1 // The MIT License (MIT) 2 // 3 // Copyright (c) 2015-2016 the fiat-crypto authors (see the AUTHORS file). 4 // 5 // Permission is hereby granted, free of charge, to any person obtaining a copy 6 // of this software and associated documentation files (the "Software"), to deal 7 // in the Software without restriction, including without limitation the rights 8 // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 // copies of the Software, and to permit persons to whom the Software is 10 // furnished to do so, subject to the following conditions: 11 // 12 // The above copyright notice and this permission notice shall be included in all 13 // copies or substantial portions of the Software. 14 // 15 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 // SOFTWARE. 22 23 #ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H 24 #define OPENSSL_HEADER_CURVE25519_INTERNAL_H 25 26 #if defined(__cplusplus) 27 extern "C" { 28 #endif 29 30 #include <openssl/base.h> 31 32 #include "../../crypto/internal.h" 33 34 35 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE) 36 #define BORINGSSL_X25519_NEON 37 38 // x25519_NEON is defined in asm/x25519-arm.S. 39 void x25519_NEON(uint8_t out[32], const uint8_t scalar[32], 40 const uint8_t point[32]); 41 #endif 42 43 #if defined(BORINGSSL_HAS_UINT128) 44 #define BORINGSSL_CURVE25519_64BIT 45 #endif 46 47 #if defined(BORINGSSL_CURVE25519_64BIT) 48 // fe means field element. Here the field is \Z/(2^255-19). An element t, 49 // entries t[0]...t[4], represents the integer t[0]+2^51 t[1]+2^102 t[2]+2^153 50 // t[3]+2^204 t[4]. 51 // fe limbs are bounded by 1.125*2^51. 52 // Multiplication and carrying produce fe from fe_loose. 53 typedef struct fe { uint64_t v[5]; } fe; 54 55 // fe_loose limbs are bounded by 3.375*2^51. 56 // Addition and subtraction produce fe_loose from (fe, fe). 57 typedef struct fe_loose { uint64_t v[5]; } fe_loose; 58 #else 59 // fe means field element. Here the field is \Z/(2^255-19). An element t, 60 // entries t[0]...t[9], represents the integer t[0]+2^26 t[1]+2^51 t[2]+2^77 61 // t[3]+2^102 t[4]+...+2^230 t[9]. 62 // fe limbs are bounded by 1.125*2^26,1.125*2^25,1.125*2^26,1.125*2^25,etc. 63 // Multiplication and carrying produce fe from fe_loose. 64 typedef struct fe { uint32_t v[10]; } fe; 65 66 // fe_loose limbs are bounded by 3.375*2^26,3.375*2^25,3.375*2^26,3.375*2^25,etc. 67 // Addition and subtraction produce fe_loose from (fe, fe). 68 typedef struct fe_loose { uint32_t v[10]; } fe_loose; 69 #endif 70 71 // ge means group element. 72 // 73 // Here the group is the set of pairs (x,y) of field elements (see fe.h) 74 // satisfying -x^2 + y^2 = 1 + d x^2y^2 75 // where d = -121665/121666. 76 // 77 // Representations: 78 // ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z 79 // ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT 80 // ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T 81 // ge_precomp (Duif): (y+x,y-x,2dxy) 82 83 typedef struct { 84 fe X; 85 fe Y; 86 fe Z; 87 } ge_p2; 88 89 typedef struct { 90 fe X; 91 fe Y; 92 fe Z; 93 fe T; 94 } ge_p3; 95 96 typedef struct { 97 fe_loose X; 98 fe_loose Y; 99 fe_loose Z; 100 fe_loose T; 101 } ge_p1p1; 102 103 typedef struct { 104 fe_loose yplusx; 105 fe_loose yminusx; 106 fe_loose xy2d; 107 } ge_precomp; 108 109 typedef struct { 110 fe_loose YplusX; 111 fe_loose YminusX; 112 fe_loose Z; 113 fe_loose T2d; 114 } ge_cached; 115 116 void x25519_ge_tobytes(uint8_t s[32], const ge_p2 *h); 117 int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t *s); 118 void x25519_ge_p3_to_cached(ge_cached *r, const ge_p3 *p); 119 void x25519_ge_p1p1_to_p2(ge_p2 *r, const ge_p1p1 *p); 120 void x25519_ge_p1p1_to_p3(ge_p3 *r, const ge_p1p1 *p); 121 void x25519_ge_add(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q); 122 void x25519_ge_sub(ge_p1p1 *r, const ge_p3 *p, const ge_cached *q); 123 void x25519_ge_scalarmult_small_precomp( 124 ge_p3 *h, const uint8_t a[32], const uint8_t precomp_table[15 * 2 * 32]); 125 void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]); 126 void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A); 127 void x25519_sc_reduce(uint8_t s[64]); 128 129 enum spake2_state_t { 130 spake2_state_init = 0, 131 spake2_state_msg_generated, 132 spake2_state_key_generated, 133 }; 134 135 struct spake2_ctx_st { 136 uint8_t private_key[32]; 137 uint8_t my_msg[32]; 138 uint8_t password_scalar[32]; 139 uint8_t password_hash[64]; 140 uint8_t *my_name; 141 size_t my_name_len; 142 uint8_t *their_name; 143 size_t their_name_len; 144 enum spake2_role_t my_role; 145 enum spake2_state_t state; 146 char disable_password_scalar_hack; 147 }; 148 149 150 #if defined(__cplusplus) 151 } // extern C 152 #endif 153 154 #endif // OPENSSL_HEADER_CURVE25519_INTERNAL_H 155