release/src/router/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sign_edwards25519sha512batch.c

   1 #include "api.h"
   2 #include "crypto_hash_sha512.h"
   3 #include "randombytes.h"
   4 #include "crypto_verify_32.h"
   5
   6 #include "ge25519.h"
   7
   8 int crypto_sign_keypair(
   9     unsigned char *pk,
  10     unsigned char *sk
  11     )
  12 {
  13   sc25519 scsk;
  14   ge25519 gepk;
  15
  16   randombytes(sk, 32);
  17   crypto_hash_sha512(sk, sk, 32);
  18   sk[0] &= 248;
  19   sk[31] &= 127;
  20   sk[31] |= 64;
  21
  22   sc25519_from32bytes(&scsk,sk);
  23
  24   ge25519_scalarmult_base(&gepk, &scsk);
  25   ge25519_pack(pk, &gepk);
  26   return 0;
  27 }
  28
  29 int crypto_sign(
  30     unsigned char *sm,unsigned long long *smlen,
  31     const unsigned char *m,unsigned long long mlen,
  32     const unsigned char *sk
  33     )
  34 {
  35   sc25519 sck, scs, scsk;
  36   ge25519 ger;
  37   unsigned char r[32];
  38   unsigned char s[32];
  39   unsigned long long i;
  40   unsigned char hmg[crypto_hash_sha512_BYTES];
  41   unsigned char hmr[crypto_hash_sha512_BYTES];
  42
  43   *smlen = mlen+64;
  44   for(i=0;i<mlen;i++)
  45     sm[32 + i] = m[i];
  46   for(i=0;i<32;i++)
  47     sm[i] = sk[32+i];
  48   crypto_hash_sha512(hmg, sm, mlen+32); /* Generate k as h(m,sk[32],...,sk[63]) */
  49
  50   sc25519_from64bytes(&sck, hmg);
  51   ge25519_scalarmult_base(&ger, &sck);
  52   ge25519_pack(r, &ger);
  53
  54   for(i=0;i<32;i++)
  55     sm[i] = r[i];
  56
  57   crypto_hash_sha512(hmr, sm, mlen+32); /* Compute h(m,r) */
  58   sc25519_from64bytes(&scs, hmr);
  59   sc25519_mul(&scs, &scs, &sck);
  60
  61   sc25519_from32bytes(&scsk, sk);
  62   sc25519_add(&scs, &scs, &scsk);
  63
  64   sc25519_to32bytes(s,&scs); /* cat s */
  65   for(i=0;i<32;i++)
  66     sm[mlen+32+i] = s[i];
  67
  68   return 0;
  69 }
  70
  71 int crypto_sign_open(
  72     unsigned char *m,unsigned long long *mlen,
  73     const unsigned char *sm,unsigned long long smlen,
  74     const unsigned char *pk
  75     )
  76 {
  77   unsigned long long i;
  78   unsigned char t1[32], t2[32];
  79   ge25519 get1, get2, gepk;
  80   sc25519 schmr, scs;
  81   unsigned char hmr[crypto_hash_sha512_BYTES];
  82
  83   if (ge25519_unpack_vartime(&get1, sm)) return -1;
  84   if (ge25519_unpack_vartime(&gepk, pk)) return -1;
  85
  86   crypto_hash_sha512(hmr,sm,smlen-32);
  87
  88   sc25519_from64bytes(&schmr, hmr);
  89   ge25519_scalarmult(&get1, &get1, &schmr);
  90   ge25519_add(&get1, &get1, &gepk);
  91   ge25519_pack(t1, &get1);
  92
  93   sc25519_from32bytes(&scs, &sm[smlen-32]);
  94   ge25519_scalarmult_base(&get2, &scs);
  95   ge25519_pack(t2, &get2);
  96
  97   for(i=0;i<smlen-64;i++)
  98     m[i] = sm[i + 32];
  99   *mlen = smlen-64;
 100
 101   return crypto_verify_32(t1, t2);
 102 }