Add Ed25519 support, wrappers, and tests.

Taken from earlier ed25519 branch based on floodyberry's
ed25519-donna.  Tweaked so that it applies to ref10 instead.

5 files changed, 288 insertions, 10 deletions

diff --git a/src/common/crypto_curve25519.c b/src/common/crypto_curve25519.c
index 9e83440e16..290e88d7d8 100644
--- a/src/common/crypto_curve25519.c
+++ b/src/common/crypto_curve25519.c
@@ -63,26 +63,44 @@ curve25519_public_key_is_ok(const curve25519_public_key_t *key)
   return !safe_mem_is_zero(key->public_key, CURVE25519_PUBKEY_LEN);
 }
 
-/** Generate a new keypair and return the secret key.  If <b>extra_strong</b>
- * is true, this key is possibly going to get used more than once, so
- * use a better-than-usual RNG. Return 0 on success, -1 on failure. */
+/**
+ * Generate CURVE25519_SECKEY_LEN random bytes in <b>out</b>. If
+ * <b>extra_strong</b> is true, this key is possibly going to get used more
+ * than once, so use a better-than-usual RNG. Return 0 on success, -1 on
+ * failure.
+ *
+ * This function does not adjust the output of the RNG at all; the will caller
+ * will need to clear or set the appropriate bits to make curve25519 work.
+ */
 int
-curve25519_secret_key_generate(curve25519_secret_key_t *key_out,
-                               int extra_strong)
+curve25519_rand_seckey_bytes(uint8_t *out, int extra_strong)
 {
   uint8_t k_tmp[CURVE25519_SECKEY_LEN];
 
-  if (crypto_rand((char*)key_out->secret_key, CURVE25519_SECKEY_LEN) < 0)
+  if (crypto_rand((char*)out, CURVE25519_SECKEY_LEN) < 0)
     return -1;
   if (extra_strong && !crypto_strongest_rand(k_tmp, CURVE25519_SECKEY_LEN)) {
     /* If they asked for extra-strong entropy and we have some, use it as an
      * HMAC key to improve not-so-good entropy rather than using it directly,
      * just in case the extra-strong entropy is less amazing than we hoped. */
-    crypto_hmac_sha256((char *)key_out->secret_key,
-                    (const char *)k_tmp, sizeof(k_tmp),
-                    (const char *)key_out->secret_key, CURVE25519_SECKEY_LEN);
+    crypto_hmac_sha256((char*) out,
+                       (const char *)k_tmp, sizeof(k_tmp),
+                       (const char *)out, CURVE25519_SECKEY_LEN);
   }
   memwipe(k_tmp, 0, sizeof(k_tmp));
+  return 0;
+}
+
+/** Generate a new keypair and return the secret key.  If <b>extra_strong</b>
+ * is true, this key is possibly going to get used more than once, so
+ * use a better-than-usual RNG. Return 0 on success, -1 on failure. */
+int
+curve25519_secret_key_generate(curve25519_secret_key_t *key_out,
+                               int extra_strong)
+{
+  if (curve25519_rand_seckey_bytes(key_out->secret_key, extra_strong) < 0)
+    return -1;
+
   key_out->secret_key[0] &= 248;
   key_out->secret_key[31] &= 127;
   key_out->secret_key[31] |= 64;
diff --git a/src/common/crypto_curve25519.h b/src/common/crypto_curve25519.h
index 57018ac2f5..fece2feb19 100644
--- a/src/common/crypto_curve25519.h
+++ b/src/common/crypto_curve25519.h
@@ -57,6 +57,8 @@ int curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out,
                                       char **tag_out,
                                       const char *fname);
 
