xed25519.h

Go to the documentation of this file.

// xed25519.h - written and placed in public domain by Jeffrey Walton
//              Crypto++ specific implementation wrapped around Andrew
//              Moon's public domain curve25519-donna and ed25519-donna,
//              http://github.com/floodyberry/curve25519-donna and
//              http://github.com/floodyberry/ed25519-donna.
 
// Typically the key agreement classes encapsulate their data more
// than x25519 does below. They are a little more accessible
// due to crypto_box operations.
 
 
#ifndef CRYPTOPP_XED25519_H
#define CRYPTOPP_XED25519_H
 
#include "cryptlib.h"
#include "pubkey.h"
#include "oids.h"
 
NAMESPACE_BEGIN(CryptoPP)
 
class Integer;
struct ed25519Signer;
struct ed25519Verifier;
 
// ******************** x25519 Agreement ************************* //
 
class x25519 : public SimpleKeyAgreementDomain, public CryptoParameters, public PKCS8PrivateKey
{
public:
    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(SHARED_KEYLENGTH = 32);
 
    virtual ~x25519() {}
 
    x25519() {}
 
    x25519(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
 
    x25519(const byte x[SECRET_KEYLENGTH]);
 
    x25519(const Integer &y, const Integer &x);
 
    x25519(const Integer &x);
 
    x25519(RandomNumberGenerator &rng);
 
    x25519(BufferedTransformation &params);
 
    x25519(const OID &oid);
 
    void ClampKey(byte x[SECRET_KEYLENGTH]) const;
 
    bool IsClamped(const byte x[SECRET_KEYLENGTH]) const;
 
    bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
 
    OID GetAlgorithmID() const {
        return m_oid.Empty() ? ASN1::X25519() : m_oid;
    }
 
    void SetAlgorithmID(const OID& oid) {
        m_oid = oid;
    }
 
    // CryptoParameters
    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
    void AssignFrom(const NameValuePairs &source);
 
    // CryptoParameters
    CryptoParameters & AccessCryptoParameters() {return *this;}
 
    void Save(BufferedTransformation &bt) const {
        DEREncode(bt, 0);
    }
 
    void Save(BufferedTransformation &bt, bool v1) const {
        DEREncode(bt, v1 ? 0 : 1);
    }
 
    void Load(BufferedTransformation &bt) {
        BERDecode(bt);
    }
 
    // PKCS8PrivateKey
    void BERDecode(BufferedTransformation &bt);
    void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
    void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
    void DEREncodePrivateKey(BufferedTransformation &bt) const;
 
    void DEREncode(BufferedTransformation &bt, int version) const;
 
    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
 
    // DL_PrivateKey
    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
 
    // SimpleKeyAgreementDomain
    unsigned int AgreedValueLength() const {return SHARED_KEYLENGTH;}
    unsigned int PrivateKeyLength() const {return SECRET_KEYLENGTH;}
    unsigned int PublicKeyLength() const {return PUBLIC_KEYLENGTH;}
 
    // SimpleKeyAgreementDomain
    void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const;
    void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const;
    bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const;
 
protected:
    // Create a public key from a private key
    void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
 
protected:
    FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
    OID m_oid;  // preferred OID
};
 
// ****************** ed25519 Signer *********************** //
 
struct ed25519_MessageAccumulator : public PK_MessageAccumulator
{
    CRYPTOPP_CONSTANT(RESERVE_SIZE=2048+64);
    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH=64);
 
    ed25519_MessageAccumulator() {
        Restart();
    }
 
    ed25519_MessageAccumulator(RandomNumberGenerator &rng) {
        CRYPTOPP_UNUSED(rng); Restart();
    }
 
    void Update(const byte* msg, size_t len) {
        if (msg && len)
            m_msg.insert(m_msg.end(), msg, msg+len);
    }
 
    void Restart() {
        m_msg.reserve(RESERVE_SIZE);
        m_msg.resize(SIGNATURE_LENGTH);
    }
 
    byte* signature() {
        return &m_msg[0];
    }
 
    const byte* signature() const {
        return &m_msg[0];
    }
 
    const byte* data() const {
        return &m_msg[0]+SIGNATURE_LENGTH;
    }
 
    size_t size() const {
        return m_msg.size()-SIGNATURE_LENGTH;
    }
 
protected:
    // TODO: Find an equivalent Crypto++ structure.
    std::vector<byte, AllocatorWithCleanup<byte> > m_msg;
};
 
struct ed25519PrivateKey : public PKCS8PrivateKey
{
    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
 
    virtual ~ed25519PrivateKey() {}
 
    // CryptoMaterial
    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
    void AssignFrom(const NameValuePairs &source);
 
    // GroupParameters
    OID GetAlgorithmID() const {
        return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
    }
 
    void Save(BufferedTransformation &bt) const {
        DEREncode(bt, 0);
    }
 
    void Save(BufferedTransformation &bt, bool v1) const {
        DEREncode(bt, v1 ? 0 : 1);
    }
 
    void Load(BufferedTransformation &bt) {
        BERDecode(bt);
    }
 
    void MakePublicKey(PublicKey &pub) const;
 
    // PKCS8PrivateKey
    void BERDecode(BufferedTransformation &bt);
    void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
    void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
    void DEREncodePrivateKey(BufferedTransformation &bt) const;
 
    void DEREncode(BufferedTransformation &bt, int version) const;
 
    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
 
    // PKCS8PrivateKey
    void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
    void SetPrivateExponent(const byte x[SECRET_KEYLENGTH]);
    void SetPrivateExponent(const Integer &x);
    const Integer& GetPrivateExponent() const;
 
    bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
 
    const byte* GetPrivateKeyBytePtr() const {
        return m_sk.begin();
    }
 
    const byte* GetPublicKeyBytePtr() const {
        return m_pk.begin();
    }
 
protected:
    // Create a public key from a private key
    void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
 
protected:
    FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
    OID m_oid;  // preferred OID
    mutable Integer m_x;  // for DL_PrivateKey
};
 
struct ed25519Signer : public PK_Signer
{
    CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
    typedef Integer Element;
 
    virtual ~ed25519Signer() {}
 
    ed25519Signer() {}
 
    ed25519Signer(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
 
    ed25519Signer(const byte x[SECRET_KEYLENGTH]);
 
    ed25519Signer(const Integer &y, const Integer &x);
 
    ed25519Signer(const Integer &x);
 
    ed25519Signer(const PKCS8PrivateKey &key);
 
    ed25519Signer(RandomNumberGenerator &rng);
 
    ed25519Signer(BufferedTransformation &params);
 
    // DL_ObjectImplBase
    PrivateKey& AccessKey() { return m_key; }
    PrivateKey& AccessPrivateKey() { return m_key; }
 
    const PrivateKey& GetKey() const { return m_key; }
    const PrivateKey& GetPrivateKey() const { return m_key; }
 
    // DL_SignatureSchemeBase
    size_t SignatureLength() const { return SIGNATURE_LENGTH; }
    size_t MaxRecoverableLength() const { return 0; }
    size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
        CRYPTOPP_UNUSED(signatureLength); return 0;
    }
 
    bool IsProbabilistic() const { return false; }
    bool AllowNonrecoverablePart() const { return false; }
    bool RecoverablePartFirst() const { return false; }
 
    PK_MessageAccumulator* NewSignatureAccumulator(RandomNumberGenerator &rng) const {
        return new ed25519_MessageAccumulator(rng);
    }
 
    void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const {
        CRYPTOPP_UNUSED(messageAccumulator); CRYPTOPP_UNUSED(recoverableMessage);
        CRYPTOPP_UNUSED(recoverableMessageLength);
        throw NotImplemented("ed25519Signer: this object does not support recoverable messages");
    }
 
    size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const;
 
    size_t SignStream (RandomNumberGenerator &rng, std::istream& stream, byte *signature) const;
 
protected:
    ed25519PrivateKey m_key;
};
 
// ****************** ed25519 Verifier *********************** //
 
struct ed25519PublicKey : public X509PublicKey
{
    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
    typedef Integer Element;
 
    virtual ~ed25519PublicKey() {}
 
    OID GetAlgorithmID() const {
        return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
    }
 
    void Save(BufferedTransformation &bt) const {
        DEREncode(bt);
    }
 
    void Load(BufferedTransformation &bt) {
        BERDecode(bt);
    }
 
    // X509PublicKey
    void BERDecode(BufferedTransformation &bt);
    void DEREncode(BufferedTransformation &bt) const;
    void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
    void DEREncodePublicKey(BufferedTransformation &bt) const;
 
    void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
 
    bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
    bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
    void AssignFrom(const NameValuePairs &source);
 
    // DL_PublicKey
    void SetPublicElement(const byte y[PUBLIC_KEYLENGTH]);
    void SetPublicElement(const Element &y);
    const Element& GetPublicElement() const;
 
    const byte* GetPublicKeyBytePtr() const {
        return m_pk.begin();
    }
 
protected:
    FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
    OID m_oid;  // preferred OID
    mutable Integer m_y;  // for DL_PublicKey
};
 
struct ed25519Verifier : public PK_Verifier
{
    CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32);
    CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64);
    typedef Integer Element;
 
    virtual ~ed25519Verifier() {}
 
    ed25519Verifier() {}
 
    ed25519Verifier(const byte y[PUBLIC_KEYLENGTH]);
 
    ed25519Verifier(const Integer &y);
 
    ed25519Verifier(const X509PublicKey &key);
 
    ed25519Verifier(BufferedTransformation &params);
 
    ed25519Verifier(const ed25519Signer& signer);
 
    // DL_ObjectImplBase
    PublicKey& AccessKey() { return m_key; }
    PublicKey& AccessPublicKey() { return m_key; }
 
    const PublicKey& GetKey() const { return m_key; }
    const PublicKey& GetPublicKey() const { return m_key; }
 
    // DL_SignatureSchemeBase
    size_t SignatureLength() const { return SIGNATURE_LENGTH; }
    size_t MaxRecoverableLength() const { return 0; }
    size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
        CRYPTOPP_UNUSED(signatureLength); return 0;
    }
 
    bool IsProbabilistic() const { return false; }
    bool AllowNonrecoverablePart() const { return false; }
    bool RecoverablePartFirst() const { return false; }
 
    ed25519_MessageAccumulator* NewVerificationAccumulator() const {
        return new ed25519_MessageAccumulator;
    }
 
    void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const {
        CRYPTOPP_ASSERT(signature != NULLPTR);
        CRYPTOPP_ASSERT(signatureLength == SIGNATURE_LENGTH);
        ed25519_MessageAccumulator& accum = static_cast<ed25519_MessageAccumulator&>(messageAccumulator);
        if (signature && signatureLength)
            std::memcpy(accum.signature(), signature, STDMIN((size_t)SIGNATURE_LENGTH, signatureLength));
    }
 
    bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const;
 
    bool VerifyStream(std::istream& stream, const byte *signature, size_t signatureLen) const;
 
    DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const {
        CRYPTOPP_UNUSED(recoveredMessage); CRYPTOPP_UNUSED(messageAccumulator);
        throw NotImplemented("ed25519Verifier: this object does not support recoverable messages");
    }
 
protected:
    ed25519PublicKey m_key;
};
 
struct ed25519
{
    typedef ed25519Signer Signer;
    typedef ed25519Verifier Verifier;
};
 
NAMESPACE_END  // CryptoPP
 
#endif  // CRYPTOPP_XED25519_H