diff --git a/libsodium/src/libsodium/crypto_auth/hmacsha256/checksum b/libsodium/src/libsodium/crypto_auth/hmacsha256/checksum deleted file mode 100644 index 2fa9604b..00000000 --- a/libsodium/src/libsodium/crypto_auth/hmacsha256/checksum +++ /dev/null @@ -1 +0,0 @@ -3bd7abd4f4dce04396f2ac7cb1cff70607f692411c49a1563b037d31e1662632 diff --git a/libsodium/src/libsodium/crypto_auth/hmacsha256/cp/api.h b/libsodium/src/libsodium/crypto_auth/hmacsha256/cp/api.h deleted file mode 100644 index cd4d38e7..00000000 --- a/libsodium/src/libsodium/crypto_auth/hmacsha256/cp/api.h +++ /dev/null @@ -1,9 +0,0 @@ - -#include "crypto_auth_hmacsha256.h" - -#define crypto_auth crypto_auth_hmacsha256 -#define crypto_auth_verify crypto_auth_hmacsha256_verify -#define crypto_auth_BYTES crypto_auth_hmacsha256_BYTES -#define crypto_auth_KEYBYTES crypto_auth_hmacsha256_KEYBYTES -#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha256_IMPLEMENTATION -#define crypto_auth_VERSION crypto_auth_hmacsha256_VERSION diff --git a/libsodium/src/libsodium/crypto_auth/hmacsha512/cp/api.h b/libsodium/src/libsodium/crypto_auth/hmacsha512/cp/api.h deleted file mode 100644 index 0ce40434..00000000 --- a/libsodium/src/libsodium/crypto_auth/hmacsha512/cp/api.h +++ /dev/null @@ -1,9 +0,0 @@ - -#include "crypto_auth_hmacsha512.h" - -#define crypto_auth crypto_auth_hmacsha512 -#define crypto_auth_verify crypto_auth_hmacsha512_verify -#define crypto_auth_BYTES crypto_auth_hmacsha512_BYTES -#define crypto_auth_KEYBYTES crypto_auth_hmacsha512_KEYBYTES -#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512_IMPLEMENTATION -#define crypto_auth_VERSION crypto_auth_hmacsha512_VERSION diff --git a/libsodium/src/libsodium/crypto_auth/hmacsha512256/checksum b/libsodium/src/libsodium/crypto_auth/hmacsha512256/checksum deleted file mode 100644 index 1c037f2d..00000000 --- a/libsodium/src/libsodium/crypto_auth/hmacsha512256/checksum +++ /dev/null @@ -1 +0,0 @@ -2f5e8a6a0cac012d8d001351d7d583e69f91390df46305c3608e0c2893491886 diff --git a/libsodium/src/libsodium/crypto_auth/hmacsha512256/cp/api.h b/libsodium/src/libsodium/crypto_auth/hmacsha512256/cp/api.h deleted file mode 100644 index 645b2781..00000000 --- a/libsodium/src/libsodium/crypto_auth/hmacsha512256/cp/api.h +++ /dev/null @@ -1,9 +0,0 @@ - -#include "crypto_auth_hmacsha512256.h" - -#define crypto_auth crypto_auth_hmacsha512256 -#define crypto_auth_verify crypto_auth_hmacsha512256_verify -#define crypto_auth_BYTES crypto_auth_hmacsha512256_BYTES -#define crypto_auth_KEYBYTES crypto_auth_hmacsha512256_KEYBYTES -#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512256_IMPLEMENTATION -#define crypto_auth_VERSION crypto_auth_hmacsha512256_VERSION diff --git a/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/checksum b/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/checksum deleted file mode 100644 index 56a20083..00000000 --- a/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/checksum +++ /dev/null @@ -1 +0,0 @@ -5fac7400caabc14a99c5c0bc13fb1df5e468e870382a3a1c diff --git a/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/api.h b/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/api.h deleted file mode 100644 index 7f320c6f..00000000 --- a/libsodium/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/api.h +++ /dev/null @@ -1,20 +0,0 @@ - -#include "crypto_box_curve25519xsalsa20poly1305.h" - -#define crypto_box crypto_box_curve25519xsalsa20poly1305 -#define crypto_box_open crypto_box_curve25519xsalsa20poly1305_open -#define crypto_box_seed_keypair crypto_box_curve25519xsalsa20poly1305_seed_keypair -#define crypto_box_keypair crypto_box_curve25519xsalsa20poly1305_keypair -#define crypto_box_beforenm crypto_box_curve25519xsalsa20poly1305_beforenm -#define crypto_box_afternm crypto_box_curve25519xsalsa20poly1305_afternm -#define crypto_box_open_afternm crypto_box_curve25519xsalsa20poly1305_open_afternm -#define crypto_box_SEEDBYTES crypto_box_curve25519xsalsa20poly1305_SEEDBYTES -#define crypto_box_PUBLICKEYBYTES crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES -#define crypto_box_SECRETKEYBYTES crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES -#define crypto_box_BEFORENMBYTES crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES -#define crypto_box_NONCEBYTES crypto_box_curve25519xsalsa20poly1305_NONCEBYTES -#define crypto_box_ZEROBYTES crypto_box_curve25519xsalsa20poly1305_ZEROBYTES -#define crypto_box_BOXZEROBYTES crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES -#define crypto_box_MACBYTES (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES) -#define crypto_box_IMPLEMENTATION crypto_box_curve25519xsalsa20poly1305_IMPLEMENTATION -#define crypto_box_VERSION crypto_box_curve25519xsalsa20poly1305_VERSION diff --git a/libsodium/src/libsodium/crypto_core/hsalsa20/checksum b/libsodium/src/libsodium/crypto_core/hsalsa20/checksum deleted file mode 100644 index f67bb2e2..00000000 --- a/libsodium/src/libsodium/crypto_core/hsalsa20/checksum +++ /dev/null @@ -1 +0,0 @@ -28ebe700b5878570702a68740aa131e6fa907e58a3f6915cd183c6db3f7afd7a diff --git a/libsodium/src/libsodium/crypto_core/hsalsa20/ref2/api.h b/libsodium/src/libsodium/crypto_core/hsalsa20/ref2/api.h deleted file mode 100644 index 582cba65..00000000 --- a/libsodium/src/libsodium/crypto_core/hsalsa20/ref2/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_core_hsalsa20.h" - -#define crypto_core crypto_core_hsalsa20 -#define crypto_core_OUTPUTBYTES crypto_core_hsalsa20_OUTPUTBYTES -#define crypto_core_INPUTBYTES crypto_core_hsalsa20_INPUTBYTES -#define crypto_core_KEYBYTES crypto_core_hsalsa20_KEYBYTES -#define crypto_core_CONSTBYTES crypto_core_hsalsa20_CONSTBYTES -#define crypto_core_IMPLEMENTATION crypto_core_hsalsa20_IMPLEMENTATION -#define crypto_core_VERSION crypto_core_hsalsa20_VERSION diff --git a/libsodium/src/libsodium/crypto_core/salsa20/checksum b/libsodium/src/libsodium/crypto_core/salsa20/checksum deleted file mode 100644 index fcf56186..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa20/checksum +++ /dev/null @@ -1 +0,0 @@ -9d1ee8d84b974e648507ffd93829376c5b4420751710e44f6593abd8769378011d85ecda51ceb8f43661d3c65ef5b57c4f5bf8df76c8202784c8df8def61e6a6 diff --git a/libsodium/src/libsodium/crypto_core/salsa20/ref/api.h b/libsodium/src/libsodium/crypto_core/salsa20/ref/api.h deleted file mode 100644 index d34ddeb4..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa20/ref/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_core_salsa20.h" - -#define crypto_core crypto_core_salsa20 -#define crypto_core_OUTPUTBYTES crypto_core_salsa20_OUTPUTBYTES -#define crypto_core_INPUTBYTES crypto_core_salsa20_INPUTBYTES -#define crypto_core_KEYBYTES crypto_core_salsa20_KEYBYTES -#define crypto_core_CONSTBYTES crypto_core_salsa20_CONSTBYTES -#define crypto_core_IMPLEMENTATION crypto_core_salsa20_IMPLEMENTATION -#define crypto_core_VERSION crypto_core_salsa20_VERSION diff --git a/libsodium/src/libsodium/crypto_core/salsa2012/checksum b/libsodium/src/libsodium/crypto_core/salsa2012/checksum deleted file mode 100644 index 2f99a8d6..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa2012/checksum +++ /dev/null @@ -1 +0,0 @@ -f36d643f798efc0fca888d3ac4bdcc54c98a968c2da16bd5b8bfe9fe9025a6ca3a207e9362dc7cf17ddfc7477ee754d3f521b1df91640093754f7275b1a54293 diff --git a/libsodium/src/libsodium/crypto_core/salsa2012/ref/api.h b/libsodium/src/libsodium/crypto_core/salsa2012/ref/api.h deleted file mode 100644 index 76919a0c..