* Handbook of elliptic and hyperelliptic curve cryptography, Chapter 13
* http://cs.ucsb.edu/~koc/ccs130h/2013/EllipticHyperelliptic-CohenFrey.pdf
*
+ * Curve25519 spec from libssh (with reference to other things in the
+ * libssh code):
+ * https://git.libssh.org/users/aris/libssh.git/tree/doc/curve25519-sha256@libssh.org.txt
+ *
* Edwards DSA:
* http://ed25519.cr.yp.to/ed25519-20110926.pdf
*/
};
initialise_wcurve(&curve, 256, p, a, b, n, Gx, Gy);
- curve.name = "nistp256";
+ curve.textname = curve.name = "nistp256";
/* Now initialised, no need to do it again */
initialised = 1;
};
initialise_wcurve(&curve, 384, p, a, b, n, Gx, Gy);
- curve.name = "nistp384";
+ curve.textname = curve.name = "nistp384";
/* Now initialised, no need to do it again */
initialised = 1;
};
initialise_wcurve(&curve, 521, p, a, b, n, Gx, Gy);
- curve.name = "nistp521";
+ curve.textname = curve.name = "nistp521";
/* Now initialised, no need to do it again */
initialised = 1;
/* This curve doesn't need a name, because it's never used in
* any format that embeds the curve name */
curve.name = NULL;
+ curve.textname = "Curve25519";
/* Now initialised, no need to do it again */
initialised = 1;
curve.name = NULL;
initialise_ecurve(&curve, 256, q, l, d, Bx, By);
+ curve.textname = "Ed25519";
/* Now initialised, no need to do it again */
initialised = 1;
/* Read x bit and then reset it */
negative = bignum_bit(point->y, point->curve->fieldBits - 1);
bignum_set_bit(point->y, point->curve->fieldBits - 1, 0);
+ bn_restore_invariant(point->y);
/* Get the x from the y */
point->x = ecp_edx(point->curve, point->y);
/* Curve name is duplicated for Weierstrass form */
if (curve->type == EC_WEIERSTRASS) {
getstring(&data, &len, &p, &slen);
+ if (!p) return NULL;
if (!match_ssh_id(slen, p, curve->name)) return NULL;
}
ec->publicKey.x = NULL;
ec->publicKey.y = NULL;
ec->publicKey.z = NULL;
+ ec->privateKey = NULL;
if (!getmppoint(&data, &len, &ec->publicKey)) {
ecdsa_freekey(ec);
return NULL;
}
- ec->privateKey = NULL;
if (!ec->publicKey.x || !ec->publicKey.y ||
bignum_cmp(ec->publicKey.x, curve->p) >= 0 ||
p->x = NULL;
if (p->curve->type == EC_MONTGOMERY) {
- /* Do conversion in network byte order */
+ /*
+ * Endianness-swap. The Curve25519 algorithm definition
+ * assumes you were doing your computation in arrays of 32
+ * little-endian bytes, and now specifies that you take your
+ * final one of those and convert it into a bignum in
+ * _network_ byte order, i.e. big-endian.
+ *
+ * In particular, the spec says, you convert the _whole_ 32
+ * bytes into a bignum. That is, on the rare occasions that
+ * p->x has come out with the most significant 8 bits zero, we
+ * have to imagine that being represented by a 32-byte string
+ * with the last byte being zero, so that has to be converted
+ * into an SSH-2 bignum with the _low_ byte zero, i.e. a
+ * multiple of 256.
+ */
int i;
- int bytes = (bignum_bitcount(ret)+7) / 8;
+ int bytes = (p->curve->fieldBits+7) / 8;
unsigned char *byteorder = snewn(bytes, unsigned char);
for (i = 0; i < bytes; ++i) {
byteorder[i] = bignum_byte(ret, i);
}
freebn(ret);
ret = bignum_from_bytes(byteorder, bytes);
+ smemclr(byteorder, bytes);
sfree(byteorder);
}
return ret;
}
+const char *ssh_ecdhkex_curve_textname(const struct ssh_kex *kex)
+{
+ const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;
+ struct ec_curve *curve = extra->curve();
+ return curve->textname;
+}
+
void *ssh_ecdhkex_newkey(const struct ssh_kex *kex)
{
const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;