    sig));               \
} while (0)

EdDSA sign a given block.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2039 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_ecdsa_sign

#define GNUNET_CRYPTO_ecdsa_sign	(		priv,
			ps,
			sig
	)

Value:

          do {                 \
          /* check size is set correctly */                              \
          GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
          /* check 'ps' begins with the purpose */                       \
          GNUNET_static_assert (((void*) (ps)) ==                        \
                                ((void*) &(ps)->purpose));               \
          GNUNET_assert (GNUNET_OK ==                                    \
                         GNUNET_CRYPTO_ecdsa_sign_ (priv,                \
                                                    &(ps)->purpose,      \
                                                    sig));               \
} while (0)

ECDSA sign a given block.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2101 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_edx25519_sign

#define GNUNET_CRYPTO_edx25519_sign	(		priv,
			ps,
			sig
	)

Value:

          do {              \
          /* check size is set correctly */                              \
          GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
          /* check 'ps' begins with the purpose */                       \
          GNUNET_static_assert (((void*) (ps)) ==                        \
                                ((void*) &(ps)->purpose));               \
          GNUNET_assert (GNUNET_OK ==                                    \
                         GNUNET_CRYPTO_edx25519_sign_ (priv,             \
                                                       &(ps)->purpose,   \
                                                       sig));            \
} while (0)

Edx25519 sign a given block.

The resulting signature is compatible with EdDSA.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2148 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_eddsa_verify

#define GNUNET_CRYPTO_eddsa_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({             \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_CRYPTO_eddsa_verify_ (purp,                             \
                                 &(ps)->purpose,                   \
                                 sig,                              \
                                 pub);                             \
  })

Verify EdDSA signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 2201 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_ecdsa_verify

#define GNUNET_CRYPTO_ecdsa_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({             \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_CRYPTO_ecdsa_verify_ (purp,                             \
                                 &(ps)->purpose,                   \
                                 sig,                              \
                                 pub);                             \
  })

Verify ECDSA signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 2253 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_edx25519_verify

#define GNUNET_CRYPTO_edx25519_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({         \
    /* check size is set correctly */                             \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps))); \
    /* check 'ps' begins with the purpose */                      \
    GNUNET_static_assert (((void*) (ps)) ==                       \
                          ((void*) &(ps)->purpose));              \
    GNUNET_CRYPTO_edx25519_verify_ (purp,                         \
                                    &(ps)->purpose,               \
                                    sig,                          \
                                    pub);                         \
  })

Verify Edx25519 signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 2305 of file gnunet_crypto_lib.h.

Enumeration Type Documentation

GNUNET_CRYPTO_Quality

enum GNUNET_CRYPTO_Quality

Desired quality level for random numbers.

Enumerator
GNUNET_CRYPTO_QUALITY_WEAK	No good quality of the operation is needed (i.e., random numbers can be pseudo-random).
GNUNET_CRYPTO_QUALITY_STRONG	High-quality operations are desired.
GNUNET_CRYPTO_QUALITY_NONCE	Randomness for IVs etc. is required.

Definition at line 84 of file gnunet_crypto_lib.h.

{
  GNUNET_CRYPTO_QUALITY_WEAK,
 
  GNUNET_CRYPTO_QUALITY_STRONG,
 
  GNUNET_CRYPTO_QUALITY_NONCE
};

Function Documentation

GNUNET_CRYPTO_seed_weak_random()

void GNUNET_CRYPTO_seed_weak_random

(

int32_t

seed

)

Seed a weak random generator.

Only GNUNET_CRYPTO_QUALITY_WEAK-mode generator can be seeded.

Parameters

seed	the seed to use

Definition at line 91 of file crypto_random.c.

{
#ifdef OPENBSD
  srandom_deterministic (seed);
#else
  srandom (seed);
#endif
}

Referenced by __attribute__().

Here is the caller graph for this function:

GNUNET_CRYPTO_zero_keys()

void GNUNET_CRYPTO_zero_keys	(	void *	buffer,
		size_t	length
	)

Zero out buffer, securely against compiler optimizations.

Used to delete key material.

Parameters

buffer	the buffer to zap
length	buffer length

Definition at line 110 of file crypto_random.c.

{
#if HAVE_MEMSET_S
  memset_s (buffer, length, 0, length);
#elif HAVE_EXPLICIT_BZERO
  explicit_bzero (buffer, length);
#else
  volatile unsigned char *p = buffer;
  while (length--)
    *p++ = 0;
#endif
}

References p.

Referenced by dv_key_clean(), GNUNET_IDENTITY_decrypt(), and GNUNET_IDENTITY_decrypt_old().

Here is the caller graph for this function:

GNUNET_CRYPTO_random_block()

void GNUNET_CRYPTO_random_block	(	enum GNUNET_CRYPTO_Quality	mode,
		void *	buffer,
		size_t	length
	)

Fill block with a random values.

Parameters

	mode	desired quality of the random number
[out]	buffer	the buffer to fill
	length	buffer length
	mode	desired quality of the random number
	buffer	the buffer to fill
	length	buffer length

Definition at line 133 of file crypto_random.c.

{
#ifdef gcry_fast_random_poll
  static unsigned int invokeCount;
#endif
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    gcry_randomize (buffer, length, GCRY_STRONG_RANDOM);
    return;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    gcry_create_nonce (buffer, length);
    return;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    gcry_randomize (buffer, length, GCRY_WEAK_RANDOM);
    return;
 
  default:
    GNUNET_assert (0);
  }
}

References GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, and mode.

Referenced by delayed_put(), do_pad(), encode_message_body(), GCC_create(), generate_free_member_id(), GNUNET_async_scope_fresh(), GNUNET_CRYPTO_ecdhe_key_create(), GNUNET_CRYPTO_ecdsa_key_create(), GNUNET_CRYPTO_eddsa_key_create(), GNUNET_CRYPTO_edx25519_key_create(), GNUNET_CRYPTO_random_timeflake(), handle_validation_response(), mq_init(), output_vectors(), prepare_pending_acknowledgement(), RPS_sampler_elem_reinit(), run(), sock_read(), start_address_validation(), start_dv_learn(), and transmit_kx().

Here is the caller graph for this function:

GNUNET_CRYPTO_random_timeflake()

void GNUNET_CRYPTO_random_timeflake	(	enum GNUNET_CRYPTO_Quality	mode,
		struct GNUNET_Uuid *	uuid
	)

Fill UUID with a timeflake pseudo-random value.

Note that timeflakes use only 80 bits of randomness and 48 bits to encode a timestamp in milliseconds. So what we return here is not a completely random number.

Parameters

	mode	desired quality of the random number
[out]	uuid	the value to fill

Note that timeflakes use only 80 bits of randomness and 48 bits to encode a timestamp in milliseconds. So what we return here is not a completely random number.

Parameters

mode	desired quality of the random number
uuid	the value to fill

Definition at line 316 of file crypto_random.c.

{
  struct GNUNET_TIME_Absolute now;
  uint64_t ms;
  uint64_t be;
  char *base;
 
  GNUNET_CRYPTO_random_block (mode,
                              uuid,
                              sizeof (struct GNUNET_Uuid));
  now = GNUNET_TIME_absolute_get ();
  ms = now.abs_value_us / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us;
  be = GNUNET_htonll (ms);
  base = (char *) &be;
  memcpy (uuid,
          base + 2,
          sizeof (be) - 2);
}

References GNUNET_TIME_Absolute::abs_value_us, GNUNET_CRYPTO_random_block(), GNUNET_htonll(), GNUNET_TIME_absolute_get(), GNUNET_TIME_UNIT_MILLISECONDS, and mode.

