Initial commit
This commit is contained in:
Andrzej Wójcik
commit
d23d5af0d7
7
.gitignore
vendored
Normal file
7
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
.DS_Store
|
||||||
|
/.build
|
||||||
|
/.swiftpm
|
||||||
|
/Packages
|
||||||
|
/*.xcodeproj
|
||||||
|
xcuserdata/
|
||||||
|
|
||||||
674
LICENSE
Normal file
674
LICENSE
Normal file
|
|
@ -0,0 +1,674 @@
|
||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
Version 3, 29 June 2007
|
||||||
|
|
||||||
|
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The GNU General Public License is a free, copyleft license for
|
||||||
|
software and other kinds of works.
|
||||||
|
|
||||||
|
The licenses for most software and other practical works are designed
|
||||||
|
to take away your freedom to share and change the works. By contrast,
|
||||||
|
the GNU General Public License is intended to guarantee your freedom to
|
||||||
|
share and change all versions of a program--to make sure it remains free
|
||||||
|
software for all its users. We, the Free Software Foundation, use the
|
||||||
|
GNU General Public License for most of our software; it applies also to
|
||||||
|
any other work released this way by its authors. You can apply it to
|
||||||
|
your programs, too.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not
|
||||||
|
price. Our General Public Licenses are designed to make sure that you
|
||||||
|
have the freedom to distribute copies of free software (and charge for
|
||||||
|
them if you wish), that you receive source code or can get it if you
|
||||||
|
want it, that you can change the software or use pieces of it in new
|
||||||
|
free programs, and that you know you can do these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to prevent others from denying you
|
||||||
|
these rights or asking you to surrender the rights. Therefore, you have
|
||||||
|
certain responsibilities if you distribute copies of the software, or if
|
||||||
|
you modify it: responsibilities to respect the freedom of others.
|
||||||
|
|
||||||
|
For example, if you distribute copies of such a program, whether
|
||||||
|
gratis or for a fee, you must pass on to the recipients the same
|
||||||
|
freedoms that you received. You must make sure that they, too, receive
|
||||||
|
or can get the source code. And you must show them these terms so they
|
||||||
|
know their rights.
|
||||||
|
|
||||||
|
Developers that use the GNU GPL protect your rights with two steps:
|
||||||
|
(1) assert copyright on the software, and (2) offer you this License
|
||||||
|
giving you legal permission to copy, distribute and/or modify it.
|
||||||
|
|
||||||
|
For the developers' and authors' protection, the GPL clearly explains
|
||||||
|
that there is no warranty for this free software. For both users' and
|
||||||
|
authors' sake, the GPL requires that modified versions be marked as
|
||||||
|
changed, so that their problems will not be attributed erroneously to
|
||||||
|
authors of previous versions.
|
||||||
|
|
||||||
|
Some devices are designed to deny users access to install or run
|
||||||
|
modified versions of the software inside them, although the manufacturer
|
||||||
|
can do so. This is fundamentally incompatible with the aim of
|
||||||
|
protecting users' freedom to change the software. The systematic
|
||||||
|
pattern of such abuse occurs in the area of products for individuals to
|
||||||
|
use, which is precisely where it is most unacceptable. Therefore, we
|
||||||
|
have designed this version of the GPL to prohibit the practice for those
|
||||||
|
products. If such problems arise substantially in other domains, we
|
||||||
|
stand ready to extend this provision to those domains in future versions
|
||||||
|
of the GPL, as needed to protect the freedom of users.
|
||||||
|
|
||||||
|
Finally, every program is threatened constantly by software patents.
|
||||||
|
States should not allow patents to restrict development and use of
|
||||||
|
software on general-purpose computers, but in those that do, we wish to
|
||||||
|
avoid the special danger that patents applied to a free program could
|
||||||
|
make it effectively proprietary. To prevent this, the GPL assures that
|
||||||
|
patents cannot be used to render the program non-free.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow.
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
0. Definitions.
|
||||||
|
|
||||||
|
"This License" refers to version 3 of the GNU General Public License.
|
||||||
|
|
||||||
|
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||||
|
works, such as semiconductor masks.
|
||||||
|
|
||||||
|
"The Program" refers to any copyrightable work licensed under this
|
||||||
|
License. Each licensee is addressed as "you". "Licensees" and
|
||||||
|
"recipients" may be individuals or organizations.
|
||||||
|
|
||||||
|
To "modify" a work means to copy from or adapt all or part of the work
|
||||||
|
in a fashion requiring copyright permission, other than the making of an
|
||||||
|
exact copy. The resulting work is called a "modified version" of the
|
||||||
|
earlier work or a work "based on" the earlier work.
|
||||||
|
|
||||||
|
A "covered work" means either the unmodified Program or a work based
|
||||||
|
on the Program.
|
||||||
|
|
||||||
|
To "propagate" a work means to do anything with it that, without
|
||||||
|
permission, would make you directly or secondarily liable for
|
||||||
|
infringement under applicable copyright law, except executing it on a
|
||||||
|
computer or modifying a private copy. Propagation includes copying,
|
||||||
|
distribution (with or without modification), making available to the
|
||||||
|
public, and in some countries other activities as well.
|
||||||
|
|
||||||
|
To "convey" a work means any kind of propagation that enables other
|
||||||
|
parties to make or receive copies. Mere interaction with a user through
|
||||||
|
a computer network, with no transfer of a copy, is not conveying.
|
||||||
|
|
||||||
|
An interactive user interface displays "Appropriate Legal Notices"
|
||||||
|
to the extent that it includes a convenient and prominently visible
|
||||||
|
feature that (1) displays an appropriate copyright notice, and (2)
|
||||||
|
tells the user that there is no warranty for the work (except to the
|
||||||
|
extent that warranties are provided), that licensees may convey the
|
||||||
|
work under this License, and how to view a copy of this License. If
|
||||||
|
the interface presents a list of user commands or options, such as a
|
||||||
|
menu, a prominent item in the list meets this criterion.
|
||||||
|
|
||||||
|
1. Source Code.
|
||||||
|
|
||||||
|
The "source code" for a work means the preferred form of the work
|
||||||
|
for making modifications to it. "Object code" means any non-source
|
||||||
|
form of a work.
|
||||||
|
|
||||||
|
A "Standard Interface" means an interface that either is an official
|
||||||
|
standard defined by a recognized standards body, or, in the case of
|
||||||
|
interfaces specified for a particular programming language, one that
|
||||||
|
is widely used among developers working in that language.
|
||||||
|
|
||||||
|
The "System Libraries" of an executable work include anything, other
|
||||||
|
than the work as a whole, that (a) is included in the normal form of
|
||||||
|
packaging a Major Component, but which is not part of that Major
|
||||||
|
Component, and (b) serves only to enable use of the work with that
|
||||||
|
Major Component, or to implement a Standard Interface for which an
|
||||||
|
implementation is available to the public in source code form. A
|
||||||
|
"Major Component", in this context, means a major essential component
|
||||||
|
(kernel, window system, and so on) of the specific operating system
|
||||||
|
(if any) on which the executable work runs, or a compiler used to
|
||||||
|
produce the work, or an object code interpreter used to run it.
|
||||||
|
|
||||||
|
The "Corresponding Source" for a work in object code form means all
|
||||||
|
the source code needed to generate, install, and (for an executable
|
||||||
|
work) run the object code and to modify the work, including scripts to
|
||||||
|
control those activities. However, it does not include the work's
|
||||||
|
System Libraries, or general-purpose tools or generally available free
|
||||||
|
programs which are used unmodified in performing those activities but
|
||||||
|
which are not part of the work. For example, Corresponding Source
|
||||||
|
includes interface definition files associated with source files for
|
||||||
|
the work, and the source code for shared libraries and dynamically
|
||||||
|
linked subprograms that the work is specifically designed to require,
|
||||||
|
such as by intimate data communication or control flow between those
|
||||||
|
subprograms and other parts of the work.
|
||||||
|
|
||||||
|
The Corresponding Source need not include anything that users
|
||||||
|
can regenerate automatically from other parts of the Corresponding
|
||||||
|
Source.
|
||||||
|
|
||||||
|
The Corresponding Source for a work in source code form is that
|
||||||
|
same work.
|
||||||
|
|
||||||
|
2. Basic Permissions.
|
||||||
|
|
||||||
|
All rights granted under this License are granted for the term of
|
||||||
|
copyright on the Program, and are irrevocable provided the stated
|
||||||
|
conditions are met. This License explicitly affirms your unlimited
|
||||||
|
permission to run the unmodified Program. The output from running a
|
||||||
|
covered work is covered by this License only if the output, given its
|
||||||
|
content, constitutes a covered work. This License acknowledges your
|
||||||
|
rights of fair use or other equivalent, as provided by copyright law.
|
||||||
|
|
||||||
|
You may make, run and propagate covered works that you do not
|
||||||
|
convey, without conditions so long as your license otherwise remains
|
||||||
|
in force. You may convey covered works to others for the sole purpose
|
||||||
|
of having them make modifications exclusively for you, or provide you
|
||||||
|
with facilities for running those works, provided that you comply with
|
||||||
|
the terms of this License in conveying all material for which you do
|
||||||
|
not control copyright. Those thus making or running the covered works
|
||||||
|
for you must do so exclusively on your behalf, under your direction
|
||||||
|
and control, on terms that prohibit them from making any copies of
|
||||||
|
your copyrighted material outside their relationship with you.
|
||||||
|
|
||||||
|
Conveying under any other circumstances is permitted solely under
|
||||||
|
the conditions stated below. Sublicensing is not allowed; section 10
|
||||||
|
makes it unnecessary.
|
||||||
|
|
||||||
|
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||||
|
|
||||||
|
No covered work shall be deemed part of an effective technological
|
||||||
|
measure under any applicable law fulfilling obligations under article
|
||||||
|
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||||
|
similar laws prohibiting or restricting circumvention of such
|
||||||
|
measures.
|
||||||
|
|
||||||
|
When you convey a covered work, you waive any legal power to forbid
|
||||||
|
circumvention of technological measures to the extent such circumvention
|
||||||
|
is effected by exercising rights under this License with respect to
|
||||||
|
the covered work, and you disclaim any intention to limit operation or
|
||||||
|
modification of the work as a means of enforcing, against the work's
|
||||||
|
users, your or third parties' legal rights to forbid circumvention of
|
||||||
|
technological measures.
|
||||||
|
|
||||||
|
4. Conveying Verbatim Copies.
|
||||||
|
|
||||||
|
You may convey verbatim copies of the Program's source code as you
|
||||||
|
receive it, in any medium, provided that you conspicuously and
|
||||||
|
appropriately publish on each copy an appropriate copyright notice;
|
||||||
|
keep intact all notices stating that this License and any
|
||||||
|
non-permissive terms added in accord with section 7 apply to the code;
|
||||||
|
keep intact all notices of the absence of any warranty; and give all
|
||||||
|
recipients a copy of this License along with the Program.
|
||||||
|
|
||||||
|
You may charge any price or no price for each copy that you convey,
|
||||||
|
and you may offer support or warranty protection for a fee.
|
||||||
|
|
||||||
|
5. Conveying Modified Source Versions.
|
||||||
|
|
||||||
|
You may convey a work based on the Program, or the modifications to
|
||||||
|
produce it from the Program, in the form of source code under the
|
||||||
|
terms of section 4, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) The work must carry prominent notices stating that you modified
|
||||||
|
it, and giving a relevant date.
|
||||||
|
|
||||||
|
b) The work must carry prominent notices stating that it is
|
||||||
|
released under this License and any conditions added under section
|
||||||
|
7. This requirement modifies the requirement in section 4 to
|
||||||
|
"keep intact all notices".
|
||||||
|
|
||||||
|
c) You must license the entire work, as a whole, under this
|
||||||
|
License to anyone who comes into possession of a copy. This
|
||||||
|
License will therefore apply, along with any applicable section 7
|
||||||
|
additional terms, to the whole of the work, and all its parts,
|
||||||
|
regardless of how they are packaged. This License gives no
|
||||||
|
permission to license the work in any other way, but it does not
|
||||||
|
invalidate such permission if you have separately received it.
|
||||||
|
|
||||||
|
d) If the work has interactive user interfaces, each must display
|
||||||
|
Appropriate Legal Notices; however, if the Program has interactive
|
||||||
|
interfaces that do not display Appropriate Legal Notices, your
|
||||||
|
work need not make them do so.
|
||||||
|
|
||||||
|
A compilation of a covered work with other separate and independent
|
||||||
|
works, which are not by their nature extensions of the covered work,
|
||||||
|
and which are not combined with it such as to form a larger program,
|
||||||
|
in or on a volume of a storage or distribution medium, is called an
|
||||||
|
"aggregate" if the compilation and its resulting copyright are not
|
||||||
|
used to limit the access or legal rights of the compilation's users
|
||||||
|
beyond what the individual works permit. Inclusion of a covered work
|
||||||
|
in an aggregate does not cause this License to apply to the other
|
||||||
|
parts of the aggregate.
|
||||||
|
|
||||||
|
6. Conveying Non-Source Forms.
|
||||||
|
|
||||||
|
You may convey a covered work in object code form under the terms
|
||||||
|
of sections 4 and 5, provided that you also convey the
|
||||||
|
machine-readable Corresponding Source under the terms of this License,
|
||||||
|
in one of these ways:
|
||||||
|
|
||||||
|
a) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by the
|
||||||
|
Corresponding Source fixed on a durable physical medium
|
||||||
|
customarily used for software interchange.
|
||||||
|
|
||||||
|
b) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by a
|
||||||
|
written offer, valid for at least three years and valid for as
|
||||||
|
long as you offer spare parts or customer support for that product
|
||||||
|
model, to give anyone who possesses the object code either (1) a
|
||||||
|
copy of the Corresponding Source for all the software in the
|
||||||
|
product that is covered by this License, on a durable physical
|
||||||
|
medium customarily used for software interchange, for a price no
|
||||||
|
more than your reasonable cost of physically performing this
|
||||||
|
conveying of source, or (2) access to copy the
|
||||||
|
Corresponding Source from a network server at no charge.
|
||||||
|
|
||||||
|
c) Convey individual copies of the object code with a copy of the
|
||||||
|
written offer to provide the Corresponding Source. This
|
||||||
|
alternative is allowed only occasionally and noncommercially, and
|
||||||
|
only if you received the object code with such an offer, in accord
|
||||||
|
with subsection 6b.
|
||||||
|
|
||||||
|
d) Convey the object code by offering access from a designated
|
||||||
|
place (gratis or for a charge), and offer equivalent access to the
|
||||||
|
Corresponding Source in the same way through the same place at no
|
||||||
|
further charge. You need not require recipients to copy the
|
||||||
|
Corresponding Source along with the object code. If the place to
|
||||||
|
copy the object code is a network server, the Corresponding Source
|
||||||
|
may be on a different server (operated by you or a third party)
|
||||||
|
that supports equivalent copying facilities, provided you maintain
|
||||||
|
clear directions next to the object code saying where to find the
|
||||||
|
Corresponding Source. Regardless of what server hosts the
|
||||||
|
Corresponding Source, you remain obligated to ensure that it is
|
||||||
|
available for as long as needed to satisfy these requirements.
|
||||||
|
|
||||||
|
e) Convey the object code using peer-to-peer transmission, provided
|
||||||
|
you inform other peers where the object code and Corresponding
|
||||||
|
Source of the work are being offered to the general public at no
|
||||||
|
charge under subsection 6d.
|
||||||
|
|
||||||
|
A separable portion of the object code, whose source code is excluded
|
||||||
|
from the Corresponding Source as a System Library, need not be
|
||||||
|
included in conveying the object code work.
|
||||||
|
|
||||||
|
A "User Product" is either (1) a "consumer product", which means any
|
||||||
|
tangible personal property which is normally used for personal, family,
|
||||||
|
or household purposes, or (2) anything designed or sold for incorporation
|
||||||
|
into a dwelling. In determining whether a product is a consumer product,
|
||||||
|
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||||
|
product received by a particular user, "normally used" refers to a
|
||||||
|
typical or common use of that class of product, regardless of the status
|
||||||
|
of the particular user or of the way in which the particular user
|
||||||
|
actually uses, or expects or is expected to use, the product. A product
|
||||||
|
is a consumer product regardless of whether the product has substantial
|
||||||
|
commercial, industrial or non-consumer uses, unless such uses represent
|
||||||
|
the only significant mode of use of the product.
|
||||||
|
|
||||||
|
"Installation Information" for a User Product means any methods,
|
||||||
|
procedures, authorization keys, or other information required to install
|
||||||
|
and execute modified versions of a covered work in that User Product from
|
||||||
|
a modified version of its Corresponding Source. The information must
|
||||||
|
suffice to ensure that the continued functioning of the modified object
|
||||||
|
code is in no case prevented or interfered with solely because
|
||||||
|
modification has been made.
|
||||||
|
|
||||||
|
If you convey an object code work under this section in, or with, or
|
||||||
|
specifically for use in, a User Product, and the conveying occurs as
|
||||||
|
part of a transaction in which the right of possession and use of the
|
||||||
|
User Product is transferred to the recipient in perpetuity or for a
|
||||||
|
fixed term (regardless of how the transaction is characterized), the
|
||||||
|
Corresponding Source conveyed under this section must be accompanied
|
||||||
|
by the Installation Information. But this requirement does not apply
|
||||||
|
if neither you nor any third party retains the ability to install
|
||||||
|
modified object code on the User Product (for example, the work has
|
||||||
|
been installed in ROM).
|
||||||
|
|
||||||
|
The requirement to provide Installation Information does not include a
|
||||||
|
requirement to continue to provide support service, warranty, or updates
|
||||||
|
for a work that has been modified or installed by the recipient, or for
|
||||||
|
the User Product in which it has been modified or installed. Access to a
|
||||||
|
network may be denied when the modification itself materially and
|
||||||
|
adversely affects the operation of the network or violates the rules and
|
||||||
|
protocols for communication across the network.
|
||||||
|
|
||||||
|
Corresponding Source conveyed, and Installation Information provided,
|
||||||
|
in accord with this section must be in a format that is publicly
|
||||||
|
documented (and with an implementation available to the public in
|
||||||
|
source code form), and must require no special password or key for
|
||||||
|
unpacking, reading or copying.
|
||||||
|
|
||||||
|
7. Additional Terms.
|
||||||
|
|
||||||
|
"Additional permissions" are terms that supplement the terms of this
|
||||||
|
License by making exceptions from one or more of its conditions.
|
||||||
|
Additional permissions that are applicable to the entire Program shall
|
||||||
|
be treated as though they were included in this License, to the extent
|
||||||
|
that they are valid under applicable law. If additional permissions
|
||||||
|
apply only to part of the Program, that part may be used separately
|
||||||
|
under those permissions, but the entire Program remains governed by
|
||||||
|
this License without regard to the additional permissions.
|
||||||
|
|
||||||
|
When you convey a copy of a covered work, you may at your option
|
||||||
|
remove any additional permissions from that copy, or from any part of
|
||||||
|
it. (Additional permissions may be written to require their own
|
||||||
|
removal in certain cases when you modify the work.) You may place
|
||||||
|
additional permissions on material, added by you to a covered work,
|
||||||
|
for which you have or can give appropriate copyright permission.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, for material you
|
||||||
|
add to a covered work, you may (if authorized by the copyright holders of
|
||||||
|
that material) supplement the terms of this License with terms:
|
||||||
|
|
||||||
|
a) Disclaiming warranty or limiting liability differently from the
|
||||||
|
terms of sections 15 and 16 of this License; or
|
||||||
|
|
||||||
|
b) Requiring preservation of specified reasonable legal notices or
|
||||||
|
author attributions in that material or in the Appropriate Legal
|
||||||
|
Notices displayed by works containing it; or
|
||||||
|
|
||||||
|
c) Prohibiting misrepresentation of the origin of that material, or
|
||||||
|
requiring that modified versions of such material be marked in
|
||||||
|
reasonable ways as different from the original version; or
|
||||||
|
|
||||||
|
d) Limiting the use for publicity purposes of names of licensors or
|
||||||
|
authors of the material; or
|
||||||
|
|
||||||
|
e) Declining to grant rights under trademark law for use of some
|
||||||
|
trade names, trademarks, or service marks; or
|
||||||
|
|
||||||
|
f) Requiring indemnification of licensors and authors of that
|
||||||
|
material by anyone who conveys the material (or modified versions of
|
||||||
|
it) with contractual assumptions of liability to the recipient, for
|
||||||
|
any liability that these contractual assumptions directly impose on
|
||||||
|
those licensors and authors.
|
||||||
|
|
||||||
|
All other non-permissive additional terms are considered "further
|
||||||
|
restrictions" within the meaning of section 10. If the Program as you
|
||||||
|
received it, or any part of it, contains a notice stating that it is
|
||||||
|
governed by this License along with a term that is a further
|
||||||
|
restriction, you may remove that term. If a license document contains
|
||||||
|
a further restriction but permits relicensing or conveying under this
|
||||||
|
License, you may add to a covered work material governed by the terms
|
||||||
|
of that license document, provided that the further restriction does
|
||||||
|
not survive such relicensing or conveying.
|
||||||
|
|
||||||
|
If you add terms to a covered work in accord with this section, you
|
||||||
|
must place, in the relevant source files, a statement of the
|
||||||
|
additional terms that apply to those files, or a notice indicating
|
||||||
|
where to find the applicable terms.
|
||||||
|
|
||||||
|
Additional terms, permissive or non-permissive, may be stated in the
|
||||||
|
form of a separately written license, or stated as exceptions;
|
||||||
|
the above requirements apply either way.
|
||||||
|
|
||||||
|
8. Termination.
|
||||||
|
|
||||||
|
You may not propagate or modify a covered work except as expressly
|
||||||
|
provided under this License. Any attempt otherwise to propagate or
|
||||||
|
modify it is void, and will automatically terminate your rights under
|
||||||
|
this License (including any patent licenses granted under the third
|
||||||
|
paragraph of section 11).
|
||||||
|
|
||||||
|
However, if you cease all violation of this License, then your
|
||||||
|
license from a particular copyright holder is reinstated (a)
|
||||||
|
provisionally, unless and until the copyright holder explicitly and
|
||||||
|
finally terminates your license, and (b) permanently, if the copyright
|
||||||
|
holder fails to notify you of the violation by some reasonable means
|
||||||
|
prior to 60 days after the cessation.
|
||||||
|
|
||||||
|
Moreover, your license from a particular copyright holder is
|
||||||
|
reinstated permanently if the copyright holder notifies you of the
|
||||||
|
violation by some reasonable means, this is the first time you have
|
||||||
|
received notice of violation of this License (for any work) from that
|
||||||
|
copyright holder, and you cure the violation prior to 30 days after
|
||||||
|
your receipt of the notice.
|
||||||
|
|
||||||
|
Termination of your rights under this section does not terminate the
|
||||||
|
licenses of parties who have received copies or rights from you under
|
||||||
|
this License. If your rights have been terminated and not permanently
|
||||||
|
reinstated, you do not qualify to receive new licenses for the same
|
||||||
|
material under section 10.
|
||||||
|
|
||||||
|
9. Acceptance Not Required for Having Copies.
|
||||||
|
|
||||||
|
You are not required to accept this License in order to receive or
|
||||||
|
run a copy of the Program. Ancillary propagation of a covered work
|
||||||
|
occurring solely as a consequence of using peer-to-peer transmission
|
||||||
|
to receive a copy likewise does not require acceptance. However,
|
||||||
|
nothing other than this License grants you permission to propagate or
|
||||||
|
modify any covered work. These actions infringe copyright if you do
|
||||||
|
not accept this License. Therefore, by modifying or propagating a
|
||||||
|
covered work, you indicate your acceptance of this License to do so.
|
||||||
|
|
||||||
|
10. Automatic Licensing of Downstream Recipients.
|
||||||
|
|
||||||
|
Each time you convey a covered work, the recipient automatically
|
||||||
|
receives a license from the original licensors, to run, modify and
|
||||||
|
propagate that work, subject to this License. You are not responsible
|
||||||
|
for enforcing compliance by third parties with this License.
|
||||||
|
|
||||||
|
An "entity transaction" is a transaction transferring control of an
|
||||||
|
organization, or substantially all assets of one, or subdividing an
|
||||||
|
organization, or merging organizations. If propagation of a covered
|
||||||
|
work results from an entity transaction, each party to that
|
||||||
|
transaction who receives a copy of the work also receives whatever
|
||||||
|
licenses to the work the party's predecessor in interest had or could
|
||||||
|
give under the previous paragraph, plus a right to possession of the
|
||||||
|
Corresponding Source of the work from the predecessor in interest, if
|
||||||
|
the predecessor has it or can get it with reasonable efforts.
|
||||||
|
|
||||||
|
You may not impose any further restrictions on the exercise of the
|
||||||
|
rights granted or affirmed under this License. For example, you may
|
||||||
|
not impose a license fee, royalty, or other charge for exercise of
|
||||||
|
rights granted under this License, and you may not initiate litigation
|
||||||
|
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||||
|
any patent claim is infringed by making, using, selling, offering for
|
||||||
|
sale, or importing the Program or any portion of it.
|
||||||
|
|
||||||
|
11. Patents.
|
||||||
|
|
||||||
|
A "contributor" is a copyright holder who authorizes use under this
|
||||||
|
License of the Program or a work on which the Program is based. The
|
||||||
|
work thus licensed is called the contributor's "contributor version".
|
||||||
|
|
||||||
|
A contributor's "essential patent claims" are all patent claims
|
||||||
|
owned or controlled by the contributor, whether already acquired or
|
||||||
|
hereafter acquired, that would be infringed by some manner, permitted
|
||||||
|
by this License, of making, using, or selling its contributor version,
|
||||||
|
but do not include claims that would be infringed only as a
|
||||||
|
consequence of further modification of the contributor version. For
|
||||||
|
purposes of this definition, "control" includes the right to grant
|
||||||
|
patent sublicenses in a manner consistent with the requirements of
|
||||||
|
this License.
|
||||||
|
|
||||||
|
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||||
|
patent license under the contributor's essential patent claims, to
|
||||||
|
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||||
|
propagate the contents of its contributor version.
|
||||||
|
|
||||||
|
In the following three paragraphs, a "patent license" is any express
|
||||||
|
agreement or commitment, however denominated, not to enforce a patent
|
||||||
|
(such as an express permission to practice a patent or covenant not to
|
||||||
|
sue for patent infringement). To "grant" such a patent license to a
|
||||||
|
party means to make such an agreement or commitment not to enforce a
|
||||||
|
patent against the party.
|
||||||
|
|
||||||
|
If you convey a covered work, knowingly relying on a patent license,
|
||||||
|
and the Corresponding Source of the work is not available for anyone
|
||||||
|
to copy, free of charge and under the terms of this License, through a
|
||||||
|
publicly available network server or other readily accessible means,
|
||||||
|
then you must either (1) cause the Corresponding Source to be so
|
||||||
|
available, or (2) arrange to deprive yourself of the benefit of the
|
||||||
|
patent license for this particular work, or (3) arrange, in a manner
|
||||||
|
consistent with the requirements of this License, to extend the patent
|
||||||
|
license to downstream recipients. "Knowingly relying" means you have
|
||||||
|
actual knowledge that, but for the patent license, your conveying the
|
||||||
|
covered work in a country, or your recipient's use of the covered work
|
||||||
|
in a country, would infringe one or more identifiable patents in that
|
||||||
|
country that you have reason to believe are valid.
|
||||||
|
|
||||||
|
If, pursuant to or in connection with a single transaction or
|
||||||
|
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||||
|
covered work, and grant a patent license to some of the parties
|
||||||
|
receiving the covered work authorizing them to use, propagate, modify
|
||||||
|
or convey a specific copy of the covered work, then the patent license
|
||||||
|
you grant is automatically extended to all recipients of the covered
|
||||||
|
work and works based on it.
|
||||||
|
|
||||||
|
A patent license is "discriminatory" if it does not include within
|
||||||
|
the scope of its coverage, prohibits the exercise of, or is
|
||||||
|
conditioned on the non-exercise of one or more of the rights that are
|
||||||
|
specifically granted under this License. You may not convey a covered
|
||||||
|
work if you are a party to an arrangement with a third party that is
|
||||||
|
in the business of distributing software, under which you make payment
|
||||||
|
to the third party based on the extent of your activity of conveying
|
||||||
|
the work, and under which the third party grants, to any of the
|
||||||
|
parties who would receive the covered work from you, a discriminatory
|
||||||
|
patent license (a) in connection with copies of the covered work
|
||||||
|
conveyed by you (or copies made from those copies), or (b) primarily
|
||||||
|
for and in connection with specific products or compilations that
|
||||||
|
contain the covered work, unless you entered into that arrangement,
|
||||||
|
or that patent license was granted, prior to 28 March 2007.
