ecc: Implement Curve Ed25519 signing and verification.

* cipher/ecc-curves.c (domain_parms): Add curve "Ed25519".
* cipher/ecc.c (reverse_buffer): New.
(eddsa_encodempi): New.
(eddsa_encodepoint): New.
(eddsa_decodepoint): New.
(sign_eddsa): Implement.
(verify_eddsa): Implement.
(ecc_sign): Init unused Q.  Pass public key to sign_eddsa.
(ecc_verify): Init pk.Q if not used.  Pass public key verbatim to
verify_eddsa.
* cipher/pubkey.c (sexp_elements_extract): Add arg OPAQUE.  Change all
callers to pass 0.
(sexp_to_sig): Add arg OPAQUE and pass it to sexp_elements_extract.
(sexp_data_to_mpi): Allow for a zero length "value".
(gcry_pk_verify): Reorder parameter processing.  Pass OPAQUE flag as
required.
* mpi/ec.c (ec_invm): Print a warning if the inverse does not exist.
(_gcry_mpi_ec_get_affine): Implement for our Twisted Edwards curve
model.
(dup_point_twistededwards): Implement.
(add_points_twistededwards): Implement.
(_gcry_mpi_ec_mul_point): Support Twisted Edwards.

* mpi/mpicoder.c (do_get_buffer): Add arg FILL_LE.
(_gcry_mpi_get_buffer): Ditto.  Change all callers.
(_gcry_mpi_get_secure_buffer): Ditto.

* src/sexp.c (_gcry_sexp_nth_opaque_mpi): New.

* tests/t-ed25519.c: New.
* tests/t-ed25519.inp: New.
* tests/t-mpi-point.c (basic_ec_math_simplified): Print some output
only in debug mode.
(twistededwards_math): New test.
(main): Call new test.
--

This is a non optimized version which takes far too long.  On my X220
Thinkpad the 1024 test cases take 14 seconds (12 with --sign-with-pk).
There should be a lot of room for improvements.

Signed-off-by: Werner Koch <wk@gnupg.org>

4 files changed, 31 insertions, 3 deletions

diff --git a/src/g10lib.h b/src/g10lib.h
index f8953e7b..57176e9f 100644
--- a/src/g10lib.h
+++ b/src/g10lib.h
@@ -407,6 +407,7 @@ gcry_err_code_t _gcry_mpi_init (void);
 /*-- sexp.c --*/
 gcry_error_t _gcry_sexp_vbuild (gcry_sexp_t *retsexp, size_t *erroff,
                                 const char *format, va_list arg_ptr);
+gcry_mpi_t _gcry_sexp_nth_opaque_mpi (gcry_sexp_t list, int number);
 char *_gcry_sexp_nth_string (const gcry_sexp_t list, int number);
 
 
diff --git a/src/misc.c b/src/misc.c
index 6f03eb5a..a19e1e48 100644
--- a/src/misc.c
+++ b/src/misc.c
@@ -347,7 +347,7 @@ _gcry_log_printmpi (const char *text, gcry_mpi_t mpi)
     }
   else
     {
-      rawmpi = _gcry_mpi_get_buffer (mpi, &rawmpilen, &sign);
+      rawmpi = _gcry_mpi_get_buffer (mpi, 0, &rawmpilen, &sign);
       if (!rawmpi)
         do_printhex (text? text:" ", " [out of core]", NULL, 0);
       else
diff --git a/src/mpi.h b/src/mpi.h
index bf731a3b..bd931681 100644
--- a/src/mpi.h
+++ b/src/mpi.h
@@ -159,8 +159,10 @@ gcry_mpi_t _gcry_mpi_const (enum gcry_mpi_constants no);
 /*-- mpicoder.c --*/
 void  _gcry_log_mpidump( const char *text, gcry_mpi_t a );
 u32   _gcry_mpi_get_keyid( gcry_mpi_t a, u32 *keyid );
-byte *_gcry_mpi_get_buffer( gcry_mpi_t a, unsigned *nbytes, int *sign );
-byte *_gcry_mpi_get_secure_buffer( gcry_mpi_t a, unsigned *nbytes, int *sign );
+byte *_gcry_mpi_get_buffer (gcry_mpi_t a, unsigned int fill_le,
+                            unsigned int *r_nbytes, int *sign);
+byte *_gcry_mpi_get_secure_buffer (gcry_mpi_t a, unsigned int fill_le,
+                                   unsigned *r_nbytes, int *sign);
 void  _gcry_mpi_set_buffer ( gcry_mpi_t a, const void *buffer,
                              unsigned int nbytes, int sign );
 
@@ -274,6 +276,7 @@ void _gcry_mpi_get_point (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
 void _gcry_mpi_snatch_point (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
                              mpi_point_t point);
 
+
 /* Models describing an elliptic curve.  */
 enum gcry_mpi_ec_models
   {
diff --git a/src/sexp.c b/src/sexp.c
index 0e96f0b0..d8812c7e 100644
--- a/src/sexp.c
+++ b/src/sexp.c
@@ -783,6 +783,30 @@ gcry_sexp_nth_mpi (gcry_sexp_t list, int number, int mpifmt)
 }
 
 
+/*
+ * Get data from the car and store return it as an opaque MPI.
+ */
+gcry_mpi_t
+_gcry_sexp_nth_opaque_mpi (gcry_sexp_t list, int number)
+{
+  char *p;
+  size_t n;
+  gcry_mpi_t a;
+
+  p = gcry_sexp_nth_buffer (list, number, &n);
+  if (!p)
+    return NULL;
+
+  a = gcry_is_secure (list)? _gcry_mpi_snew (0) : _gcry_mpi_new (0);
+  if (a)
+    gcry_mpi_set_opaque (a, p, n*8);
+  else
+    gcry_free (p);
+
+  return a;
+}
+
+
 /****************
  * Get the CDR
  */