1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
/*
* Copyright (c) 2022, stelar7 <dudedbz@gmail.com>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/ByteReader.h>
#include <AK/Endian.h>
#include <AK/Random.h>
#include <LibCrypto/Curves/Curve25519.h>
#include <LibCrypto/Curves/X25519.h>
namespace Crypto::Curves {
static constexpr u8 BITS = 255;
static constexpr u8 BYTES = 32;
static constexpr u8 WORDS = 8;
static constexpr u32 A24 = 121666;
static void conditional_swap(u32* first, u32* second, u32 condition)
{
u32 mask = ~condition + 1;
for (auto i = 0; i < WORDS; i++) {
u32 temp = mask & (first[i] ^ second[i]);
first[i] ^= temp;
second[i] ^= temp;
}
}
ErrorOr<ByteBuffer> X25519::generate_private_key()
{
auto buffer = TRY(ByteBuffer::create_uninitialized(BYTES));
fill_with_random(buffer);
return buffer;
}
ErrorOr<ByteBuffer> X25519::generate_public_key(ReadonlyBytes a)
{
u8 generator[BYTES] { 9 };
return compute_coordinate(a, { generator, BYTES });
}
// https://datatracker.ietf.org/doc/html/rfc7748#section-5
ErrorOr<ByteBuffer> X25519::compute_coordinate(ReadonlyBytes input_k, ReadonlyBytes input_u)
{
u32 k[WORDS] {};
u32 u[WORDS] {};
u32 x1[WORDS] {};
u32 x2[WORDS] {};
u32 z1[WORDS] {};
u32 z2[WORDS] {};
u32 t1[WORDS] {};
u32 t2[WORDS] {};
// Copy input to internal state
Curve25519::import_state(k, input_k.data());
// Set the three least significant bits of the first byte and the most significant bit of the last to zero,
// set the second most significant bit of the last byte to 1
k[0] &= 0xFFFFFFF8;
k[7] &= 0x7FFFFFFF;
k[7] |= 0x40000000;
// Copy coordinate to internal state
Curve25519::import_state(u, input_u.data());
// mask the most significant bit in the final byte.
u[7] &= 0x7FFFFFFF;
// Implementations MUST accept non-canonical values and process them as
// if they had been reduced modulo the field prime.
Curve25519::modular_reduce(u, u);
Curve25519::set(x1, 1);
Curve25519::set(z1, 0);
Curve25519::copy(x2, u);
Curve25519::set(z2, 1);
// Montgomery ladder
u32 swap = 0;
for (auto i = BITS - 1; i >= 0; i--) {
u32 b = (k[i / BYTES] >> (i % BYTES)) & 1;
conditional_swap(x1, x2, swap ^ b);
conditional_swap(z1, z2, swap ^ b);
swap = b;
Curve25519::modular_add(t1, x2, z2);
Curve25519::modular_subtract(x2, x2, z2);
Curve25519::modular_add(z2, x1, z1);
Curve25519::modular_subtract(x1, x1, z1);
Curve25519::modular_multiply(t1, t1, x1);
Curve25519::modular_multiply(x2, x2, z2);
Curve25519::modular_square(z2, z2);
Curve25519::modular_square(x1, x1);
Curve25519::modular_subtract(t2, z2, x1);
Curve25519::modular_multiply_single(z1, t2, A24);
Curve25519::modular_add(z1, z1, x1);
Curve25519::modular_multiply(z1, z1, t2);
Curve25519::modular_multiply(x1, x1, z2);
Curve25519::modular_subtract(z2, t1, x2);
Curve25519::modular_square(z2, z2);
Curve25519::modular_multiply(z2, z2, u);
Curve25519::modular_add(x2, x2, t1);
Curve25519::modular_square(x2, x2);
}
conditional_swap(x1, x2, swap);
conditional_swap(z1, z2, swap);
// Retrieve affine representation
Curve25519::modular_multiply_inverse(u, z1);
Curve25519::modular_multiply(u, u, x1);
// Encode state for export
auto buffer = TRY(ByteBuffer::create_uninitialized(BYTES));
Curve25519::export_state(u, buffer.data());
return buffer;
}
ErrorOr<ByteBuffer> X25519::derive_premaster_key(ReadonlyBytes shared_point)
{
VERIFY(shared_point.size() == BYTES);
ByteBuffer premaster_key = TRY(ByteBuffer::copy(shared_point));
return premaster_key;
}
}
|