|
||||||
|
|
||||||
|
Nothing in this License shall be construed as excluding or limiting
|
||||||
|
any implied license or other defenses to infringement that may
|
||||||
|
otherwise be available to you under applicable patent law.
|
||||||
|
|
||||||
|
12. No Surrender of Others' Freedom.
|
||||||
|
|
||||||
|
If conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot convey a
|
||||||
|
covered work so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you may
|
||||||
|
not convey it at all. For example, if you agree to terms that obligate you
|
||||||
|
to collect a royalty for further conveying from those to whom you convey
|
||||||
|
the Program, the only way you could satisfy both those terms and this
|
||||||
|
License would be to refrain entirely from conveying the Program.
|
||||||
|
|
||||||
|
13. Use with the GNU Affero General Public License.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, you have
|
||||||
|
permission to link or combine any covered work with a work licensed
|
||||||
|
under version 3 of the GNU Affero General Public License into a single
|
||||||
|
combined work, and to convey the resulting work. The terms of this
|
||||||
|
License will continue to apply to the part which is the covered work,
|
||||||
|
but the special requirements of the GNU Affero General Public License,
|
||||||
|
section 13, concerning interaction through a network will apply to the
|
||||||
|
combination as such.
|
||||||
|
|
||||||
|
14. Revised Versions of this License.
|
||||||
|
|
||||||
|
The Free Software Foundation may publish revised and/or new versions of
|
||||||
|
the GNU General Public License from time to time. Such new versions will
|
||||||
|
be similar in spirit to the present version, but may differ in detail to
|
||||||
|
address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the
|
||||||
|
Program specifies that a certain numbered version of the GNU General
|
||||||
|
Public License "or any later version" applies to it, you have the
|
||||||
|
option of following the terms and conditions either of that numbered
|
||||||
|
version or of any later version published by the Free Software
|
||||||
|
Foundation. If the Program does not specify a version number of the
|
||||||
|
GNU General Public License, you may choose any version ever published
|
||||||
|
by the Free Software Foundation.
|
||||||
|
|
||||||
|
If the Program specifies that a proxy can decide which future
|
||||||
|
versions of the GNU General Public License can be used, that proxy's
|
||||||
|
public statement of acceptance of a version permanently authorizes you
|
||||||
|
to choose that version for the Program.
|
||||||
|
|
||||||
|
Later license versions may give you additional or different
|
||||||
|
permissions. However, no additional obligations are imposed on any
|
||||||
|
author or copyright holder as a result of your choosing to follow a
|
||||||
|
later version.
|
||||||
|
|
||||||
|
15. Disclaimer of Warranty.
|
||||||
|
|
||||||
|
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||||
|
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||||
|
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||||
|
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||||
|
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||||
|
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||||
|
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
16. Limitation of Liability.
|
||||||
|
|
||||||
|
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||||
|
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||||
|
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||||
|
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||||
|
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||||
|
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||||
|
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||||
|
SUCH DAMAGES.
|
||||||
|
|
||||||
|
17. Interpretation of Sections 15 and 16.
|
||||||
|
|
||||||
|
If the disclaimer of warranty and limitation of liability provided
|
||||||
|
above cannot be given local legal effect according to their terms,
|
||||||
|
reviewing courts shall apply local law that most closely approximates
|
||||||
|
an absolute waiver of all civil liability in connection with the
|
||||||
|
Program, unless a warranty or assumption of liability accompanies a
|
||||||
|
copy of the Program in return for a fee.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Programs
|
||||||
|
|
||||||
|
If you develop a new program, and you want it to be of the greatest
|
||||||
|
possible use to the public, the best way to achieve this is to make it
|
||||||
|
free software which everyone can redistribute and change under these terms.
|
||||||
|
|
||||||
|
To do so, attach the following notices to the program. It is safest
|
||||||
|
to attach them to the start of each source file to most effectively
|
||||||
|
state the exclusion of warranty; and each file should have at least
|
||||||
|
the "copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
<one line to give the program's name and a brief idea of what it does.>
|
||||||
|
Copyright (C) <year> <name of author>
|
||||||
|
|
||||||
|
This program is free software: you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
This program is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License
|
||||||
|
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
If the program does terminal interaction, make it output a short
|
||||||
|
notice like this when it starts in an interactive mode:
|
||||||
|
|
||||||
|
<program> Copyright (C) <year> <name of author>
|
||||||
|
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||||
|
This is free software, and you are welcome to redistribute it
|
||||||
|
under certain conditions; type `show c' for details.
|
||||||
|
|
||||||
|
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||||
|
parts of the General Public License. Of course, your program's commands
|
||||||
|
might be different; for a GUI interface, you would use an "about box".
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or school,
|
||||||
|
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||||
|
For more information on this, and how to apply and follow the GNU GPL, see
|
||||||
|
<https://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
The GNU General Public License does not permit incorporating your program
|
||||||
|
into proprietary programs. If your program is a subroutine library, you
|
||||||
|
may consider it more useful to permit linking proprietary applications with
|
||||||
|
the library. If this is what you want to do, use the GNU Lesser General
|
||||||
|
Public License instead of this License. But first, please read
|
||||||
|
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
||||||
38
Package.swift
Normal file
38
Package.swift
Normal file
|
|
@ -0,0 +1,38 @@
|
||||||
|
// swift-tools-version:5.2
|
||||||
|
// The swift-tools-version declares the minimum version of Swift required to build this package.
|
||||||
|
|
||||||
|
import PackageDescription
|
||||||
|
|
||||||
|
let package = Package(
|
||||||
|
name: "libsignal",
|
||||||
|
platforms: [.iOS(.v11), .macOS(.v10_12)],
|
||||||
|
products: [
|
||||||
|
// Products define the executables and libraries produced by a package, and make them visible to other packages.
|
||||||
|
.library(
|
||||||
|
name: "libsignal",
|
||||||
|
targets: ["libsignal"]),
|
||||||
|
],
|
||||||
|
dependencies: [
|
||||||
|
// Dependencies declare other packages that this package depends on.
|
||||||
|
// .package(url: /* package url */, from: "1.0.0"),
|
||||||
|
],
|
||||||
|
targets: [
|
||||||
|
// Targets are the basic building blocks of a package. A target can define a module or a test suite.
|
||||||
|
// Targets can depend on other targets in this package, and on products in packages which this package depends on.
|
||||||
|
.target(
|
||||||
|
name: "libsignal",
|
||||||
|
dependencies: [],
|
||||||
|
publicHeadersPath: "includes",
|
||||||
|
cSettings: [
|
||||||
|
.headerSearchPath("includes"),
|
||||||
|
.headerSearchPath("curve25519"),
|
||||||
|
.headerSearchPath("curve25519/ed25519"),
|
||||||
|
.headerSearchPath("curve25519/ed25519/additions"),
|
||||||
|
.headerSearchPath("curve25519/ed25519/additions/generalized"),
|
||||||
|
.headerSearchPath("curve25519/ed25519/nacl_includes"),
|
||||||
|
.headerSearchPath("curve25519/ed25519/nacl_sha512"),
|
||||||
|
.headerSearchPath("curve25519/ed25519/tests"),
|
||||||
|
]
|
||||||
|
)
|
||||||
|
]
|
||||||
|
)
|
||||||
7
README.md
Normal file
7
README.md
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
<h1 align="center">
|
||||||
|
libsignal
|
||||||
|
</h1>
|
||||||
|
|
||||||
|
# What it is
|
||||||
|
|
||||||
|
This repository contains a modified version of [libsignal](https://github.com/signalapp/libsignal-protocol-c) library wrapped in Swift package for easier usage in Swift-based projects.
|
||||||
13
Sources/libsignal/File.h
Normal file
13
Sources/libsignal/File.h
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
//
|
||||||
|
// File.h
|
||||||
|
//
|
||||||
|
//
|
||||||
|
// Created by Andrzej Wójcik on 10/04/2020.
|
||||||
|
//
|
||||||
|
|
||||||
|
#ifndef File_h
|
||||||
|
#define File_h
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
#endif /* File_h */
|
||||||
210
Sources/libsignal/FingerprintProtocol.pb-c.c
Executable file
210
Sources/libsignal/FingerprintProtocol.pb-c.c
Executable file
|
|
@ -0,0 +1,210 @@
|
||||||
|
/* Generated by the protocol buffer compiler. DO NOT EDIT! */
|
||||||
|
/* Generated from: FingerprintProtocol.proto */
|
||||||
|
|
||||||
|
/* Do not generate deprecated warnings for self */
|
||||||
|
#ifndef PROTOBUF_C__NO_DEPRECATED
|
||||||
|
#define PROTOBUF_C__NO_DEPRECATED
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#include "FingerprintProtocol.pb-c.h"
|
||||||
|
void textsecure__logical_fingerprint__init
|
||||||
|
(Textsecure__LogicalFingerprint *message)
|
||||||
|
{
|
||||||
|
static Textsecure__LogicalFingerprint init_value = TEXTSECURE__LOGICAL_FINGERPRINT__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__logical_fingerprint__get_packed_size
|
||||||
|
(const Textsecure__LogicalFingerprint *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__logical_fingerprint__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__logical_fingerprint__pack
|
||||||
|
(const Textsecure__LogicalFingerprint *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__logical_fingerprint__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__logical_fingerprint__pack_to_buffer
|
||||||
|
(const Textsecure__LogicalFingerprint *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__logical_fingerprint__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__LogicalFingerprint *
|
||||||
|
textsecure__logical_fingerprint__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__LogicalFingerprint *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__logical_fingerprint__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__logical_fingerprint__free_unpacked
|
||||||
|
(Textsecure__LogicalFingerprint *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__logical_fingerprint__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__combined_fingerprints__init
|
||||||
|
(Textsecure__CombinedFingerprints *message)
|
||||||
|
{
|
||||||
|
static Textsecure__CombinedFingerprints init_value = TEXTSECURE__COMBINED_FINGERPRINTS__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__combined_fingerprints__get_packed_size
|
||||||
|
(const Textsecure__CombinedFingerprints *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__combined_fingerprints__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__combined_fingerprints__pack
|
||||||
|
(const Textsecure__CombinedFingerprints *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__combined_fingerprints__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__combined_fingerprints__pack_to_buffer
|
||||||
|
(const Textsecure__CombinedFingerprints *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__combined_fingerprints__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__CombinedFingerprints *
|
||||||
|
textsecure__combined_fingerprints__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__CombinedFingerprints *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__combined_fingerprints__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__combined_fingerprints__free_unpacked
|
||||||
|
(Textsecure__CombinedFingerprints *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__combined_fingerprints__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__logical_fingerprint__field_descriptors[2] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"content",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__LogicalFingerprint, has_content),
|
||||||
|
offsetof(Textsecure__LogicalFingerprint, content),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"identifier",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__LogicalFingerprint, has_identifier),
|
||||||
|
offsetof(Textsecure__LogicalFingerprint, identifier),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__logical_fingerprint__field_indices_by_name[] = {
|
||||||
|
0, /* field[0] = content */
|
||||||
|
1, /* field[1] = identifier */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__logical_fingerprint__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 2 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__logical_fingerprint__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.LogicalFingerprint",
|
||||||
|
"LogicalFingerprint",
|
||||||
|
"Textsecure__LogicalFingerprint",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__LogicalFingerprint),
|
||||||
|
2,
|
||||||
|
textsecure__logical_fingerprint__field_descriptors,
|
||||||
|
textsecure__logical_fingerprint__field_indices_by_name,
|
||||||
|
1, textsecure__logical_fingerprint__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__logical_fingerprint__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__combined_fingerprints__field_descriptors[3] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"version",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__CombinedFingerprints, has_version),
|
||||||
|
offsetof(Textsecure__CombinedFingerprints, version),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"localFingerprint",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_MESSAGE,
|
||||||
|
0, /* quantifier_offset */
|
||||||
|
offsetof(Textsecure__CombinedFingerprints, localfingerprint),
|
||||||
|
&textsecure__logical_fingerprint__descriptor,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"remoteFingerprint",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_MESSAGE,
|
||||||
|
0, /* quantifier_offset */
|
||||||
|
offsetof(Textsecure__CombinedFingerprints, remotefingerprint),
|
||||||
|
&textsecure__logical_fingerprint__descriptor,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__combined_fingerprints__field_indices_by_name[] = {
|
||||||
|
1, /* field[1] = localFingerprint */
|
||||||
|
2, /* field[2] = remoteFingerprint */
|
||||||
|
0, /* field[0] = version */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__combined_fingerprints__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 3 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__combined_fingerprints__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.CombinedFingerprints",
|
||||||
|
"CombinedFingerprints",
|
||||||
|
"Textsecure__CombinedFingerprints",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__CombinedFingerprints),
|
||||||
|
3,
|
||||||
|
textsecure__combined_fingerprints__field_descriptors,
|
||||||
|
textsecure__combined_fingerprints__field_indices_by_name,
|
||||||
|
1, textsecure__combined_fingerprints__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__combined_fingerprints__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
114
Sources/libsignal/FingerprintProtocol.pb-c.h
Executable file
114
Sources/libsignal/FingerprintProtocol.pb-c.h
Executable file
|
|
@ -0,0 +1,114 @@
|
||||||
|
/* Generated by the protocol buffer compiler. DO NOT EDIT! */
|
||||||
|
/* Generated from: FingerprintProtocol.proto */
|
||||||
|
|
||||||
|
#ifndef PROTOBUF_C_FingerprintProtocol_2eproto__INCLUDED
|
||||||
|
#define PROTOBUF_C_FingerprintProtocol_2eproto__INCLUDED
|
||||||
|
|
||||||
|
#include "protobuf-c/protobuf-c.h"
|
||||||
|
|
||||||
|
PROTOBUF_C__BEGIN_DECLS
|
||||||
|
|
||||||
|
#if PROTOBUF_C_VERSION_NUMBER < 1000000
|
||||||
|
# error This file was generated by a newer version of protoc-c which is incompatible with your libprotobuf-c headers. Please update your headers.
|
||||||
|
#elif 1002001 < PROTOBUF_C_MIN_COMPILER_VERSION
|
||||||
|
# error This file was generated by an older version of protoc-c which is incompatible with your libprotobuf-c headers. Please regenerate this file with a newer version of protoc-c.
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
typedef struct _Textsecure__LogicalFingerprint Textsecure__LogicalFingerprint;
|
||||||
|
typedef struct _Textsecure__CombinedFingerprints Textsecure__CombinedFingerprints;
|
||||||
|
|
||||||
|
|
||||||
|
/* --- enums --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- messages --- */
|
||||||
|
|
||||||
|
struct _Textsecure__LogicalFingerprint
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_content;
|
||||||
|
ProtobufCBinaryData content;
|
||||||
|
/*
|
||||||
|
* Version 0
|
||||||
|
*/
|
||||||
|
protobuf_c_boolean has_identifier;
|
||||||
|
ProtobufCBinaryData identifier;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__LOGICAL_FINGERPRINT__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__logical_fingerprint__descriptor) \
|
||||||
|
, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__CombinedFingerprints
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_version;
|
||||||
|
uint32_t version;
|
||||||
|
Textsecure__LogicalFingerprint *localfingerprint;
|
||||||
|
Textsecure__LogicalFingerprint *remotefingerprint;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__COMBINED_FINGERPRINTS__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__combined_fingerprints__descriptor) \
|
||||||
|
, 0,0, NULL, NULL }
|
||||||
|
|
||||||
|
|
||||||
|
/* Textsecure__LogicalFingerprint methods */
|
||||||
|
void textsecure__logical_fingerprint__init
|
||||||
|
(Textsecure__LogicalFingerprint *message);
|
||||||
|
size_t textsecure__logical_fingerprint__get_packed_size
|
||||||
|
(const Textsecure__LogicalFingerprint *message);
|
||||||
|
size_t textsecure__logical_fingerprint__pack
|
||||||
|
(const Textsecure__LogicalFingerprint *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__logical_fingerprint__pack_to_buffer
|
||||||
|
(const Textsecure__LogicalFingerprint *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__LogicalFingerprint *
|
||||||
|
textsecure__logical_fingerprint__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__logical_fingerprint__free_unpacked
|
||||||
|
(Textsecure__LogicalFingerprint *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__CombinedFingerprints methods */
|
||||||
|
void textsecure__combined_fingerprints__init
|
||||||
|
(Textsecure__CombinedFingerprints *message);
|
||||||
|
size_t textsecure__combined_fingerprints__get_packed_size
|
||||||
|
(const Textsecure__CombinedFingerprints *message);
|
||||||
|
size_t textsecure__combined_fingerprints__pack
|
||||||
|
(const Textsecure__CombinedFingerprints *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__combined_fingerprints__pack_to_buffer
|
||||||
|
(const Textsecure__CombinedFingerprints *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__CombinedFingerprints *
|
||||||
|
textsecure__combined_fingerprints__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__combined_fingerprints__free_unpacked
|
||||||
|
(Textsecure__CombinedFingerprints *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* --- per-message closures --- */
|
||||||
|
|
||||||
|
typedef void (*Textsecure__LogicalFingerprint_Closure)
|
||||||
|
(const Textsecure__LogicalFingerprint *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__CombinedFingerprints_Closure)
|
||||||
|
(const Textsecure__CombinedFingerprints *message,
|
||||||
|
void *closure_data);
|
||||||
|
|
||||||
|
/* --- services --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- descriptors --- */
|
||||||
|
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__logical_fingerprint__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__combined_fingerprints__descriptor;
|
||||||
|
|
||||||
|
PROTOBUF_C__END_DECLS
|
||||||
|
|
||||||
|
|
||||||
|
#endif /* PROTOBUF_C_FingerprintProtocol_2eproto__INCLUDED */
|
||||||
621
Sources/libsignal/LICENSE
Executable file
621
Sources/libsignal/LICENSE
Executable file
|
|
@ -0,0 +1,621 @@
|
||||||
|
GNU GENERAL PUBLIC LICENSE
|
||||||
|
Version 3, 29 June 2007
|
||||||
|
|
||||||
|
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies
|
||||||
|
of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The GNU General Public License is a free, copyleft license for
|
||||||
|
software and other kinds of works.
|
||||||
|
|
||||||
|
The licenses for most software and other practical works are designed
|
||||||
|
to take away your freedom to share and change the works. By contrast,
|
||||||
|
the GNU General Public License is intended to guarantee your freedom to
|
||||||
|
share and change all versions of a program--to make sure it remains free
|
||||||
|
software for all its users. We, the Free Software Foundation, use the
|
||||||
|
GNU General Public License for most of our software; it applies also to
|
||||||
|
any other work released this way by its authors. You can apply it to
|
||||||
|
your programs, too.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not
|
||||||
|
price. Our General Public Licenses are designed to make sure that you
|
||||||
|
have the freedom to distribute copies of free software (and charge for
|
||||||
|
them if you wish), that you receive source code or can get it if you
|
||||||
|
want it, that you can change the software or use pieces of it in new
|
||||||
|
free programs, and that you know you can do these things.
|
||||||
|
|
||||||
|
To protect your rights, we need to prevent others from denying you
|
||||||
|
these rights or asking you to surrender the rights. Therefore, you have
|
||||||
|
certain responsibilities if you distribute copies of the software, or if
|
||||||
|
you modify it: responsibilities to respect the freedom of others.
|
||||||
|
|
||||||
|
For example, if you distribute copies of such a program, whether
|
||||||
|
gratis or for a fee, you must pass on to the recipients the same
|
||||||
|
freedoms that you received. You must make sure that they, too, receive
|
||||||
|
or can get the source code. And you must show them these terms so they
|
||||||
|
know their rights.
|
||||||
|
|
||||||
|
Developers that use the GNU GPL protect your rights with two steps:
|
||||||
|
(1) assert copyright on the software, and (2) offer you this License
|
||||||
|
giving you legal permission to copy, distribute and/or modify it.
|
||||||
|
|
||||||
|
For the developers' and authors' protection, the GPL clearly explains
|
||||||
|
that there is no warranty for this free software. For both users' and
|
||||||
|
authors' sake, the GPL requires that modified versions be marked as
|
||||||
|
changed, so that their problems will not be attributed erroneously to
|
||||||
|
authors of previous versions.
|
||||||
|
|
||||||
|
Some devices are designed to deny users access to install or run
|
||||||
|
modified versions of the software inside them, although the manufacturer
|
||||||
|
can do so. This is fundamentally incompatible with the aim of
|
||||||
|
protecting users' freedom to change the software. The systematic
|
||||||
|
pattern of such abuse occurs in the area of products for individuals to
|
||||||
|
use, which is precisely where it is most unacceptable. Therefore, we
|
||||||
|
have designed this version of the GPL to prohibit the practice for those
|
||||||
|
products. If such problems arise substantially in other domains, we
|
||||||
|
stand ready to extend this provision to those domains in future versions
|
||||||
|
of the GPL, as needed to protect the freedom of users.
|
||||||
|
|
||||||
|
Finally, every program is threatened constantly by software patents.
|
||||||
|
States should not allow patents to restrict development and use of
|
||||||
|
software on general-purpose computers, but in those that do, we wish to
|
||||||
|
avoid the special danger that patents applied to a free program could
|
||||||
|
make it effectively proprietary. To prevent this, the GPL assures that
|
||||||
|
patents cannot be used to render the program non-free.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and
|
||||||
|
modification follow.
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
0. Definitions.
|
||||||
|
|
||||||
|
"This License" refers to version 3 of the GNU General Public License.
|
||||||
|
|
||||||
|
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||||
|
works, such as semiconductor masks.
|
||||||
|
|
||||||
|
"The Program" refers to any copyrightable work licensed under this
|
||||||
|
License. Each licensee is addressed as "you". "Licensees" and
|
||||||
|
"recipients" may be individuals or organizations.
|
||||||
|
|
||||||
|
To "modify" a work means to copy from or adapt all or part of the work
|
||||||
|
in a fashion requiring copyright permission, other than the making of an
|
||||||
|
exact copy. The resulting work is called a "modified version" of the
|
||||||
|
earlier work or a work "based on" the earlier work.
|
||||||
|
|
||||||
|
A "covered work" means either the unmodified Program or a work based
|
||||||
|
on the Program.
|
||||||
|
|
||||||
|
To "propagate" a work means to do anything with it that, without
|
||||||
|
permission, would make you directly or secondarily liable for
|
||||||
|
infringement under applicable copyright law, except executing it on a
|
||||||
|
computer or modifying a private copy. Propagation includes copying,
|
||||||
|
distribution (with or without modification), making available to the
|
||||||
|
public, and in some countries other activities as well.
|
||||||
|
|
||||||
|
To "convey" a work means any kind of propagation that enables other
|
||||||
|
parties to make or receive copies. Mere interaction with a user through
|
||||||
|
a computer network, with no transfer of a copy, is not conveying.
|
||||||
|
|
||||||
|
An interactive user interface displays "Appropriate Legal Notices"
|
||||||
|
to the extent that it includes a convenient and prominently visible
|
||||||
|
feature that (1) displays an appropriate copyright notice, and (2)
|
||||||
|
tells the user that there is no warranty for the work (except to the
|
||||||
|
extent that warranties are provided), that licensees may convey the
|
||||||
|
work under this License, and how to view a copy of this License. If
|
||||||
|
the interface presents a list of user commands or options, such as a
|
||||||
|
menu, a prominent item in the list meets this criterion.
|
||||||
|
|
||||||
|
1. Source Code.
|
||||||
|
|
||||||
|
The "source code" for a work means the preferred form of the work
|
||||||
|
for making modifications to it. "Object code" means any non-source
|
||||||
|
form of a work.
|
||||||
|
|
||||||
|
A "Standard Interface" means an interface that either is an official
|
||||||
|
standard defined by a recognized standards body, or, in the case of
|
||||||
|
interfaces specified for a particular programming language, one that
|
||||||
|
is widely used among developers working in that language.
|
||||||
|
|
||||||
|
The "System Libraries" of an executable work include anything, other
|
||||||
|
than the work as a whole, that (a) is included in the normal form of
|
||||||
|
packaging a Major Component, but which is not part of that Major
|
||||||
|
Component, and (b) serves only to enable use of the work with that
|
||||||
|
Major Component, or to implement a Standard Interface for which an
|
||||||
|
implementation is available to the public in source code form. A
|
||||||
|
"Major Component", in this context, means a major essential component
|
||||||
|
(kernel, window system, and so on) of the specific operating system
|
||||||
|
(if any) on which the executable work runs, or a compiler used to
|
||||||
|
produce the work, or an object code interpreter used to run it.
|
||||||
|
|
||||||
|
The "Corresponding Source" for a work in object code form means all
|
||||||
|
the source code needed to generate, install, and (for an executable
|
||||||
|
work) run the object code and to modify the work, including scripts to
|
||||||
|
control those activities. However, it does not include the work's
|
||||||
|
System Libraries, or general-purpose tools or generally available free
|
||||||
|
programs which are used unmodified in performing those activities but
|
||||||
|
which are not part of the work. For example, Corresponding Source
|
||||||
|
includes interface definition files associated with source files for
|
||||||
|
the work, and the source code for shared libraries and dynamically
|
||||||
|
linked subprograms that the work is specifically designed to require,
|
||||||
|
such as by intimate data communication or control flow between those
|
||||||
|
subprograms and other parts of the work.
|
||||||
|
|
||||||
|
The Corresponding Source need not include anything that users
|
||||||
|
can regenerate automatically from other parts of the Corresponding
|
||||||
|
Source.
|
||||||
|
|
||||||
|
The Corresponding Source for a work in source code form is that
|
||||||
|
same work.
|
||||||
|
|
||||||
|
2. Basic Permissions.
|
||||||
|
|
||||||
|
All rights granted under this License are granted for the term of
|
||||||
|
copyright on the Program, and are irrevocable provided the stated
|
||||||
|
conditions are met. This License explicitly affirms your unlimited
|
||||||
|
permission to run the unmodified Program. The output from running a
|
||||||
|
covered work is covered by this License only if the output, given its
|
||||||
|
content, constitutes a covered work. This License acknowledges your
|
||||||
|
rights of fair use or other equivalent, as provided by copyright law.
|
||||||
|
|
||||||
|
You may make, run and propagate covered works that you do not
|
||||||
|
convey, without conditions so long as your license otherwise remains
|
||||||
|
in force. You may convey covered works to others for the sole purpose
|
||||||
|
of having them make modifications exclusively for you, or provide you
|
||||||
|
with facilities for running those works, provided that you comply with
|
||||||
|
the terms of this License in conveying all material for which you do
|
||||||
|
not control copyright. Those thus making or running the covered works
|
||||||
|
for you must do so exclusively on your behalf, under your direction
|
||||||
|
and control, on terms that prohibit them from making any copies of
|
||||||
|
your copyrighted material outside their relationship with you.
|
||||||
|
|
||||||
|
Conveying under any other circumstances is permitted solely under
|
||||||
|
the conditions stated below. Sublicensing is not allowed; section 10
|
||||||
|
makes it unnecessary.
|
||||||
|
|
||||||
|
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||||
|
|
||||||
|
No covered work shall be deemed part of an effective technological
|
||||||
|
measure under any applicable law fulfilling obligations under article
|
||||||
|
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||||
|
similar laws prohibiting or restricting circumvention of such
|
||||||
|
measures.
|
||||||
|
|
||||||
|
When you convey a covered work, you waive any legal power to forbid
|
||||||
|
circumvention of technological measures to the extent such circumvention
|
||||||
|
is effected by exercising rights under this License with respect to
|
||||||
|
the covered work, and you disclaim any intention to limit operation or
|
||||||
|
modification of the work as a means of enforcing, against the work's
|
||||||
|
users, your or third parties' legal rights to forbid circumvention of
|
||||||
|
technological measures.
|
||||||
|
|
||||||
|
4. Conveying Verbatim Copies.
|
||||||
|
|
||||||
|
You may convey verbatim copies of the Program's source code as you
|
||||||
|
receive it, in any medium, provided that you conspicuously and
|
||||||
|
appropriately publish on each copy an appropriate copyright notice;
|
||||||
|
keep intact all notices stating that this License and any
|
||||||
|
non-permissive terms added in accord with section 7 apply to the code;
|
||||||
|
keep intact all notices of the absence of any warranty; and give all
|
||||||
|
recipients a copy of this License along with the Program.
