Alawn/shadowsocks-libev
1
0
Fork 0
mirror of https://github.com/shadowsocks/shadowsocks-libev.git synced 2026-11-02 07:53:43 +00:00
Code Releases Activity

Clean up

Browse Source
This commit is contained in:
Max Lv
2015-12-14 09:39:53 +08:00
parent 96f750f52c
commit 72ea070b1d
63 changed files with 0 additions and 1968 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libsodium/src/libsodium/crypto_auth/hmacsha256/checksum
-1
View File
@@ -1 +0,0 @@
3bd7abd4f4dce04396f2ac7cb1cff70607f692411c49a1563b037d31e1662632
libsodium/src/libsodium/crypto_auth/hmacsha256/cp/api.h
-9
View File
@@ -1,9 +0,0 @@
#include "crypto_auth_hmacsha256.h"
#define crypto_auth crypto_auth_hmacsha256
#define crypto_auth_verify crypto_auth_hmacsha256_verify
#define crypto_auth_BYTES crypto_auth_hmacsha256_BYTES
#define crypto_auth_KEYBYTES crypto_auth_hmacsha256_KEYBYTES
#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha256_IMPLEMENTATION
#define crypto_auth_VERSION crypto_auth_hmacsha256_VERSION
libsodium/src/libsodium/crypto_auth/hmacsha512/cp/api.h
-9
View File
@@ -1,9 +0,0 @@
#include "crypto_auth_hmacsha512.h"
#define crypto_auth crypto_auth_hmacsha512
#define crypto_auth_verify crypto_auth_hmacsha512_verify
#define crypto_auth_BYTES crypto_auth_hmacsha512_BYTES
#define crypto_auth_KEYBYTES crypto_auth_hmacsha512_KEYBYTES
#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512_IMPLEMENTATION
#define crypto_auth_VERSION crypto_auth_hmacsha512_VERSION
libsodium/src/libsodium/crypto_auth/hmacsha512256/checksum
-1
View File
@@ -1 +0,0 @@
2f5e8a6a0cac012d8d001351d7d583e69f91390df46305c3608e0c2893491886
libsodium/src/libsodium/crypto_auth/hmacsha512256/cp/api.h
-9
View File
@@ -1,9 +0,0 @@
#include "crypto_auth_hmacsha512256.h"
#define crypto_auth crypto_auth_hmacsha512256
#define crypto_auth_verify crypto_auth_hmacsha512256_verify
#define crypto_auth_BYTES crypto_auth_hmacsha512256_BYTES
#define crypto_auth_KEYBYTES crypto_auth_hmacsha512256_KEYBYTES
#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512256_IMPLEMENTATION
#define crypto_auth_VERSION crypto_auth_hmacsha512256_VERSION
libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/checksum
-1
View File
@@ -1 +0,0 @@
5fac7400caabc14a99c5c0bc13fb1df5e468e870382a3a1c
libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/api.h
-20
View File
@@ -1,20 +0,0 @@
#include "crypto_box_curve25519xsalsa20poly1305.h"
#define crypto_box crypto_box_curve25519xsalsa20poly1305
#define crypto_box_open crypto_box_curve25519xsalsa20poly1305_open
#define crypto_box_seed_keypair crypto_box_curve25519xsalsa20poly1305_seed_keypair
#define crypto_box_keypair crypto_box_curve25519xsalsa20poly1305_keypair
#define crypto_box_beforenm crypto_box_curve25519xsalsa20poly1305_beforenm
#define crypto_box_afternm crypto_box_curve25519xsalsa20poly1305_afternm
#define crypto_box_open_afternm crypto_box_curve25519xsalsa20poly1305_open_afternm
#define crypto_box_SEEDBYTES crypto_box_curve25519xsalsa20poly1305_SEEDBYTES
#define crypto_box_PUBLICKEYBYTES crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES
#define crypto_box_SECRETKEYBYTES crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES
#define crypto_box_BEFORENMBYTES crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES
#define crypto_box_NONCEBYTES crypto_box_curve25519xsalsa20poly1305_NONCEBYTES
#define crypto_box_ZEROBYTES crypto_box_curve25519xsalsa20poly1305_ZEROBYTES
#define crypto_box_BOXZEROBYTES crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES
#define crypto_box_MACBYTES (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES)
#define crypto_box_IMPLEMENTATION crypto_box_curve25519xsalsa20poly1305_IMPLEMENTATION
#define crypto_box_VERSION crypto_box_curve25519xsalsa20poly1305_VERSION
libsodium/src/libsodium/crypto_core/hsalsa20/checksum
-1
View File
@@ -1 +0,0 @@
28ebe700b5878570702a68740aa131e6fa907e58a3f6915cd183c6db3f7afd7a
libsodium/src/libsodium/crypto_core/hsalsa20/ref2/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_core_hsalsa20.h"
#define crypto_core crypto_core_hsalsa20
#define crypto_core_OUTPUTBYTES crypto_core_hsalsa20_OUTPUTBYTES
#define crypto_core_INPUTBYTES crypto_core_hsalsa20_INPUTBYTES
#define crypto_core_KEYBYTES crypto_core_hsalsa20_KEYBYTES
#define crypto_core_CONSTBYTES crypto_core_hsalsa20_CONSTBYTES
#define crypto_core_IMPLEMENTATION crypto_core_hsalsa20_IMPLEMENTATION
#define crypto_core_VERSION crypto_core_hsalsa20_VERSION
libsodium/src/libsodium/crypto_core/salsa20/checksum
-1
View File
@@ -1 +0,0 @@
9d1ee8d84b974e648507ffd93829376c5b4420751710e44f6593abd8769378011d85ecda51ceb8f43661d3c65ef5b57c4f5bf8df76c8202784c8df8def61e6a6
libsodium/src/libsodium/crypto_core/salsa20/ref/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_core_salsa20.h"
#define crypto_core crypto_core_salsa20
#define crypto_core_OUTPUTBYTES crypto_core_salsa20_OUTPUTBYTES
#define crypto_core_INPUTBYTES crypto_core_salsa20_INPUTBYTES
#define crypto_core_KEYBYTES crypto_core_salsa20_KEYBYTES
#define crypto_core_CONSTBYTES crypto_core_salsa20_CONSTBYTES
#define crypto_core_IMPLEMENTATION crypto_core_salsa20_IMPLEMENTATION
#define crypto_core_VERSION crypto_core_salsa20_VERSION
libsodium/src/libsodium/crypto_core/salsa2012/checksum
-1
View File
@@ -1 +0,0 @@
f36d643f798efc0fca888d3ac4bdcc54c98a968c2da16bd5b8bfe9fe9025a6ca3a207e9362dc7cf17ddfc7477ee754d3f521b1df91640093754f7275b1a54293
libsodium/src/libsodium/crypto_core/salsa2012/ref/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_core_salsa2012.h"
#define crypto_core crypto_core_salsa2012
#define crypto_core_OUTPUTBYTES crypto_core_salsa2012_OUTPUTBYTES
#define crypto_core_INPUTBYTES crypto_core_salsa2012_INPUTBYTES
#define crypto_core_KEYBYTES crypto_core_salsa2012_KEYBYTES
#define crypto_core_CONSTBYTES crypto_core_salsa2012_CONSTBYTES
#define crypto_core_IMPLEMENTATION crypto_core_salsa2012_IMPLEMENTATION
#define crypto_core_VERSION crypto_core_salsa2012_VERSION
libsodium/src/libsodium/crypto_core/salsa208/checksum
-1
View File
@@ -1 +0,0 @@
1e13ea9e74cb36989f7cbf4abc80b29154e1a8b150bd5244951318abea002a93ae9fe2abbcf7217526ac2a85b66c256ba9374b1257eda0c01816da328edfa11a
libsodium/src/libsodium/crypto_core/salsa208/ref/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_core_salsa208.h"
#define crypto_core crypto_core_salsa208
#define crypto_core_OUTPUTBYTES crypto_core_salsa208_OUTPUTBYTES
#define crypto_core_INPUTBYTES crypto_core_salsa208_INPUTBYTES
#define crypto_core_KEYBYTES crypto_core_salsa208_KEYBYTES
#define crypto_core_CONSTBYTES crypto_core_salsa208_CONSTBYTES
#define crypto_core_IMPLEMENTATION crypto_core_salsa208_IMPLEMENTATION
#define crypto_core_VERSION crypto_core_salsa208_VERSION
libsodium/src/libsodium/crypto_generichash/blake2/ref/api.h
-2
View File
@@ -1,2 +0,0 @@
#include "crypto_generichash_blake2b.h"
libsodium/src/libsodium/crypto_hash/sha256/checksum
-1
View File
@@ -1 +0,0 @@
86df8bd202b2a2b5fdc04a7f50a591e43a345849c12fef08d487109648a08e05
libsodium/src/libsodium/crypto_hash/sha256/cp/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_hash_sha256.h"
#define crypto_hash crypto_hash_sha256
#define crypto_hash_init crypto_hash_sha256_init
#define crypto_hash_update crypto_hash_sha256_update
#define crypto_hash_final crypto_hash_sha256_final
#define crypto_hash_BYTES crypto_hash_sha256_BYTES
#define crypto_hash_IMPLEMENTATION crypto_hash_sha256_IMPLEMENTATION
#define crypto_hash_VERSION crypto_hash_sha256_VERSION
libsodium/src/libsodium/crypto_hash/sha512/checksum
-1
View File
@@ -1 +0,0 @@
9a2a989e136a02c3362c98e6e1e0b52fab980a1dafbebe4dd5e44d15d061742e35fb686befd4e33c608d251c96e26c020f90d92bb7ec8a657f79bb8e0b00a473
libsodium/src/libsodium/crypto_hash/sha512/cp/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_hash_sha512.h"
#define crypto_hash crypto_hash_sha512
#define crypto_hash_init crypto_hash_sha512_init