+int curve25519_rand_seckey_bytes(uint8_t *out, int extra_strong);
+
 #ifdef CRYPTO_CURVE25519_PRIVATE
 STATIC int curve25519_impl(uint8_t *output, const uint8_t *secret,
                            const uint8_t *basepoint);
diff --git a/src/common/crypto_ed25519.c b/src/common/crypto_ed25519.c
new file mode 100644
index 0000000000..c39f4f4fe2
--- /dev/null
+++ b/src/common/crypto_ed25519.c
@@ -0,0 +1,181 @@
+/* Copyright (c) 2013, The Tor Project, Inc. */
+/* See LICENSE for licensing information */
+
+/* Wrapper code for an ed25519 implementation. */
+
+#include "orconfig.h"
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+
+#include "crypto.h"
+
+#include "crypto_curve25519.h"
+#include "crypto_ed25519.h"
+#include "torlog.h"
+#include "util.h"
+
+#include "ed25519/ref10/ed25519_ref10.h"
+
+int
+ed25519_secret_key_generate(ed25519_secret_key_t *seckey_out,
+                        int extra_strong)
+{
+  (void) extra_strong;
+  if (ed25519_ref10_seckey(seckey_out->seckey) < 0)
+    return -1;
+  return 0;
+}
+
+int
+ed25519_public_key_generate(ed25519_public_key_t *pubkey_out,
+                        const ed25519_secret_key_t *seckey)
+{
+  if (ed25519_ref10_pubkey(pubkey_out->pubkey, seckey->seckey) < 0)
+    return -1;
+  return 0;
+}
+
+/** Generate a new ed25519 keypair in <b>keypair_out</b>.  If
+ * <b>extra_strong</b> is set, try to mix some system entropy into the key
+ * generation process. Return 0 on success, -1 on failure. */
+int
+ed25519_keypair_generate(ed25519_keypair_t *keypair_out, int extra_strong)
+{
+  (void) extra_strong;
+
+  if (ed25519_ref10_keygen(keypair_out->pubkey.pubkey,
+                           keypair_out->seckey.seckey)<0)
+    return -1;
+  return 0;
+}
+
+/**
+ * Set <b>signature_out</b> to a signature of the <b>len</b>-byte message
+ * <b>msg</b>, using the secret and public key in <b>keypair</b>.
+ */
+int
+ed25519_sign(ed25519_signature_t *signature_out,
+             const uint8_t *msg, size_t len,
+             const ed25519_keypair_t *keypair)
+{
+  uint8_t keys[64];
+  uint8_t *tmp;
+  uint64_t tmplen;
+
+  /* XXXX Make crypto_sign in ref10 friendlier so we don't need this stupid
+   * copying. */
+  tor_assert(len < SIZE_T_CEILING - 64);
+  tmplen = ((uint64_t)len) + 64;
+  tmp = tor_malloc(tmplen);
+
+  memcpy(keys, keypair->seckey.seckey, 32);
+  memcpy(keys+32, keypair->pubkey.pubkey, 32);
+
+  if (ed25519_ref10_sign(tmp, &tmplen, msg, len, keys) < 0) {
+    tor_free(tmp);
+    return -1;
+  }
+
+  memcpy(signature_out->sig, tmp, 64);
+  memwipe(keys, 0, sizeof(keys));
+
+  tor_free(tmp);
+
+  return 0;
+}
+
+/**
+ * Check whether if <b>signature</b> is a valid signature for the
+ * <b>len</b>-byte message in <b>msg</b> made with the key <b>pubkey</b>.
+ *
+ * Return 0 if the signature is valid; -1 if it isn't.
+ */
+int
+ed25519_checksig(const ed25519_signature_t *signature,
+                 const uint8_t *msg, size_t len,
+                 const ed25519_public_key_t *pubkey)
+{
+  uint8_t *smtmp;
+  uint8_t *tmp;
+  uint64_t tmplen;
+  int r;
+
+  tor_assert(len < SIZE_T_CEILING - 64);
+  tmplen = len + 64;
+  tmp = tor_malloc(tmplen);
+  smtmp = tor_malloc(tmplen);
+  memcpy(smtmp, signature->sig, 64);
+  memcpy(smtmp+64, msg, len);
+
+  r = ed25519_ref10_open(tmp, &tmplen, smtmp, tmplen, pubkey->pubkey);
+
+  tor_free(tmp);
+  tor_free(smtmp);
+
+  return r;
+}
+
+/** Validate every signature among those in <b>checkable</b>, which contains
+ * exactly <b>n_checkable</b> elements.  If <b>okay_out</b> is non-NULL, set
+ * the i'th element of <b>okay_out</b> to 1 if the i'th element of
+ * <b>checkable</b> is valid, and to 0 otherwise.  Return 0 if every signature
+ * was valid. Otherwise return -N, where N is the number of invalid
+ * signatures.
+ */
+int
+ed25519_checksig_batch(int *okay_out,
+                       const ed25519_checkable_t *checkable,
+                       int n_checkable)
+{
+  int res, i;
+
+  res = 0;
+  for (i = 0; i < n_checkable; ++i) {
+    const ed25519_checkable_t *ch = &checkable[i];
+    int r = ed25519_checksig(&ch->signature, ch->msg, ch->len, ch->pubkey);