|
||||||
|
|
||||||
|
You may charge any price or no price for each copy that you convey,
|
||||||
|
and you may offer support or warranty protection for a fee.
|
||||||
|
|
||||||
|
5. Conveying Modified Source Versions.
|
||||||
|
|
||||||
|
You may convey a work based on the Program, or the modifications to
|
||||||
|
produce it from the Program, in the form of source code under the
|
||||||
|
terms of section 4, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) The work must carry prominent notices stating that you modified
|
||||||
|
it, and giving a relevant date.
|
||||||
|
|
||||||
|
b) The work must carry prominent notices stating that it is
|
||||||
|
released under this License and any conditions added under section
|
||||||
|
7. This requirement modifies the requirement in section 4 to
|
||||||
|
"keep intact all notices".
|
||||||
|
|
||||||
|
c) You must license the entire work, as a whole, under this
|
||||||
|
License to anyone who comes into possession of a copy. This
|
||||||
|
License will therefore apply, along with any applicable section 7
|
||||||
|
additional terms, to the whole of the work, and all its parts,
|
||||||
|
regardless of how they are packaged. This License gives no
|
||||||
|
permission to license the work in any other way, but it does not
|
||||||
|
invalidate such permission if you have separately received it.
|
||||||
|
|
||||||
|
d) If the work has interactive user interfaces, each must display
|
||||||
|
Appropriate Legal Notices; however, if the Program has interactive
|
||||||
|
interfaces that do not display Appropriate Legal Notices, your
|
||||||
|
work need not make them do so.
|
||||||
|
|
||||||
|
A compilation of a covered work with other separate and independent
|
||||||
|
works, which are not by their nature extensions of the covered work,
|
||||||
|
and which are not combined with it such as to form a larger program,
|
||||||
|
in or on a volume of a storage or distribution medium, is called an
|
||||||
|
"aggregate" if the compilation and its resulting copyright are not
|
||||||
|
used to limit the access or legal rights of the compilation's users
|
||||||
|
beyond what the individual works permit. Inclusion of a covered work
|
||||||
|
in an aggregate does not cause this License to apply to the other
|
||||||
|
parts of the aggregate.
|
||||||
|
|
||||||
|
6. Conveying Non-Source Forms.
|
||||||
|
|
||||||
|
You may convey a covered work in object code form under the terms
|
||||||
|
of sections 4 and 5, provided that you also convey the
|
||||||
|
machine-readable Corresponding Source under the terms of this License,
|
||||||
|
in one of these ways:
|
||||||
|
|
||||||
|
a) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by the
|
||||||
|
Corresponding Source fixed on a durable physical medium
|
||||||
|
customarily used for software interchange.
|
||||||
|
|
||||||
|
b) Convey the object code in, or embodied in, a physical product
|
||||||
|
(including a physical distribution medium), accompanied by a
|
||||||
|
written offer, valid for at least three years and valid for as
|
||||||
|
long as you offer spare parts or customer support for that product
|
||||||
|
model, to give anyone who possesses the object code either (1) a
|
||||||
|
copy of the Corresponding Source for all the software in the
|
||||||
|
product that is covered by this License, on a durable physical
|
||||||
|
medium customarily used for software interchange, for a price no
|
||||||
|
more than your reasonable cost of physically performing this
|
||||||
|
conveying of source, or (2) access to copy the
|
||||||
|
Corresponding Source from a network server at no charge.
|
||||||
|
|
||||||
|
c) Convey individual copies of the object code with a copy of the
|
||||||
|
written offer to provide the Corresponding Source. This
|
||||||
|
alternative is allowed only occasionally and noncommercially, and
|
||||||
|
only if you received the object code with such an offer, in accord
|
||||||
|
with subsection 6b.
|
||||||
|
|
||||||
|
d) Convey the object code by offering access from a designated
|
||||||
|
place (gratis or for a charge), and offer equivalent access to the
|
||||||
|
Corresponding Source in the same way through the same place at no
|
||||||
|
further charge. You need not require recipients to copy the
|
||||||
|
Corresponding Source along with the object code. If the place to
|
||||||
|
copy the object code is a network server, the Corresponding Source
|
||||||
|
may be on a different server (operated by you or a third party)
|
||||||
|
that supports equivalent copying facilities, provided you maintain
|
||||||
|
clear directions next to the object code saying where to find the
|
||||||
|
Corresponding Source. Regardless of what server hosts the
|
||||||
|
Corresponding Source, you remain obligated to ensure that it is
|
||||||
|
available for as long as needed to satisfy these requirements.
|
||||||
|
|
||||||
|
e) Convey the object code using peer-to-peer transmission, provided
|
||||||
|
you inform other peers where the object code and Corresponding
|
||||||
|
Source of the work are being offered to the general public at no
|
||||||
|
charge under subsection 6d.
|
||||||
|
|
||||||
|
A separable portion of the object code, whose source code is excluded
|
||||||
|
from the Corresponding Source as a System Library, need not be
|
||||||
|
included in conveying the object code work.
|
||||||
|
|
||||||
|
A "User Product" is either (1) a "consumer product", which means any
|
||||||
|
tangible personal property which is normally used for personal, family,
|
||||||
|
or household purposes, or (2) anything designed or sold for incorporation
|
||||||
|
into a dwelling. In determining whether a product is a consumer product,
|
||||||
|
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||||
|
product received by a particular user, "normally used" refers to a
|
||||||
|
typical or common use of that class of product, regardless of the status
|
||||||
|
of the particular user or of the way in which the particular user
|
||||||
|
actually uses, or expects or is expected to use, the product. A product
|
||||||
|
is a consumer product regardless of whether the product has substantial
|
||||||
|
commercial, industrial or non-consumer uses, unless such uses represent
|
||||||
|
the only significant mode of use of the product.
|
||||||
|
|
||||||
|
"Installation Information" for a User Product means any methods,
|
||||||
|
procedures, authorization keys, or other information required to install
|
||||||
|
and execute modified versions of a covered work in that User Product from
|
||||||
|
a modified version of its Corresponding Source. The information must
|
||||||
|
suffice to ensure that the continued functioning of the modified object
|
||||||
|
code is in no case prevented or interfered with solely because
|
||||||
|
modification has been made.
|
||||||
|
|
||||||
|
If you convey an object code work under this section in, or with, or
|
||||||
|
specifically for use in, a User Product, and the conveying occurs as
|
||||||
|
part of a transaction in which the right of possession and use of the
|
||||||
|
User Product is transferred to the recipient in perpetuity or for a
|
||||||
|
fixed term (regardless of how the transaction is characterized), the
|
||||||
|
Corresponding Source conveyed under this section must be accompanied
|
||||||
|
by the Installation Information. But this requirement does not apply
|
||||||
|
if neither you nor any third party retains the ability to install
|
||||||
|
modified object code on the User Product (for example, the work has
|
||||||
|
been installed in ROM).
|
||||||
|
|
||||||
|
The requirement to provide Installation Information does not include a
|
||||||
|
requirement to continue to provide support service, warranty, or updates
|
||||||
|
for a work that has been modified or installed by the recipient, or for
|
||||||
|
the User Product in which it has been modified or installed. Access to a
|
||||||
|
network may be denied when the modification itself materially and
|
||||||
|
adversely affects the operation of the network or violates the rules and
|
||||||
|
protocols for communication across the network.
|
||||||
|
|
||||||
|
Corresponding Source conveyed, and Installation Information provided,
|
||||||
|
in accord with this section must be in a format that is publicly
|
||||||
|
documented (and with an implementation available to the public in
|
||||||
|
source code form), and must require no special password or key for
|
||||||
|
unpacking, reading or copying.
|
||||||
|
|
||||||
|
7. Additional Terms.
|
||||||
|
|
||||||
|
"Additional permissions" are terms that supplement the terms of this
|
||||||
|
License by making exceptions from one or more of its conditions.
|
||||||
|
Additional permissions that are applicable to the entire Program shall
|
||||||
|
be treated as though they were included in this License, to the extent
|
||||||
|
that they are valid under applicable law. If additional permissions
|
||||||
|
apply only to part of the Program, that part may be used separately
|
||||||
|
under those permissions, but the entire Program remains governed by
|
||||||
|
this License without regard to the additional permissions.
|
||||||
|
|
||||||
|
When you convey a copy of a covered work, you may at your option
|
||||||
|
remove any additional permissions from that copy, or from any part of
|
||||||
|
it. (Additional permissions may be written to require their own
|
||||||
|
removal in certain cases when you modify the work.) You may place
|
||||||
|
additional permissions on material, added by you to a covered work,
|
||||||
|
for which you have or can give appropriate copyright permission.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, for material you
|
||||||
|
add to a covered work, you may (if authorized by the copyright holders of
|
||||||
|
that material) supplement the terms of this License with terms:
|
||||||
|
|
||||||
|
a) Disclaiming warranty or limiting liability differently from the
|
||||||
|
terms of sections 15 and 16 of this License; or
|
||||||
|
|
||||||
|
b) Requiring preservation of specified reasonable legal notices or
|
||||||
|
author attributions in that material or in the Appropriate Legal
|
||||||
|
Notices displayed by works containing it; or
|
||||||
|
|
||||||
|
c) Prohibiting misrepresentation of the origin of that material, or
|
||||||
|
requiring that modified versions of such material be marked in
|
||||||
|
reasonable ways as different from the original version; or
|
||||||
|
|
||||||
|
d) Limiting the use for publicity purposes of names of licensors or
|
||||||
|
authors of the material; or
|
||||||
|
|
||||||
|
e) Declining to grant rights under trademark law for use of some
|
||||||
|
trade names, trademarks, or service marks; or
|
||||||
|
|
||||||
|
f) Requiring indemnification of licensors and authors of that
|
||||||
|
material by anyone who conveys the material (or modified versions of
|
||||||
|
it) with contractual assumptions of liability to the recipient, for
|
||||||
|
any liability that these contractual assumptions directly impose on
|
||||||
|
those licensors and authors.
|
||||||
|
|
||||||
|
All other non-permissive additional terms are considered "further
|
||||||
|
restrictions" within the meaning of section 10. If the Program as you
|
||||||
|
received it, or any part of it, contains a notice stating that it is
|
||||||
|
governed by this License along with a term that is a further
|
||||||
|
restriction, you may remove that term. If a license document contains
|
||||||
|
a further restriction but permits relicensing or conveying under this
|
||||||
|
License, you may add to a covered work material governed by the terms
|
||||||
|
of that license document, provided that the further restriction does
|
||||||
|
not survive such relicensing or conveying.
|
||||||
|
|
||||||
|
If you add terms to a covered work in accord with this section, you
|
||||||
|
must place, in the relevant source files, a statement of the
|
||||||
|
additional terms that apply to those files, or a notice indicating
|
||||||
|
where to find the applicable terms.
|
||||||
|
|
||||||
|
Additional terms, permissive or non-permissive, may be stated in the
|
||||||
|
form of a separately written license, or stated as exceptions;
|
||||||
|
the above requirements apply either way.
|
||||||
|
|
||||||
|
8. Termination.
|
||||||
|
|
||||||
|
You may not propagate or modify a covered work except as expressly
|
||||||
|
provided under this License. Any attempt otherwise to propagate or
|
||||||
|
modify it is void, and will automatically terminate your rights under
|
||||||
|
this License (including any patent licenses granted under the third
|
||||||
|
paragraph of section 11).
|
||||||
|
|
||||||
|
However, if you cease all violation of this License, then your
|
||||||
|
license from a particular copyright holder is reinstated (a)
|
||||||
|
provisionally, unless and until the copyright holder explicitly and
|
||||||
|
finally terminates your license, and (b) permanently, if the copyright
|
||||||
|
holder fails to notify you of the violation by some reasonable means
|
||||||
|
prior to 60 days after the cessation.
|
||||||
|
|
||||||
|
Moreover, your license from a particular copyright holder is
|
||||||
|
reinstated permanently if the copyright holder notifies you of the
|
||||||
|
violation by some reasonable means, this is the first time you have
|
||||||
|
received notice of violation of this License (for any work) from that
|
||||||
|
copyright holder, and you cure the violation prior to 30 days after
|
||||||
|
your receipt of the notice.
|
||||||
|
|
||||||
|
Termination of your rights under this section does not terminate the
|
||||||
|
licenses of parties who have received copies or rights from you under
|
||||||
|
this License. If your rights have been terminated and not permanently
|
||||||
|
reinstated, you do not qualify to receive new licenses for the same
|
||||||
|
material under section 10.
|
||||||
|
|
||||||
|
9. Acceptance Not Required for Having Copies.
|
||||||
|
|
||||||
|
You are not required to accept this License in order to receive or
|
||||||
|
run a copy of the Program. Ancillary propagation of a covered work
|
||||||
|
occurring solely as a consequence of using peer-to-peer transmission
|
||||||
|
to receive a copy likewise does not require acceptance. However,
|
||||||
|
nothing other than this License grants you permission to propagate or
|
||||||
|
modify any covered work. These actions infringe copyright if you do
|
||||||
|
not accept this License. Therefore, by modifying or propagating a
|
||||||
|
covered work, you indicate your acceptance of this License to do so.
|
||||||
|
|
||||||
|
10. Automatic Licensing of Downstream Recipients.
|
||||||
|
|
||||||
|
Each time you convey a covered work, the recipient automatically
|
||||||
|
receives a license from the original licensors, to run, modify and
|
||||||
|
propagate that work, subject to this License. You are not responsible
|
||||||
|
for enforcing compliance by third parties with this License.
|
||||||
|
|
||||||
|
An "entity transaction" is a transaction transferring control of an
|
||||||
|
organization, or substantially all assets of one, or subdividing an
|
||||||
|
organization, or merging organizations. If propagation of a covered
|
||||||
|
work results from an entity transaction, each party to that
|
||||||
|
transaction who receives a copy of the work also receives whatever
|
||||||
|
licenses to the work the party's predecessor in interest had or could
|
||||||
|
give under the previous paragraph, plus a right to possession of the
|
||||||
|
Corresponding Source of the work from the predecessor in interest, if
|
||||||
|
the predecessor has it or can get it with reasonable efforts.
|
||||||
|
|
||||||
|
You may not impose any further restrictions on the exercise of the
|
||||||
|
rights granted or affirmed under this License. For example, you may
|
||||||
|
not impose a license fee, royalty, or other charge for exercise of
|
||||||
|
rights granted under this License, and you may not initiate litigation
|
||||||
|
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||||
|
any patent claim is infringed by making, using, selling, offering for
|
||||||
|
sale, or importing the Program or any portion of it.
|
||||||
|
|
||||||
|
11. Patents.
|
||||||
|
|
||||||
|
A "contributor" is a copyright holder who authorizes use under this
|
||||||
|
License of the Program or a work on which the Program is based. The
|
||||||
|
work thus licensed is called the contributor's "contributor version".
|
||||||
|
|
||||||
|
A contributor's "essential patent claims" are all patent claims
|
||||||
|
owned or controlled by the contributor, whether already acquired or
|
||||||
|
hereafter acquired, that would be infringed by some manner, permitted
|
||||||
|
by this License, of making, using, or selling its contributor version,
|
||||||
|
but do not include claims that would be infringed only as a
|
||||||
|
consequence of further modification of the contributor version. For
|
||||||
|
purposes of this definition, "control" includes the right to grant
|
||||||
|
patent sublicenses in a manner consistent with the requirements of
|
||||||
|
this License.
|
||||||
|
|
||||||
|
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||||
|
patent license under the contributor's essential patent claims, to
|
||||||
|
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||||
|
propagate the contents of its contributor version.
|
||||||
|
|
||||||
|
In the following three paragraphs, a "patent license" is any express
|
||||||
|
agreement or commitment, however denominated, not to enforce a patent
|
||||||
|
(such as an express permission to practice a patent or covenant not to
|
||||||
|
sue for patent infringement). To "grant" such a patent license to a
|
||||||
|
party means to make such an agreement or commitment not to enforce a
|
||||||
|
patent against the party.
|
||||||
|
|
||||||
|
If you convey a covered work, knowingly relying on a patent license,
|
||||||
|
and the Corresponding Source of the work is not available for anyone
|
||||||
|
to copy, free of charge and under the terms of this License, through a
|
||||||
|
publicly available network server or other readily accessible means,
|
||||||
|
then you must either (1) cause the Corresponding Source to be so
|
||||||
|
available, or (2) arrange to deprive yourself of the benefit of the
|
||||||
|
patent license for this particular work, or (3) arrange, in a manner
|
||||||
|
consistent with the requirements of this License, to extend the patent
|
||||||
|
license to downstream recipients. "Knowingly relying" means you have
|
||||||
|
actual knowledge that, but for the patent license, your conveying the
|
||||||
|
covered work in a country, or your recipient's use of the covered work
|
||||||
|
in a country, would infringe one or more identifiable patents in that
|
||||||
|
country that you have reason to believe are valid.
|
||||||
|
|
||||||
|
If, pursuant to or in connection with a single transaction or
|
||||||
|
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||||
|
covered work, and grant a patent license to some of the parties
|
||||||
|
receiving the covered work authorizing them to use, propagate, modify
|
||||||
|
or convey a specific copy of the covered work, then the patent license
|
||||||
|
you grant is automatically extended to all recipients of the covered
|
||||||
|
work and works based on it.
|
||||||
|
|
||||||
|
A patent license is "discriminatory" if it does not include within
|
||||||
|
the scope of its coverage, prohibits the exercise of, or is
|
||||||
|
conditioned on the non-exercise of one or more of the rights that are
|
||||||
|
specifically granted under this License. You may not convey a covered
|
||||||
|
work if you are a party to an arrangement with a third party that is
|
||||||
|
in the business of distributing software, under which you make payment
|
||||||
|
to the third party based on the extent of your activity of conveying
|
||||||
|
the work, and under which the third party grants, to any of the
|
||||||
|
parties who would receive the covered work from you, a discriminatory
|
||||||
|
patent license (a) in connection with copies of the covered work
|
||||||
|
conveyed by you (or copies made from those copies), or (b) primarily
|
||||||
|
for and in connection with specific products or compilations that
|
||||||
|
contain the covered work, unless you entered into that arrangement,
|
||||||
|
or that patent license was granted, prior to 28 March 2007.
|
||||||
|
|
||||||
|
Nothing in this License shall be construed as excluding or limiting
|
||||||
|
any implied license or other defenses to infringement that may
|
||||||
|
otherwise be available to you under applicable patent law.
|
||||||
|
|
||||||
|
12. No Surrender of Others' Freedom.
|
||||||
|
|
||||||
|
If conditions are imposed on you (whether by court order, agreement or
|
||||||
|
otherwise) that contradict the conditions of this License, they do not
|
||||||
|
excuse you from the conditions of this License. If you cannot convey a
|
||||||
|
covered work so as to satisfy simultaneously your obligations under this
|
||||||
|
License and any other pertinent obligations, then as a consequence you may
|
||||||
|
not convey it at all. For example, if you agree to terms that obligate you
|
||||||
|
to collect a royalty for further conveying from those to whom you convey
|
||||||
|
the Program, the only way you could satisfy both those terms and this
|
||||||
|
License would be to refrain entirely from conveying the Program.
|
||||||
|
|
||||||
|
13. Use with the GNU Affero General Public License.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, you have
|
||||||
|
permission to link or combine any covered work with a work licensed
|
||||||
|
under version 3 of the GNU Affero General Public License into a single
|
||||||
|
combined work, and to convey the resulting work. The terms of this
|
||||||
|
License will continue to apply to the part which is the covered work,
|
||||||
|
but the special requirements of the GNU Affero General Public License,
|
||||||
|
section 13, concerning interaction through a network will apply to the
|
||||||
|
combination as such.
|
||||||
|
|
||||||
|
14. Revised Versions of this License.
|
||||||
|
|
||||||
|
The Free Software Foundation may publish revised and/or new versions of
|
||||||
|
the GNU General Public License from time to time. Such new versions will
|
||||||
|
be similar in spirit to the present version, but may differ in detail to
|
||||||
|
address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the
|
||||||
|
Program specifies that a certain numbered version of the GNU General
|
||||||
|
Public License "or any later version" applies to it, you have the
|
||||||
|
option of following the terms and conditions either of that numbered
|
||||||
|
version or of any later version published by the Free Software
|
||||||
|
Foundation. If the Program does not specify a version number of the
|
||||||
|
GNU General Public License, you may choose any version ever published
|
||||||
|
by the Free Software Foundation.
|
||||||
|
|
||||||
|
If the Program specifies that a proxy can decide which future
|
||||||
|
versions of the GNU General Public License can be used, that proxy's
|
||||||
|
public statement of acceptance of a version permanently authorizes you
|
||||||
|
to choose that version for the Program.
|
||||||
|
|
||||||
|
Later license versions may give you additional or different
|
||||||
|
permissions. However, no additional obligations are imposed on any
|
||||||
|
author or copyright holder as a result of your choosing to follow a
|
||||||
|
later version.
|
||||||
|
|
||||||
|
15. Disclaimer of Warranty.
|
||||||
|
|
||||||
|
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||||
|
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||||
|
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||||
|
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||||
|
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||||
|
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||||
|
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||||
|
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
16. Limitation of Liability.
|
||||||
|
|
||||||
|
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||||
|
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||||
|
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||||
|
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||||
|
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||||
|
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||||
|
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||||
|
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||||
|
SUCH DAMAGES.
|
||||||
|
|
||||||
|
17. Interpretation of Sections 15 and 16.
|
||||||
|
|
||||||
|
If the disclaimer of warranty and limitation of liability provided
|
||||||
|
above cannot be given local legal effect according to their terms,
|
||||||
|
reviewing courts shall apply local law that most closely approximates
|
||||||
|
an absolute waiver of all civil liability in connection with the
|
||||||
|
Program, unless a warranty or assumption of liability accompanies a
|
||||||
|
copy of the Program in return for a fee.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
1462
Sources/libsignal/LocalStorageProtocol.pb-c.c
Executable file
1462
Sources/libsignal/LocalStorageProtocol.pb-c.c
Executable file
File diff suppressed because it is too large
Load diff
509
Sources/libsignal/LocalStorageProtocol.pb-c.h
Executable file
509
Sources/libsignal/LocalStorageProtocol.pb-c.h
Executable file
|
|
@ -0,0 +1,509 @@
|
||||||
|
/* Generated by the protocol buffer compiler. DO NOT EDIT! */
|
||||||
|
/* Generated from: LocalStorageProtocol.proto */
|
||||||
|
|
||||||
|
#ifndef PROTOBUF_C_LocalStorageProtocol_2eproto__INCLUDED
|
||||||
|
#define PROTOBUF_C_LocalStorageProtocol_2eproto__INCLUDED
|
||||||
|
|
||||||
|
#include "protobuf-c/protobuf-c.h"
|
||||||
|
|
||||||
|
PROTOBUF_C__BEGIN_DECLS
|
||||||
|
|
||||||
|
#if PROTOBUF_C_VERSION_NUMBER < 1000000
|
||||||
|
# error This file was generated by a newer version of protoc-c which is incompatible with your libprotobuf-c headers. Please update your headers.
|
||||||
|
#elif 1002001 < PROTOBUF_C_MIN_COMPILER_VERSION
|
||||||
|
# error This file was generated by an older version of protoc-c which is incompatible with your libprotobuf-c headers. Please regenerate this file with a newer version of protoc-c.
