Crypto library: cryptographic operations

Provides cryptographic primitives. More...

Collaboration diagram for Crypto library: cryptographic operations:

Macros
#define	GNUNET_CRYPTO_eddsa_sign(priv, ps, sig)
	EdDSA sign a given block. More...
#define	GNUNET_CRYPTO_ecdsa_sign(priv, ps, sig)
	ECDSA sign a given block. More...
#define	GNUNET_CRYPTO_edx25519_sign(priv, ps, sig)
	Edx25519 sign a given block. More...
#define	GNUNET_CRYPTO_eddsa_verify(purp, ps, sig, pub)
	Verify EdDSA signature. More...
#define	GNUNET_CRYPTO_ecdsa_verify(purp, ps, sig, pub)
	Verify ECDSA signature. More...
#define	GNUNET_CRYPTO_edx25519_verify(purp, ps, sig, pub)
	Verify Edx25519 signature. More...

Enumerations
enum	GNUNET_CRYPTO_Quality { GNUNET_CRYPTO_QUALITY_WEAK , GNUNET_CRYPTO_QUALITY_STRONG , GNUNET_CRYPTO_QUALITY_NONCE }
	Desired quality level for random numbers. More...

Functions
void	GNUNET_CRYPTO_seed_weak_random (int32_t seed)
	Seed a weak random generator. More...
void	GNUNET_CRYPTO_zero_keys (void *buffer, size_t length)
	Zero out buffer, securely against compiler optimizations. More...
void	GNUNET_CRYPTO_random_block (enum GNUNET_CRYPTO_Quality mode, void *buffer, size_t length)
	Fill block with a random values. More...
void	GNUNET_CRYPTO_random_timeflake (enum GNUNET_CRYPTO_Quality mode, struct GNUNET_Uuid *uuid)
	Fill UUID with a timeflake pseudo-random value. More...
uint32_t	GNUNET_CRYPTO_random_u32 (enum GNUNET_CRYPTO_Quality mode, uint32_t i)
	Produce a random value. More...
uint64_t	GNUNET_CRYPTO_random_u64 (enum GNUNET_CRYPTO_Quality mode, uint64_t max)
	Generate a random unsigned 64-bit value. More...
unsigned int *	GNUNET_CRYPTO_random_permute (enum GNUNET_CRYPTO_Quality mode, unsigned int n)
	Get an array with a random permutation of the numbers 0...n-1. More...
void	GNUNET_CRYPTO_symmetric_create_session_key (struct GNUNET_CRYPTO_SymmetricSessionKey *key)
	Create a new random session key. More...
ssize_t	GNUNET_CRYPTO_symmetric_encrypt (const void *block, size_t size, const struct GNUNET_CRYPTO_SymmetricSessionKey *sessionkey, const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, void *result)
	Encrypt a block using a symmetric sessionkey. More...
ssize_t	GNUNET_CRYPTO_symmetric_decrypt (const void *block, size_t size, const struct GNUNET_CRYPTO_SymmetricSessionKey *sessionkey, const struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, void *result)
	Decrypt a given block using a symmetric sessionkey. More...
void	GNUNET_CRYPTO_symmetric_derive_iv (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, const struct GNUNET_CRYPTO_SymmetricSessionKey *skey, const void *salt, size_t salt_len,...)
	Derive an IV. More...
void	GNUNET_CRYPTO_ecdsa_key_get_public (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_eddsa_key_get_public (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, struct GNUNET_CRYPTO_EddsaPublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_edx25519_key_get_public (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
	Extract the public key for the given private key. More...
void	GNUNET_CRYPTO_ecdhe_key_get_public (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, struct GNUNET_CRYPTO_EcdhePublicKey *pub)
	Extract the public key for the given private key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_key_from_file (const char *filename, int do_create, struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey)
	Create a new private key by reading it from a file. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_key_from_file (const char *filename, int do_create, struct GNUNET_CRYPTO_EddsaPrivateKey *pkey)
	Create a new private key by reading it from a file. More...
struct GNUNET_CRYPTO_EddsaPrivateKey *	GNUNET_CRYPTO_eddsa_key_create_from_configuration (const struct GNUNET_CONFIGURATION_Handle *cfg)
	Create a new private key by reading our peer's key from the file specified in the configuration. More...
void	GNUNET_CRYPTO_ecdsa_key_create (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_edx25519_key_create (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_edx25519_key_create_from_seed (const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Create a new private key for Edx25519 from a given seed. More...
void	GNUNET_CRYPTO_ecdhe_key_create (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
	Create a new private key. More...
void	GNUNET_CRYPTO_eddsa_key_clear (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_ecdsa_key_clear (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_edx25519_key_clear (struct GNUNET_CRYPTO_Edx25519PrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_ecdhe_key_clear (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
	Clear memory that was used to store a private key. More...
void	GNUNET_CRYPTO_private_key_clear (struct GNUNET_CRYPTO_PrivateKey *pk)
	Clear memory that was used to store a private key. More...
const struct GNUNET_CRYPTO_EcdsaPrivateKey *	GNUNET_CRYPTO_ecdsa_key_get_anonymous (void)
	Get the shared private key we use for anonymous users. More...
void	GNUNET_CRYPTO_eddsa_setup_hostkey (const char *cfg_name)
	Setup a hostkey file for a peer given the name of the configuration file (!). More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_get_peer_identity (const struct GNUNET_CONFIGURATION_Handle *cfg, struct GNUNET_PeerIdentity *dst)
	Retrieve the identity of the host's peer. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_sign_by_peer_identity (const struct GNUNET_CONFIGURATION_Handle *cfg, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EddsaSignature *sig)
	Sign a given block with a specific purpose using the host's peer identity. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_verify_peer_identity (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_EddsaSignature *sig, const struct GNUNET_PeerIdentity *identity)
	Verify a given signature with a peer's identity. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecc_ecdh (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a public and a private ECC key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_ecdh (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a ECDH public key and a private EdDSA key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_x25519_ecdh (const struct GNUNET_CRYPTO_EcdhePrivateKey *sk, const struct GNUNET_CRYPTO_EcdhePublicKey *pk, struct GNUNET_CRYPTO_EcdhePublicKey *dh)
	Derive key material from a ECDH public key and a private X25519 key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *prk)
	Decapsulate a key for a private X25519 key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *prk)
	Encapsulate key material for a X25519 public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_kem_encaps_norand (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_EcdhePrivateKey *skE, struct GNUNET_ShortHashCode *prk)
	Deterministic variant of GNUNET_CRYPTO_hpke_kem_encaps. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_authkem_encaps_norand (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, const struct GNUNET_CRYPTO_EcdhePrivateKey *skS, struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_EcdhePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate authenticated key material for a X25519 public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_authkem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, const struct GNUNET_CRYPTO_EcdhePrivateKey *skS, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate authenticated key material for a X25519 public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_authkem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey *skR, const struct GNUNET_CRYPTO_EcdhePublicKey *pkS, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private X25519 key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand (uint8_t random_tweak, const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_kem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey *skR, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Carries out ecdh decapsulation with own private key and the representative of the received public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, const struct GNUNET_CRYPTO_EcdhePrivateKey *skS, struct GNUNET_CRYPTO_HpkeEncapsulation *c, const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *skE, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate authenticated key material for a X25519 public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_authkem_encaps (const struct GNUNET_CRYPTO_EcdhePublicKey *pkR, const struct GNUNET_CRYPTO_EcdhePrivateKey *skS, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Encapsulate authenticated key material for a X25519 public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_hpke_elligator_authkem_decaps (const struct GNUNET_CRYPTO_EcdhePrivateKey *skR, const struct GNUNET_CRYPTO_EcdhePublicKey *pkS, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *shared_secret)
	Decapsulate a key for a private X25519 key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_decaps (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *prk)
	Decapsulate a key for a private EdDSA key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_kem_encaps (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_CRYPTO_HpkeEncapsulation *c, struct GNUNET_ShortHashCode *prk)
	Encapsulate key material for a EdDSA public key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_ecdh (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_HashCode *key_material)
	HPKE END. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdh_eddsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EddsaPublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a EdDSA public key and a private ECDH key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdh_x25519 (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_CRYPTO_EcdhePublicKey *dh)
	Derive key material from a EdDSA public key and a private ECDH key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdh_ecdsa (const struct GNUNET_CRYPTO_EcdhePrivateKey *priv, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, struct GNUNET_HashCode *key_material)
	Derive key material from a EcDSA public key and a private ECDH key. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_sign_ (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EddsaSignature *sig)
	EdDSA sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_sign_ (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EcdsaSignature *sig)
	ECDSA Sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_edx25519_sign_ (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_Edx25519Signature *sig)
	Edx25519 sign a given block. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_eddsa_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_EddsaSignature *sig, const struct GNUNET_CRYPTO_EddsaPublicKey *pub)
	Verify EdDSA signature. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdsa_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_EcdsaSignature *sig, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Verify ECDSA signature. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_edx25519_verify_ (uint32_t purpose, const struct GNUNET_CRYPTO_EccSignaturePurpose *validate, const struct GNUNET_CRYPTO_Edx25519Signature *sig, const struct GNUNET_CRYPTO_Edx25519PublicKey *pub)
	Verify Edx25519 signature. More...
struct GNUNET_CRYPTO_EcdsaPrivateKey *	GNUNET_CRYPTO_ecdsa_private_key_derive (const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const char *label, const char *context)
	Derive a private key from a given private key and a label. More...
void	GNUNET_CRYPTO_ecdsa_public_key_derive (const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EcdsaPublicKey *result)
	Derive a public key from a given public key and a label. More...
void	GNUNET_CRYPTO_eddsa_private_key_derive (const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPrivateScalar *result)
	Derive a private scalar from a given private key and a label. More...
void	GNUNET_CRYPTO_eddsa_public_key_derive (const struct GNUNET_CRYPTO_EddsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPublicKey *result)
	Derive a public key from a given public key and a label. More...
void	GNUNET_CRYPTO_edx25519_private_key_derive (const struct GNUNET_CRYPTO_Edx25519PrivateKey *priv, const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PrivateKey *result)
	Derive a private scalar from a given private key and a label. More...
void	GNUNET_CRYPTO_edx25519_public_key_derive (const struct GNUNET_CRYPTO_Edx25519PublicKey *pub, const void *seed, size_t seedsize, struct GNUNET_CRYPTO_Edx25519PublicKey *result)
	Derive a public key from a given public key and a label. More...
void	GNUNET_CRYPTO_ecdhe_elligator_decoding (struct GNUNET_CRYPTO_EcdhePublicKey *point, bool *high_y, const struct GNUNET_CRYPTO_ElligatorRepresentative *representative)
	Clears the most significant bit and second most significant bit of the serialized representaive before applying elligator direct map. More...
bool	GNUNET_CRYPTO_ecdhe_elligator_encoding (uint8_t random_tweak, struct GNUNET_CRYPTO_ElligatorRepresentative *r, const struct GNUNET_CRYPTO_EcdhePublicKey *pub)
	Encodes a point on Curve25519 to a an element of the underlying finite field. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand (uint8_t random_tweak, const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *sk, struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_CRYPTO_ElligatorRepresentative *repr)
	Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point. More...
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_ecdhe_elligator_key_get_public (const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *sk, struct GNUNET_CRYPTO_EcdhePublicKey *pub, struct GNUNET_CRYPTO_ElligatorRepresentative *repr)
	Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point. More...
void	GNUNET_CRYPTO_ecdhe_elligator_key_create (struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *sk)
	Generates a private key for Curve25519. More...

Detailed Description

Provides cryptographic primitives.

See also

Documentation

Macro Definition Documentation

GNUNET_CRYPTO_eddsa_sign

#define GNUNET_CRYPTO_eddsa_sign	(		priv,
			ps,
			sig
	)

Value:

    do {                 \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*ps));    \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_assert (GNUNET_OK ==                                    \
                   GNUNET_CRYPTO_eddsa_sign_ (priv,                \
                                              &(ps)->purpose,      \
                                              sig));               \
} while (0)

EdDSA sign a given block.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2810 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_ecdsa_sign

#define GNUNET_CRYPTO_ecdsa_sign	(		priv,
			ps,
			sig
	)

Value:

    do {                 \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_assert (GNUNET_OK ==                                    \
                   GNUNET_CRYPTO_ecdsa_sign_ (priv,                \
                                              &(ps)->purpose,      \
                                              sig));               \
} while (0)

ECDSA sign a given block.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2872 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_edx25519_sign

#define GNUNET_CRYPTO_edx25519_sign	(		priv,
			ps,
			sig
	)

Value:

    do {              \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_assert (GNUNET_OK ==                                    \
                   GNUNET_CRYPTO_edx25519_sign_ (priv,             \
                                                 &(ps)->purpose,   \
                                                 sig));            \
} while (0)

Edx25519 sign a given block.

The resulting signature is compatible with EdDSA.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

	priv	private key to use for the signing
	ps	packed struct with what to sign, MUST begin with a purpose
[out]	sig	where to write the signature

Definition at line 2919 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_eddsa_verify

#define GNUNET_CRYPTO_eddsa_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({             \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_CRYPTO_eddsa_verify_ (purp,                             \
                                 &(ps)->purpose,                   \
                                 sig,                              \
                                 pub);                             \
  })

Verify EdDSA signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 2972 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_ecdsa_verify

#define GNUNET_CRYPTO_ecdsa_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({             \
    /* check size is set correctly */                              \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps)));  \
    /* check 'ps' begins with the purpose */                       \
    GNUNET_static_assert (((void*) (ps)) ==                        \
                          ((void*) &(ps)->purpose));               \
    GNUNET_CRYPTO_ecdsa_verify_ (purp,                             \
                                 &(ps)->purpose,                   \
                                 sig,                              \
                                 pub);                             \
  })

Verify ECDSA signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 3024 of file gnunet_crypto_lib.h.

