authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-10-25 21:55:05+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-10-25 21:55:05+01:00
log0c7a99b38d2fb881cde5125ef0729ff0427c06a6
tree5d9fef96a97108ab487d3ab1713a0a13a7dbf339
parent28fb97f1885ea54dd2a1ee2d06b2a73b009b1850

Move ed25519 key pairs to a KeyPair structure

2 files changed, 65 insertions(+), 63 deletions(-)

lib/std/crypto/25519/ed25519.zig+60-50
......@@ -5,6 +5,7 @@
55// and substantial portions of the software.
66const std = @import("std");
77const crypto = std.crypto;
8const debug = std.debug;
89const fmt = std.fmt;
910const mem = std.mem;
1011const Sha512 = std.crypto.hash.sha2.Sha512;
......@@ -15,8 +16,8 @@ pub const Ed25519 = struct {
1516 pub const Curve = @import("edwards25519.zig").Edwards25519;
1617 /// Length (in bytes) of a seed required to create a key pair.
1718 pub const seed_length = 32;
18 /// Length (in bytes) of a compressed key pair.
19 pub const keypair_length = 64;
19 /// Length (in bytes) of a compressed secret key.
20 pub const secret_length = 64;
2021 /// Length (in bytes) of a compressed public key.
2122 pub const public_length = 32;
2223 /// Length (in bytes) of a signature.
......@@ -24,46 +25,61 @@ pub const Ed25519 = struct {
2425 /// Length (in bytes) of optional random bytes, for non-deterministic signatures.
2526 pub const noise_length = 32;
2627
27 /// Derive a key pair from a secret seed.
28 ///
29 /// As in RFC 8032, an Ed25519 public key is generated by hashing
30 /// the secret key using the SHA-512 function, and interpreting the
31 /// bit-swapped, clamped lower-half of the output as the secret scalar.
32 ///
33 /// For this reason, an EdDSA secret key is commonly called a seed,
34 /// from which the actual secret is derived.
35 pub fn createKeyPair(seed: ?[seed_length]u8) ![keypair_length]u8 {
36 const sk = seed orelse sk: {
37 var random_seed: [seed_length]u8 = undefined;
38 try crypto.randomBytes(&random_seed);
39 break :sk random_seed;
40 };
41 var az: [Sha512.digest_length]u8 = undefined;
42 var h = Sha512.init(.{});
43 h.update(&sk);
44 h.final(&az);
45 const p = try Curve.basePoint.clampedMul(az[0..32].*);
46 var keypair: [keypair_length]u8 = undefined;
47 mem.copy(u8, &keypair, &sk);
48 mem.copy(u8, keypair[seed_length..], &p.toBytes());
49 return keypair;
50 }
28 /// An Ed25519 key pair.
29 pub const KeyPair = struct {
30 /// Public part.
31 public_key: [public_length]u8,
32 /// Secret part. What we expose as a secret key is, under the hood, the concatenation of the seed and the public key.
33 secret_key: [secret_length]u8,
5134
52 /// Return the public key for a given key pair.
53 pub fn publicKey(key_pair: [keypair_length]u8) [public_length]u8 {
54 var public_key: [public_length]u8 = undefined;
55 mem.copy(u8, public_key[0..], key_pair[seed_length..]);
56 return public_key;
57 }
35 /// Derive a key pair from an optional secret seed.
36 ///
37 /// As in RFC 8032, an Ed25519 public key is generated by hashing
38 /// the secret key using the SHA-512 function, and interpreting the
39 /// bit-swapped, clamped lower-half of the output as the secret scalar.
40 ///
41 /// For this reason, an EdDSA secret key is commonly called a seed,
42 /// from which the actual secret is derived.
43 pub fn create(seed: ?[seed_length]u8) !KeyPair {
44 const ss = seed orelse ss: {
45 var random_seed: [seed_length]u8 = undefined;
46 try crypto.randomBytes(&random_seed);
47 break :ss random_seed;
48 };
49 var az: [Sha512.digest_length]u8 = undefined;
50 var h = Sha512.init(.{});
51 h.update(&ss);
52 h.final(&az);
53 const p = try Curve.basePoint.clampedMul(az[0..32].*);
54 var sk: [secret_length]u8 = undefined;
55 mem.copy(u8, &sk, &ss);
56 const pk = p.toBytes();
57 mem.copy(u8, sk[seed_length..], &pk);
58
59 return KeyPair{ .public_key = pk, .secret_key = sk };
60 }
61
62 /// Create a KeyPair from a secret key.