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
typedef struct _Textsecure__SessionStructure Textsecure__SessionStructure;
|
||||||
|
typedef struct _Textsecure__SessionStructure__Chain Textsecure__SessionStructure__Chain;
|
||||||
|
typedef struct _Textsecure__SessionStructure__Chain__ChainKey Textsecure__SessionStructure__Chain__ChainKey;
|
||||||
|
typedef struct _Textsecure__SessionStructure__Chain__MessageKey Textsecure__SessionStructure__Chain__MessageKey;
|
||||||
|
typedef struct _Textsecure__SessionStructure__PendingKeyExchange Textsecure__SessionStructure__PendingKeyExchange;
|
||||||
|
typedef struct _Textsecure__SessionStructure__PendingPreKey Textsecure__SessionStructure__PendingPreKey;
|
||||||
|
typedef struct _Textsecure__RecordStructure Textsecure__RecordStructure;
|
||||||
|
typedef struct _Textsecure__PreKeyRecordStructure Textsecure__PreKeyRecordStructure;
|
||||||
|
typedef struct _Textsecure__SignedPreKeyRecordStructure Textsecure__SignedPreKeyRecordStructure;
|
||||||
|
typedef struct _Textsecure__IdentityKeyPairStructure Textsecure__IdentityKeyPairStructure;
|
||||||
|
typedef struct _Textsecure__SenderKeyStateStructure Textsecure__SenderKeyStateStructure;
|
||||||
|
typedef struct _Textsecure__SenderKeyStateStructure__SenderChainKey Textsecure__SenderKeyStateStructure__SenderChainKey;
|
||||||
|
typedef struct _Textsecure__SenderKeyStateStructure__SenderMessageKey Textsecure__SenderKeyStateStructure__SenderMessageKey;
|
||||||
|
typedef struct _Textsecure__SenderKeyStateStructure__SenderSigningKey Textsecure__SenderKeyStateStructure__SenderSigningKey;
|
||||||
|
typedef struct _Textsecure__SenderKeyRecordStructure Textsecure__SenderKeyRecordStructure;
|
||||||
|
|
||||||
|
|
||||||
|
/* --- enums --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- messages --- */
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure__Chain__ChainKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_index;
|
||||||
|
uint32_t index;
|
||||||
|
protobuf_c_boolean has_key;
|
||||||
|
ProtobufCBinaryData key;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__CHAIN__CHAIN_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__chain__chain_key__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure__Chain__MessageKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_index;
|
||||||
|
uint32_t index;
|
||||||
|
protobuf_c_boolean has_cipherkey;
|
||||||
|
ProtobufCBinaryData cipherkey;
|
||||||
|
protobuf_c_boolean has_mackey;
|
||||||
|
ProtobufCBinaryData mackey;
|
||||||
|
protobuf_c_boolean has_iv;
|
||||||
|
ProtobufCBinaryData iv;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__CHAIN__MESSAGE_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__chain__message_key__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure__Chain
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_senderratchetkey;
|
||||||
|
ProtobufCBinaryData senderratchetkey;
|
||||||
|
protobuf_c_boolean has_senderratchetkeyprivate;
|
||||||
|
ProtobufCBinaryData senderratchetkeyprivate;
|
||||||
|
Textsecure__SessionStructure__Chain__ChainKey *chainkey;
|
||||||
|
size_t n_messagekeys;
|
||||||
|
Textsecure__SessionStructure__Chain__MessageKey **messagekeys;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__CHAIN__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__chain__descriptor) \
|
||||||
|
, 0,{0,NULL}, 0,{0,NULL}, NULL, 0,NULL }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure__PendingKeyExchange
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_sequence;
|
||||||
|
uint32_t sequence;
|
||||||
|
protobuf_c_boolean has_localbasekey;
|
||||||
|
ProtobufCBinaryData localbasekey;
|
||||||
|
protobuf_c_boolean has_localbasekeyprivate;
|
||||||
|
ProtobufCBinaryData localbasekeyprivate;
|
||||||
|
protobuf_c_boolean has_localratchetkey;
|
||||||
|
ProtobufCBinaryData localratchetkey;
|
||||||
|
protobuf_c_boolean has_localratchetkeyprivate;
|
||||||
|
ProtobufCBinaryData localratchetkeyprivate;
|
||||||
|
protobuf_c_boolean has_localidentitykey;
|
||||||
|
ProtobufCBinaryData localidentitykey;
|
||||||
|
protobuf_c_boolean has_localidentitykeyprivate;
|
||||||
|
ProtobufCBinaryData localidentitykeyprivate;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__PENDING_KEY_EXCHANGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__pending_key_exchange__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure__PendingPreKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_prekeyid;
|
||||||
|
uint32_t prekeyid;
|
||||||
|
protobuf_c_boolean has_signedprekeyid;
|
||||||
|
int32_t signedprekeyid;
|
||||||
|
protobuf_c_boolean has_basekey;
|
||||||
|
ProtobufCBinaryData basekey;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__PENDING_PRE_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__pending_pre_key__descriptor) \
|
||||||
|
, 0,0, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SessionStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_sessionversion;
|
||||||
|
uint32_t sessionversion;
|
||||||
|
protobuf_c_boolean has_localidentitypublic;
|
||||||
|
ProtobufCBinaryData localidentitypublic;
|
||||||
|
protobuf_c_boolean has_remoteidentitypublic;
|
||||||
|
ProtobufCBinaryData remoteidentitypublic;
|
||||||
|
protobuf_c_boolean has_rootkey;
|
||||||
|
ProtobufCBinaryData rootkey;
|
||||||
|
protobuf_c_boolean has_previouscounter;
|
||||||
|
uint32_t previouscounter;
|
||||||
|
Textsecure__SessionStructure__Chain *senderchain;
|
||||||
|
size_t n_receiverchains;
|
||||||
|
Textsecure__SessionStructure__Chain **receiverchains;
|
||||||
|
Textsecure__SessionStructure__PendingKeyExchange *pendingkeyexchange;
|
||||||
|
Textsecure__SessionStructure__PendingPreKey *pendingprekey;
|
||||||
|
protobuf_c_boolean has_remoteregistrationid;
|
||||||
|
uint32_t remoteregistrationid;
|
||||||
|
protobuf_c_boolean has_localregistrationid;
|
||||||
|
uint32_t localregistrationid;
|
||||||
|
protobuf_c_boolean has_needsrefresh;
|
||||||
|
protobuf_c_boolean needsrefresh;
|
||||||
|
protobuf_c_boolean has_alicebasekey;
|
||||||
|
ProtobufCBinaryData alicebasekey;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SESSION_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__session_structure__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,0, NULL, 0,NULL, NULL, NULL, 0,0, 0,0, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__RecordStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
Textsecure__SessionStructure *currentsession;
|
||||||
|
size_t n_previoussessions;
|
||||||
|
Textsecure__SessionStructure **previoussessions;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__RECORD_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__record_structure__descriptor) \
|
||||||
|
, NULL, 0,NULL }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__PreKeyRecordStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_id;
|
||||||
|
uint32_t id;
|
||||||
|
protobuf_c_boolean has_publickey;
|
||||||
|
ProtobufCBinaryData publickey;
|
||||||
|
protobuf_c_boolean has_privatekey;
|
||||||
|
ProtobufCBinaryData privatekey;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__PRE_KEY_RECORD_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__pre_key_record_structure__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SignedPreKeyRecordStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_id;
|
||||||
|
uint32_t id;
|
||||||
|
protobuf_c_boolean has_publickey;
|
||||||
|
ProtobufCBinaryData publickey;
|
||||||
|
protobuf_c_boolean has_privatekey;
|
||||||
|
ProtobufCBinaryData privatekey;
|
||||||
|
protobuf_c_boolean has_signature;
|
||||||
|
ProtobufCBinaryData signature;
|
||||||
|
protobuf_c_boolean has_timestamp;
|
||||||
|
uint64_t timestamp;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SIGNED_PRE_KEY_RECORD_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__signed_pre_key_record_structure__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,0 }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__IdentityKeyPairStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_publickey;
|
||||||
|
ProtobufCBinaryData publickey;
|
||||||
|
protobuf_c_boolean has_privatekey;
|
||||||
|
ProtobufCBinaryData privatekey;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__IDENTITY_KEY_PAIR_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__identity_key_pair_structure__descriptor) \
|
||||||
|
, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyStateStructure__SenderChainKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_iteration;
|
||||||
|
uint32_t iteration;
|
||||||
|
protobuf_c_boolean has_seed;
|
||||||
|
ProtobufCBinaryData seed;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_STATE_STRUCTURE__SENDER_CHAIN_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_state_structure__sender_chain_key__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyStateStructure__SenderMessageKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_iteration;
|
||||||
|
uint32_t iteration;
|
||||||
|
protobuf_c_boolean has_seed;
|
||||||
|
ProtobufCBinaryData seed;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_STATE_STRUCTURE__SENDER_MESSAGE_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_state_structure__sender_message_key__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyStateStructure__SenderSigningKey
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_public_;
|
||||||
|
ProtobufCBinaryData public_;
|
||||||
|
protobuf_c_boolean has_private_;
|
||||||
|
ProtobufCBinaryData private_;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_STATE_STRUCTURE__SENDER_SIGNING_KEY__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_state_structure__sender_signing_key__descriptor) \
|
||||||
|
, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyStateStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_senderkeyid;
|
||||||
|
uint32_t senderkeyid;
|
||||||
|
Textsecure__SenderKeyStateStructure__SenderChainKey *senderchainkey;
|
||||||
|
Textsecure__SenderKeyStateStructure__SenderSigningKey *sendersigningkey;
|
||||||
|
size_t n_sendermessagekeys;
|
||||||
|
Textsecure__SenderKeyStateStructure__SenderMessageKey **sendermessagekeys;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_STATE_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_state_structure__descriptor) \
|
||||||
|
, 0,0, NULL, NULL, 0,NULL }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyRecordStructure
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
size_t n_senderkeystates;
|
||||||
|
Textsecure__SenderKeyStateStructure **senderkeystates;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_RECORD_STRUCTURE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_record_structure__descriptor) \
|
||||||
|
, 0,NULL }
|
||||||
|
|
||||||
|
|
||||||
|
/* Textsecure__SessionStructure__Chain__ChainKey methods */
|
||||||
|
void textsecure__session_structure__chain__chain_key__init
|
||||||
|
(Textsecure__SessionStructure__Chain__ChainKey *message);
|
||||||
|
/* Textsecure__SessionStructure__Chain__MessageKey methods */
|
||||||
|
void textsecure__session_structure__chain__message_key__init
|
||||||
|
(Textsecure__SessionStructure__Chain__MessageKey *message);
|
||||||
|
/* Textsecure__SessionStructure__Chain methods */
|
||||||
|
void textsecure__session_structure__chain__init
|
||||||
|
(Textsecure__SessionStructure__Chain *message);
|
||||||
|
/* Textsecure__SessionStructure__PendingKeyExchange methods */
|
||||||
|
void textsecure__session_structure__pending_key_exchange__init
|
||||||
|
(Textsecure__SessionStructure__PendingKeyExchange *message);
|
||||||
|
/* Textsecure__SessionStructure__PendingPreKey methods */
|
||||||
|
void textsecure__session_structure__pending_pre_key__init
|
||||||
|
(Textsecure__SessionStructure__PendingPreKey *message);
|
||||||
|
/* Textsecure__SessionStructure methods */
|
||||||
|
void textsecure__session_structure__init
|
||||||
|
(Textsecure__SessionStructure *message);
|
||||||
|
size_t textsecure__session_structure__get_packed_size
|
||||||
|
(const Textsecure__SessionStructure *message);
|
||||||
|
size_t textsecure__session_structure__pack
|
||||||
|
(const Textsecure__SessionStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__session_structure__pack_to_buffer
|
||||||
|
(const Textsecure__SessionStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SessionStructure *
|
||||||
|
textsecure__session_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__session_structure__free_unpacked
|
||||||
|
(Textsecure__SessionStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__RecordStructure methods */
|
||||||
|
void textsecure__record_structure__init
|
||||||
|
(Textsecure__RecordStructure *message);
|
||||||
|
size_t textsecure__record_structure__get_packed_size
|
||||||
|
(const Textsecure__RecordStructure *message);
|
||||||
|
size_t textsecure__record_structure__pack
|
||||||
|
(const Textsecure__RecordStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__record_structure__pack_to_buffer
|
||||||
|
(const Textsecure__RecordStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__RecordStructure *
|
||||||
|
textsecure__record_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__record_structure__free_unpacked
|
||||||
|
(Textsecure__RecordStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__PreKeyRecordStructure methods */
|
||||||
|
void textsecure__pre_key_record_structure__init
|
||||||
|
(Textsecure__PreKeyRecordStructure *message);
|
||||||
|
size_t textsecure__pre_key_record_structure__get_packed_size
|
||||||
|
(const Textsecure__PreKeyRecordStructure *message);
|
||||||
|
size_t textsecure__pre_key_record_structure__pack
|
||||||
|
(const Textsecure__PreKeyRecordStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__pre_key_record_structure__pack_to_buffer
|
||||||
|
(const Textsecure__PreKeyRecordStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__PreKeyRecordStructure *
|
||||||
|
textsecure__pre_key_record_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__pre_key_record_structure__free_unpacked
|
||||||
|
(Textsecure__PreKeyRecordStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__SignedPreKeyRecordStructure methods */
|
||||||
|
void textsecure__signed_pre_key_record_structure__init
|
||||||
|
(Textsecure__SignedPreKeyRecordStructure *message);
|
||||||
|
size_t textsecure__signed_pre_key_record_structure__get_packed_size
|
||||||
|
(const Textsecure__SignedPreKeyRecordStructure *message);
|
||||||
|
size_t textsecure__signed_pre_key_record_structure__pack
|
||||||
|
(const Textsecure__SignedPreKeyRecordStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__signed_pre_key_record_structure__pack_to_buffer
|
||||||
|
(const Textsecure__SignedPreKeyRecordStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SignedPreKeyRecordStructure *
|
||||||
|
textsecure__signed_pre_key_record_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__signed_pre_key_record_structure__free_unpacked
|
||||||
|
(Textsecure__SignedPreKeyRecordStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__IdentityKeyPairStructure methods */
|
||||||
|
void textsecure__identity_key_pair_structure__init
|
||||||
|
(Textsecure__IdentityKeyPairStructure *message);
|
||||||
|
size_t textsecure__identity_key_pair_structure__get_packed_size
|
||||||
|
(const Textsecure__IdentityKeyPairStructure *message);
|
||||||
|
size_t textsecure__identity_key_pair_structure__pack
|
||||||
|
(const Textsecure__IdentityKeyPairStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__identity_key_pair_structure__pack_to_buffer
|
||||||
|
(const Textsecure__IdentityKeyPairStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__IdentityKeyPairStructure *
|
||||||
|
textsecure__identity_key_pair_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__identity_key_pair_structure__free_unpacked
|
||||||
|
(Textsecure__IdentityKeyPairStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__SenderKeyStateStructure__SenderChainKey methods */
|
||||||
|
void textsecure__sender_key_state_structure__sender_chain_key__init
|
||||||
|
(Textsecure__SenderKeyStateStructure__SenderChainKey *message);
|
||||||
|
/* Textsecure__SenderKeyStateStructure__SenderMessageKey methods */
|
||||||
|
void textsecure__sender_key_state_structure__sender_message_key__init
|
||||||
|
(Textsecure__SenderKeyStateStructure__SenderMessageKey *message);
|
||||||
|
/* Textsecure__SenderKeyStateStructure__SenderSigningKey methods */
|
||||||
|
void textsecure__sender_key_state_structure__sender_signing_key__init
|
||||||
|
(Textsecure__SenderKeyStateStructure__SenderSigningKey *message);
|
||||||
|
/* Textsecure__SenderKeyStateStructure methods */
|
||||||
|
void textsecure__sender_key_state_structure__init
|
||||||
|
(Textsecure__SenderKeyStateStructure *message);
|
||||||
|
size_t textsecure__sender_key_state_structure__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyStateStructure *message);
|
||||||
|
size_t textsecure__sender_key_state_structure__pack
|
||||||
|
(const Textsecure__SenderKeyStateStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__sender_key_state_structure__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyStateStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SenderKeyStateStructure *
|
||||||
|
textsecure__sender_key_state_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__sender_key_state_structure__free_unpacked
|
||||||
|
(Textsecure__SenderKeyStateStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__SenderKeyRecordStructure methods */
|
||||||
|
void textsecure__sender_key_record_structure__init
|
||||||
|
(Textsecure__SenderKeyRecordStructure *message);
|
||||||
|
size_t textsecure__sender_key_record_structure__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyRecordStructure *message);
|
||||||
|
size_t textsecure__sender_key_record_structure__pack
|
||||||
|
(const Textsecure__SenderKeyRecordStructure *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__sender_key_record_structure__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyRecordStructure *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SenderKeyRecordStructure *
|
||||||
|
textsecure__sender_key_record_structure__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__sender_key_record_structure__free_unpacked
|
||||||
|
(Textsecure__SenderKeyRecordStructure *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* --- per-message closures --- */
|
||||||
|
|
||||||
|
typedef void (*Textsecure__SessionStructure__Chain__ChainKey_Closure)
|
||||||
|
(const Textsecure__SessionStructure__Chain__ChainKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SessionStructure__Chain__MessageKey_Closure)
|
||||||
|
(const Textsecure__SessionStructure__Chain__MessageKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SessionStructure__Chain_Closure)
|
||||||
|
(const Textsecure__SessionStructure__Chain *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SessionStructure__PendingKeyExchange_Closure)
|
||||||
|
(const Textsecure__SessionStructure__PendingKeyExchange *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SessionStructure__PendingPreKey_Closure)
|
||||||
|
(const Textsecure__SessionStructure__PendingPreKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SessionStructure_Closure)
|
||||||
|
(const Textsecure__SessionStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__RecordStructure_Closure)
|
||||||
|
(const Textsecure__RecordStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__PreKeyRecordStructure_Closure)
|
||||||
|
(const Textsecure__PreKeyRecordStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SignedPreKeyRecordStructure_Closure)
|
||||||
|
(const Textsecure__SignedPreKeyRecordStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__IdentityKeyPairStructure_Closure)
|
||||||
|
(const Textsecure__IdentityKeyPairStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyStateStructure__SenderChainKey_Closure)
|
||||||
|
(const Textsecure__SenderKeyStateStructure__SenderChainKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyStateStructure__SenderMessageKey_Closure)
|
||||||
|
(const Textsecure__SenderKeyStateStructure__SenderMessageKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyStateStructure__SenderSigningKey_Closure)
|
||||||
|
(const Textsecure__SenderKeyStateStructure__SenderSigningKey *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyStateStructure_Closure)
|
||||||
|
(const Textsecure__SenderKeyStateStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyRecordStructure_Closure)
|
||||||
|
(const Textsecure__SenderKeyRecordStructure *message,
|
||||||
|
void *closure_data);
|
||||||
|
|
||||||
|
/* --- services --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- descriptors --- */
|
||||||
|
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__chain__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__chain__chain_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__chain__message_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__pending_key_exchange__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__session_structure__pending_pre_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__record_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__pre_key_record_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__signed_pre_key_record_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__identity_key_pair_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_state_structure__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_state_structure__sender_chain_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_state_structure__sender_message_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_state_structure__sender_signing_key__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_record_structure__descriptor;
|
||||||
|
|
||||||
|
PROTOBUF_C__END_DECLS
|
||||||
|
|
||||||
|
|
||||||
|
#endif /* PROTOBUF_C_LocalStorageProtocol_2eproto__INCLUDED */
|
||||||
729
Sources/libsignal/WhisperTextProtocol.pb-c.c
Executable file
729
Sources/libsignal/WhisperTextProtocol.pb-c.c
Executable file
|
|
@ -0,0 +1,729 @@
|
||||||
|
/* Generated by the protocol buffer compiler. DO NOT EDIT! */
|
||||||
|
/* Generated from: WhisperTextProtocol.proto */
|
||||||
|
|
||||||
|
/* Do not generate deprecated warnings for self */
|
||||||
|
#ifndef PROTOBUF_C__NO_DEPRECATED
|
||||||
|
#define PROTOBUF_C__NO_DEPRECATED
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#include "WhisperTextProtocol.pb-c.h"
|
||||||
|
void textsecure__signal_message__init
|
||||||
|
(Textsecure__SignalMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__SignalMessage init_value = TEXTSECURE__SIGNAL_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__signal_message__get_packed_size
|
||||||
|
(const Textsecure__SignalMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__signal_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__signal_message__pack
|
||||||
|
(const Textsecure__SignalMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__signal_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__signal_message__pack_to_buffer
|
||||||
|
(const Textsecure__SignalMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__signal_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__SignalMessage *
|
||||||
|
textsecure__signal_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__SignalMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__signal_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__signal_message__free_unpacked
|
||||||
|
(Textsecure__SignalMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__signal_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__pre_key_signal_message__init
|
||||||
|
(Textsecure__PreKeySignalMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__PreKeySignalMessage init_value = TEXTSECURE__PRE_KEY_SIGNAL_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__pre_key_signal_message__get_packed_size
|
||||||
|
(const Textsecure__PreKeySignalMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__pre_key_signal_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__pre_key_signal_message__pack
|
||||||
|
(const Textsecure__PreKeySignalMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__pre_key_signal_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__pre_key_signal_message__pack_to_buffer
|
||||||
|
(const Textsecure__PreKeySignalMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__pre_key_signal_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__PreKeySignalMessage *
|
||||||
|
textsecure__pre_key_signal_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__PreKeySignalMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__pre_key_signal_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__pre_key_signal_message__free_unpacked
|
||||||
|
(Textsecure__PreKeySignalMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__pre_key_signal_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__key_exchange_message__init
|
||||||
|
(Textsecure__KeyExchangeMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__KeyExchangeMessage init_value = TEXTSECURE__KEY_EXCHANGE_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__key_exchange_message__get_packed_size
|
||||||
|
(const Textsecure__KeyExchangeMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__key_exchange_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__key_exchange_message__pack
|
||||||
|
(const Textsecure__KeyExchangeMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__key_exchange_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__key_exchange_message__pack_to_buffer
|
||||||
|
(const Textsecure__KeyExchangeMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__key_exchange_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__KeyExchangeMessage *
|
||||||
|
textsecure__key_exchange_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__KeyExchangeMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__key_exchange_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__key_exchange_message__free_unpacked
|
||||||
|
(Textsecure__KeyExchangeMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__key_exchange_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__sender_key_message__init
|
||||||
|
(Textsecure__SenderKeyMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__SenderKeyMessage init_value = TEXTSECURE__SENDER_KEY_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_message__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_message__pack
|
||||||
|
(const Textsecure__SenderKeyMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_message__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__SenderKeyMessage *
|
||||||
|
textsecure__sender_key_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__SenderKeyMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__sender_key_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__sender_key_message__free_unpacked
|
||||||
|
(Textsecure__SenderKeyMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__sender_key_distribution_message__init
|
||||||
|
(Textsecure__SenderKeyDistributionMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__SenderKeyDistributionMessage init_value = TEXTSECURE__SENDER_KEY_DISTRIBUTION_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_distribution_message__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_distribution_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_distribution_message__pack
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_distribution_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__sender_key_distribution_message__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_distribution_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__SenderKeyDistributionMessage *
|
||||||
|
textsecure__sender_key_distribution_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__SenderKeyDistributionMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__sender_key_distribution_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__sender_key_distribution_message__free_unpacked
|
||||||
|
(Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__sender_key_distribution_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
void textsecure__device_consistency_code_message__init
|
||||||
|
(Textsecure__DeviceConsistencyCodeMessage *message)
|
||||||
|
{
|
||||||
|
static Textsecure__DeviceConsistencyCodeMessage init_value = TEXTSECURE__DEVICE_CONSISTENCY_CODE_MESSAGE__INIT;
|
||||||
|
*message = init_value;
|
||||||
|
}
|
||||||
|
size_t textsecure__device_consistency_code_message__get_packed_size
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__device_consistency_code_message__descriptor);
|
||||||
|
return protobuf_c_message_get_packed_size ((const ProtobufCMessage*)(message));
|
||||||
|
}
|
||||||
|
size_t textsecure__device_consistency_code_message__pack
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
uint8_t *out)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__device_consistency_code_message__descriptor);
|
||||||
|
return protobuf_c_message_pack ((const ProtobufCMessage*)message, out);
|
||||||
|
}
|
||||||
|
size_t textsecure__device_consistency_code_message__pack_to_buffer
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
ProtobufCBuffer *buffer)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__device_consistency_code_message__descriptor);
|
||||||
|
return protobuf_c_message_pack_to_buffer ((const ProtobufCMessage*)message, buffer);
|
||||||
|
}
|
||||||
|
Textsecure__DeviceConsistencyCodeMessage *
|
||||||
|
textsecure__device_consistency_code_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data)
|
||||||
|
{
|
||||||
|
return (Textsecure__DeviceConsistencyCodeMessage *)
|
||||||
|
protobuf_c_message_unpack (&textsecure__device_consistency_code_message__descriptor,
|
||||||
|
allocator, len, data);
|
||||||
|
}
|
||||||
|
void textsecure__device_consistency_code_message__free_unpacked
|
||||||
|
(Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
ProtobufCAllocator *allocator)
|
||||||
|
{
|
||||||
|
assert(message->base.descriptor == &textsecure__device_consistency_code_message__descriptor);
|
||||||
|
protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);
|
||||||
|
}
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__signal_message__field_descriptors[4] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"ratchetKey",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__SignalMessage, has_ratchetkey),
|
||||||
|
offsetof(Textsecure__SignalMessage, ratchetkey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"counter",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SignalMessage, has_counter),
|
||||||
|
offsetof(Textsecure__SignalMessage, counter),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"previousCounter",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SignalMessage, has_previouscounter),
|
||||||
|
offsetof(Textsecure__SignalMessage, previouscounter),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ciphertext",
|
||||||
|
4,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__SignalMessage, has_ciphertext),
|
||||||
|
offsetof(Textsecure__SignalMessage, ciphertext),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__signal_message__field_indices_by_name[] = {
|
||||||
|
3, /* field[3] = ciphertext */
|
||||||
|
1, /* field[1] = counter */
|
||||||
|
2, /* field[2] = previousCounter */
|
||||||
|
0, /* field[0] = ratchetKey */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__signal_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 4 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__signal_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.SignalMessage",
|
||||||
|
"SignalMessage",
|
||||||
|
"Textsecure__SignalMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__SignalMessage),
|
||||||
|
4,
|
||||||
|
textsecure__signal_message__field_descriptors,
|
||||||
|
textsecure__signal_message__field_indices_by_name,
|
||||||
|
1, textsecure__signal_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__signal_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__pre_key_signal_message__field_descriptors[6] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"preKeyId",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_prekeyid),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, prekeyid),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"baseKey",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_basekey),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, basekey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"identityKey",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_identitykey),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, identitykey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"message",
|
||||||
|
4,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_message),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, message),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"registrationId",
|
||||||
|
5,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_registrationid),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, registrationid),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"signedPreKeyId",
|
||||||
|
6,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, has_signedprekeyid),
|
||||||
|
offsetof(Textsecure__PreKeySignalMessage, signedprekeyid),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__pre_key_signal_message__field_indices_by_name[] = {
|
||||||
|
1, /* field[1] = baseKey */
|
||||||
|
2, /* field[2] = identityKey */
|
||||||
|
3, /* field[3] = message */
|
||||||
|
0, /* field[0] = preKeyId */
|
||||||
|
4, /* field[4] = registrationId */
|
||||||
|
5, /* field[5] = signedPreKeyId */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__pre_key_signal_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 6 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__pre_key_signal_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.PreKeySignalMessage",
|
||||||
|
"PreKeySignalMessage",
|
||||||
|
"Textsecure__PreKeySignalMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__PreKeySignalMessage),
|
||||||
|
6,
|
||||||
|
textsecure__pre_key_signal_message__field_descriptors,
|
||||||
|
textsecure__pre_key_signal_message__field_indices_by_name,
|
||||||
|
1, textsecure__pre_key_signal_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__pre_key_signal_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__key_exchange_message__field_descriptors[5] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"id",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, has_id),
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, id),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"baseKey",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, has_basekey),
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, basekey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ratchetKey",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, has_ratchetkey),
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, ratchetkey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"identityKey",
|
||||||
|
4,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, has_identitykey),
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, identitykey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"baseKeySignature",
|
||||||
|
5,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, has_basekeysignature),
|
||||||
|
offsetof(Textsecure__KeyExchangeMessage, basekeysignature),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__key_exchange_message__field_indices_by_name[] = {
|
||||||
|
1, /* field[1] = baseKey */
|
||||||
|
4, /* field[4] = baseKeySignature */
|
||||||
|
0, /* field[0] = id */
|
||||||
|
3, /* field[3] = identityKey */
|
||||||
|
2, /* field[2] = ratchetKey */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__key_exchange_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 5 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__key_exchange_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.KeyExchangeMessage",
|
||||||
|
"KeyExchangeMessage",
|
||||||
|
"Textsecure__KeyExchangeMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__KeyExchangeMessage),
|
||||||
|
5,
|
||||||
|
textsecure__key_exchange_message__field_descriptors,
|
||||||
|
textsecure__key_exchange_message__field_indices_by_name,
|
||||||
|
1, textsecure__key_exchange_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__key_exchange_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__sender_key_message__field_descriptors[3] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"id",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, has_id),
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, id),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"iteration",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, has_iteration),
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, iteration),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ciphertext",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, has_ciphertext),
|
||||||
|
offsetof(Textsecure__SenderKeyMessage, ciphertext),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__sender_key_message__field_indices_by_name[] = {
|
||||||
|
2, /* field[2] = ciphertext */
|
||||||
|
0, /* field[0] = id */
|
||||||
|
1, /* field[1] = iteration */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__sender_key_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 3 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__sender_key_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.SenderKeyMessage",
|
||||||
|
"SenderKeyMessage",
|
||||||
|
"Textsecure__SenderKeyMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__SenderKeyMessage),
|
||||||
|
3,
|
||||||
|
textsecure__sender_key_message__field_descriptors,
|
||||||
|
textsecure__sender_key_message__field_indices_by_name,
|
||||||
|
1, textsecure__sender_key_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__sender_key_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__sender_key_distribution_message__field_descriptors[4] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"id",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, has_id),
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, id),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"iteration",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, has_iteration),
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, iteration),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"chainKey",
|
||||||
|
3,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, has_chainkey),
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, chainkey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"signingKey",
|
||||||
|
4,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, has_signingkey),
|
||||||
|
offsetof(Textsecure__SenderKeyDistributionMessage, signingkey),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__sender_key_distribution_message__field_indices_by_name[] = {
|
||||||
|
2, /* field[2] = chainKey */
|
||||||
|
0, /* field[0] = id */
|
||||||
|
1, /* field[1] = iteration */
|
||||||
|
3, /* field[3] = signingKey */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__sender_key_distribution_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 4 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__sender_key_distribution_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.SenderKeyDistributionMessage",
|
||||||
|
"SenderKeyDistributionMessage",
|
||||||
|
"Textsecure__SenderKeyDistributionMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__SenderKeyDistributionMessage),
|
||||||
|
4,
|
||||||
|
textsecure__sender_key_distribution_message__field_descriptors,
|
||||||
|
textsecure__sender_key_distribution_message__field_indices_by_name,
|
||||||
|
1, textsecure__sender_key_distribution_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__sender_key_distribution_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
|
static const ProtobufCFieldDescriptor textsecure__device_consistency_code_message__field_descriptors[2] =
|
||||||
|
{
|
||||||
|
{
|
||||||
|
"generation",
|
||||||
|
1,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_UINT32,
|
||||||
|
offsetof(Textsecure__DeviceConsistencyCodeMessage, has_generation),
|
||||||
|
offsetof(Textsecure__DeviceConsistencyCodeMessage, generation),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"signature",
|
||||||
|
2,
|
||||||
|
PROTOBUF_C_LABEL_OPTIONAL,
|
||||||
|
PROTOBUF_C_TYPE_BYTES,
|
||||||
|
offsetof(Textsecure__DeviceConsistencyCodeMessage, has_signature),
|
||||||
|
offsetof(Textsecure__DeviceConsistencyCodeMessage, signature),
|
||||||
|
NULL,
|
||||||
|
NULL,
|
||||||
|
0, /* flags */
|
||||||
|
0,NULL,NULL /* reserved1,reserved2, etc */
|
||||||
|
},
|
||||||
|
};
|
||||||
|
static const unsigned textsecure__device_consistency_code_message__field_indices_by_name[] = {
|
||||||
|
0, /* field[0] = generation */
|
||||||
|
1, /* field[1] = signature */
|
||||||
|
};
|
||||||
|
static const ProtobufCIntRange textsecure__device_consistency_code_message__number_ranges[1 + 1] =
|
||||||
|
{
|
||||||
|
{ 1, 0 },
|
||||||
|
{ 0, 2 }
|
||||||
|
};
|
||||||
|
const ProtobufCMessageDescriptor textsecure__device_consistency_code_message__descriptor =
|
||||||
|
{
|
||||||
|
PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
|
||||||
|
"textsecure.DeviceConsistencyCodeMessage",
|
||||||
|
"DeviceConsistencyCodeMessage",
|
||||||
|
"Textsecure__DeviceConsistencyCodeMessage",
|
||||||
|
"textsecure",
|
||||||
|
sizeof(Textsecure__DeviceConsistencyCodeMessage),
|
||||||
|
2,
|
||||||
|
textsecure__device_consistency_code_message__field_descriptors,
|
||||||
|
textsecure__device_consistency_code_message__field_indices_by_name,
|
||||||
|
1, textsecure__device_consistency_code_message__number_ranges,
|
||||||
|
(ProtobufCMessageInit) textsecure__device_consistency_code_message__init,
|
||||||
|
NULL,NULL,NULL /* reserved[123] */
|
||||||
|
};
|
||||||
286
Sources/libsignal/WhisperTextProtocol.pb-c.h
Executable file
286
Sources/libsignal/WhisperTextProtocol.pb-c.h
Executable file
|
|
@ -0,0 +1,286 @@
|
||||||
|
/* Generated by the protocol buffer compiler. DO NOT EDIT! */
|
||||||
|
/* Generated from: WhisperTextProtocol.proto */
|
||||||
|
|
||||||
|
#ifndef PROTOBUF_C_WhisperTextProtocol_2eproto__INCLUDED
|
||||||
|
#define PROTOBUF_C_WhisperTextProtocol_2eproto__INCLUDED
|
||||||
|
|
||||||
|
#include "protobuf-c/protobuf-c.h"
|
||||||
|
|
||||||
|
PROTOBUF_C__BEGIN_DECLS
|
||||||
|
|
||||||
|
#if PROTOBUF_C_VERSION_NUMBER < 1000000
|
||||||
|
# error This file was generated by a newer version of protoc-c which is incompatible with your libprotobuf-c headers. Please update your headers.
|
||||||
|
#elif 1002001 < PROTOBUF_C_MIN_COMPILER_VERSION
|
||||||
|
# error This file was generated by an older version of protoc-c which is incompatible with your libprotobuf-c headers. Please regenerate this file with a newer version of protoc-c.