GNUNET_CRYPTO_edx25519_verify

#define GNUNET_CRYPTO_edx25519_verify	(		purp,
			ps,
			sig,
			pub
	)

Value:

    ({         \
    /* check size is set correctly */                             \
    GNUNET_assert (ntohl ((ps)->purpose.size) == sizeof (*(ps))); \
    /* check 'ps' begins with the purpose */                      \
    GNUNET_static_assert (((void*) (ps)) ==                       \
                          ((void*) &(ps)->purpose));              \
    GNUNET_CRYPTO_edx25519_verify_ (purp,                         \
                                    &(ps)->purpose,               \
                                    sig,                          \
                                    pub);                         \
  })

Verify Edx25519 signature.

The ps data must be a fixed-size struct for which the signature is to be created. The size field in ps->purpose must correctly indicate the number of bytes of the data structure, including its header.

Parameters

purp	purpose of the signature, must match 'ps->purpose.purpose' (except in host byte order)
priv	private key to use for the signing
ps	packed struct with what to sign, MUST begin with a purpose
sig	where to write the signature

Definition at line 3076 of file gnunet_crypto_lib.h.

Enumeration Type Documentation

GNUNET_CRYPTO_Quality

enum GNUNET_CRYPTO_Quality

Desired quality level for random numbers.

Enumerator
GNUNET_CRYPTO_QUALITY_WEAK	No good quality of the operation is needed (i.e., random numbers can be pseudo-random).
GNUNET_CRYPTO_QUALITY_STRONG	High-quality operations are desired.
GNUNET_CRYPTO_QUALITY_NONCE	Randomness for IVs etc. is required.

Definition at line 84 of file gnunet_crypto_lib.h.

{
  GNUNET_CRYPTO_QUALITY_WEAK,
 
  GNUNET_CRYPTO_QUALITY_STRONG,
 
  GNUNET_CRYPTO_QUALITY_NONCE
};

Function Documentation

GNUNET_CRYPTO_seed_weak_random()

void GNUNET_CRYPTO_seed_weak_random

(

int32_t

seed

)

Seed a weak random generator.

Only GNUNET_CRYPTO_QUALITY_WEAK-mode generator can be seeded.

Parameters

seed	the seed to use

Definition at line 91 of file crypto_random.c.

{
#ifdef OPENBSD
  srandom_deterministic (seed);
#else
  srandom (seed);
#endif
}

References seed.

Referenced by __attribute__().

Here is the caller graph for this function:

GNUNET_CRYPTO_zero_keys()

void GNUNET_CRYPTO_zero_keys	(	void *	buffer,
		size_t	length
	)

Zero out buffer, securely against compiler optimizations.

Used to delete key material.

Parameters

buffer	the buffer to zap
length	buffer length

Definition at line 110 of file crypto_random.c.

{
#if HAVE_MEMSET_S
  memset_s (buffer, length, 0, length);
#elif HAVE_EXPLICIT_BZERO
  explicit_bzero (buffer, length);
#else
  volatile unsigned char *p = buffer;
  while (length--)
    *p++ = 0;
#endif
}

References p.

Referenced by delete_store_message(), and dv_key_clean().

Here is the caller graph for this function:

GNUNET_CRYPTO_random_block()

void GNUNET_CRYPTO_random_block	(	enum GNUNET_CRYPTO_Quality	mode,
		void *	buffer,
		size_t	length
	)

Fill block with a random values.

Parameters

	mode	desired quality of the random number
[out]	buffer	the buffer to fill
	length	buffer length
	mode	desired quality of the random number
	buffer	the buffer to fill
	length	buffer length

Definition at line 133 of file crypto_random.c.

{
#ifdef gcry_fast_random_poll
  static unsigned int invokeCount;
#endif
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    gcry_randomize (buffer, length, GCRY_STRONG_RANDOM);
    return;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    gcry_create_nonce (buffer, length);
    return;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    gcry_randomize (buffer, length, GCRY_WEAK_RANDOM);
    return;
 
  default:
    GNUNET_assert (0);
  }
}

References GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, and mode.

Referenced by client_quic_init(), connection_init(), delayed_put(), do_pad(), encapsulate_for_dv(), encode_message_body(), GCC_create(), generate_free_member_id(), get_new_connection_id_cb(), GNUNET_async_scope_fresh(), GNUNET_CRYPTO_ecdhe_elligator_key_create(), GNUNET_CRYPTO_ecdhe_elligator_key_get_public(), GNUNET_CRYPTO_ecdhe_key_create(), GNUNET_CRYPTO_ecdsa_key_create(), GNUNET_CRYPTO_eddsa_key_create(), GNUNET_CRYPTO_edx25519_key_create(), GNUNET_CRYPTO_hash_create_random(), GNUNET_CRYPTO_hpke_elligator_kem_encaps(), GNUNET_CRYPTO_hpke_sender_setup2(), GNUNET_CRYPTO_random_timeflake(), handle_validation_response(), mq_init(), output_vectors(), prepare_pending_acknowledgement(), rand_cb(), RPS_sampler_elem_reinit(), sock_read(), start_address_validation(), start_dv_learn(), and transmit_kx().

Here is the caller graph for this function:

GNUNET_CRYPTO_random_timeflake()

void GNUNET_CRYPTO_random_timeflake	(	enum GNUNET_CRYPTO_Quality	mode,
		struct GNUNET_Uuid *	uuid
	)

Fill UUID with a timeflake pseudo-random value.

Note that timeflakes use only 80 bits of randomness and 48 bits to encode a timestamp in milliseconds. So what we return here is not a completely random number.

Parameters

	mode	desired quality of the random number
[out]	uuid	the value to fill

Note that timeflakes use only 80 bits of randomness and 48 bits to encode a timestamp in milliseconds. So what we return here is not a completely random number.

Parameters

mode	desired quality of the random number
uuid	the value to fill

Definition at line 316 of file crypto_random.c.

{
  struct GNUNET_TIME_Absolute now;
  uint64_t ms;
  uint64_t be;
  char *base;
 
  GNUNET_CRYPTO_random_block (mode,
                              uuid,
                              sizeof (struct GNUNET_Uuid));
  now = GNUNET_TIME_absolute_get ();
  ms = now.abs_value_us / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us;
  be = GNUNET_htonll (ms);
  base = (char *) &be;
  memcpy (uuid,
          base + 2,
          sizeof (be) - 2);
}

References GNUNET_TIME_Absolute::abs_value_us, GNUNET_CRYPTO_random_block(), GNUNET_htonll(), GNUNET_TIME_absolute_get(), GNUNET_TIME_UNIT_MILLISECONDS, and mode.

Here is the call graph for this function:

GNUNET_CRYPTO_random_u32()

uint32_t GNUNET_CRYPTO_random_u32	(	enum GNUNET_CRYPTO_Quality	mode,
		uint32_t	i
	)

Produce a random value.

Parameters

mode	desired quality of the random number
i	the upper limit (exclusive) for the random number

Returns

a random value in the interval [0,i) (exclusive).

Produce a random value.

Parameters

mode	desired quality of the random number
i	the upper limit (exclusive) for the random number

Returns

a random value in the interval [0,i[.

Definition at line 178 of file crypto_random.c.

{
#ifdef gcry_fast_random_poll
  static unsigned int invokeCount;
#endif
  uint32_t ret;
  uint32_t ul;
 
  GNUNET_assert (i > 0);
 
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    /* see http://lists.gnupg.org/pipermail/gcrypt-devel/2004-May/000613.html */
#ifdef gcry_fast_random_poll
    if ((invokeCount++ % 256) == 0)
      gcry_fast_random_poll ();
#endif
    ul = UINT32_MAX - (UINT32_MAX % i);
    do
    {
      gcry_randomize ((unsigned char *) &ret,
                      sizeof(uint32_t),
                      GCRY_STRONG_RANDOM);
    }
    while (ret >= ul);
    return ret % i;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    ul = UINT32_MAX - (UINT32_MAX % i);
    do
    {
      gcry_create_nonce (&ret, sizeof(ret));
    }
    while (ret >= ul);
    return ret % i;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    ret = i * get_weak_random ();
    if (ret >= i)
      ret = i - 1;
    return ret;
 
  default:
    GNUNET_assert (0);
  }
  return 0;
}

References get_weak_random(), GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, mode, and ret.

Referenced by __attribute__(), allocate_v4_address(), allocate_v6_address(), calculate_seed(), channel_new_cb(), compute_rand_delay(), compute_service_response(), daemon_started(), delayed_get(), delayed_put(), download_get_url(), generate_request_id(), get_any(), get_bootstrap_server(), get_delay_randomization(), get_forward_count(), get_random_literal(), get_random_peer_from_peermap(), get_randomized_delay(), get_request_socket(), get_typed(), GNUNET_BLOCK_GROUP_bf_create(), GNUNET_CONTAINER_heap_walk_get_next(), GNUNET_CONTAINER_multihashmap_get_random(), GNUNET_CONTAINER_multipeermap_get_random(), GNUNET_CONTAINER_multishortmap_get_random(), GNUNET_CONTAINER_multiuuidmap_get_random(), GNUNET_CRYPTO_random_permute(), GNUNET_FS_search_start_probe_(), GNUNET_TUN_initialize_ipv4_header(), GSC_CLIENTS_deliver_message(), GSF_pending_request_get_message_(), handle_client_evaluate(), handle_dns_request(), handle_dv_learn(), handle_flow_control(), handle_p2p_get(), handle_p2p_put(), handle_resolve_result(), join_room_run(), ogg_init(), plan(), queue(), reannounce_regex(), recursive_dns_resolution(), REGEX_TEST_generate_random_regex(), REGEX_TEST_generate_random_string(), resolve_and_cache(), route_control_message_without_fc(), route_via_neighbour(), select_peer(), send_bloomfilter(), setup_fresh_address(), setup_fresh_ping(), should_I_drop(), shuffle_answers(), start_dv_learn(), test_run(), transmit_typemap_task(), and try_open_exit().

Here is the call graph for this function:

GNUNET_CRYPTO_random_u64()

uint64_t GNUNET_CRYPTO_random_u64	(	enum GNUNET_CRYPTO_Quality	mode,
		uint64_t	max
	)

Generate a random unsigned 64-bit value.

Parameters

mode	desired quality of the random number
max	value returned will be in range [0,max) (exclusive)

Returns

random 64-bit number

Definition at line 262 of file crypto_random.c.

{
  uint64_t ret;
  uint64_t ul;
 
  GNUNET_assert (max > 0);
  switch (mode)
  {
  case GNUNET_CRYPTO_QUALITY_STRONG:
    ul = UINT64_MAX - (UINT64_MAX % max);
    do
    {
      gcry_randomize ((unsigned char *) &ret,
                      sizeof(uint64_t),
                      GCRY_STRONG_RANDOM);
    }
    while (ret >= ul);
    return ret % max;
 
  case GNUNET_CRYPTO_QUALITY_NONCE:
    ul = UINT64_MAX - (UINT64_MAX % max);
    do
    {
      gcry_create_nonce (&ret, sizeof(ret));
    }
    while (ret >= ul);
 
    return ret % max;
 
  case GNUNET_CRYPTO_QUALITY_WEAK:
    ret = max * get_weak_random ();
    if (ret >= max)
      ret = max - 1;
    return ret;
 
  default:
    GNUNET_assert (0);
  }
  return 0;
}

References get_weak_random(), GNUNET_assert, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_QUALITY_STRONG, GNUNET_CRYPTO_QUALITY_WEAK, max, mode, and ret.

Referenced by activate_core_visible_dv_path(), calculate_fork_degree(), choose_exit(), dht_connected(), get_transmit_delay(), GNUNET_DHT_connect(), GNUNET_GNSRECORD_pow_start(), handle_dht_p2p_put(), handle_flow_control(), handle_validation_response(), ifc_broadcast(), namestore_flat_store_records(), namestore_postgres_store_records(), namestore_sqlite_store_records(), pick_random_dv_hops(), postgres_plugin_get_key(), postgres_plugin_put(), put_migration_continuation(), run(), sampler_get_rand_peer(), send_find_peer_message(), send_full_set(), setup_out_cipher(), sqlite_plugin_get_key(), sqlite_plugin_get_replication(), sqlite_plugin_put(), and update_next_challenge_time().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_random_permute()

unsigned int * GNUNET_CRYPTO_random_permute	(	enum GNUNET_CRYPTO_Quality	mode,
		unsigned int	n
	)

Get an array with a random permutation of the numbers 0...n-1.

Parameters

mode	GNUNET_CRYPTO_QUALITY_STRONG if the strong (but expensive) PRNG should be used, GNUNET_CRYPTO_QUALITY_WEAK or GNUNET_CRYPTO_QUALITY_NONCE otherwise
n	the size of the array

Returns

the permutation array (allocated from heap)

Parameters

mode	#GNUNET_RANDOM_QUALITY_STRONG if the strong (but expensive) PRNG should be used, #GNUNET_RANDOM_QUALITY_WEAK otherwise
n	the size of the array

Returns

the permutation array (allocated from heap)

Definition at line 238 of file crypto_random.c.

{
  unsigned int *ret;
  unsigned int i;
  unsigned int tmp;
  uint32_t x;
 
  GNUNET_assert (n > 0);
  ret = GNUNET_malloc (n * sizeof(unsigned int));
  for (i = 0; i < n; i++)
    ret[i] = i;
  for (i = n - 1; i > 0; i--)
  {
    x = GNUNET_CRYPTO_random_u32 (mode, i + 1);
    tmp = ret[x];
    ret[x] = ret[i];
    ret[i] = tmp;
  }
  return ret;
}

References GNUNET_assert, GNUNET_CRYPTO_random_u32(), GNUNET_malloc, mode, and ret.

Referenced by compute_service_response(), and do_round().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_create_session_key()

void GNUNET_CRYPTO_symmetric_create_session_key

(

struct GNUNET_CRYPTO_SymmetricSessionKey *

key

)

Create a new random session key.

