crypto_curve25519.c File Reference

Wrapper code for a curve25519 implementation. More...

#include "orconfig.h"
#include "lib/ctime/di_ops.h"
#include "lib/crypt_ops/crypto_curve25519.h"
#include "lib/crypt_ops/crypto_digest.h"
#include "lib/crypt_ops/crypto_format.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/crypt_ops/crypto_util.h"
#include "lib/log/log.h"
#include "lib/log/util_bug.h"
#include "ed25519/donna/ed25519_donna_tor.h"
#include <string.h>

Go to the source code of this file.

Functions
static void	pick_curve25519_basepoint_impl (void)
STATIC int	curve25519_impl (uint8_t *output, const uint8_t *secret, const uint8_t *point)
STATIC int	curve25519_basepoint_impl (uint8_t *output, const uint8_t *secret)
void	curve25519_set_impl_params (int use_ed)
int	curve25519_public_key_is_ok (const curve25519_public_key_t *key)
int	curve25519_rand_seckey_bytes (uint8_t *out, int extra_strong)
int	curve25519_secret_key_generate (curve25519_secret_key_t *key_out, int extra_strong)
void	curve25519_public_key_generate (curve25519_public_key_t *key_out, const curve25519_secret_key_t *seckey)
int	curve25519_keypair_generate (curve25519_keypair_t *keypair_out, int extra_strong)
int	curve25519_keypair_write_to_file (const curve25519_keypair_t *keypair, const char *fname, const char *tag)
int	curve25519_keypair_read_from_file (curve25519_keypair_t *keypair_out, char **tag_out, const char *fname)
void	curve25519_handshake (uint8_t *output, const curve25519_secret_key_t *skey, const curve25519_public_key_t *pkey)
static int	curve25519_basepoint_spot_check (void)
void	curve25519_init (void)

Variables
static int	curve25519_use_ed = -1

Detailed Description

Wrapper code for a curve25519 implementation.

Curve25519 is an Elliptic-Curve Diffie Hellman handshake, designed by Dan Bernstein. For more information, see https://cr.yp.to/ecdh.html

Tor uses Curve25519 as the basis of its "ntor" circuit extension handshake, and in related code. The functions in this module are used to find the most suitable available Curve25519 implementation, to provide wrappers around it, and so on.

Definition in file crypto_curve25519.c.

Macro Definition Documentation

CRYPTO_CURVE25519_PRIVATE

#define CRYPTO_CURVE25519_PRIVATE

Definition at line 18 of file crypto_curve25519.c.

Function Documentation

curve25519_basepoint_impl()

STATIC int curve25519_basepoint_impl	(	uint8_t *	output,
		const uint8_t *	secret
	)

Helper function: Multiply the scalar "secret" by the Curve25519 basepoint (X=9), and store the result in "output". Return 0 on success, -1 on failure.

Definition at line 90 of file crypto_curve25519.c.

Referenced by curve25519_basepoint_spot_check(), and curve25519_public_key_generate().

curve25519_basepoint_spot_check()

static int curve25519_basepoint_spot_check ( void  )

static

Check whether the ed25519-based curve25519 basepoint optimization seems to be working. If so, return 0; otherwise return -1.

Definition at line 278 of file crypto_curve25519.c.

Referenced by pick_curve25519_basepoint_impl().

curve25519_handshake()

void curve25519_handshake	(	uint8_t *	output,
		const curve25519_secret_key_t *	skey,
		const curve25519_public_key_t *	pkey
	)

Perform the curve25519 ECDH handshake with skey and pkey, writing CURVE25519_OUTPUT_LEN bytes of output into output.

Definition at line 268 of file crypto_curve25519.c.

Referenced by hs_ntor_service_get_introduce1_keys_multi(), onion_ntor3_client_handshake(), and onion_skin_ntor3_server_handshake_part2_nokeygen().

curve25519_impl()

STATIC int curve25519_impl	(	uint8_t *	output,
		const uint8_t *	secret,
		const uint8_t *	point
	)

Helper function: call the most appropriate backend to compute the scalar "secret" times the point "point". Store the result in "output". Return 0 on success, negative on failure.

Definition at line 65 of file crypto_curve25519.c.

Referenced by curve25519_handshake().

curve25519_init()

void curve25519_init

(

void

)

Initialize the curve25519 implementations. This is necessary if you're going to use them in a multithreaded setting, and not otherwise.

Definition at line 363 of file crypto_curve25519.c.

curve25519_keypair_generate()

int curve25519_keypair_generate	(	curve25519_keypair_t *	keypair_out,
		int	extra_strong
	)

Construct a new keypair in *keypair_out. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

Definition at line 190 of file crypto_curve25519.c.

Referenced by onion_skin_ntor3_create(), and onion_skin_ntor3_server_handshake_part2().

curve25519_keypair_read_from_file()

int curve25519_keypair_read_from_file	(	curve25519_keypair_t *	keypair_out,
		char **	tag_out,
		const char *	fname
	)

Read a curve25519 keypair from a file named fname created by curve25519_keypair_write_to_file(). Store the keypair in keypair_out, and the associated tag string in tag_out. Return 0 on success, and -1 on failure.

Definition at line 233 of file crypto_curve25519.c.

curve25519_keypair_write_to_file()

int curve25519_keypair_write_to_file	(	const curve25519_keypair_t *	keypair,
		const char *	fname,
		const char *	tag
	)

Store the keypair keypair, including its secret and public parts, to the file fname. Use the string tag tag to distinguish this from other Curve25519 keypairs. Return 0 on success, -1 on failure.

See crypto_write_tagged_contents_to_file() for more information on the metaformat used for these keys.

Definition at line 207 of file crypto_curve25519.c.

curve25519_public_key_generate()

void curve25519_public_key_generate	(	curve25519_public_key_t *	key_out,
		const curve25519_secret_key_t *	seckey
	)

Given a secret key in seckey, create the corresponding public key in key_out.

Definition at line 179 of file crypto_curve25519.c.

Referenced by curve25519_keypair_generate(), and curve25519_keypair_read_from_file().

curve25519_public_key_is_ok()

int curve25519_public_key_is_ok

(

const curve25519_public_key_t *

key

)

Return true iff a curve25519_public_key_t seems valid. (It's not necessary to see if the point is on the curve, since the twist is also secure, but we do need to make sure that it isn't the point at infinity.)

Definition at line 132 of file crypto_curve25519.c.

Referenced by hs_circ_is_rend_sent_in_intro1().

curve25519_rand_seckey_bytes()

int curve25519_rand_seckey_bytes	(	uint8_t *	out,
		int	extra_strong
	)

Generate CURVE25519_SECKEY_LEN random bytes in out. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

This function does not adjust the output of the RNG at all; the will caller will need to clear or set the appropriate bits to make curve25519 work.

Definition at line 147 of file crypto_curve25519.c.

Referenced by curve25519_secret_key_generate().

curve25519_secret_key_generate()

int curve25519_secret_key_generate	(	curve25519_secret_key_t *	key_out,
		int	extra_strong
	)

Generate a new keypair and return the secret key. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

Definition at line 161 of file crypto_curve25519.c.

Referenced by curve25519_keypair_generate().

curve25519_set_impl_params()

void curve25519_set_impl_params

(

int

use_ed

)

Override the decision of whether to use the Ed25519-based basepoint multiply function. Used for testing.

Definition at line 118 of file crypto_curve25519.c.

pick_curve25519_basepoint_impl()

static void pick_curve25519_basepoint_impl ( void  )

static

Choose whether to use the ed25519-based curve25519-basepoint implementation.

Definition at line 344 of file crypto_curve25519.c.

Referenced by curve25519_init().

Variable Documentation

curve25519_use_ed

int curve25519_use_ed = -1

static

This is set to 1 if we have an optimized Ed25519-based implementation for multiplying a value by the basepoint; to 0 if we don't, and to -1 if we haven't checked.

Definition at line 57 of file crypto_curve25519.c.

Referenced by curve25519_basepoint_spot_check(), curve25519_set_impl_params(), and pick_curve25519_basepoint_impl().