1 /* Copyright (c) 2020, Google Inc. 2 * 3 * Permission to use, copy, modify, and/or distribute this software for any 4 * purpose with or without fee is hereby granted, provided that the above 5 * copyright notice and this permission notice appear in all copies. 6 * 7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ 14 15 #ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H 16 #define OPENSSL_HEADER_CURVE25519_INTERNAL_H 17 18 #include <openssl/curve25519.h> 19 20 #include "../internal.h" 21 22 #if defined(__cplusplus) 23 extern "C" { 24 #endif 25 26 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE) 27 #define BORINGSSL_X25519_NEON 28 29 // x25519_NEON is defined in asm/x25519-arm.S. 30 void x25519_NEON(uint8_t out[32], const uint8_t scalar[32], 31 const uint8_t point[32]); 32 #endif 33 34 #if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \ 35 defined(__GNUC__) && defined(__x86_64__) && !defined(OPENSSL_WINDOWS) 36 #define BORINGSSL_FE25519_ADX 37 38 // fiat_curve25519_adx_mul is defined in 39 // third_party/fiat/asm/fiat_curve25519_adx_mul.S 40 void __attribute__((sysv_abi)) 41 fiat_curve25519_adx_mul(uint64_t out[4], const uint64_t in1[4], 42 const uint64_t in2[4]); 43 44 // fiat_curve25519_adx_square is defined in 45 // third_party/fiat/asm/fiat_curve25519_adx_square.S 46 void __attribute__((sysv_abi)) 47 fiat_curve25519_adx_square(uint64_t out[4], const uint64_t in[4]); 48 49 // x25519_scalar_mult_adx is defined in third_party/fiat/curve25519_64_adx.h 50 void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32], 51 const uint8_t point[32]); 52 void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]); 53 #endif 54 55 #if defined(OPENSSL_64_BIT) 56 // fe means field element. Here the field is \Z/(2^255-19). An element t, 57 // entries t[0]...t[4], represents the integer t[0]+2^51 t[1]+2^102 t[2]+2^153 58 // t[3]+2^204 t[4]. 59 // fe limbs are bounded by 1.125*2^51. 60 // Multiplication and carrying produce fe from fe_loose. 61 typedef struct fe { uint64_t v[5]; } fe; 62 63 // fe_loose limbs are bounded by 3.375*2^51. 64 // Addition and subtraction produce fe_loose from (fe, fe). 65 typedef struct fe_loose { uint64_t v[5]; } fe_loose; 66 #else 67 // fe means field element. Here the field is \Z/(2^255-19). An element t, 68 // entries t[0]...t[9], represents the integer t[0]+2^26 t[1]+2^51 t[2]+2^77 69 // t[3]+2^102 t[4]+...+2^230 t[9]. 70 // fe limbs are bounded by 1.125*2^26,1.125*2^25,1.125*2^26,1.125*2^25,etc. 71 // Multiplication and carrying produce fe from fe_loose. 72 typedef struct fe { uint32_t v[10]; } fe; 73 74 // fe_loose limbs are bounded by 3.375*2^26,3.375*2^25,3.375*2^26,3.375*2^25,etc. 75 // Addition and subtraction produce fe_loose from (fe, fe). 76 typedef struct fe_loose { uint32_t v[10]; } fe_loose; 77 #endif 78 79 // ge means group element. 80 // 81 // Here the group is the set of pairs (x,y) of field elements (see fe.h) 82 // satisfying -x^2 + y^2 = 1 + d x^2y^2 83 // where d = -121665/121666. 84 // 85 // Representations: 86 // ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z 87 // ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT 88 // ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T 89 // ge_precomp (Duif): (y+x,y-x,2dxy) 90 91 typedef struct { 92 fe X; 93 fe Y; 94 fe Z; 95 } ge_p2; 96 97 typedef struct { 98 fe X; 99 fe Y; 100 fe Z; 101 fe T; 102 } ge_p3; 103 104 typedef struct { 105 fe_loose X; 106 fe_loose Y; 107 fe_loose Z; 108 fe_loose T; 109 } ge_p1p1; 110 111 typedef struct { 112 fe_loose yplusx; 113 fe_loose yminusx; 114 fe_loose xy2d; 115 } ge_precomp; 116 117 typedef struct { 118 fe_loose YplusX; 119 fe_loose YminusX; 120 fe_loose Z; 121 fe_loose T2d; 122 } ge_cached; 123 124 void x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h); 125 int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]); 126 void x25519_ge_p3_to_cached(ge_cached *r, const ge_p3 *p); 127 void x25519_ge_p1p1_to_p2(ge_p2 *r, const ge_p1p1 *p); 128 void x25519_ge_p1p1_to_p3(ge_p3 *r, const ge_p1p1 *p); 129 void x25519_ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q); 130 void x25519_ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q); 131 void x25519_ge_scalarmult_small_precomp( 132 ge_p3 *h, const uint8_t a[32], const uint8_t precomp_table[15 * 2 * 32]); 133 void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]); 134 void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A); 135 void x25519_sc_reduce(uint8_t s[64]); 136 137 enum spake2_state_t { 138 spake2_state_init = 0, 139 spake2_state_msg_generated, 140 spake2_state_key_generated, 141 }; 142 143 struct spake2_ctx_st { 144 uint8_t private_key[32]; 145 uint8_t my_msg[32]; 146 uint8_t password_scalar[32]; 147 uint8_t password_hash[64]; 148 uint8_t *my_name; 149 size_t my_name_len; 150 uint8_t *their_name; 151 size_t their_name_len; 152 enum spake2_role_t my_role; 153 enum spake2_state_t state; 154 char disable_password_scalar_hack; 155 }; 156 157 158 extern const uint8_t k25519Precomp[32][8][3][32]; 159 160 #if defined(__cplusplus) 161 } // extern C 162 #endif 163 164 #endif // OPENSSL_HEADER_CURVE25519_INTERNAL_H 165