Here is the call graph for this function:

GNUNET_CRYPTO_random_u32()

uint32_t GNUNET_CRYPTO_random_u32	(	enum GNUNET_CRYPTO_Quality	mode,
		uint32_t	i
	)

Produce a random value.

Parameters

mode	desired quality of the random number
i	the upper limit (exclusive) for the random number

Returns

a random value in the interval [0,i) (exclusive).

Produce a random value.

Parameters

mode	desired quality of the random number
i	the upper limit (exclusive) for the random number

Returns

a random value in the interval [0,i[.

Definition at line 178 of file crypto_random.c.

{
#ifdef gcry_fast_random_poll
  static unsigned int invokeCount;
#endif
  uint32_t ret;
  uint32_t ul;
 
  GNUNET_assert (i > 0);
 
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    ul = UINT32_MAX - (UINT32_MAX % i);
    do
    {
      gcry_randomize ((unsigned char *) &ret,
                      sizeof(uint32_t),
                      GCRY_STRONG_RANDOM);
    }
    while (ret >= ul);
    return ret % i;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    ul = UINT32_MAX - (UINT32_MAX % i);
    do
    {
      gcry_create_nonce (&ret, sizeof(ret));
    }
    while (ret >= ul);
    return ret % i;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    ret = i * get_weak_random ();
    if (ret >= i)
      ret = i - 1;
    return ret;
 
  default:
    GNUNET_assert (0);
  }
  return 0;
}

References get_weak_random(), GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, mode, and ret.

Referenced by __attribute__(), adjust_running_peers(), allocate_v4_address(), allocate_v6_address(), attempt_connect_task(), barrier_wait_cb(), calculate_seed(), channel_new_cb(), compute_service_response(), daemon_started(), delayed_get(), delayed_put(), download_get_url(), find_validation_entry(), GDS_am_closest_peer(), gen_topo_random(), generate_indices(), generate_request_id(), get_any(), get_bootstrap_server(), get_preference(), get_property(), get_random_literal(), get_random_peer_from_peermap(), get_request_socket(), get_typed(), GNUNET_BLOCK_GROUP_bf_create(), GNUNET_CONTAINER_heap_walk_get_next(), GNUNET_CONTAINER_multihashmap_get_random(), GNUNET_CONTAINER_multipeermap_get_random(), GNUNET_CONTAINER_multishortmap_get_random(), GNUNET_CONTAINER_multiuuidmap_get_random(), GNUNET_CRYPTO_hash_create_random(), GNUNET_CRYPTO_random_permute(), GNUNET_FRAGMENT_context_create(), GNUNET_FS_search_start_probe_(), GNUNET_TUN_initialize_ipv4_header(), GSC_CLIENTS_deliver_message(), GSF_pending_request_get_message_(), handle_client_evaluate(), handle_dns_request(), handle_dv_learn(), handle_flow_control(), handle_p2p_get(), handle_p2p_put(), handle_resolve_result(), main(), manage_service_wrapper(), ogg_init(), plan(), queue(), reannounce_regex(), recursive_dns_resolution(), REGEX_TEST_generate_random_regex(), REGEX_TEST_generate_random_string(), resolve_and_cache(), revalidate_address(), run(), second_stage(), select_peer(), select_random_peer(), send_bloomfilter(), send_hello(), send_keepalive(), setup_fresh_address(), setup_fresh_ping(), setup_sockets(), should_I_drop(), shuffle_answers(), start_dv_learn(), test_run(), transmit_typemap_task(), and try_open_exit().

Here is the call graph for this function:

GNUNET_CRYPTO_random_u64()

uint64_t GNUNET_CRYPTO_random_u64	(	enum GNUNET_CRYPTO_Quality	mode,
		uint64_t	max
	)

Generate a random unsigned 64-bit value.

Parameters

mode	desired quality of the random number
max	value returned will be in range [0,max) (exclusive)

Returns

random 64-bit number

Definition at line 262 of file crypto_random.c.

{
  uint64_t ret;
  uint64_t ul;
 
  GNUNET_assert (max > 0);
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    ul = UINT64_MAX - (UINT64_MAX % max);
    do
    {
      gcry_randomize ((unsigned char *) &ret,
                      sizeof(uint64_t),
                      GCRY_STRONG_RANDOM);
    }
    while (ret >= ul);
    return ret % max;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    ul = UINT64_MAX - (UINT64_MAX % max);
    do
    {
      gcry_create_nonce (&ret, sizeof(ret));
    }
    while (ret >= ul);
 
    return ret % max;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    ret = max * get_weak_random ();
    if (ret >= max)
      ret = max - 1;
    return ret;
 
  default:
    GNUNET_assert (0);
  }
  return 0;
}

References get_weak_random(), GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, max, mode, and ret.

Referenced by activate_core_visible_dv_path(), calculate_fork_degree(), choose_exit(), dht_connected(), gen_topo_scale_free(), GNUNET_DHT_connect(), GNUNET_REVOCATION_pow_start(), handle_dht_p2p_put(), handle_flow_control(), handle_validation_response(), ifc_broadcast(), namestore_flat_store_records(), pick_random_dv_hops(), postgres_plugin_get_key(), postgres_plugin_put(), put_migration_continuation(), run(), sampler_get_rand_peer(), send_find_peer_message(), send_full_set(), setup_out_cipher(), sqlite_plugin_get_key(), sqlite_plugin_get_replication(), sqlite_plugin_put(), and update_next_challenge_time().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_random_permute()

unsigned int* GNUNET_CRYPTO_random_permute	(	enum GNUNET_CRYPTO_Quality	mode,
		unsigned int	n
	)

Get an array with a random permutation of the numbers 0...n-1.

Parameters

mode	GNUNET_CRYPTO_QUALITY_STRONG if the strong (but expensive) PRNG should be used, GNUNET_CRYPTO_QUALITY_WEAK or GNUNET_CRYPTO_QUALITY_NONCE otherwise
n	the size of the array

Returns

the permutation array (allocated from heap)

Parameters

mode	#GNUNET_RANDOM_QUALITY_STRONG if the strong (but expensive) PRNG should be used, #GNUNET_RANDOM_QUALITY_WEAK otherwise
n	the size of the array

Returns

the permutation array (allocated from heap)

Definition at line 238 of file crypto_random.c.

{
  unsigned int *ret;
  unsigned int i;
  unsigned int tmp;
  uint32_t x;
 
  GNUNET_assert (n > 0);
  ret = GNUNET_malloc (n * sizeof(unsigned int));
  for (i = 0; i < n; i++)
    ret[i] = i;
  for (i = n - 1; i > 0; i--)
  {
    x = GNUNET_CRYPTO_random_u32 (mode, i + 1);
    tmp = ret[x];
    ret[x] = ret[i];
    ret[i] = tmp;
  }
  return ret;
}

References GNUNET_assert, GNUNET_CRYPTO_random_u32(), GNUNET_malloc, mode, and ret.

Referenced by churn(), compute_service_response(), and do_round().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_create_session_key()

void GNUNET_CRYPTO_symmetric_create_session_key

(

struct GNUNET_CRYPTO_SymmetricSessionKey *

key

)

Create a new random session key.

Parameters

key	key to initialize

Create a new random session key.

Parameters

key	session key to initialize

Definition at line 42 of file crypto_symmetric.c.

{
  gcry_randomize (key->aes_key,
                  GNUNET_CRYPTO_AES_KEY_LENGTH,
                  GCRY_STRONG_RANDOM);
  gcry_randomize (key->twofish_key,
                  GNUNET_CRYPTO_AES_KEY_LENGTH,
                  GCRY_STRONG_RANDOM);
}

References GNUNET_CRYPTO_AES_KEY_LENGTH, and key.