#define crypto_hash_update crypto_hash_sha512_update
#define crypto_hash_final crypto_hash_sha512_final
#define crypto_hash_BYTES crypto_hash_sha512_BYTES
#define crypto_hash_IMPLEMENTATION crypto_hash_sha512_IMPLEMENTATION
#define crypto_hash_VERSION crypto_hash_sha512_VERSION
libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/auth_poly1305_donna.c
-105
View File
@@ -1,105 +0,0 @@
#include "utils.h"
#include "poly1305_donna.h"
#ifdef HAVE_TI_MODE
# include "poly1305_donna64.h"
#else
# include "poly1305_donna32.h"
#endif
static void
poly1305_update(poly1305_context *ctx, const unsigned char *m,
unsigned long long bytes) {
poly1305_state_internal_t *st = (poly1305_state_internal_t *)(void *)ctx;
unsigned long long i;
/* handle leftover */
if (st->leftover) {
unsigned long long want = (poly1305_block_size - st->leftover);
if (want > bytes)
want = bytes;
for (i = 0; i < want; i++)
st->buffer[st->leftover + i] = m[i];
bytes -= want;
m += want;
st->leftover += want;
if (st->leftover < poly1305_block_size)
return;
poly1305_blocks(st, st->buffer, poly1305_block_size);
st->leftover = 0;
}
/* process full blocks */
if (bytes >= poly1305_block_size) {
unsigned long long want = (bytes & ~(poly1305_block_size - 1));
poly1305_blocks(st, m, want);
m += want;
bytes -= want;
}
/* store leftover */
if (bytes) {
for (i = 0; i < bytes; i++)
st->buffer[st->leftover + i] = m[i];
st->leftover += bytes;
}
}
int
crypto_onetimeauth_poly1305_donna(unsigned char *out, const unsigned char *m,
unsigned long long inlen,
const unsigned char *key)
{
poly1305_context ctx;
poly1305_init(&ctx, key);
poly1305_update(&ctx, m, inlen);
poly1305_finish(&ctx, out);
return 0;
}
int
crypto_onetimeauth_poly1305_donna_init(crypto_onetimeauth_poly1305_state *state,
const unsigned char *key)
{
poly1305_init((poly1305_context *) state, key);
return 0;
}
int
crypto_onetimeauth_poly1305_donna_update(crypto_onetimeauth_poly1305_state *state,
const unsigned char *in,
unsigned long long inlen)
{
poly1305_update((poly1305_context *) state, in, inlen);
return 0;
}
int
crypto_onetimeauth_poly1305_donna_final(crypto_onetimeauth_poly1305_state *state,
unsigned char *out)
{
poly1305_finish((poly1305_context *) state, out);
return 0;
}
/* LCOV_EXCL_START */
const char *
crypto_onetimeauth_poly1305_donna_implementation_name(void)
{
return POLY1305_IMPLEMENTATION_NAME;
}
/* LCOV_EXCL_STOP */
struct crypto_onetimeauth_poly1305_implementation
crypto_onetimeauth_poly1305_donna_implementation = {
SODIUM_C99(.implementation_name =) crypto_onetimeauth_poly1305_donna_implementation_name,
SODIUM_C99(.onetimeauth =) crypto_onetimeauth_poly1305_donna,
SODIUM_C99(.onetimeauth_verify =) crypto_onetimeauth_poly1305_donna_verify,
SODIUM_C99(.onetimeauth_init =) crypto_onetimeauth_poly1305_donna_init,
SODIUM_C99(.onetimeauth_update =) crypto_onetimeauth_poly1305_donna_update,
SODIUM_C99(.onetimeauth_final =) crypto_onetimeauth_poly1305_donna_final
};
libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/verify_poly1305_donna.c
-15
View File
@@ -1,15 +0,0 @@
#include "crypto_onetimeauth_poly1305.h"
#include "crypto_verify_16.h"
#include "poly1305_donna.h"
int
crypto_onetimeauth_poly1305_donna_verify(const unsigned char *h,
const unsigned char *in,
unsigned long long inlen,
const unsigned char *k)
{
unsigned char correct[16];
crypto_onetimeauth_poly1305_donna(correct,in,inlen,k);
return crypto_verify_16(h,correct);
}
libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_api.c
-11
View File
@@ -1,11 +0,0 @@
#include "crypto_onetimeauth_poly1305.h"
size_t
crypto_onetimeauth_poly1305_bytes(void) {
return crypto_onetimeauth_poly1305_BYTES;
}
size_t
crypto_onetimeauth_poly1305_keybytes(void) {
return crypto_onetimeauth_poly1305_KEYBYTES;
}
libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_try.c
-13
View File
@@ -1,13 +0,0 @@
#include <stdlib.h>
#include <string.h>
#include "crypto_onetimeauth.h"
#include "crypto_onetimeauth_poly1305.h"
#include "utils.h"
#include "donna/poly1305_donna.h"
crypto_onetimeauth_poly1305_implementation *
crypto_onetimeauth_pick_best_implementation(void)
{
return &crypto_onetimeauth_poly1305_donna_implementation;
}
libsodium/src/libsodium/crypto_scalarmult/curve25519/checksum
-1
View File
@@ -1 +0,0 @@
dacdae4a0f12353dfc66757f2fd1fff538fe6616115dace9afb8016a55be2a52
libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h
-9
View File
@@ -1,9 +0,0 @@
#include "crypto_scalarmult_curve25519.h"
#define crypto_scalarmult_curve25519_implementation_name \
crypto_scalarmult_curve25519_donna_c64_implementation_name
#define crypto_scalarmult crypto_scalarmult_curve25519
#define crypto_scalarmult_base crypto_scalarmult_curve25519_base
libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/base_curve25519_donna_c64.c
-13
View File
@@ -1,13 +0,0 @@
#include "api.h"
#ifdef HAVE_TI_MODE
static const unsigned char basepoint[32] = {9};
int crypto_scalarmult_base(unsigned char *q,const unsigned char *n)
{
return crypto_scalarmult(q, n, basepoint);
}
#endif
libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c
-456
View File
@@ -1,456 +0,0 @@
/* Copyright 2008, Google Inc.
* All rights reserved.
*
* Code released into the public domain.
*
* curve25519-donna: Curve25519 elliptic curve, public key function
*
* http://code.google.com/p/curve25519-donna/
*
* Adam Langley <agl@imperialviolet.org>
* Parts optimised by floodyberry
* Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
*
* More information about curve25519 can be found here
* http://cr.yp.to/ecdh.html
*
* djb's sample implementation of curve25519 is written in a special assembly
* language called qhasm and uses the floating point registers.
*
* This is, almost, a clean room reimplementation from the curve25519 paper. It
* uses many of the tricks described therein. Only the crecip function is taken
* from the sample implementation.
*/
#include <string.h>
#include <stdint.h>
#include "api.h"
#ifdef HAVE_TI_MODE
typedef uint8_t u8;
typedef uint64_t limb;
typedef limb felem[5];
// This is a special gcc mode for 128-bit integers. It's implemented on 64-bit
// platforms only as far as I know.
typedef unsigned uint128_t __attribute__((mode(TI)));
#undef force_inline
#define force_inline __attribute__((always_inline))
/* Sum two numbers: output += in */
static inline void force_inline
fsum(limb *output, const limb *in) {
output[0] += in[0];
output[1] += in[1];
output[2] += in[2];
output[3] += in[3];
output[4] += in[4];
}
/* Find the difference of two numbers: output = in - output
* (note the order of the arguments!)
*
* Assumes that out[i] < 2**52
* On return, out[i] < 2**55
*/
static inline void force_inline
fdifference_backwards(felem out, const felem in) {
/* 152 is 19 << 3 */
static const limb two54m152 = (((limb)1) << 54) - 152;
static const limb two54m8 = (((limb)1) << 54) - 8;
out[0] = in[0] + two54m152 - out[0];
out[1] = in[1] + two54m8 - out[1];
out[2] = in[2] + two54m8 - out[2];
out[3] = in[3] + two54m8 - out[3];
out[4] = in[4] + two54m8 - out[4];
}
/* Multiply a number by a scalar: output = in * scalar */
static inline void force_inline
fscalar_product(felem output, const felem in, const limb scalar) {
uint128_t a;
a = ((uint128_t) in[0]) * scalar;
output[0] = ((limb)a) & 0x7ffffffffffff;
a = ((uint128_t) in[1]) * scalar + ((limb) (a >> 51));
output[1] = ((limb)a) & 0x7ffffffffffff;
a = ((uint128_t) in[2]) * scalar + ((limb) (a >> 51));
output[2] = ((limb)a) & 0x7ffffffffffff;
a = ((uint128_t) in[3]) * scalar + ((limb) (a >> 51));
output[3] = ((limb)a) & 0x7ffffffffffff;
a = ((uint128_t) in[4]) * scalar + ((limb) (a >> 51));
output[4] = ((limb)a) & 0x7ffffffffffff;
output[0] += (a >> 51) * 19;
}
/* Multiply two numbers: output = in2 * in
*
* output must be distinct to both inputs. The inputs are reduced coefficient
* form, the output is not.
*
* Assumes that in[i] < 2**55 and likewise for in2.