Parameters

key	key to initialize

Create a new random session key.

Parameters

key	session key to initialize

Definition at line 42 of file crypto_symmetric.c.

{
  gcry_randomize (key->aes_key,
                  GNUNET_CRYPTO_AES_KEY_LENGTH,
                  GCRY_STRONG_RANDOM);
  gcry_randomize (key->twofish_key,
                  GNUNET_CRYPTO_AES_KEY_LENGTH,
                  GCRY_STRONG_RANDOM);
}

References GNUNET_CRYPTO_AES_KEY_LENGTH, and key.

GNUNET_CRYPTO_symmetric_encrypt()

ssize_t GNUNET_CRYPTO_symmetric_encrypt	(	const void *	block,
		size_t	size,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	sessionkey,
		const struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		void *	result
	)

Encrypt a block using a symmetric sessionkey.

Parameters

block	the block to encrypt
size	the size of the block
sessionkey	the key used to encrypt
iv	the initialization vector to use, use INITVALUE for streams.

Returns

the size of the encrypted block, -1 for errors

Encrypt a block using a symmetric sessionkey.

Parameters

block	the block to encrypt
size	the size of the block
sessionkey	the key used to encrypt
iv	the initialization vector to use, use INITVALUE for streams
result	the output parameter in which to store the encrypted result can be the same or overlap with block

Returns

the size of the encrypted block, -1 for errors. Due to the use of CFB and therefore an effective stream cipher, this size should be the same as len.

Definition at line 131 of file crypto_symmetric.c.

{
  gcry_cipher_hd_t handle;
  char tmp[GNUNET_NZL(size)];
 
  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_encrypt (handle, tmp, size, block, size));
  gcry_cipher_close (handle);
  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_encrypt (handle, result, size, tmp, size));
  gcry_cipher_close (handle);
  memset (tmp, 0, sizeof(tmp));
  return size;
}

References GNUNET_assert, GNUNET_NZL, GNUNET_OK, handle, result, setup_cipher_aes(), setup_cipher_twofish(), and size.

Referenced by do_encrypt(), encrypt_existing_match(), GNUNET_FS_handle_on_demand_block(), GNUNET_FS_publish_ublock_(), GNUNET_FS_tree_encoder_next(), t_ax_encrypt(), t_h_encrypt(), and try_match_block().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_decrypt()

ssize_t GNUNET_CRYPTO_symmetric_decrypt	(	const void *	block,
		size_t	size,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	sessionkey,
		const struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		void *	result
	)

Decrypt a given block using a symmetric sessionkey.

Parameters

block	the data to decrypt, encoded as returned by encrypt
size	how big is the block?
sessionkey	the key used to decrypt
iv	the initialization vector to use
result	address to store the result at

Returns

-1 on failure, size of decrypted block on success

Decrypt a given block using a symmetric sessionkey.

Parameters

block	the data to decrypt, encoded as returned by encrypt
size	the size of the block to decrypt
sessionkey	the key used to decrypt
iv	the initialization vector to use, use INITVALUE for streams
result	address to store the result at can be the same or overlap with block

Returns

-1 on failure, size of decrypted block on success. Due to the use of CFB and therefore an effective stream cipher, this size should be the same as size.

Definition at line 169 of file crypto_symmetric.c.

{
  gcry_cipher_hd_t handle;
  char tmp[size];
 
  if (GNUNET_OK != setup_cipher_twofish (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_decrypt (handle, tmp, size, block, size));
  gcry_cipher_close (handle);
  if (GNUNET_OK != setup_cipher_aes (&handle, sessionkey, iv))
    return -1;
  GNUNET_assert (0 == gcry_cipher_decrypt (handle, result, size, tmp, size));
  gcry_cipher_close (handle);
  memset (tmp, 0, sizeof(tmp));
  return size;
}

References GNUNET_assert, GNUNET_OK, handle, result, setup_cipher_aes(), setup_cipher_twofish(), and size.

Referenced by do_decrypt(), GNUNET_FS_ublock_decrypt_(), process_result_with_request(), t_ax_decrypt(), t_h_decrypt(), and try_old_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_symmetric_derive_iv()

void GNUNET_CRYPTO_symmetric_derive_iv	(	struct GNUNET_CRYPTO_SymmetricInitializationVector *	iv,
		const struct GNUNET_CRYPTO_SymmetricSessionKey *	skey,
		const void *	salt,
		size_t	salt_len,
			...
	)

Derive an IV.

Parameters

iv	initialization vector
skey	session key
salt	salt for the derivation
salt_len	size of the salt
...	pairs of void * & size_t for context chunks, terminated by NULL

Definition at line 203 of file crypto_symmetric.c.

{
  va_list argp;
 
  va_start (argp, salt_len);
  GNUNET_CRYPTO_symmetric_derive_iv_v (iv, skey, salt, salt_len, argp);
  va_end (argp);
}

References GNUNET_CRYPTO_symmetric_derive_iv_v(), and salt.

Referenced by derive_iv(), derive_pong_iv(), t_ax_decrypt(), t_ax_encrypt(), t_h_decrypt(), t_h_encrypt(), and try_old_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_get_public()

void GNUNET_CRYPTO_ecdsa_key_get_public	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		struct GNUNET_CRYPTO_EcdsaPublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the special elligator private key
pub	where to write the public key

Definition at line 190 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdsa_key_get_public);
  crypto_scalarmult_ed25519_base_noclamp (pub->q_y, priv->d);
  BENCHMARK_END (ecdsa_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EcdsaPrivateKey::d, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by block_create2(), decrypt_block_with_keyword(), get_update_information_directory(), GNUNET_CRYPTO_ecdsa_private_key_derive(), GNUNET_CRYPTO_key_get_public(), GNUNET_FS_publish_sks(), GNUNET_FS_publish_ublock_(), GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), and process_kblock_for_unindex().

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_get_public()

void GNUNET_CRYPTO_eddsa_key_get_public	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		struct GNUNET_CRYPTO_EddsaPublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 201 of file crypto_ecc.c.

{
  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
  unsigned char sk[crypto_sign_SECRETKEYBYTES];
 
  BENCHMARK_START (eddsa_key_get_public);
  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
  GNUNET_memcpy (pub->q_y, pk, crypto_sign_PUBLICKEYBYTES);
  sodium_memzero (sk, crypto_sign_SECRETKEYBYTES);
  BENCHMARK_END (eddsa_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EddsaPrivateKey::d, GNUNET_assert, GNUNET_memcpy, pk, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by advertise_dns_exit(), block_create2(), checkvec(), create_keys(), GNUNET_CRYPTO_eddsa_private_key_derive(), GNUNET_CRYPTO_get_peer_identity(), GNUNET_CRYPTO_key_get_public(), GNUNET_FS_uri_loc_create(), GSC_KX_init(), init_socket(), main_init(), output_vectors(), print_key(), regex_iterator(), and run().

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_get_public()

void GNUNET_CRYPTO_edx25519_key_get_public	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		struct GNUNET_CRYPTO_Edx25519PublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 79 of file crypto_edx25519.c.

{
  crypto_scalarmult_ed25519_base_noclamp (pub->q_y,
                                          priv->a);
}

References GNUNET_CRYPTO_Edx25519PrivateKey::a, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by GNUNET_CRYPTO_edx25519_private_key_derive(), and output_vectors().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_key_get_public()

void GNUNET_CRYPTO_ecdhe_key_get_public	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		struct GNUNET_CRYPTO_EcdhePublicKey *	pub
	)

Extract the public key for the given private key.

Parameters

priv	the private key
pub	where to write the public key

Definition at line 217 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdhe_key_get_public);
  GNUNET_assert (0 == crypto_scalarmult_base (pub->q_y, priv->d));
  BENCHMARK_END (ecdhe_key_get_public);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_assert, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by authkem_encaps_norand(), GCT_handle_kx_auth(), GCT_send(), GNUNET_CRYPTO_hpke_authkem_encaps_norand(), GNUNET_CRYPTO_hpke_kem_encaps_norand(), output_vectors(), print_examples_ecdh(), send_kx(), send_kx_auth(), and sign_ephemeral_key().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_from_file()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_key_from_file	(	const char *	filename,
		int	do_create,
		struct GNUNET_CRYPTO_EcdsaPrivateKey *	pkey
	)

Create a new private key by reading it from a file.

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

GNUNET_OK on success, GNUNET_NO if do_create was set but we found an existing file, GNUNET_SYSERR on failure

Definition at line 201 of file crypto_ecc_setup.c.

{
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that we didn't create it... */
    return (do_create) ? GNUNET_NO : GNUNET_OK;
  }
  else if (! do_create)
  {
    return GNUNET_SYSERR;
  }
  GNUNET_CRYPTO_ecdsa_key_create (pkey);
  if (GNUNET_OK ==
      GNUNET_DISK_fn_write (filename,
                            pkey,
                            sizeof (*pkey),
                            GNUNET_DISK_PERM_USER_READ))
    return GNUNET_OK;
  /* maybe another process succeeded in the meantime, try reading one more time */
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that *we* didn't create it... */
    return GNUNET_NO;
  }
  /* give up */
  return GNUNET_SYSERR;
}

References filename, GNUNET_CRYPTO_ecdsa_key_create(), GNUNET_DISK_fn_write(), GNUNET_DISK_PERM_USER_READ, GNUNET_NO, GNUNET_OK, GNUNET_SYSERR, pkey, and read_from_file().

Here is the call graph for this function:

GNUNET_CRYPTO_eddsa_key_from_file()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_key_from_file	(	const char *	filename,
		int	do_create,
		struct GNUNET_CRYPTO_EddsaPrivateKey *	pkey
	)

Create a new private key by reading it from a file.

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

GNUNET_OK on success, GNUNET_NO if do_create was set but we found an existing file, GNUNET_SYSERR on failure

If the files does not exist and do_create is set, creates a new key and write it to the file.

If the contents of the file are invalid, an error is returned.

Parameters

	filename	name of file to use to store the key
	do_create	should a file be created?
[out]	pkey	set to the private key from filename on success

Returns

- GNUNET_OK on success,

• GNUNET_NO if do_create was set but we found an existing file,
• GNUNET_SYSERR on failure or if the file didn't exist and do_create was not set

Definition at line 144 of file crypto_ecc_setup.c.

{
  enum GNUNET_GenericReturnValue ret;
 
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that we didn't create it... */
    return (do_create) ? GNUNET_NO : GNUNET_OK;
  }
  else if (! do_create)
  {
    return GNUNET_SYSERR;
  }
 
  GNUNET_CRYPTO_eddsa_key_create (pkey);
  ret = GNUNET_DISK_fn_write (filename,
                              pkey,
                              sizeof (*pkey),
                              GNUNET_DISK_PERM_USER_READ);
  if ( (GNUNET_OK == ret) ||
       (GNUNET_SYSERR == ret) )
    return ret;
  /* maybe another process succeeded in the meantime, try reading one more time */
  if (GNUNET_OK ==
      read_from_file (filename,
                      pkey,
                      sizeof (*pkey)))
  {
    /* file existed, report that *we* didn't create it... */
    return GNUNET_NO;
  }
  /* give up */
  return GNUNET_SYSERR;
}

References filename, GNUNET_CRYPTO_eddsa_key_create(), GNUNET_DISK_fn_write(), GNUNET_DISK_PERM_USER_READ, GNUNET_NO, GNUNET_OK, GNUNET_SYSERR, pkey, read_from_file(), and ret.

Referenced by GNUNET_CRYPTO_eddsa_key_create_from_configuration(), main_init(), and run().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_create_from_configuration()

struct GNUNET_CRYPTO_EddsaPrivateKey * GNUNET_CRYPTO_eddsa_key_create_from_configuration

(

const struct GNUNET_CONFIGURATION_Handle *

cfg

)

Create a new private key by reading our peer's key from the file specified in the configuration.

Parameters

cfg	the configuration to use

Returns

new private key, NULL on error (for example, permission denied); free using GNUNET_free

Parameters

cfg	the configuration to use

Returns

new private key, NULL on error (for example, permission denied)

Definition at line 247 of file crypto_ecc_setup.c.

{
  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
  char *fn;
 
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_filename (cfg,
                                               "PEER",
                                               "PRIVATE_KEY",
                                               &fn))
    return NULL;
  priv = GNUNET_new (struct GNUNET_CRYPTO_EddsaPrivateKey);
  if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_key_from_file (fn,
                                                          GNUNET_YES,
                                                          priv))
  {
    GNUNET_free (fn);
    GNUNET_free (priv);
    return NULL;
  }
  GNUNET_free (fn);
  return priv;
}

References cfg, GNUNET_CONFIGURATION_get_value_filename(), GNUNET_CRYPTO_eddsa_key_from_file(), GNUNET_free, GNUNET_new, GNUNET_OK, GNUNET_SYSERR, and GNUNET_YES.

Referenced by advertise_dns_exit(), DHTU_gnunet_init(), GNUNET_CRYPTO_get_peer_identity(), GNUNET_CRYPTO_sign_by_peer_identity(), init_socket(), and run().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_create()

void GNUNET_CRYPTO_ecdsa_key_create

(

struct GNUNET_CRYPTO_EcdsaPrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 465 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdsa_key_create);
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey));
  pk->d[0] &= 248;
  pk->d[31] &= 127;
  pk->d[31] |= 64;
 
  BENCHMARK_END (ecdsa_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by GNUNET_CRYPTO_ecdsa_key_from_file(), private_key_create(), run_edkey(), and run_pkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_create()

void GNUNET_CRYPTO_eddsa_key_create

(

struct GNUNET_CRYPTO_EddsaPrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 480 of file crypto_ecc.c.