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa2012/ref/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_core_salsa2012.h" - -#define crypto_core crypto_core_salsa2012 -#define crypto_core_OUTPUTBYTES crypto_core_salsa2012_OUTPUTBYTES -#define crypto_core_INPUTBYTES crypto_core_salsa2012_INPUTBYTES -#define crypto_core_KEYBYTES crypto_core_salsa2012_KEYBYTES -#define crypto_core_CONSTBYTES crypto_core_salsa2012_CONSTBYTES -#define crypto_core_IMPLEMENTATION crypto_core_salsa2012_IMPLEMENTATION -#define crypto_core_VERSION crypto_core_salsa2012_VERSION diff --git a/libsodium/src/libsodium/crypto_core/salsa208/checksum b/libsodium/src/libsodium/crypto_core/salsa208/checksum deleted file mode 100644 index a16cb52f..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa208/checksum +++ /dev/null @@ -1 +0,0 @@ -1e13ea9e74cb36989f7cbf4abc80b29154e1a8b150bd5244951318abea002a93ae9fe2abbcf7217526ac2a85b66c256ba9374b1257eda0c01816da328edfa11a diff --git a/libsodium/src/libsodium/crypto_core/salsa208/ref/api.h b/libsodium/src/libsodium/crypto_core/salsa208/ref/api.h deleted file mode 100644 index 07d090b3..00000000 --- a/libsodium/src/libsodium/crypto_core/salsa208/ref/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_core_salsa208.h" - -#define crypto_core crypto_core_salsa208 -#define crypto_core_OUTPUTBYTES crypto_core_salsa208_OUTPUTBYTES -#define crypto_core_INPUTBYTES crypto_core_salsa208_INPUTBYTES -#define crypto_core_KEYBYTES crypto_core_salsa208_KEYBYTES -#define crypto_core_CONSTBYTES crypto_core_salsa208_CONSTBYTES -#define crypto_core_IMPLEMENTATION crypto_core_salsa208_IMPLEMENTATION -#define crypto_core_VERSION crypto_core_salsa208_VERSION diff --git a/libsodium/src/libsodium/crypto_generichash/blake2/ref/api.h b/libsodium/src/libsodium/crypto_generichash/blake2/ref/api.h deleted file mode 100644 index 130d2461..00000000 --- a/libsodium/src/libsodium/crypto_generichash/blake2/ref/api.h +++ /dev/null @@ -1,2 +0,0 @@ - -#include "crypto_generichash_blake2b.h" diff --git a/libsodium/src/libsodium/crypto_hash/sha256/checksum b/libsodium/src/libsodium/crypto_hash/sha256/checksum deleted file mode 100644 index ee52aa30..00000000 --- a/libsodium/src/libsodium/crypto_hash/sha256/checksum +++ /dev/null @@ -1 +0,0 @@ -86df8bd202b2a2b5fdc04a7f50a591e43a345849c12fef08d487109648a08e05 diff --git a/libsodium/src/libsodium/crypto_hash/sha256/cp/api.h b/libsodium/src/libsodium/crypto_hash/sha256/cp/api.h deleted file mode 100644 index b38a563a..00000000 --- a/libsodium/src/libsodium/crypto_hash/sha256/cp/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_hash_sha256.h" - -#define crypto_hash crypto_hash_sha256 -#define crypto_hash_init crypto_hash_sha256_init -#define crypto_hash_update crypto_hash_sha256_update -#define crypto_hash_final crypto_hash_sha256_final -#define crypto_hash_BYTES crypto_hash_sha256_BYTES -#define crypto_hash_IMPLEMENTATION crypto_hash_sha256_IMPLEMENTATION -#define crypto_hash_VERSION crypto_hash_sha256_VERSION diff --git a/libsodium/src/libsodium/crypto_hash/sha512/checksum b/libsodium/src/libsodium/crypto_hash/sha512/checksum deleted file mode 100644 index edf714e9..00000000 --- a/libsodium/src/libsodium/crypto_hash/sha512/checksum +++ /dev/null @@ -1 +0,0 @@ -9a2a989e136a02c3362c98e6e1e0b52fab980a1dafbebe4dd5e44d15d061742e35fb686befd4e33c608d251c96e26c020f90d92bb7ec8a657f79bb8e0b00a473 diff --git a/libsodium/src/libsodium/crypto_hash/sha512/cp/api.h b/libsodium/src/libsodium/crypto_hash/sha512/cp/api.h deleted file mode 100644 index c3a31883..00000000 --- a/libsodium/src/libsodium/crypto_hash/sha512/cp/api.h +++ /dev/null @@ -1,10 +0,0 @@ - -#include "crypto_hash_sha512.h" - -#define crypto_hash crypto_hash_sha512 -#define crypto_hash_init crypto_hash_sha512_init -#define crypto_hash_update crypto_hash_sha512_update -#define crypto_hash_final crypto_hash_sha512_final -#define crypto_hash_BYTES crypto_hash_sha512_BYTES -#define crypto_hash_IMPLEMENTATION crypto_hash_sha512_IMPLEMENTATION -#define crypto_hash_VERSION crypto_hash_sha512_VERSION diff --git a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/auth_poly1305_donna.c b/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/auth_poly1305_donna.c deleted file mode 100644 index 42e21e33..00000000 --- a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/auth_poly1305_donna.c +++ /dev/null @@ -1,105 +0,0 @@ - -#include "utils.h" -#include "poly1305_donna.h" -#ifdef HAVE_TI_MODE -# include "poly1305_donna64.h" -#else -# include "poly1305_donna32.h" -#endif - -static void -poly1305_update(poly1305_context *ctx, const unsigned char *m, - unsigned long long bytes) { - poly1305_state_internal_t *st = (poly1305_state_internal_t *)(void *)ctx; - unsigned long long i; - - /* handle leftover */ - if (st->leftover) { - unsigned long long want = (poly1305_block_size - st->leftover); - if (want > bytes) - want = bytes; - for (i = 0; i < want; i++) - st->buffer[st->leftover + i] = m[i]; - bytes -= want; - m += want; - st->leftover += want; - if (st->leftover < poly1305_block_size) - return; - poly1305_blocks(st, st->buffer, poly1305_block_size); - st->leftover = 0; - } - - /* process full blocks */ - if (bytes >= poly1305_block_size) { - unsigned long long want = (bytes & ~(poly1305_block_size - 1)); - poly1305_blocks(st, m, want); - m += want; - bytes -= want; - } - - /* store leftover */ - if (bytes) { - for (i = 0; i < bytes; i++) - st->buffer[st->leftover + i] = m[i]; - st->leftover += bytes; - } -} - -int -crypto_onetimeauth_poly1305_donna(unsigned char *out, const unsigned char *m, - unsigned long long inlen, - const unsigned char *key) -{ - poly1305_context ctx; - poly1305_init(&ctx, key); - poly1305_update(&ctx, m, inlen); - poly1305_finish(&ctx, out); - - return 0; -} - -int -crypto_onetimeauth_poly1305_donna_init(crypto_onetimeauth_poly1305_state *state, - const unsigned char *key) -{ - poly1305_init((poly1305_context *) state, key); - - return 0; -} - -int -crypto_onetimeauth_poly1305_donna_update(crypto_onetimeauth_poly1305_state *state, - const unsigned char *in, - unsigned long long inlen) -{ - poly1305_update((poly1305_context *) state, in, inlen); - - return 0; -} - -int -crypto_onetimeauth_poly1305_donna_final(crypto_onetimeauth_poly1305_state *state, - unsigned char *out) -{ - poly1305_finish((poly1305_context *) state, out); - - return 0; -} - -/* LCOV_EXCL_START */ -const char * -crypto_onetimeauth_poly1305_donna_implementation_name(void) -{ - return POLY1305_IMPLEMENTATION_NAME; -} -/* LCOV_EXCL_STOP */ - -struct crypto_onetimeauth_poly1305_implementation -crypto_onetimeauth_poly1305_donna_implementation = { - SODIUM_C99(.implementation_name =) crypto_onetimeauth_poly1305_donna_implementation_name, - SODIUM_C99(.onetimeauth =) crypto_onetimeauth_poly1305_donna, - SODIUM_C99(.onetimeauth_verify =) crypto_onetimeauth_poly1305_donna_verify, - SODIUM_C99(.onetimeauth_init =) crypto_onetimeauth_poly1305_donna_init, - SODIUM_C99(.onetimeauth_update =) crypto_onetimeauth_poly1305_donna_update, - SODIUM_C99(.onetimeauth_final =) crypto_onetimeauth_poly1305_donna_final -}; diff --git a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/verify_poly1305_donna.c b/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/verify_poly1305_donna.c deleted file mode 100644 index e0598423..00000000 --- a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/verify_poly1305_donna.c +++ /dev/null @@ -1,15 +0,0 @@ -#include "crypto_onetimeauth_poly1305.h" -#include "crypto_verify_16.h" -#include "poly1305_donna.h" - -int -crypto_onetimeauth_poly1305_donna_verify(const