* On return, output[i] < 2**52
*/
static inline void force_inline
fmul(felem output, const felem in2, const felem in) {
uint128_t t[5];
limb r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c;
r0 = in[0];
r1 = in[1];
r2 = in[2];
r3 = in[3];
r4 = in[4];
s0 = in2[0];
s1 = in2[1];
s2 = in2[2];
s3 = in2[3];
s4 = in2[4];
t[0] = ((uint128_t) r0) * s0;
t[1] = ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0;
t[2] = ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1;
t[3] = ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1;
t[4] = ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2;
r4 *= 19;
r1 *= 19;
r2 *= 19;
r3 *= 19;
t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2;
t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3;
t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4;
t[3] += ((uint128_t) r4) * s4;
r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51);
t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51);
t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51);
t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51);
t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51);
r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff;
r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff;
r2 += c;
output[0] = r0;
output[1] = r1;
output[2] = r2;
output[3] = r3;
output[4] = r4;
}
static inline void force_inline
fsquare_times(felem output, const felem in, limb count) {
uint128_t t[5];
limb r0,r1,r2,r3,r4,c;
limb d0,d1,d2,d4,d419;
r0 = in[0];
r1 = in[1];
r2 = in[2];
r3 = in[3];
r4 = in[4];
do {
d0 = r0 * 2;
d1 = r1 * 2;
d2 = r2 * 2 * 19;
d419 = r4 * 19;
d4 = d419 * 2;
t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3 ));
t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19));
t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3 ));
t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419 ));
t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2 ));
r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51);
t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51);
t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51);
t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51);
t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51);
r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff;
r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff;
r2 += c;
} while(--count);
output[0] = r0;
output[1] = r1;
output[2] = r2;
output[3] = r3;
output[4] = r4;
}
#if !defined(CPU_ALIGNED_ACCESS_REQUIRED) && defined(NATIVE_LITTLE_ENDIAN)
# define load_limb(p) (*((const limb *) (p)))
# define store_limb(p, v) (*((limb *) (p)) = (v))
#else
static inline limb force_inline
load_limb(const u8 *in) {
return
((limb)in[0]) |
(((limb)in[1]) << 8) |
(((limb)in[2]) << 16) |
(((limb)in[3]) << 24) |
(((limb)in[4]) << 32) |
(((limb)in[5]) << 40) |
(((limb)in[6]) << 48) |
(((limb)in[7]) << 56);
}
static inline void force_inline
store_limb(u8 *out, limb in) {
out[0] = in & 0xff;
out[1] = (in >> 8) & 0xff;
out[2] = (in >> 16) & 0xff;
out[3] = (in >> 24) & 0xff;
out[4] = (in >> 32) & 0xff;
out[5] = (in >> 40) & 0xff;
out[6] = (in >> 48) & 0xff;
out[7] = (in >> 56) & 0xff;
}
#endif
/* Take a little-endian, 32-byte number and expand it into polynomial form */
static void
fexpand(limb *output, const u8 *in) {
output[0] = load_limb(in) & 0x7ffffffffffff;
output[1] = (load_limb(in+6) >> 3) & 0x7ffffffffffff;
output[2] = (load_limb(in+12) >> 6) & 0x7ffffffffffff;
output[3] = (load_limb(in+19) >> 1) & 0x7ffffffffffff;
output[4] = (load_limb(in+24) >> 12) & 0x7ffffffffffff;
}
/* Take a fully reduced polynomial form number and contract it into a
* little-endian, 32-byte array
*/
static void
fcontract(u8 *output, const felem input) {
uint128_t t[5];
t[0] = input[0];
t[1] = input[1];
t[2] = input[2];
t[3] = input[3];
t[4] = input[4];
t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
/* now t is between 0 and 2^255-1, properly carried. */
/* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
t[0] += 19;
t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
/* now between 19 and 2^255-1 in both cases, and offset by 19. */
t[0] += 0x8000000000000 - 19;
t[1] += 0x8000000000000 - 1;
t[2] += 0x8000000000000 - 1;
t[3] += 0x8000000000000 - 1;
t[4] += 0x8000000000000 - 1;
/* now between 2^255 and 2^256-20, and offset by 2^255. */
t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
t[4] &= 0x7ffffffffffff;
store_limb(output, t[0] | (t[1] << 51));
store_limb(output + 8, (t[1] >> 13) | (t[2] << 38));
store_limb(output + 16, (t[2] >> 26) | (t[3] << 25));
store_limb(output + 24, (t[3] >> 39) | (t[4] << 12));
}
/* Input: Q, Q', Q-Q'
* Output: 2Q, Q+Q'
*
* x2 z3: long form
* x3 z3: long form
* x z: short form, destroyed
* xprime zprime: short form, destroyed
* qmqp: short form, preserved
*/
static void
fmonty(limb *x2, limb *z2, /* output 2Q */
limb *x3, limb *z3, /* output Q + Q' */
limb *x, limb *z, /* input Q */
limb *xprime, limb *zprime, /* input Q' */
const limb *qmqp /* input Q - Q' */) {
limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5],
zzprime[5], zzzprime[5];
memcpy(origx, x, 5 * sizeof(limb));
fsum(x, z);
fdifference_backwards(z, origx); // does x - z
memcpy(origxprime, xprime, sizeof(limb) * 5);
fsum(xprime, zprime);
fdifference_backwards(zprime, origxprime);
fmul(xxprime, xprime, z);
fmul(zzprime, x, zprime);
memcpy(origxprime, xxprime, sizeof(limb) * 5);
fsum(xxprime, zzprime);
fdifference_backwards(zzprime, origxprime);
fsquare_times(x3, xxprime, 1);
fsquare_times(zzzprime, zzprime, 1);
fmul(z3, zzzprime, qmqp);
fsquare_times(xx, x, 1);
fsquare_times(zz, z, 1);
fmul(x2, xx, zz);
fdifference_backwards(zz, xx); // does zz = xx - zz
fscalar_product(zzz, zz, 121665);
fsum(zzz, xx);
fmul(z2, zz, zzz);
}
// -----------------------------------------------------------------------------
// Maybe swap the contents of two limb arrays (@a and @b), each @len elements
// long. Perform the swap iff @swap is non-zero.
//
// This function performs the swap without leaking any side-channel
// information.
// -----------------------------------------------------------------------------
static void
swap_conditional(limb a[5], limb b[5], limb iswap) {
unsigned i;
const limb swap = -iswap;
for (i = 0; i < 5; ++i) {
const limb x = swap & (a[i] ^ b[i]);
a[i] ^= x;
b[i] ^= x;
}
}
/* Calculates nQ where Q is the x-coordinate of a point on the curve
*
* resultx/resultz: the x coordinate of the resulting curve point (short form)
* n: a little endian, 32-byte number
* q: a point of the curve (short form)
*/
static void
cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
limb a[5] = {0}, b[5] = {1}, c[5] = {1}, d[5] = {0};
limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
limb e[5] = {0}, f[5] = {1}, g[5] = {0}, h[5] = {1};
limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
unsigned i, j;
memcpy(nqpqx, q, sizeof(limb) * 5);
for (i = 0; i < 32; ++i) {
u8 byte = n[31 - i];