GNUNET_CRYPTO_symmetric_encrypt()

ssize_t GNUNET_CRYPTO_symmetric_encrypt	(	const void *	block,
		size_t	size,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	sessionkey,
		const struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		void *	result
	)

Encrypt a block using a symmetric sessionkey.

Parameters

block	the block to encrypt
size	the size of the block
sessionkey	the key used to encrypt
iv	the initialization vector to use, use INITVALUE for streams.

Returns

the size of the encrypted block, -1 for errors

Encrypt a block using a symmetric sessionkey.

Parameters

block	the block to encrypt
size	the size of the block
sessionkey	the key used to encrypt
iv	the initialization vector to use, use INITVALUE for streams
result	the output parameter in which to store the encrypted result can be the same or overlap with block

Returns

the size of the encrypted block, -1 for errors. Due to the use of CFB and therefore an effective stream cipher, this size should be the same as len.

Definition at line 131 of file crypto_symmetric.c.

{
  gcry_cipher_hd_t handle;
  char tmp[size];
 
  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_encrypt (handle, tmp, size, block, size));
  gcry_cipher_close (handle);
  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_encrypt (handle, result, size, tmp, size));
  gcry_cipher_close (handle);
  memset (tmp, 0, sizeof(tmp));
  return size;
}

References GNUNET_assert, GNUNET_OK, handle, result, setup_cipher_aes(), setup_cipher_twofish(), and size.

Referenced by do_encrypt(), encrypt_existing_match(), GNUNET_FS_handle_on_demand_block(), GNUNET_FS_publish_ublock_(), GNUNET_FS_tree_encoder_next(), GNUNET_IDENTITY_decrypt(), t_ax_encrypt(), t_h_encrypt(), and try_match_block().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_decrypt()

ssize_t GNUNET_CRYPTO_symmetric_decrypt	(	const void *	block,
		size_t	size,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	sessionkey,
		const struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		void *	result
	)

Decrypt a given block using a symmetric sessionkey.

Parameters

block	the data to decrypt, encoded as returned by encrypt
size	how big is the block?
sessionkey	the key used to decrypt
iv	the initialization vector to use
result	address to store the result at

Returns

-1 on failure, size of decrypted block on success

Decrypt a given block using a symmetric sessionkey.

Parameters

block	the data to decrypt, encoded as returned by encrypt
size	the size of the block to decrypt
sessionkey	the key used to decrypt
iv	the initialization vector to use, use INITVALUE for streams
result	address to store the result at can be the same or overlap with block

Returns

-1 on failure, size of decrypted block on success. Due to the use of CFB and therefore an effective stream cipher, this size should be the same as size.

Definition at line 169 of file crypto_symmetric.c.

{
  gcry_cipher_hd_t handle;
  char tmp[size];
 
  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_decrypt (handle, tmp, size, block, size));
  gcry_cipher_close (handle);
  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_decrypt (handle, result, size, tmp, size));
  gcry_cipher_close (handle);
  memset (tmp, 0, sizeof(tmp));
  return size;
}

References GNUNET_assert, GNUNET_OK, handle, result, setup_cipher_aes(), setup_cipher_twofish(), and size.

Referenced by do_decrypt(), GNUNET_FS_ublock_decrypt_(), GNUNET_IDENTITY_decrypt_old(), process_result_with_request(), t_ax_decrypt(), t_h_decrypt(), and try_old_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_derive_iv()

void GNUNET_CRYPTO_symmetric_derive_iv	(	struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	skey,
		const void *	salt,
		size_t	salt_len,
			...
	)

Derive an IV.

Parameters

iv	initialization vector
skey	session key
salt	salt for the derivation
salt_len	size of the salt
...	pairs of void * & size_t for context chunks, terminated by NULL

Definition at line 203 of file crypto_symmetric.c.

{
  va_list argp;
 
  va_start (argp, salt_len);
  GNUNET_CRYPTO_symmetric_derive_iv_v (iv, skey, salt, salt_len, argp);
  va_end (argp);
}

References GNUNET_CRYPTO_symmetric_derive_iv_v(), and salt.

Referenced by derive_iv(), derive_pong_iv(), t_ax_decrypt(), t_ax_encrypt(), t_h_decrypt(), t_h_encrypt(), and try_old_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_get_public()

void GNUNET_CRYPTO_ecdsa_key_get_public	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		struct GNUNET_CRYPTO_EcdsaPublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 187 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdsa_key_get_public);
  crypto_scalarmult_ed25519_base_noclamp (pub->q_y, priv->d);
  BENCHMARK_END (ecdsa_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EcdsaPrivateKey::d, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by decrypt_block_with_keyword(), get_update_information_directory(), GNUNET_CRYPTO_ecdsa_private_key_derive(), GNUNET_FS_publish_sks(), GNUNET_FS_publish_ublock_(), GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), and process_kblock_for_unindex().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_get_public()

void GNUNET_CRYPTO_eddsa_key_get_public	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		struct GNUNET_CRYPTO_EddsaPublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 198 of file crypto_ecc.c.

{
  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
  unsigned char sk[crypto_sign_SECRETKEYBYTES];
 
  BENCHMARK_START (eddsa_key_get_public);
  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
  GNUNET_memcpy (pub->q_y, pk, crypto_sign_PUBLICKEYBYTES);
  sodium_memzero (sk, crypto_sign_SECRETKEYBYTES);
  BENCHMARK_END (eddsa_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EddsaPrivateKey::d, GNUNET_assert, GNUNET_memcpy, pk, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by advertise_dns_exit(), checkvec(), create_keys(), get_identity(), GNUNET_CRYPTO_eddsa_private_key_derive(), GNUNET_FS_uri_loc_create(), GNUNET_TESTING_get_peer(), GNUNET_TESTING_hostkey_get(), GSC_KX_init(), init_socket(), main_init(), output_vectors(), print_key(), regex_iterator(), and run().

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_get_public()

void GNUNET_CRYPTO_edx25519_key_get_public	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		struct GNUNET_CRYPTO_Edx25519PublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 79 of file crypto_edx25519.c.

{
  crypto_scalarmult_ed25519_base_noclamp (pub->q_y,
                                          priv->a);
}

References GNUNET_CRYPTO_Edx25519PrivateKey::a, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by GNUNET_CRYPTO_edx25519_private_key_derive(), and output_vectors().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_key_get_public()

void GNUNET_CRYPTO_ecdhe_key_get_public	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		struct GNUNET_CRYPTO_EcdhePublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 214 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdhe_key_get_public);
  GNUNET_assert (0 == crypto_scalarmult_base (pub->q_y, priv->d));
  BENCHMARK_END (ecdhe_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_assert, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by GCT_add_channel(), GCT_send(), GNUNET_IDENTITY_decrypt(), output_vectors(), print_examples_ecdh(), send_kx(), send_kx_auth(), and sign_ephemeral_key().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_from_file()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_key_from_file	(	const char *	filename,
		int	do_create,
		struct GNUNET_CRYPTO_EcdsaPrivateKey *	pkey
	)

Create a new private key by reading it from a file.

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

GNUNET_OK on success, GNUNET_NO if do_create was set but we found an existing file, GNUNET_SYSERR on failure

Definition at line 1 of file crypto_ecc_setup.c.

{
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that we didn't create it... */
    return (do_create) ? GNUNET_NO : GNUNET_OK;
  }
  else if (! do_create)
  {
    return GNUNET_SYSERR;
  }
  GNUNET_CRYPTO_ecdsa_key_create (pkey);
  if (GNUNET_OK ==
      GNUNET_DISK_fn_write (filename,
                            pkey,
                            sizeof (*pkey),
                            GNUNET_DISK_PERM_USER_READ))
    return GNUNET_OK;
  /* maybe another process succeeded in the meantime, try reading one more time */
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that *we* didn't create it... */
    return GNUNET_NO;
  }
  /* give up */
  return GNUNET_SYSERR;
}

GNUNET_CRYPTO_eddsa_key_from_file()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_key_from_file	(	const char *	filename,
		int	do_create,
		struct GNUNET_CRYPTO_EddsaPrivateKey *	pkey
	)

Create a new private key by reading it from a file.