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
typedef struct _Textsecure__SignalMessage Textsecure__SignalMessage;
|
||||||
|
typedef struct _Textsecure__PreKeySignalMessage Textsecure__PreKeySignalMessage;
|
||||||
|
typedef struct _Textsecure__KeyExchangeMessage Textsecure__KeyExchangeMessage;
|
||||||
|
typedef struct _Textsecure__SenderKeyMessage Textsecure__SenderKeyMessage;
|
||||||
|
typedef struct _Textsecure__SenderKeyDistributionMessage Textsecure__SenderKeyDistributionMessage;
|
||||||
|
typedef struct _Textsecure__DeviceConsistencyCodeMessage Textsecure__DeviceConsistencyCodeMessage;
|
||||||
|
|
||||||
|
|
||||||
|
/* --- enums --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- messages --- */
|
||||||
|
|
||||||
|
struct _Textsecure__SignalMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_ratchetkey;
|
||||||
|
ProtobufCBinaryData ratchetkey;
|
||||||
|
protobuf_c_boolean has_counter;
|
||||||
|
uint32_t counter;
|
||||||
|
protobuf_c_boolean has_previouscounter;
|
||||||
|
uint32_t previouscounter;
|
||||||
|
protobuf_c_boolean has_ciphertext;
|
||||||
|
ProtobufCBinaryData ciphertext;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SIGNAL_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__signal_message__descriptor) \
|
||||||
|
, 0,{0,NULL}, 0,0, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__PreKeySignalMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_registrationid;
|
||||||
|
uint32_t registrationid;
|
||||||
|
protobuf_c_boolean has_prekeyid;
|
||||||
|
uint32_t prekeyid;
|
||||||
|
protobuf_c_boolean has_signedprekeyid;
|
||||||
|
uint32_t signedprekeyid;
|
||||||
|
protobuf_c_boolean has_basekey;
|
||||||
|
ProtobufCBinaryData basekey;
|
||||||
|
protobuf_c_boolean has_identitykey;
|
||||||
|
ProtobufCBinaryData identitykey;
|
||||||
|
/*
|
||||||
|
* SignalMessage
|
||||||
|
*/
|
||||||
|
protobuf_c_boolean has_message;
|
||||||
|
ProtobufCBinaryData message;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__PRE_KEY_SIGNAL_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__pre_key_signal_message__descriptor) \
|
||||||
|
, 0,0, 0,0, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__KeyExchangeMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_id;
|
||||||
|
uint32_t id;
|
||||||
|
protobuf_c_boolean has_basekey;
|
||||||
|
ProtobufCBinaryData basekey;
|
||||||
|
protobuf_c_boolean has_ratchetkey;
|
||||||
|
ProtobufCBinaryData ratchetkey;
|
||||||
|
protobuf_c_boolean has_identitykey;
|
||||||
|
ProtobufCBinaryData identitykey;
|
||||||
|
protobuf_c_boolean has_basekeysignature;
|
||||||
|
ProtobufCBinaryData basekeysignature;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__KEY_EXCHANGE_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__key_exchange_message__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_id;
|
||||||
|
uint32_t id;
|
||||||
|
protobuf_c_boolean has_iteration;
|
||||||
|
uint32_t iteration;
|
||||||
|
protobuf_c_boolean has_ciphertext;
|
||||||
|
ProtobufCBinaryData ciphertext;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_message__descriptor) \
|
||||||
|
, 0,0, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__SenderKeyDistributionMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_id;
|
||||||
|
uint32_t id;
|
||||||
|
protobuf_c_boolean has_iteration;
|
||||||
|
uint32_t iteration;
|
||||||
|
protobuf_c_boolean has_chainkey;
|
||||||
|
ProtobufCBinaryData chainkey;
|
||||||
|
protobuf_c_boolean has_signingkey;
|
||||||
|
ProtobufCBinaryData signingkey;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__SENDER_KEY_DISTRIBUTION_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__sender_key_distribution_message__descriptor) \
|
||||||
|
, 0,0, 0,0, 0,{0,NULL}, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
struct _Textsecure__DeviceConsistencyCodeMessage
|
||||||
|
{
|
||||||
|
ProtobufCMessage base;
|
||||||
|
protobuf_c_boolean has_generation;
|
||||||
|
uint32_t generation;
|
||||||
|
protobuf_c_boolean has_signature;
|
||||||
|
ProtobufCBinaryData signature;
|
||||||
|
};
|
||||||
|
#define TEXTSECURE__DEVICE_CONSISTENCY_CODE_MESSAGE__INIT \
|
||||||
|
{ PROTOBUF_C_MESSAGE_INIT (&textsecure__device_consistency_code_message__descriptor) \
|
||||||
|
, 0,0, 0,{0,NULL} }
|
||||||
|
|
||||||
|
|
||||||
|
/* Textsecure__SignalMessage methods */
|
||||||
|
void textsecure__signal_message__init
|
||||||
|
(Textsecure__SignalMessage *message);
|
||||||
|
size_t textsecure__signal_message__get_packed_size
|
||||||
|
(const Textsecure__SignalMessage *message);
|
||||||
|
size_t textsecure__signal_message__pack
|
||||||
|
(const Textsecure__SignalMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__signal_message__pack_to_buffer
|
||||||
|
(const Textsecure__SignalMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SignalMessage *
|
||||||
|
textsecure__signal_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__signal_message__free_unpacked
|
||||||
|
(Textsecure__SignalMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__PreKeySignalMessage methods */
|
||||||
|
void textsecure__pre_key_signal_message__init
|
||||||
|
(Textsecure__PreKeySignalMessage *message);
|
||||||
|
size_t textsecure__pre_key_signal_message__get_packed_size
|
||||||
|
(const Textsecure__PreKeySignalMessage *message);
|
||||||
|
size_t textsecure__pre_key_signal_message__pack
|
||||||
|
(const Textsecure__PreKeySignalMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__pre_key_signal_message__pack_to_buffer
|
||||||
|
(const Textsecure__PreKeySignalMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__PreKeySignalMessage *
|
||||||
|
textsecure__pre_key_signal_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__pre_key_signal_message__free_unpacked
|
||||||
|
(Textsecure__PreKeySignalMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__KeyExchangeMessage methods */
|
||||||
|
void textsecure__key_exchange_message__init
|
||||||
|
(Textsecure__KeyExchangeMessage *message);
|
||||||
|
size_t textsecure__key_exchange_message__get_packed_size
|
||||||
|
(const Textsecure__KeyExchangeMessage *message);
|
||||||
|
size_t textsecure__key_exchange_message__pack
|
||||||
|
(const Textsecure__KeyExchangeMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__key_exchange_message__pack_to_buffer
|
||||||
|
(const Textsecure__KeyExchangeMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__KeyExchangeMessage *
|
||||||
|
textsecure__key_exchange_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__key_exchange_message__free_unpacked
|
||||||
|
(Textsecure__KeyExchangeMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__SenderKeyMessage methods */
|
||||||
|
void textsecure__sender_key_message__init
|
||||||
|
(Textsecure__SenderKeyMessage *message);
|
||||||
|
size_t textsecure__sender_key_message__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyMessage *message);
|
||||||
|
size_t textsecure__sender_key_message__pack
|
||||||
|
(const Textsecure__SenderKeyMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__sender_key_message__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SenderKeyMessage *
|
||||||
|
textsecure__sender_key_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__sender_key_message__free_unpacked
|
||||||
|
(Textsecure__SenderKeyMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__SenderKeyDistributionMessage methods */
|
||||||
|
void textsecure__sender_key_distribution_message__init
|
||||||
|
(Textsecure__SenderKeyDistributionMessage *message);
|
||||||
|
size_t textsecure__sender_key_distribution_message__get_packed_size
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message);
|
||||||
|
size_t textsecure__sender_key_distribution_message__pack
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__sender_key_distribution_message__pack_to_buffer
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__SenderKeyDistributionMessage *
|
||||||
|
textsecure__sender_key_distribution_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__sender_key_distribution_message__free_unpacked
|
||||||
|
(Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* Textsecure__DeviceConsistencyCodeMessage methods */
|
||||||
|
void textsecure__device_consistency_code_message__init
|
||||||
|
(Textsecure__DeviceConsistencyCodeMessage *message);
|
||||||
|
size_t textsecure__device_consistency_code_message__get_packed_size
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message);
|
||||||
|
size_t textsecure__device_consistency_code_message__pack
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
uint8_t *out);
|
||||||
|
size_t textsecure__device_consistency_code_message__pack_to_buffer
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
ProtobufCBuffer *buffer);
|
||||||
|
Textsecure__DeviceConsistencyCodeMessage *
|
||||||
|
textsecure__device_consistency_code_message__unpack
|
||||||
|
(ProtobufCAllocator *allocator,
|
||||||
|
size_t len,
|
||||||
|
const uint8_t *data);
|
||||||
|
void textsecure__device_consistency_code_message__free_unpacked
|
||||||
|
(Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
ProtobufCAllocator *allocator);
|
||||||
|
/* --- per-message closures --- */
|
||||||
|
|
||||||
|
typedef void (*Textsecure__SignalMessage_Closure)
|
||||||
|
(const Textsecure__SignalMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__PreKeySignalMessage_Closure)
|
||||||
|
(const Textsecure__PreKeySignalMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__KeyExchangeMessage_Closure)
|
||||||
|
(const Textsecure__KeyExchangeMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyMessage_Closure)
|
||||||
|
(const Textsecure__SenderKeyMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__SenderKeyDistributionMessage_Closure)
|
||||||
|
(const Textsecure__SenderKeyDistributionMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
typedef void (*Textsecure__DeviceConsistencyCodeMessage_Closure)
|
||||||
|
(const Textsecure__DeviceConsistencyCodeMessage *message,
|
||||||
|
void *closure_data);
|
||||||
|
|
||||||
|
/* --- services --- */
|
||||||
|
|
||||||
|
|
||||||
|
/* --- descriptors --- */
|
||||||
|
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__signal_message__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__pre_key_signal_message__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__key_exchange_message__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_message__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__sender_key_distribution_message__descriptor;
|
||||||
|
extern const ProtobufCMessageDescriptor textsecure__device_consistency_code_message__descriptor;
|
||||||
|
|
||||||
|
PROTOBUF_C__END_DECLS
|
||||||
|
|
||||||
|
|
||||||
|
#endif /* PROTOBUF_C_WhisperTextProtocol_2eproto__INCLUDED */
|
||||||
665
Sources/libsignal/curve.c
Executable file
665
Sources/libsignal/curve.c
Executable file
|
|
@ -0,0 +1,665 @@
|
||||||
|
#include "curve.h"
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include "protobuf-c/protobuf-c.h"
|
||||||
|
|
||||||
|
#include "curve25519/curve25519-donna.h"
|
||||||
|
#include "curve25519/ed25519/additions/curve_sigs.h"
|
||||||
|
#include "curve25519/ed25519/additions/generalized/gen_x.h"
|
||||||
|
#include "curve25519/ed25519/tests/internal_fast_tests.h"
|
||||||
|
#include "signal_protocol_internal.h"
|
||||||
|
#include "signal_utarray.h"
|
||||||
|
|
||||||
|
#define DJB_TYPE 0x05
|
||||||
|
#define DJB_KEY_LEN 32
|
||||||
|
#define VRF_VERIFY_LEN 32
|
||||||
|
|
||||||
|
struct ec_public_key
|
||||||
|
{
|
||||||
|
signal_type_base base;
|
||||||
|
uint8_t data[DJB_KEY_LEN];
|
||||||
|
};
|
||||||
|
|
||||||
|
struct ec_private_key
|
||||||
|
{
|
||||||
|
signal_type_base base;
|
||||||
|
uint8_t data[DJB_KEY_LEN];
|
||||||
|
};
|
||||||
|
|
||||||
|
struct ec_key_pair
|
||||||
|
{
|
||||||
|
signal_type_base base;
|
||||||
|
ec_public_key *public_key;
|
||||||
|
ec_private_key *private_key;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct ec_public_key_list
|
||||||
|
{
|
||||||
|
UT_array *values;
|
||||||
|
};
|
||||||
|
|
||||||
|
int curve_internal_fast_tests(int silent)
|
||||||
|
{
|
||||||
|
if (all_fast_tests(silent) != 0)
|
||||||
|
return SG_ERR_UNKNOWN;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_decode_point(ec_public_key **public_key, const uint8_t *key_data, size_t key_len, signal_context *global_context)
|
||||||
|
{
|
||||||
|
ec_public_key *key = 0;
|
||||||
|
|
||||||
|
if(key_len > 0 && key_data[0] != DJB_TYPE) {
|
||||||
|
signal_log(global_context, SG_LOG_ERROR, "Invalid key type: %d", key_data[0]);
|
||||||
|
return SG_ERR_INVALID_KEY;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(key_len != DJB_KEY_LEN + 1) {
|
||||||
|
signal_log(global_context, SG_LOG_ERROR, "Invalid key length: %d", key_len);
|
||||||
|
return SG_ERR_INVALID_KEY;
|
||||||
|
}
|
||||||
|
|
||||||
|
key = malloc(sizeof(ec_public_key));
|
||||||
|
if(!key) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
SIGNAL_INIT(key, ec_public_key_destroy);
|
||||||
|
|
||||||
|
memcpy(key->data, key_data + 1, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
*public_key = key;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_compare(const ec_public_key *key1, const ec_public_key *key2)
|
||||||
|
{
|
||||||
|
if(key1 == key2) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else if(key1 == 0 && key2 != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
else if(key1 != 0 && key2 == 0) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return signal_constant_memcmp(key1->data, key2->data, DJB_KEY_LEN);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_memcmp(const ec_public_key *key1, const ec_public_key *key2)
|
||||||
|
{
|
||||||
|
if(key1 == key2) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else if(key1 == 0 && key2 != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
else if(key1 != 0 && key2 == 0) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return memcmp(key1->data, key2->data, DJB_KEY_LEN);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_serialize(signal_buffer **buffer, const ec_public_key *key)
|
||||||
|
{
|
||||||
|
signal_buffer *buf = 0;
|
||||||
|
uint8_t *data = 0;
|
||||||
|
|
||||||
|
if(!key) {
|
||||||
|
return SG_ERR_INVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
buf = signal_buffer_alloc(sizeof(uint8_t) * (DJB_KEY_LEN + 1));
|
||||||
|
if(!buf) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
data = signal_buffer_data(buf);
|
||||||
|
data[0] = DJB_TYPE;
|
||||||
|
memcpy(data + 1, key->data, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
*buffer = buf;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_serialize_protobuf(ProtobufCBinaryData *buffer, const ec_public_key *key)
|
||||||
|
{
|
||||||
|
size_t len = 0;
|
||||||
|
uint8_t *data = 0;
|
||||||
|
|
||||||
|
assert(buffer);
|
||||||
|
assert(key);
|
||||||
|
|
||||||
|
len = sizeof(uint8_t) * (DJB_KEY_LEN + 1);
|
||||||
|
data = malloc(len);
|
||||||
|
if(!data) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
data[0] = DJB_TYPE;
|
||||||
|
memcpy(data + 1, key->data, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
buffer->data = data;
|
||||||
|
buffer->len = len;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
void ec_public_key_destroy(signal_type_base *type)
|
||||||
|
{
|
||||||
|
ec_public_key *public_key = (ec_public_key *)type;
|
||||||
|
free(public_key);
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_decode_private_point(ec_private_key **private_key, const uint8_t *key_data, size_t key_len, signal_context *global_context)
|
||||||
|
{
|
||||||
|
ec_private_key *key = 0;
|
||||||
|
|
||||||
|
if(key_len != DJB_KEY_LEN) {
|
||||||
|
signal_log(global_context, SG_LOG_ERROR, "Invalid key length: %d", key_len);
|
||||||
|
return SG_ERR_INVALID_KEY;
|
||||||
|
}
|
||||||
|
|
||||||
|
key = malloc(sizeof(ec_private_key));
|
||||||
|
if(!key) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
SIGNAL_INIT(key, ec_private_key_destroy);
|
||||||
|
|
||||||
|
memcpy(key->data, key_data, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
*private_key = key;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_private_key_compare(const ec_private_key *key1, const ec_private_key *key2)
|
||||||
|
{
|
||||||
|
if(key1 == key2) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else if(key1 == 0 && key2 != 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
else if(key1 != 0 && key2 == 0) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return signal_constant_memcmp(key1->data, key2->data, DJB_KEY_LEN);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_private_key_serialize(signal_buffer **buffer, const ec_private_key *key)
|
||||||
|
{
|
||||||
|
signal_buffer *buf = 0;
|
||||||
|
uint8_t *data = 0 ;
|
||||||
|
|
||||||
|
buf = signal_buffer_alloc(sizeof(uint8_t) * DJB_KEY_LEN);
|
||||||
|
if(!buf) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
data = signal_buffer_data(buf);
|
||||||
|
memcpy(data, key->data, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
*buffer = buf;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_private_key_serialize_protobuf(ProtobufCBinaryData *buffer, const ec_private_key *key)
|
||||||
|
{
|
||||||
|
size_t len = 0;
|
||||||
|
uint8_t *data = 0;
|
||||||
|
|
||||||
|
assert(buffer);
|
||||||
|
assert(key);
|
||||||
|
|
||||||
|
len = sizeof(uint8_t) * DJB_KEY_LEN;
|
||||||
|
data = malloc(len);
|
||||||
|
if(!data) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(data, key->data, DJB_KEY_LEN);
|
||||||
|
|
||||||
|
buffer->data = data;
|
||||||
|
buffer->len = len;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
void ec_private_key_destroy(signal_type_base *type)
|
||||||
|
{
|
||||||
|
ec_private_key *private_key = (ec_private_key *)type;
|
||||||
|
signal_explicit_bzero(private_key, sizeof(ec_private_key));
|
||||||
|
free(private_key);
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_key_pair_create(ec_key_pair **key_pair, ec_public_key *public_key, ec_private_key *private_key)
|
||||||
|
{
|
||||||
|
ec_key_pair *result = malloc(sizeof(ec_key_pair));
|
||||||
|
if(!result) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
SIGNAL_INIT(result, ec_key_pair_destroy);
|
||||||
|
result->public_key = public_key;
|
||||||
|
SIGNAL_REF(public_key);
|
||||||
|
result->private_key = private_key;
|
||||||
|
SIGNAL_REF(private_key);
|
||||||
|
|
||||||
|
*key_pair = result;
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
ec_public_key *ec_key_pair_get_public(const ec_key_pair *key_pair)
|
||||||
|
{
|
||||||
|
return key_pair->public_key;
|
||||||
|
}
|
||||||
|
|
||||||
|
ec_private_key *ec_key_pair_get_private(const ec_key_pair *key_pair)
|
||||||
|
{
|
||||||
|
return key_pair->private_key;
|
||||||
|
}
|
||||||
|
|
||||||
|
void ec_key_pair_destroy(signal_type_base *type)
|
||||||
|
{
|
||||||
|
ec_key_pair *key_pair = (ec_key_pair *)type;
|
||||||
|
SIGNAL_UNREF(key_pair->public_key);
|
||||||
|
SIGNAL_UNREF(key_pair->private_key);
|
||||||
|
free(key_pair);
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_generate_private_key(signal_context *context, ec_private_key **private_key)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
ec_private_key *key = 0;
|
||||||
|
|
||||||
|
assert(context);
|
||||||
|
|
||||||
|
key = malloc(sizeof(ec_private_key));
|
||||||
|
if(!key) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
SIGNAL_INIT(key, ec_private_key_destroy);
|
||||||
|
|
||||||
|
result = signal_crypto_random(context, key->data, DJB_KEY_LEN);
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
key->data[0] &= 248;
|
||||||
|
key->data[31] &= 127;
|
||||||
|
key->data[31] |= 64;
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
if(key) {
|
||||||
|
SIGNAL_UNREF(key);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
*private_key = key;
|
||||||
|
}
|
||||||
|
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_generate_public_key(ec_public_key **public_key, const ec_private_key *private_key)
|
||||||
|
{
|
||||||
|
static const uint8_t basepoint[32] = {9};
|
||||||
|
int result = 0;
|
||||||
|
|
||||||
|
ec_public_key *key = malloc(sizeof(ec_public_key));
|
||||||
|
if(!key) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
SIGNAL_INIT(key, ec_public_key_destroy);
|
||||||
|
|
||||||
|
result = curve25519_donna(key->data, private_key->data, basepoint);
|
||||||
|
|
||||||
|
if(result == 0) {
|
||||||
|
*public_key = key;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
if(key) {
|
||||||
|
SIGNAL_UNREF(key);
|
||||||
|
}
|
||||||
|
return SG_ERR_UNKNOWN;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_generate_key_pair(signal_context *context, ec_key_pair **key_pair)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
ec_key_pair *pair_result = 0;
|
||||||
|
ec_private_key *key_private = 0;
|
||||||
|
ec_public_key *key_public = 0;
|
||||||
|
|
||||||
|
assert(context);
|
||||||
|
|
||||||
|
result = curve_generate_private_key(context, &key_private);
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = curve_generate_public_key(&key_public, key_private);
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = ec_key_pair_create(&pair_result, key_public, key_private);
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(key_public) {
|
||||||
|
SIGNAL_UNREF(key_public);
|
||||||
|
}
|
||||||
|
if(key_private) {
|
||||||
|
SIGNAL_UNREF(key_private);
|
||||||
|
}
|
||||||
|
|
||||||
|
if(result < 0) {
|
||||||
|
if(pair_result) {
|
||||||
|
SIGNAL_UNREF(pair_result);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
*key_pair = pair_result;
|
||||||
|
}
|
||||||
|
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
ec_public_key_list *ec_public_key_list_alloc()
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
ec_public_key_list *list = malloc(sizeof(ec_public_key_list));
|
||||||
|
if(!list) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
memset(list, 0, sizeof(ec_public_key_list));
|
||||||
|
|
||||||
|
utarray_new(list->values, &ut_ptr_icd);
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
if(list) {
|
||||||
|
free(list);
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return list;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
ec_public_key_list *ec_public_key_list_copy(const ec_public_key_list *list)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
ec_public_key_list *result_list = 0;
|
||||||
|
unsigned int size;
|
||||||
|
unsigned int i;
|
||||||
|
ec_public_key **p;
|
||||||
|
|
||||||
|
result_list = ec_public_key_list_alloc();
|
||||||
|
if(!result_list) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
size = utarray_len(list->values);
|
||||||
|
|
||||||
|
utarray_reserve(result_list->values, size);
|
||||||
|
|
||||||
|
for (i = 0; i < size; i++) {
|
||||||
|
p = (ec_public_key **)utarray_eltptr(list->values, i);
|
||||||
|
result = ec_public_key_list_push_back(result_list, *p);
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
if(result_list) {
|
||||||
|
ec_public_key_list_free(result_list);
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return result_list;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_list_push_back(ec_public_key_list *list, ec_public_key *value)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
assert(list);
|
||||||
|
assert(value);
|
||||||
|
|
||||||
|
utarray_push_back(list->values, &value);
|
||||||
|
SIGNAL_REF(value);
|
||||||
|
|
||||||
|
complete:
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int ec_public_key_list_size(const ec_public_key_list *list)
|
||||||
|
{
|
||||||
|
assert(list);
|
||||||
|
return utarray_len(list->values);
|
||||||
|
}
|
||||||
|
|
||||||
|
ec_public_key *ec_public_key_list_at(const ec_public_key_list *list, unsigned int index)
|
||||||
|
{
|
||||||
|
ec_public_key **value = 0;
|
||||||
|
|
||||||
|
assert(list);
|
||||||
|
assert(index < utarray_len(list->values));
|
||||||
|
|
||||||
|
value = (ec_public_key **)utarray_eltptr(list->values, index);
|
||||||
|
|
||||||
|
assert(*value);
|
||||||
|
|
||||||
|
return *value;
|
||||||
|
}
|
||||||
|
|
||||||
|
int ec_public_key_list_sort_comparator(const void *a, const void *b)
|
||||||
|
{
|
||||||
|
const ec_public_key *key1 = *((const ec_public_key **)a);
|
||||||
|
const ec_public_key *key2 = *((const ec_public_key **)b);
|
||||||
|
return ec_public_key_memcmp(key1, key2);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ec_public_key_list_sort(ec_public_key_list *list)
|
||||||
|
{
|
||||||
|
assert(list);
|
||||||
|
utarray_sort(list->values, ec_public_key_list_sort_comparator);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ec_public_key_list_free(ec_public_key_list *list)
|
||||||
|
{
|
||||||
|
unsigned int size;
|
||||||
|
unsigned int i;
|
||||||
|
ec_public_key **p;
|
||||||
|
if(list) {
|
||||||
|
size = utarray_len(list->values);
|
||||||
|
for (i = 0; i < size; i++) {
|
||||||
|
p = (ec_public_key **)utarray_eltptr(list->values, i);
|
||||||
|
SIGNAL_UNREF(*p);
|
||||||
|
}
|
||||||
|
utarray_free(list->values);
|
||||||
|
free(list);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_calculate_agreement(uint8_t **shared_key_data, const ec_public_key *public_key, const ec_private_key *private_key)
|
||||||
|
{
|
||||||
|
uint8_t *key = 0;
|
||||||
|
int result = 0;
|
||||||
|
|
||||||
|
if(!public_key || !private_key) {
|
||||||
|
return SG_ERR_INVALID_KEY;
|
||||||
|
}
|
||||||
|
|
||||||
|
key = malloc(DJB_KEY_LEN);
|
||||||
|
if(!key) {
|
||||||
|
return SG_ERR_NOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = curve25519_donna(key, private_key->data, public_key->data);
|
||||||
|
|
||||||
|
if(result == 0) {
|
||||||
|
*shared_key_data = key;
|
||||||
|
return DJB_KEY_LEN;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
if(key) {
|
||||||
|
free(key);
|
||||||
|
}
|
||||||
|
return SG_ERR_UNKNOWN;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_verify_signature(const ec_public_key *signing_key,
|
||||||
|
const uint8_t *message_data, size_t message_len,
|
||||||
|
const uint8_t *signature_data, size_t signature_len)
|
||||||
|
{
|
||||||
|
if(signature_len != CURVE_SIGNATURE_LEN) {
|
||||||
|
return SG_ERR_INVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
return curve25519_verify(signature_data, signing_key->data, message_data, message_len) == 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_calculate_signature(signal_context *context,
|
||||||
|
signal_buffer **signature,
|
||||||
|
const ec_private_key *signing_key,
|
||||||
|
const uint8_t *message_data, size_t message_len)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
uint8_t random_data[CURVE_SIGNATURE_LEN];
|
||||||
|
signal_buffer *buffer = 0;
|
||||||
|
|
||||||
|
result = signal_crypto_random(context, random_data, sizeof(random_data));
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
buffer = signal_buffer_alloc(CURVE_SIGNATURE_LEN);
|
||||||
|
if(!buffer) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = curve25519_sign(signal_buffer_data(buffer), signing_key->data, message_data, message_len, random_data);
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
if(buffer) {
|
||||||
|
signal_buffer_free(buffer);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
*signature = buffer;
|
||||||
|
}
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_verify_vrf_signature(signal_context *context,
|
||||||
|
signal_buffer **vrf_output,
|
||||||
|
const ec_public_key *signing_key,
|
||||||
|
const uint8_t *message_data, size_t message_len,
|
||||||
|
const uint8_t *signature_data, size_t signature_len)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
signal_buffer *buffer = 0;
|
||||||
|
|
||||||
|
if(!signing_key) {
|
||||||
|
return SG_ERR_INVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(!message_data || !signature_data || signature_len != VRF_SIGNATURE_LEN) {
|
||||||
|
signal_log(context, SG_LOG_ERROR, "Invalid message or signature format");
|
||||||
|
return SG_ERR_VRF_SIG_VERIF_FAILED;
|
||||||
|
}
|
||||||
|
|
||||||
|
buffer = signal_buffer_alloc(VRF_VERIFY_LEN);
|
||||||
|
if(!buffer) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = generalized_xveddsa_25519_verify(signal_buffer_data(buffer),
|
||||||
|
signature_data, signing_key->data,
|
||||||
|
message_data, message_len, NULL, 0);
|
||||||
|
if(result != 0) {
|
||||||
|
signal_log(context, SG_LOG_ERROR, "Invalid signature");
|
||||||
|
result = SG_ERR_VRF_SIG_VERIF_FAILED;
|
||||||
|
}
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
signal_buffer_free(buffer);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
*vrf_output = buffer;
|
||||||
|
}
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve_calculate_vrf_signature(signal_context *context,
|
||||||
|
signal_buffer **signature,
|
||||||
|
const ec_private_key *signing_key,
|
||||||
|
const uint8_t *message_data, size_t message_len)
|
||||||
|
{
|
||||||
|
int result = 0;
|
||||||
|
uint8_t random_data[64];
|
||||||
|
signal_buffer *buffer = 0;
|
||||||
|
|
||||||
|
result = signal_crypto_random(context, random_data, sizeof(random_data));
|
||||||
|
if(result < 0) {
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
buffer = signal_buffer_alloc(VRF_SIGNATURE_LEN);
|
||||||
|
if(!buffer) {
|
||||||
|
result = SG_ERR_NOMEM;
|
||||||
|
goto complete;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = generalized_xveddsa_25519_sign(signal_buffer_data(buffer),
|
||||||
|
signing_key->data,
|
||||||
|
message_data, message_len, random_data, NULL, 0);
|
||||||
|
if(result != 0) {
|
||||||
|
signal_log(context, SG_LOG_ERROR, "Signature failed!");
|
||||||
|
result = SG_ERR_UNKNOWN;
|
||||||
|
}
|
||||||
|
|
||||||
|
complete:
|
||||||
|
if(result < 0) {
|
||||||
|
signal_buffer_free(buffer);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
*signature = buffer;
|
||||||
|
}
|
||||||
|
return result;
|
||||||
|
}
|
||||||
870
Sources/libsignal/curve25519/curve25519-donna.c
Executable file
870
Sources/libsignal/curve25519/curve25519-donna.c
Executable file
|
|
@ -0,0 +1,870 @@
|
||||||
|
/* Copyright 2008, Google Inc.
