Update docs/usage for 'plink -shareexists'.

[PuTTY.git] / sshecc.c

diff --git a/sshecc.c b/sshecc.c
index 32f14de3cb2ed1e1c7ad37dcc78a6b15cc90eaa2..5f170215dbc2dd9764158b5334254943ae40709c 100644 (file)
--- a/sshecc.c
+++ b/sshecc.c
@@ -24,6 +24,10 @@
  * Handbook of elliptic and hyperelliptic curve cryptography, Chapter 13
  *   http://cs.ucsb.edu/~koc/ccs130h/2013/EllipticHyperelliptic-CohenFrey.pdf
  *
+ * Curve25519 spec from libssh (with reference to other things in the
+ * libssh code):
+ *   https://git.libssh.org/users/aris/libssh.git/tree/doc/curve25519-sha256@libssh.org.txt
+ *
  * Edwards DSA:
  *   http://ed25519.cr.yp.to/ed25519-20110926.pdf
  */
@@ -157,7 +161,7 @@ static struct ec_curve *ec_p256(void)
         };
 
         initialise_wcurve(&curve, 256, p, a, b, n, Gx, Gy);
-        curve.name = "nistp256";
+        curve.textname = curve.name = "nistp256";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -223,7 +227,7 @@ static struct ec_curve *ec_p384(void)
         };
 
         initialise_wcurve(&curve, 384, p, a, b, n, Gx, Gy);
-        curve.name = "nistp384";
+        curve.textname = curve.name = "nistp384";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -307,7 +311,7 @@ static struct ec_curve *ec_p521(void)
         };
 
         initialise_wcurve(&curve, 521, p, a, b, n, Gx, Gy);
-        curve.name = "nistp521";
+        curve.textname = curve.name = "nistp521";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -352,6 +356,7 @@ static struct ec_curve *ec_curve25519(void)
         /* This curve doesn't need a name, because it's never used in
          * any format that embeds the curve name */
         curve.name = NULL;
+        curve.textname = "Curve25519";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -403,6 +408,7 @@ static struct ec_curve *ec_ed25519(void)
         curve.name = NULL;
 
         initialise_ecurve(&curve, 256, q, l, d, Bx, By);
+        curve.textname = "Ed25519";
 
         /* Now initialised, no need to do it again */
         initialised = 1;
@@ -2688,15 +2694,30 @@ static Bignum ecdh_calculate(const Bignum private,
     p->x = NULL;
 
     if (p->curve->type == EC_MONTGOMERY) {
-        /* Do conversion in network byte order */
+        /*
+         * Endianness-swap. The Curve25519 algorithm definition
+         * assumes you were doing your computation in arrays of 32
+         * little-endian bytes, and now specifies that you take your
+         * final one of those and convert it into a bignum in
+         * _network_ byte order, i.e. big-endian.
+         *
+         * In particular, the spec says, you convert the _whole_ 32
+         * bytes into a bignum. That is, on the rare occasions that
+         * p->x has come out with the most significant 8 bits zero, we
+         * have to imagine that being represented by a 32-byte string
+         * with the last byte being zero, so that has to be converted
+         * into an SSH-2 bignum with the _low_ byte zero, i.e. a
+         * multiple of 256.
+         */
         int i;
-        int bytes = (bignum_bitcount(ret)+7) / 8;
+        int bytes = (p->curve->fieldBits+7) / 8;
         unsigned char *byteorder = snewn(bytes, unsigned char);
         for (i = 0; i < bytes; ++i) {
             byteorder[i] = bignum_byte(ret, i);
         }
         freebn(ret);
         ret = bignum_from_bytes(byteorder, bytes);
+        smemclr(byteorder, bytes);
         sfree(byteorder);
     }
 
@@ -2704,6 +2725,13 @@ static Bignum ecdh_calculate(const Bignum private,
     return ret;
 }
 
+const char *ssh_ecdhkex_curve_textname(const struct ssh_kex *kex)
+{
+    const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;
+    struct ec_curve *curve = extra->curve();
+    return curve->textname;
+}
+
 void *ssh_ecdhkex_newkey(const struct ssh_kex *kex)
 {
     const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;