for (j = 0; j < 8; ++j) {
const limb bit = byte >> 7;
swap_conditional(nqx, nqpqx, bit);
swap_conditional(nqz, nqpqz, bit);
fmonty(nqx2, nqz2,
nqpqx2, nqpqz2,
nqx, nqz,
nqpqx, nqpqz,
q);
swap_conditional(nqx2, nqpqx2, bit);
swap_conditional(nqz2, nqpqz2, bit);
t = nqx;
nqx = nqx2;
nqx2 = t;
t = nqz;
nqz = nqz2;
nqz2 = t;
t = nqpqx;
nqpqx = nqpqx2;
nqpqx2 = t;
t = nqpqz;
nqpqz = nqpqz2;
nqpqz2 = t;
byte <<= 1;
}
}
memcpy(resultx, nqx, sizeof(limb) * 5);
memcpy(resultz, nqz, sizeof(limb) * 5);
}
// -----------------------------------------------------------------------------
// Shamelessly copied from djb's code, tightened a little
// -----------------------------------------------------------------------------
static void
crecip(felem out, const felem z) {
felem a,t0,b,c;
/* 2 */ fsquare_times(a, z, 1); // a = 2
/* 8 */ fsquare_times(t0, a, 2);
/* 9 */ fmul(b, t0, z); // b = 9
/* 11 */ fmul(a, b, a); // a = 11
/* 22 */ fsquare_times(t0, a, 1);
/* 2^5 - 2^0 = 31 */ fmul(b, t0, b);
/* 2^10 - 2^5 */ fsquare_times(t0, b, 5);
/* 2^10 - 2^0 */ fmul(b, t0, b);
/* 2^20 - 2^10 */ fsquare_times(t0, b, 10);
/* 2^20 - 2^0 */ fmul(c, t0, b);
/* 2^40 - 2^20 */ fsquare_times(t0, c, 20);
/* 2^40 - 2^0 */ fmul(t0, t0, c);
/* 2^50 - 2^10 */ fsquare_times(t0, t0, 10);
/* 2^50 - 2^0 */ fmul(b, t0, b);
/* 2^100 - 2^50 */ fsquare_times(t0, b, 50);
/* 2^100 - 2^0 */ fmul(c, t0, b);
/* 2^200 - 2^100 */ fsquare_times(t0, c, 100);
/* 2^200 - 2^0 */ fmul(t0, t0, c);
/* 2^250 - 2^50 */ fsquare_times(t0, t0, 50);
/* 2^250 - 2^0 */ fmul(t0, t0, b);
/* 2^255 - 2^5 */ fsquare_times(t0, t0, 5);
/* 2^255 - 21 */ fmul(out, t0, a);
}
int
crypto_scalarmult(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
limb bp[5], x[5], z[5], zmone[5];
uint8_t e[32];
int i;
for (i = 0;i < 32;++i) e[i] = secret[i];
e[0] &= 248;
e[31] &= 127;
e[31] |= 64;
fexpand(bp, basepoint);
cmult(x, z, e, bp);
crecip(zmone, z);
fmul(z, x, zmone);
fcontract(mypublic, z);
return 0;
}
#endif
libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/api.h
-5
View File
@@ -1,5 +0,0 @@
#include "crypto_scalarmult_curve25519.h"
#define crypto_scalarmult crypto_scalarmult_curve25519
#define crypto_scalarmult_base crypto_scalarmult_curve25519_base
libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/base_curve25519_ref10.c
-14
View File
@@ -1,14 +0,0 @@
#include "api.h"
#include "crypto_scalarmult.h"
#ifndef HAVE_TI_MODE
static const unsigned char basepoint[32] = {9};
int crypto_scalarmult_base(unsigned char *q,const unsigned char *n)
{
return crypto_scalarmult(q,n,basepoint);
}
#endif
libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/scalarmult_curve25519_ref10.c
-54
View File
@@ -1,54 +0,0 @@
#include "api.h"
#include "crypto_scalarmult.h"
#include "fe.h"
#ifndef HAVE_TI_MODE
int crypto_scalarmult(unsigned char *q,
const unsigned char *n,
const unsigned char *p)
{
unsigned char e[32];
unsigned int i;
fe x1;
fe x2;
fe z2;
fe x3;
fe z3;
fe tmp0;
fe tmp1;
int pos;
unsigned int swap;
unsigned int b;
for (i = 0;i < 32;++i) e[i] = n[i];
e[0] &= 248;
e[31] &= 127;
e[31] |= 64;
fe_frombytes(x1,p);
fe_1(x2);
fe_0(z2);
fe_copy(x3,x1);
fe_1(z3);
swap = 0;
for (pos = 254;pos >= 0;--pos) {
b = e[pos / 8] >> (pos & 7);
b &= 1;
swap ^= b;
fe_cswap(x2,x3,swap);
fe_cswap(z2,z3,swap);
swap = b;
#include "montgomery.h"
}
fe_cswap(x2,x3,swap);
fe_cswap(z2,z3,swap);
fe_invert(z2,z2);
fe_mul(x2,x2,z2);
fe_tobytes(q,x2);
return 0;
}
#endif
libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519_api.c
-14
View File
@@ -1,14 +0,0 @@
#include "crypto_scalarmult_curve25519.h"
size_t
crypto_scalarmult_curve25519_bytes(void)
{
return crypto_scalarmult_curve25519_BYTES;
}
size_t
crypto_scalarmult_curve25519_scalarbytes(void)
{
return crypto_scalarmult_curve25519_SCALARBYTES;
}
libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/checksum
-1
View File
@@ -1 +0,0 @@
df372f95dd87381b7c9ceb6f340ccaa03d19bed5d9e4ab004d99d847675a9658
libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h
-11
View File
@@ -1,11 +0,0 @@
#include "crypto_secretbox_xsalsa20poly1305.h"
#define crypto_secretbox crypto_secretbox_xsalsa20poly1305
#define crypto_secretbox_open crypto_secretbox_xsalsa20poly1305_open
#define crypto_secretbox_KEYBYTES crypto_secretbox_xsalsa20poly1305_KEYBYTES
#define crypto_secretbox_NONCEBYTES crypto_secretbox_xsalsa20poly1305_NONCEBYTES
#define crypto_secretbox_ZEROBYTES crypto_secretbox_xsalsa20poly1305_ZEROBYTES
#define crypto_secretbox_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES
#define crypto_secretbox_IMPLEMENTATION crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION
#define crypto_secretbox_VERSION crypto_secretbox_xsalsa20poly1305_VERSION
libsodium/src/libsodium/crypto_shorthash/siphash24/ref/api.h
-7
View File
@@ -1,7 +0,0 @@
#include "crypto_shorthash_siphash24.h"
#define crypto_shorthash crypto_shorthash_siphash24
#define crypto_shorthash_BYTES crypto_shorthash_siphash24_BYTES
#define crypto_shorthash_IMPLEMENTATION crypto_shorthash_siphash24_IMPLEMENTATION
#define crypto_shorthash_VERSION crypto_shorthash_siphash24_VERSION
libsodium/src/libsodium/crypto_sign/ed25519/ref10/api.h
-15
View File
@@ -1,15 +0,0 @@
#include "crypto_sign_ed25519.h"
#define crypto_sign crypto_sign_ed25519
#define crypto_sign_detached crypto_sign_ed25519_detached
#define crypto_sign_open crypto_sign_ed25519_open
#define crypto_sign_verify_detached crypto_sign_ed25519_verify_detached
#define crypto_sign_keypair crypto_sign_ed25519_keypair
#define crypto_sign_seed_keypair crypto_sign_ed25519_seed_keypair
#define crypto_sign_BYTES crypto_sign_ed25519_BYTES
#define crypto_sign_SEEDBYTES crypto_sign_ed25519_SEEDBYTES
#define crypto_sign_PUBLICKEYBYTES crypto_sign_ed25519_PUBLICKEYBYTES
#define crypto_sign_SECRETKEYBYTES crypto_sign_ed25519_SECRETKEYBYTES
#define crypto_sign_IMPLEMENTATION crypto_sign_ed25519_IMPLEMENTATION
#define crypto_sign_VERSION crypto_sign_ed25519_VERSION
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/api.h
-12
View File
@@ -1,12 +0,0 @@
#include "crypto_sign_edwards25519sha512batch.h"
#define crypto_sign crypto_sign_edwards25519sha512batch
#define crypto_sign_open crypto_sign_edwards25519sha512batch_open
#define crypto_sign_keypair crypto_sign_edwards25519sha512batch_keypair
#define crypto_sign_BYTES crypto_sign_edwards25519sha512batch_BYTES
#define crypto_sign_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES
#define crypto_sign_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_SECRETKEYBYTES
#define crypto_sign_IMPLEMENTATION crypto_sign_edwards25519sha512batch_IMPLEMENTATION
#define crypto_sign_VERSION crypto_sign_edwards25519sha512batch_VERSION
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519.h
-54
View File
@@ -1,54 +0,0 @@
#ifndef FE25519_H
#define FE25519_H
#define fe25519 crypto_sign_edwards25519sha512batch_fe25519
#define fe25519_unpack crypto_sign_edwards25519sha512batch_fe25519_unpack
#define fe25519_pack crypto_sign_edwards25519sha512batch_fe25519_pack