63 pub fn fromSecretKey(secret_key: [secret_length]u8) KeyPair {
64 return KeyPair{
65 .secret_key = secret_key,
66 .public_key = secret_key[seed_length..].*,
67 };
68 }
69 };
5870
5971 /// Sign a message using a key pair, and optional random noise.
6072 /// Having noise creates non-standard, non-deterministic signatures,
6173 /// but has been proven to increase resilience against fault attacks.
62 pub fn sign(msg: []const u8, key_pair: [keypair_length]u8, noise: ?[noise_length]u8) ![signature_length]u8 {
63 const public_key = key_pair[32..];
74 pub fn sign(msg: []const u8, key_pair: KeyPair, noise: ?[noise_length]u8) ![signature_length]u8 {
75 const seed = key_pair.secret_key[0..seed_length];
76 const public_key = key_pair.secret_key[seed_length..];
77 if (!mem.eql(u8, public_key, &key_pair.public_key)) {
78 return error.KeyMismatch;
79 }
6480 var az: [Sha512.digest_length]u8 = undefined;
6581 var h = Sha512.init(.{});
66 h.update(key_pair[0..seed_length]);
82 h.update(seed);
6783 h.final(&az);
6884
6985 h = Sha512.init(.{});
......@@ -192,50 +208,44 @@ pub const Ed25519 = struct {
192208test "ed25519 key pair creation" {
193209 var seed: [32]u8 = undefined;
194210 try fmt.hexToBytes(seed[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");
195 const key_pair = try Ed25519.createKeyPair(seed);
211 const key_pair = try Ed25519.KeyPair.create(seed);
196212 var buf: [256]u8 = undefined;
197 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{key_pair}), "8052030376D47112BE7F73ED7A019293DD12AD910B654455798B4667D73DE1662D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
198
199 const public_key = Ed25519.publicKey(key_pair);
200 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{public_key}), "2D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
213 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{key_pair.secret_key}), "8052030376D47112BE7F73ED7A019293DD12AD910B654455798B4667D73DE1662D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
214 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{key_pair.public_key}), "2D6F7455D97B4A3A10D7293909D1A4F2058CB9A370E43FA8154BB280DB839083");
201215}
202216
203217test "ed25519 signature" {
204218 var seed: [32]u8 = undefined;
205219 try fmt.hexToBytes(seed[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");
206 const key_pair = try Ed25519.createKeyPair(seed);
220 const key_pair = try Ed25519.KeyPair.create(seed);
207221
208222 const sig = try Ed25519.sign("test", key_pair, null);
209223 var buf: [128]u8 = undefined;
210224 std.testing.expectEqualStrings(try std.fmt.bufPrint(&buf, "{X}", .{sig}), "10A442B4A80CC4225B154F43BEF28D2472CA80221951262EB8E0DF9091575E2687CC486E77263C3418C757522D54F84B0359236ABBBD4ACD20DC297FDCA66808");
211 const public_key = Ed25519.publicKey(key_pair);
212 try Ed25519.verify(sig, "test", public_key);
213 std.testing.expectError(error.InvalidSignature, Ed25519.verify(sig, "TEST", public_key));
225 try Ed25519.verify(sig, "test", key_pair.public_key);
226 std.testing.expectError(error.InvalidSignature, Ed25519.verify(sig, "TEST", key_pair.public_key));
214227}
215228
216229test "ed25519 batch verification" {
217230 var i: usize = 0;
218231 while (i < 100) : (i += 1) {
219 var seed: [32]u8 = undefined;
220 try std.crypto.randomBytes(&seed);
221 const key_pair = try Ed25519.createKeyPair(seed);
232 const key_pair = try Ed25519.KeyPair.create(null);
222233 var msg1: [32]u8 = undefined;
223234 var msg2: [32]u8 = undefined;
224235 try std.crypto.randomBytes(&msg1);
225236 try std.crypto.randomBytes(&msg2);
226237 const sig1 = try Ed25519.sign(&msg1, key_pair, null);
227238 const sig2 = try Ed25519.sign(&msg2, key_pair, null);
228 const public_key = Ed25519.publicKey(key_pair);
229239 var signature_batch = [_]Ed25519.BatchElement{
230240 Ed25519.BatchElement{
231241 .sig = sig1,
232242 .msg = &msg1,
233 .public_key = public_key,
243 .public_key = key_pair.public_key,
234244 },
235245 Ed25519.BatchElement{
236246 .sig = sig2,
237247 .msg = &msg2,
238 .public_key = public_key,
248 .public_key = key_pair.public_key,
239249 },
240250 };
241251 try Ed25519.verifyBatch(2, signature_batch);
lib/std/crypto/benchmark.zig+5-13
......@@ -124,10 +124,8 @@ pub fn benchmarkKeyExchange(comptime DhKeyExchange: anytype, comptime exchange_c
124124const signatures = [_]Crypto{Crypto{ .ty = crypto.sign.Ed25519, .name = "ed25519" }};
125125
126126pub fn benchmarkSignature(comptime Signature: anytype, comptime signatures_count: comptime_int) !u64 {
127 var seed: [Signature.seed_length]u8 = undefined;
128 prng.random.bytes(seed[0..]);
129127 const msg = [_]u8{0} ** 64;
130 const key_pair = try Signature.createKeyPair(seed);
128 const key_pair = try Signature.KeyPair.create(null);
131129
132130 var timer = try Timer.start();
133131 const start = timer.lap();
......@@ -149,11 +147,8 @@ pub fn benchmarkSignature(comptime Signature: anytype, comptime signatures_count
149147const signature_verifications = [_]Crypto{Crypto{ .ty = crypto.sign.Ed25519, .name = "ed25519" }};
150148
151149pub fn benchmarkSignatureVerification(comptime Signature: anytype, comptime signatures_count: comptime_int) !u64 {
152 var seed: [Signature.seed_length]u8 = undefined;
153 prng.random.bytes(seed[0..]);
154150 const msg = [_]u8{0} ** 64;
155 const key_pair = try Signature.createKeyPair(seed);
156 const public_key = Signature.publicKey(key_pair);
151 const key_pair = try Signature.KeyPair.create(null);
157152 const sig = try Signature.sign(&msg, key_pair, null);
158153
159154 var timer = try Timer.start();
......@@ -161,7 +156,7 @@ pub fn benchmarkSignatureVerification(comptime Signature: anytype, comptime sign
161156 {
162157 var i: usize = 0;
163158 while (i < signatures_count) : (i += 1) {
164 try Signature.verify(sig, &msg, public_key);
159 try Signature.verify(sig, &msg, key_pair.public_key);
165160 mem.doNotOptimizeAway(&sig);
166161 }
167162 }
......@@ -176,16 +171,13 @@ pub fn benchmarkSignatureVerification(comptime Signature: anytype, comptime sign
176171const batch_signature_verifications = [_]Crypto{Crypto{ .ty = crypto.sign.Ed25519, .name = "ed25519" }};
177172
178173pub fn benchmarkBatchSignatureVerification(comptime Signature: anytype, comptime signatures_count: comptime_int) !u64 {
179 var seed: [Signature.seed_length]u8 = undefined;
180 prng.random.bytes(seed[0..]);
181174 const msg = [_]u8{0} ** 64;
182 const key_pair = try Signature.createKeyPair(seed);
183 const public_key = Signature.publicKey(key_pair);
175 const key_pair = try Signature.KeyPair.create(null);
184176 const sig = try Signature.sign(&msg, key_pair, null);
185177
186178 var batch: [64]Signature.BatchElement = undefined;
187179 for (batch) |*element| {
188 element.* = Signature.BatchElement{ .sig = sig, .msg = &msg, .public_key = public_key };
180 element.* = Signature.BatchElement{ .sig = sig, .msg = &msg, .public_key = key_pair.public_key };
189181 }
190182
191183 var timer = try Timer.start();