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

GNUNET_OK on success, GNUNET_NO if do_create was set but we found an existing file, GNUNET_SYSERR on failure

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

- GNUNET_OK on success,

• GNUNET_NO if do_create was set but we found an existing file,
• GNUNET_SYSERR on failure or if the file didn't exist and do_create was not set

Definition at line 1 of file crypto_ecc_setup.c.

{
  enum GNUNET_GenericReturnValue ret;
 
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that we didn't create it... */
    return (do_create) ? GNUNET_NO : GNUNET_OK;
  }
  else if (! do_create)
  {
    return GNUNET_SYSERR;
  }
 
  GNUNET_CRYPTO_eddsa_key_create (pkey);
  ret = GNUNET_DISK_fn_write (filename,
                              pkey,
                              sizeof (*pkey),
                              GNUNET_DISK_PERM_USER_READ);
  if ( (GNUNET_OK == ret) ||
       (GNUNET_SYSERR == ret) )
    return ret;
  /* maybe another process succeeded in the meantime, try reading one more time */
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that *we* didn't create it... */
    return GNUNET_NO;
  }
  /* give up */
  return GNUNET_SYSERR;
}

Referenced by GNUNET_CRYPTO_eddsa_key_create_from_configuration(), main_init(), and run().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_create_from_configuration()

struct GNUNET_CRYPTO_EddsaPrivateKey* GNUNET_CRYPTO_eddsa_key_create_from_configuration

(

const struct GNUNET_CONFIGURATION_Handle *

cfg

)

Create a new private key by reading our peer's key from the file specified in the configuration.

Parameters

cfg	the configuration to use

Returns

new private key, NULL on error (for example, permission denied); free using GNUNET_free

Parameters

cfg	the configuration to use

Returns

new private key, NULL on error (for example, permission denied)

Definition at line 247 of file crypto_ecc_setup.c.

{
  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
  char *fn;
 
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_filename (cfg,
                                               "PEER",
                                               "PRIVATE_KEY",
                                               &fn))
    return NULL;
  priv = GNUNET_new (struct GNUNET_CRYPTO_EddsaPrivateKey);
  if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_key_from_file (fn,
                                                          GNUNET_YES,
                                                          priv))
  {
    GNUNET_free (fn);
    GNUNET_free (priv);
    return NULL;
  }
  GNUNET_free (fn);
  return priv;
}

References cfg, GNUNET_CONFIGURATION_get_value_filename(), GNUNET_CRYPTO_eddsa_key_from_file(), GNUNET_free, GNUNET_new, GNUNET_OK, GNUNET_SYSERR, and GNUNET_YES.

Referenced by advertise_dns_exit(), GNUNET_CRYPTO_eddsa_setup_key(), init_socket(), and run().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_create()

void GNUNET_CRYPTO_ecdsa_key_create

(

struct GNUNET_CRYPTO_EcdsaPrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 447 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdsa_key_create);
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
  pk->d[0] &= 248;
  pk->d[31] &= 127;
  pk->d[31] |= 64;
 
  BENCHMARK_END (ecdsa_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by run_edkey(), and run_pkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_create()

void GNUNET_CRYPTO_eddsa_key_create

(

struct GNUNET_CRYPTO_EddsaPrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 462 of file crypto_ecc.c.

{
  BENCHMARK_START (eddsa_key_create);
  /*
   * We do not clamp for EdDSA, since all functions that use the private key do
   * their own clamping (just like in libsodium).  What we call "private key"
   * here, actually corresponds to the seed in libsodium.
   *
   * (Contrast this to ECDSA, where functions using the private key can't clamp
   * due to properties needed for GNS.  That is a worse/unsafer API, but
   * required for the GNS constructions to work.)
   */
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
  BENCHMARK_END (eddsa_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by create_keys(), output_vectors(), and run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_create()

void GNUNET_CRYPTO_edx25519_key_create

(

struct GNUNET_CRYPTO_Edx25519PrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 65 of file crypto_edx25519.c.

{
  char seed[256 / 8];
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              seed,
                              sizeof (seed));
  GNUNET_CRYPTO_edx25519_key_create_from_seed (seed,
                                               sizeof(seed),
                                               pk);
}

References GNUNET_CRYPTO_edx25519_key_create_from_seed(), GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_create_from_seed()

void GNUNET_CRYPTO_edx25519_key_create_from_seed	(	const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PrivateKey *	pk
	)

Create a new private key for Edx25519 from a given seed.

After expanding the seed, the first half of the key will be clamped according to EdDSA.

Parameters

	seed	seed input
	seedsize	size of the seed in bytes
[out]	pk	private key to initialize

Definition at line 45 of file crypto_edx25519.c.

{
 
  GNUNET_static_assert (sizeof(*pk) == sizeof(struct GNUNET_HashCode));
  GNUNET_CRYPTO_hash (seed,
                      seedsize,
                      (struct GNUNET_HashCode *) pk);
 
  /* Clamp the first half of the key. The second half is used in the signature
   * process. */
  pk->a[0] &= 248;
  pk->a[31] &= 127;
  pk->a[31] |= 64;
}

References GNUNET_CRYPTO_hash(), GNUNET_static_assert, and pk.

Referenced by GNUNET_CRYPTO_edx25519_key_create().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_key_create()

void GNUNET_CRYPTO_ecdhe_key_create

(

struct GNUNET_CRYPTO_EcdhePrivateKey *

pk

)

Create a new private key.

Clear with GNUNET_CRYPTO_ecdhe_key_clear().

Parameters

[out]

pk

set to fresh private key;

Definition at line 436 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdhe_key_create);
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
  BENCHMARK_END (ecdhe_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by do_rekey(), GCT_create_tunnel(), GNUNET_IDENTITY_decrypt(), GSC_KX_init(), new_ephemeral(), output_vectors(), and print_examples_ecdh().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_clear()

void GNUNET_CRYPTO_eddsa_key_clear

(

struct GNUNET_CRYPTO_EddsaPrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 429 of file crypto_ecc.c.

{
  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey));
}

References pk.

GNUNET_CRYPTO_ecdsa_key_clear()

void GNUNET_CRYPTO_ecdsa_key_clear

(

struct GNUNET_CRYPTO_EcdsaPrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 422 of file crypto_ecc.c.

{
  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
}

References pk.

GNUNET_CRYPTO_edx25519_key_clear()

void GNUNET_CRYPTO_edx25519_key_clear

(

struct GNUNET_CRYPTO_Edx25519PrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 38 of file crypto_edx25519.c.

{
  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_Edx25519PrivateKey));
}

References pk.

GNUNET_CRYPTO_ecdhe_key_clear()

void GNUNET_CRYPTO_ecdhe_key_clear

(

struct GNUNET_CRYPTO_EcdhePrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 415 of file crypto_ecc.c.

{
  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_EcdhePrivateKey));
}

References pk.

Referenced by cleanup_ax(), and GNUNET_IDENTITY_decrypt().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_get_anonymous()

const struct GNUNET_CRYPTO_EcdsaPrivateKey* GNUNET_CRYPTO_ecdsa_key_get_anonymous

(

void

)

Get the shared private key we use for anonymous users.

Returns

"anonymous" private key; do not free

'anonymous' pseudonym (global static, d=1, public key = G (generator).

Definition at line 482 of file crypto_ecc.c.