unsigned char *h, - const unsigned char *in, - unsigned long long inlen, - const unsigned char *k) -{ - unsigned char correct[16]; - - crypto_onetimeauth_poly1305_donna(correct,in,inlen,k); - return crypto_verify_16(h,correct); -} diff --git a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_api.c b/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_api.c deleted file mode 100644 index b8878d5d..00000000 --- a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_api.c +++ /dev/null @@ -1,11 +0,0 @@ -#include "crypto_onetimeauth_poly1305.h" - -size_t -crypto_onetimeauth_poly1305_bytes(void) { - return crypto_onetimeauth_poly1305_BYTES; -} - -size_t -crypto_onetimeauth_poly1305_keybytes(void) { - return crypto_onetimeauth_poly1305_KEYBYTES; -} diff --git a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_try.c b/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_try.c deleted file mode 100644 index 10084e5b..00000000 --- a/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_try.c +++ /dev/null @@ -1,13 +0,0 @@ - -#include -#include -#include "crypto_onetimeauth.h" -#include "crypto_onetimeauth_poly1305.h" -#include "utils.h" -#include "donna/poly1305_donna.h" - -crypto_onetimeauth_poly1305_implementation * -crypto_onetimeauth_pick_best_implementation(void) -{ - return &crypto_onetimeauth_poly1305_donna_implementation; -} diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/checksum b/libsodium/src/libsodium/crypto_scalarmult/curve25519/checksum deleted file mode 100644 index ce2d395b..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/checksum +++ /dev/null @@ -1 +0,0 @@ -dacdae4a0f12353dfc66757f2fd1fff538fe6616115dace9afb8016a55be2a52 diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h b/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h deleted file mode 100644 index 5c9bba7e..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h +++ /dev/null @@ -1,9 +0,0 @@ - -#include "crypto_scalarmult_curve25519.h" - -#define crypto_scalarmult_curve25519_implementation_name \ - crypto_scalarmult_curve25519_donna_c64_implementation_name - -#define crypto_scalarmult crypto_scalarmult_curve25519 -#define crypto_scalarmult_base crypto_scalarmult_curve25519_base - diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/base_curve25519_donna_c64.c b/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/base_curve25519_donna_c64.c deleted file mode 100644 index 58a3f1c9..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/base_curve25519_donna_c64.c +++ /dev/null @@ -1,13 +0,0 @@ - -#include "api.h" - -#ifdef HAVE_TI_MODE - -static const unsigned char basepoint[32] = {9}; - -int crypto_scalarmult_base(unsigned char *q,const unsigned char *n) -{ - return crypto_scalarmult(q, n, basepoint); -} - -#endif diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c b/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c deleted file mode 100644 index 7da3e1c0..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c +++ /dev/null @@ -1,456 +0,0 @@ -/* Copyright 2008, Google Inc. - * All rights reserved. - * - * Code released into the public domain. - * - * curve25519-donna: Curve25519 elliptic curve, public key function - * - * http://code.google.com/p/curve25519-donna/ - * - * Adam Langley - * Parts optimised by floodyberry - * Derived from public domain C code by Daniel J. Bernstein - * - * More information about curve25519 can be found here - * http://cr.yp.to/ecdh.html - * - * djb's sample implementation of curve25519 is written in a special assembly - * language called qhasm and uses the floating point registers. - * - * This is, almost, a clean room reimplementation from the curve25519 paper. It - * uses many of the tricks described therein. Only the crecip function is taken - * from the sample implementation. - */ - -#include -#include -#include "api.h" - -#ifdef HAVE_TI_MODE - -typedef uint8_t u8; -typedef uint64_t limb; -typedef limb felem[5]; -// This is a special gcc mode for 128-bit integers. It's implemented on 64-bit -// platforms only as far as I know. -typedef unsigned uint128_t __attribute__((mode(TI))); - -#undef force_inline -#define force_inline __attribute__((always_inline)) - -/* Sum two numbers: output += in */ -static inline void force_inline -fsum(limb *output, const limb *in) { - output[0] += in[0]; - output[1] += in[1]; - output[2] += in[2]; - output[3] += in[3]; - output[4] += in[4]; -} - -/* Find the difference of two numbers: output = in - output - * (note the order of the arguments!) - * - * Assumes that out[i] < 2**52 - * On return, out[i] < 2**55 - */ -static inline void force_inline -fdifference_backwards(felem out, const felem in) { - /* 152 is 19 << 3 */ - static const limb two54m152 = (((limb)1) << 54) - 152; - static const limb two54m8 = (((limb)1) << 54) - 8; - - out[0] = in[0] + two54m152 - out[0]; - out[1] = in[1] + two54m8 - out[1]; - out[2] = in[2] + two54m8 - out[2]; - out[3] = in[3] + two54m8 - out[3]; - out[4] = in[4] + two54m8 - out[4]; -} - -/* Multiply a number by a scalar: output = in * scalar */ -static inline void force_inline -fscalar_product(felem output, const felem in, const limb scalar) { - uint128_t a; - - a = ((uint128_t) in[0]) * scalar; - output[0] = ((limb)a) & 0x7ffffffffffff; - - a = ((uint128_t) in[1]) * scalar + ((limb) (a >> 51)); - output[1] = ((limb)a) & 0x7ffffffffffff; - - a = ((uint128_t) in[2]) * scalar + ((limb) (a >> 51)); - output[2] = ((limb)a) & 0x7ffffffffffff; - - a = ((uint128_t) in[3]) * scalar + ((limb) (a >> 51)); - output[3] = ((limb)a) & 0x7ffffffffffff; - - a = ((uint128_t) in[4]) * scalar + ((limb) (a >> 51)); - output[4] = ((limb)a) & 0x7ffffffffffff; - - output[0] += (a >> 51) * 19; -} - -/* Multiply two numbers: output = in2 * in - * - * output must be distinct to both inputs. The inputs are reduced coefficient - * form, the output is not. - * - * Assumes that in[i] < 2**55 and likewise for in2. - * On return, output[i] < 2**52 - */ -static inline void force_inline -fmul(felem output, const felem in2, const felem in) { - uint128_t t[5]; - limb r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c; - - r0 = in[0]; - r1 = in[1]; - r2 = in[2]; - r3 = in[3]; - r4 = in[4]; - - s0 = in2[0]; - s1 = in2[1]; - s2 = in2[2]; - s3 = in2[3]; - s4 = in2[4]; - - t[0] = ((uint128_t) r0) * s0; - t[1] = ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0; - t[2] = ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1; - t[3] = ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1; - t[4] = ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2; - - r4 *= 19; - r1 *= 19; - r2 *= 19; - r3 *= 19; - - t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2; - t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3; - t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4; - t[3] += ((uint128_t) r4) * s4; - - r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); - t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); - t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); - t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); - t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); - r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; - r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; - r2 += c; - - output[0] = r0; - output[1] = r1; - output[2] = r2; - output[3] = r3; - output[4] = r4; -} - -static inline void force_inline -fsquare_times(felem output, const felem in, limb count) { - uint128_t t[5]; - limb r0,r1,r2,r3,r4,c; - limb d0,d1,d2,d4,d419; - - r0 = in[0]; - r1 = in[1]; - r2 = in[2]; - r3 = in[3]; - r4 = in[4]; - - do { - d0 = r0 * 2; - d1 = r1 * 2; - d2 = r2 * 2 * 19; - d419 = r4 * 19; - d4 = d419 * 2; - - t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3 )); - t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19)); - t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3 )); - t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419 )); - t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2 )); - - r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51); - t[1] += c; r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51); - t[2] += c; r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51); - t[3] += c; r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51); - t[4] += c; r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51); - r0 += c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff; - r1 += c; c = r1 >> 51; r1 = r1 & 0x7ffffffffffff; - r2 += c; - } while(--count); - - output[0] = r0; - output[1] = r1; - output[2] = r2; - output[3] = r3; - output[4] = r4; -} - -#if !defined(CPU_ALIGNED_ACCESS_REQUIRED) && defined(NATIVE_LITTLE_ENDIAN) -# define load_limb(p) (*((const limb *) (p))) -# define store_limb(p, v) (*((limb *) (p)) = (v)) -#else -static inline limb force_inline -load_limb(const u8 *in) { - return - ((limb)in[0]) | - (((limb)in[1]) << 8) | - (((limb)in[2]) << 16) | - (((limb)in[3]) << 24) | - (((limb)in[4]) << 32) | - (((limb)in[5]) << 40) | - (((limb)in[6]) << 48) | - (((limb)in[7]) << 56); -} - -static inline void force_inline -store_limb(u8 *out, limb in) { - out[0] = in & 0xff; - out[1] = (in >> 8) & 0xff; - out[2] = (in >> 16) & 0xff; - out[3] = (in >> 24) & 0xff; - out[4] = (in >> 32) & 0xff; - out[5] = (in >> 40) & 0xff; - out[6] = (in >> 48) & 0xff; - out[7] = (in >> 56) & 0xff; -} -#endif - -/* Take a little-endian, 32-byte number and expand it into polynomial form */ -static void -fexpand(limb *output, const u8 *in) { - output[0] = load_limb(in) & 0x7ffffffffffff; - output[1] = (load_limb(in+6) >> 3) & 0x7ffffffffffff; - output[2] = (load_limb(in+12) >> 6) & 0x7ffffffffffff; - output[3] = (load_limb(in+19) >> 1) & 0x7ffffffffffff; - output[4] = (load_limb(in+24) >> 12) & 0x7ffffffffffff; -} - -/* Take a fully reduced polynomial form number and contract it into a - * little-endian, 32-byte array - */ -static void -fcontract(u8 *output, const felem input) { - uint128_t t[5]; - - t[0] = input[0]; - t[1] = input[1]; - t[2] = input[2]; - t[3] = input[3]; - t[4] = input[4]; - - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; - - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; - - /* now t is between 0 and 2^255-1, properly carried. */ - /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */ - - t[0] += 19; - - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff; - - /* now between 19 and 2^255-1 in both cases, and offset by 19. */ - - t[0] += 0x8000000000000 - 19; - t[1] += 0x8000000000000 - 1; - t[2] += 0x8000000000000 - 1; - t[3] += 0x8000000000000 - 1; - t[4] += 0x8000000000000 - 1; - - /* now between 2^255 and 2^256-20, and offset by 2^255. */ - - t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff; - t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff; - t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff; - t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff; - t[4] &= 0x7ffffffffffff; - - store_limb(output, t[0] | (t[1] << 51)); - store_limb(output + 8, (t[1] >> 13) | (t[2] << 38)); - store_limb(output + 16, (t[2] >> 26) | (t[3] << 25)); - store_limb(output + 24, (t[3] >> 39) | (t[4] << 12)); -} - -/* Input: Q, Q', Q-Q' - * Output: 2Q, Q+Q' - * - * x2 z3: long form - * x3 z3: long form - * x z: short form, destroyed - * xprime zprime: short form, destroyed - * qmqp: short form, preserved - */ -static void -fmonty(limb *x2, limb *z2, /* output 2Q */ - limb *x3, limb *z3, /* output Q + Q' */ - limb *x, limb *z, /* input Q */ - limb *xprime, limb *zprime, /* input Q' */ - const limb *qmqp /* input Q - Q' */) { - limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5], - zzprime[5], zzzprime[5]; - - memcpy(origx, x, 5 * sizeof(limb)); - fsum(x, z); - fdifference_backwards(z, origx); // does x - z - - memcpy(origxprime, xprime, sizeof(limb) * 5); - fsum(xprime, zprime); - fdifference_backwards(zprime, origxprime); - fmul(xxprime, xprime, z); - fmul(zzprime, x, zprime); - memcpy(origxprime, xxprime, sizeof(limb) * 5); - fsum(xxprime, zzprime); - fdifference_backwards(zzprime, origxprime); - fsquare_times(x3, xxprime, 1); - fsquare_times(zzzprime, zzprime, 1); - fmul(z3, zzzprime, qmqp); - - fsquare_times(xx, x, 1); - fsquare_times(zz, z, 1); - fmul(x2, xx, zz); - fdifference_backwards(zz, xx); // does zz = xx - zz - fscalar_product(zzz, zz, 121665); - fsum(zzz, xx); - fmul(z2, zz, zzz); -} - -// ----------------------------------------------------------------------------- -// Maybe swap the contents of two limb arrays (@a and @b), each @len elements -// long. Perform the swap iff @swap is non-zero. -// -// This function performs the swap without leaking any side-channel -// information. -// ----------------------------------------------------------------------------- -static void -swap_conditional(limb a[5], limb b[5], limb iswap) { - unsigned i; - const limb swap = -iswap; - - for (i = 0; i < 5; ++i) { - const limb x = swap & (a[i] ^ b[i]); - a[i] ^= x; - b[i] ^= x; - } -} - -/* Calculates nQ where Q is the x-coordinate of a point on the curve - * - * resultx/resultz: the x coordinate of the resulting curve point (short form) - * n: a little endian, 32-byte number - * q: a point of the curve (short form) - */ -static void -cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) { - limb a[5] = {0}, b[5] = {1}, c[5] = {1}, d[5] = {0}; - limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t; - limb e[5] = {0}, f[5] = {1}, g[5] = {0}, h[5] = {1}; - limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h; - - unsigned i, j; - - memcpy(nqpqx, q, sizeof(limb) * 5); - - for (i = 0; i < 32; ++i) { - u8 byte = n[31 - i]; - for (j = 0; j < 8; ++j) { - const limb bit = byte >> 7; - - swap_conditional(nqx, nqpqx, bit); - swap_conditional(nqz, nqpqz, bit); - fmonty(nqx2, nqz2, - nqpqx2, nqpqz2, - nqx, nqz, - nqpqx, nqpqz, - q); - swap_conditional(nqx2, nqpqx2, bit); - swap_conditional(nqz2, nqpqz2, bit); - - t = nqx; - nqx = nqx2; - nqx2 = t; - t = nqz; - nqz = nqz2; - nqz2 = t; - t = nqpqx; - nqpqx = nqpqx2; - nqpqx2 = t; - t = nqpqz; - nqpqz = nqpqz2; - nqpqz2 = t; - - byte <<= 1; - } - } - - memcpy(resultx, nqx, sizeof(limb) * 5); - memcpy(resultz, nqz, sizeof(limb) * 5); -} - - -// ----------------------------------------------------------------------------- -// Shamelessly copied from djb's code, tightened a little -// ----------------------------------------------------------------------------- -static void -crecip(felem out, const felem z) { - felem a,t0,b,c; - - /* 2 */ fsquare_times(a, z, 1); // a = 2 - /* 8 */ fsquare_times(t0, a, 2); - /* 9 */ fmul(b, t0, z); // b = 9 - /* 11 */ fmul(a, b, a); // a = 11 - /* 22 */ fsquare_times(t0, a, 1); - /* 2^5 - 2^0 = 31 */ fmul(b, t0, b); - /* 2^10 - 2^5 */ fsquare_times(t0, b, 5); - /* 2^10 - 2^0 */ fmul(b, t0, b); - /* 2^20 - 2^10 */ fsquare_times(t0, b, 10); - /* 2^20 - 2^0 */ fmul(c, t0, b); - /* 2^40 - 2^20 */ fsquare_times(t0, c, 20); - /* 2^40 - 2^0 */ fmul(t0, t0, c); - /* 2^50 - 2^10 */ fsquare_times(t0, t0, 10); - /* 2^50 - 2^0 */ fmul(b, t0, b); - /* 2^100 - 2^50 */ fsquare_times(t0, b, 50); - /* 2^100 - 2^0 */ fmul(c, t0, b); - /* 2^200 - 2^100 */ fsquare_times(t0, c, 100); - /* 2^200 - 2^0 */ fmul(t0, t0, c); - /* 2^250 - 2^50 */ fsquare_times(t0, t0, 50); - /* 2^250 - 2^0 */ fmul(t0, t0, b); - /* 2^255 - 2^5 */ fsquare_times(t0, t0, 5); - /* 2^255 - 21 */ fmul(out, t0, a); -} - -int -crypto_scalarmult(u8 *mypublic, const u8 *secret, const u8 *basepoint) { - limb bp[5], x[5], z[5], zmone[5]; - uint8_t e[32]; - int i; - - for (i = 0;i < 32;++i) e[i] = secret[i]; - e[0] &= 248; - e[31] &= 127; - e[31] |= 64; - - fexpand(bp, basepoint); - cmult(x, z, e, bp); - crecip(zmone, z); - fmul(z, x, zmone); - fcontract(mypublic, z); - return 0; -} - -#endif diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/api.h b/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/api.h deleted file mode 100644 index 40a42065..