#define fe25519_cmov crypto_sign_edwards25519sha512batch_fe25519_cmov
#define fe25519_setone crypto_sign_edwards25519sha512batch_fe25519_setone
#define fe25519_setzero crypto_sign_edwards25519sha512batch_fe25519_setzero
#define fe25519_neg crypto_sign_edwards25519sha512batch_fe25519_neg
#define fe25519_getparity crypto_sign_edwards25519sha512batch_fe25519_getparity
#define fe25519_add crypto_sign_edwards25519sha512batch_fe25519_add
#define fe25519_sub crypto_sign_edwards25519sha512batch_fe25519_sub
#define fe25519_mul crypto_sign_edwards25519sha512batch_fe25519_mul
#define fe25519_square crypto_sign_edwards25519sha512batch_fe25519_square
#define fe25519_pow crypto_sign_edwards25519sha512batch_fe25519_pow
#define fe25519_sqrt_vartime crypto_sign_edwards25519sha512batch_fe25519_sqrt_vartime
#define fe25519_invert crypto_sign_edwards25519sha512batch_fe25519_invert
#include "crypto_uint32.h"
typedef struct {
crypto_uint32 v[32];
} fe25519;
void fe25519_unpack(fe25519 *r, const unsigned char x[32]);
void fe25519_pack(unsigned char r[32], const fe25519 *x);
void fe25519_cmov(fe25519 *r, const fe25519 *x, unsigned char b);
void fe25519_setone(fe25519 *r);
void fe25519_setzero(fe25519 *r);
void fe25519_neg(fe25519 *r, const fe25519 *x);
unsigned char fe25519_getparity(const fe25519 *x);
void fe25519_add(fe25519 *r, const fe25519 *x, const fe25519 *y);
void fe25519_sub(fe25519 *r, const fe25519 *x, const fe25519 *y);
void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y);
void fe25519_square(fe25519 *r, const fe25519 *x);
void fe25519_pow(fe25519 *r, const fe25519 *x, const unsigned char *e);
int fe25519_sqrt_vartime(fe25519 *r, const fe25519 *x, unsigned char parity);
void fe25519_invert(fe25519 *r, const fe25519 *x);
#endif
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519_edwards25519sha512batch.c
-348
View File
@@ -1,348 +0,0 @@
#include "fe25519.h"
#define WINDOWSIZE 4 /* Should be 1,2, or 4 */
#define WINDOWMASK ((1<<WINDOWSIZE)-1)
static void reduce_add_sub(fe25519 *r)
{
crypto_uint32 t;
int i,rep;
for(rep=0;rep<4;rep++)
{
t = r->v[31] >> 7;
r->v[31] &= 127;
t *= 19;
r->v[0] += t;
for(i=0;i<31;i++)
{
t = r->v[i] >> 8;
r->v[i+1] += t;
r->v[i] &= 255;
}
}
}
static void reduce_mul(fe25519 *r)
{
crypto_uint32 t;
int i,rep;
for(rep=0;rep<2;rep++)
{
t = r->v[31] >> 7;
r->v[31] &= 127;
t *= 19;
r->v[0] += t;
for(i=0;i<31;i++)
{
t = r->v[i] >> 8;
r->v[i+1] += t;
r->v[i] &= 255;
}
}
}
/* reduction modulo 2^255-19 */
static void freeze(fe25519 *r)
{
int i;
unsigned int m = (r->v[31] == 127);
for(i=30;i>1;i--)
m *= (r->v[i] == 255);
m *= (r->v[0] >= 237);
r->v[31] -= m*127;
for(i=30;i>0;i--)
r->v[i] -= m*255;
r->v[0] -= m*237;
}
/*freeze input before calling isone*/
static int isone(const fe25519 *x)
{
int i;
int r = (x->v[0] == 1);
for(i=1;i<32;i++)
r *= (x->v[i] == 0);
return r;
}
/*freeze input before calling iszero*/
static int iszero(const fe25519 *x)
{
int i;
int r = (x->v[0] == 0);
for(i=1;i<32;i++)
r *= (x->v[i] == 0);
return r;
}
static int issquare(const fe25519 *x)
{
unsigned char e[32] = {0xf6,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x3f}; /* (p-1)/2 */
fe25519 t;
fe25519_pow(&t,x,e);
freeze(&t);
return isone(&t) || iszero(&t);
}
void fe25519_unpack(fe25519 *r, const unsigned char x[32])
{
int i;
for(i=0;i<32;i++) r->v[i] = x[i];
r->v[31] &= 127;
}
/* Assumes input x being reduced mod 2^255 */
void fe25519_pack(unsigned char r[32], const fe25519 *x)
{
int i;
unsigned int m;
for(i=0;i<32;i++)
r[i] = x->v[i];
/* freeze byte array */
m = (r[31] == 127); /* XXX: some compilers might use branches; fix */
for(i=30;i>1;i--)
m *= (r[i] == 255);
m *= (r[0] >= 237);
r[31] -= m*127;
for(i=30;i>0;i--)
r[i] -= m*255;
r[0] -= m*237;
}
void fe25519_cmov(fe25519 *r, const fe25519 *x, unsigned char b)
{
unsigned char nb = 1-b;
int i;
for(i=0;i<32;i++) r->v[i] = nb * r->v[i] + b * x->v[i];
}
unsigned char fe25519_getparity(const fe25519 *x)
{
fe25519 t;
int i;
for(i=0;i<32;i++) t.v[i] = x->v[i];
freeze(&t);
return t.v[0] & 1;
}
void fe25519_setone(fe25519 *r)
{
int i;
r->v[0] = 1;
for(i=1;i<32;i++) r->v[i]=0;
}
void fe25519_setzero(fe25519 *r)
{
int i;
for(i=0;i<32;i++) r->v[i]=0;
}
void fe25519_neg(fe25519 *r, const fe25519 *x)
{
fe25519 t;
int i;
for(i=0;i<32;i++) t.v[i]=x->v[i];
fe25519_setzero(r);
fe25519_sub(r, r, &t);
}
void fe25519_add(fe25519 *r, const fe25519 *x, const fe25519 *y)
{
int i;
for(i=0;i<32;i++) r->v[i] = x->v[i] + y->v[i];
reduce_add_sub(r);
}
void fe25519_sub(fe25519 *r, const fe25519 *x, const fe25519 *y)
{
int i;
crypto_uint32 t[32];
t[0] = x->v[0] + 0x1da;
t[31] = x->v[31] + 0xfe;
for(i=1;i<31;i++) t[i] = x->v[i] + 0x1fe;
for(i=0;i<32;i++) r->v[i] = t[i] - y->v[i];
reduce_add_sub(r);
}
void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y)
{
int i,j;
crypto_uint32 t[63];
for(i=0;i<63;i++)t[i] = 0;
for(i=0;i<32;i++)
for(j=0;j<32;j++)
t[i+j] += x->v[i] * y->v[j];
for(i=32;i<63;i++)
r->v[i-32] = t[i-32] + 38*t[i];
r->v[31] = t[31]; /* result now in r[0]...r[31] */
reduce_mul(r);
}
void fe25519_square(fe25519 *r, const fe25519 *x)
{
fe25519_mul(r, x, x);
}
/*XXX: Make constant time! */
void fe25519_pow(fe25519 *r, const fe25519 *x, const unsigned char *e)
{
/*
fe25519 g;
fe25519_setone(&g);
int i;
unsigned char j;
for(i=32;i>0;i--)
{
for(j=128;j>0;j>>=1)
{
fe25519_square(&g,&g);
if(e[i-1] & j)
fe25519_mul(&g,&g,x);
}
}
for(i=0;i<32;i++) r->v[i] = g.v[i];
*/
fe25519 g;
int i,j,k;
fe25519 t;
unsigned char w;
fe25519 pre[(1 << WINDOWSIZE)];
fe25519_setone(&g);
// Precomputation
fe25519_setone(pre);
pre[1] = *x;
for(i=2;i<(1<<WINDOWSIZE);i+=2)
{
fe25519_square(pre+i, pre+i/2);
fe25519_mul(pre+i+1, pre+i, pre+1);
}
// Fixed-window scalar multiplication
for(i=32;i>0;i--)
{
for(j=8-WINDOWSIZE;j>=0;j-=WINDOWSIZE)
{
for(k=0;k<WINDOWSIZE;k++)
fe25519_square(&g, &g);
// Cache-timing resistant loading of precomputed value:
w = (e[i-1]>>j) & WINDOWMASK;
t = pre[0];
for(k=1;k<(1<<WINDOWSIZE);k++)
fe25519_cmov(&t, &pre[k], k==w);
fe25519_mul(&g, &g, &t);
}
}
*r = g;
}
/* Return 0 on success, 1 otherwise */
int fe25519_sqrt_vartime(fe25519 *r, const fe25519 *x, unsigned char parity)
{
unsigned char e[32] = {0xfb,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x1f}; /* (p-1)/4 */
unsigned char e2[32] = {0xfe,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x0f}; /* (p+3)/8 */
unsigned char e3[32] = {0xfd,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x0f}; /* (p-5)/8 */
fe25519 p = {{0}};
fe25519 d;
int i;
/* See HAC, Alg. 3.37 */
if (!issquare(x)) return -1;
fe25519_pow(&d,x,e);
freeze(&d);
if(isone(&d))
fe25519_pow(r,x,e2);
else
{
for(i=0;i<32;i++)
d.v[i] = 4*x->v[i];
fe25519_pow(&d,&d,e3);
for(i=0;i<32;i++)
r->v[i] = 2*x->v[i];
fe25519_mul(r,r,&d);
}
freeze(r);
if((r->v[0] & 1) != (parity & 1))
{
fe25519_sub(r,&p,r);
}
return 0;
}
void fe25519_invert(fe25519 *r, const fe25519 *x)
{
fe25519 z2;
fe25519 z9;
fe25519 z11;
fe25519 z2_5_0;
fe25519 z2_10_0;
fe25519 z2_20_0;
