summaryrefslogtreecommitdiff
path: root/cipher/ecc-curves.c
AgeCommit message (Collapse)AuthorFilesLines
2016-03-18ecc: ECDSA adjustments for FIPS 186-4Vitezslav Cizek1-1/+1
* cipher/ecc-curves.c: Unmark curve P-192 for FIPS. * cipher/ecc.c: Add ECDSA self test. * cipher/pubkey-util.c (_gcry_pk_util_init_encoding_ctx): Use SHA-2 in FIPS mode. * tests/fipsdrv.c: Add support for ECDSA signatures. -- Enable ECC in FIPS mode. According to NIST SP 800-131A, curve P-192 and SHA-1 are disallowed for key pair generation and signature generation after 2013. Thanks to Jan Matejek for the patch. Signed-off-by: Vitezslav Cizek <vcizek@suse.com> Minor source code re-formatting by -wk.
2015-08-10ecc: fix Montgomery curve bugs.NIIBE Yutaka1-1/+1
* cipher/ecc.c (check_secret_key): Y1 should not be NULL when check. (ecc_check_secret_key): Support Montgomery curve. * mpi/ec.c (_gcry_mpi_ec_curve_point): Fix condition.
2015-08-06Add Curve25519 support.NIIBE Yutaka1-2/+15
* cipher/ecc-curves.c (curve_aliases, domain_parms): Add Curve25519. * tests/curves.c (N_CURVES): It's 22 now. * src/cipher.h (PUBKEY_FLAG_DJB_TWEAK): New. * cipher/ecc-common.h (_gcry_ecc_mont_decodepoint): New. * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): New. * cipher/ecc.c (nist_generate_key): Handle the case of PUBKEY_FLAG_DJB_TWEAK and Montgomery curve. (test_ecdh_only_keys, check_secret_key): Likewise. (ecc_generate): Support Curve25519 which is Montgomery curve with flag PUBKEY_FLAG_DJB_TWEAK and PUBKEY_FLAG_COMP. (ecc_encrypt_raw): Get flags from KEYPARMS and handle PUBKEY_FLAG_DJB_TWEAK and Montgomery curve. (ecc_decrypt_raw): Likewise. (compute_keygrip): Handle the case of PUBKEY_FLAG_DJB_TWEAK. * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): PUBKEY_FLAG_EDDSA implies PUBKEY_FLAG_DJB_TWEAK. Parse "djb-tweak" for PUBKEY_FLAG_DJB_TWEAK. -- With PUBKEY_FLAG_DJB_TWEAK, secret key has msb set and it should be always multiple by cofactor.
2014-11-19ecc: Improve Montgomery curve implementation.NIIBE Yutaka1-2/+1
* cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Support MPI_EC_MONTGOMERY. * cipher/ecc.c (test_ecdh_only_keys): New. (nist_generate_key): Call test_ecdh_only_keys for MPI_EC_MONTGOMERY. (check_secret_key): Handle Montgomery curve of x-coordinate only. * mpi/ec.c (_gcry_mpi_ec_mul_point): Resize points before the loop. Simplify, using pointers of Q1, Q2, PRD, and SUM. --
2014-08-08ecc: Add cofactor to domain parameters.NIIBE Yutaka1-35/+94
* src/ec-context.h (mpi_ec_ctx_s): Add cofactor 'h'. * cipher/ecc-common.h (elliptic_curve_t): Add cofactor 'h'. (_gcry_ecc_update_curve_param): New API adding cofactor. * cipher/ecc-curves.c (ecc_domain_parms_t): Add cofactor 'h'. (ecc_domain_parms_t domain_parms): Add cofactors. (_gcry_ecc_fill_in_curve, _gcry_ecc_update_curve_param) (_gcry_ecc_get_curve, _gcry_mpi_ec_new, _gcry_ecc_get_param_sexp) (_gcry_ecc_get_mpi): Handle cofactor. * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Likewise. * cipher/ecc-misc.c (_gcry_ecc_curve_free) (_gcry_ecc_curve_copy): Likewise. * cipher/ecc.c (nist_generate_key, ecc_generate) (ecc_check_secret_key, ecc_sign, ecc_verify, ecc_encrypt_raw) (ecc_decrypt_raw, _gcry_pk_ecc_get_sexp, _gcry_pubkey_spec_ecc): Likewise. (compute_keygrip): Handle cofactor, but skip it for its computation. * mpi/ec.c (ec_deinit): Likewise. * tests/t-mpi-point.c (context_param): Likewise. (test_curve): Add cofactors. * tests/curves.c (sample_key_1, sample_key_2): Add cofactors. * tests/keygrip.c (key_grips): Add cofactors. -- We keep compatibility of compute_keygrip in cipher/ecc.c.