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/api.h +++ /dev/null @@ -1,5 +0,0 @@ - -#include "crypto_scalarmult_curve25519.h" - -#define crypto_scalarmult crypto_scalarmult_curve25519 -#define crypto_scalarmult_base crypto_scalarmult_curve25519_base diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/base_curve25519_ref10.c b/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/base_curve25519_ref10.c deleted file mode 100644 index ce123ddf..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/base_curve25519_ref10.c +++ /dev/null @@ -1,14 +0,0 @@ - -#include "api.h" -#include "crypto_scalarmult.h" - -#ifndef HAVE_TI_MODE - -static const unsigned char basepoint[32] = {9}; - -int crypto_scalarmult_base(unsigned char *q,const unsigned char *n) -{ - return crypto_scalarmult(q,n,basepoint); -} - -#endif diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/scalarmult_curve25519_ref10.c b/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/scalarmult_curve25519_ref10.c deleted file mode 100644 index a081430a..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/scalarmult_curve25519_ref10.c +++ /dev/null @@ -1,54 +0,0 @@ - -#include "api.h" -#include "crypto_scalarmult.h" -#include "fe.h" - -#ifndef HAVE_TI_MODE - -int crypto_scalarmult(unsigned char *q, - const unsigned char *n, - const unsigned char *p) -{ - unsigned char e[32]; - unsigned int i; - fe x1; - fe x2; - fe z2; - fe x3; - fe z3; - fe tmp0; - fe tmp1; - int pos; - unsigned int swap; - unsigned int b; - - for (i = 0;i < 32;++i) e[i] = n[i]; - e[0] &= 248; - e[31] &= 127; - e[31] |= 64; - fe_frombytes(x1,p); - fe_1(x2); - fe_0(z2); - fe_copy(x3,x1); - fe_1(z3); - - swap = 0; - for (pos = 254;pos >= 0;--pos) { - b = e[pos / 8] >> (pos & 7); - b &= 1; - swap ^= b; - fe_cswap(x2,x3,swap); - fe_cswap(z2,z3,swap); - swap = b; -#include "montgomery.h" - } - fe_cswap(x2,x3,swap); - fe_cswap(z2,z3,swap); - - fe_invert(z2,z2); - fe_mul(x2,x2,z2); - fe_tobytes(q,x2); - return 0; -} - -#endif diff --git a/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519_api.c b/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519_api.c deleted file mode 100644 index 94c720a2..00000000 --- a/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519_api.c +++ /dev/null @@ -1,14 +0,0 @@ - -#include "crypto_scalarmult_curve25519.h" - -size_t -crypto_scalarmult_curve25519_bytes(void) -{ - return crypto_scalarmult_curve25519_BYTES; -} - -size_t -crypto_scalarmult_curve25519_scalarbytes(void) -{ - return crypto_scalarmult_curve25519_SCALARBYTES; -} diff --git a/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/checksum b/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/checksum deleted file mode 100644 index af3c6897..00000000 --- a/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/checksum +++ /dev/null @@ -1 +0,0 @@ -df372f95dd87381b7c9ceb6f340ccaa03d19bed5d9e4ab004d99d847675a9658 diff --git a/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h b/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h deleted file mode 100644 index 5eff3d29..00000000 --- a/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h +++ /dev/null @@ -1,11 +0,0 @@ - -#include "crypto_secretbox_xsalsa20poly1305.h" - -#define crypto_secretbox crypto_secretbox_xsalsa20poly1305 -#define crypto_secretbox_open crypto_secretbox_xsalsa20poly1305_open -#define crypto_secretbox_KEYBYTES crypto_secretbox_xsalsa20poly1305_KEYBYTES -#define crypto_secretbox_NONCEBYTES crypto_secretbox_xsalsa20poly1305_NONCEBYTES -#define crypto_secretbox_ZEROBYTES crypto_secretbox_xsalsa20poly1305_ZEROBYTES -#define crypto_secretbox_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES -#define crypto_secretbox_IMPLEMENTATION crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION -#define crypto_secretbox_VERSION crypto_secretbox_xsalsa20poly1305_VERSION diff --git a/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/api.h b/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/api.h deleted file mode 100644 index a837c8af..00000000 --- a/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/api.h +++ /dev/null @@ -1,7 +0,0 @@ - -#include "crypto_shorthash_siphash24.h" - -#define crypto_shorthash crypto_shorthash_siphash24 -#define crypto_shorthash_BYTES crypto_shorthash_siphash24_BYTES -#define crypto_shorthash_IMPLEMENTATION crypto_shorthash_siphash24_IMPLEMENTATION -#define crypto_shorthash_VERSION crypto_shorthash_siphash24_VERSION diff --git a/libsodium/src/libsodium/crypto_sign/ed25519/ref10/api.h b/libsodium/src/libsodium/crypto_sign/ed25519/ref10/api.h deleted file mode 100644 index 0106cf13..00000000 --- a/libsodium/src/libsodium/crypto_sign/ed25519/ref10/api.h +++ /dev/null @@ -1,15 +0,0 @@ - -#include "crypto_sign_ed25519.h" - -#define crypto_sign crypto_sign_ed25519 -#define crypto_sign_detached crypto_sign_ed25519_detached -#define crypto_sign_open crypto_sign_ed25519_open -#define crypto_sign_verify_detached crypto_sign_ed25519_verify_detached -#define crypto_sign_keypair crypto_sign_ed25519_keypair -#define crypto_sign_seed_keypair crypto_sign_ed25519_seed_keypair -#define crypto_sign_BYTES crypto_sign_ed25519_BYTES -#define crypto_sign_SEEDBYTES crypto_sign_ed25519_SEEDBYTES -#define crypto_sign_PUBLICKEYBYTES crypto_sign_ed25519_PUBLICKEYBYTES -#define crypto_sign_SECRETKEYBYTES crypto_sign_ed25519_SECRETKEYBYTES -#define crypto_sign_IMPLEMENTATION crypto_sign_ed25519_IMPLEMENTATION -#define crypto_sign_VERSION crypto_sign_ed25519_VERSION diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/api.h b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/api.h deleted file mode 100644 index 5cb0f760..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/api.h +++ /dev/null @@ -1,12 +0,0 @@ - -#include "crypto_sign_edwards25519sha512batch.h" - -#define crypto_sign crypto_sign_edwards25519sha512batch -#define crypto_sign_open crypto_sign_edwards25519sha512batch_open -#define crypto_sign_keypair crypto_sign_edwards25519sha512batch_keypair -#define crypto_sign_BYTES crypto_sign_edwards25519sha512batch_BYTES -#define crypto_sign_PUBLICKEYBYTES crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES -#define crypto_sign_SECRETKEYBYTES crypto_sign_edwards25519sha512batch_SECRETKEYBYTES -#define crypto_sign_IMPLEMENTATION crypto_sign_edwards25519sha512batch_IMPLEMENTATION -#define crypto_sign_VERSION crypto_sign_edwards25519sha512batch_VERSION - diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519.h b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519.h deleted file mode 100644 index 98c613fa..