libsodium: Needed for Dnscrypto-proxy Release 1.3.0
[tomato.git] / release / src / router / libsodium / src / libsodium / crypto_sign / edwards25519sha512batch / ref / sign_edwards25519sha512batch.c
blob885d7b1abe9fdbf414a53a277dfdaed7fe220745
1 #include "api.h"
2 #include "crypto_hash_sha512.h"
3 #include "randombytes.h"
4 #include "crypto_verify_32.h"
6 #include "ge25519.h"
8 int crypto_sign_keypair(
9 unsigned char *pk,
10 unsigned char *sk
13 sc25519 scsk;
14 ge25519 gepk;
16 randombytes(sk, 32);
17 crypto_hash_sha512(sk, sk, 32);
18 sk[0] &= 248;
19 sk[31] &= 127;
20 sk[31] |= 64;
22 sc25519_from32bytes(&scsk,sk);
24 ge25519_scalarmult_base(&gepk, &scsk);
25 ge25519_pack(pk, &gepk);
26 return 0;
29 int crypto_sign(
30 unsigned char *sm,unsigned long long *smlen,
31 const unsigned char *m,unsigned long long mlen,
32 const unsigned char *sk
35 sc25519 sck, scs, scsk;
36 ge25519 ger;
37 unsigned char r[32];
38 unsigned char s[32];
39 unsigned long long i;
40 unsigned char hmg[crypto_hash_sha512_BYTES];
41 unsigned char hmr[crypto_hash_sha512_BYTES];
43 *smlen = mlen+64;
44 for(i=0;i<mlen;i++)
45 sm[32 + i] = m[i];
46 for(i=0;i<32;i++)
47 sm[i] = sk[32+i];
48 crypto_hash_sha512(hmg, sm, mlen+32); /* Generate k as h(m,sk[32],...,sk[63]) */
50 sc25519_from64bytes(&sck, hmg);
51 ge25519_scalarmult_base(&ger, &sck);
52 ge25519_pack(r, &ger);
54 for(i=0;i<32;i++)
55 sm[i] = r[i];
57 crypto_hash_sha512(hmr, sm, mlen+32); /* Compute h(m,r) */
58 sc25519_from64bytes(&scs, hmr);
59 sc25519_mul(&scs, &scs, &sck);
61 sc25519_from32bytes(&scsk, sk);
62 sc25519_add(&scs, &scs, &scsk);
64 sc25519_to32bytes(s,&scs); /* cat s */
65 for(i=0;i<32;i++)
66 sm[mlen+32+i] = s[i];
68 return 0;
71 int crypto_sign_open(
72 unsigned char *m,unsigned long long *mlen,
73 const unsigned char *sm,unsigned long long smlen,
74 const unsigned char *pk
77 unsigned long long i;
78 unsigned char t1[32], t2[32];
79 ge25519 get1, get2, gepk;
80 sc25519 schmr, scs;
81 unsigned char hmr[crypto_hash_sha512_BYTES];
83 if (ge25519_unpack_vartime(&get1, sm)) return -1;
84 if (ge25519_unpack_vartime(&gepk, pk)) return -1;
86 crypto_hash_sha512(hmr,sm,smlen-32);
88 sc25519_from64bytes(&schmr, hmr);
89 ge25519_scalarmult(&get1, &get1, &schmr);
90 ge25519_add(&get1, &get1, &gepk);
91 ge25519_pack(t1, &get1);
93 sc25519_from32bytes(&scs, &sm[smlen-32]);
94 ge25519_scalarmult_base(&get2, &scs);
95 ge25519_pack(t2, &get2);
97 for(i=0;i<smlen-64;i++)
98 m[i] = sm[i + 32];
99 *mlen = smlen-64;
101 return crypto_verify_32(t1, t2);