Macros | Functions | Variables
crypto_curve25519.c File Reference
#include "orconfig.h"
#include "lib/ctime/di_ops.h"
#include "lib/crypt_ops/crypto_curve25519.h"
#include "lib/crypt_ops/crypto_digest.h"
#include "lib/crypt_ops/crypto_format.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/crypt_ops/crypto_util.h"
#include "lib/log/log.h"
#include "lib/log/util_bug.h"
#include "ed25519/donna/ed25519_donna_tor.h"
#include <string.h>

Go to the source code of this file.


static void pick_curve25519_basepoint_impl (void)
STATIC int curve25519_impl (uint8_t *output, const uint8_t *secret, const uint8_t *point)
STATIC int curve25519_basepoint_impl (uint8_t *output, const uint8_t *secret)
void curve25519_set_impl_params (int use_ed)
int curve25519_public_key_is_ok (const curve25519_public_key_t *key)
int curve25519_rand_seckey_bytes (uint8_t *out, int extra_strong)
int curve25519_secret_key_generate (curve25519_secret_key_t *key_out, int extra_strong)
void curve25519_public_key_generate (curve25519_public_key_t *key_out, const curve25519_secret_key_t *seckey)
int curve25519_keypair_generate (curve25519_keypair_t *keypair_out, int extra_strong)
int curve25519_keypair_write_to_file (const curve25519_keypair_t *keypair, const char *fname, const char *tag)
int curve25519_keypair_read_from_file (curve25519_keypair_t *keypair_out, char **tag_out, const char *fname)
void curve25519_handshake (uint8_t *output, const curve25519_secret_key_t *skey, const curve25519_public_key_t *pkey)
static int curve25519_basepoint_spot_check (void)
void curve25519_init (void)


static int curve25519_use_ed = -1

Detailed Description

Wrapper code for a curve25519 implementation.

Curve25519 is an Elliptic-Curve Diffie Hellman handshake, designed by Dan Bernstein. For more information, see

Tor uses Curve25519 as the basis of its "ntor" circuit extension handshake, and in related code. The functions in this module are used to find the most suitable available Curve25519 implementation, to provide wrappers around it, and so on.

Definition in file crypto_curve25519.c.

Function Documentation

◆ curve25519_basepoint_impl()

STATIC int curve25519_basepoint_impl ( uint8_t *  output,
const uint8_t *  secret 

Helper function: Multiply the scalar "secret" by the Curve25519 basepoint (X=9), and store the result in "output". Return 0 on success, -1 on failure.

Definition at line 90 of file crypto_curve25519.c.

Referenced by curve25519_basepoint_spot_check(), and curve25519_public_key_generate().

◆ curve25519_basepoint_spot_check()

static int curve25519_basepoint_spot_check ( void  )

Check whether the ed25519-based curve25519 basepoint optimization seems to be working. If so, return 0; otherwise return -1.

Definition at line 278 of file crypto_curve25519.c.

References curve25519_basepoint_impl(), and curve25519_use_ed.

Referenced by pick_curve25519_basepoint_impl().

◆ curve25519_handshake()

void curve25519_handshake ( uint8_t *  output,
const curve25519_secret_key_t skey,
const curve25519_public_key_t pkey 

Perform the curve25519 ECDH handshake with skey and pkey, writing CURVE25519_OUTPUT_LEN bytes of output into output.

Definition at line 268 of file crypto_curve25519.c.

References curve25519_impl().

◆ curve25519_impl()

STATIC int curve25519_impl ( uint8_t *  output,
const uint8_t *  secret,
const uint8_t *  point 

Helper function: call the most appropriate backend to compute the scalar "secret" times the point "point". Store the result in "output". Return 0 on success, negative on failure.

Definition at line 65 of file crypto_curve25519.c.

References CURVE25519_PUBKEY_LEN, and memwipe().

Referenced by curve25519_handshake().

◆ curve25519_init()

void curve25519_init ( void  )

Initialize the curve25519 implementations. This is necessary if you're going to use them in a multithreaded setting, and not otherwise.

Definition at line 363 of file crypto_curve25519.c.

References pick_curve25519_basepoint_impl().