2014-07-25ecc: Support the non-standard 0x40 compression flag for EdDSA.Werner Koch1-1/+1
* cipher/ecc.c (ecc_generate): Check the "comp" flag for EdDSA. * cipher/ecc-eddsa.c (eddsa_encode_x_y): Add arg WITH_PREFIX. (_gcry_ecc_eddsa_encodepoint): Ditto. (_gcry_ecc_eddsa_ensure_compact): Handle the 0x40 compression prefix. (_gcry_ecc_eddsa_decodepoint): Ditto. * tests/keygrip.c: Check an compresssed with prefix Ed25519 key. * tests/t-ed25519.inp: Ditto.
2014-01-27Fix memory leaks in ecc codeDmitry Eremin-Solenikov1-4/+18
* cipher/ecc-curves.c (_gcry_ecc_update_curve_param): Release passed mpi values. * cipher/ecc.c (compute_keygrip): Fix potential memory leak in error path. * cipher/ecc.c (_gcry_ecc_get_curve): Release temporary mpi. -- ==11657== 252 (80 direct, 172 indirect) bytes in 4 blocks are definitely lost in loss record 8 of 8 ==11657== at 0x4028A28: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==11657== by 0x404178F: _gcry_private_malloc (stdmem.c:113) ==11657== by 0x403CED1: do_malloc.constprop.4 (global.c:768) ==11657== by 0x403DD01: _gcry_xmalloc (global.c:790) ==11657== by 0x409EAE0: _gcry_mpi_alloc (mpiutil.c:84) ==11657== by 0x409C4E4: _gcry_mpi_scan (mpicoder.c:466) ==11657== by 0x404009C: _gcry_sexp_nth_mpi (sexp.c:796) ==11657== by 0x40410B5: _gcry_sexp_vextract_param (sexp.c:2327) ==11657== by 0x4041396: _gcry_sexp_extract_param (sexp.c:2378) ==11657== by 0x407B895: compute_keygrip (ecc.c:1492) ==11657== by 0x404BBE8: _gcry_pk_get_keygrip (pubkey.c:674) ==11657== by 0x403B1BF: gcry_pk_get_keygrip (visibility.c:1056) ==16502== 144 (60 direct, 84 indirect) bytes in 3 blocks are definitely lost in loss record 3 of 7 ==16502== at 0x4028A28: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==16502== by 0x404B4DE: _gcry_private_malloc (stdmem.c:113) ==16502== by 0x404667B: do_malloc (global.c:768) ==16502== by 0x40466E7: _gcry_malloc (global.c:790) ==16502== by 0x4046A55: _gcry_xmalloc (global.c:944) ==16502== by 0x40CD25B: _gcry_mpi_alloc (mpiutil.c:84) ==16502== by 0x40CAC3E: _gcry_mpi_scan (mpicoder.c:548) ==16502== by 0x40A72B2: scanval (ecc-curves.c:432) ==16502== by 0x40A7B0D: _gcry_ecc_get_curve (ecc-curves.c:685) ==16502== by 0x4058164: _gcry_pk_get_curve (pubkey.c:747) ==16502== by 0x4043E14: gcry_pk_get_curve (visibility.c:1067) ==16502== by 0x8048934: check_matching (curves.c:124) Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
2014-01-13Add GOST R 34.10-2012 curves proposed by TC26Dmitry Eremin-Solenikov1-0/+35
* cipher/ecc-curves.c (domain_parmss): Add two GOST R 34.10-2012 curves proposed/pending to standardization by TC26 (Russian cryptography technical comitee). * cipher/ecc-curves.c (curve_alias): Add OID aliases. * tests/curves.c: Increase N_CURVES. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
2014-01-13Add GOST R 34.10-2001 curves per RFC4357Dmitry Eremin-Solenikov1-1/+39
* cipher/ecc-curves.c (domain_parms): Add 3 curves defined in rfc4357. * cipher/ecc-curves.c (curve_aliases): Add OID and Xch aliases for GOST curves. * tests/curves.c (N_CURVES): Update value. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
2014-01-13ecc: Make a macro shorter.Werner Koch1-3/+19
* src/mpi.h (MPI_EC_TWISTEDEDWARDS): Rename to MPI_EC_EDWARDS. CHnage all users. * cipher/ecc-curves.c (domain_parms): Add parameters for Curve3617 as comment. * mpi/ec.c (dup_point_twistededwards): Rename to dup_point_edwards. (add_points_twistededwards): Rename to add_points_edwards. Signed-off-by: Werner Koch <wk@gnupg.org>
2014-01-12Add secp256k1 curve.NIIBE Yutaka1-0/+13
* cipher/ecc-curves.c (curve_aliases): Add secp256k1 and its OID. (domain_parms): Add secp256k1's domain paramerter. * tests/basic.c (check_pubkey): Add a key of secp256k1. * tests/curves.c (N_CURVES): Updated. -- The key in check_pubkey is from "Test vector 1" of following page. https://en.bitcoin.it/wiki/BIP_0032_TestVectors Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2013-12-12Remove macro hacks for internal vs. external functions. Part 2 and last.Werner Koch1-13/+13
* src/visibility.h: Remove remaining define/undef hacks for symbol visibility. Add macros to detect the use of the public functions. Change all affected functions by replacing them by the x-macros. * src/g10lib.h: Add internal prototypes. (xtrymalloc, xtrycalloc, xtrymalloc_secure, xtrycalloc_secure) (xtryrealloc, xtrystrdup, xmalloc, xcalloc, xmalloc_secure) (xcalloc_secure, xrealloc, xstrdup, xfree): New macros. -- The use of xmalloc/xtrymalloc/xfree is a more common pattern than the gcry_free etc. functions. Those functions behave like those defined by C and thus for better readability we use these macros and not the underscore prefixed functions. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-12-06ecc: Remove unused internal function.Werner Koch1-22/+8
* src/cipher-proto.h (gcry_pk_spec): Remove get_param. * cipher/ecc-curves.c (_gcry_ecc_get_param_sexp): Merge in code from _gcry_ecc_get_param. (_gcry_ecc_get_param): Remove. * cipher/ecc.c (_gcry_pubkey_spec_ecc): Remove _gcry_ecc_get_param. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-12-05ecc: Change OID for Ed25519.Werner Koch1-1/+2
* cipher/ecc-curves.c (curve_aliased): Add more suitable OID for Ed25519. -- The formerly used OID has been assigned by Peter Gutmann for Curve25519. We better keep them distinct and assign a separate one for Ed25519. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-12-05Remove macro hacks for internal vs. external functions. Part 1.Werner Koch1-45/+45
* src/visibility.h: Remove almost all define/undef hacks for symbol visibility. Add macros to detect the use of the public functions. Change all affected functions by prefixing them explicitly with an underscore and change all internal callers to call the underscore prefixed versions. Provide convenience macros from sexp and mpi functions. * src/visibility.c: Change all functions to use only gpg_err_code_t and translate to gpg_error_t only in visibility.c. -- The use of the macro magic made if hard to follow the function calls in the source. It was not easy to see if an internal or external function (as defined by visibility.c) was called. The change is quite large but hopefully makes Libgcrypt easier to maintain. Some function have not yet been fixed; this will be done soon. Because Libgcrypt does no make use of any other libgpg-error using libraries it is useless to always translate between gpg_error_t and gpg_err_code_t (i.e with and w/o error source identifier). This translation has no mostly be moved to the function wrappers in visibility.c. An additional advantage of using gpg_err_code_t is that comparison can be done without using gpg_err_code(). I am sorry for that large patch, but a series of patches would actually be more work to audit. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-12-02ecc: Make gcry_pk_testkey work for Ed25519.Werner Koch1-7/+7
* cipher/ecc-misc.c (_gcry_ecc_compute_public): Add optional args G and d. Change all callers. * cipher/ecc.c (gen_y_2): Remove. (check_secret_key): Use generic public key compute function. Adjust for use with Ed25519 and EdDSA. (nist_generate_key): Do not use the compliant key thingy for Ed25519. (ecc_check_secret_key): Make parameter parsing similar to the other functions. * cipher/ecc-curves.c (domain_parms): Zero prefix some parameters so that _gcry_ecc_update_curve_param works correctly. * tests/keygen.c (check_ecc_keys): Add "param" flag. Check all Ed25519 keys.
2013-11-13ecc: Fix some memory leaksChristian Grothoff1-0/+1
* cipher/ecc-curves.c (_gcry_mpi_ec_new): Free ec->b before assigning. * cipher/ecc.c (nist_generate_key): Release Q. * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Ditto. -- _gcry_mpi_ec_new: Fixing memory leak detected with valgrind; if 'b' is non-NULL, the code in ec_p_init (ec.c:379) already makes a copy of 'b', so before we clobber ctx->b here, we need to at least release the old value (however, it would of course be nicer to not first make a copy of b in the first place, but this is the most localized change to get rid of the memory leak). nist_generate_key: Fixing rather obvious local leak; Q is first initialized, then used, copied into the result but never released.
2013-11-11ecc: Change keygrip computation for Ed25519+EdDSA.Werner Koch1-0/+50
* cipher/ecc.c (compute_keygrip): Rework. * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_ensure_compact): New. * cipher/ecc-curves.c (_gcry_ecc_update_curve_param): New. * tests/keygrip.c (key_grips): Add flag param and test cases for Ed25519. -- The keygrip for Ed25519+EdDSA has not yet been used - thus it is possible to change it. Using the compact representation saves us the recovering of x from the standard representation. Compacting is basically free.
2013-11-11mpi: Add special format GCRYMPI_FMT_OPAQUE.Werner Koch1-2/+2
* src/gcrypt.h.in (GCRYMPI_FMT_OPAQUE): New. (_gcry_sexp_nth_opaque_mpi): Remove. * src/sexp.c (gcry_sexp_nth_mpi): Add support for GCRYMPI_FMT_OPAQUE. (_gcry_sexp_vextract_param): Replace removed function by GCRYMPI_FMT_OPAQUE. -- Using a new formatting mode is easier than to add a dedicated extraction function for opaque MPIs. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-11-08ecc: Improve gcry_pk_get_curve.Werner Koch1-35/+71
* cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Factor some code out to .. (find_domain_parms_idx): new. (_gcry_ecc_get_curve): Find by curve name on error. -- This change allows the use of an input with just the curve name which can be used to test whether a given curve has been implemented. Is is required because due to the "param" flag change the caller usually does not have the key parameters available. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-11-08ecc: Make "noparam" the default and replace by "param".Werner Koch1-6/+12
* src/cipher.h (PUBKEY_FLAG_NOCOMP): New. (PUBKEY_FLAG_NOPARAM): Remove. (PUBKEY_FLAG_PARAM): New. * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Support the new flags and ignore the obsolete "noparam" flag. * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Return the curve name also for curves selected by NBITS. (_gcry_mpi_ec_new): Support the "param" flag. * cipher/ecc.c (ecc_generate, ecc_sign, ecc_verify): Ditto. * tests/keygen.c (check_ecc_keys): Remove the "noparam" flag. -- This is an API change but there are not many ECC users yet and adding the "param" flag for those who really need the parameters (e.g. if private keys have been stored without the curve name, it can easily be added. Note that no version of Libgcrypt with support for "noparam" has been released but for the sake of projects already working with the master version we don't bail out on "noparam". Signed-off-by: Werner Koch <wk@gnupg.org>
2013-11-05ecc: Fully implement Ed25519 compression in ECDSA mode.Werner Koch1-45/+83
* src/ec-context.h (mpi_ec_ctx_s): Add field FLAGS. * mpi/ec.c (ec_p_init): Add arg FLAGS. Change all callers to pass it. * cipher/ecc-curves.c (point_from_keyparam): Add arg EC, parse as opaque mpi and use eddsa decoding depending on the flag. (_gcry_mpi_ec_new): Rearrange to parse Q and D after knowing the curve. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-10-16ecc: Add support for GOST R 34.10-2001/-2012 signaturesDmitry Eremin-Solenikov1-0/+28
* src/cipher.h: define PUBKEY_FLAG_GOST * cipher/ecc-curves.c: Add GOST2001-test and GOST2012-test curves defined in standards. Typical applications would use either those curves, or curves defined in RFC 4357 (will be added later). * cipher/ecc.c (sign_gost, verify_gost): New. (ecc_sign, ecc_verify): use sign_gost/verify_gost if PUBKEY_FLAG_GOST is set. (ecc_names): add "gost" for gost signatures. * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist, _gcry_pk_util_preparse_sigval): set PUBKEY_FLAG_GOST if gost flag is present in s-exp. * tests/benchmark.c (ecc_bench): also benchmark GOST signatures. * tests/basic.c (check_pubkey): add two public keys from GOST R 34.10-2012 standard. (check_pubkey_sign_ecdsa): add two data sets to check gost signatures. * tests/curves.c: correct N_CURVES as we now have 2 more curves. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> Removed some comments from the new curve definitions in ecc-curves.c to avoid line wrapping. Eventually we will develop a precompiler to avoid parsing those hex strings. -wk
2013-10-16sexp: Add function gcry_sexp_extract_param.Werner Koch1-3/+3
* src/gcrypt.h.in (_GCRY_GCC_ATTR_SENTINEL): New. (gcry_sexp_extract_param): New. * src/visibility.c (gcry_sexp_extract_param): New. * src/visibility.h (gcry_sexp_extract_param): Add hack to detect internal use. * cipher/pubkey-util.c (_gcry_pk_util_extract_mpis): Move and split into ... * src/sexp.c (_gcry_sexp_vextract_param) (_gcry_sexp_extract_param): this. Change all callers. Add support for buffer descriptors and a path option/ * tests/tsexp.c (die, hex2buffer, hex2mpi, hex2mpiopa): New. (cmp_mpihex, cmp_bufhex): New. (check_extract_param): New. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-10-11pubkey: Move sexp parsing of remaining fucntions to the modules.Werner Koch1-23/+28
* cipher/pubkey.c (release_mpi_array): Remove. (pubkey_check_secret_key): Remove. (sexp_elements_extract): Remove. (sexp_elements_extract_ecc): Remove. (sexp_to_key): Remove. (get_hash_algo): Remove. (gcry_pk_testkey): Revamp. (gcry_pk_get_curve): Revamp. * cipher/rsa.c (rsa_check_secret_key): Revamp. * cipher/elgamal.c (elg_check_secret_key): Revamp. * cipher/dsa.c (dsa_check_secret_key): Revamp. * cipher/ecc.c (ecc_check_secret_key): Revamp. * cipher/ecc-curves.c: Include cipher.h and pubkey-internal.h (_gcry_ecc_get_curve): Revamp. * cipher/pubkey-util.c (_gcry_pk_util_extract_mpis): Set passed and used parameters on error to NULL. -- That is the final part of the changes modulo introduced regressions. pubkey.c is now actually maintainable code. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-10-09pubkey: Move sexp parsing for gcry_pk_verify to the modules.Werner Koch1-9/+20
* cipher/rsa.c (rsa_verify): Revamp. * cipher/dsa.c (dsa_verify): Revamp. * cipher/elgamal.c (elg_verify): Revamp. * cipher/ecc.c (ecc_verify): Revamp. * cipher/pubkey.c (sexp_to_sig): Remove. (pss_verify_cmp): Move to pubkey-util.c (sexp_data_to_mpi): Ditto. (init_encoding_ctx): Ditto. (gcry_pk_verify): Simplify. * cipher/pubkey-util.c (_gcry_pk_util_init_encoding_ctx): Add. Take from pubkey.c (get_hash_algo): Ditto. (_gcry_pk_util_data_to_mpi): Ditto. (pss_verify_cmp): Ditto. (_gcry_pk_util_extract_mpis): New. (_gcry_pk_util_preparse_sigval): New. (_gcry_pk_util_free_encoding_ctx): New. * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Make curve init optional. * src/g10lib.h (GCC_ATTR_SENTINEL): New. * tests/basic.c (check_pubkey_sign): Print the algo name. (main): Add option --pubkey. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-10-08pubkey: Move sexp parsing for gcry_pk_get_nbits to the modules.Werner Koch1-11/+16
* cipher/pubkey.c (spec_from_sexp): New. (gcry_pk_get_nbits): Simplify. * cipher/rsa.c (rsa_get_nbits): Take only PARMS as args and do sexp parsing here. * cipher/dsa.c (dsa_get_nbits): Ditto. * cipher/elgamal.c (elg_get_nbits): Ditto. * cipher/ecc.c (ecc_get_nbits): Ditto. * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Allow NULL for arg CURVE. -- gcry_pk_get_nbits should now also be faster for ECC because there is no more need to copy all the parms if a curve name has been given. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-10-06ecc: Add OID for Ed25519.Werner Koch1-0/+2
-- See: From: Peter Gutmann <pgut001@cs.auckland.ac.nz> Subject: Re: [cryptography] Curve25519 OID (was: Re: the spell is broken) To: xxxxxxxxxxxxx Cc: cryptography@randombit.net Message-Id: <E1VSk4L-0004JD-AI@login01.fos.auckland.ac.nz> Date: Sun, 06 Oct 2013 21:52:05 +1300 xxxxxxxxxxxxxxx writes: >For completeness, Crypto++ has a factory-like method that serves curves. The >curves are sorted by OID in the function, so Crypto++ would need an OID for >ed25519. { 1 3 6 1 4 1 3029 1 5 1 } ed209^H^H5519 You have been OIDed. Go forth and encrypt. Peter.
2013-09-30ecc: Use faster b parameter for Ed25519.Werner Koch1-1/+1
* cipher/ecc-curves.c (domain_parms): Replace b. * tests/t-mpi-point.c (test_curve): Ditto. -- This change has been suggested by NIIBE Yutaka: Here, 0x98412DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235EC8FEDA4 is: (121666^-1 mod q)*121665. (121666^-1) * 121665 mod q is: 0x2DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235ECA6874A While it works for both, I think that shorter is better. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-25ecc: Allow the name "q@eddsa" to get/set the public key.Werner Koch1-6/+56
* cipher/ecc-curves.c (_gcry_ecc_get_mpi): Support "q@eddsa". (_gcry_ecc_set_mpi): Support "q". * cipher/ecc.c (eddsa_encodepoint): Rename to ... (_gcry_ecc_eddsa_encodepoint): this and make global. Remove arg MINLEN and take from context. (eddsa_decodepoint): Rename to (_gcry_ecc_eddsa_decodepoint): this and make global. Remove arg LEN and take from context. (sign_eddsa, verify_eddsa): Take B from context. (ecc_sign, ecc_verify): Add hack to set DIALECT. (_gcry_pk_ecc_get_sexp): Use _gcry_ecc_compute_public. Handle EdDSA. * src/ec-context.h (mpi_ec_ctx_s): Add field NBITS. * mpi/ec.c (ec_p_init): Init NBITS. * tests/t-mpi-point.c (test_curve): Add Ed25519. (sample_ed25519_q): New. (context_param): Check new sample key. (hex2buffer, hex2mpiopa): New. (cmp_mpihex): Take care of opaque MPIs. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-25ecc: Refactor low-level access functions.Werner Koch1-0/+140
* mpi/ec.c (point_copy): Move to cipher/ecc-curves.c. (ec_get_reset): Rename to _gcry_mpi_ec_get_reset and make global. (_gcry_mpi_ec_get_mpi): Factor most code out to _gcry_ecc_get_mpi. (_gcry_mpi_ec_get_point): Factor most code out to _gcry_ecc_get_point. (_gcry_mpi_ec_set_mpi): Factor most code out to _gcry_ecc_set_mpi. (_gcry_mpi_ec_set_point): Factor most code out to _gcry_ecc_set_point. * cipher/ecc-curves.c (_gcry_ecc_get_mpi): New. (_gcry_ecc_get_point, _gcry_ecc_set_mpi, _gcry_ecc_set_point): New. * cipher/ecc-misc.c (_gcry_ecc_compute_public): New. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-18ecc: Add Ed25519 key generation and prepare for optimizations.Werner Koch1-17/+28
* src/mpi.h (enum ecc_dialects): New. * src/ec-context.h (mpi_ec_ctx_s): Add field DIALECT. * cipher/ecc-common.h (elliptic_curve_t): Ditto. * cipher/ecc-curves.c (ecc_domain_parms_t): Ditto. (domain_parms): Add dialect values. (_gcry_ecc_fill_in_curve): Set dialect. (_gcry_ecc_get_curve): Ditto. (_gcry_mpi_ec_new): Ditto. (_gcry_ecc_get_param): Use ECC_DIALECT_STANDARD for now. * cipher/ecc-misc.c (_gcry_ecc_curve_copy): Copy dialect. (_gcry_ecc_dialect2str): New. * mpi/ec.c (ec_p_init): Add arg DIALECT. (_gcry_mpi_ec_p_internal_new): Ditto. (_gcry_mpi_ec_p_new): Ditto. * mpi/mpiutil.c (gcry_mpi_set_opaque): Set the secure flag. (_gcry_mpi_set_opaque_copy): New. * cipher/ecc-misc.c (_gcry_ecc_os2ec): Take care of an opaque MPI. * cipher/ecc.c (eddsa_generate_key): New. (generate_key): Rename to nist_generate_key and factor some code out to ... (ecc_generate_ext): here. Divert to eddsa_generate_key if desired. (eddsa_decodepoint): Take care of an opaque MPI. (ecc_check_secret_key): Ditto. (ecc_sign): Ditto. * cipher/pubkey.c (sexp_elements_extract_ecc): Store public and secret key as opaque MPIs. (gcry_pk_genkey): Add the curve_name also to the private key part of the result. * tests/benchmark.c (ecc_bench): Support Ed25519. (main): Add option --debug. * tests/curves.c (sample_key_2): Make sure that P and N are positive. * tests/keygen.c (show): New. (check_ecc_keys): Support Ed25519. -- There are two main purposes of this patch: Add a key generation feature for Ed25519 and add the "dialect" thingy which will eventually be used to add curve specific optimization. Note that the entire way of how we interface between the public key modules and pubkey.c is overly complex and probably also the cause for a lot of performance overhead. Given that we don't have the loadable module system anymore, we should entirely get rid of the MPI-array based internal interface and move parts of the s-expression handling direct into the pubkey modules. This needs to be fixed or we are turning Libgcrypt into another software incarnation of Heathrow Airport. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-16ecc: Implement Curve Ed25519 signing and verification.Werner Koch1-2/+14
* cipher/ecc-curves.c (domain_parms): Add curve "Ed25519". * cipher/ecc.c (reverse_buffer): New. (eddsa_encodempi): New. (eddsa_encodepoint): New. (eddsa_decodepoint): New. (sign_eddsa): Implement. (verify_eddsa): Implement. (ecc_sign): Init unused Q. Pass public key to sign_eddsa. (ecc_verify): Init pk.Q if not used. Pass public key verbatim to verify_eddsa. * cipher/pubkey.c (sexp_elements_extract): Add arg OPAQUE. Change all callers to pass 0. (sexp_to_sig): Add arg OPAQUE and pass it to sexp_elements_extract. (sexp_data_to_mpi): Allow for a zero length "value". (gcry_pk_verify): Reorder parameter processing. Pass OPAQUE flag as required. * mpi/ec.c (ec_invm): Print a warning if the inverse does not exist. (_gcry_mpi_ec_get_affine): Implement for our Twisted Edwards curve model. (dup_point_twistededwards): Implement. (add_points_twistededwards): Implement. (_gcry_mpi_ec_mul_point): Support Twisted Edwards. * mpi/mpicoder.c (do_get_buffer): Add arg FILL_LE. (_gcry_mpi_get_buffer): Ditto. Change all callers. (_gcry_mpi_get_secure_buffer): Ditto. * src/sexp.c (_gcry_sexp_nth_opaque_mpi): New. * tests/t-ed25519.c: New. * tests/t-ed25519.inp: New. * tests/t-mpi-point.c (basic_ec_math_simplified): Print some output only in debug mode. (twistededwards_math): New test. (main): Call new test. -- This is a non optimized version which takes far too long. On my X220 Thinkpad the 1024 test cases take 14 seconds (12 with --sign-with-pk). There should be a lot of room for improvements. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-07mpi: Improve support for non-Weierstrass support.Werner Koch1-5/+9
* mpi/ec.c (ec_p_init): Add args MODEL and P. Change all callers. (_gcry_mpi_ec_p_internal_new): Ditto. (_gcry_mpi_ec_p_new): Ditto. * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Return GPG_ERR_UNKNOWN_CURVE instead of invalid value. Init curve model. * cipher/ecc.c (ecc_verify, ecc_encrypt_raw): Ditto. * cipher/pubkey.c (sexp_data_to_mpi): Fix EDDSA flag error checking. -- (fixes commit c26be7a337d0bf98193bc58e043209e46d0769bb)
2013-09-04Prepare support for non-Weierstrass EC equations.Werner Koch1-4/+35
* src/mpi.h (gcry_mpi_ec_models): New. * src/ec-context.h (mpi_ec_ctx_s): Add MODEL. * cipher/ecc-common.h (elliptic_curve_t): Ditto. * cipher/ecc-curves.c (ecc_domain_parms_t): Ditto. (domain_parms): Mark als as Weierstrass. (_gcry_ecc_fill_in_curve): Check model. (_gcry_ecc_get_curve): Set model to Weierstrass. * cipher/ecc-misc.c (_gcry_ecc_model2str): New. * cipher/ecc.c (generate_key, ecc_generate_ext): Print model in the debug output. * mpi/ec.c (_gcry_mpi_ec_dup_point): Switch depending on model. Factor code out to ... (dup_point_weierstrass): new. (dup_point_montgomery, dup_point_twistededwards): New stub functions. (_gcry_mpi_ec_add_points): Switch depending on model. Factor code out to ... (add_points_weierstrass): new. (add_points_montgomery, add_points_twistededwards): New stub functions. * tests/Makefile.am (TESTS): Reorder tests. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-08-30Refactor the ECC code into 3 files.Werner Koch1-0/+731
* cipher/ecc-common.h, cipher/ecc-curves.c, cipher/ecc-misc.c: New. * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add new files. * configure.ac (GCRYPT_PUBKEY_CIPHERS): Add new .c files. * cipher/ecc.c (curve_aliases, ecc_domain_parms_t, domain_parms) (scanval): Move to ecc-curves.c. (fill_in_curve): Move to ecc-curve.c as _gcry_ecc_fill_in_curve. (ecc_get_curve): Move to ecc-curve.c as _gcry_ecc_get_curve. (_gcry_mpi_ec_ec2os): Move to ecc-misc.c. (ec2os): Move to ecc-misc.c as _gcry_ecc_ec2os. (os2ec): Move to ecc-misc.c as _gcry_ecc_os2ec. (point_set): Move as inline function to ecc-common.h. (_gcry_ecc_curve_free): Move to ecc-misc.c as _gcry_ecc_curve_free. (_gcry_ecc_curve_copy): Move to ecc-misc.c as _gcry_ecc_curve_copy. (mpi_from_keyparam, point_from_keyparam): Move to ecc-curves.c. (_gcry_mpi_ec_new): Move to ecc-curves.c. (ecc_get_param): Move to ecc-curves.c as _gcry_ecc_get_param. (ecc_get_param_sexp): Move to ecc-curves.c as _gcry_ecc_get_param_sexp. Signed-off-by: Werner Koch <wk@gnupg.org>
generated by cgit v1.2.1 (git 2.18.0) at 2024-05-15 08:52:34 +0000