{
  BENCHMARK_START (eddsa_key_create);
  /*
   * We do not clamp for EdDSA, since all functions that use the private key do
   * their own clamping (just like in libsodium).  What we call "private key"
   * here, actually corresponds to the seed in libsodium.
   *
   * (Contrast this to ECDSA, where functions using the private key can't clamp
   * due to properties needed for GNS.  That is a worse/unsafer API, but
   * required for the GNS constructions to work.)
   */
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
  BENCHMARK_END (eddsa_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by create_keys(), GNUNET_CRYPTO_eddsa_key_from_file(), output_vectors(), private_key_create(), and run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_create()

void GNUNET_CRYPTO_edx25519_key_create

(

struct GNUNET_CRYPTO_Edx25519PrivateKey *

pk

)

Create a new private key.

Parameters

[out]

pk

private key to initialize

Definition at line 65 of file crypto_edx25519.c.

{
  char seed[256 / 8];
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              seed,
                              sizeof (seed));
  GNUNET_CRYPTO_edx25519_key_create_from_seed (seed,
                                               sizeof(seed),
                                               pk);
}

References GNUNET_CRYPTO_edx25519_key_create_from_seed(), GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), pk, and seed.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_create_from_seed()

void GNUNET_CRYPTO_edx25519_key_create_from_seed	(	const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PrivateKey *	pk
	)

Create a new private key for Edx25519 from a given seed.

After expanding the seed, the first half of the key will be clamped according to EdDSA.

Parameters

	seed	seed input
	seedsize	size of the seed in bytes
[out]	pk	private key to initialize

Definition at line 45 of file crypto_edx25519.c.

{
 
  GNUNET_static_assert (sizeof(*pk) == sizeof(struct GNUNET_HashCode));
  GNUNET_CRYPTO_hash (seed,
                      seedsize,
                      (struct GNUNET_HashCode *) pk);
 
  /* Clamp the first half of the key. The second half is used in the signature
   * process. */
  pk->a[0] &= 248;
  pk->a[31] &= 127;
  pk->a[31] |= 64;
}

References GNUNET_CRYPTO_hash(), GNUNET_static_assert, pk, and seed.

Referenced by GNUNET_CRYPTO_edx25519_key_create().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_key_create()

void GNUNET_CRYPTO_ecdhe_key_create

(

struct GNUNET_CRYPTO_EcdhePrivateKey *

pk

)

Create a new private key.

Clear with GNUNET_CRYPTO_ecdhe_key_clear(). This is X25519 DH (RFC 7748 Section 5) and corresponds to X25519(a,9). See GNUNET_CRYPTO_ecc_ecdh for the DH function.

Parameters

[out]

pk

set to fresh private key;

Definition at line 454 of file crypto_ecc.c.

{
  BENCHMARK_START (ecdhe_key_create);
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              pk,
                              sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
  BENCHMARK_END (ecdhe_key_create);
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by do_rekey(), GCT_create_tunnel(), GNUNET_CRYPTO_hpke_authkem_encaps(), GNUNET_CRYPTO_hpke_kem_encaps(), GNUNET_CRYPTO_hpke_sender_setup(), GSC_KX_init(), new_ephemeral(), output_vectors(), and print_examples_ecdh().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_key_clear()

void GNUNET_CRYPTO_eddsa_key_clear

(

struct GNUNET_CRYPTO_EddsaPrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 447 of file crypto_ecc.c.

{
  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey));
}

References buffer_clear(), and pk.

Referenced by GNUNET_CRYPTO_private_key_clear(), and GNUNET_CRYPTO_sign_by_peer_identity().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_clear()

void GNUNET_CRYPTO_ecdsa_key_clear

(

struct GNUNET_CRYPTO_EcdsaPrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 440 of file crypto_ecc.c.

{
  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
}

References buffer_clear(), and pk.

Referenced by GNUNET_CRYPTO_private_key_clear().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_key_clear()

void GNUNET_CRYPTO_edx25519_key_clear

(

struct GNUNET_CRYPTO_Edx25519PrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 38 of file crypto_edx25519.c.

{
  memset (pk, 0, sizeof(struct GNUNET_CRYPTO_Edx25519PrivateKey));
}

References pk.

GNUNET_CRYPTO_ecdhe_key_clear()

void GNUNET_CRYPTO_ecdhe_key_clear

(

struct GNUNET_CRYPTO_EcdhePrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 433 of file crypto_ecc.c.

{
  buffer_clear (pk, sizeof(struct GNUNET_CRYPTO_EcdhePrivateKey));
}

References buffer_clear(), and pk.

Referenced by cleanup_ax().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_private_key_clear()

void GNUNET_CRYPTO_private_key_clear

(

struct GNUNET_CRYPTO_PrivateKey *

pk

)

Clear memory that was used to store a private key.

Parameters

pk	location of the key

Definition at line 47 of file crypto_pkey.c.

{
  switch (ntohl (key->type))
  {
  case GNUNET_PUBLIC_KEY_TYPE_ECDSA:
    GNUNET_CRYPTO_ecdsa_key_clear (&key->ecdsa_key);
    break;
  case GNUNET_PUBLIC_KEY_TYPE_EDDSA:
    GNUNET_CRYPTO_eddsa_key_clear (&key->eddsa_key);
    break;
  default:
    GNUNET_break (0);
  }
}

References GNUNET_break, GNUNET_CRYPTO_ecdsa_key_clear(), GNUNET_CRYPTO_eddsa_key_clear(), GNUNET_PUBLIC_KEY_TYPE_ECDSA, GNUNET_PUBLIC_KEY_TYPE_EDDSA, and key.

Referenced by dequeue_message_from_room(), and GNUNET_MESSENGER_set_key().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_key_get_anonymous()

const struct GNUNET_CRYPTO_EcdsaPrivateKey * GNUNET_CRYPTO_ecdsa_key_get_anonymous

(

void

)

Get the shared private key we use for anonymous users.

Returns

"anonymous" private key; do not free

'anonymous' pseudonym (global static, d=1, public key = G (generator).

Definition at line 500 of file crypto_ecc.c.

{
  static struct GNUNET_CRYPTO_EcdsaPrivateKey anonymous;
  static int once;
 
  if (once)
    return &anonymous;
  GNUNET_CRYPTO_mpi_print_unsigned (anonymous.d,
                                    sizeof(anonymous.d),
                                    GCRYMPI_CONST_ONE);
  anonymous.d[0] &= 248;
  anonymous.d[31] &= 127;
  anonymous.d[31] |= 64;
 
  once = 1;
  return &anonymous;
}

References GNUNET_CRYPTO_EcdsaPrivateKey::d, GNUNET_CRYPTO_mpi_print_unsigned(), and once.

Referenced by decrypt_block_with_keyword(), GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), GNUNET_IDENTITY_ego_get_anonymous(), process_kblock_for_unindex(), and publish_ksk_cont().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_setup_hostkey()

void GNUNET_CRYPTO_eddsa_setup_hostkey

(

const char *

cfg_name

)

Setup a hostkey file for a peer given the name of the configuration file (!).

This function is used so that at a later point code can be certain that reading a hostkey is fast (for example in time-dependent testcases).

Parameters

cfg_name

name of the configuration file to use

GNUNET_CRYPTO_get_peer_identity()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_get_peer_identity	(	const struct GNUNET_CONFIGURATION_Handle *	cfg,
		struct GNUNET_PeerIdentity *	dst
	)

Retrieve the identity of the host's peer.

Parameters

cfg	configuration to use
dst	pointer to where to write the peer identity

Returns

GNUNET_OK on success, GNUNET_SYSERR if the identity could not be retrieved

Definition at line 274 of file crypto_ecc_setup.c.

{
  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
 
  if (NULL == (priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("Could not load peer's private key\n"));
    return GNUNET_SYSERR;
  }
  GNUNET_CRYPTO_eddsa_key_get_public (priv,
                                      &dst->public_key);
  GNUNET_free (priv);
  return GNUNET_OK;
}

References _, cfg, GNUNET_CRYPTO_eddsa_key_create_from_configuration(), GNUNET_CRYPTO_eddsa_key_get_public(), GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_log, GNUNET_OK, GNUNET_SYSERR, and GNUNET_PeerIdentity::public_key.

Referenced by DHTU_ip_init(), get_result_iterator(), get_service_peer_identity(), GNUNET_CONVERSATION_phone_create(), and run().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_sign_by_peer_identity()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_sign_by_peer_identity	(	const struct GNUNET_CONFIGURATION_Handle *	cfg,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_EddsaSignature *	sig
	)

Sign a given block with a specific purpose using the host's peer identity.

Parameters

cfg	configuration to use
purpose	what to sign (size, purpose)
sig	where to write the signature

Returns

GNUNET_OK on success, GNUNET_SYSERR if the identity could not be retrieved

Definition at line 293 of file crypto_ecc_setup.c.

{
  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
  enum GNUNET_GenericReturnValue result;
 
  if (NULL == (priv = GNUNET_CRYPTO_eddsa_key_create_from_configuration (cfg)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("Could not load peer's private key\n"));
    return GNUNET_SYSERR;
  }
 
  result = GNUNET_CRYPTO_eddsa_sign_ (priv, purpose, sig);
  GNUNET_CRYPTO_eddsa_key_clear (priv);
  return result;
}

References _, cfg, GNUNET_CRYPTO_eddsa_key_clear(), GNUNET_CRYPTO_eddsa_key_create_from_configuration(), GNUNET_CRYPTO_eddsa_sign_(), GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_SYSERR, and result.

Referenced by sign_message_by_peer().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_verify_peer_identity()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_verify_peer_identity	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_EddsaSignature *	sig,
		const struct GNUNET_PeerIdentity *	identity
	)

Verify a given signature with a peer's identity.

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
identity	the peer's identity to verify

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 316 of file crypto_ecc_setup.c.

{
  return GNUNET_CRYPTO_eddsa_verify_ (purpose, validate, sig,
                                      &identity->public_key);
}

References GNUNET_CRYPTO_eddsa_verify_(), and identity.

Referenced by verify_message_by_peer().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecc_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecc_ecdh	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a public and a private ECC key.

This is X25519 DH (RFC 7748 Section 5) and corresponds to H(X25519(b,X25519(a,9))) where b := priv, pub := X25519(a,9), and a := GNUNET_CRYPTO_ecdhe_key_create().

Parameters

priv	private key to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material (xyG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 732 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_hash(), GNUNET_OK, GNUNET_SYSERR, p, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by checkvec(), derive_session_keys(), output_vectors(), print_examples_ecdh(), t_ax_decrypt_and_validate(), t_ax_encrypt(), and update_ax_by_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_ecdh	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a ECDH public key and a private EdDSA key.

Dual to #GNUNET_CRRYPTO_ecdh_eddsa. This uses the Ed25519 private seed as X25519 seed. As such, this also is a X25519 DH (see GNUNET_CRYPTO_ecc_ecdh). NOTE: Whenever you can get away with it, use separate key pairs for signing and encryption (DH)!

Parameters

priv	private key from EdDSA to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 745 of file crypto_ecc.c.

{
  struct GNUNET_HashCode hc;
  uint8_t a[crypto_scalarmult_SCALARBYTES];
  uint8_t p[crypto_scalarmult_BYTES];
 
  GNUNET_CRYPTO_hash (priv,
                      sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey),
                      &hc);
  memcpy (a, &hc, sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
  if (0 != crypto_scalarmult (p, a, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p,
                      crypto_scalarmult_BYTES,
                      key_material);
  return GNUNET_OK;
}

References GNUNET_CRYPTO_hash(), GNUNET_OK, GNUNET_SYSERR, p, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by update_ax_by_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_x25519_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_x25519_ecdh	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	sk,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pk,
		struct GNUNET_CRYPTO_EcdhePublicKey *	dh
	)

Derive key material from a ECDH public key and a private X25519 key.

Dual to #GNUNET_CRRYPTO_ecdh_x25519. NOTE: Whenever you can get away with it, use separate key pairs for signing and encryption (DH)!

Parameters

sk	private key from X25519 to use for the ECDH (x)
pk	public key to use for the ECDH (yG)
additional_data	this is fed into HKDF-Extract along with the ECDH shared secret
ad_len	Length of the additional data
dh	the DH shared secret (NOTE: Derive key from this before use!)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 767 of file crypto_ecc.c.

{
  uint64_t checkbyte = 0;
  size_t num_words = sizeof *dh / sizeof (uint64_t);
  if (0 != crypto_scalarmult_curve25519 (dh->q_y, sk->d, pub->q_y))
    return GNUNET_SYSERR;
  // We need to check if this is the all-zero value
  for (int i = 0; i < num_words; i++)
    checkbyte |= ((uint64_t*)dh)[i];
  return (0 == checkbyte) ? GNUNET_SYSERR : GNUNET_OK;
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_OK, GNUNET_SYSERR, pub, GNUNET_CRYPTO_EddsaPublicKey::q_y, and GNUNET_CRYPTO_EcdhePublicKey::q_y.

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps(), and GNUNET_CRYPTO_hpke_kem_decaps().

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_kem_decaps	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	prk
	)

Decapsulate a key for a private X25519 key.