◆ curve25519_keypair_generate()

int curve25519_keypair_generate ( curve25519_keypair_t keypair_out,
int  extra_strong 

Construct a new keypair in *keypair_out. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

Definition at line 190 of file crypto_curve25519.c.

References curve25519_public_key_generate(), and curve25519_secret_key_generate().

◆ curve25519_keypair_read_from_file()

int curve25519_keypair_read_from_file ( curve25519_keypair_t keypair_out,
char **  tag_out,
const char *  fname 

Read a curve25519 keypair from a file named fname created by curve25519_keypair_write_to_file(). Store the keypair in keypair_out, and the associated tag string in tag_out. Return 0 on success, and -1 on failure.

Definition at line 233 of file crypto_curve25519.c.

References crypto_read_tagged_contents_from_file(), CURVE25519_PUBKEY_LEN, curve25519_public_key_generate(), and CURVE25519_SECKEY_LEN.

◆ curve25519_keypair_write_to_file()

int curve25519_keypair_write_to_file ( const curve25519_keypair_t keypair,
const char *  fname,
const char *  tag 

Store the keypair keypair, including its secret and public parts, to the file fname. Use the string tag tag to distinguish this from other Curve25519 keypairs. Return 0 on success, -1 on failure.

See crypto_write_tagged_contents_to_file() for more information on the metaformat used for these keys.

Definition at line 207 of file crypto_curve25519.c.

◆ curve25519_public_key_generate()

void curve25519_public_key_generate ( curve25519_public_key_t key_out,
const curve25519_secret_key_t seckey 

Given a secret key in seckey, create the corresponding public key in key_out.

Definition at line 179 of file crypto_curve25519.c.

References curve25519_basepoint_impl().

Referenced by curve25519_keypair_generate(), and curve25519_keypair_read_from_file().

◆ curve25519_public_key_is_ok()

int curve25519_public_key_is_ok ( const curve25519_public_key_t key)

Return true iff a curve25519_public_key_t seems valid. (It's not necessary to see if the point is on the curve, since the twist is also secure, but we do need to make sure that it isn't the point at infinity.)

Definition at line 132 of file crypto_curve25519.c.

References CURVE25519_PUBKEY_LEN, and safe_mem_is_zero().

◆ curve25519_rand_seckey_bytes()

int curve25519_rand_seckey_bytes ( uint8_t *  out,
int  extra_strong 

Generate CURVE25519_SECKEY_LEN random bytes in out. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

This function does not adjust the output of the RNG at all; the will caller will need to clear or set the appropriate bits to make curve25519 work.

Definition at line 147 of file crypto_curve25519.c.

References crypto_strongest_rand(), and CURVE25519_SECKEY_LEN.

Referenced by curve25519_secret_key_generate().

◆ curve25519_secret_key_generate()

int curve25519_secret_key_generate ( curve25519_secret_key_t key_out,
int  extra_strong 

Generate a new keypair and return the secret key. If extra_strong is true, this key is possibly going to get used more than once, so use a better-than-usual RNG. Return 0 on success, -1 on failure.

Definition at line 161 of file crypto_curve25519.c.

References curve25519_rand_seckey_bytes().

Referenced by curve25519_keypair_generate().

◆ curve25519_set_impl_params()

void curve25519_set_impl_params ( int  use_ed)

Override the decision of whether to use the Ed25519-based basepoint multiply function. Used for testing.

Definition at line 118 of file crypto_curve25519.c.

References curve25519_use_ed.

◆ pick_curve25519_basepoint_impl()

static void pick_curve25519_basepoint_impl ( void  )

Choose whether to use the ed25519-based curve25519-basepoint implementation.

Definition at line 344 of file crypto_curve25519.c.

References curve25519_basepoint_spot_check(), and curve25519_use_ed.

Referenced by curve25519_init().

Variable Documentation

◆ curve25519_use_ed

int curve25519_use_ed = -1

This is set to 1 if we have an optimized Ed25519-based implementation for multiplying a value by the basepoint; to 0 if we don't, and to -1 if we haven't checked.

Definition at line 57 of file crypto_curve25519.c.

Referenced by curve25519_basepoint_spot_check(), curve25519_set_impl_params(), and pick_curve25519_basepoint_impl().