{
  static struct GNUNET_CRYPTO_EcdsaPrivateKey anonymous;
  static int once;
 
  if (once)
    return &anonymous;
  GNUNET_CRYPTO_mpi_print_unsigned (anonymous.d,
                                    sizeof(anonymous.d),
                                    GCRYMPI_CONST_ONE);
  anonymous.d[0] &= 248;
  anonymous.d[31] &= 127;
  anonymous.d[31] |= 64;
 
  once = 1;
  return &anonymous;
}

References GNUNET_CRYPTO_EcdsaPrivateKey::d, GNUNET_CRYPTO_mpi_print_unsigned(), and once.

Referenced by decrypt_block_with_keyword(), GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), GNUNET_IDENTITY_ego_get_anonymous(), process_kblock_for_unindex(), and publish_ksk_cont().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_setup_hostkey()

void GNUNET_CRYPTO_eddsa_setup_hostkey

(

const char *

cfg_name

)

Setup a hostkey file for a peer given the name of the configuration file (!).

This function is used so that at a later point code can be certain that reading a hostkey is fast (for example in time-dependent testcases).

Parameters

cfg_name

name of the configuration file to use

GNUNET_CRYPTO_get_peer_identity()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_get_peer_identity	(	const struct GNUNET_CONFIGURATION_Handle *	cfg,
		struct GNUNET_PeerIdentity *	dst
	)

Retrieve the identity of the host's peer.

Parameters

cfg	configuration to use
dst	pointer to where to write the peer identity

Returns

GNUNET_OK on success, GNUNET_SYSERR if the identity could not be retrieved

Definition at line 247 of file crypto_ecc_setup.c.

{
  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
 
  if (NULL == (priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("Could not load peer's private key\n"));
    return GNUNET_SYSERR;
  }
  GNUNET_CRYPTO_eddsa_key_get_public (priv,
                                      &dst->public_key);
  GNUNET_free (priv);
  return GNUNET_OK;
}

Referenced by get_result_iterator(), get_service_peer_identity(), GNUNET_CONVERSATION_phone_create(), libgnunet_plugin_dhtu_ip_init(), on_peer(), and run().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecc_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecc_ecdh	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a public and a private ECC key.

Parameters

priv	private key to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material (xyG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

References data, GNUNET_CRYPTO_hash(), GNUNET_ERROR_TYPE_ERROR, LOG_GCRY, and GNUNET_CRYPTO_EccSignaturePurpose::size.

Referenced by checkvec(), derive_session_keys(), output_vectors(), print_examples_ecdh(), t_ax_decrypt_and_validate(), t_ax_encrypt(), and update_ax_by_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_ecdh	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a ECDH public key and a private EdDSA key.

Dual to #GNUNET_CRRYPTO_ecdh_eddsa.

Parameters

priv	private key from EdDSA to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_HashCode hc;
  uint8_t a[crypto_scalarmult_SCALARBYTES];
  uint8_t p[crypto_scalarmult_BYTES];
 
  GNUNET_CRYPTO_hash (priv,
                      sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey),
                      &hc);
  memcpy (a, &hc, sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
  if (0 != crypto_scalarmult (p, a, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p,
                      crypto_scalarmult_BYTES,
                      key_material);
  return GNUNET_OK;
}

Referenced by GNUNET_IDENTITY_decrypt_old(), and update_ax_by_kx().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_kem_decaps	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	c,
		struct GNUNET_HashCode *	key_material
	)

Decapsulate a key for a private EdDSA key.

Dual to #GNUNET_CRRYPTO_eddsa_kem_encaps.

Parameters

priv	private key from EdDSA to use for the ECDH (x)
c	the encapsulated key
key_material	where to write the key material H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  return GNUNET_CRYPTO_eddsa_ecdh (priv, c, key_material);
}

Referenced by handle_dv_box(), setup_in_cipher(), and setup_shared_secret_dec().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_kem_encaps	(	const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		struct GNUNET_CRYPTO_EcdhePublicKey *	c,
		struct GNUNET_HashCode *	key_material
	)

Encapsulate key material for a EdDSA public key.

Dual to #GNUNET_CRRYPTO_eddsa_kem_decaps.

Parameters

priv	private key to use for the ECDH (y)
c	public key from EdDSA to use for the ECDH (X=h(x)G)
key_material	where to write the key material H(yX)=H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
 
  GNUNET_CRYPTO_ecdhe_key_create (&sk);
  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, c);
  return GNUNET_CRYPTO_ecdh_eddsa (&sk, pub, key_material);
}

Referenced by inject_rekey(), setup_shared_secret_ephemeral(), and start_initial_kx_out().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_fo_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_fo_kem_encaps	(	const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		struct GNUNET_CRYPTO_FoKemC *	c,
		struct GNUNET_HashCode *	key_material
	)

Encapsulate key material using a CCA-secure KEM.

The KEM is using a OWTF with image oracle constructed from a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP). Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_decaps.

Parameters

	pub	public key to encapsulated for
[out]	c	the encapsulation
[out]	key_material	the encapsulated key

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_HashCode x;
  struct GNUNET_HashCode ux;
  struct GNUNET_HashCode w;
  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
  enum GNUNET_GenericReturnValue ret;
 
  // This is the input to the FO OWTF
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE, &x, sizeof(x));
 
  // We build our OWTF using a FO-transformation of ElGamal:
  // U(x)
  GNUNET_CRYPTO_hash (&x, sizeof (x), &ux);
  GNUNET_memcpy (&sk, &ux, sizeof (sk));
 
  // B := g^U(x)
  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, &c->pub);
 
  ret = GNUNET_CRYPTO_ecdh_eddsa (&sk, pub, &w);
  if (GNUNET_OK != ret)
    return ret;
  // w xor x (one-time pad)
  GNUNET_CRYPTO_hash_xor (&w, &x, &c->y);
 
  // k := H(x) FIXME: U and H must be different?
  GNUNET_memcpy (key_material, &ux, sizeof (ux));
  return GNUNET_OK;
}

GNUNET_CRYPTO_eddsa_fo_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_fo_kem_decaps	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_FoKemC *	c,
		struct GNUNET_HashCode *	key_material
	)

Decapsulate key material using a CCA-secure KEM.

The KEM is using a OWTF with image oracle constructed from a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP). Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_encaps.

Parameters

	priv	private key this encapsulation is for
	c	the encapsulation
[out]	key_material	the encapsulated key

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Decapsulate key material using a CCA-secure KEM.

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_HashCode w;
  enum GNUNET_GenericReturnValue ret;
 
  ret = GNUNET_CRYPTO_eddsa_ecdh (priv, &c->pub, &w);
  if (GNUNET_OK != ret)
    return ret;
  return fo_kem_decaps (&w, c, key_material);
}

GNUNET_CRYPTO_ecdsa_fo_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_fo_kem_encaps	(	const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub,
		struct GNUNET_CRYPTO_FoKemC *	c,
		struct GNUNET_HashCode *	key_material
	)

Encapsulate key material using a CCA-secure KEM.

The KEM is using a OWTF with image oracle constructed from a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP). Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_decaps.

Parameters

	pub	public key to encapsulated for
[out]	c	the encapsulation
[out]	key_material	the encapsulated key

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_HashCode x;
  struct GNUNET_HashCode ux;
  struct GNUNET_HashCode w;
  struct GNUNET_CRYPTO_EcdhePrivateKey sk;
 
  // This is the input to the FO OWTF
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE, &x, sizeof(x));
 
  // We build our OWTF using a FO-transformation of ElGamal:
  // U(x)
  GNUNET_CRYPTO_hash (&x, sizeof (x), &ux);
  GNUNET_memcpy (&sk, &ux, sizeof (sk));
 
  // B := g^U(x)
  GNUNET_CRYPTO_ecdhe_key_get_public (&sk, &c->pub);
 
  if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdh_ecdsa (&sk, pub, &w))
    return -1;
  // w xor x (one-time pad)
  GNUNET_CRYPTO_hash_xor (&w, &x, &c->y);
 
  // k := H(x) FIXME: U and H must be different?
  GNUNET_memcpy (key_material, &ux, sizeof (ux));
  return GNUNET_OK;
}

GNUNET_CRYPTO_ecdsa_fo_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_fo_kem_decaps	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		struct GNUNET_CRYPTO_FoKemC *	c,
		struct GNUNET_HashCode *	key_material
	)

Decapsulate key material using a CCA-secure KEM.

The KEM is using a OWTF with image oracle constructed from a Fujusaki-Okamoto transformation using ElGamal (DH plus XOR OTP). Dual to #GNUNET_CRRYPTO_eddsa_fo_kem_encaps.

Parameters

	priv	private key this encapsulation is for
	c	the encapsulation
[out]	key_material	the encapsulated key

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  struct GNUNET_HashCode w;
  enum GNUNET_GenericReturnValue ret;
 
  ret = GNUNET_CRYPTO_ecdsa_ecdh (priv, &c->pub, &w);
  if (GNUNET_OK != ret)
    return ret;
  return fo_kem_decaps (&w, c, key_material);
}

GNUNET_CRYPTO_ecdsa_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_ecdh	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a ECDH public key and a private ECDSA key.

Dual to #GNUNET_CRRYPTO_ecdh_ecdsa.

Parameters

priv	private key from ECDSA to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
 
  BENCHMARK_START (ecdsa_ecdh);
  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p,
                      crypto_scalarmult_BYTES,
                      key_material);
  BENCHMARK_END (ecdsa_ecdh);
  return GNUNET_OK;
}

Referenced by GNUNET_IDENTITY_decrypt_old().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdh_eddsa()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdh_eddsa	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a EdDSA public key and a private ECDH key.

Dual to #GNUNET_CRRYPTO_eddsa_ecdh.

Parameters

priv	private key to use for the ECDH (y)
pub	public key from EdDSA to use for the ECDH (X=h(x)G)
key_material	where to write the key material H(yX)=H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
 
  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
    return GNUNET_SYSERR;
  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

Referenced by checkvec(), GNUNET_IDENTITY_decrypt(), output_vectors(), and update_ax_by_kx().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdh_ecdsa()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdh_ecdsa	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a EcDSA public key and a private ECDH key.

Dual to #GNUNET_CRRYPTO_ecdsa_ecdh.

Parameters

priv	private key to use for the ECDH (y)
pub	public key from ECDSA to use for the ECDH (X=h(x)G)
key_material	where to write the key material H(yX)=H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
 
  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
    return GNUNET_SYSERR;
  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

Referenced by GNUNET_IDENTITY_decrypt().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_sign_	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_EddsaSignature *	sig
	)

EdDSA sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_eddsa_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
 
  size_t mlen = ntohl (purpose->size);
  unsigned char sk[crypto_sign_SECRETKEYBYTES];
  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
  int res;
 
  BENCHMARK_START (eddsa_sign);
  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
  res = crypto_sign_detached ((uint8_t *) sig,
                              NULL,
                              (uint8_t *) purpose,
                              mlen,
                              sk);
  BENCHMARK_END (eddsa_sign);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

Referenced by do_dht_put(), GST_validation_handle_ping(), insert_decrypt_element(), insert_round1_element(), insert_round2_element(), regex_iterator(), send_disconnect(), setup_flood_message(), and sign_ephemeral_key().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_sign_	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_EcdsaSignature *	sig
	)

ECDSA Sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_ecdsa_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 513 of file crypto_ecc.c.

{
  gcry_sexp_t priv_sexp;
  gcry_sexp_t sig_sexp;
  gcry_sexp_t data;
  int rc;
  gcry_mpi_t rs[2];
 
  BENCHMARK_START (ecdsa_sign);
 
  priv_sexp = decode_private_ecdsa_key (priv);
  data = data_to_ecdsa_value (purpose);
  if (0 != (rc = gcry_pk_sign (&sig_sexp, data, priv_sexp)))
  {
    LOG (GNUNET_ERROR_TYPE_WARNING,
         _ ("ECC signing failed at %s:%d: %s\n"),
         __FILE__,
         __LINE__,
         gcry_strerror (rc));
    gcry_sexp_release (data);
    gcry_sexp_release (priv_sexp);
    return GNUNET_SYSERR;
  }
  gcry_sexp_release (priv_sexp);
  gcry_sexp_release (data);
 
  /* extract 'r' and 's' values from sexpression 'sig_sexp' and store in
     'signature' */
  if (0 != (rc = key_from_sexp (rs, sig_sexp, "sig-val", "rs")))
  {
    GNUNET_break (0);
    gcry_sexp_release (sig_sexp);
    return GNUNET_SYSERR;
  }
  gcry_sexp_release (sig_sexp);
  GNUNET_CRYPTO_mpi_print_unsigned (sig->r, sizeof(sig->r), rs[0]);
  GNUNET_CRYPTO_mpi_print_unsigned (sig->s, sizeof(sig->s), rs[1]);
  gcry_mpi_release (rs[0]);
  gcry_mpi_release (rs[1]);
 
  BENCHMARK_END (ecdsa_sign);
 
  return GNUNET_OK;
}

Referenced by GNUNET_FS_publish_ublock_().

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_edx25519_sign_	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_Edx25519Signature *	sig
	)

Edx25519 sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_edx25519_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Edx25519 sign a given block.

But instead of expanding a private seed (which is usually the case for crypto APIs) and using the resulting scalars, it takes the scalars directly from Edx25519PrivateKey. We require this functionality in order to use derived private keys for signatures.

The resulting signature is a standard EdDSA signature which can be verified using the usual APIs.

Parameters

priv	the private key (containing two scalars .a and .b)
purp	the signature purpose
sig	the resulting signature

Calculate the public key P from the private scalar in the key.

Calculate r: r = SHA512 (b ∥ M) where M is our message (purpose).

Temporarily put P into S

Reduce the scalar value r

Calculate R := r * G of the signature

Calculate hram := SHA512 (R ∥ P ∥ M)

Reduce the resulting scalar value

Calculate S := r + hram * s mod L

Definition at line 79 of file crypto_edx25519.c.

{
 
  crypto_hash_sha512_state hs;
  unsigned char r[64];
  unsigned char hram[64];
  unsigned char P[32];
  unsigned char r_mod[64];
  unsigned char R[32];
  unsigned char tmp[32];
 
  crypto_hash_sha512_init (&hs);
 
  crypto_scalarmult_ed25519_base_noclamp (P,
                                          priv->a);
 
  crypto_hash_sha512_update (&hs,
                             priv->b,
                             sizeof(priv->b));
  crypto_hash_sha512_update (&hs,
                             (uint8_t*) purpose,
                             ntohl (purpose->size));
  crypto_hash_sha512_final (&hs,
                            r);
 
  memcpy (sig->s, P, 32);
 
  crypto_core_ed25519_scalar_reduce (r_mod, r);
 
  crypto_scalarmult_ed25519_base_noclamp (R, r_mod);
  memcpy (sig->r, R, sizeof (R));
 
  crypto_hash_sha512_init (&hs);
  crypto_hash_sha512_update (&hs, (uint8_t*) sig, 64);
  crypto_hash_sha512_update (&hs, (uint8_t*) purpose,
                             ntohl (purpose->size));
  crypto_hash_sha512_final (&hs, hram);
 
  unsigned char hram_mod[64];
  crypto_core_ed25519_scalar_reduce (hram_mod, hram);
 
  crypto_core_ed25519_scalar_mul (tmp, hram_mod, priv->a);
  crypto_core_ed25519_scalar_add (sig->s, tmp, r_mod);
 
  sodium_memzero (r, sizeof (r));
  sodium_memzero (r_mod, sizeof (r_mod));
 
  return GNUNET_OK;
}

GNUNET_CRYPTO_eddsa_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_EddsaSignature *	sig,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pub
	)

Verify EdDSA signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_eddsa_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 513 of file crypto_ecc.c.