fe25519 z2_50_0;
fe25519 z2_100_0;
fe25519 t0;
fe25519 t1;
int i;
/* 2 */ fe25519_square(&z2,x);
/* 4 */ fe25519_square(&t1,&z2);
/* 8 */ fe25519_square(&t0,&t1);
/* 9 */ fe25519_mul(&z9,&t0,x);
/* 11 */ fe25519_mul(&z11,&z9,&z2);
/* 22 */ fe25519_square(&t0,&z11);
/* 2^5 - 2^0 = 31 */ fe25519_mul(&z2_5_0,&t0,&z9);
/* 2^6 - 2^1 */ fe25519_square(&t0,&z2_5_0);
/* 2^7 - 2^2 */ fe25519_square(&t1,&t0);
/* 2^8 - 2^3 */ fe25519_square(&t0,&t1);
/* 2^9 - 2^4 */ fe25519_square(&t1,&t0);
/* 2^10 - 2^5 */ fe25519_square(&t0,&t1);
/* 2^10 - 2^0 */ fe25519_mul(&z2_10_0,&t0,&z2_5_0);
/* 2^11 - 2^1 */ fe25519_square(&t0,&z2_10_0);
/* 2^12 - 2^2 */ fe25519_square(&t1,&t0);
/* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); }
/* 2^20 - 2^0 */ fe25519_mul(&z2_20_0,&t1,&z2_10_0);
/* 2^21 - 2^1 */ fe25519_square(&t0,&z2_20_0);
/* 2^22 - 2^2 */ fe25519_square(&t1,&t0);
/* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); }
/* 2^40 - 2^0 */ fe25519_mul(&t0,&t1,&z2_20_0);
/* 2^41 - 2^1 */ fe25519_square(&t1,&t0);
/* 2^42 - 2^2 */ fe25519_square(&t0,&t1);
/* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fe25519_square(&t1,&t0); fe25519_square(&t0,&t1); }
/* 2^50 - 2^0 */ fe25519_mul(&z2_50_0,&t0,&z2_10_0);
/* 2^51 - 2^1 */ fe25519_square(&t0,&z2_50_0);
/* 2^52 - 2^2 */ fe25519_square(&t1,&t0);
/* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); }
/* 2^100 - 2^0 */ fe25519_mul(&z2_100_0,&t1,&z2_50_0);
/* 2^101 - 2^1 */ fe25519_square(&t1,&z2_100_0);
/* 2^102 - 2^2 */ fe25519_square(&t0,&t1);
/* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fe25519_square(&t1,&t0); fe25519_square(&t0,&t1); }
/* 2^200 - 2^0 */ fe25519_mul(&t1,&t0,&z2_100_0);
/* 2^201 - 2^1 */ fe25519_square(&t0,&t1);
/* 2^202 - 2^2 */ fe25519_square(&t1,&t0);
/* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); }
/* 2^250 - 2^0 */ fe25519_mul(&t0,&t1,&z2_50_0);
/* 2^251 - 2^1 */ fe25519_square(&t1,&t0);
/* 2^252 - 2^2 */ fe25519_square(&t0,&t1);
/* 2^253 - 2^3 */ fe25519_square(&t1,&t0);
/* 2^254 - 2^4 */ fe25519_square(&t0,&t1);
/* 2^255 - 2^5 */ fe25519_square(&t1,&t0);
/* 2^255 - 21 */ fe25519_mul(r,&t1,&z11);
}
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519.h
-34
View File
@@ -1,34 +0,0 @@
#ifndef GE25519_H
#define GE25519_H
#include "fe25519.h"
#include "sc25519.h"
#define ge25519 crypto_sign_edwards25519sha512batch_ge25519
#define ge25519_unpack_vartime crypto_sign_edwards25519sha512batch_ge25519_unpack_vartime
#define ge25519_pack crypto_sign_edwards25519sha512batch_ge25519_pack
#define ge25519_add crypto_sign_edwards25519sha512batch_ge25519_add
#define ge25519_double crypto_sign_edwards25519sha512batch_ge25519_double
#define ge25519_scalarmult crypto_sign_edwards25519sha512batch_ge25519_scalarmult
#define ge25519_scalarmult_base crypto_sign_edwards25519sha512batch_ge25519_scalarmult_base
typedef struct {
fe25519 x;
fe25519 y;
fe25519 z;
fe25519 t;
} ge25519;
int ge25519_unpack_vartime(ge25519 *r, const unsigned char p[32]);
void ge25519_pack(unsigned char r[32], const ge25519 *p);
void ge25519_add(ge25519 *r, const ge25519 *p, const ge25519 *q);
void ge25519_double(ge25519 *r, const ge25519 *p);
void ge25519_scalarmult(ge25519 *r, const ge25519 *p, const sc25519 *s);
void ge25519_scalarmult_base(ge25519 *r, const sc25519 *s);
#endif
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519_edwards25519sha512batch.c
-230
View File
@@ -1,230 +0,0 @@
#include "fe25519.h"
#include "sc25519.h"
#include "ge25519.h"
/*
* Arithmetic on the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2
* with d = -(121665/121666) = 37095705934669439343138083508754565189542113879843219016388785533085940283555
* Base point: (15112221349535400772501151409588531511454012693041857206046113283949847762202,46316835694926478169428394003475163141307993866256225615783033603165251855960);
*/
typedef struct
{
fe25519 x;
fe25519 z;
fe25519 y;
fe25519 t;
} ge25519_p1p1;
typedef struct
{
fe25519 x;
fe25519 y;
fe25519 z;
} ge25519_p2;
#define ge25519_p3 ge25519
/* Windowsize for fixed-window scalar multiplication */
#define WINDOWSIZE 2 /* Should be 1,2, or 4 */
#define WINDOWMASK ((1<<WINDOWSIZE)-1)
/* packed parameter d in the Edwards curve equation */
static const unsigned char ecd[32] = {0xA3, 0x78, 0x59, 0x13, 0xCA, 0x4D, 0xEB, 0x75, 0xAB, 0xD8, 0x41, 0x41, 0x4D, 0x0A, 0x70, 0x00,
0x98, 0xE8, 0x79, 0x77, 0x79, 0x40, 0xC7, 0x8C, 0x73, 0xFE, 0x6F, 0x2B, 0xEE, 0x6C, 0x03, 0x52};
/* Packed coordinates of the base point */
static const unsigned char ge25519_base_x[32] = {0x1A, 0xD5, 0x25, 0x8F, 0x60, 0x2D, 0x56, 0xC9, 0xB2, 0xA7, 0x25, 0x95, 0x60, 0xC7, 0x2C, 0x69,
0x5C, 0xDC, 0xD6, 0xFD, 0x31, 0xE2, 0xA4, 0xC0, 0xFE, 0x53, 0x6E, 0xCD, 0xD3, 0x36, 0x69, 0x21};
static const unsigned char ge25519_base_y[32] = {0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66};
static const unsigned char ge25519_base_z[32] = {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
static const unsigned char ge25519_base_t[32] = {0xA3, 0xDD, 0xB7, 0xA5, 0xB3, 0x8A, 0xDE, 0x6D, 0xF5, 0x52, 0x51, 0x77, 0x80, 0x9F, 0xF0, 0x20,
0x7D, 0xE3, 0xAB, 0x64, 0x8E, 0x4E, 0xEA, 0x66, 0x65, 0x76, 0x8B, 0xD7, 0x0F, 0x5F, 0x87, 0x67};
/* Packed coordinates of the neutral element */
static const unsigned char ge25519_neutral_x[32] = {0};
static const unsigned char ge25519_neutral_y[32] = {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
static const unsigned char ge25519_neutral_z[32] = {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
static const unsigned char ge25519_neutral_t[32] = {0};
static void p1p1_to_p2(ge25519_p2 *r, const ge25519_p1p1 *p)
{
fe25519_mul(&r->x, &p->x, &p->t);
fe25519_mul(&r->y, &p->y, &p->z);
fe25519_mul(&r->z, &p->z, &p->t);
}
static void p1p1_to_p3(ge25519_p3 *r, const ge25519_p1p1 *p)
{
p1p1_to_p2((ge25519_p2 *)r, p);
fe25519_mul(&r->t, &p->x, &p->y);
}
/* Constant-time version of: if(b) r = p */
static void cmov_p3(ge25519_p3 *r, const ge25519_p3 *p, unsigned char b)
{
fe25519_cmov(&r->x, &p->x, b);
fe25519_cmov(&r->y, &p->y, b);
fe25519_cmov(&r->z, &p->z, b);
fe25519_cmov(&r->t, &p->t, b);
}
/* See http://www.hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#doubling-dbl-2008-hwcd */
static void dbl_p1p1(ge25519_p1p1 *r, const ge25519_p2 *p)
{
fe25519 a,b,c,d;
fe25519_square(&a, &p->x);
fe25519_square(&b, &p->y);
fe25519_square(&c, &p->z);
fe25519_add(&c, &c, &c);
fe25519_neg(&d, &a);
fe25519_add(&r->x, &p->x, &p->y);
fe25519_square(&r->x, &r->x);
fe25519_sub(&r->x, &r->x, &a);
fe25519_sub(&r->x, &r->x, &b);
fe25519_add(&r->z, &d, &b);
fe25519_sub(&r->t, &r->z, &c);
fe25519_sub(&r->y, &d, &b);
}
static void add_p1p1(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_p3 *q)
{
fe25519 a, b, c, d, t, fd;
fe25519_unpack(&fd, ecd);
fe25519_sub(&a, &p->y, &p->x); // A = (Y1-X1)*(Y2-X2)
fe25519_sub(&t, &q->y, &q->x);
fe25519_mul(&a, &a, &t);
fe25519_add(&b, &p->x, &p->y); // B = (Y1+X1)*(Y2+X2)
fe25519_add(&t, &q->x, &q->y);