Dual to GNUNET_CRYPTO_hpke_kem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

priv	private key from X25519 to use for the ECDH (x)
c	the encapsulated key
prk	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 370 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey dh;
  uint8_t kem_context[sizeof *c + crypto_scalarmult_curve25519_BYTES];
  uint8_t pkR[crypto_scalarmult_BYTES];
 
  // pkE = DeserializePublicKey(enc) is a NOP, see Section 7.1.1
  // dh = DH(skR, pkE)
  if (GNUNET_OK !=
      GNUNET_CRYPTO_x25519_ecdh (skR,
                                 (struct GNUNET_CRYPTO_EcdhePublicKey*) c,
                                 &dh))
    return GNUNET_SYSERR; // ValidationError
 
  // pkRm = DeserializePublicKey(pk(skR)) is a NOP, see Section 7.1.1
  crypto_scalarmult_curve25519_base (pkR, skR->d);
  // kem_context = concat(enc, pkRm)
  memcpy (kem_context, c, sizeof *c);
  memcpy (kem_context + sizeof *c, pkR, sizeof pkR);
  // shared_secret = ExtractAndExpand(dh, kem_context)
  return GNUNET_CRYPTO_hpke_labeled_extract_and_expand (
    &dh, sizeof dh,
    "HPKE-v1",
    "HPKE-v1",
    "eae_prk", strlen ("eae_prk"),
    "shared_secret", strlen ("shared_secret"),
    kem_context, sizeof kem_context,
    GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
    sizeof GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
    shared_secret);
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_HPKE_KEM_SUITE_ID, GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_CRYPTO_x25519_ecdh(), GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_eddsa_kem_decaps(), and GNUNET_CRYPTO_hpke_receiver_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_kem_encaps	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	prk
	)

Encapsulate key material for a X25519 public key.

Dual to GNUNET_CRYPTO_hpke_kem_decaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
c	public key from X25519 to use for the ECDH (X=h(x)G)
prk	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 299 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePrivateKey skE;
  // skE, pkE = GenerateKeyPair()
  GNUNET_CRYPTO_ecdhe_key_create (&skE);
 
  return GNUNET_CRYPTO_hpke_kem_encaps_norand (pub, c, &skE, shared_secret);
}

References GNUNET_CRYPTO_ecdhe_key_create(), GNUNET_CRYPTO_hpke_kem_encaps_norand(), and pub.

Referenced by GNUNET_CRYPTO_eddsa_kem_encaps().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_kem_encaps_norand()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_kem_encaps_norand	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skE,
		struct GNUNET_ShortHashCode *	prk
	)

Deterministic variant of GNUNET_CRYPTO_hpke_kem_encaps.

Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
c	public key from X25519 to use for the ECDH (X=h(x)G)
skE	ephemeral private key from X25519 to use
prk	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 282 of file crypto_hpke.c.

{
  // enc = SerializePublicKey(pkE) is a NOP, see Section 7.1.1
  GNUNET_CRYPTO_ecdhe_key_get_public (
    skE,
    (struct GNUNET_CRYPTO_EcdhePublicKey*) enc);
  return kem_encaps_norand (GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
                            sizeof GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
                            pkR, enc, skE, shared_secret);
}

References enc, GNUNET_CRYPTO_ecdhe_key_get_public(), GNUNET_CRYPTO_HPKE_KEM_SUITE_ID, and kem_encaps_norand().

Referenced by GNUNET_CRYPTO_hpke_kem_encaps(), and GNUNET_CRYPTO_hpke_sender_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_authkem_encaps_norand()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_authkem_encaps_norand	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skS,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skE,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Encapsulate authenticated key material for a X25519 public key.

Deterministic variant of GNUNET_CRYPTO_hpke_authkem_encaps. Dual to GNUNET_CRYPTO_hpke_authkem_decaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
skS	secret of the authenticating sender
c	public key from X25519 to use for the ECDH (X=h(x)G)
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 212 of file crypto_hpke.c.

{
  // enc = SerializePublicKey(pkE) is a NOP, see Section 7.1.1
  GNUNET_CRYPTO_ecdhe_key_get_public (
    skE,
    (struct GNUNET_CRYPTO_EcdhePublicKey*) c);
  return authkem_encaps_norand (GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
                                sizeof GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
                                pkR, skS, c, skE, shared_secret);
}

References authkem_encaps_norand(), GNUNET_CRYPTO_ecdhe_key_get_public(), and GNUNET_CRYPTO_HPKE_KEM_SUITE_ID.

Referenced by GNUNET_CRYPTO_hpke_authkem_encaps(), and GNUNET_CRYPTO_hpke_sender_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_authkem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_authkem_encaps	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skS,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Encapsulate authenticated key material for a X25519 public key.

Dual to GNUNET_CRYPTO_hpke_kem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
skS	secret of the authenticating sender
c	public key from X25519 to use for the ECDH (X=h(x)G)
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 230 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePrivateKey skE;
  // skE, pkE = GenerateKeyPair()
  GNUNET_CRYPTO_ecdhe_key_create (&skE);
 
  return GNUNET_CRYPTO_hpke_authkem_encaps_norand (pkR, skS, c, &skE,
                                                   shared_secret);
}

References GNUNET_CRYPTO_ecdhe_key_create(), and GNUNET_CRYPTO_hpke_authkem_encaps_norand().

Here is the call graph for this function:

GNUNET_CRYPTO_hpke_authkem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_authkem_decaps	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	skR,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pkS,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Decapsulate a key for a private X25519 key.

Dual to GNUNET_CRYPTO_hpke_authkem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

skR	secret key of receiver
pkS	public key of the authenticating sender
c	the encapsulated key
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 327 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey dh[2];
  uint8_t pkR[crypto_scalarmult_BYTES];
  uint8_t kem_context[sizeof *c + sizeof pkR + sizeof *pkS];
 
  // pkE = DeserializePublicKey(enc) is a NOP, see Section 7.1.1
  // dh = DH(skE, pkR)
  if (GNUNET_OK != GNUNET_CRYPTO_ecdh_x25519 (skR,
                                              (struct
                                               GNUNET_CRYPTO_EcdhePublicKey*) c,
                                              &dh[0]))
    return GNUNET_SYSERR; // ValidationError
  // dh = DH(skS, pkR)
  if (GNUNET_OK != GNUNET_CRYPTO_ecdh_x25519 (skR, pkS,
                                              &dh[1]))
    return GNUNET_SYSERR; // ValidationError
  // pkRm = DeserializePublicKey(pk(skR)) is a NOP, see Section 7.1.1
  crypto_scalarmult_curve25519_base (pkR, skR->d);
  // kem_context = concat(enc, pkRm)
  memcpy (kem_context, c, sizeof *c);
  memcpy (kem_context + sizeof *c, pkR, sizeof pkR);
  memcpy (kem_context + sizeof *c + sizeof pkR,
          pkS, sizeof *pkS);
  // shared_secret = ExtractAndExpand(dh, kem_context)
  return GNUNET_CRYPTO_hpke_labeled_extract_and_expand (
    dh, sizeof (struct GNUNET_CRYPTO_EcdhePublicKey) * 2,
    "HPKE-v1",
    "HPKE-v1",
    "eae_prk", strlen ("eae_prk"),
    "shared_secret", strlen ("shared_secret"),
    kem_context, sizeof kem_context,
    GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
    sizeof GNUNET_CRYPTO_HPKE_KEM_SUITE_ID,
    shared_secret);
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_ecdh_x25519(), GNUNET_CRYPTO_HPKE_KEM_SUITE_ID, GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_OK, and GNUNET_SYSERR.

Referenced by GNUNET_CRYPTO_hpke_receiver_setup2().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand	(	uint8_t	random_tweak,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *	skE,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair.

Following the terminology in https://eprint.iacr.org/2021/509.pdf. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

random_tweak	random 8-bit value used as seed
pkR	public key of receiver
c	representative of ephemeral public key A to use for the ECDH (direct_map(r)=A=aG)
skE	special elligator ephemeral private key from X25519 to use
shared_secret	where to write the key material HKDF-Extract(r||aX)=HKDF-Extract(r||x(aG))

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 423 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey pkE;
  // skE, pkE = GenerateElligatorKeyPair()
  // enc = SerializePublicKey(pkE) == c is the elligator representative
  GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand (random_tweak,
                                                       skE,
                                                       &pkE,
                                                       (struct
                                                        GNUNET_CRYPTO_ElligatorRepresentative
                                                        *) c);
 
  return kem_encaps_norand (GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID,
                            sizeof GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID,
                            pkR, c, (const struct
                                     GNUNET_CRYPTO_EcdhePrivateKey*) skE,
                            shared_secret);
}

References GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand(), GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID, and kem_encaps_norand().

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_encaps(), GNUNET_CRYPTO_hpke_sender_setup2(), and main().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_elligator_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_kem_encaps	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Carries out ecdh encapsulation with given public key and the private key from a freshly created ephemeral key pair.

Following the terminology in https://eprint.iacr.org/2021/509.pdf. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	Receiver public key (X)
c	representative of ephemeral public key A to use for the ECDH (direct_map(r)=A=aG)
shared_secret	where to write the key material HKDF-Extract(r||aX)=HKDF-Extract(r||x(aG))

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 449 of file crypto_hpke.c.

{
  uint8_t random_tweak;
  struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey skE;
 
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              &random_tweak,
                              sizeof(uint8_t));
 
  // skE, pkE = GenerateElligatorKeyPair()
  GNUNET_CRYPTO_ecdhe_elligator_key_create (&skE);
 
  return GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand (random_tweak, pkR, c,
                                                         &skE, shared_secret);
}

References GNUNET_CRYPTO_ecdhe_elligator_key_create(), GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand(), GNUNET_CRYPTO_QUALITY_NONCE, and GNUNET_CRYPTO_random_block().

Referenced by setup_initial_shared_secret_ephemeral(), and start_initial_kx_out().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_elligator_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_kem_decaps	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	skR,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Carries out ecdh decapsulation with own private key and the representative of the received public key.

Following the terminology in https://eprint.iacr.org/2021/509.pdf. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

skR	sender private key (x)
r	received representative r, from which we can obtain the public key A (direct_map(r)=A=aG)
shared_secret	where to write the key material HKDF-Extract(r||aX)=HKDF-Extract(r||x(aG))

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 470 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey pkE;
  struct GNUNET_CRYPTO_EcdhePublicKey dh;
  const struct GNUNET_CRYPTO_ElligatorRepresentative *r;
  uint8_t kem_context[sizeof *r + crypto_scalarmult_curve25519_BYTES];
  uint8_t pkR[crypto_scalarmult_BYTES];
 
  r = (struct GNUNET_CRYPTO_ElligatorRepresentative*) c;
  // pkE = DeserializePublicKey(enc) Elligator deserialize!
  GNUNET_CRYPTO_ecdhe_elligator_decoding (&pkE, NULL, r);
  // dh = DH(skR, pkE)
  GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_x25519_ecdh (skR, &pkE,
                                                         &dh));
  // pkRm = DeserializePublicKey(pk(skR)) is a NOP, see Section 7.1.1
  crypto_scalarmult_curve25519_base (pkR, skR->d);
  memcpy (kem_context, r, sizeof *r);
  memcpy (kem_context + sizeof *r, pkR, sizeof pkR);
  // shared_secret = ExtractAndExpand(dh, kem_context)
  return GNUNET_CRYPTO_hpke_labeled_extract_and_expand (
    &dh, sizeof dh,
    "HPKE-v1",
    "HPKE-v1",
    "eae_prk", strlen ("eae_prk"),
    "shared_secret", strlen ("shared_secret"),
    kem_context, sizeof kem_context,
    GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID,
    sizeof GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID,
    shared_secret);
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_assert, GNUNET_CRYPTO_ecdhe_elligator_decoding(), GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID, GNUNET_CRYPTO_hpke_labeled_extract_and_expand(), GNUNET_CRYPTO_x25519_ecdh(), GNUNET_OK, and GNUNET_CRYPTO_ElligatorRepresentative::r.

Referenced by GNUNET_CRYPTO_hpke_receiver_setup2(), setup_in_cipher_elligator(), and setup_initial_shared_secret_dec().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skS,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *	skE,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Encapsulate authenticated key material for a X25519 public key.

Elligator variant. Deterministic variant of GNUNET_CRYPTO_hpke_authkem_encaps. Dual to GNUNET_CRYPTO_hpke_authkem_decaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
skS	secret of the authenticating sender
c	public key from X25519 to use for the ECDH (X=h(x)G)
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 506 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey pkE;
  // skE, pkE = GenerateElligatorKeyPair()
  // enc = SerializePublicKey(pkE) == c is the elligator representative
  GNUNET_CRYPTO_ecdhe_elligator_key_get_public (
    skE, &pkE,
    (struct GNUNET_CRYPTO_ElligatorRepresentative*) c);
 
  return authkem_encaps_norand (GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID,
                                sizeof GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID
                                ,
                                pkR, skS, c,
                                (const struct
                                 GNUNET_CRYPTO_EcdhePrivateKey*) skE,
                                shared_secret);
}

References authkem_encaps_norand(), GNUNET_CRYPTO_ecdhe_elligator_key_get_public(), and GNUNET_CRYPTO_HPKE_KEM_ELLIGATOR_SUITE_ID.

Referenced by GNUNET_CRYPTO_hpke_elligator_authkem_encaps().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_hpke_elligator_authkem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_authkem_encaps	(	const struct GNUNET_CRYPTO_EcdhePublicKey *	pkR,
		const struct GNUNET_CRYPTO_EcdhePrivateKey *	skS,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Encapsulate authenticated key material for a X25519 public key.

Elligator variant. Dual to GNUNET_CRYPTO_hpke_kem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

pkR	public key of receiver
skS	secret of the authenticating sender
c	public key from X25519 to use for the ECDH (X=h(x)G)
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 531 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey skE;
  // skE, pkE = GenerateElligatorKeyPair()
  GNUNET_CRYPTO_ecdhe_elligator_key_create (&skE);
 
  return GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand (pkR, skS, c, &skE,
                                                             shared_secret);
}

References GNUNET_CRYPTO_ecdhe_elligator_key_create(), and GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand().

Here is the call graph for this function:

GNUNET_CRYPTO_hpke_elligator_authkem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_hpke_elligator_authkem_decaps	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	skR,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pkS,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	shared_secret
	)

Decapsulate a key for a private X25519 key.

Elligator variant. Dual to GNUNET_CRYPTO_hpke_authkem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

skR	private key from X25519 to use for the ECDH (x)
pkS	public key of the authenticating sender
c	the encapsulated key
shared_secret	where to write the key material

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

GNUNET_CRYPTO_eddsa_kem_decaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_kem_decaps	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	prk
	)

Decapsulate a key for a private EdDSA key.