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* Redistribution and use in source and binary forms, with or without
|
||||||
|
* modification, are permitted provided that the following conditions are
|
||||||
|
* met:
|
||||||
|
*
|
||||||
|
* * Redistributions of source code must retain the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer.
|
||||||
|
* * Redistributions in binary form must reproduce the above
|
||||||
|
* copyright notice, this list of conditions and the following disclaimer
|
||||||
|
* in the documentation and/or other materials provided with the
|
||||||
|
* distribution.
|
||||||
|
* * Neither the name of Google Inc. nor the names of its
|
||||||
|
* contributors may be used to endorse or promote products derived from
|
||||||
|
* this software without specific prior written permission.
|
||||||
|
*
|
||||||
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||||
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||||
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||||
|
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||||
|
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||||
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||||
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||||
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
*
|
||||||
|
* curve25519-donna: Curve25519 elliptic curve, public key function
|
||||||
|
*
|
||||||
|
* http://code.google.com/p/curve25519-donna/
|
||||||
|
*
|
||||||
|
* Adam Langley <agl@imperialviolet.org>
|
||||||
|
*
|
||||||
|
* Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
|
||||||
|
*
|
||||||
|
* More information about curve25519 can be found here
|
||||||
|
* http://cr.yp.to/ecdh.html
|
||||||
|
*
|
||||||
|
* djb's sample implementation of curve25519 is written in a special assembly
|
||||||
|
* language called qhasm and uses the floating point registers.
|
||||||
|
*
|
||||||
|
* This is, almost, a clean room reimplementation from the curve25519 paper. It
|
||||||
|
* uses many of the tricks described therein. Only the crecip function is taken
|
||||||
|
* from the sample implementation. */
|
||||||
|
|
||||||
|
#include <string.h>
|
||||||
|
#include <stdint.h>
|
||||||
|
|
||||||
|
#ifdef _MSC_VER
|
||||||
|
#define inline __inline
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef uint8_t u8;
|
||||||
|
typedef int32_t s32;
|
||||||
|
typedef int64_t limb;
|
||||||
|
|
||||||
|
/* Field element representation:
|
||||||
|
*
|
||||||
|
* Field elements are written as an array of signed, 64-bit limbs, least
|
||||||
|
* significant first. The value of the field element is:
|
||||||
|
* x[0] + 2^26·x[1] + x^51·x[2] + 2^102·x[3] + ...
|
||||||
|
*
|
||||||
|
* i.e. the limbs are 26, 25, 26, 25, ... bits wide. */
|
||||||
|
|
||||||
|
/* Sum two numbers: output += in */
|
||||||
|
static void fsum(limb *output, const limb *in) {
|
||||||
|
unsigned i;
|
||||||
|
for (i = 0; i < 10; i += 2) {
|
||||||
|
output[0+i] = output[0+i] + in[0+i];
|
||||||
|
output[1+i] = output[1+i] + in[1+i];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Find the difference of two numbers: output = in - output
|
||||||
|
* (note the order of the arguments!). */
|
||||||
|
static void fdifference(limb *output, const limb *in) {
|
||||||
|
unsigned i;
|
||||||
|
for (i = 0; i < 10; ++i) {
|
||||||
|
output[i] = in[i] - output[i];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Multiply a number by a scalar: output = in * scalar */
|
||||||
|
static void fscalar_product(limb *output, const limb *in, const limb scalar) {
|
||||||
|
unsigned i;
|
||||||
|
for (i = 0; i < 10; ++i) {
|
||||||
|
output[i] = in[i] * scalar;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Multiply two numbers: output = in2 * in
|
||||||
|
*
|
||||||
|
* output must be distinct to both inputs. The inputs are reduced coefficient
|
||||||
|
* form, the output is not.
|
||||||
|
*
|
||||||
|
* output[x] <= 14 * the largest product of the input limbs. */
|
||||||
|
static void fproduct(limb *output, const limb *in2, const limb *in) {
|
||||||
|
output[0] = ((limb) ((s32) in2[0])) * ((s32) in[0]);
|
||||||
|
output[1] = ((limb) ((s32) in2[0])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[0]);
|
||||||
|
output[2] = 2 * ((limb) ((s32) in2[1])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[0]);
|
||||||
|
output[3] = ((limb) ((s32) in2[1])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[0]);
|
||||||
|
output[4] = ((limb) ((s32) in2[2])) * ((s32) in[2]) +
|
||||||
|
2 * (((limb) ((s32) in2[1])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[1])) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[0]);
|
||||||
|
output[5] = ((limb) ((s32) in2[2])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[0]);
|
||||||
|
output[6] = 2 * (((limb) ((s32) in2[3])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[1])) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[0]);
|
||||||
|
output[7] = ((limb) ((s32) in2[3])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[0]);
|
||||||
|
output[8] = ((limb) ((s32) in2[4])) * ((s32) in[4]) +
|
||||||
|
2 * (((limb) ((s32) in2[3])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[1])) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[0]);
|
||||||
|
output[9] = ((limb) ((s32) in2[4])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in2[0])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[0]);
|
||||||
|
output[10] = 2 * (((limb) ((s32) in2[5])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[1])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[1])) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[2]);
|
||||||
|
output[11] = ((limb) ((s32) in2[5])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in2[2])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[2]);
|
||||||
|
output[12] = ((limb) ((s32) in2[6])) * ((s32) in[6]) +
|
||||||
|
2 * (((limb) ((s32) in2[5])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[3])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[3])) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[4]);
|
||||||
|
output[13] = ((limb) ((s32) in2[6])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[7])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in2[4])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[4]);
|
||||||
|
output[14] = 2 * (((limb) ((s32) in2[7])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[5])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[5])) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[6]);
|
||||||
|
output[15] = ((limb) ((s32) in2[7])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in2[8])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in2[6])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[6]);
|
||||||
|
output[16] = ((limb) ((s32) in2[8])) * ((s32) in[8]) +
|
||||||
|
2 * (((limb) ((s32) in2[7])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[7]));
|
||||||
|
output[17] = ((limb) ((s32) in2[8])) * ((s32) in[9]) +
|
||||||
|
((limb) ((s32) in2[9])) * ((s32) in[8]);
|
||||||
|
output[18] = 2 * ((limb) ((s32) in2[9])) * ((s32) in[9]);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Reduce a long form to a short form by taking the input mod 2^255 - 19.
|
||||||
|
*
|
||||||
|
* On entry: |output[i]| < 14*2^54
|
||||||
|
* On exit: |output[0..8]| < 280*2^54 */
|
||||||
|
static void freduce_degree(limb *output) {
|
||||||
|
/* Each of these shifts and adds ends up multiplying the value by 19.
|
||||||
|
*
|
||||||
|
* For output[0..8], the absolute entry value is < 14*2^54 and we add, at
|
||||||
|
* most, 19*14*2^54 thus, on exit, |output[0..8]| < 280*2^54. */
|
||||||
|
output[8] += output[18] << 4;
|
||||||
|
output[8] += output[18] << 1;
|
||||||
|
output[8] += output[18];
|
||||||
|
output[7] += output[17] << 4;
|
||||||
|
output[7] += output[17] << 1;
|
||||||
|
output[7] += output[17];
|
||||||
|
output[6] += output[16] << 4;
|
||||||
|
output[6] += output[16] << 1;
|
||||||
|
output[6] += output[16];
|
||||||
|
output[5] += output[15] << 4;
|
||||||
|
output[5] += output[15] << 1;
|
||||||
|
output[5] += output[15];
|
||||||
|
output[4] += output[14] << 4;
|
||||||
|
output[4] += output[14] << 1;
|
||||||
|
output[4] += output[14];
|
||||||
|
output[3] += output[13] << 4;
|
||||||
|
output[3] += output[13] << 1;
|
||||||
|
output[3] += output[13];
|
||||||
|
output[2] += output[12] << 4;
|
||||||
|
output[2] += output[12] << 1;
|
||||||
|
output[2] += output[12];
|
||||||
|
output[1] += output[11] << 4;
|
||||||
|
output[1] += output[11] << 1;
|
||||||
|
output[1] += output[11];
|
||||||
|
output[0] += output[10] << 4;
|
||||||
|
output[0] += output[10] << 1;
|
||||||
|
output[0] += output[10];
|
||||||
|
}
|
||||||
|
|
||||||
|
#if (-1 & 3) != 3
|
||||||
|
#error "This code only works on a two's complement system"
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/* return v / 2^26, using only shifts and adds.
|
||||||
|
*
|
||||||
|
* On entry: v can take any value. */
|
||||||
|
static inline limb
|
||||||
|
div_by_2_26(const limb v)
|
||||||
|
{
|
||||||
|
/* High word of v; no shift needed. */
|
||||||
|
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||||
|
/* Set to all 1s if v was negative; else set to 0s. */
|
||||||
|
const int32_t sign = ((int32_t) highword) >> 31;
|
||||||
|
/* Set to 0x3ffffff if v was negative; else set to 0. */
|
||||||
|
const int32_t roundoff = ((uint32_t) sign) >> 6;
|
||||||
|
/* Should return v / (1<<26) */
|
||||||
|
return (v + roundoff) >> 26;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* return v / (2^25), using only shifts and adds.
|
||||||
|
*
|
||||||
|
* On entry: v can take any value. */
|
||||||
|
static inline limb
|
||||||
|
div_by_2_25(const limb v)
|
||||||
|
{
|
||||||
|
/* High word of v; no shift needed*/
|
||||||
|
const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
|
||||||
|
/* Set to all 1s if v was negative; else set to 0s. */
|
||||||
|
const int32_t sign = ((int32_t) highword) >> 31;
|
||||||
|
/* Set to 0x1ffffff if v was negative; else set to 0. */
|
||||||
|
const int32_t roundoff = ((uint32_t) sign) >> 7;
|
||||||
|
/* Should return v / (1<<25) */
|
||||||
|
return (v + roundoff) >> 25;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* return v / (2^25), using only shifts and adds.
|
||||||
|
*
|
||||||
|
* On entry: v can take any value. */
|
||||||
|
static inline s32
|
||||||
|
div_s32_by_2_25(const s32 v)
|
||||||
|
{
|
||||||
|
const s32 roundoff = ((uint32_t)(v >> 31)) >> 7;
|
||||||
|
return (v + roundoff) >> 25;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Reduce all coefficients of the short form input so that |x| < 2^26.
|
||||||
|
*
|
||||||
|
* On entry: |output[i]| < 280*2^54 */
|
||||||
|
static void freduce_coefficients(limb *output) {
|
||||||
|
unsigned i;
|
||||||
|
|
||||||
|
output[10] = 0;
|
||||||
|
|
||||||
|
for (i = 0; i < 10; i += 2) {
|
||||||
|
limb over = div_by_2_26(output[i]);
|
||||||
|
/* The entry condition (that |output[i]| < 280*2^54) means that over is, at
|
||||||
|
* most, 280*2^28 in the first iteration of this loop. This is added to the
|
||||||
|
* next limb and we can approximate the resulting bound of that limb by
|
||||||
|
* 281*2^54. */
|
||||||
|
output[i] -= over << 26;
|
||||||
|
output[i+1] += over;
|
||||||
|
|
||||||
|
/* For the first iteration, |output[i+1]| < 281*2^54, thus |over| <
|
||||||
|
* 281*2^29. When this is added to the next limb, the resulting bound can
|
||||||
|
* be approximated as 281*2^54.
|
||||||
|
*
|
||||||
|
* For subsequent iterations of the loop, 281*2^54 remains a conservative
|
||||||
|
* bound and no overflow occurs. */
|
||||||
|
over = div_by_2_25(output[i+1]);
|
||||||
|
output[i+1] -= over << 25;
|
||||||
|
output[i+2] += over;
|
||||||
|
}
|
||||||
|
/* Now |output[10]| < 281*2^29 and all other coefficients are reduced. */
|
||||||
|
output[0] += output[10] << 4;
|
||||||
|
output[0] += output[10] << 1;
|
||||||
|
output[0] += output[10];
|
||||||
|
|
||||||
|
output[10] = 0;
|
||||||
|
|
||||||
|
/* Now output[1..9] are reduced, and |output[0]| < 2^26 + 19*281*2^29
|
||||||
|
* So |over| will be no more than 2^16. */
|
||||||
|
{
|
||||||
|
limb over = div_by_2_26(output[0]);
|
||||||
|
output[0] -= over << 26;
|
||||||
|
output[1] += over;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Now output[0,2..9] are reduced, and |output[1]| < 2^25 + 2^16 < 2^26. The
|
||||||
|
* bound on |output[1]| is sufficient to meet our needs. */
|
||||||
|
}
|
||||||
|
|
||||||
|
/* A helpful wrapper around fproduct: output = in * in2.
|
||||||
|
*
|
||||||
|
* On entry: |in[i]| < 2^27 and |in2[i]| < 2^27.
|
||||||
|
*
|
||||||
|
* output must be distinct to both inputs. The output is reduced degree
|
||||||
|
* (indeed, one need only provide storage for 10 limbs) and |output[i]| < 2^26. */
|
||||||
|
static void
|
||||||
|
fmul(limb *output, const limb *in, const limb *in2) {
|
||||||
|
limb t[19];
|
||||||
|
fproduct(t, in, in2);
|
||||||
|
/* |t[i]| < 14*2^54 */
|
||||||
|
freduce_degree(t);
|
||||||
|
freduce_coefficients(t);
|
||||||
|
/* |t[i]| < 2^26 */
|
||||||
|
memcpy(output, t, sizeof(limb) * 10);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Square a number: output = in**2
|
||||||
|
*
|
||||||
|
* output must be distinct from the input. The inputs are reduced coefficient
|
||||||
|
* form, the output is not.
|
||||||
|
*
|
||||||
|
* output[x] <= 14 * the largest product of the input limbs. */
|
||||||
|
static void fsquare_inner(limb *output, const limb *in) {
|
||||||
|
output[0] = ((limb) ((s32) in[0])) * ((s32) in[0]);
|
||||||
|
output[1] = 2 * ((limb) ((s32) in[0])) * ((s32) in[1]);
|
||||||
|
output[2] = 2 * (((limb) ((s32) in[1])) * ((s32) in[1]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[2]));
|
||||||
|
output[3] = 2 * (((limb) ((s32) in[1])) * ((s32) in[2]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[3]));
|
||||||
|
output[4] = ((limb) ((s32) in[2])) * ((s32) in[2]) +
|
||||||
|
4 * ((limb) ((s32) in[1])) * ((s32) in[3]) +
|
||||||
|
2 * ((limb) ((s32) in[0])) * ((s32) in[4]);
|
||||||
|
output[5] = 2 * (((limb) ((s32) in[2])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in[1])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[5]));
|
||||||
|
output[6] = 2 * (((limb) ((s32) in[3])) * ((s32) in[3]) +
|
||||||
|
((limb) ((s32) in[2])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[6]) +
|
||||||
|
2 * ((limb) ((s32) in[1])) * ((s32) in[5]));
|
||||||
|
output[7] = 2 * (((limb) ((s32) in[3])) * ((s32) in[4]) +
|
||||||
|
((limb) ((s32) in[2])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in[1])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[7]));
|
||||||
|
output[8] = ((limb) ((s32) in[4])) * ((s32) in[4]) +
|
||||||
|
2 * (((limb) ((s32) in[2])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[8]) +
|
||||||
|
2 * (((limb) ((s32) in[1])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[3])) * ((s32) in[5])));
|
||||||
|
output[9] = 2 * (((limb) ((s32) in[4])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in[3])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in[2])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[1])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in[0])) * ((s32) in[9]));
|
||||||
|
output[10] = 2 * (((limb) ((s32) in[5])) * ((s32) in[5]) +
|
||||||
|
((limb) ((s32) in[4])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in[2])) * ((s32) in[8]) +
|
||||||
|
2 * (((limb) ((s32) in[3])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[1])) * ((s32) in[9])));
|
||||||
|
output[11] = 2 * (((limb) ((s32) in[5])) * ((s32) in[6]) +
|
||||||
|
((limb) ((s32) in[4])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[3])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in[2])) * ((s32) in[9]));
|
||||||
|
output[12] = ((limb) ((s32) in[6])) * ((s32) in[6]) +
|
||||||
|
2 * (((limb) ((s32) in[4])) * ((s32) in[8]) +
|
||||||
|
2 * (((limb) ((s32) in[5])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[3])) * ((s32) in[9])));
|
||||||
|
output[13] = 2 * (((limb) ((s32) in[6])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[5])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in[4])) * ((s32) in[9]));
|
||||||
|
output[14] = 2 * (((limb) ((s32) in[7])) * ((s32) in[7]) +
|
||||||
|
((limb) ((s32) in[6])) * ((s32) in[8]) +
|
||||||
|
2 * ((limb) ((s32) in[5])) * ((s32) in[9]));
|
||||||
|
output[15] = 2 * (((limb) ((s32) in[7])) * ((s32) in[8]) +
|
||||||
|
((limb) ((s32) in[6])) * ((s32) in[9]));
|
||||||
|
output[16] = ((limb) ((s32) in[8])) * ((s32) in[8]) +
|
||||||
|
4 * ((limb) ((s32) in[7])) * ((s32) in[9]);
|
||||||
|
output[17] = 2 * ((limb) ((s32) in[8])) * ((s32) in[9]);
|
||||||
|
output[18] = 2 * ((limb) ((s32) in[9])) * ((s32) in[9]);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fsquare sets output = in^2.
|
||||||
|
*
|
||||||
|
* On entry: The |in| argument is in reduced coefficients form and |in[i]| <
|
||||||
|
* 2^27.
|
||||||
|
*
|
||||||
|
* On exit: The |output| argument is in reduced coefficients form (indeed, one
|
||||||
|
* need only provide storage for 10 limbs) and |out[i]| < 2^26. */
|
||||||
|
static void
|
||||||
|
fsquare(limb *output, const limb *in) {
|
||||||
|
limb t[19];
|
||||||
|
fsquare_inner(t, in);
|
||||||
|
/* |t[i]| < 14*2^54 because the largest product of two limbs will be <
|
||||||
|
* 2^(27+27) and fsquare_inner adds together, at most, 14 of those
|
||||||
|
* products. */
|
||||||
|
freduce_degree(t);
|
||||||
|
freduce_coefficients(t);
|
||||||
|
/* |t[i]| < 2^26 */
|
||||||
|
memcpy(output, t, sizeof(limb) * 10);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Take a little-endian, 32-byte number and expand it into polynomial form */
|
||||||
|
static void
|
||||||
|
fexpand(limb *output, const u8 *input) {
|
||||||
|
#define F(n,start,shift,mask) \
|
||||||
|
output[n] = ((((limb) input[start + 0]) | \
|
||||||
|
((limb) input[start + 1]) << 8 | \
|
||||||
|
((limb) input[start + 2]) << 16 | \
|
||||||
|
((limb) input[start + 3]) << 24) >> shift) & mask;
|
||||||
|
F(0, 0, 0, 0x3ffffff);
|
||||||
|
F(1, 3, 2, 0x1ffffff);
|
||||||
|
F(2, 6, 3, 0x3ffffff);
|
||||||
|
F(3, 9, 5, 0x1ffffff);
|
||||||
|
F(4, 12, 6, 0x3ffffff);
|
||||||
|
F(5, 16, 0, 0x1ffffff);
|
||||||
|
F(6, 19, 1, 0x3ffffff);
|
||||||
|
F(7, 22, 3, 0x1ffffff);
|
||||||
|
F(8, 25, 4, 0x3ffffff);
|
||||||
|
F(9, 28, 6, 0x1ffffff);
|
||||||
|
#undef F
|
||||||
|
}
|
||||||
|
|
||||||
|
#if (-32 >> 1) != -16
|
||||||
|
#error "This code only works when >> does sign-extension on negative numbers"
|
||||||
|
#endif
|
||||||
|
|
||||||
|
/* s32_eq returns 0xffffffff iff a == b and zero otherwise. */
|
||||||
|
static s32 s32_eq(s32 a, s32 b) {
|
||||||
|
a = ~(a ^ b);
|
||||||
|
a &= a << 16;
|
||||||
|
a &= a << 8;
|
||||||
|
a &= a << 4;
|
||||||
|
a &= a << 2;
|
||||||
|
a &= a << 1;
|
||||||
|
return a >> 31;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* s32_gte returns 0xffffffff if a >= b and zero otherwise, where a and b are
|
||||||
|
* both non-negative. */
|
||||||
|
static s32 s32_gte(s32 a, s32 b) {
|
||||||
|
a -= b;
|
||||||
|
/* a >= 0 iff a >= b. */
|
||||||
|
return ~(a >> 31);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Take a fully reduced polynomial form number and contract it into a
|
||||||
|
* little-endian, 32-byte array.
|
||||||
|
*
|
||||||
|
* On entry: |input_limbs[i]| < 2^26 */
|
||||||
|
static void
|
||||||
|
fcontract(u8 *output, limb *input_limbs) {
|
||||||
|
int i;
|
||||||
|
int j;
|
||||||
|
s32 input[10];
|
||||||
|
s32 mask;
|
||||||
|
|
||||||
|
/* |input_limbs[i]| < 2^26, so it's valid to convert to an s32. */
|
||||||
|
for (i = 0; i < 10; i++) {
|
||||||
|
input[i] = input_limbs[i];
|
||||||
|
}
|
||||||
|
|
||||||
|
for (j = 0; j < 2; ++j) {
|
||||||
|
for (i = 0; i < 9; ++i) {
|
||||||
|
if ((i & 1) == 1) {
|
||||||
|
/* This calculation is a time-invariant way to make input[i]
|
||||||
|
* non-negative by borrowing from the next-larger limb. */
|
||||||
|
const s32 mask = input[i] >> 31;
|
||||||
|
const s32 carry = -((input[i] & mask) >> 25);
|
||||||
|
input[i] = input[i] + (carry << 25);
|
||||||
|
input[i+1] = input[i+1] - carry;
|
||||||
|
} else {
|
||||||
|
const s32 mask = input[i] >> 31;
|
||||||
|
const s32 carry = -((input[i] & mask) >> 26);
|
||||||
|
input[i] = input[i] + (carry << 26);
|
||||||
|
input[i+1] = input[i+1] - carry;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* There's no greater limb for input[9] to borrow from, but we can multiply
|
||||||
|
* by 19 and borrow from input[0], which is valid mod 2^255-19. */
|
||||||
|
{
|
||||||
|
const s32 mask = input[9] >> 31;
|
||||||
|
const s32 carry = -((input[9] & mask) >> 25);
|
||||||
|
input[9] = input[9] + (carry << 25);
|
||||||
|
input[0] = input[0] - (carry * 19);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* After the first iteration, input[1..9] are non-negative and fit within
|
||||||
|
* 25 or 26 bits, depending on position. However, input[0] may be
|
||||||
|
* negative. */
|
||||||
|
}
|
||||||
|
|
||||||
|
/* The first borrow-propagation pass above ended with every limb
|
||||||
|
except (possibly) input[0] non-negative.
|
||||||
|
|
||||||
|
If input[0] was negative after the first pass, then it was because of a
|
||||||
|
carry from input[9]. On entry, input[9] < 2^26 so the carry was, at most,
|
||||||
|
one, since (2**26-1) >> 25 = 1. Thus input[0] >= -19.
|
||||||
|
|
||||||
|
In the second pass, each limb is decreased by at most one. Thus the second
|
||||||
|
borrow-propagation pass could only have wrapped around to decrease
|
||||||
|
input[0] again if the first pass left input[0] negative *and* input[1]
|
||||||
|
through input[9] were all zero. In that case, input[1] is now 2^25 - 1,
|
||||||
|
and this last borrow-propagation step will leave input[1] non-negative. */
|
||||||
|
{
|
||||||
|
const s32 mask = input[0] >> 31;
|
||||||
|
const s32 carry = -((input[0] & mask) >> 26);
|
||||||
|
input[0] = input[0] + (carry << 26);
|
||||||
|
input[1] = input[1] - carry;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* All input[i] are now non-negative. However, there might be values between
|
||||||
|
* 2^25 and 2^26 in a limb which is, nominally, 25 bits wide. */
|
||||||
|
for (j = 0; j < 2; j++) {
|
||||||
|
for (i = 0; i < 9; i++) {
|
||||||
|
if ((i & 1) == 1) {
|
||||||
|
const s32 carry = input[i] >> 25;
|
||||||
|
input[i] &= 0x1ffffff;
|
||||||
|
input[i+1] += carry;
|
||||||
|
} else {
|
||||||
|
const s32 carry = input[i] >> 26;
|
||||||
|
input[i] &= 0x3ffffff;
|
||||||
|
input[i+1] += carry;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const s32 carry = input[9] >> 25;
|
||||||
|
input[9] &= 0x1ffffff;
|
||||||
|
input[0] += 19*carry;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* If the first carry-chain pass, just above, ended up with a carry from
|
||||||
|
* input[9], and that caused input[0] to be out-of-bounds, then input[0] was
|
||||||
|
* < 2^26 + 2*19, because the carry was, at most, two.