fe25519_mul(&b, &b, &t);
fe25519_mul(&c, &p->t, &q->t); //C = T1*k*T2
fe25519_mul(&c, &c, &fd);
fe25519_add(&c, &c, &c); //XXX: Can save this addition by precomputing 2*ecd
fe25519_mul(&d, &p->z, &q->z); //D = Z1*2*Z2
fe25519_add(&d, &d, &d);
fe25519_sub(&r->x, &b, &a); // E = B-A
fe25519_sub(&r->t, &d, &c); // F = D-C
fe25519_add(&r->z, &d, &c); // G = D+C
fe25519_add(&r->y, &b, &a); // H = B+A
}
/* ********************************************************************
* EXPORTED FUNCTIONS
******************************************************************** */
/* return 0 on success, -1 otherwise */
int ge25519_unpack_vartime(ge25519_p3 *r, const unsigned char p[32])
{
int ret;
fe25519 t, fd;
unsigned char par;
fe25519_setone(&r->z);
fe25519_unpack(&fd, ecd);
par = p[31] >> 7;
fe25519_unpack(&r->y, p);
fe25519_square(&r->x, &r->y);
fe25519_mul(&t, &r->x, &fd);
fe25519_sub(&r->x, &r->x, &r->z);
fe25519_add(&t, &r->z, &t);
fe25519_invert(&t, &t);
fe25519_mul(&r->x, &r->x, &t);
ret = fe25519_sqrt_vartime(&r->x, &r->x, par);
fe25519_mul(&r->t, &r->x, &r->y);
return ret;
}
void ge25519_pack(unsigned char r[32], const ge25519_p3 *p)
{
fe25519 tx, ty, zi;
fe25519_invert(&zi, &p->z);
fe25519_mul(&tx, &p->x, &zi);
fe25519_mul(&ty, &p->y, &zi);
fe25519_pack(r, &ty);
r[31] ^= fe25519_getparity(&tx) << 7;
}
void ge25519_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q)
{
ge25519_p1p1 grp1p1;
add_p1p1(&grp1p1, p, q);
p1p1_to_p3(r, &grp1p1);
}
void ge25519_double(ge25519_p3 *r, const ge25519_p3 *p)
{
ge25519_p1p1 grp1p1;
dbl_p1p1(&grp1p1, (const ge25519_p2 *)p);
p1p1_to_p3(r, &grp1p1);
}
void ge25519_scalarmult(ge25519_p3 *r, const ge25519_p3 *p, const sc25519 *s)
{
int i,j,k;
ge25519_p3 g;
ge25519_p3 pre[(1 << WINDOWSIZE)];
ge25519_p3 t;
ge25519_p1p1 tp1p1;
unsigned char w;
unsigned char sb[32];
fe25519_unpack(&g.x, ge25519_neutral_x);
fe25519_unpack(&g.y, ge25519_neutral_y);
fe25519_unpack(&g.z, ge25519_neutral_z);
fe25519_unpack(&g.t, ge25519_neutral_t);
sc25519_to32bytes(sb, s);
// Precomputation
pre[0] = g;
pre[1] = *p;
for(i=2;i<(1<<WINDOWSIZE);i+=2)
{
dbl_p1p1(&tp1p1, (ge25519_p2 *)(pre+i/2));
p1p1_to_p3(pre+i, &tp1p1);
add_p1p1(&tp1p1, pre+i, pre+1);
p1p1_to_p3(pre+i+1, &tp1p1);
}
// Fixed-window scalar multiplication
for(i=32;i>0;i--)
{
for(j=8-WINDOWSIZE;j>=0;j-=WINDOWSIZE)
{
for(k=0;k<WINDOWSIZE-1;k++)
{
dbl_p1p1(&tp1p1, (ge25519_p2 *)&g);
p1p1_to_p2((ge25519_p2 *)&g, &tp1p1);
}
dbl_p1p1(&tp1p1, (ge25519_p2 *)&g);
p1p1_to_p3(&g, &tp1p1);
// Cache-timing resistant loading of precomputed value:
w = (sb[i-1]>>j) & WINDOWMASK;
t = pre[0];
for(k=1;k<(1<<WINDOWSIZE);k++)
cmov_p3(&t, &pre[k], k==w);
add_p1p1(&tp1p1, &g, &t);
if(j != 0) p1p1_to_p2((ge25519_p2 *)&g, &tp1p1);
else p1p1_to_p3(&g, &tp1p1); /* convert to p3 representation at the end */
}
}
r->x = g.x;
r->y = g.y;
r->z = g.z;
r->t = g.t;
}
void ge25519_scalarmult_base(ge25519_p3 *r, const sc25519 *s)
{
/* XXX: Better algorithm for known-base-point scalar multiplication */
ge25519_p3 t;
fe25519_unpack(&t.x, ge25519_base_x);
fe25519_unpack(&t.y, ge25519_base_y);
fe25519_unpack(&t.z, ge25519_base_z);
fe25519_unpack(&t.t, ge25519_base_t);
ge25519_scalarmult(r, &t, s);
}
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519.h
-51
View File
@@ -1,51 +0,0 @@
#ifndef SC25519_H
#define SC25519_H
#define sc25519 crypto_sign_edwards25519sha512batch_sc25519
#define sc25519_from32bytes crypto_sign_edwards25519sha512batch_sc25519_from32bytes
#define sc25519_from64bytes crypto_sign_edwards25519sha512batch_sc25519_from64bytes
#define sc25519_to32bytes crypto_sign_edwards25519sha512batch_sc25519_to32bytes
#define sc25519_pack crypto_sign_edwards25519sha512batch_sc25519_pack
#define sc25519_getparity crypto_sign_edwards25519sha512batch_sc25519_getparity
#define sc25519_setone crypto_sign_edwards25519sha512batch_sc25519_setone
#define sc25519_setzero crypto_sign_edwards25519sha512batch_sc25519_setzero
#define sc25519_neg crypto_sign_edwards25519sha512batch_sc25519_neg
#define sc25519_add crypto_sign_edwards25519sha512batch_sc25519_add
#define sc25519_sub crypto_sign_edwards25519sha512batch_sc25519_sub
#define sc25519_mul crypto_sign_edwards25519sha512batch_sc25519_mul
#define sc25519_square crypto_sign_edwards25519sha512batch_sc25519_square
#define sc25519_invert crypto_sign_edwards25519sha512batch_sc25519_invert
#include "crypto_uint32.h"
typedef struct {
crypto_uint32 v[32];
} sc25519;
void sc25519_from32bytes(sc25519 *r, const unsigned char x[32]);
void sc25519_from64bytes(sc25519 *r, const unsigned char x[64]);
void sc25519_to32bytes(unsigned char r[32], const sc25519 *x);
void sc25519_pack(unsigned char r[32], const sc25519 *x);
unsigned char sc25519_getparity(const sc25519 *x);
void sc25519_setone(sc25519 *r);
void sc25519_setzero(sc25519 *r);
void sc25519_neg(sc25519 *r, const sc25519 *x);
void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y);
void sc25519_sub(sc25519 *r, const sc25519 *x, const sc25519 *y);
void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y);
void sc25519_square(sc25519 *r, const sc25519 *x);
void sc25519_invert(sc25519 *r, const sc25519 *x);
#endif
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519_edwards25519sha512batch.c
-150
View File
@@ -1,150 +0,0 @@
#include "sc25519.h"
/*Arithmetic modulo the group order n = 2^252 + 27742317777372353535851937790883648493 = 7237005577332262213973186563042994240857116359379907606001950938285454250989 */
static const crypto_uint32 m[32] = {0xED, 0xD3, 0xF5, 0x5C, 0x1A, 0x63, 0x12, 0x58, 0xD6, 0x9C, 0xF7, 0xA2, 0xDE, 0xF9, 0xDE, 0x14,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10};
static const crypto_uint32 mu[33] = {0x1B, 0x13, 0x2C, 0x0A, 0xA3, 0xE5, 0x9C, 0xED, 0xA7, 0x29, 0x63, 0x08, 0x5D, 0x21, 0x06, 0x21,
0xEB, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x0F};
/* Reduce coefficients of r before calling reduce_add_sub */
static void reduce_add_sub(sc25519 *r)
{
int i, b, pb=0, nb;
unsigned char t[32];
for(i=0;i<32;i++)
{
b = (r->v[i]<pb+m[i]);
t[i] = r->v[i]-pb-m[i]+b*256;
pb = b;
}
nb = 1-b;
for(i=0;i<32;i++)
r->v[i] = r->v[i]*b + t[i]*nb;
}
/* Reduce coefficients of x before calling barrett_reduce */
static void barrett_reduce(sc25519 *r, const crypto_uint32 x[64])
{
/* See HAC, Alg. 14.42 */
int i,j;
crypto_uint32 q2[66] = {0};
crypto_uint32 *q3 = q2 + 33;
crypto_uint32 r1[33];
crypto_uint32 r2[33] = {0};
crypto_uint32 carry;
int b, pb=0;
for(i=0;i<33;i++)
for(j=0;j<33;j++)
if(i+j >= 31) q2[i+j] += mu[i]*x[j+31];
carry = q2[31] >> 8;
q2[32] += carry;
carry = q2[32] >> 8;
q2[33] += carry;
for(i=0;i<33;i++)r1[i] = x[i];
for(i=0;i<32;i++) {
for(j=0;j<33;j++) {
if(i+j < 33) {
/* coverity[overrun-local] */
r2[i+j] += m[i]*q3[j];
}
}
}
for(i=0;i<32;i++)
{
carry = r2[i] >> 8;
r2[i+1] += carry;
r2[i] &= 0xff;
}
for(i=0;i<32;i++)
{
b = (r1[i]<pb+r2[i]);
r->v[i] = r1[i]-pb-r2[i]+b*256;
pb = b;
}
/* XXX: Can it really happen that r<0?, See HAC, Alg 14.42, Step 3
* If so: Handle it here!