Dual to #GNUNET_CRRYPTO_eddsa_kem_encaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

priv	private key from EdDSA to use for the ECDH (x)
c	the encapsulated key
prk	where to write the key material HKDF-Extract(c||aX)=HKDF-Extract(c||x(aG))

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 407 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePrivateKey skR;
 
  // This maps the ed25519 point to X25519
  if (0 != crypto_sign_ed25519_sk_to_curve25519 (skR.d, priv->d))
    return GNUNET_SYSERR;
  return GNUNET_CRYPTO_hpke_kem_decaps (&skR, c, shared_secret);
 
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_EddsaPrivateKey::d, GNUNET_CRYPTO_hpke_kem_decaps(), and GNUNET_SYSERR.

Referenced by handle_dv_box(), setup_in_cipher(), and setup_shared_secret_dec().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_kem_encaps()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_kem_encaps	(	const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		struct GNUNET_CRYPTO_HpkeEncapsulation *	c,
		struct GNUNET_ShortHashCode *	prk
	)

Encapsulate key material for a EdDSA public key.

Dual to #GNUNET_CRRYPTO_eddsa_kem_decaps. Use GNUNET_CRYPTO_hkdf_expand to derive further context-specific keys from the key material.

Parameters

priv	private key to use for the ECDH (y)
c	public key from EdDSA to use for the ECDH (X=h(x)G)
prk	where to write the key material HKDF-Extract(c||aX)=HKDF-Extract(c||x(aG))

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 312 of file crypto_hpke.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey pkR;
 
  // This maps the ed25519 point to X25519
  if (0 != crypto_sign_ed25519_pk_to_curve25519 (pkR.q_y, pub->q_y))
    return GNUNET_SYSERR;
 
  return GNUNET_CRYPTO_hpke_kem_encaps (&pkR, c, shared_secret);
}

References GNUNET_CRYPTO_hpke_kem_encaps(), GNUNET_SYSERR, pub, GNUNET_CRYPTO_EddsaPublicKey::q_y, and GNUNET_CRYPTO_EcdhePublicKey::q_y.

Referenced by encapsulate_for_dv(), inject_rekey(), and setup_shared_secret_ephemeral().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_ecdh()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_ecdh	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

HPKE END.

Derive key material from a ECDH public key and a private ECDSA key. Dual to #GNUNET_CRRYPTO_ecdh_ecdsa.

Parameters

priv	private key from ECDSA to use for the ECDH (x)
pub	public key to use for the ECDH (yG)
key_material	where to write the key material H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 805 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
 
  BENCHMARK_START (ecdsa_ecdh);
  if (0 != crypto_scalarmult (p, priv->d, pub->q_y))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p,
                      crypto_scalarmult_BYTES,
                      key_material);
  BENCHMARK_END (ecdsa_ecdh);
  return GNUNET_OK;
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EcdsaPrivateKey::d, GNUNET_CRYPTO_hash(), GNUNET_OK, GNUNET_SYSERR, p, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Here is the call graph for this function:

GNUNET_CRYPTO_ecdh_eddsa()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdh_eddsa	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a EdDSA public key and a private ECDH key.

Dual to #GNUNET_CRRYPTO_eddsa_ecdh. This converts the Edwards25519 public key pub to a Curve25519 public key before computing a X25519 DH (see GNUNET_CRYPTO_ecc_ecdh). The resulting X25519 secret is then derived to a key using SHA-512. NOTE: Whenever you can get away with it, use separate key pairs for signing and encryption (DH)!

Parameters

priv	private key to use for the ECDH (y)
pub	public key from EdDSA to use for the ECDH (X=h(x)G)
key_material	where to write the key material H(yX)=H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 823 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
 
  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
    return GNUNET_SYSERR;
  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_hash(), GNUNET_OK, GNUNET_SYSERR, p, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by checkvec(), output_vectors(), and update_ax_by_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdh_x25519()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdh_x25519	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_CRYPTO_EcdhePublicKey *	dh
	)

Derive key material from a EdDSA public key and a private ECDH key.

Dual to #GNUNET_CRRYPTO_x25519_ecdh. NOTE: Whenever you can get away with it, use separate key pairs for signing and encryption (DH)!

Parameters

priv	private key to use for the ECDH (y)
pub	public key from EdDSA to use for the ECDH (X=h(x)G)
dh	the DH shared secret (NOTE: Derive key from this before use!)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 783 of file crypto_ecc.c.

{
  uint64_t checkbyte = 0;
  size_t num_words = sizeof *dh / sizeof (uint64_t);
  if (0 != crypto_scalarmult_curve25519 (dh->q_y, sk->d, pk->q_y))
    return GNUNET_SYSERR;
  // We need to check if this is the all-zero value
  for (int i = 0; i < num_words; i++)
    checkbyte |= ((uint64_t*)dh)[i];
  if (0 == checkbyte)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "HPKE ECDH: X25519 all zero value!\n");
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_OK, GNUNET_SYSERR, pk, and GNUNET_CRYPTO_EcdhePublicKey::q_y.

Referenced by authkem_encaps_norand(), GNUNET_CRYPTO_hpke_authkem_decaps(), and kem_encaps_norand().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdh_ecdsa()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdh_ecdsa	(	const struct GNUNET_CRYPTO_EcdhePrivateKey *	priv,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub,
		struct GNUNET_HashCode *	key_material
	)

Derive key material from a EcDSA public key and a private ECDH key.

Dual to #GNUNET_CRRYPTO_ecdsa_ecdh.

Parameters

priv	private key to use for the ECDH (y)
pub	public key from ECDSA to use for the ECDH (X=h(x)G)
key_material	where to write the key material H(yX)=H(h(x)yG)

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 841 of file crypto_ecc.c.

{
  uint8_t p[crypto_scalarmult_BYTES];
  uint8_t curve25510_pk[crypto_scalarmult_BYTES];
 
  if (0 != crypto_sign_ed25519_pk_to_curve25519 (curve25510_pk, pub->q_y))
    return GNUNET_SYSERR;
  if (0 != crypto_scalarmult (p, priv->d, curve25510_pk))
    return GNUNET_SYSERR;
  GNUNET_CRYPTO_hash (p, crypto_scalarmult_BYTES, key_material);
  return GNUNET_OK;
}

References GNUNET_CRYPTO_EcdhePrivateKey::d, GNUNET_CRYPTO_hash(), GNUNET_OK, GNUNET_SYSERR, p, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Here is the call graph for this function:

GNUNET_CRYPTO_eddsa_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_sign_	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_EddsaSignature *	sig
	)

EdDSA sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_eddsa_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 625 of file crypto_ecc.c.

{
 
  size_t mlen = ntohl (purpose->size);
  unsigned char sk[crypto_sign_SECRETKEYBYTES];
  unsigned char pk[crypto_sign_PUBLICKEYBYTES];
  int res;
 
  BENCHMARK_START (eddsa_sign);
  GNUNET_assert (0 == crypto_sign_seed_keypair (pk, sk, priv->d));
  res = crypto_sign_detached ((uint8_t *) sig,
                              NULL,
                              (uint8_t *) purpose,
                              mlen,
                              sk);
  BENCHMARK_END (eddsa_sign);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_CRYPTO_EddsaPrivateKey::d, GNUNET_assert, GNUNET_OK, GNUNET_SYSERR, pk, res, and GNUNET_CRYPTO_EccSignaturePurpose::size.

Referenced by do_dht_put(), GNUNET_CRYPTO_sign_(), GNUNET_CRYPTO_sign_by_peer_identity(), GNUNET_CRYPTO_sign_raw_(), insert_decrypt_element(), insert_round1_element(), insert_round2_element(), regex_iterator(), setup_flood_message(), and sign_ephemeral_key().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_sign_	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_EcdsaSignature *	sig
	)

ECDSA Sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_ecdsa_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Definition at line 554 of file crypto_ecc.c.

{
  gcry_sexp_t priv_sexp;
  gcry_sexp_t sig_sexp;
  gcry_sexp_t data;
  int rc;
  gcry_mpi_t rs[2];
 
  BENCHMARK_START (ecdsa_sign);
 
  priv_sexp = decode_private_ecdsa_key (priv);
  data = data_to_ecdsa_value (purpose);
  if (0 != (rc = gcry_pk_sign (&sig_sexp, data, priv_sexp)))
  {
    LOG (GNUNET_ERROR_TYPE_WARNING,
         _ ("ECC signing failed at %s:%d: %s\n"),
         __FILE__,
         __LINE__,
         gcry_strerror (rc));
    gcry_sexp_release (data);
    gcry_sexp_release (priv_sexp);
    return GNUNET_SYSERR;
  }
  gcry_sexp_release (priv_sexp);
  gcry_sexp_release (data);
 
  /* extract 'r' and 's' values from sexpression 'sig_sexp' and store in
     'signature' */
  if (0 != (rc = key_from_sexp (rs, sig_sexp, "sig-val", "rs")))
  {
    GNUNET_break (0);
    gcry_sexp_release (sig_sexp);
    return GNUNET_SYSERR;
  }
  gcry_sexp_release (sig_sexp);
  GNUNET_CRYPTO_mpi_print_unsigned (sig->r, sizeof(sig->r), rs[0]);
  GNUNET_CRYPTO_mpi_print_unsigned (sig->s, sizeof(sig->s), rs[1]);
  gcry_mpi_release (rs[0]);
  gcry_mpi_release (rs[1]);
 
  BENCHMARK_END (ecdsa_sign);
 
  return GNUNET_OK;
}

References _, BENCHMARK_END, BENCHMARK_START, data, data_to_ecdsa_value(), decode_private_ecdsa_key(), GNUNET_break, GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_ERROR_TYPE_WARNING, GNUNET_OK, GNUNET_SYSERR, key_from_sexp(), LOG, GNUNET_CRYPTO_EcdsaSignature::r, and GNUNET_CRYPTO_EcdsaSignature::s.

Referenced by GNUNET_CRYPTO_ecdsa_sign_derived(), GNUNET_CRYPTO_sign_(), GNUNET_CRYPTO_sign_raw_(), and GNUNET_FS_publish_ublock_().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_sign_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_edx25519_sign_	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	purpose,
		struct GNUNET_CRYPTO_Edx25519Signature *	sig
	)

Edx25519 sign a given block.

The purpose data is the beginning of the data of which the signature is to be created. The size field in purpose must correctly indicate the number of bytes of the data structure, including its header. If possible, use GNUNET_CRYPTO_edx25519_sign() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

	priv	private key to use for the signing
	purpose	what to sign (size, purpose)
[out]	sig	where to write the signature

Returns

GNUNET_SYSERR on error, GNUNET_OK on success

Edx25519 sign a given block.

But instead of expanding a private seed (which is usually the case for crypto APIs) and using the resulting scalars, it takes the scalars directly from Edx25519PrivateKey. We require this functionality in order to use derived private keys for signatures.

The resulting signature is a standard EdDSA signature which can be verified using the usual APIs.

Parameters

priv	the private key (containing two scalars .a and .b)
purp	the signature purpose
sig	the resulting signature

Calculate the public key P from the private scalar in the key.

Calculate r: r = SHA512 (b ∥ M) where M is our message (purpose).

Temporarily put P into S

Reduce the scalar value r

Calculate R := r * G of the signature

Calculate hram := SHA512 (R ∥ P ∥ M)

Reduce the resulting scalar value

Calculate S := r + hram * s mod L

Definition at line 103 of file crypto_edx25519.c.

{
 
  crypto_hash_sha512_state hs;
  unsigned char r[64];
  unsigned char hram[64];
  unsigned char P[32];
  unsigned char r_mod[64];
  unsigned char R[32];
  unsigned char tmp[32];
  unsigned char hram_mod[64];
 
  crypto_hash_sha512_init (&hs);
 
  crypto_scalarmult_ed25519_base_noclamp (P,
                                          priv->a);
 
  crypto_hash_sha512_update (&hs,
                             priv->b,
                             sizeof(priv->b));
  crypto_hash_sha512_update (&hs,
                             (uint8_t*) purpose,
                             ntohl (purpose->size));
  crypto_hash_sha512_final (&hs,
                            r);
 
  memcpy (sig->s, P, 32);
 
  crypto_core_ed25519_scalar_reduce (r_mod, r);
 
  crypto_scalarmult_ed25519_base_noclamp (R, r_mod);
  memcpy (sig->r, R, sizeof (R));
 
  crypto_hash_sha512_init (&hs);
  crypto_hash_sha512_update (&hs, (uint8_t*) sig, 64);
  crypto_hash_sha512_update (&hs, (uint8_t*) purpose,
                             ntohl (purpose->size));
  crypto_hash_sha512_final (&hs, hram);
 
  crypto_core_ed25519_scalar_reduce (hram_mod, hram);
 
  crypto_core_ed25519_scalar_mul (tmp, hram_mod, priv->a);
  crypto_core_ed25519_scalar_add (sig->s, tmp, r_mod);
 
  sodium_memzero (r, sizeof (r));
  sodium_memzero (r_mod, sizeof (r_mod));
 
  return GNUNET_OK;
}

References GNUNET_CRYPTO_Edx25519PrivateKey::a, GNUNET_CRYPTO_Edx25519PrivateKey::b, GNUNET_OK, GNUNET_CRYPTO_Edx25519Signature::r, GNUNET_CRYPTO_Edx25519Signature::s, and GNUNET_CRYPTO_EccSignaturePurpose::size.

GNUNET_CRYPTO_eddsa_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_EddsaSignature *	sig,
		const struct GNUNET_CRYPTO_EddsaPublicKey *	pub
	)

Verify EdDSA signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_eddsa_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 708 of file crypto_ecc.c.

{
  const unsigned char *m = (const void *) validate;
  size_t mlen = ntohl (validate->size);
  const unsigned char *s = (const void *) sig;
 
  int res;
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  BENCHMARK_START (eddsa_verify);
 
  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
  BENCHMARK_END (eddsa_verify);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

References BENCHMARK_END, BENCHMARK_START, GNUNET_OK, GNUNET_SYSERR, m, pub, GNUNET_CRYPTO_EccSignaturePurpose::purpose, GNUNET_CRYPTO_EddsaPublicKey::q_y, res, and GNUNET_CRYPTO_EccSignaturePurpose::size.

Referenced by block_plugin_dns_check_block(), block_plugin_regex_check_block(), GNUNET_CRYPTO_signature_verify_(), GNUNET_CRYPTO_signature_verify_raw_(), GNUNET_CRYPTO_verify_peer_identity(), GNUNET_GNSRECORD_block_verify(), handle_ephemeral_key(), keygen_round1_new_element(), keygen_round2_new_element(), and verify_message_crypto().

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_EcdsaSignature *	sig,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub
	)

Verify ECDSA signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_eddsa_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 649 of file crypto_ecc.c.

{
  gcry_sexp_t data;
  gcry_sexp_t sig_sexpr;
  gcry_sexp_t pub_sexpr;
  int rc;
 
  BENCHMARK_START (ecdsa_verify);
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  /* build s-expression for signature */
  if (0 != (rc = gcry_sexp_build (&sig_sexpr,
                                  NULL,
                                  "(sig-val(ecdsa(r %b)(s %b)))",
                                  (int) sizeof(sig->r),
                                  sig->r,
                                  (int) sizeof(sig->s),
                                  sig->s)))
  {
    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
    return GNUNET_SYSERR;
  }
  data = data_to_ecdsa_value (validate);
  if (0 != (rc = gcry_sexp_build (&pub_sexpr,
                                  NULL,
                                  "(public-key(ecc(curve " CURVE ")(q %b)))",
                                  (int) sizeof(pub->q_y),
                                  pub->q_y)))
  {
    gcry_sexp_release (data);
    gcry_sexp_release (sig_sexpr);
    return GNUNET_SYSERR;
  }
  rc = gcry_pk_verify (sig_sexpr, data, pub_sexpr);
  gcry_sexp_release (pub_sexpr);
  gcry_sexp_release (data);
  gcry_sexp_release (sig_sexpr);
  if (0 != rc)
  {
    LOG (GNUNET_ERROR_TYPE_INFO,
         _ ("ECDSA signature verification failed at %s:%d: %s\n"),
         __FILE__,
         __LINE__,
         gcry_strerror (rc));
    BENCHMARK_END (ecdsa_verify);
    return GNUNET_SYSERR;
  }
  BENCHMARK_END (ecdsa_verify);
  return GNUNET_OK;
}

References _, BENCHMARK_END, BENCHMARK_START, CURVE, data, data_to_ecdsa_value(), GNUNET_ERROR_TYPE_ERROR, GNUNET_ERROR_TYPE_INFO, GNUNET_OK, GNUNET_SYSERR, LOG, LOG_GCRY, pub, GNUNET_CRYPTO_EccSignaturePurpose::purpose, GNUNET_CRYPTO_EddsaPublicKey::q_y, GNUNET_CRYPTO_EcdsaSignature::r, and GNUNET_CRYPTO_EcdsaSignature::s.

Referenced by block_plugin_fs_check_block(), GNUNET_CRYPTO_signature_verify_(), GNUNET_CRYPTO_signature_verify_raw_(), and GNUNET_GNSRECORD_block_verify().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_verify_()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_edx25519_verify_	(	uint32_t	purpose,
		const struct GNUNET_CRYPTO_EccSignaturePurpose *	validate,
		const struct GNUNET_CRYPTO_Edx25519Signature *	sig,
		const struct GNUNET_CRYPTO_Edx25519PublicKey *	pub
	)

Verify Edx25519 signature.

The validate data is the beginning of the data of which the signature is to be verified. The size field in validate must correctly indicate the number of bytes of the data structure, including its header. If purpose does not match the purpose given in validate (the latter must be in big endian), signature verification fails. If possible, use GNUNET_CRYPTO_edx25519_verify() instead of this function (only if validate is not fixed-size, you must use this function directly).

Parameters

purpose	what is the purpose that the signature should have?
validate	block to validate (size, purpose, data)
sig	signature that is being validated
pub	public key of the signer

Returns

GNUNET_OK if ok, GNUNET_SYSERR if invalid

Definition at line 186 of file crypto_edx25519.c.

{
  const unsigned char *m = (const void *) validate;
  size_t mlen = ntohl (validate->size);
  const unsigned char *s = (const void *) sig;
 
  int res;
 
  if (purpose != ntohl (validate->purpose))
    return GNUNET_SYSERR; /* purpose mismatch */
 
  res = crypto_sign_verify_detached (s, m, mlen, pub->q_y);
  return (res == 0) ? GNUNET_OK : GNUNET_SYSERR;
}

References GNUNET_OK, GNUNET_SYSERR, m, pub, GNUNET_CRYPTO_EccSignaturePurpose::purpose, GNUNET_CRYPTO_EddsaPublicKey::q_y, res, and GNUNET_CRYPTO_EccSignaturePurpose::size.

GNUNET_CRYPTO_ecdsa_private_key_derive()

struct GNUNET_CRYPTO_EcdsaPrivateKey * GNUNET_CRYPTO_ecdsa_private_key_derive	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	priv,
		const char *	label,
		const char *	context
	)

Derive a private key from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'.

Parameters

priv	original private key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'; typically the name of the subsystem/application

Returns

derived private key

Definition at line 202 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
  struct GNUNET_CRYPTO_EcdsaPrivateKey *ret;
  struct GNUNET_HashCode hc;
  uint8_t dc[32];
  gcry_mpi_t h;
  gcry_mpi_t x;
  gcry_mpi_t d;
  gcry_mpi_t n;
  gcry_ctx_t ctx;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
 
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  GNUNET_CRYPTO_ecdsa_key_get_public (priv, &pub);
 
  derive_h (&pub, sizeof (pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
 
  /* Convert to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    dc[i] = priv->d[31 - i];
  GNUNET_CRYPTO_mpi_scan_unsigned (&x, dc, sizeof(dc));
  d = gcry_mpi_new (256);
  gcry_mpi_mulm (d, h, x, n);
  gcry_mpi_release (h);
  gcry_mpi_release (x);
  gcry_mpi_release (n);
  gcry_ctx_release (ctx);
  ret = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
  /* Convert to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    ret->d[i] = dc[31 - i];
  sodium_memzero (dc, sizeof(dc));
  gcry_mpi_release (d);
  return ret;
}

References context, ctx, CURVE, d, GNUNET_CRYPTO_EcdsaPrivateKey::d, dc, derive_h(), GNUNET_assert, GNUNET_CRYPTO_ecdsa_key_get_public(), GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), GNUNET_new, h, pub, and ret.

Referenced by GNUNET_CRYPTO_ecdsa_sign_derived(), GNUNET_FS_publish_ublock_(), and run_pkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdsa_public_key_derive()

void GNUNET_CRYPTO_ecdsa_public_key_derive	(	const struct GNUNET_CRYPTO_EcdsaPublicKey *	pub,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EcdsaPublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'. typically the name of the subsystem/application
result	where to write the derived public key

Definition at line 247 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_HashCode hc;
  gcry_ctx_t ctx;
  gcry_mpi_t q_y;
  gcry_mpi_t h;
  gcry_mpi_t n;
  gcry_mpi_t h_mod_n;
  gcry_mpi_point_t q;
  gcry_mpi_point_t v;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
 
  /* obtain point 'q' from original public key.  The provided 'q' is
     compressed thus we first store it in the context and then get it
     back as a (decompresssed) point.  */
  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
  GNUNET_assert (NULL != q_y);
  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
  gcry_mpi_release (q_y);
  q = gcry_mpi_ec_get_point ("q", ctx, 0);
  GNUNET_assert (q);
 
  /* calculate h_mod_n = h % n */
  derive_h (pub, sizeof (*pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  h_mod_n = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_n, h, n);
  /* calculate v = h_mod_n * q */
  v = gcry_mpi_point_new (0);
  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
  gcry_mpi_release (h_mod_n);
  gcry_mpi_release (h);
  gcry_mpi_release (n);
  gcry_mpi_point_release (q);
 
  /* convert point 'v' to public key that we return */
  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
  gcry_mpi_point_release (v);
  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
  GNUNET_assert (q_y);
  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
  gcry_mpi_release (q_y);
  gcry_ctx_release (ctx);
}

References context, ctx, CURVE, derive_h(), GNUNET_assert, GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, q, GNUNET_CRYPTO_EddsaPublicKey::q_y, and result.

Referenced by block_sign_ecdsa(), GNUNET_FS_search_start_searching_(), GNUNET_FS_unindex_do_remove_kblocks_(), GNUNET_GNSRECORD_query_from_public_key(), run_pkey(), and schedule_transmit_search_request().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_private_key_derive()

void GNUNET_CRYPTO_eddsa_private_key_derive	(	const struct GNUNET_CRYPTO_EddsaPrivateKey *	priv,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EddsaPrivateScalar *	result
	)

Derive a private scalar from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'. The result is the derived private scalar, not the private key as for EdDSA we cannot derive before we hash the private key.

Parameters

priv	original private key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'; typically the name of the subsystem/application
result	derived private scalar

Libsodium does not offer an API with arbitrary arithmetic. Hence we have to use libgcrypt here.

Get our modulo L

This is the standard private key expansion in Ed25519. The first 32 octets are used as a little-endian private scalar. We derive this scalar using our "h".

Get h mod L

dc now contains the private scalar "a". We calculate: d' := h * a mod L

We hash the derived "h" parameter with the other half of the expanded private key. This ensures that for signature generation, the "R" is derived from the same derivation path as "h" and is not reused.

Definition at line 300 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_CRYPTO_EddsaPublicKey pub;
  struct GNUNET_HashCode hc;
  uint8_t dc[32];
  unsigned char sk[64];
  gcry_mpi_t h;
  gcry_mpi_t h_mod_L;
  gcry_mpi_t a;
  gcry_mpi_t d;
  gcry_mpi_t L;
  gcry_ctx_t ctx;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
 
  L = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  GNUNET_CRYPTO_eddsa_key_get_public (priv, &pub);
 
  crypto_hash_sha512 (sk, priv->d, 32);
  sk[0] &= 248;
  sk[31] &= 127;
  sk[31] |= 64;
 
  derive_h (&pub, sizeof (pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
  h_mod_L = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_L, h, L);
  /* Convert scalar to big endian for libgcrypt */
  for (size_t i = 0; i < 32; i++)
    dc[i] = sk[31 - i];
 
  GNUNET_CRYPTO_mpi_scan_unsigned (&a, dc, sizeof(dc)); // a
  d = gcry_mpi_new (256);
  gcry_mpi_mulm (d, h_mod_L, a, L); // d := h * a mod L
  gcry_mpi_release (h);
  gcry_mpi_release (a);
  gcry_mpi_release (L);
  gcry_mpi_release (h_mod_L);
  gcry_ctx_release (ctx);
  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
  {
    crypto_hash_sha256_state hs;
    crypto_hash_sha256_init (&hs);
    crypto_hash_sha256_update (&hs, sk + 32, 32);
    crypto_hash_sha256_update (&hs, (unsigned char*) &hc, sizeof (hc));
    crypto_hash_sha256_final (&hs, result->s + 32);
  }
  /* Convert to little endian for libsodium */
  for (size_t i = 0; i < 32; i++)
    result->s[i] = dc[31 - i];
 
  sodium_memzero (dc, sizeof(dc));
  gcry_mpi_release (d);
}

References context, ctx, d, GNUNET_CRYPTO_EddsaPrivateKey::d, dc, derive_h(), GNUNET_assert, GNUNET_CRYPTO_eddsa_key_get_public(), GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, and result.

Referenced by GNUNET_CRYPTO_eddsa_sign_derived(), and run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_eddsa_public_key_derive()

void GNUNET_CRYPTO_eddsa_public_key_derive	(	const struct GNUNET_CRYPTO_EddsaPublicKey *	pub,
		const char *	label,
		const char *	context,
		struct GNUNET_CRYPTO_EddsaPublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
label	label to use for key deriviation
context	additional context to use for HKDF of 'h'. typically the name of the subsystem/application
result	where to write the derived public key

Definition at line 388 of file crypto_ecc_gnsrecord.c.

{
  struct GNUNET_HashCode hc;
  gcry_ctx_t ctx;
  gcry_mpi_t q_y;
  gcry_mpi_t h;
  gcry_mpi_t n;
  gcry_mpi_t h_mod_n;
  gcry_mpi_point_t q;
  gcry_mpi_point_t v;
 
  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
 
  /* obtain point 'q' from original public key.  The provided 'q' is
     compressed thus we first store it in the context and then get it
     back as a (decompresssed) point.  */
  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
  GNUNET_assert (NULL != q_y);
  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
  gcry_mpi_release (q_y);
  q = gcry_mpi_ec_get_point ("q", ctx, 0);
  GNUNET_assert (q);
 
  /* calculate h_mod_n = h % n */
  derive_h (pub, sizeof (*pub), label, context, &hc);
  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
 
  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
  h_mod_n = gcry_mpi_new (256);
  gcry_mpi_mod (h_mod_n, h, n);
 
  /* calculate v = h_mod_n * q */
  v = gcry_mpi_point_new (0);
  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
  gcry_mpi_release (h_mod_n);
  gcry_mpi_release (h);
  gcry_mpi_release (n);
  gcry_mpi_point_release (q);
 
  /* convert point 'v' to public key that we return */
  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
  gcry_mpi_point_release (v);
  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
  GNUNET_assert (q_y);
  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
  gcry_mpi_release (q_y);
  gcry_ctx_release (ctx);
 
}

References context, ctx, derive_h(), GNUNET_assert, GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), h, pub, q, GNUNET_CRYPTO_EddsaPublicKey::q_y, and result.

Referenced by block_sign_eddsa(), GNUNET_GNSRECORD_query_from_public_key(), and run_edkey().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_private_key_derive()

void GNUNET_CRYPTO_edx25519_private_key_derive	(	const struct GNUNET_CRYPTO_Edx25519PrivateKey *	priv,
		const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PrivateKey *	result
	)

Derive a private scalar from a given private key and a label.

Essentially calculates a private key 'h = H(l,P) * d mod n' where n is the size of the ECC group and P is the public key associated with the private key 'd'.

Parameters

priv	original private key
seed	input seed
seedsize	size of the seed
result	derived private key

dc now contains the private scalar "a". We carefully remove the clamping and derive a'. Calculate: a1 := a / 8 a2 := h * a1 mod n a' := a2 * 8 mod n

Definition at line 245 of file crypto_edx25519.c.

{
  struct GNUNET_CRYPTO_Edx25519PublicKey pub;
  struct GNUNET_HashCode hc;
  uint8_t a[32];
  uint8_t eight[32] = { 8 };
  uint8_t eight_inv[32];
  uint8_t h[64] = { 0 };
 
  GNUNET_CRYPTO_edx25519_key_get_public (priv, &pub);
 
  /* Get h mod n */
  derive_h (&pub,
            seed,
            seedsize,
            &hc);
 
  memcpy (h, &hc, 64);
  crypto_core_ed25519_scalar_reduce (h,
                                     h);
#ifdef CHECK_RARE_CASES
  {
    char zero[32] = { 0 };
    char one[32] = { 1 };
 
    GNUNET_assert (0 != memcmp (zero, h, 32));
    GNUNET_assert (0 != memcmp (one, h, 32));
  }
#endif
 
  GNUNET_assert (0 == crypto_core_ed25519_scalar_invert (eight_inv,
                                                         eight));
 
  crypto_core_ed25519_scalar_mul (a, priv->a, eight_inv);
  crypto_core_ed25519_scalar_mul (a, a, h);
  crypto_core_ed25519_scalar_mul (a, a, eight);
 
#ifdef CHECK_RARE_CASES
  /* The likelihood for a' == 0 or a' == 1 is neglegible */
  {
    char zero[32] = { 0 };
    char one[32] = { 1 };
 
    GNUNET_assert (0 != memcmp (zero, a, 32));
    GNUNET_assert (0 != memcmp (one, a, 32));
  }
#endif
 
  /* We hash the derived "h" parameter with the other half of the expanded
   * private key (that is: priv->b). This ensures that for signature
   * generation, the "R" is derived from the same derivation path as "h" and is
   * not reused. */
  {
    struct GNUNET_HashCode hcb;
    struct GNUNET_HashContext *hctx;
 
    hctx = GNUNET_CRYPTO_hash_context_start ();
    GNUNET_CRYPTO_hash_context_read (hctx, priv->b, sizeof(priv->b));
    GNUNET_CRYPTO_hash_context_read (hctx, (unsigned char*) &hc, sizeof (hc));
    GNUNET_CRYPTO_hash_context_finish (hctx, &hcb);
 
    /* Truncate result, effectively doing SHA512/256 */
    for (size_t i = 0; i < 32; i++)
      result->b[i] = ((unsigned char *) &hcb)[i];
  }
 
  for (size_t i = 0; i < 32; i++)
    result->a[i] = a[i];
 
  sodium_memzero (a, sizeof(a));
}

References GNUNET_CRYPTO_Edx25519PrivateKey::a, GNUNET_CRYPTO_Edx25519PrivateKey::b, derive_h(), GNUNET_assert, GNUNET_CRYPTO_edx25519_key_get_public(), GNUNET_CRYPTO_hash_context_finish(), GNUNET_CRYPTO_hash_context_read(), GNUNET_CRYPTO_hash_context_start(), h, pub, result, seed, and zero.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_edx25519_public_key_derive()

void GNUNET_CRYPTO_edx25519_public_key_derive	(	const struct GNUNET_CRYPTO_Edx25519PublicKey *	pub,
		const void *	seed,
		size_t	seedsize,
		struct GNUNET_CRYPTO_Edx25519PublicKey *	result
	)

Derive a public key from a given public key and a label.

Essentially calculates a public key 'V = H(l,P) * P'.

Parameters

pub	original public key
seed	input seed
seedsize	size of the seed
result	where to write the derived public key

Definition at line 339 of file crypto_edx25519.c.

{
  struct GNUNET_HashCode hc;
  uint8_t h[64] = { 0 };
 
  derive_h (pub,
            seed,
            seedsize,
            &hc);
  memcpy (h,
          &hc,
          64);
  crypto_core_ed25519_scalar_reduce (h,
                                     h);
  GNUNET_assert (0 == crypto_scalarmult_ed25519_noclamp (result->q_y,
                                                         h,
                                                         pub->q_y));
}

References derive_h(), GNUNET_assert, h, pub, GNUNET_CRYPTO_EddsaPublicKey::q_y, result, and seed.

Referenced by output_vectors().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_elligator_decoding()

void GNUNET_CRYPTO_ecdhe_elligator_decoding	(	struct GNUNET_CRYPTO_EcdhePublicKey *	point,
		bool *	high_y,
		const struct GNUNET_CRYPTO_ElligatorRepresentative *	representative
	)

Clears the most significant bit and second most significant bit of the serialized representaive before applying elligator direct map.

Parameters

representative	serialized elligator representative of an element of Curves25519's finite field
point	destination for the calculated point on the curve
high_y	bool pointed to will be set to 'true' if corresponding y-coordinate is > 2 ^ 254 - 10, otherwise 0. Can be set to NULL if not needed.

Definition at line 508 of file crypto_elligator.c.

{
  // if sign of direct map transformation not needed throw it away
  struct GNUNET_CRYPTO_ElligatorRepresentative r_tmp;
  bool high_y_local;
  bool *high_y_ptr;
  if (NULL == high_y)
    high_y_ptr = &high_y_local;
  else
    high_y_ptr = high_y;
 
  memcpy (&r_tmp.r, &representative->r, sizeof(r_tmp.r));
  r_tmp.r[31] &= 63;
  // GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,"Print high_y\n");
  elligator_direct_map ((uint8_t *) point->q_y,
                        high_y_ptr,
                        (uint8_t *) r_tmp.r);
}

References elligator_direct_map(), GNUNET_CRYPTO_EcdhePublicKey::q_y, and GNUNET_CRYPTO_ElligatorRepresentative::r.

Referenced by GNUNET_CRYPTO_hpke_elligator_kem_decaps().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_elligator_encoding()

bool GNUNET_CRYPTO_ecdhe_elligator_encoding	(	uint8_t	random_tweak,
		struct GNUNET_CRYPTO_ElligatorRepresentative *	r,
		const struct GNUNET_CRYPTO_EcdhePublicKey *	pub
	)

Encodes a point on Curve25519 to a an element of the underlying finite field.

This transformation is deterministic.

Parameters

random_tweak	random 8-bit value used as seed
r	storage for the calculated representative
pub	a point on the curve

Returns

'true' if the given point can be encoded into a representative. Otherwise 'false' is returned and the content of the representative storage is undefined

Definition at line 359 of file crypto_elligator.c.

{
  bool high_y;
  bool msb_set;
  bool smsb_set;
 
 
  uint8_t *representative = r->r;
  uint8_t *point = (uint8_t *) pub->q_y;
 
  mp_limb_t scratch_space[scratch_space_length];
 
  mp_limb_t a[P_LIMBS + P_LIMBS];
  mp_limb_t b[P_LIMBS + P_LIMBS];
  mp_limb_t c[P_LIMBS + P_LIMBS];
 
  high_y = random_tweak & 1;
 
  // a := point
 
  decode_bytes (a, point);
 
  // b := -a / (a + A), or b := p if a = 0
 
  mpn_add_n (b, a, A, P_LIMBS);
  mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
                scratch_space);
  mpn_sec_mul (b, c, P_LIMBS, a, P_LIMBS, scratch_space);
  mpn_sec_div_r (b, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
  mpn_sub_n (b, p, b, P_LIMBS);
 
  // If high_y = true, b := 1 / b or b := 0 if it was = p
 
  mpn_sec_powm (c, b, P_LIMBS, negative_2, P_BITS - 1, p, P_LIMBS,
                scratch_space);
  mpn_cnd_swap (high_y, b, c, P_LIMBS);
 
  // c := b / u
 
  mpn_sec_mul (c, b, P_LIMBS, inverted_u, P_LIMBS, scratch_space);
  mpn_sec_div_r (c, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
 
  // If c is a square modulo p, b := least_square_root(c)
 
  least_square_root (b, c, scratch_space);
 
  // Determine, whether b ^ 2 = c
 
  mpn_sec_sqr (a, b, P_LIMBS, scratch_space);
  mpn_sec_div_r (a, P_LIMBS + P_LIMBS, p, P_LIMBS, scratch_space);
  mpn_sub_n (a, a, c, P_LIMBS);
 
  {
    bool result = mpn_sec_sub_1 (a, a, P_LIMBS, 1, scratch_space);
 
    encode_bytes (representative, b);
 
    // Setting most significant bit and second most significant bit randomly
    msb_set = (random_tweak >> 1) & 1;
    smsb_set = (random_tweak >> 2) & 1;
    if (msb_set)
    {
      r->r[31] |= 128;
    }
    if (smsb_set)
    {
      r->r[31] |= 64;
    }
    return result;
  }
}

References A, decode_bytes(), encode_bytes(), inverted_u, least_square_root(), negative_2, p, P_BITS, P_LIMBS, pub, GNUNET_CRYPTO_EddsaPublicKey::q_y, GNUNET_CRYPTO_ElligatorRepresentative::r, result, and scratch_space_length.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand	(	uint8_t	random_tweak,
		const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *	sk,
		struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_CRYPTO_ElligatorRepresentative *	repr
	)

Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point.

Following Method 1 in description https://elligator.org/key-exchange section Step 2: Generate a “special” public key.

Parameters

random_tweak	random 8-bit value used as seed
sk	private key for generating valid public key
pub	valid public key for elligator inverse map
repr	storage for a calculated representative

Returns

GNUNET_OK on success

Definition at line 639 of file crypto_elligator.c.

{
  struct GNUNET_CRYPTO_EcdhePublicKey pub = {0};
  if (GNUNET_SYSERR ==
      elligator_generate_public_key (sk, &pub))
    return GNUNET_SYSERR;
 
  if (NULL == repr)
    return GNUNET_OK;
  if (! GNUNET_CRYPTO_ecdhe_elligator_encoding (random_tweak,
                                                repr,
                                                &pub))
    return GNUNET_SYSERR;
  memcpy (pk->q_y, pub.q_y, sizeof(pk->q_y));
  return GNUNET_OK;
}

References elligator_generate_public_key(), GNUNET_CRYPTO_ecdhe_elligator_encoding(), GNUNET_OK, GNUNET_SYSERR, pk, pub, and GNUNET_CRYPTO_EddsaPublicKey::q_y.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_key_get_public(), GNUNET_CRYPTO_hpke_elligator_kem_encaps_norand(), and main().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_elligator_key_get_public()

enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdhe_elligator_key_get_public	(	const struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *	sk,
		struct GNUNET_CRYPTO_EcdhePublicKey *	pub,
		struct GNUNET_CRYPTO_ElligatorRepresentative *	repr
	)

Generates a valid public key for elligator's inverse map by adding a lower order point to a prime order point.

Following Method 1 in description https://elligator.org/key-exchange section Step 2: Generate a “special” public key.

Parameters

sk	private key for generating valid public key
pub	valid public key for elligator inverse map
repr	storage for a calculated representative

Returns

GNUNET_OK on success

Definition at line 662 of file crypto_elligator.c.

{
  uint8_t random_tweak;
  GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                              &random_tweak,
                              sizeof(uint8_t));
 
  return GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand (random_tweak,
                                                              sk,
                                                              pk,
                                                              repr);
}

References GNUNET_CRYPTO_ecdhe_elligator_key_get_public_norand(), GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), and pk.

Referenced by GNUNET_CRYPTO_ecdhe_elligator_key_create(), and GNUNET_CRYPTO_hpke_elligator_authkem_encaps_norand().

Here is the call graph for this function:

Here is the caller graph for this function:

GNUNET_CRYPTO_ecdhe_elligator_key_create()

void GNUNET_CRYPTO_ecdhe_elligator_key_create

(

struct GNUNET_CRYPTO_ElligatorEcdhePrivateKey *

sk

)

Generates a private key for Curve25519.

Parameters

sk	Curve25519 private key

Definition at line 680 of file crypto_elligator.c.

{
  struct GNUNET_CRYPTO_ElligatorRepresentative repr;
  struct GNUNET_CRYPTO_EcdhePublicKey pk;
  // inverse map can fail for some public keys generated by GNUNET_CRYPTO_ecdhe_elligator_generate_public_key
  while (true)
  {
    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                                sk,
                                sizeof (struct
                                        GNUNET_CRYPTO_ElligatorEcdhePrivateKey))
    ;
    if (GNUNET_OK == GNUNET_CRYPTO_ecdhe_elligator_key_get_public (sk, &pk,
                                                                   &repr))
      break;
  }
 
}

References GNUNET_CRYPTO_ecdhe_elligator_key_get_public(), GNUNET_CRYPTO_QUALITY_NONCE, GNUNET_CRYPTO_random_block(), GNUNET_OK, and pk.

Referenced by GNUNET_CRYPTO_hpke_elligator_authkem_encaps(), and GNUNET_CRYPTO_hpke_elligator_kem_encaps().

Here is the call graph for this function:

Here is the caller graph for this function: