* Handbook of elliptic and hyperelliptic curve cryptography, Chapter 13
* http://cs.ucsb.edu/~koc/ccs130h/2013/EllipticHyperelliptic-CohenFrey.pdf
*
+ * Curve25519 spec from libssh (with reference to other things in the
+ * libssh code):
+ * https://git.libssh.org/users/aris/libssh.git/tree/doc/curve25519-sha256@libssh.org.txt
+ *
* Edwards DSA:
* http://ed25519.cr.yp.to/ed25519-20110926.pdf
*/
*/
static void initialise_wcurve(struct ec_curve *curve, int bits,
- unsigned char *p,
- unsigned char *a, unsigned char *b,
- unsigned char *n, unsigned char *Gx,
- unsigned char *Gy)
+ const unsigned char *p,
+ const unsigned char *a, const unsigned char *b,
+ const unsigned char *n, const unsigned char *Gx,
+ const unsigned char *Gy)
{
int length = bits / 8;
if (bits % 8) ++length;
}
static void initialise_mcurve(struct ec_curve *curve, int bits,
- unsigned char *p,
- unsigned char *a, unsigned char *b,
- unsigned char *Gx)
+ const unsigned char *p,
+ const unsigned char *a, const unsigned char *b,
+ const unsigned char *Gx)
{
int length = bits / 8;
if (bits % 8) ++length;
}
static void initialise_ecurve(struct ec_curve *curve, int bits,
- unsigned char *p,
- unsigned char *l, unsigned char *d,
- unsigned char *Bx, unsigned char *By)
+ const unsigned char *p,
+ const unsigned char *l, const unsigned char *d,
+ const unsigned char *Bx, const unsigned char *By)
{
int length = bits / 8;
if (bits % 8) ++length;
if (!initialised)
{
- unsigned char p[] = {
+ static const unsigned char p[] = {
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
};
- unsigned char a[] = {
+ static const unsigned char a[] = {
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc
};
- unsigned char b[] = {
+ static const unsigned char b[] = {
0x5a, 0xc6, 0x35, 0xd8, 0xaa, 0x3a, 0x93, 0xe7,
0xb3, 0xeb, 0xbd, 0x55, 0x76, 0x98, 0x86, 0xbc,
0x65, 0x1d, 0x06, 0xb0, 0xcc, 0x53, 0xb0, 0xf6,
0x3b, 0xce, 0x3c, 0x3e, 0x27, 0xd2, 0x60, 0x4b
};
- unsigned char n[] = {
+ static const unsigned char n[] = {
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xbc, 0xe6, 0xfa, 0xad, 0xa7, 0x17, 0x9e, 0x84,
0xf3, 0xb9, 0xca, 0xc2, 0xfc, 0x63, 0x25, 0x51
};
- unsigned char Gx[] = {
+ static const unsigned char Gx[] = {
0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47,
0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2,
0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0,
0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96
};
- unsigned char Gy[] = {
+ static const unsigned char Gy[] = {
0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b,
0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16,
0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce,
};
initialise_wcurve(&curve, 256, p, a, b, n, Gx, Gy);
- curve.name = "nistp256";
+ curve.textname = curve.name = "nistp256";
/* Now initialised, no need to do it again */
initialised = 1;
if (!initialised)
{
- unsigned char p[] = {
+ static const unsigned char p[] = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff
};
- unsigned char a[] = {
+ static const unsigned char a[] = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xfc
};
- unsigned char b[] = {
+ static const unsigned char b[] = {
0xb3, 0x31, 0x2f, 0xa7, 0xe2, 0x3e, 0xe7, 0xe4,
0x98, 0x8e, 0x05, 0x6b, 0xe3, 0xf8, 0x2d, 0x19,
0x18, 0x1d, 0x9c, 0x6e, 0xfe, 0x81, 0x41, 0x12,
0xc6, 0x56, 0x39, 0x8d, 0x8a, 0x2e, 0xd1, 0x9d,
0x2a, 0x85, 0xc8, 0xed, 0xd3, 0xec, 0x2a, 0xef
};
- unsigned char n[] = {
+ static const unsigned char n[] = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x58, 0x1a, 0x0d, 0xb2, 0x48, 0xb0, 0xa7, 0x7a,
0xec, 0xec, 0x19, 0x6a, 0xcc, 0xc5, 0x29, 0x73
};
- unsigned char Gx[] = {
+ static const unsigned char Gx[] = {
0xaa, 0x87, 0xca, 0x22, 0xbe, 0x8b, 0x05, 0x37,
0x8e, 0xb1, 0xc7, 0x1e, 0xf3, 0x20, 0xad, 0x74,
0x6e, 0x1d, 0x3b, 0x62, 0x8b, 0xa7, 0x9b, 0x98,
0x55, 0x02, 0xf2, 0x5d, 0xbf, 0x55, 0x29, 0x6c,
0x3a, 0x54, 0x5e, 0x38, 0x72, 0x76, 0x0a, 0xb7
};
- unsigned char Gy[] = {
+ static const unsigned char Gy[] = {
0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f,
0x5d, 0x9e, 0x98, 0xbf, 0x92, 0x92, 0xdc, 0x29,
0xf8, 0xf4, 0x1d, 0xbd, 0x28, 0x9a, 0x14, 0x7c,
};
initialise_wcurve(&curve, 384, p, a, b, n, Gx, Gy);
- curve.name = "nistp384";
+ curve.textname = curve.name = "nistp384";
/* Now initialised, no need to do it again */
initialised = 1;
if (!initialised)
{
- unsigned char p[] = {
+ static const unsigned char p[] = {
0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff
};
- unsigned char a[] = {
+ static const unsigned char a[] = {
0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xfc
};
- unsigned char b[] = {
+ static const unsigned char b[] = {
0x00, 0x51, 0x95, 0x3e, 0xb9, 0x61, 0x8e, 0x1c,
0x9a, 0x1f, 0x92, 0x9a, 0x21, 0xa0, 0xb6, 0x85,
0x40, 0xee, 0xa2, 0xda, 0x72, 0x5b, 0x99, 0xb3,
0x34, 0xf1, 0xef, 0x45, 0x1f, 0xd4, 0x6b, 0x50,
0x3f, 0x00
};
- unsigned char n[] = {
+ static const unsigned char n[] = {
0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0x47, 0xae, 0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38,
0x64, 0x09
};
- unsigned char Gx[] = {
+ static const unsigned char Gx[] = {
0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04, 0x04,
0xe9, 0xcd, 0x9e, 0x3e, 0xcb, 0x66, 0x23, 0x95,
0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05, 0x3f,
0x42, 0x9b, 0xf9, 0x7e, 0x7e, 0x31, 0xc2, 0xe5,
0xbd, 0x66
};
- unsigned char Gy[] = {
+ static const unsigned char Gy[] = {
0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b,
0xc0, 0x04, 0x5c, 0x8a, 0x5f, 0xb4, 0x2c, 0x7d,
0x1b, 0xd9, 0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b,
};
initialise_wcurve(&curve, 521, p, a, b, n, Gx, Gy);
- curve.name = "nistp521";
+ curve.textname = curve.name = "nistp521";
/* Now initialised, no need to do it again */
initialised = 1;
if (!initialised)
{
- unsigned char p[] = {
+ static const unsigned char p[] = {
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xed
};
- unsigned char a[] = {
+ static const unsigned char a[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x6d, 0x06
};
- unsigned char b[] = {
+ static const unsigned char b[] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
};
- unsigned char gx[32] = {
+ static const unsigned char gx[32] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
/* This curve doesn't need a name, because it's never used in
* any format that embeds the curve name */
curve.name = NULL;
+ curve.textname = "Curve25519";
/* Now initialised, no need to do it again */
initialised = 1;
if (!initialised)
{
- unsigned char q[] = {
+ static const unsigned char q[] = {
0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xed
};
- unsigned char l[32] = {
+ static const unsigned char l[32] = {
0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7, 0x9c, 0xd6,
0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed
};
- unsigned char d[32] = {
+ static const unsigned char d[32] = {
0x52, 0x03, 0x6c, 0xee, 0x2b, 0x6f, 0xfe, 0x73,
0x8c, 0xc7, 0x40, 0x79, 0x77, 0x79, 0xe8, 0x98,
0x00, 0x70, 0x0a, 0x4d, 0x41, 0x41, 0xd8, 0xab,
0x75, 0xeb, 0x4d, 0xca, 0x13, 0x59, 0x78, 0xa3
};
- unsigned char Bx[32] = {
+ static const unsigned char Bx[32] = {
0x21, 0x69, 0x36, 0xd3, 0xcd, 0x6e, 0x53, 0xfe,
0xc0, 0xa4, 0xe2, 0x31, 0xfd, 0xd6, 0xdc, 0x5c,
0x69, 0x2c, 0xc7, 0x60, 0x95, 0x25, 0xa7, 0xb2,
0xc9, 0x56, 0x2d, 0x60, 0x8f, 0x25, 0xd5, 0x1a
};
- unsigned char By[32] = {
+ static const unsigned char By[32] = {
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
curve.name = NULL;
initialise_ecurve(&curve, 256, q, l, d, Bx, By);
+ curve.textname = "Ed25519";
/* Now initialised, no need to do it again */
initialised = 1;
/* Read x bit and then reset it */
negative = bignum_bit(point->y, point->curve->fieldBits - 1);
bignum_set_bit(point->y, point->curve->fieldBits - 1, 0);
+ bn_restore_invariant(point->y);
/* Get the x from the y */
point->x = ecp_edx(point->curve, point->y);
/* Curve name is duplicated for Weierstrass form */
if (curve->type == EC_WEIERSTRASS) {
getstring(&data, &len, &p, &slen);
+ if (!p) return NULL;
if (!match_ssh_id(slen, p, curve->name)) return NULL;
}
ec->publicKey.x = NULL;
ec->publicKey.y = NULL;
ec->publicKey.z = NULL;
+ ec->privateKey = NULL;
if (!getmppoint(&data, &len, &ec->publicKey)) {
ecdsa_freekey(ec);
return NULL;
}
- ec->privateKey = NULL;
if (!ec->publicKey.x || !ec->publicKey.y ||
bignum_cmp(ec->publicKey.x, curve->p) >= 0 ||
}
getstring((const char**)blob, len, &q, &qlen);
- if (!q)
- return NULL;
- if (qlen != 64)
+ if (!q || qlen != 64) {
+ ecdsa_freekey(ec);
return NULL;
+ }
ec->privateKey = bignum_from_bytes_le((const unsigned char *)q, 32);
}
getstring(&sig, &siglen, &p, &slen);
+ if (!p) return 0;
if (ec->publicKey.curve->type == EC_EDWARDS) {
struct ec_point *r;
Bignum s, h;
p->x = NULL;
if (p->curve->type == EC_MONTGOMERY) {
- /* Do conversion in network byte order */
+ /*
+ * Endianness-swap. The Curve25519 algorithm definition
+ * assumes you were doing your computation in arrays of 32
+ * little-endian bytes, and now specifies that you take your
+ * final one of those and convert it into a bignum in
+ * _network_ byte order, i.e. big-endian.
+ *
+ * In particular, the spec says, you convert the _whole_ 32
+ * bytes into a bignum. That is, on the rare occasions that
+ * p->x has come out with the most significant 8 bits zero, we
+ * have to imagine that being represented by a 32-byte string
+ * with the last byte being zero, so that has to be converted
+ * into an SSH-2 bignum with the _low_ byte zero, i.e. a
+ * multiple of 256.
+ */
int i;
- int bytes = (bignum_bitcount(ret)+7) / 8;
+ int bytes = (p->curve->fieldBits+7) / 8;
unsigned char *byteorder = snewn(bytes, unsigned char);
for (i = 0; i < bytes; ++i) {
byteorder[i] = bignum_byte(ret, i);
}
freebn(ret);
ret = bignum_from_bytes(byteorder, bytes);
+ smemclr(byteorder, bytes);
sfree(byteorder);
}
return ret;
}
+const char *ssh_ecdhkex_curve_textname(const struct ssh_kex *kex)
+{
+ const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;
+ struct ec_curve *curve = extra->curve();
+ return curve->textname;
+}
+
void *ssh_ecdhkex_newkey(const struct ssh_kex *kex)
{
const struct eckex_extra *extra = (const struct eckex_extra *)kex->extra;
bytes[0] &= 248;
bytes[31] &= 127;
bytes[31] |= 64;
- key->privateKey = bignum_from_bytes(bytes, sizeof(bytes));
- for (i = 0; i < sizeof(bytes); ++i)
- {
- ((volatile char*)bytes)[i] = 0;
- }
+ key->privateKey = bignum_from_bytes_le(bytes, sizeof(bytes));
+ smemclr(bytes, sizeof(bytes));
if (!key->privateKey) {
sfree(key);
return NULL;
return extra->oid;
}
-const int ec_nist_alg_and_curve_by_bits(int bits,
- const struct ec_curve **curve,
- const struct ssh_signkey **alg)
+const int ec_nist_curve_lengths[] = { 256, 384, 521 };
+const int n_ec_nist_curve_lengths = lenof(ec_nist_curve_lengths);
+
+int ec_nist_alg_and_curve_by_bits(int bits,
+ const struct ec_curve **curve,
+ const struct ssh_signkey **alg)
{
switch (bits) {
case 256: *alg = &ssh_ecdsa_nistp256; break;
return TRUE;
}
-const int ec_ed_alg_and_curve_by_bits(int bits,
- const struct ec_curve **curve,
- const struct ssh_signkey **alg)
+int ec_ed_alg_and_curve_by_bits(int bits,
+ const struct ec_curve **curve,
+ const struct ssh_signkey **alg)
{
switch (bits) {
case 256: *alg = &ssh_ecdsa_ed25519; break;
projects / PuTTY.git / blobdiff