|
||||||
|
*
|
||||||
|
* If the second pass carried from input[9] again then input[0] is < 2*19 and
|
||||||
|
* the input[9] -> input[0] carry didn't push input[0] out of bounds. */
|
||||||
|
|
||||||
|
/* It still remains the case that input might be between 2^255-19 and 2^255.
|
||||||
|
* In this case, input[1..9] must take their maximum value and input[0] must
|
||||||
|
* be >= (2^255-19) & 0x3ffffff, which is 0x3ffffed. */
|
||||||
|
mask = s32_gte(input[0], 0x3ffffed);
|
||||||
|
for (i = 1; i < 10; i++) {
|
||||||
|
if ((i & 1) == 1) {
|
||||||
|
mask &= s32_eq(input[i], 0x1ffffff);
|
||||||
|
} else {
|
||||||
|
mask &= s32_eq(input[i], 0x3ffffff);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* mask is either 0xffffffff (if input >= 2^255-19) and zero otherwise. Thus
|
||||||
|
* this conditionally subtracts 2^255-19. */
|
||||||
|
input[0] -= mask & 0x3ffffed;
|
||||||
|
|
||||||
|
for (i = 1; i < 10; i++) {
|
||||||
|
if ((i & 1) == 1) {
|
||||||
|
input[i] -= mask & 0x1ffffff;
|
||||||
|
} else {
|
||||||
|
input[i] -= mask & 0x3ffffff;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
input[1] <<= 2;
|
||||||
|
input[2] <<= 3;
|
||||||
|
input[3] <<= 5;
|
||||||
|
input[4] <<= 6;
|
||||||
|
input[6] <<= 1;
|
||||||
|
input[7] <<= 3;
|
||||||
|
input[8] <<= 4;
|
||||||
|
input[9] <<= 6;
|
||||||
|
#define F(i, s) \
|
||||||
|
output[s+0] |= input[i] & 0xff; \
|
||||||
|
output[s+1] = (input[i] >> 8) & 0xff; \
|
||||||
|
output[s+2] = (input[i] >> 16) & 0xff; \
|
||||||
|
output[s+3] = (input[i] >> 24) & 0xff;
|
||||||
|
output[0] = 0;
|
||||||
|
output[16] = 0;
|
||||||
|
F(0,0);
|
||||||
|
F(1,3);
|
||||||
|
F(2,6);
|
||||||
|
F(3,9);
|
||||||
|
F(4,12);
|
||||||
|
F(5,16);
|
||||||
|
F(6,19);
|
||||||
|
F(7,22);
|
||||||
|
F(8,25);
|
||||||
|
F(9,28);
|
||||||
|
#undef F
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Input: Q, Q', Q-Q'
|
||||||
|
* Output: 2Q, Q+Q'
|
||||||
|
*
|
||||||
|
* x2 z3: long form
|
||||||
|
* x3 z3: long form
|
||||||
|
* x z: short form, destroyed
|
||||||
|
* xprime zprime: short form, destroyed
|
||||||
|
* qmqp: short form, preserved
|
||||||
|
*
|
||||||
|
* On entry and exit, the absolute value of the limbs of all inputs and outputs
|
||||||
|
* are < 2^26. */
|
||||||
|
static void fmonty(limb *x2, limb *z2, /* output 2Q */
|
||||||
|
limb *x3, limb *z3, /* output Q + Q' */
|
||||||
|
limb *x, limb *z, /* input Q */
|
||||||
|
limb *xprime, limb *zprime, /* input Q' */
|
||||||
|
const limb *qmqp /* input Q - Q' */) {
|
||||||
|
limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],
|
||||||
|
zzprime[19], zzzprime[19], xxxprime[19];
|
||||||
|
|
||||||
|
memcpy(origx, x, 10 * sizeof(limb));
|
||||||
|
fsum(x, z);
|
||||||
|
/* |x[i]| < 2^27 */
|
||||||
|
fdifference(z, origx); /* does x - z */
|
||||||
|
/* |z[i]| < 2^27 */
|
||||||
|
|
||||||
|
memcpy(origxprime, xprime, sizeof(limb) * 10);
|
||||||
|
fsum(xprime, zprime);
|
||||||
|
/* |xprime[i]| < 2^27 */
|
||||||
|
fdifference(zprime, origxprime);
|
||||||
|
/* |zprime[i]| < 2^27 */
|
||||||
|
fproduct(xxprime, xprime, z);
|
||||||
|
/* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <
|
||||||
|
* 2^(27+27) and fproduct adds together, at most, 14 of those products.
|
||||||
|
* (Approximating that to 2^58 doesn't work out.) */
|
||||||
|
fproduct(zzprime, x, zprime);
|
||||||
|
/* |zzprime[i]| < 14*2^54 */
|
||||||
|
freduce_degree(xxprime);
|
||||||
|
freduce_coefficients(xxprime);
|
||||||
|
/* |xxprime[i]| < 2^26 */
|
||||||
|
freduce_degree(zzprime);
|
||||||
|
freduce_coefficients(zzprime);
|
||||||
|
/* |zzprime[i]| < 2^26 */
|
||||||
|
memcpy(origxprime, xxprime, sizeof(limb) * 10);
|
||||||
|
fsum(xxprime, zzprime);
|
||||||
|
/* |xxprime[i]| < 2^27 */
|
||||||
|
fdifference(zzprime, origxprime);
|
||||||
|
/* |zzprime[i]| < 2^27 */
|
||||||
|
fsquare(xxxprime, xxprime);
|
||||||
|
/* |xxxprime[i]| < 2^26 */
|
||||||
|
fsquare(zzzprime, zzprime);
|
||||||
|
/* |zzzprime[i]| < 2^26 */
|
||||||
|
fproduct(zzprime, zzzprime, qmqp);
|
||||||
|
/* |zzprime[i]| < 14*2^52 */
|
||||||
|
freduce_degree(zzprime);
|
||||||
|
freduce_coefficients(zzprime);
|
||||||
|
/* |zzprime[i]| < 2^26 */
|
||||||
|
memcpy(x3, xxxprime, sizeof(limb) * 10);
|
||||||
|
memcpy(z3, zzprime, sizeof(limb) * 10);
|
||||||
|
|
||||||
|
fsquare(xx, x);
|
||||||
|
/* |xx[i]| < 2^26 */
|
||||||
|
fsquare(zz, z);
|
||||||
|
/* |zz[i]| < 2^26 */
|
||||||
|
fproduct(x2, xx, zz);
|
||||||
|
/* |x2[i]| < 14*2^52 */
|
||||||
|
freduce_degree(x2);
|
||||||
|
freduce_coefficients(x2);
|
||||||
|
/* |x2[i]| < 2^26 */
|
||||||
|
fdifference(zz, xx); // does zz = xx - zz
|
||||||
|
/* |zz[i]| < 2^27 */
|
||||||
|
memset(zzz + 10, 0, sizeof(limb) * 9);
|
||||||
|
fscalar_product(zzz, zz, 121665);
|
||||||
|
/* |zzz[i]| < 2^(27+17) */
|
||||||
|
/* No need to call freduce_degree here:
|
||||||
|
fscalar_product doesn't increase the degree of its input. */
|
||||||
|
freduce_coefficients(zzz);
|
||||||
|
/* |zzz[i]| < 2^26 */
|
||||||
|
fsum(zzz, xx);
|
||||||
|
/* |zzz[i]| < 2^27 */
|
||||||
|
fproduct(z2, zz, zzz);
|
||||||
|
/* |z2[i]| < 14*2^(26+27) */
|
||||||
|
freduce_degree(z2);
|
||||||
|
freduce_coefficients(z2);
|
||||||
|
/* |z2|i| < 2^26 */
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Conditionally swap two reduced-form limb arrays if 'iswap' is 1, but leave
|
||||||
|
* them unchanged if 'iswap' is 0. Runs in data-invariant time to avoid
|
||||||
|
* side-channel attacks.
|
||||||
|
*
|
||||||
|
* NOTE that this function requires that 'iswap' be 1 or 0; other values give
|
||||||
|
* wrong results. Also, the two limb arrays must be in reduced-coefficient,
|
||||||
|
* reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
|
||||||
|
* and all all values in a[0..9],b[0..9] must have magnitude less than
|
||||||
|
* INT32_MAX. */
|
||||||
|
static void
|
||||||
|
swap_conditional(limb a[19], limb b[19], limb iswap) {
|
||||||
|
unsigned i;
|
||||||
|
const s32 swap = (s32) -iswap;
|
||||||
|
|
||||||
|
for (i = 0; i < 10; ++i) {
|
||||||
|
const s32 x = swap & ( ((s32)a[i]) ^ ((s32)b[i]) );
|
||||||
|
a[i] = ((s32)a[i]) ^ x;
|
||||||
|
b[i] = ((s32)b[i]) ^ x;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Calculates nQ where Q is the x-coordinate of a point on the curve
|
||||||
|
*
|
||||||
|
* resultx/resultz: the x coordinate of the resulting curve point (short form)
|
||||||
|
* n: a little endian, 32-byte number
|
||||||
|
* q: a point of the curve (short form) */
|
||||||
|
static void
|
||||||
|
cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
|
||||||
|
limb a[19] = {0}, b[19] = {1}, c[19] = {1}, d[19] = {0};
|
||||||
|
limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
|
||||||
|
limb e[19] = {0}, f[19] = {1}, g[19] = {0}, h[19] = {1};
|
||||||
|
limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
|
||||||
|
|
||||||
|
unsigned i, j;
|
||||||
|
|
||||||
|
memcpy(nqpqx, q, sizeof(limb) * 10);
|
||||||
|
|
||||||
|
for (i = 0; i < 32; ++i) {
|
||||||
|
u8 byte = n[31 - i];
|
||||||
|
for (j = 0; j < 8; ++j) {
|
||||||
|
const limb bit = byte >> 7;
|
||||||
|
|
||||||
|
swap_conditional(nqx, nqpqx, bit);
|
||||||
|
swap_conditional(nqz, nqpqz, bit);
|
||||||
|
fmonty(nqx2, nqz2,
|
||||||
|
nqpqx2, nqpqz2,
|
||||||
|
nqx, nqz,
|
||||||
|
nqpqx, nqpqz,
|
||||||
|
q);
|
||||||
|
swap_conditional(nqx2, nqpqx2, bit);
|
||||||
|
swap_conditional(nqz2, nqpqz2, bit);
|
||||||
|
|
||||||
|
t = nqx;
|
||||||
|
nqx = nqx2;
|
||||||
|
nqx2 = t;
|
||||||
|
t = nqz;
|
||||||
|
nqz = nqz2;
|
||||||
|
nqz2 = t;
|
||||||
|
t = nqpqx;
|
||||||
|
nqpqx = nqpqx2;
|
||||||
|
nqpqx2 = t;
|
||||||
|
t = nqpqz;
|
||||||
|
nqpqz = nqpqz2;
|
||||||
|
nqpqz2 = t;
|
||||||
|
|
||||||
|
byte <<= 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(resultx, nqx, sizeof(limb) * 10);
|
||||||
|
memcpy(resultz, nqz, sizeof(limb) * 10);
|
||||||
|
}
|
||||||
|
|
||||||
|
// -----------------------------------------------------------------------------
|
||||||
|
// Shamelessly copied from djb's code
|
||||||
|
// -----------------------------------------------------------------------------
|
||||||
|
static void
|
||||||
|
crecip(limb *out, const limb *z) {
|
||||||
|
limb z2[10];
|
||||||
|
limb z9[10];
|
||||||
|
limb z11[10];
|
||||||
|
limb z2_5_0[10];
|
||||||
|
limb z2_10_0[10];
|
||||||
|
limb z2_20_0[10];
|
||||||
|
limb z2_50_0[10];
|
||||||
|
limb z2_100_0[10];
|
||||||
|
limb t0[10];
|
||||||
|
limb t1[10];
|
||||||
|
int i;
|
||||||
|
|
||||||
|
/* 2 */ fsquare(z2,z);
|
||||||
|
/* 4 */ fsquare(t1,z2);
|
||||||
|
/* 8 */ fsquare(t0,t1);
|
||||||
|
/* 9 */ fmul(z9,t0,z);
|
||||||
|
/* 11 */ fmul(z11,z9,z2);
|
||||||
|
/* 22 */ fsquare(t0,z11);
|
||||||
|
/* 2^5 - 2^0 = 31 */ fmul(z2_5_0,t0,z9);
|
||||||
|
|
||||||
|
/* 2^6 - 2^1 */ fsquare(t0,z2_5_0);
|
||||||
|
/* 2^7 - 2^2 */ fsquare(t1,t0);
|
||||||
|
/* 2^8 - 2^3 */ fsquare(t0,t1);
|
||||||
|
/* 2^9 - 2^4 */ fsquare(t1,t0);
|
||||||
|
/* 2^10 - 2^5 */ fsquare(t0,t1);
|
||||||
|
/* 2^10 - 2^0 */ fmul(z2_10_0,t0,z2_5_0);
|
||||||
|
|
||||||
|
/* 2^11 - 2^1 */ fsquare(t0,z2_10_0);
|
||||||
|
/* 2^12 - 2^2 */ fsquare(t1,t0);
|
||||||
|
/* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||||
|
/* 2^20 - 2^0 */ fmul(z2_20_0,t1,z2_10_0);
|
||||||
|
|
||||||
|
/* 2^21 - 2^1 */ fsquare(t0,z2_20_0);
|
||||||
|
/* 2^22 - 2^2 */ fsquare(t1,t0);
|
||||||
|
/* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||||
|
/* 2^40 - 2^0 */ fmul(t0,t1,z2_20_0);
|
||||||
|
|
||||||
|
/* 2^41 - 2^1 */ fsquare(t1,t0);
|
||||||
|
/* 2^42 - 2^2 */ fsquare(t0,t1);
|
||||||
|
/* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||||
|
/* 2^50 - 2^0 */ fmul(z2_50_0,t0,z2_10_0);
|
||||||
|
|
||||||
|
/* 2^51 - 2^1 */ fsquare(t0,z2_50_0);
|
||||||
|
/* 2^52 - 2^2 */ fsquare(t1,t0);
|
||||||
|
/* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||||
|
/* 2^100 - 2^0 */ fmul(z2_100_0,t1,z2_50_0);
|
||||||
|
|
||||||
|
/* 2^101 - 2^1 */ fsquare(t1,z2_100_0);
|
||||||
|
/* 2^102 - 2^2 */ fsquare(t0,t1);
|
||||||
|
/* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
|
||||||
|
/* 2^200 - 2^0 */ fmul(t1,t0,z2_100_0);
|
||||||
|
|
||||||
|
/* 2^201 - 2^1 */ fsquare(t0,t1);
|
||||||
|
/* 2^202 - 2^2 */ fsquare(t1,t0);
|
||||||
|
/* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
|
||||||
|
/* 2^250 - 2^0 */ fmul(t0,t1,z2_50_0);
|
||||||
|
|
||||||
|
/* 2^251 - 2^1 */ fsquare(t1,t0);
|
||||||
|
/* 2^252 - 2^2 */ fsquare(t0,t1);
|
||||||
|
/* 2^253 - 2^3 */ fsquare(t1,t0);
|
||||||
|
/* 2^254 - 2^4 */ fsquare(t0,t1);
|
||||||
|
/* 2^255 - 2^5 */ fsquare(t1,t0);
|
||||||
|
/* 2^255 - 21 */ fmul(out,t1,z11);
|
||||||
|
}
|
||||||
|
|
||||||
|
int
|
||||||
|
curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
|
||||||
|
limb bp[10], x[10], z[11], zmone[10];
|
||||||
|
uint8_t e[32];
|
||||||
|
int i;
|
||||||
|
|
||||||
|
for (i = 0; i < 32; ++i) e[i] = secret[i];
|
||||||
|
// e[0] &= 248;
|
||||||
|
// e[31] &= 127;
|
||||||
|
// e[31] |= 64;
|
||||||
|
|
||||||
|
fexpand(bp, basepoint);
|
||||||
|
cmult(x, z, e, bp);
|
||||||
|
crecip(zmone, z);
|
||||||
|
fmul(z, x, zmone);
|
||||||
|
fcontract(mypublic, z);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
6
Sources/libsignal/curve25519/curve25519-donna.h
Executable file
6
Sources/libsignal/curve25519/curve25519-donna.h
Executable file
|
|
@ -0,0 +1,6 @@
|
||||||
|
#ifndef CURVE25519_DONNA_H
|
||||||
|
#define CURVE25519_DONNA_H
|
||||||
|
|
||||||
|
extern int curve25519_donna(uint8_t *, const uint8_t *, const uint8_t *);
|
||||||
|
|
||||||
|
#endif
|
||||||
44
Sources/libsignal/curve25519/ed25519/additions/compare.c
Executable file
44
Sources/libsignal/curve25519/ed25519/additions/compare.c
Executable file
|
|
@ -0,0 +1,44 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "compare.h"
|
||||||
|
|
||||||
|
/* Const-time comparison from SUPERCOP, but here it's only used for
|
||||||
|
signature verification, so doesn't need to be const-time. But
|
||||||
|
copied the nacl version anyways. */
|
||||||
|
int crypto_verify_32_ref(const unsigned char *x, const unsigned char *y)
|
||||||
|
{
|
||||||
|
unsigned int differentbits = 0;
|
||||||
|
#define F(i) differentbits |= x[i] ^ y[i];
|
||||||
|
F(0)
|
||||||
|
F(1)
|
||||||
|
F(2)
|
||||||
|
F(3)
|
||||||
|
F(4)
|
||||||
|
F(5)
|
||||||
|
F(6)
|
||||||
|
F(7)
|
||||||
|
F(8)
|
||||||
|
F(9)
|
||||||
|
F(10)
|
||||||
|
F(11)
|
||||||
|
F(12)
|
||||||
|
F(13)
|
||||||
|
F(14)
|
||||||
|
F(15)
|
||||||
|
F(16)
|
||||||
|
F(17)
|
||||||
|
F(18)
|
||||||
|
F(19)
|
||||||
|
F(20)
|
||||||
|
F(21)
|
||||||
|
F(22)
|
||||||
|
F(23)
|
||||||
|
F(24)
|
||||||
|
F(25)
|
||||||
|
F(26)
|
||||||
|
F(27)
|
||||||
|
F(28)
|
||||||
|
F(29)
|
||||||
|
F(30)
|
||||||
|
F(31)
|
||||||
|
return (1 & ((differentbits - 1) >> 8)) - 1;
|
||||||
|
}
|
||||||
6
Sources/libsignal/curve25519/ed25519/additions/compare.h
Executable file
6
Sources/libsignal/curve25519/ed25519/additions/compare.h
Executable file
|
|
@ -0,0 +1,6 @@
|
||||||
|
#ifndef __COMPARE_H__
|
||||||
|
#define __COMPARE_H__
|
||||||
|
|
||||||
|
int crypto_verify_32_ref(const unsigned char *b1, const unsigned char *b2);
|
||||||
|
|
||||||
|
#endif
|
||||||
45
Sources/libsignal/curve25519/ed25519/additions/crypto_additions.h
Executable file
45
Sources/libsignal/curve25519/ed25519/additions/crypto_additions.h
Executable file
|
|
@ -0,0 +1,45 @@
|
||||||
|
|
||||||
|
#ifndef __CRYPTO_ADDITIONS__
|
||||||
|
#define __CRYPTO_ADDITIONS__
|
||||||
|
|
||||||
|
#include "crypto_uint32.h"
|
||||||
|
#include "fe.h"
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
#define MAX_MSG_LEN 256
|
||||||
|
|
||||||
|
void sc_neg(unsigned char *b, const unsigned char *a);
|
||||||
|
void sc_cmov(unsigned char* f, const unsigned char* g, unsigned char b);
|
||||||
|
|
||||||
|
int fe_isequal(const fe f, const fe g);
|
||||||
|
int fe_isreduced(const unsigned char* s);
|
||||||
|
void fe_mont_rhs(fe v2, const fe u);
|
||||||
|
void fe_montx_to_edy(fe y, const fe u);
|
||||||
|
void fe_sqrt(fe b, const fe a);
|
||||||
|
|
||||||
|
int ge_isneutral(const ge_p3* q);
|
||||||
|
void ge_neg(ge_p3* r, const ge_p3 *p);
|
||||||
|
void ge_montx_to_p3(ge_p3* p, const fe u, const unsigned char ed_sign_bit);
|
||||||
|
void ge_p3_to_montx(fe u, const ge_p3 *p);
|
||||||
|
void ge_scalarmult(ge_p3 *h, const unsigned char *a, const ge_p3 *A);
|
||||||
|
void ge_scalarmult_cofactor(ge_p3 *q, const ge_p3 *p);
|
||||||
|
|
||||||
|
void elligator(fe u, const fe r);
|
||||||
|
void hash_to_point(ge_p3* p, const unsigned char* msg, const unsigned long in_len);
|
||||||
|
|
||||||
|
int crypto_sign_modified(
|
||||||
|
unsigned char *sm,
|
||||||
|
const unsigned char *m,unsigned long long mlen,
|
||||||
|
const unsigned char *sk, /* Curve/Ed25519 private key */
|
||||||
|
const unsigned char *pk, /* Ed25519 public key */
|
||||||
|
const unsigned char *random /* 64 bytes random to hash into nonce */
|
||||||
|
);
|
||||||
|
|
||||||
|
int crypto_sign_open_modified(
|
||||||
|
unsigned char *m,
|
||||||
|
const unsigned char *sm,unsigned long long smlen,
|
||||||
|
const unsigned char *pk
|
||||||
|
);
|
||||||
|
|
||||||
|
|
||||||
|
#endif
|
||||||
6
Sources/libsignal/curve25519/ed25519/additions/crypto_hash_sha512.h
Executable file
6
Sources/libsignal/curve25519/ed25519/additions/crypto_hash_sha512.h
Executable file
|
|
@ -0,0 +1,6 @@
|
||||||
|
#ifndef crypto_hash_sha512_H
|
||||||
|
#define crypto_hash_sha512_H
|
||||||
|
|
||||||
|
extern int crypto_hash_sha512(unsigned char *,const unsigned char *,unsigned long long);
|
||||||
|
|
||||||
|
#endif
|
||||||
102
Sources/libsignal/curve25519/ed25519/additions/curve_sigs.c
Executable file
102
Sources/libsignal/curve25519/ed25519/additions/curve_sigs.c
Executable file
|
|
@ -0,0 +1,102 @@
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include "../ge.h"
|
||||||
|
#include "curve_sigs.h"
|
||||||
|
#include "crypto_sign.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
int curve25519_sign(unsigned char* signature_out,
|
||||||
|
const unsigned char* curve25519_privkey,
|
||||||
|
const unsigned char* msg, const unsigned long msg_len,
|
||||||
|
const unsigned char* random)
|
||||||
|
{
|
||||||
|
ge_p3 ed_pubkey_point; /* Ed25519 pubkey point */
|
||||||
|
unsigned char ed_pubkey[32]; /* Ed25519 encoded pubkey */
|
||||||
|
unsigned char *sigbuf; /* working buffer */
|
||||||
|
unsigned char sign_bit = 0;
|
||||||
|
|
||||||
|
if ((sigbuf = malloc(msg_len + 128)) == 0) {
|
||||||
|
memset(signature_out, 0, 64);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Convert the Curve25519 privkey to an Ed25519 public key */
|
||||||
|
ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey);
|
||||||
|
ge_p3_tobytes(ed_pubkey, &ed_pubkey_point);
|
||||||
|
sign_bit = ed_pubkey[31] & 0x80;
|
||||||
|
|
||||||
|
/* Perform an Ed25519 signature with explicit private key */
|
||||||
|
crypto_sign_modified(sigbuf, msg, msg_len, curve25519_privkey,
|
||||||
|
ed_pubkey, random);
|
||||||
|
memmove(signature_out, sigbuf, 64);
|
||||||
|
|
||||||
|
/* Encode the sign bit into signature (in unused high bit of S) */
|
||||||
|
signature_out[63] &= 0x7F; /* bit should be zero already, but just in case */
|
||||||
|
signature_out[63] |= sign_bit;
|
||||||
|
|
||||||
|
free(sigbuf);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int curve25519_verify(const unsigned char* signature,
|
||||||
|
const unsigned char* curve25519_pubkey,
|
||||||
|
const unsigned char* msg, const unsigned long msg_len)
|
||||||
|
{
|
||||||
|
fe u;
|
||||||
|
fe y;
|
||||||
|
unsigned char ed_pubkey[32];
|
||||||
|
unsigned char *verifybuf = NULL; /* working buffer */
|
||||||
|
unsigned char *verifybuf2 = NULL; /* working buffer #2 */
|
||||||
|
int result;
|
||||||
|
|
||||||
|
if ((verifybuf = malloc(msg_len + 64)) == 0) {
|
||||||
|
result = -1;
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ((verifybuf2 = malloc(msg_len + 64)) == 0) {
|
||||||
|
result = -1;
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Convert the Curve25519 public key into an Ed25519 public key. In
|
||||||
|
particular, convert Curve25519's "montgomery" x-coordinate (u) into an
|
||||||
|
Ed25519 "edwards" y-coordinate:
|
||||||
|
|
||||||
|
y = (u - 1) / (u + 1)
|
||||||
|
|
||||||
|
NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp
|
||||||
|
|
||||||
|
Then move the sign bit into the pubkey from the signature.