*/
reduce_add_sub(r);
reduce_add_sub(r);
}
/*
static int iszero(const sc25519 *x)
{
// Implement
return 0;
}
*/
void sc25519_from32bytes(sc25519 *r, const unsigned char x[32])
{
int i;
crypto_uint32 t[64] = {0};
for(i=0;i<32;i++) t[i] = x[i];
barrett_reduce(r, t);
}
void sc25519_from64bytes(sc25519 *r, const unsigned char x[64])
{
int i;
crypto_uint32 t[64] = {0};
for(i=0;i<64;i++) t[i] = x[i];
barrett_reduce(r, t);
}
/* XXX: What we actually want for crypto_group is probably just something like
* void sc25519_frombytes(sc25519 *r, const unsigned char *x, size_t xlen)
*/
void sc25519_to32bytes(unsigned char r[32], const sc25519 *x)
{
int i;
for(i=0;i<32;i++) r[i] = x->v[i];
}
void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y)
{
int i, carry;
for(i=0;i<32;i++) r->v[i] = x->v[i] + y->v[i];
for(i=0;i<31;i++)
{
carry = r->v[i] >> 8;
r->v[i+1] += carry;
r->v[i] &= 0xff;
}
reduce_add_sub(r);
}
void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y)
{
int i,j,carry;
crypto_uint32 t[64];
for(i=0;i<64;i++)t[i] = 0;
for(i=0;i<32;i++)
for(j=0;j<32;j++)
t[i+j] += x->v[i] * y->v[j];
/* Reduce coefficients */
for(i=0;i<63;i++)
{
carry = t[i] >> 8;
t[i+1] += carry;
t[i] &= 0xff;
}
barrett_reduce(r, t);
}
void sc25519_square(sc25519 *r, const sc25519 *x)
{
sc25519_mul(r, x, x);
}
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sign_edwards25519sha512batch.c
-102
View File
@@ -1,102 +0,0 @@
#include "api.h"
#include "crypto_hash_sha512.h"
#include "randombytes.h"
#include "crypto_verify_32.h"
#include "ge25519.h"
int crypto_sign_keypair(
unsigned char *pk,
unsigned char *sk
)
{
sc25519 scsk;
ge25519 gepk;
randombytes_buf(sk, 32);
crypto_hash_sha512(sk, sk, 32);
sk[0] &= 248;
sk[31] &= 127;
sk[31] |= 64;
sc25519_from32bytes(&scsk,sk);
ge25519_scalarmult_base(&gepk, &scsk);
ge25519_pack(pk, &gepk);
return 0;
}
int crypto_sign(
unsigned char *sm,unsigned long long *smlen,
const unsigned char *m,unsigned long long mlen,
const unsigned char *sk
)
{
sc25519 sck, scs, scsk;
ge25519 ger;
unsigned char r[32];
unsigned char s[32];
unsigned long long i;
unsigned char hmg[crypto_hash_sha512_BYTES];
unsigned char hmr[crypto_hash_sha512_BYTES];
*smlen = mlen+64;
for(i=0;i<mlen;i++)
sm[32 + i] = m[i];
for(i=0;i<32;i++)
sm[i] = sk[32+i];
crypto_hash_sha512(hmg, sm, mlen+32); /* Generate k as h(m,sk[32],...,sk[63]) */
sc25519_from64bytes(&sck, hmg);
ge25519_scalarmult_base(&ger, &sck);
ge25519_pack(r, &ger);
for(i=0;i<32;i++)
sm[i] = r[i];
crypto_hash_sha512(hmr, sm, mlen+32); /* Compute h(m,r) */
sc25519_from64bytes(&scs, hmr);
sc25519_mul(&scs, &scs, &sck);
sc25519_from32bytes(&scsk, sk);
sc25519_add(&scs, &scs, &scsk);
sc25519_to32bytes(s,&scs); /* cat s */
for(i=0;i<32;i++)
sm[mlen+32+i] = s[i];
return 0;
}
int crypto_sign_open(
unsigned char *m,unsigned long long *mlen,
const unsigned char *sm,unsigned long long smlen,
const unsigned char *pk
)
{
unsigned long long i;
unsigned char t1[32], t2[32];
ge25519 get1, get2, gepk;
sc25519 schmr, scs;
unsigned char hmr[crypto_hash_sha512_BYTES];
if (ge25519_unpack_vartime(&get1, sm)) return -1;
if (ge25519_unpack_vartime(&gepk, pk)) return -1;
crypto_hash_sha512(hmr,sm,smlen-32);
sc25519_from64bytes(&schmr, hmr);
ge25519_scalarmult(&get1, &get1, &schmr);
ge25519_add(&get1, &get1, &gepk);
ge25519_pack(t1, &get1);
sc25519_from32bytes(&scs, &sm[smlen-32]);
ge25519_scalarmult_base(&get2, &scs);
ge25519_pack(t2, &get2);
for(i=0;i<smlen-64;i++)
m[i] = sm[i + 32];
*mlen = smlen-64;
return crypto_verify_32(t1, t2);
}
libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/sign_edwards25519sha512batch_api.c
-16
View File
@@ -1,16 +0,0 @@
#include "crypto_sign_edwards25519sha512batch.h"
size_t
crypto_sign_edwards25519sha512batch_bytes(void) {
return crypto_sign_edwards25519sha512batch_BYTES;
}
size_t
crypto_sign_edwards25519sha512batch_publickeybytes(void) {
return crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES;
}
size_t
crypto_sign_edwards25519sha512batch_secretkeybytes(void) {
return crypto_sign_edwards25519sha512batch_SECRETKEYBYTES;
}
libsodium/src/libsodium/crypto_stream/aes128ctr/checksum
-1
View File
@@ -1 +0,0 @@
6e9966897837aae181e93261ae88fdf0
libsodium/src/libsodium/crypto_stream/aes128ctr/portable/api.h
-13
View File
@@ -1,13 +0,0 @@
#include "crypto_stream_aes128ctr.h"
#define crypto_stream crypto_stream_aes128ctr
#define crypto_stream_xor crypto_stream_aes128ctr_xor
#define crypto_stream_beforenm crypto_stream_aes128ctr_beforenm
#define crypto_stream_afternm crypto_stream_aes128ctr_afternm
#define crypto_stream_xor_afternm crypto_stream_aes128ctr_xor_afternm
#define crypto_stream_KEYBYTES crypto_stream_aes128ctr_KEYBYTES
#define crypto_stream_NONCEBYTES crypto_stream_aes128ctr_NONCEBYTES
#define crypto_stream_BEFORENMBYTES crypto_stream_aes128ctr_BEFORENMBYTES
#define crypto_stream_IMPLEMENTATION crypto_stream_aes128ctr_IMPLEMENTATION
#define crypto_stream_VERSION crypto_stream_aes128ctr_VERSION
libsodium/src/libsodium/crypto_stream/chacha20/ref/api.h
-12
View File
@@ -1,12 +0,0 @@
#include "crypto_stream_chacha20.h"
int
crypto_stream_chacha20_ref(unsigned char *c, unsigned long long clen,
const unsigned char *n, const unsigned char *k);
int
crypto_stream_chacha20_ref_xor_ic(unsigned char *c, const unsigned char *m,
unsigned long long mlen,
const unsigned char *n, uint64_t ic,
const unsigned char *k);
libsodium/src/libsodium/crypto_stream/chacha20/stream_chacha20_api.c
-36
View File
@@ -1,36 +0,0 @@
#include "crypto_stream_chacha20.h"
#include "ref/api.h"
size_t
crypto_stream_chacha20_keybytes(void) {
return crypto_stream_chacha20_KEYBYTES;
}
size_t
crypto_stream_chacha20_noncebytes(void) {
return crypto_stream_chacha20_NONCEBYTES;
}
int
crypto_stream_chacha20(unsigned char *c, unsigned long long clen,
const unsigned char *n, const unsigned char *k)
{
return crypto_stream_chacha20_ref(c, clen, n, k);
}
int
crypto_stream_chacha20_xor_ic(unsigned char *c, const unsigned char *m,
unsigned long long mlen,
const unsigned char *n, uint64_t ic,
const unsigned char *k)
{
return crypto_stream_chacha20_ref_xor_ic(c, m, mlen, n, ic, k);
}
int
crypto_stream_chacha20_xor(unsigned char *c, const unsigned char *m,
unsigned long long mlen, const unsigned char *n,
const unsigned char *k)
{
return crypto_stream_chacha20_ref_xor_ic(c, m, mlen, n, 0U, k);
}
libsodium/src/libsodium/crypto_stream/salsa20/amd64_xmm6/api.h
-1
View File
@@ -1 +0,0 @@
#include "crypto_stream_salsa20.h"
libsodium/src/libsodium/crypto_stream/salsa20/checksum
-1
View File
@@ -1 +0,0 @@
44a3966eabcd3a2b13faca2150e38f2b7e6bac187d626618f50a9f875158ae78
libsodium/src/libsodium/crypto_stream/salsa20/ref/api.h
-5
View File
@@ -1,5 +0,0 @@
#include "crypto_stream_salsa20.h"
#define crypto_stream crypto_stream_salsa20
#define crypto_stream_xor crypto_stream_salsa20_xor
libsodium/src/libsodium/crypto_stream/salsa2012/checksum
-1
View File
@@ -1 +0,0 @@
ecc758f200061c3cc770b25797da73583548d4f90f69a967fbbe1a6d94d1705c
libsodium/src/libsodium/crypto_stream/salsa2012/ref/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_stream_salsa2012.h"
#define crypto_stream crypto_stream_salsa2012
#define crypto_stream_xor crypto_stream_salsa2012_xor
#define crypto_stream_KEYBYTES crypto_stream_salsa2012_KEYBYTES
#define crypto_stream_NONCEBYTES crypto_stream_salsa2012_NONCEBYTES
#define crypto_stream_IMPLEMENTATION crypto_stream_salsa2012_IMPLEMENTATION
#define crypto_stream_VERSION crypto_stream_salsa2012_VERSION
libsodium/src/libsodium/crypto_stream/salsa208/checksum
-1
View File
@@ -1 +0,0 @@
05f32b0647417aaa446b0b3127318133cf9af32b771869eab267000bf02710cd
libsodium/src/libsodium/crypto_stream/salsa208/ref/api.h
-9
View File
@@ -1,9 +0,0 @@
#include "crypto_stream_salsa208.h"
#define crypto_stream crypto_stream_salsa208
#define crypto_stream_xor crypto_stream_salsa208_xor
#define crypto_stream_KEYBYTES crypto_stream_salsa208_KEYBYTES
#define crypto_stream_NONCEBYTES crypto_stream_salsa208_NONCEBYTES
#define crypto_stream_IMPLEMENTATION crypto_stream_salsa208_IMPLEMENTATION
#define crypto_stream_VERSION crypto_stream_salsa208_VERSION
libsodium/src/libsodium/crypto_stream/xsalsa20/checksum
-1
View File
@@ -1 +0,0 @@
201bc58a96adcb6ed339ca33c188af8ca04a4ce68be1e0953309ee09a0cf8e7a
libsodium/src/libsodium/crypto_stream/xsalsa20/ref/api.h
-10
View File
@@ -1,10 +0,0 @@
#include "crypto_stream_xsalsa20.h"
#define crypto_stream crypto_stream_xsalsa20
#define crypto_stream_xor crypto_stream_xsalsa20_xor
#define crypto_stream_KEYBYTES crypto_stream_xsalsa20_KEYBYTES
#define crypto_stream_NONCEBYTES crypto_stream_xsalsa20_NONCEBYTES
#define crypto_stream_IMPLEMENTATION crypto_stream_xsalsa20_IMPLEMENTATION
#define crypto_stream_VERSION crypto_stream_xsalsa20_VERSION
libsodium/src/libsodium/crypto_verify/16/checksum
-1
View File
@@ -1 +0,0 @@
0
libsodium/src/libsodium/crypto_verify/16/ref/api.h
-2
View File
@@ -1,2 +0,0 @@
#include "crypto_verify_16.h"
libsodium/src/libsodium/crypto_verify/32/checksum
-1
View File
@@ -1 +0,0 @@
0
libsodium/src/libsodium/crypto_verify/32/ref/api.h
-2
View File
@@ -1,2 +0,0 @@
#include "crypto_verify_32.h"
libsodium/src/libsodium/crypto_verify/64/ref/api.h
-2
View File
@@ -1,2 +0,0 @@
#include "crypto_verify_64.h"