{
  const unsigned char *m = (const void *) validate;
  size_t mlen = ntohl (validate->size);
  const unsigned char *s = (const void *) sig;
 
  int res;
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  BENCHMARK_START (eddsa_verify);
 
  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
  BENCHMARK_END (eddsa_verify);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

Referenced by GST_neighbours_handle_disconnect_message(), GST_validation_handle_pong(), handle_ephemeral_key(), keygen_round1_new_element(), keygen_round2_new_element(), and verify_message_crypto().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_EcdsaSignature *	sig,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub
	)

Verify ECDSA signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_eddsa_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 513 of file crypto_ecc.c.

{
  gcry_sexp_t data;
  gcry_sexp_t sig_sexpr;
  gcry_sexp_t pub_sexpr;
  int rc;
 
  BENCHMARK_START (ecdsa_verify);
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  /* build s-expression for signature */
  if (0 != (rc = gcry_sexp_build (&sig_sexpr,
                                  NULL,
                                  "(sig-val(ecdsa(r %b)(s %b)))",
                                  (int) sizeof(sig->r),
                                  sig->r,
                                  (int) sizeof(sig->s),
                                  sig->s)))
  {
    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
    return GNUNET_SYSERR;
  }
  data = data_to_ecdsa_value (validate);
  if (0 != (rc = gcry_sexp_build (&pub_sexpr,
                                  NULL,
                                  "(public-key(ecc(curve " CURVE ")(q %b)))",
                                  (int) sizeof(pub->q_y),
                                  pub->q_y)))
  {
    gcry_sexp_release (data);
    gcry_sexp_release (sig_sexpr);
    return GNUNET_SYSERR;
  }
  rc = gcry_pk_verify (sig_sexpr, data, pub_sexpr);
  gcry_sexp_release (pub_sexpr);
  gcry_sexp_release (data);
  gcry_sexp_release (sig_sexpr);
  if (0 != rc)
  {
    LOG (GNUNET_ERROR_TYPE_INFO,
         _ ("ECDSA signature verification failed at %s:%d: %s\n"),
         __FILE__,
         __LINE__,
         gcry_strerror (rc));
    BENCHMARK_END (ecdsa_verify);
    return GNUNET_SYSERR;
  }
  BENCHMARK_END (ecdsa_verify);
  return GNUNET_OK;
}

GNUNET_CRYPTO_edx25519_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_edx25519_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_Edx25519Signature *	sig,
		const struct GNUNET_CRYPTO_Edx25519PublicKey *	pub
	)

Verify Edx25519 signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_edx25519_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 79 of file crypto_edx25519.c.

{
  const unsigned char *m = (const void *) validate;
  size_t mlen = ntohl (validate->size);
  const unsigned char *s = (const void *) sig;
 
  int res;
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

GNUNET_CRYPTO_ecdsa_private_key_derive()

struct GNUNET_CRYPTO_EcdsaPrivateKey* GNUNET_CRYPTO_ecdsa_private_key_derive	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const char *	label,
		const char *	context
	)

Derive a private key from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'.

Parameters

priv	original private key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'; typically the name of the subsystem/application

Returns

derived private key

Definition at line 196 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
  struct GNUNET_CRYPTO_EcdsaPrivateKey *ret;
  struct GNUNET_HashCode hc;
  uint8_t dc[32];
  gcry_mpi_t h;
  gcry_mpi_t x;
  gcry_mpi_t d;
  gcry_mpi_t n;
  gcry_ctx_t ctx;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
 
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  GNUNET_CRYPTO_ecdsa_key_get_public (priv, &pub);
 
  derive_h (&pub, sizeof (pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
 
  /* Convert to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    dc[i] = priv->d[31 - i];
  GNUNET_CRYPTO_mpi_scan_unsigned (&x, dc, sizeof(dc));
  d = gcry_mpi_new (256);
  gcry_mpi_mulm (d, h, x, n);
  gcry_mpi_release (h);
  gcry_mpi_release (x);
  gcry_mpi_release (n);
  gcry_ctx_release (ctx);
  ret = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
  /* Convert to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    ret->d[i] = dc[31 - i];
  sodium_memzero (dc, sizeof(dc));
  gcry_mpi_release (d);
  return ret;
}

References context, ctx, CURVE, GNUNET_CRYPTO_EcdsaPrivateKey::d, dc, derive_h(), GNUNET_assert, GNUNET_CRYPTO_ecdsa_key_get_public(), GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), GNUNET_new, h, pub, and ret.

Referenced by GNUNET_FS_publish_ublock_(), and run_pkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_public_key_derive()

void GNUNET_CRYPTO_ecdsa_public_key_derive	(	const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EcdsaPublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'. typically the name of the subsystem/application
result	where to write the derived public key

Definition at line 241 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_HashCode hc;
  gcry_ctx_t ctx;
  gcry_mpi_t q_y;
  gcry_mpi_t h;
  gcry_mpi_t n;
  gcry_mpi_t h_mod_n;
  gcry_mpi_point_t q;
  gcry_mpi_point_t v;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
 
  /* obtain point 'q' from original public key.  The provided 'q' is
     compressed thus we first store it in the context and then get it
     back as a (decompresssed) point.  */
  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
  GNUNET_assert (NULL != q_y);
  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
  gcry_mpi_release (q_y);
  q = gcry_mpi_ec_get_point ("q", ctx, 0);
  GNUNET_assert (q);
 
  /* calculate h_mod_n = h % n */
  derive_h (pub, sizeof (*pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  h_mod_n = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_n, h, n);
  /* calculate v = h_mod_n * q */
  v = gcry_mpi_point_new (0);
  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
  gcry_mpi_release (h_mod_n);
  gcry_mpi_release (h);
  gcry_mpi_release (n);
  gcry_mpi_point_release (q);
 
  /* convert point 'v' to public key that we return */
  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
  gcry_mpi_point_release (v);
  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
  GNUNET_assert (q_y);
  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
  gcry_mpi_release (q_y);
  gcry_ctx_release (ctx);
}

References context, ctx, CURVE, derive_h(), GNUNET_assert, GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, q, GNUNET_CRYPTO_EddsaPublicKey::q_y, and result.

Referenced by GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), run_pkey(), and schedule_transmit_search_request().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_private_key_derive()

void GNUNET_CRYPTO_eddsa_private_key_derive	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EddsaPrivateScalar *	result
	)

Derive a private scalar from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'. The result is the derived private scalar, not the private key as for EdDSA we cannot derive before we hash the private key.

Parameters

priv	original private key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'; typically the name of the subsystem/application
result	derived private scalar

Libsodium does not offer an API with arbitrary arithmetic. Hence we have to use libgcrypt here.

Get our modulo L

This is the standard private key expansion in Ed25519. The first 32 octets are used as a little-endian private scalar. We derive this scalar using our "h".

Get h mod L

dc now contains the private scalar "a". We calculate: d' := h * a mod L

We hash the derived "h" parameter with the other half of the expanded private key. This ensures that for signature generation, the "R" is derived from the same derivation path as "h" and is not reused.

Definition at line 294 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_CRYPTO_EddsaPublicKey pub;
  struct GNUNET_HashCode hc;
  uint8_t dc[32];
  unsigned char sk[64];
  gcry_mpi_t h;
  gcry_mpi_t h_mod_L;
  gcry_mpi_t a;
  gcry_mpi_t d;
  gcry_mpi_t L;
  gcry_ctx_t ctx;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
 
  L = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  GNUNET_CRYPTO_eddsa_key_get_public (priv, &pub);
 
  crypto_hash_sha512 (sk, priv->d, 32);
  sk[0] &= 248;
  sk[31] &= 127;
  sk[31] |= 64;
 
  derive_h (&pub, sizeof (pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
  h_mod_L = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_L, h, L);
  /* Convert scalar to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    dc[i] = sk[31 - i];
 
  GNUNET_CRYPTO_mpi_scan_unsigned (&a, dc, sizeof(dc)); // a
  d = gcry_mpi_new (256);
  gcry_mpi_mulm (d, h_mod_L, a, L); // d := h * a mod L
  gcry_mpi_release (h);
  gcry_mpi_release (a);
  gcry_mpi_release (L);
  gcry_mpi_release (h_mod_L);
  gcry_ctx_release (ctx);
  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
  crypto_hash_sha256_state hs;
  crypto_hash_sha256_init (&hs);
  crypto_hash_sha256_update (&hs, sk + 32, 32);
  crypto_hash_sha256_update (&hs, (unsigned char*) &hc, sizeof (hc));
  crypto_hash_sha256_final (&hs, result->s + 32);
  // memcpy (result->s, sk, sizeof (sk));
  /* Convert to little endian for libsodium */
  for (size_t i = 0; i < 32; i++)
    result->s[i] = dc[31 - i];
 
  sodium_memzero (dc, sizeof(dc));
  gcry_mpi_release (d);
}

References context, ctx, GNUNET_CRYPTO_EddsaPrivateKey::d, dc, derive_h(), GNUNET_assert, GNUNET_CRYPTO_eddsa_key_get_public(), GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, and result.

Referenced by run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_public_key_derive()

void GNUNET_CRYPTO_eddsa_public_key_derive	(	const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EddsaPublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'. typically the name of the subsystem/application
result	where to write the derived public key

Definition at line 381 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_HashCode hc;
  gcry_ctx_t ctx;
  gcry_mpi_t q_y;
  gcry_mpi_t h;
  gcry_mpi_t n;
  gcry_mpi_t h_mod_n;
  gcry_mpi_point_t q;
  gcry_mpi_point_t v;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
 
  /* obtain point 'q' from original public key.  The provided 'q' is
     compressed thus we first store it in the context and then get it
     back as a (decompresssed) point.  */
  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
  GNUNET_assert (NULL != q_y);
  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
  gcry_mpi_release (q_y);
  q = gcry_mpi_ec_get_point ("q", ctx, 0);
  GNUNET_assert (q);
 
  /* calculate h_mod_n = h % n */
  derive_h (pub, sizeof (*pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
 
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  h_mod_n = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_n, h, n);
 
  /* calculate v = h_mod_n * q */
  v = gcry_mpi_point_new (0);
  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
  gcry_mpi_release (h_mod_n);
  gcry_mpi_release (h);
  gcry_mpi_release (n);
  gcry_mpi_point_release (q);
 
  /* convert point 'v' to public key that we return */
  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
  gcry_mpi_point_release (v);
  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
  GNUNET_assert (q_y);
  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
  gcry_mpi_release (q_y);
  gcry_ctx_release (ctx);
 
}

References context, ctx, derive_h(), GNUNET_assert, GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, q, GNUNET_CRYPTO_EddsaPublicKey::q_y, and result.

Referenced by run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_private_key_derive()

void GNUNET_CRYPTO_edx25519_private_key_derive	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PrivateKey *	result
	)

Derive a private scalar from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'.

Parameters

priv	original private key
seed	input seed
seedsize	size of the seed
result	derived private key

dc now contains the private scalar "a". We carefully remove the clamping and derive a'. Calculate: a1 := a / 8 a2 := h * a1 mod n a' := a2 * 8 mod n

Definition at line 239 of file crypto_edx25519.c.

{
  struct GNUNET_CRYPTO_Edx25519PublicKey pub;
  struct GNUNET_HashCode hc;
  uint8_t a[32];
  uint8_t eight[32] = { 8 };
  uint8_t eight_inv[32];
  uint8_t h[64] = { 0 };
 
  GNUNET_CRYPTO_edx25519_key_get_public (priv, &pub);
 
  /* Get h mod n */
  derive_h (&pub,
            seed,
            seedsize,
            &hc);
 
  memcpy (h, &hc, 64);
  crypto_core_ed25519_scalar_reduce (h,
                                     h);
#ifdef CHECK_RARE_CASES
  {
    char zero[32] = { 0 };
    char one[32] = { 1 };
 
    GNUNET_assert (0 != memcmp (zero, h, 32));
    GNUNET_assert (0 != memcmp (one, h, 32));
  }
#endif
 
  GNUNET_assert (0 == crypto_core_ed25519_scalar_invert (eight_inv,
                                                         eight));
 
  crypto_core_ed25519_scalar_mul (a, priv->a, eight_inv);
  crypto_core_ed25519_scalar_mul (a, a, h);
  crypto_core_ed25519_scalar_mul (a, a, eight);
 
#ifdef CHECK_RARE_CASES
  /* The likelihood for a' == 0 or a' == 1 is neglegible */
  {
    char zero[32] = { 0 };
    char one[32] = { 1 };
 
    GNUNET_assert (0 != memcmp (zero, a, 32));
    GNUNET_assert (0 != memcmp (one, a, 32));
  }
#endif
 
  /* We hash the derived "h" parameter with the other half of the expanded
   * private key (that is: priv->b). This ensures that for signature
   * generation, the "R" is derived from the same derivation path as "h" and is
   * not reused. */
  {
    struct GNUNET_HashCode hcb;
    struct GNUNET_HashContext *hctx;
 
    hctx = GNUNET_CRYPTO_hash_context_start ();
    GNUNET_CRYPTO_hash_context_read (hctx, priv->b, sizeof(priv->b));
    GNUNET_CRYPTO_hash_context_read (hctx, (unsigned char*) &hc, sizeof (hc));
    GNUNET_CRYPTO_hash_context_finish (hctx, &hcb);
 
    /* Truncate result, effectively doing SHA512/256 */
    for (size_t i = 0; i < 32; i++)
      result->b[i] = ((unsigned char *) &hcb)[i];
  }
 
  for (size_t i = 0; i < 32; i++)
    result->a[i] = a[i];
 
  sodium_memzero (a, sizeof(a));
}

References GNUNET_CRYPTO_Edx25519PrivateKey::a, GNUNET_CRYPTO_Edx25519PrivateKey::b, derive_h(), GNUNET_assert, GNUNET_CRYPTO_edx25519_key_get_public(), GNUNET_CRYPTO_hash_context_finish(), GNUNET_CRYPTO_hash_context_read(), GNUNET_CRYPTO_hash_context_start(), h, pub, result, and zero.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_public_key_derive()

void GNUNET_CRYPTO_edx25519_public_key_derive	(	const struct GNUNET_CRYPTO_Edx25519PublicKey *	pub,
		const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
seed	input seed
seedsize	size of the seed
result	where to write the derived public key

Definition at line 333 of file crypto_edx25519.c.

{
  struct GNUNET_HashCode hc;
  uint8_t h[64] = { 0 };
 
  derive_h (pub,
            seed,
            seedsize,
            &hc);
  memcpy (h,
          &hc,
          64);
  crypto_core_ed25519_scalar_reduce (h,
                                     h);
  GNUNET_assert (0 == crypto_scalarmult_ed25519_noclamp (result->q_y,
                                                         h,
                                                         pub->q_y));
}

References derive_h(), GNUNET_assert, h, pub, GNUNET_CRYPTO_EddsaPublicKey::q_y, and result.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function: