GNUnet  0.17.6
crypto_ecc_gnsrecord.c
Go to the documentation of this file.
1 /*
2  This file is part of GNUnet.
3  Copyright (C) 2012, 2013, 2015 GNUnet e.V.
4 
5  GNUnet is free software: you can redistribute it and/or modify it
6  under the terms of the GNU Affero General Public License as published
7  by the Free Software Foundation, either version 3 of the License,
8  or (at your option) any later version.
9 
10  GNUnet is distributed in the hope that it will be useful, but
11  WITHOUT ANY WARRANTY; without even the implied warranty of
12  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13  Affero General Public License for more details.
14 
15  You should have received a copy of the GNU Affero General Public License
16  along with this program. If not, see <http://www.gnu.org/licenses/>.
17 
18  SPDX-License-Identifier: AGPL3.0-or-later
19  */
20 
28 #include "platform.h"
29 #include <gcrypt.h>
30 #include <sodium.h>
31 #include "gnunet_crypto_lib.h"
32 #include "gnunet_strings_lib.h"
33 
34 #define CURVE "Ed25519"
35 
47 void
48 derive_h (const void *pub,
49  size_t pubsize,
50  const char *label,
51  const char *context,
52  struct GNUNET_HashCode *hc)
53 {
54  static const char *const salt = "key-derivation";
55 
57  sizeof(*hc),
58  salt,
59  strlen (salt),
60  pub,
61  pubsize,
62  label,
63  strlen (label),
64  context,
65  strlen (context),
66  NULL,
67  0);
68 }
69 
70 
73  const struct GNUNET_CRYPTO_EddsaPrivateKey *pkey,
74  const char *label,
75  const char *context,
76  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
77  struct GNUNET_CRYPTO_EddsaSignature *sig)
78 {
80  crypto_hash_sha512_state hs;
81  unsigned char sk[64];
82  unsigned char r[64];
83  unsigned char hram[64];
84  unsigned char R[32];
85  unsigned char zk[32];
86  unsigned char tmp[32];
87 
92  label,
93  context,
94  &priv);
95 
96  crypto_hash_sha512_init (&hs);
97 
106  memcpy (sk, priv.s, 64);
107 
112  crypto_scalarmult_ed25519_base_noclamp (zk,
113  sk);
114 
123  crypto_hash_sha512_update (&hs, sk + 32, 32);
124  crypto_hash_sha512_update (&hs, (uint8_t*) purpose, ntohl (purpose->size));
125  crypto_hash_sha512_final (&hs, r);
126 
130  memcpy (sig->s, zk, 32);
131 
135  unsigned char r_mod[64];
136  crypto_core_ed25519_scalar_reduce (r_mod, r);
137 
141  crypto_scalarmult_ed25519_base_noclamp (R, r_mod);
142  memcpy (sig->r, R, sizeof (R));
143 
148  crypto_hash_sha512_init (&hs);
149  crypto_hash_sha512_update (&hs, (uint8_t*) sig, 64);
150  crypto_hash_sha512_update (&hs, (uint8_t*) purpose,
151  ntohl (purpose->size));
152  crypto_hash_sha512_final (&hs, hram);
153 
157  unsigned char hram_mod[64];
158  crypto_core_ed25519_scalar_reduce (hram_mod, hram);
159 
164  crypto_core_ed25519_scalar_mul (tmp, hram_mod, sk);
165  crypto_core_ed25519_scalar_add (sig->s, tmp, r_mod);
166 
167  sodium_memzero (sk, sizeof (sk));
168  sodium_memzero (r, sizeof (r));
169  sodium_memzero (r_mod, sizeof (r_mod));
170  return GNUNET_OK;
171 }
172 
175  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
176  const char *label,
177  const char *context,
178  const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose,
179  struct GNUNET_CRYPTO_EcdsaSignature *sig)
180 {
184  label,
185  context);
187  purpose,
188  sig);
189  GNUNET_free (key);
190  return res;
191 }
192 
195  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
196  const char *label,
197  const char *context)
198 {
201  struct GNUNET_HashCode hc;
202  uint8_t dc[32];
203  gcry_mpi_t h;
204  gcry_mpi_t x;
205  gcry_mpi_t d;
206  gcry_mpi_t n;
207  gcry_ctx_t ctx;
208 
209  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
210 
211  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
213 
214  derive_h (&pub, sizeof (pub), label, context, &hc);
215  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
216 
217  /* Convert to big endian for libgcrypt */
218  for (size_t i = 0; i < 32; i++)
219  dc[i] = priv->d[31 - i];
220  GNUNET_CRYPTO_mpi_scan_unsigned (&x, dc, sizeof(dc));
221  d = gcry_mpi_new (256);
222  gcry_mpi_mulm (d, h, x, n);
223  gcry_mpi_release (h);
224  gcry_mpi_release (x);
225  gcry_mpi_release (n);
226  gcry_ctx_release (ctx);
228  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
229  /* Convert to big endian for libgcrypt */
230  for (size_t i = 0; i < 32; i++)
231  ret->d[i] = dc[31 - i];
232  sodium_memzero (dc, sizeof(dc));
233  gcry_mpi_release (d);
234  return ret;
235 }
236 
237 
238 void
240  const struct GNUNET_CRYPTO_EcdsaPublicKey *pub,
241  const char *label,
242  const char *context,
244 {
245  struct GNUNET_HashCode hc;
246  gcry_ctx_t ctx;
247  gcry_mpi_t q_y;
248  gcry_mpi_t h;
249  gcry_mpi_t n;
250  gcry_mpi_t h_mod_n;
251  gcry_mpi_point_t q;
252  gcry_mpi_point_t v;
253 
254  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, CURVE));
255 
256  /* obtain point 'q' from original public key. The provided 'q' is
257  compressed thus we first store it in the context and then get it
258  back as a (decompresssed) point. */
259  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
260  GNUNET_assert (NULL != q_y);
261  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
262  gcry_mpi_release (q_y);
263  q = gcry_mpi_ec_get_point ("q", ctx, 0);
264  GNUNET_assert (q);
265 
266  /* calculate h_mod_n = h % n */
267  derive_h (pub, sizeof (*pub), label, context, &hc);
268  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
269  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
270  h_mod_n = gcry_mpi_new (256);
271  gcry_mpi_mod (h_mod_n, h, n);
272  /* calculate v = h_mod_n * q */
273  v = gcry_mpi_point_new (0);
274  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
275  gcry_mpi_release (h_mod_n);
276  gcry_mpi_release (h);
277  gcry_mpi_release (n);
278  gcry_mpi_point_release (q);
279 
280  /* convert point 'v' to public key that we return */
281  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
282  gcry_mpi_point_release (v);
283  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
284  GNUNET_assert (q_y);
285  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
286  gcry_mpi_release (q_y);
287  gcry_ctx_release (ctx);
288 }
289 
290 
291 void
293  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
294  const char *label,
295  const char *context,
297 {
299  struct GNUNET_HashCode hc;
300  uint8_t dc[32];
301  unsigned char sk[64];
302  gcry_mpi_t h;
303  gcry_mpi_t h_mod_n;
304  gcry_mpi_t x;
305  gcry_mpi_t d;
306  gcry_mpi_t n;
307  gcry_mpi_t a1;
308  gcry_mpi_t a2;
309  gcry_ctx_t ctx;
310 
315  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
316 
320  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
322 
329  crypto_hash_sha512 (sk, priv->d, 32);
330  sk[0] &= 248;
331  sk[31] &= 127;
332  sk[31] |= 64;
333 
337  derive_h (&pub, sizeof (pub), label, context, &hc);
338  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
339  h_mod_n = gcry_mpi_new (256);
340  gcry_mpi_mod (h_mod_n, h, n);
341  /* Convert scalar to big endian for libgcrypt */
342  for (size_t i = 0; i < 32; i++)
343  dc[i] = sk[31 - i];
344 
353  GNUNET_CRYPTO_mpi_scan_unsigned (&x, dc, sizeof(dc)); // a
354  a1 = gcry_mpi_new (256);
355  gcry_mpi_t eight = gcry_mpi_set_ui (NULL, 8);
356  gcry_mpi_div (a1, NULL, x, eight, 0); // a1 := a / 8
357  a2 = gcry_mpi_new (256);
358  gcry_mpi_mulm (a2, h_mod_n, a1, n); // a2 := h * a1 mod n
359  d = gcry_mpi_new (256);
360  gcry_mpi_mul (d, a2, eight); // a' := a2 * 8
361  gcry_mpi_release (h);
362  gcry_mpi_release (x);
363  gcry_mpi_release (n);
364  gcry_mpi_release (a1);
365  gcry_mpi_release (a2);
366  gcry_ctx_release (ctx);
367  GNUNET_CRYPTO_mpi_print_unsigned (dc, sizeof(dc), d);
374  crypto_hash_sha256_state hs;
375  crypto_hash_sha256_init (&hs);
376  crypto_hash_sha256_update (&hs, sk + 32, 32);
377  crypto_hash_sha256_update (&hs, (unsigned char*) &hc, sizeof (hc));
378  crypto_hash_sha256_final (&hs, result->s + 32);
379  //memcpy (result->s, sk, sizeof (sk));
380  /* Convert to little endian for libsodium */
381  for (size_t i = 0; i < 32; i++)
382  result->s[i] = dc[31 - i];
383 
384  sodium_memzero (dc, sizeof(dc));
385  gcry_mpi_release (d);
386 }
387 
388 
389 void
391  const struct GNUNET_CRYPTO_EddsaPublicKey *pub,
392  const char *label,
393  const char *context,
395 {
396  struct GNUNET_HashCode hc;
397  gcry_ctx_t ctx;
398  gcry_mpi_t q_y;
399  gcry_mpi_t h;
400  gcry_mpi_t n;
401  gcry_mpi_t h_mod_n;
402  gcry_mpi_point_t q;
403  gcry_mpi_point_t v;
404 
405  GNUNET_assert (0 == gcry_mpi_ec_new (&ctx, NULL, "Ed25519"));
406 
407  /* obtain point 'q' from original public key. The provided 'q' is
408  compressed thus we first store it in the context and then get it
409  back as a (decompresssed) point. */
410  q_y = gcry_mpi_set_opaque_copy (NULL, pub->q_y, 8 * sizeof(pub->q_y));
411  GNUNET_assert (NULL != q_y);
412  GNUNET_assert (0 == gcry_mpi_ec_set_mpi ("q", q_y, ctx));
413  gcry_mpi_release (q_y);
414  q = gcry_mpi_ec_get_point ("q", ctx, 0);
415  GNUNET_assert (q);
416 
417  /* calculate h_mod_n = h % n */
418  derive_h (pub, sizeof (*pub), label, context, &hc);
419  GNUNET_CRYPTO_mpi_scan_unsigned (&h, (unsigned char *) &hc, sizeof(hc));
420 
421  n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
422  h_mod_n = gcry_mpi_new (256);
423  gcry_mpi_mod (h_mod_n, h, n);
424 
425  /* calculate v = h_mod_n * q */
426  v = gcry_mpi_point_new (0);
427  gcry_mpi_ec_mul (v, h_mod_n, q, ctx);
428  gcry_mpi_release (h_mod_n);
429  gcry_mpi_release (h);
430  gcry_mpi_release (n);
431  gcry_mpi_point_release (q);
432 
433  /* convert point 'v' to public key that we return */
434  GNUNET_assert (0 == gcry_mpi_ec_set_point ("q", v, ctx));
435  gcry_mpi_point_release (v);
436  q_y = gcry_mpi_ec_get_mpi ("q@eddsa", ctx, 0);
437  GNUNET_assert (q_y);
438  GNUNET_CRYPTO_mpi_print_unsigned (result->q_y, sizeof(result->q_y), q_y);
439  gcry_mpi_release (q_y);
440  gcry_ctx_release (ctx);
441 
442 }
443 
444 
445 void
447  const struct GNUNET_CRYPTO_EddsaPrivateScalar *priv,
449 {
450  unsigned char sk[32];
451 
452  memcpy (sk, priv->s, 32);
453 
458  crypto_scalarmult_ed25519_base_noclamp (pkey->q_y,
459  sk);
460 }
#define CURVE
void derive_h(const void *pub, size_t pubsize, const char *label, const char *context, struct GNUNET_HashCode *hc)
Derive the 'h' value for key derivation, where 'h = H(l,P)'.
static int ret
Return value of the commandline.
Definition: gnunet-abd.c:81
static struct GNUNET_ARM_Handle * h
Connection with ARM.
Definition: gnunet-arm.c:99
static int res
struct GNUNET_HashCode key
The key used in the DHT.
static struct GNUNET_FS_DownloadContext * dc
static pa_context * context
Pulseaudio context.
static char * pkey
Public key of the zone to look in, in ASCII.
static int result
Global testing status.
static struct GNUNET_REVOCATION_Query * q
Handle for revocation query.
static struct GNUNET_CRYPTO_EddsaPublicKey pub
Definition: gnunet-scrypt.c:46
static struct GNUNET_CRYPTO_PowSalt salt
Salt for PoW calcualations.
static struct GNUNET_DNSSTUB_Context * ctx
Context for DNS resolution.
cryptographic primitives for GNUnet
Strings and string handling functions.
void GNUNET_CRYPTO_ecdsa_public_key_derive(const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EcdsaPublicKey *result)
Derive a public key from a given public key and a label.
void GNUNET_CRYPTO_eddsa_private_key_derive(const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPrivateScalar *result)
Derive a private scalar from a given private key and a label.
void GNUNET_CRYPTO_eddsa_key_get_public(const struct GNUNET_CRYPTO_EddsaPrivateKey *priv, struct GNUNET_CRYPTO_EddsaPublicKey *pub)
Extract the public key for the given private key.
Definition: crypto_ecc.c:197
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_sign_(const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EcdsaSignature *sig)
ECDSA Sign a given block.
Definition: crypto_ecc.c:549
void GNUNET_CRYPTO_eddsa_public_key_derive(const struct GNUNET_CRYPTO_EddsaPublicKey *pub, const char *label, const char *context, struct GNUNET_CRYPTO_EddsaPublicKey *result)
Derive a public key from a given public key and a label.
void GNUNET_CRYPTO_ecdsa_key_get_public(const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
Extract the public key for the given private key.
Definition: crypto_ecc.c:186
struct GNUNET_CRYPTO_EcdsaPrivateKey * GNUNET_CRYPTO_ecdsa_private_key_derive(const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const char *label, const char *context)
Derive a private key from a given private key and a label.
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_kdf(void *result, size_t out_len, const void *xts, size_t xts_len, const void *skm, size_t skm_len,...)
Derive key.
Definition: crypto_kdf.c:69
void GNUNET_CRYPTO_mpi_scan_unsigned(gcry_mpi_t *result, const void *data, size_t size)
Convert data buffer into MPI value.
Definition: crypto_mpi.c:131
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_eddsa_sign_derived(const struct GNUNET_CRYPTO_EddsaPrivateKey *pkey, const char *label, const char *context, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EddsaSignature *sig)
This is a signature function for EdDSA which takes a private key and derives it using the label and c...
enum GNUNET_GenericReturnValue GNUNET_CRYPTO_ecdsa_sign_derived(const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv, const char *label, const char *context, const struct GNUNET_CRYPTO_EccSignaturePurpose *purpose, struct GNUNET_CRYPTO_EcdsaSignature *sig)
This is a signature function for ECDSA which takes a private key, derives/blinds it and signs the mes...
void GNUNET_CRYPTO_mpi_print_unsigned(void *buf, size_t size, gcry_mpi_t val)
Output the given MPI value to the given buffer in network byte order.
Definition: crypto_mpi.c:78
void GNUNET_CRYPTO_eddsa_key_get_public_from_scalar(const struct GNUNET_CRYPTO_EddsaPrivateScalar *priv, struct GNUNET_CRYPTO_EddsaPublicKey *pkey)
Extract the public key of the given private scalar.
GNUNET_GenericReturnValue
Named constants for return values.
Definition: gnunet_common.h:96
@ GNUNET_OK
Definition: gnunet_common.h:99
#define GNUNET_assert(cond)
Use this for fatal errors that cannot be handled.
#define GNUNET_new(type)
Allocate a struct or union of the given type.
#define GNUNET_free(ptr)
Wrapper around free.
header of what an ECC signature signs this must be followed by "size - 8" bytes of the actual signed ...
Private ECC key encoded for transmission.
unsigned char d[256/8]
d is a value mod n, where n has at most 256 bits.
Public ECC key (always for Curve25519) encoded in a format suitable for network transmission and ECDS...
an ECC signature using ECDSA
Private ECC key encoded for transmission.
unsigned char d[256/8]
d is a value mod n, where n has at most 256 bits.
Private ECC scalar encoded for transmission.
unsigned char s[512/8]
s is the expandedprivate 512-bit scalar of a private key.
Public ECC key (always for curve Ed25519) encoded in a format suitable for network transmission and E...
unsigned char q_y[256/8]
Point Q consists of a y-value mod p (256 bits); the x-value is always positive.
an ECC signature using EdDSA.
unsigned char s[256/8]
S value.
unsigned char r[256/8]
R value.
A 512-bit hashcode.