+    if (r < 0)
+      --res;
+    if (okay_out)
+      okay_out[i] = (r == 0);
+  }
+
+#if 0
+  const uint8_t **ms;
+  size_t *lens;
+  const uint8_t **pks;
+  const uint8_t **sigs;
+  int *oks;
+
+  ms = tor_malloc(sizeof(uint8_t*)*n_checkable);
+  lens = tor_malloc(sizeof(size_t)*n_checkable);
+  pks = tor_malloc(sizeof(uint8_t*)*n_checkable);
+  sigs = tor_malloc(sizeof(uint8_t*)*n_checkable);
+  oks = okay_out ? okay_out : tor_malloc(sizeof(int)*n_checkable);
+
+  for (i = 0; i < n_checkable; ++i) {
+    ms[i] = checkable[i].msg;
+    lens[i] = checkable[i].len;
+    pks[i] = checkable[i].pubkey->pubkey;
+    sigs[i] = checkable[i].signature.sig;
+    oks[i] = 0;
+  }
+
+  ed25519_sign_open_batch_donna_fb(ms, lens, pks, sigs, n_checkable, oks);
+
+  res = 0;
+  for (i = 0; i < n_checkable; ++i) {
+    if (!oks[i])
+      --res;
+  }
+
+  tor_free(ms);
+  tor_free(lens);
+  tor_free(pks);
+  if (! okay_out)
+    tor_free(oks);
+#endif
+
+  return res;
+}
+
diff --git a/src/common/crypto_ed25519.h b/src/common/crypto_ed25519.h
new file mode 100644
index 0000000000..6b00c3d043
--- /dev/null
+++ b/src/common/crypto_ed25519.h
@@ -0,0 +1,72 @@
+/* Copyright (c) 2012-2013, The Tor Project, Inc. */
+/* See LICENSE for licensing information */
+
+#ifndef TOR_CRYPTO_ED25519_H
+#define TOR_CRYPTO_ED25519_H
+
+#include "testsupport.h"
+#include "torint.h"
+
+#define ED25519_PUBKEY_LEN 32
+#define ED25519_SECKEY_LEN 32
+#define ED25519_SIG_LEN 64
+
+/** An Ed25519 signature. */
+typedef struct {
+  uint8_t sig[ED25519_SIG_LEN];
+} ed25519_signature_t;
+
+/** An Ed25519 public key */
+typedef struct {
+  uint8_t pubkey[ED25519_PUBKEY_LEN];
+} ed25519_public_key_t;
+
+/** An Ed25519 secret key */
+typedef struct {
+  uint8_t seckey[ED25519_SECKEY_LEN];
+} ed25519_secret_key_t;
+
+/** An Ed25519 keypair. */
+typedef struct {
+  ed25519_public_key_t pubkey;
+  ed25519_secret_key_t seckey;
+} ed25519_keypair_t;
+
+#ifdef CURVE25519_ENABLED
+int ed25519_secret_key_generate(ed25519_secret_key_t *seckey_out,
+                            int extra_strong);
+int ed25519_public_key_generate(ed25519_public_key_t *pubkey_out,
+                            const ed25519_secret_key_t *seckey);
+int ed25519_keypair_generate(ed25519_keypair_t *keypair_out, int extra_strong);
+int ed25519_sign(ed25519_signature_t *signature_out,
+                 const uint8_t *msg, size_t len,
+                 const ed25519_keypair_t *key);
+int ed25519_checksig(const ed25519_signature_t *signature,
+                     const uint8_t *msg, size_t len,
+                     const ed25519_public_key_t *pubkey);
+
+/**
+ * A collection of information necessary to check an Ed25519 signature. Used
+ * for batch verification.
+ */
+typedef struct {
+  /** The public key that supposedly generated the signature. */
+  ed25519_public_key_t *pubkey;
+  /** The signature to check. */
+  ed25519_signature_t signature;
+  /** The message that the signature is supposed to have been applied to. */
+  const uint8_t *msg;
+  /** The length of the message. */
+  size_t len;
+} ed25519_checkable_t;
+
+int ed25519_checksig_batch(int *okay_out,
+                           const ed25519_checkable_t *checkable,
+                           int n_checkable);
+#endif
+
+/* XXXX write secret keys to disk, load secret keys from disk, read encrypted,
+ * write encrypted. serialize public. parse public. */
+
+#endif
+
diff --git a/src/common/include.am b/src/common/include.am
index 68e0110c26..8fc1ff95b7 100644
--- a/src/common/include.am
+++ b/src/common/include.am
@@ -52,8 +52,12 @@ LIBDONNA=
 endif
 endif
 
+LIBDONNA += $(LIBED25519_REF10)
+
 if CURVE25519_ENABLED
-libcrypto_extra_source=src/common/crypto_curve25519.c
+libcrypto_extra_source = \
+	src/common/crypto_curve25519.c \
+	src/common/crypto_ed25519.c
 endif
 
 LIBOR_A_SOURCES = \
@@ -110,6 +114,7 @@ COMMONHEADERS = \
   src/common/container.h			\
   src/common/crypto.h				\
   src/common/crypto_curve25519.h		\
+  src/common/crypto_ed25519.h			\
   src/common/di_ops.h				\
   src/common/memarea.h				\
   src/common/linux_syscalls.inc			\