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519.h +++ /dev/null @@ -1,54 +0,0 @@ -#ifndef FE25519_H -#define FE25519_H - -#define fe25519 crypto_sign_edwards25519sha512batch_fe25519 -#define fe25519_unpack crypto_sign_edwards25519sha512batch_fe25519_unpack -#define fe25519_pack crypto_sign_edwards25519sha512batch_fe25519_pack -#define fe25519_cmov crypto_sign_edwards25519sha512batch_fe25519_cmov -#define fe25519_setone crypto_sign_edwards25519sha512batch_fe25519_setone -#define fe25519_setzero crypto_sign_edwards25519sha512batch_fe25519_setzero -#define fe25519_neg crypto_sign_edwards25519sha512batch_fe25519_neg -#define fe25519_getparity crypto_sign_edwards25519sha512batch_fe25519_getparity -#define fe25519_add crypto_sign_edwards25519sha512batch_fe25519_add -#define fe25519_sub crypto_sign_edwards25519sha512batch_fe25519_sub -#define fe25519_mul crypto_sign_edwards25519sha512batch_fe25519_mul -#define fe25519_square crypto_sign_edwards25519sha512batch_fe25519_square -#define fe25519_pow crypto_sign_edwards25519sha512batch_fe25519_pow -#define fe25519_sqrt_vartime crypto_sign_edwards25519sha512batch_fe25519_sqrt_vartime -#define fe25519_invert crypto_sign_edwards25519sha512batch_fe25519_invert - -#include "crypto_uint32.h" - -typedef struct { - crypto_uint32 v[32]; -} fe25519; - -void fe25519_unpack(fe25519 *r, const unsigned char x[32]); - -void fe25519_pack(unsigned char r[32], const fe25519 *x); - -void fe25519_cmov(fe25519 *r, const fe25519 *x, unsigned char b); - -void fe25519_setone(fe25519 *r); - -void fe25519_setzero(fe25519 *r); - -void fe25519_neg(fe25519 *r, const fe25519 *x); - -unsigned char fe25519_getparity(const fe25519 *x); - -void fe25519_add(fe25519 *r, const fe25519 *x, const fe25519 *y); - -void fe25519_sub(fe25519 *r, const fe25519 *x, const fe25519 *y); - -void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y); - -void fe25519_square(fe25519 *r, const fe25519 *x); - -void fe25519_pow(fe25519 *r, const fe25519 *x, const unsigned char *e); - -int fe25519_sqrt_vartime(fe25519 *r, const fe25519 *x, unsigned char parity); - -void fe25519_invert(fe25519 *r, const fe25519 *x); - -#endif diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519_edwards25519sha512batch.c b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519_edwards25519sha512batch.c deleted file mode 100644 index df7a923e..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/fe25519_edwards25519sha512batch.c +++ /dev/null @@ -1,348 +0,0 @@ -#include "fe25519.h" - -#define WINDOWSIZE 4 /* Should be 1,2, or 4 */ -#define WINDOWMASK ((1<v[31] >> 7; - r->v[31] &= 127; - t *= 19; - r->v[0] += t; - for(i=0;i<31;i++) - { - t = r->v[i] >> 8; - r->v[i+1] += t; - r->v[i] &= 255; - } - } -} - -static void reduce_mul(fe25519 *r) -{ - crypto_uint32 t; - int i,rep; - - for(rep=0;rep<2;rep++) - { - t = r->v[31] >> 7; - r->v[31] &= 127; - t *= 19; - r->v[0] += t; - for(i=0;i<31;i++) - { - t = r->v[i] >> 8; - r->v[i+1] += t; - r->v[i] &= 255; - } - } -} - -/* reduction modulo 2^255-19 */ -static void freeze(fe25519 *r) -{ - int i; - unsigned int m = (r->v[31] == 127); - for(i=30;i>1;i--) - m *= (r->v[i] == 255); - m *= (r->v[0] >= 237); - - r->v[31] -= m*127; - for(i=30;i>0;i--) - r->v[i] -= m*255; - r->v[0] -= m*237; -} - -/*freeze input before calling isone*/ -static int isone(const fe25519 *x) -{ - int i; - int r = (x->v[0] == 1); - for(i=1;i<32;i++) - r *= (x->v[i] == 0); - return r; -} - -/*freeze input before calling iszero*/ -static int iszero(const fe25519 *x) -{ - int i; - int r = (x->v[0] == 0); - for(i=1;i<32;i++) - r *= (x->v[i] == 0); - return r; -} - - -static int issquare(const fe25519 *x) -{ - unsigned char e[32] = {0xf6,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x3f}; /* (p-1)/2 */ - fe25519 t; - - fe25519_pow(&t,x,e); - freeze(&t); - return isone(&t) || iszero(&t); -} - -void fe25519_unpack(fe25519 *r, const unsigned char x[32]) -{ - int i; - for(i=0;i<32;i++) r->v[i] = x[i]; - r->v[31] &= 127; -} - -/* Assumes input x being reduced mod 2^255 */ -void fe25519_pack(unsigned char r[32], const fe25519 *x) -{ - int i; - unsigned int m; - for(i=0;i<32;i++) - r[i] = x->v[i]; - - /* freeze byte array */ - m = (r[31] == 127); /* XXX: some compilers might use branches; fix */ - for(i=30;i>1;i--) - m *= (r[i] == 255); - m *= (r[0] >= 237); - r[31] -= m*127; - for(i=30;i>0;i--) - r[i] -= m*255; - r[0] -= m*237; -} - -void fe25519_cmov(fe25519 *r, const fe25519 *x, unsigned char b) -{ - unsigned char nb = 1-b; - int i; - for(i=0;i<32;i++) r->v[i] = nb * r->v[i] + b * x->v[i]; -} - -unsigned char fe25519_getparity(const fe25519 *x) -{ - fe25519 t; - int i; - for(i=0;i<32;i++) t.v[i] = x->v[i]; - freeze(&t); - return t.v[0] & 1; -} - -void fe25519_setone(fe25519 *r) -{ - int i; - r->v[0] = 1; - for(i=1;i<32;i++) r->v[i]=0; -} - -void fe25519_setzero(fe25519 *r) -{ - int i; - for(i=0;i<32;i++) r->v[i]=0; -} - -void fe25519_neg(fe25519 *r, const fe25519 *x) -{ - fe25519 t; - int i; - for(i=0;i<32;i++) t.v[i]=x->v[i]; - fe25519_setzero(r); - fe25519_sub(r, r, &t); -} - -void fe25519_add(fe25519 *r, const fe25519 *x, const fe25519 *y) -{ - int i; - for(i=0;i<32;i++) r->v[i] = x->v[i] + y->v[i]; - reduce_add_sub(r); -} - -void fe25519_sub(fe25519 *r, const fe25519 *x, const fe25519 *y) -{ - int i; - crypto_uint32 t[32]; - t[0] = x->v[0] + 0x1da; - t[31] = x->v[31] + 0xfe; - for(i=1;i<31;i++) t[i] = x->v[i] + 0x1fe; - for(i=0;i<32;i++) r->v[i] = t[i] - y->v[i]; - reduce_add_sub(r); -} - -void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y) -{ - int i,j; - crypto_uint32 t[63]; - for(i=0;i<63;i++)t[i] = 0; - - for(i=0;i<32;i++) - for(j=0;j<32;j++) - t[i+j] += x->v[i] * y->v[j]; - - for(i=32;i<63;i++) - r->v[i-32] = t[i-32] + 38*t[i]; - r->v[31] = t[31]; /* result now in r[0]...r[31] */ - - reduce_mul(r); -} - -void fe25519_square(fe25519 *r, const fe25519 *x) -{ - fe25519_mul(r, x, x); -} - -/*XXX: Make constant time! */ -void fe25519_pow(fe25519 *r, const fe25519 *x, const unsigned char *e) -{ - /* - fe25519 g; - fe25519_setone(&g); - int i; - unsigned char j; - for(i=32;i>0;i--) - { - for(j=128;j>0;j>>=1) - { - fe25519_square(&g,&g); - if(e[i-1] & j) - fe25519_mul(&g,&g,x); - } - } - for(i=0;i<32;i++) r->v[i] = g.v[i]; - */ - fe25519 g; - int i,j,k; - fe25519 t; - unsigned char w; - fe25519 pre[(1 << WINDOWSIZE)]; - - fe25519_setone(&g); - - // Precomputation - fe25519_setone(pre); - pre[1] = *x; - for(i=2;i<(1<0;i--) - { - for(j=8-WINDOWSIZE;j>=0;j-=WINDOWSIZE) - { - for(k=0;k>j) & WINDOWMASK; - t = pre[0]; - for(k=1;k<(1<v[i]; - fe25519_pow(&d,&d,e3); - for(i=0;i<32;i++) - r->v[i] = 2*x->v[i]; - fe25519_mul(r,r,&d); - } - freeze(r); - if((r->v[0] & 1) != (parity & 1)) - { - fe25519_sub(r,&p,r); - } - return 0; -} - -void fe25519_invert(fe25519 *r, const fe25519 *x) -{ - fe25519 z2; - fe25519 z9; - fe25519 z11; - fe25519 z2_5_0; - fe25519 z2_10_0; - fe25519 z2_20_0; - fe25519 z2_50_0; - fe25519 z2_100_0; - fe25519 t0; - fe25519 t1; - int i; - - /* 2 */ fe25519_square(&z2,x); - /* 4 */ fe25519_square(&t1,&z2); - /* 8 */ fe25519_square(&t0,&t1); - /* 9 */ fe25519_mul(&z9,&t0,x); - /* 11 */ fe25519_mul(&z11,&z9,&z2); - /* 22 */ fe25519_square(&t0,&z11); - /* 2^5 - 2^0 = 31 */ fe25519_mul(&z2_5_0,&t0,&z9); - - /* 2^6 - 2^1 */ fe25519_square(&t0,&z2_5_0); - /* 2^7 - 2^2 */ fe25519_square(&t1,&t0); - /* 2^8 - 2^3 */ fe25519_square(&t0,&t1); - /* 2^9 - 2^4 */ fe25519_square(&t1,&t0); - /* 2^10 - 2^5 */ fe25519_square(&t0,&t1); - /* 2^10 - 2^0 */ fe25519_mul(&z2_10_0,&t0,&z2_5_0); - - /* 2^11 - 2^1 */ fe25519_square(&t0,&z2_10_0); - /* 2^12 - 2^2 */ fe25519_square(&t1,&t0); - /* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); } - /* 2^20 - 2^0 */ fe25519_mul(&z2_20_0,&t1,&z2_10_0); - - /* 2^21 - 2^1 */ fe25519_square(&t0,&z2_20_0); - /* 2^22 - 2^2 */ fe25519_square(&t1,&t0); - /* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); } - /* 2^40 - 2^0 */ fe25519_mul(&t0,&t1,&z2_20_0); - - /* 2^41 - 2^1 */ fe25519_square(&t1,&t0); - /* 2^42 - 2^2 */ fe25519_square(&t0,&t1); - /* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fe25519_square(&t1,&t0); fe25519_square(&t0,&t1); } - /* 2^50 - 2^0 */ fe25519_mul(&z2_50_0,&t0,&z2_10_0); - - /* 2^51 - 2^1 */ fe25519_square(&t0,&z2_50_0); - /* 2^52 - 2^2 */ fe25519_square(&t1,&t0); - /* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); } - /* 2^100 - 2^0 */ fe25519_mul(&z2_100_0,&t1,&z2_50_0); - - /* 2^101 - 2^1 */ fe25519_square(&t1,&z2_100_0); - /* 2^102 - 2^2 */ fe25519_square(&t0,&t1); - /* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fe25519_square(&t1,&t0); fe25519_square(&t0,&t1); } - /* 2^200 - 2^0 */ fe25519_mul(&t1,&t0,&z2_100_0); - - /* 2^201 - 2^1 */ fe25519_square(&t0,&t1); - /* 2^202 - 2^2 */ fe25519_square(&t1,&t0); - /* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fe25519_square(&t0,&t1); fe25519_square(&t1,&t0); } - /* 2^250 - 2^0 */ fe25519_mul(&t0,&t1,&z2_50_0); - - /* 2^251 - 2^1 */ fe25519_square(&t1,&t0); - /* 2^252 - 2^2 */ fe25519_square(&t0,&t1); - /* 2^253 - 2^3 */ fe25519_square(&t1,&t0); - /* 2^254 - 2^4 */ fe25519_square(&t0,&t1); - /* 2^255 - 2^5 */ fe25519_square(&t1,&t0); - /* 2^255 - 21 */ fe25519_mul(r,&t1,&z11); -} diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519.h b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519.h deleted file mode 100644 index 49ad163a..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519.h +++ /dev/null @@ -1,34 +0,0 @@ -#ifndef GE25519_H -#define GE25519_H - -#include "fe25519.h" -#include "sc25519.h" - -#define ge25519 crypto_sign_edwards25519sha512batch_ge25519 -#define ge25519_unpack_vartime crypto_sign_edwards25519sha512batch_ge25519_unpack_vartime -#define ge25519_pack crypto_sign_edwards25519sha512batch_ge25519_pack -#define ge25519_add crypto_sign_edwards25519sha512batch_ge25519_add -#define ge25519_double crypto_sign_edwards25519sha512batch_ge25519_double -#define ge25519_scalarmult crypto_sign_edwards25519sha512batch_ge25519_scalarmult -#define ge25519_scalarmult_base crypto_sign_edwards25519sha512batch_ge25519_scalarmult_base - -typedef struct { - fe25519 x; - fe25519 y; - fe25519 z; - fe25519 t; -} ge25519; - -int ge25519_unpack_vartime(ge25519 *r, const unsigned char p[32]); - -void ge25519_pack(unsigned char r[32], const ge25519 *p); - -void ge25519_add(ge25519 *r, const ge25519 *p, const ge25519 *q); - -void ge25519_double(ge25519 *r, const ge25519 *p); - -void ge25519_scalarmult(ge25519 *r, const ge25519 *p, const sc25519 *s); - -void ge25519_scalarmult_base(ge25519 *r, const sc25519 *s); - -#endif diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519_edwards25519sha512batch.c b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519_edwards25519sha512batch.c deleted file mode 100644 index 253b68f4..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/ge25519_edwards25519sha512batch.c +++ /dev/null @@ -1,230 +0,0 @@ -#include "fe25519.h" -#include "sc25519.h" -#include "ge25519.h" - -/* - * Arithmetic on the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2 - * with d = -(121665/121666) = 37095705934669439343138083508754565189542113879843219016388785533085940283555 - * Base point: (15112221349535400772501151409588531511454012693041857206046113283949847762202,46316835694926478169428394003475163141307993866256225615783033603165251855960); - */ - -typedef struct -{ - fe25519 x; - fe25519 z; - fe25519 y; - fe25519 t; -} ge25519_p1p1; - -typedef struct -{ - fe25519 x; - fe25519 y; - fe25519 z; -} ge25519_p2; - -#define ge25519_p3 ge25519 - -/* Windowsize for fixed-window scalar multiplication */ -#define WINDOWSIZE 2 /* Should be 1,2, or 4 */ -#define WINDOWMASK ((1<x, &p->x, &p->t); - fe25519_mul(&r->y, &p->y, &p->z); - fe25519_mul(&r->z, &p->z, &p->t); -} - -static void p1p1_to_p3(ge25519_p3 *r, const ge25519_p1p1 *p) -{ - p1p1_to_p2((ge25519_p2 *)r, p); - fe25519_mul(&r->t, &p->x, &p->y); -} - -/* Constant-time version of: if(b) r = p */ -static void cmov_p3(ge25519_p3 *r, const ge25519_p3 *p, unsigned char b) -{ - fe25519_cmov(&r->x, &p->x, b); - fe25519_cmov(&r->y, &p->y, b); - fe25519_cmov(&r->z, &p->z, b); - fe25519_cmov(&r->t, &p->t, b); -} - -/* See http://www.hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#doubling-dbl-2008-hwcd */ -static void dbl_p1p1(ge25519_p1p1 *r, const ge25519_p2 *p) -{ - fe25519 a,b,c,d; - fe25519_square(&a, &p->x); - fe25519_square(&b, &p->y); - fe25519_square(&c, &p->z); - fe25519_add(&c, &c, &c); - fe25519_neg(&d, &a); - - fe25519_add(&r->x, &p->x, &p->y); - fe25519_square(&r->x, &r->x); - fe25519_sub(&r->x, &r->x, &a); - fe25519_sub(&r->x, &r->x, &b); - fe25519_add(&r->z, &d, &b); - fe25519_sub(&r->t, &r->z, &c); - fe25519_sub(&r->y, &d, &b); -} - -static void add_p1p1(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_p3 *q) -{ - fe25519 a, b, c, d, t, fd; - fe25519_unpack(&fd, ecd); - - fe25519_sub(&a, &p->y, &p->x); // A = (Y1-X1)*(Y2-X2) - fe25519_sub(&t, &q->y, &q->x); - fe25519_mul(&a, &a, &t); - fe25519_add(&b, &p->x, &p->y); // B = (Y1+X1)*(Y2+X2) - fe25519_add(&t, &q->x, &q->y); - fe25519_mul(&b, &b, &t); - fe25519_mul(&c, &p->t, &q->t); //C = T1*k*T2 - fe25519_mul(&c, &c, &fd); - fe25519_add(&c, &c, &c); //XXX: Can save this addition by precomputing 2*ecd - fe25519_mul(&d, &p->z, &q->z); //D = Z1*2*Z2 - fe25519_add(&d, &d, &d); - fe25519_sub(&r->x, &b, &a); // E = B-A - fe25519_sub(&r->t, &d, &c); // F = D-C - fe25519_add(&r->z, &d, &c); // G = D+C - fe25519_add(&r->y, &b, &a); // H = B+A -} - -/* ******************************************************************** - * EXPORTED FUNCTIONS - ******************************************************************** */ - -/* return 0 on success, -1 otherwise */ -int ge25519_unpack_vartime(ge25519_p3 *r, const unsigned char p[32]) -{ - int ret; - fe25519 t, fd; - unsigned char par; - - fe25519_setone(&r->z); - fe25519_unpack(&fd, ecd); - par = p[31] >> 7; - fe25519_unpack(&r->y, p); - fe25519_square(&r->x, &r->y); - fe25519_mul(&t, &r->x, &fd); - fe25519_sub(&r->x, &r->x, &r->z); - fe25519_add(&t, &r->z, &t); - fe25519_invert(&t, &t); - fe25519_mul(&r->x, &r->x, &t); - ret = fe25519_sqrt_vartime(&r->x, &r->x, par); - fe25519_mul(&r->t, &r->x, &r->y); - return ret; -} - -void ge25519_pack(unsigned char r[32], const ge25519_p3 *p) -{ - fe25519 tx, ty, zi; - fe25519_invert(&zi, &p->z); - fe25519_mul(&tx, &p->x, &zi); - fe25519_mul(&ty, &p->y, &zi); - fe25519_pack(r, &ty); - r[31] ^= fe25519_getparity(&tx) << 7; -} - -void ge25519_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q) -{ - ge25519_p1p1 grp1p1; - add_p1p1(&grp1p1, p, q); - p1p1_to_p3(r, &grp1p1); -} - -void ge25519_double(ge25519_p3 *r, const ge25519_p3 *p) -{ - ge25519_p1p1 grp1p1; - dbl_p1p1(&grp1p1, (const ge25519_p2 *)p); - p1p1_to_p3(r, &grp1p1); -} - -void ge25519_scalarmult(ge25519_p3 *r, const ge25519_p3 *p, const sc25519 *s) -{ - int i,j,k; - ge25519_p3 g; - ge25519_p3 pre[(1 << WINDOWSIZE)]; - ge25519_p3 t; - ge25519_p1p1 tp1p1; - unsigned char w; - unsigned char sb[32]; - - fe25519_unpack(&g.x, ge25519_neutral_x); - fe25519_unpack(&g.y, ge25519_neutral_y); - fe25519_unpack(&g.z, ge25519_neutral_z); - fe25519_unpack(&g.t, ge25519_neutral_t); - - sc25519_to32bytes(sb, s); - - // Precomputation - pre[0] = g; - pre[1] = *p; - for(i=2;i<(1<0;i--) - { - for(j=8-WINDOWSIZE;j>=0;j-=WINDOWSIZE) - { - for(k=0;k>j) & WINDOWMASK; - t = pre[0]; - for(k=1;k<(1<x = g.x; - r->y = g.y; - r->z = g.z; - r->t = g.t; -} - -void ge25519_scalarmult_base(ge25519_p3 *r, const sc25519 *s) -{ - /* XXX: Better algorithm for known-base-point scalar multiplication */ - ge25519_p3 t; - fe25519_unpack(&t.x, ge25519_base_x); - fe25519_unpack(&t.y, ge25519_base_y); - fe25519_unpack(&t.z, ge25519_base_z); - fe25519_unpack(&t.t, ge25519_base_t); - ge25519_scalarmult(r, &t, s); -} diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519.h b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519.h deleted file mode 100644 index f791dea4..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519.h +++ /dev/null @@ -1,51 +0,0 @@ -#ifndef SC25519_H -#define SC25519_H - -#define sc25519 crypto_sign_edwards25519sha512batch_sc25519 -#define sc25519_from32bytes crypto_sign_edwards25519sha512batch_sc25519_from32bytes -#define sc25519_from64bytes crypto_sign_edwards25519sha512batch_sc25519_from64bytes -#define sc25519_to32bytes crypto_sign_edwards25519sha512batch_sc25519_to32bytes -#define sc25519_pack crypto_sign_edwards25519sha512batch_sc25519_pack -#define sc25519_getparity crypto_sign_edwards25519sha512batch_sc25519_getparity -#define sc25519_setone crypto_sign_edwards25519sha512batch_sc25519_setone -#define sc25519_setzero crypto_sign_edwards25519sha512batch_sc25519_setzero -#define sc25519_neg crypto_sign_edwards25519sha512batch_sc25519_neg -#define sc25519_add crypto_sign_edwards25519sha512batch_sc25519_add -#define sc25519_sub crypto_sign_edwards25519sha512batch_sc25519_sub -#define sc25519_mul crypto_sign_edwards25519sha512batch_sc25519_mul -#define sc25519_square crypto_sign_edwards25519sha512batch_sc25519_square -#define sc25519_invert crypto_sign_edwards25519sha512batch_sc25519_invert - -#include "crypto_uint32.h" - -typedef struct { - crypto_uint32 v[32]; -} sc25519; - -void sc25519_from32bytes(sc25519 *r, const unsigned char x[32]); - -void sc25519_from64bytes(sc25519 *r, const unsigned char x[64]); - -void sc25519_to32bytes(unsigned char r[32], const sc25519 *x); - -void sc25519_pack(unsigned char r[32], const sc25519 *x); - -unsigned char sc25519_getparity(const sc25519 *x); - -void sc25519_setone(sc25519 *r); - -void sc25519_setzero(sc25519 *r); - -void sc25519_neg(sc25519 *r, const sc25519 *x); - -void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y); - -void sc25519_sub(sc25519 *r, const sc25519 *x, const sc25519 *y); - -void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y); - -void sc25519_square(sc25519 *r, const sc25519 *x); - -void sc25519_invert(sc25519 *r, const sc25519 *x); - -#endif diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519_edwards25519sha512batch.c b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519_edwards25519sha512batch.c deleted file mode 100644 index 085e3f92..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sc25519_edwards25519sha512batch.c +++ /dev/null @@ -1,150 +0,0 @@ -#include "sc25519.h" - -/*Arithmetic modulo the group order n = 2^252 + 27742317777372353535851937790883648493 = 7237005577332262213973186563042994240857116359379907606001950938285454250989 */ - -static const crypto_uint32 m[32] = {0xED, 0xD3, 0xF5, 0x5C, 0x1A, 0x63, 0x12, 0x58, 0xD6, 0x9C, 0xF7, 0xA2, 0xDE, 0xF9, 0xDE, 0x14, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10}; - -static const crypto_uint32 mu[33] = {0x1B, 0x13, 0x2C, 0x0A, 0xA3, 0xE5, 0x9C, 0xED, 0xA7, 0x29, 0x63, 0x08, 0x5D, 0x21, 0x06, 0x21, - 0xEB, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x0F}; - -/* Reduce coefficients of r before calling reduce_add_sub */ -static void reduce_add_sub(sc25519 *r) -{ - int i, b, pb=0, nb; - unsigned char t[32]; - - for(i=0;i<32;i++) - { - b = (r->v[i]v[i]-pb-m[i]+b*256; - pb = b; - } - nb = 1-b; - for(i=0;i<32;i++) - r->v[i] = r->v[i]*b + t[i]*nb; -} - -/* Reduce coefficients of x before calling barrett_reduce */ -static void barrett_reduce(sc25519 *r, const crypto_uint32 x[64]) -{ - /* See HAC, Alg. 14.42 */ - int i,j; - crypto_uint32 q2[66] = {0}; - crypto_uint32 *q3 = q2 + 33; - crypto_uint32 r1[33]; - crypto_uint32 r2[33] = {0}; - crypto_uint32 carry; - int b, pb=0; - - for(i=0;i<33;i++) - for(j=0;j<33;j++) - if(i+j >= 31) q2[i+j] += mu[i]*x[j+31]; - carry = q2[31] >> 8; - q2[32] += carry; - carry = q2[32] >> 8; - q2[33] += carry; - - for(i=0;i<33;i++)r1[i] = x[i]; - for(i=0;i<32;i++) { - for(j=0;j<33;j++) { - if(i+j < 33) { - /* coverity[overrun-local] */ - r2[i+j] += m[i]*q3[j]; - } - } - } - for(i=0;i<32;i++) - { - carry = r2[i] >> 8; - r2[i+1] += carry; - r2[i] &= 0xff; - } - - for(i=0;i<32;i++) - { - b = (r1[i]v[i] = r1[i]-pb-r2[i]+b*256; - pb = b; - } - - /* XXX: Can it really happen that r<0?, See HAC, Alg 14.42, Step 3 - * If so: Handle it here! - */ - - reduce_add_sub(r); - reduce_add_sub(r); -} - -/* -static int iszero(const sc25519 *x) -{ - // Implement - return 0; -} -*/ - -void sc25519_from32bytes(sc25519 *r, const unsigned char x[32]) -{ - int i; - crypto_uint32 t[64] = {0}; - for(i=0;i<32;i++) t[i] = x[i]; - barrett_reduce(r, t); -} - -void sc25519_from64bytes(sc25519 *r, const unsigned char x[64]) -{ - int i; - crypto_uint32 t[64] = {0}; - for(i=0;i<64;i++) t[i] = x[i]; - barrett_reduce(r, t); -} - -/* XXX: What we actually want for crypto_group is probably just something like - * void sc25519_frombytes(sc25519 *r, const unsigned char *x, size_t xlen) - */ - -void sc25519_to32bytes(unsigned char r[32], const sc25519 *x) -{ - int i; - for(i=0;i<32;i++) r[i] = x->v[i]; -} - -void sc25519_add(sc25519 *r, const sc25519 *x, const sc25519 *y) -{ - int i, carry; - for(i=0;i<32;i++) r->v[i] = x->v[i] + y->v[i]; - for(i=0;i<31;i++) - { - carry = r->v[i] >> 8; - r->v[i+1] += carry; - r->v[i] &= 0xff; - } - reduce_add_sub(r); -} - -void sc25519_mul(sc25519 *r, const sc25519 *x, const sc25519 *y) -{ - int i,j,carry; - crypto_uint32 t[64]; - for(i=0;i<64;i++)t[i] = 0; - - for(i=0;i<32;i++) - for(j=0;j<32;j++) - t[i+j] += x->v[i] * y->v[j]; - - /* Reduce coefficients */ - for(i=0;i<63;i++) - { - carry = t[i] >> 8; - t[i+1] += carry; - t[i] &= 0xff; - } - - barrett_reduce(r, t); -} - -void sc25519_square(sc25519 *r, const sc25519 *x) -{ - sc25519_mul(r, x, x); -} diff --git a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sign_edwards25519sha512batch.c b/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sign_edwards25519sha512batch.c deleted file mode 100644 index 9c548dcf..00000000 --- a/libsodium/src/libsodium/crypto_sign/edwards25519sha512batch/ref/sign_edwards25519sha512batch.c +++ /dev/null @@ -1,102 +0,0 @@ -#include "api.h" -#include "crypto_hash_sha512.h" -#include "randombytes.h" -#include "crypto_verify_32.h" - -#include "ge25519.h" - -int crypto_sign_keypair( - unsigned char *pk, - unsigned char *sk - ) -{ - sc25519 scsk; - ge25519 gepk; - - randombytes_buf(sk, 32); - crypto_hash_sha512(sk, sk, 32); - sk[0] &= 248; - sk[31] &= 127; - sk[31] |= 64; - - sc25519_from32bytes(&scsk,sk); - - ge25519_scalarmult_base(&gepk, &scsk); - ge25519_pack(pk, &gepk); - return 0; -} - -int crypto_sign( - unsigned char *sm,unsigned long long *smlen, - const unsigned char *m,unsigned long long mlen, - const unsigned char *sk - ) -{ - sc25519 sck, scs, scsk; - ge25519 ger; - unsigned char r[32]; - unsigned char s[32]; - unsigned long long i; - unsigned char hmg[crypto_hash_sha512_BYTES]; - unsigned char hmr[crypto_hash_sha512_BYTES]; - - *smlen = mlen+64; - for(i=0;i