|
||||||
|
*/
|
||||||
|
fe_frombytes(u, curve25519_pubkey);
|
||||||
|
fe_montx_to_edy(y, u);
|
||||||
|
fe_tobytes(ed_pubkey, y);
|
||||||
|
|
||||||
|
/* Copy the sign bit, and remove it from signature */
|
||||||
|
ed_pubkey[31] &= 0x7F; /* bit should be zero already, but just in case */
|
||||||
|
ed_pubkey[31] |= (signature[63] & 0x80);
|
||||||
|
memmove(verifybuf, signature, 64);
|
||||||
|
verifybuf[63] &= 0x7F;
|
||||||
|
|
||||||
|
memmove(verifybuf+64, msg, msg_len);
|
||||||
|
|
||||||
|
/* Then perform a normal Ed25519 verification, return 0 on success */
|
||||||
|
/* The below call has a strange API: */
|
||||||
|
/* verifybuf = R || S || message */
|
||||||
|
/* verifybuf2 = internal to next call gets a copy of verifybuf, S gets
|
||||||
|
replaced with pubkey for hashing */
|
||||||
|
result = crypto_sign_open_modified(verifybuf2, verifybuf, 64 + msg_len, ed_pubkey);
|
||||||
|
|
||||||
|
err:
|
||||||
|
|
||||||
|
if (verifybuf != NULL) {
|
||||||
|
free(verifybuf);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (verifybuf2 != NULL) {
|
||||||
|
free(verifybuf2);
|
||||||
|
}
|
||||||
|
|
||||||
|
return result;
|
||||||
|
}
|
||||||
17
Sources/libsignal/curve25519/ed25519/additions/curve_sigs.h
Executable file
17
Sources/libsignal/curve25519/ed25519/additions/curve_sigs.h
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
|
||||||
|
#ifndef __CURVE_SIGS_H__
|
||||||
|
#define __CURVE_SIGS_H__
|
||||||
|
|
||||||
|
/* returns 0 on success */
|
||||||
|
int curve25519_sign(unsigned char* signature_out, /* 64 bytes */
|
||||||
|
const unsigned char* curve25519_privkey, /* 32 bytes */
|
||||||
|
const unsigned char* msg, const unsigned long msg_len, /* <= 256 bytes */
|
||||||
|
const unsigned char* random); /* 64 bytes */
|
||||||
|
|
||||||
|
/* returns 0 on success */
|
||||||
|
int curve25519_verify(const unsigned char* signature, /* 64 bytes */
|
||||||
|
const unsigned char* curve25519_pubkey, /* 32 bytes */
|
||||||
|
const unsigned char* msg, const unsigned long msg_len); /* <= 256 bytes */
|
||||||
|
|
||||||
|
|
||||||
|
#endif
|
||||||
80
Sources/libsignal/curve25519/ed25519/additions/elligator.c
Executable file
80
Sources/libsignal/curve25519/ed25519/additions/elligator.c
Executable file
|
|
@ -0,0 +1,80 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "fe.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "crypto_uint32.h"
|
||||||
|
#include "crypto_hash_sha512.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
unsigned int legendre_is_nonsquare(fe in)
|
||||||
|
{
|
||||||
|
fe temp;
|
||||||
|
unsigned char bytes[32];
|
||||||
|
fe_pow22523(temp, in); /* temp = in^((q-5)/8) */
|
||||||
|
fe_sq(temp, temp); /* in^((q-5)/4) */
|
||||||
|
fe_sq(temp, temp); /* in^((q-5)/2) */
|
||||||
|
fe_mul(temp, temp, in); /* in^((q-3)/2) */
|
||||||
|
fe_mul(temp, temp, in); /* in^((q-1)/2) */
|
||||||
|
|
||||||
|
/* temp is now the Legendre symbol:
|
||||||
|
* 1 = square
|
||||||
|
* 0 = input is zero
|
||||||
|
* -1 = nonsquare
|
||||||
|
*/
|
||||||
|
fe_tobytes(bytes, temp);
|
||||||
|
return 1 & bytes[31];
|
||||||
|
}
|
||||||
|
|
||||||
|
void elligator(fe u, const fe r)
|
||||||
|
{
|
||||||
|
/* r = input
|
||||||
|
* x = -A/(1+2r^2) # 2 is nonsquare
|
||||||
|
* e = (x^3 + Ax^2 + x)^((q-1)/2) # legendre symbol
|
||||||
|
* if e == 1 (square) or e == 0 (because x == 0 and 2r^2 + 1 == 0)
|
||||||
|
* u = x
|
||||||
|
* if e == -1 (nonsquare)
|
||||||
|
* u = -x - A
|
||||||
|
*/
|
||||||
|
fe A, one, twor2, twor2plus1, twor2plus1inv;
|
||||||
|
fe x, e, Atemp, uneg;
|
||||||
|
unsigned int nonsquare;
|
||||||
|
|
||||||
|
fe_1(one);
|
||||||
|
fe_0(A);
|
||||||
|
A[0] = 486662; /* A = 486662 */
|
||||||
|
|
||||||
|
fe_sq2(twor2, r); /* 2r^2 */
|
||||||
|
fe_add(twor2plus1, twor2, one); /* 1+2r^2 */
|
||||||
|
fe_invert(twor2plus1inv, twor2plus1); /* 1/(1+2r^2) */
|
||||||
|
fe_mul(x, twor2plus1inv, A); /* A/(1+2r^2) */
|
||||||
|
fe_neg(x, x); /* x = -A/(1+2r^2) */
|
||||||
|
|
||||||
|
fe_mont_rhs(e, x); /* e = x^3 + Ax^2 + x */
|
||||||
|
nonsquare = legendre_is_nonsquare(e);
|
||||||
|
|
||||||
|
fe_0(Atemp);
|
||||||
|
fe_cmov(Atemp, A, nonsquare); /* 0, or A if nonsquare */
|
||||||
|
fe_add(u, x, Atemp); /* x, or x+A if nonsquare */
|
||||||
|
fe_neg(uneg, u); /* -x, or -x-A if nonsquare */
|
||||||
|
fe_cmov(u, uneg, nonsquare); /* x, or -x-A if nonsquare */
|
||||||
|
}
|
||||||
|
|
||||||
|
void hash_to_point(ge_p3* p, const unsigned char* in, const unsigned long in_len)
|
||||||
|
{
|
||||||
|
unsigned char hash[64];
|
||||||
|
fe h, u;
|
||||||
|
unsigned char sign_bit;
|
||||||
|
ge_p3 p3;
|
||||||
|
|
||||||
|
crypto_hash_sha512(hash, in, in_len);
|
||||||
|
|
||||||
|
/* take the high bit as Edwards sign bit */
|
||||||
|
sign_bit = (hash[31] & 0x80) >> 7;
|
||||||
|
hash[31] &= 0x7F;
|
||||||
|
fe_frombytes(h, hash);
|
||||||
|
elligator(u, h);
|
||||||
|
|
||||||
|
ge_montx_to_p3(&p3, u, sign_bit);
|
||||||
|
ge_scalarmult_cofactor(p, &p3);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
14
Sources/libsignal/curve25519/ed25519/additions/fe_isequal.c
Executable file
14
Sources/libsignal/curve25519/ed25519/additions/fe_isequal.c
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return 1 if f == g
|
||||||
|
return 0 if f != g
|
||||||
|
*/
|
||||||
|
|
||||||
|
int fe_isequal(const fe f, const fe g)
|
||||||
|
{
|
||||||
|
fe h;
|
||||||
|
fe_sub(h, f, g);
|
||||||
|
return 1 ^ (1 & (fe_isnonzero(h) >> 8));
|
||||||
|
}
|
||||||
14
Sources/libsignal/curve25519/ed25519/additions/fe_isreduced.c
Executable file
14
Sources/libsignal/curve25519/ed25519/additions/fe_isreduced.c
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
|
||||||
|
int fe_isreduced(const unsigned char* s)
|
||||||
|
{
|
||||||
|
fe f;
|
||||||
|
unsigned char strict[32];
|
||||||
|
|
||||||
|
fe_frombytes(f, s);
|
||||||
|
fe_tobytes(strict, f);
|
||||||
|
if (crypto_verify_32(strict, s) != 0)
|
||||||
|
return 0;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
17
Sources/libsignal/curve25519/ed25519/additions/fe_mont_rhs.c
Executable file
17
Sources/libsignal/curve25519/ed25519/additions/fe_mont_rhs.c
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
void fe_mont_rhs(fe v2, fe u) {
|
||||||
|
fe A, one;
|
||||||
|
fe u2, Au, inner;
|
||||||
|
|
||||||
|
fe_1(one);
|
||||||
|
fe_0(A);
|
||||||
|
A[0] = 486662; /* A = 486662 */
|
||||||
|
|
||||||
|
fe_sq(u2, u); /* u^2 */
|
||||||
|
fe_mul(Au, A, u); /* Au */
|
||||||
|
fe_add(inner, u2, Au); /* u^2 + Au */
|
||||||
|
fe_add(inner, inner, one); /* u^2 + Au + 1 */
|
||||||
|
fe_mul(v2, u, inner); /* u(u^2 + Au + 1) */
|
||||||
|
}
|
||||||
|
|
||||||
19
Sources/libsignal/curve25519/ed25519/additions/fe_montx_to_edy.c
Executable file
19
Sources/libsignal/curve25519/ed25519/additions/fe_montx_to_edy.c
Executable file
|
|
@ -0,0 +1,19 @@
|
||||||
|
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
void fe_montx_to_edy(fe y, const fe u)
|
||||||
|
{
|
||||||
|
/*
|
||||||
|
y = (u - 1) / (u + 1)
|
||||||
|
|
||||||
|
NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp
|
||||||
|
*/
|
||||||
|
fe one, um1, up1;
|
||||||
|
|
||||||
|
fe_1(one);
|
||||||
|
fe_sub(um1, u, one);
|
||||||
|
fe_add(up1, u, one);
|
||||||
|
fe_invert(up1, up1);
|
||||||
|
fe_mul(y, um1, up1);
|
||||||
|
}
|
||||||
51
Sources/libsignal/curve25519/ed25519/additions/fe_sqrt.c
Executable file
51
Sources/libsignal/curve25519/ed25519/additions/fe_sqrt.c
Executable file
|
|
@ -0,0 +1,51 @@
|
||||||
|
#include <assert.h>
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
/* sqrt(-1) */
|
||||||
|
static unsigned char i_bytes[32] = {
|
||||||
|
0xb0, 0xa0, 0x0e, 0x4a, 0x27, 0x1b, 0xee, 0xc4,
|
||||||
|
0x78, 0xe4, 0x2f, 0xad, 0x06, 0x18, 0x43, 0x2f,
|
||||||
|
0xa7, 0xd7, 0xfb, 0x3d, 0x99, 0x00, 0x4d, 0x2b,
|
||||||
|
0x0b, 0xdf, 0xc1, 0x4f, 0x80, 0x24, 0x83, 0x2b
|
||||||
|
};
|
||||||
|
|
||||||
|
/* Preconditions: a is square or zero */
|
||||||
|
|
||||||
|
void fe_sqrt(fe out, const fe a)
|
||||||
|
{
|
||||||
|
fe exp, b, b2, bi, i;
|
||||||
|
#ifndef NDEBUG
|
||||||
|
fe legendre, zero, one;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
fe_frombytes(i, i_bytes);
|
||||||
|
fe_pow22523(exp, a); /* b = a^(q-5)/8 */
|
||||||
|
|
||||||
|
/* PRECONDITION: legendre symbol == 1 (square) or 0 (a == zero) */
|
||||||
|
#ifndef NDEBUG
|
||||||
|
fe_sq(legendre, exp); /* in^((q-5)/4) */
|
||||||
|
fe_sq(legendre, legendre); /* in^((q-5)/2) */
|
||||||
|
fe_mul(legendre, legendre, a); /* in^((q-3)/2) */
|
||||||
|
fe_mul(legendre, legendre, a); /* in^((q-1)/2) */
|
||||||
|
|
||||||
|
fe_0(zero);
|
||||||
|
fe_1(one);
|
||||||
|
assert(fe_isequal(legendre, zero) || fe_isequal(legendre, one));
|
||||||
|
#endif
|
||||||
|
|
||||||
|
fe_mul(b, a, exp); /* b = a * a^(q-5)/8 */
|
||||||
|
fe_sq(b2, b); /* b^2 = a * a^(q-1)/4 */
|
||||||
|
|
||||||
|
/* note b^4 == a^2, so b^2 == a or -a
|
||||||
|
* if b^2 != a, multiply it by sqrt(-1) */
|
||||||
|
fe_mul(bi, b, i);
|
||||||
|
fe_cmov(b, bi, 1 ^ fe_isequal(b2, a));
|
||||||
|
fe_copy(out, b);
|
||||||
|
|
||||||
|
/* PRECONDITION: out^2 == a */
|
||||||
|
#ifndef NDEBUG
|
||||||
|
fe_sq(b2, out);
|
||||||
|
assert(fe_isequal(a, b2));
|
||||||
|
#endif
|
||||||
|
}
|
||||||
16
Sources/libsignal/curve25519/ed25519/additions/ge_isneutral.c
Executable file
16
Sources/libsignal/curve25519/ed25519/additions/ge_isneutral.c
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return 1 if p is the neutral point
|
||||||
|
return 0 otherwise
|
||||||
|
*/
|
||||||
|
|
||||||
|
int ge_isneutral(const ge_p3 *p)
|
||||||
|
{
|
||||||
|
fe zero;
|
||||||
|
fe_0(zero);
|
||||||
|
|
||||||
|
/* Check if p == neutral element == (0, 1) */
|
||||||
|
return (fe_isequal(p->X, zero) & fe_isequal(p->Y, p->Z));
|
||||||
|
}
|
||||||
70
Sources/libsignal/curve25519/ed25519/additions/ge_montx_to_p3.c
Executable file
70
Sources/libsignal/curve25519/ed25519/additions/ge_montx_to_p3.c
Executable file
|
|
@ -0,0 +1,70 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "assert.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "utility.h"
|
||||||
|
|
||||||
|
/* sqrt(-(A+2)) */
|
||||||
|
static unsigned char A_bytes[32] = {
|
||||||
|
0x06, 0x7e, 0x45, 0xff, 0xaa, 0x04, 0x6e, 0xcc,
|
||||||
|
0x82, 0x1a, 0x7d, 0x4b, 0xd1, 0xd3, 0xa1, 0xc5,
|
||||||
|
0x7e, 0x4f, 0xfc, 0x03, 0xdc, 0x08, 0x7b, 0xd2,
|
||||||
|
0xbb, 0x06, 0xa0, 0x60, 0xf4, 0xed, 0x26, 0x0f
|
||||||
|
};
|
||||||
|
|
||||||
|
void ge_montx_to_p3(ge_p3* p, const fe u, const unsigned char ed_sign_bit)
|
||||||
|
{
|
||||||
|
fe x, y, A, v, v2, iv, nx;
|
||||||
|
|
||||||
|
fe_frombytes(A, A_bytes);
|
||||||
|
|
||||||
|
/* given u, recover edwards y */
|
||||||
|
/* given u, recover v */
|
||||||
|
/* given u and v, recover edwards x */
|
||||||
|
|
||||||
|
fe_montx_to_edy(y, u); /* y = (u - 1) / (u + 1) */
|
||||||
|
|
||||||
|
fe_mont_rhs(v2, u); /* v^2 = u(u^2 + Au + 1) */
|
||||||
|
fe_sqrt(v, v2); /* v = sqrt(v^2) */
|
||||||
|
|
||||||
|
fe_mul(x, u, A); /* x = u * sqrt(-(A+2)) */
|
||||||
|
fe_invert(iv, v); /* 1/v */
|
||||||
|
fe_mul(x, x, iv); /* x = (u/v) * sqrt(-(A+2)) */
|
||||||
|
|
||||||
|
fe_neg(nx, x); /* negate x to match sign bit */
|
||||||
|
fe_cmov(x, nx, fe_isnegative(x) ^ ed_sign_bit);
|
||||||
|
|
||||||
|
fe_copy(p->X, x);
|
||||||
|
fe_copy(p->Y, y);
|
||||||
|
fe_1(p->Z);
|
||||||
|
fe_mul(p->T, p->X, p->Y);
|
||||||
|
|
||||||
|
/* POSTCONDITION: check that p->X and p->Y satisfy the Ed curve equation */
|
||||||
|
/* -x^2 + y^2 = 1 + dx^2y^2 */
|
||||||
|
#ifndef NDEBUG
|
||||||
|
{
|
||||||
|
fe one, d, x2, y2, x2y2, dx2y2;
|
||||||
|
|
||||||
|
unsigned char dbytes[32] = {
|
||||||
|
0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
|
||||||
|
0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
|
||||||
|
0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
|
||||||
|
0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52
|
||||||
|
};
|
||||||
|
|
||||||
|
fe_frombytes(d, dbytes);
|
||||||
|
fe_1(one);
|
||||||
|
fe_sq(x2, p->X); /* x^2 */
|
||||||
|
fe_sq(y2, p->Y); /* y^2 */
|
||||||
|
|
||||||
|
fe_mul(dx2y2, x2, y2); /* x^2y^2 */
|
||||||
|
fe_mul(dx2y2, dx2y2, d); /* dx^2y^2 */
|
||||||
|
fe_add(dx2y2, dx2y2, one); /* dx^2y^2 + 1 */
|
||||||
|
|
||||||
|
fe_neg(x2y2, x2); /* -x^2 */
|
||||||
|
fe_add(x2y2, x2y2, y2); /* -x^2 + y^2 */
|
||||||
|
|
||||||
|
assert(fe_isequal(x2y2, dx2y2));
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
}
|
||||||
15
Sources/libsignal/curve25519/ed25519/additions/ge_neg.c
Executable file
15
Sources/libsignal/curve25519/ed25519/additions/ge_neg.c
Executable file
|
|
@ -0,0 +1,15 @@
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return r = -p
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
void ge_neg(ge_p3* r, const ge_p3 *p)
|
||||||
|
{
|
||||||
|
fe_neg(r->X, p->X);
|
||||||
|
fe_copy(r->Y, p->Y);
|
||||||
|
fe_copy(r->Z, p->Z);
|
||||||
|
fe_neg(r->T, p->T);
|
||||||
|
}
|
||||||
21
Sources/libsignal/curve25519/ed25519/additions/ge_p3_to_montx.c
Executable file
21
Sources/libsignal/curve25519/ed25519/additions/ge_p3_to_montx.c
Executable file
|
|
@ -0,0 +1,21 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
void ge_p3_to_montx(fe u, const ge_p3 *ed)
|
||||||
|
{
|
||||||
|
/*
|
||||||
|
u = (y + 1) / (1 - y)
|
||||||
|
or
|
||||||
|
u = (y + z) / (z - y)
|
||||||
|
|
||||||
|
NOTE: y=1 is converted to u=0 since fe_invert is mod-exp
|
||||||
|
*/
|
||||||
|
|
||||||
|
fe y_plus_one, one_minus_y, inv_one_minus_y;
|
||||||
|
|
||||||
|
fe_add(y_plus_one, ed->Y, ed->Z);
|
||||||
|
fe_sub(one_minus_y, ed->Z, ed->Y);
|
||||||
|
fe_invert(inv_one_minus_y, one_minus_y);
|
||||||
|
fe_mul(u, y_plus_one, inv_one_minus_y);
|
||||||
|
}
|
||||||
|
|
||||||
140
Sources/libsignal/curve25519/ed25519/additions/ge_scalarmult.c
Executable file
140
Sources/libsignal/curve25519/ed25519/additions/ge_scalarmult.c
Executable file
|
|
@ -0,0 +1,140 @@
|
||||||
|
#include "crypto_uint32.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
static unsigned char equal(signed char b,signed char c)
|
||||||
|
{
|
||||||
|
unsigned char ub = b;
|
||||||
|
unsigned char uc = c;
|
||||||
|
unsigned char x = ub ^ uc; /* 0: yes; 1..255: no */
|
||||||
|
crypto_uint32 y = x; /* 0: yes; 1..255: no */
|
||||||
|
y -= 1; /* 4294967295: yes; 0..254: no */
|
||||||
|
y >>= 31; /* 1: yes; 0: no */
|
||||||
|
return y;
|
||||||
|
}
|
||||||
|
|
||||||
|
static unsigned char negative(signed char b)
|
||||||
|
{
|
||||||
|
unsigned long long x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */
|
||||||
|
x >>= 63; /* 1: yes; 0: no */
|
||||||
|
return x;
|
||||||
|
}
|
||||||
|
|
||||||
|
static void cmov(ge_cached *t,const ge_cached *u,unsigned char b)
|
||||||
|
{
|
||||||
|
fe_cmov(t->YplusX,u->YplusX,b);
|
||||||
|
fe_cmov(t->YminusX,u->YminusX,b);
|
||||||
|
fe_cmov(t->Z,u->Z,b);
|
||||||
|
fe_cmov(t->T2d,u->T2d,b);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void select(ge_cached *t,const ge_cached *pre, signed char b)
|
||||||
|
{
|
||||||
|
ge_cached minust;
|
||||||
|
unsigned char bnegative = negative(b);
|
||||||
|
unsigned char babs = b - (((-bnegative) & b) << 1);
|
||||||
|
|
||||||
|
fe_1(t->YplusX);
|
||||||
|
fe_1(t->YminusX);
|
||||||
|
fe_1(t->Z);
|
||||||
|
fe_0(t->T2d);
|
||||||
|
|
||||||
|
cmov(t,pre+0,equal(babs,1));
|
||||||
|
cmov(t,pre+1,equal(babs,2));
|
||||||
|
cmov(t,pre+2,equal(babs,3));
|
||||||
|
cmov(t,pre+3,equal(babs,4));
|
||||||
|
cmov(t,pre+4,equal(babs,5));
|
||||||
|
cmov(t,pre+5,equal(babs,6));
|
||||||
|
cmov(t,pre+6,equal(babs,7));
|
||||||
|
cmov(t,pre+7,equal(babs,8));
|
||||||
|
fe_copy(minust.YplusX,t->YminusX);
|
||||||
|
fe_copy(minust.YminusX,t->YplusX);
|
||||||
|
fe_copy(minust.Z,t->Z);
|
||||||
|
fe_neg(minust.T2d,t->T2d);
|
||||||
|
cmov(t,&minust,bnegative);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = a * B
|
||||||
|
where a = a[0]+256*a[1]+...+256^31 a[31]
|
||||||
|
B is the Ed25519 base point (x,4/5) with x positive.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
a[31] <= 127
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_scalarmult(ge_p3 *h, const unsigned char *a, const ge_p3 *A)
|
||||||
|
{
|
||||||
|
signed char e[64];
|
||||||
|
signed char carry;
|
||||||
|
ge_p1p1 r;
|
||||||
|
ge_p2 s;
|
||||||
|
ge_p3 t0, t1, t2;
|
||||||
|
ge_cached t, pre[8];
|
||||||
|
int i;
|
||||||
|
|
||||||
|
for (i = 0;i < 32;++i) {
|
||||||
|
e[2 * i + 0] = (a[i] >> 0) & 15;
|
||||||
|
e[2 * i + 1] = (a[i] >> 4) & 15;
|
||||||
|
}
|
||||||
|
/* each e[i] is between 0 and 15 */
|
||||||
|
/* e[63] is between 0 and 7 */
|
||||||
|
|
||||||
|
carry = 0;
|
||||||
|
for (i = 0;i < 63;++i) {
|
||||||
|
e[i] += carry;
|
||||||
|
carry = e[i] + 8;
|
||||||
|
carry >>= 4;
|
||||||
|
e[i] -= carry << 4;
|
||||||
|
}
|
||||||
|
e[63] += carry;
|
||||||
|
/* each e[i] is between -8 and 8 */
|
||||||
|
|
||||||
|
// Precomputation:
|
||||||
|
ge_p3_to_cached(pre+0, A); // A
|
||||||
|
|
||||||
|
ge_p3_dbl(&r, A);
|
||||||
|
ge_p1p1_to_p3(&t0, &r);
|
||||||
|
ge_p3_to_cached(pre+1, &t0); // 2A
|
||||||
|
|
||||||
|
ge_add(&r, A, pre+1);
|
||||||
|
ge_p1p1_to_p3(&t1, &r);
|
||||||
|
ge_p3_to_cached(pre+2, &t1); // 3A
|
||||||
|
|
||||||
|
ge_p3_dbl(&r, &t0);
|
||||||
|
ge_p1p1_to_p3(&t0, &r);
|
||||||
|
ge_p3_to_cached(pre+3, &t0); // 4A
|
||||||
|
|
||||||
|
ge_add(&r, A, pre+3);
|
||||||
|
ge_p1p1_to_p3(&t2, &r);
|
||||||
|
ge_p3_to_cached(pre+4, &t2); // 5A
|
||||||
|
|
||||||
|
ge_p3_dbl(&r, &t1);
|
||||||
|
ge_p1p1_to_p3(&t1, &r);
|
||||||
|
ge_p3_to_cached(pre+5, &t1); // 6A
|
||||||
|
|
||||||
|
ge_add(&r, A, pre+5);
|
||||||
|
ge_p1p1_to_p3(&t1, &r);
|
||||||
|
ge_p3_to_cached(pre+6, &t1); // 7A
|
||||||
|
|
||||||
|
ge_p3_dbl(&r, &t0);
|
||||||
|
ge_p1p1_to_p3(&t0, &r);
|
||||||
|
ge_p3_to_cached(pre+7, &t0); // 8A
|
||||||
|
|
||||||
|
ge_p3_0(h);
|
||||||
|
|
||||||
|
for (i = 63;i > 0; i--) {
|
||||||
|
select(&t,pre,e[i]);
|
||||||
|
ge_add(&r, h, &t);
|
||||||
|
ge_p1p1_to_p2(&s,&r);
|
||||||
|
|
||||||
|
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||||
|
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||||
|
ge_p2_dbl(&r,&s); ge_p1p1_to_p2(&s,&r);
|
||||||
|
ge_p2_dbl(&r,&s); ge_p1p1_to_p3(h,&r);
|
||||||
|
|
||||||
|
}
|
||||||
|
select(&t,pre,e[0]);
|
||||||
|
ge_add(&r, h, &t);
|
||||||
|
ge_p1p1_to_p3(h,&r);
|
||||||
|
}
|
||||||
21
Sources/libsignal/curve25519/ed25519/additions/ge_scalarmult_cofactor.c
Executable file
21
Sources/libsignal/curve25519/ed25519/additions/ge_scalarmult_cofactor.c
Executable file
|
|
@ -0,0 +1,21 @@
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return 8 * p
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_scalarmult_cofactor(ge_p3 *q, const ge_p3 *p)
|
||||||
|
{
|
||||||
|
ge_p1p1 p1p1;
|
||||||
|
ge_p2 p2;
|
||||||
|
|
||||||
|
ge_p3_dbl(&p1p1, p);
|
||||||
|
ge_p1p1_to_p2(&p2, &p1p1);
|
||||||
|
|
||||||
|
ge_p2_dbl(&p1p1, &p2);
|
||||||
|
ge_p1p1_to_p2(&p2, &p1p1);
|
||||||
|
|
||||||
|
ge_p2_dbl(&p1p1, &p2);
|
||||||
|
ge_p1p1_to_p3(q, &p1p1);
|
||||||
|
}
|
||||||
15
Sources/libsignal/curve25519/ed25519/additions/generalized/ge_p3_add.c
Executable file
15
Sources/libsignal/curve25519/ed25519/additions/generalized/ge_p3_add.c
Executable file
|
|
@ -0,0 +1,15 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p + q
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_p3_add(ge_p3 *r, const ge_p3 *p, const ge_p3 *q)
|
||||||
|
{
|
||||||
|
ge_cached p_cached;
|
||||||
|
ge_p1p1 r_p1p1;
|
||||||
|
|
||||||
|
ge_p3_to_cached(&p_cached, p);
|
||||||
|
ge_add(&r_p1p1, q, &p_cached);
|
||||||
|
ge_p1p1_to_p3(r, &r_p1p1);
|
||||||
|
}
|
||||||
19
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_constants.h
Executable file
19
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_constants.h
Executable file
|
|
@ -0,0 +1,19 @@
|
||||||
|
#ifndef _GEN_CONSTANTS_H__
|
||||||
|
#define _GEN_CONSTANTS_H__
|
||||||
|
|
||||||
|
#define LABELSETMAXLEN 512
|
||||||
|
#define LABELMAXLEN 128
|
||||||
|
#define BUFLEN 1024
|
||||||
|
#define BLOCKLEN 128 /* SHA512 */
|
||||||
|
#define HASHLEN 64 /* SHA512 */
|
||||||
|
#define POINTLEN 32
|
||||||
|
#define SCALARLEN 32
|
||||||
|
#define RANDLEN 32
|
||||||
|
#define SIGNATURELEN 64
|
||||||
|
#define VRFSIGNATURELEN 96
|
||||||
|
#define VRFOUTPUTLEN 32
|
||||||
|
#define MSTART 2048
|
||||||
|
#define MSGMAXLEN 1048576
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
|
||||||
|
#ifndef __GEN_CRYPTO_ADDITIONS__
|
||||||
|
#define __GEN_CRYPTO_ADDITIONS__
|
||||||
|
|
||||||
|
#include "crypto_uint32.h"
|
||||||
|
#include "fe.h"
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
int sc_isreduced(const unsigned char* s);
|
||||||
|
|
||||||
|
int point_isreduced(const unsigned char* p);
|
||||||
|
|
||||||
|
void ge_p3_add(ge_p3 *r, const ge_p3 *p, const ge_p3 *q);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
349
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_eddsa.c
Executable file
349
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_eddsa.c
Executable file
|
|
@ -0,0 +1,349 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "gen_eddsa.h"
|
||||||
|
#include "gen_labelset.h"
|
||||||
|
#include "gen_constants.h"
|
||||||
|
#include "gen_crypto_additions.h"
|
||||||
|
#include "crypto_hash_sha512.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
#include "zeroize.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "sc.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "utility.h"
|
||||||
|
|
||||||
|
/* B: base point
|
||||||
|
* R: commitment (point),
|
||||||
|
r: private nonce (scalar)
|
||||||
|
K: encoded public key
|
||||||
|
k: private key (scalar)
|
||||||
|
Z: 32-bytes random
|
||||||
|
M: buffer containing message, message starts at M_start, continues for M_len
|
||||||
|
|
||||||
|
r = hash(B || labelset || Z || pad1 || k || pad2 || labelset || K || extra || M) (mod q)
|
||||||
|
*/
|
||||||
|
int generalized_commit(unsigned char* R_bytes, unsigned char* r_scalar,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const unsigned char* extra, const unsigned long extra_len,
|
||||||
|
const unsigned char* K_bytes, const unsigned char* k_scalar,
|
||||||
|
const unsigned char* Z,
|
||||||
|
unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len)
|
||||||
|
{
|
||||||
|
ge_p3 R_point;
|
||||||
|
unsigned char hash[HASHLEN];
|
||||||
|
unsigned char* bufstart = NULL;
|
||||||
|
unsigned char* bufptr = NULL;
|
||||||
|
unsigned char* bufend = NULL;
|
||||||
|
unsigned long prefix_len = 0;
|
||||||
|
|
||||||
|
if (labelset_validate(labelset, labelset_len) != 0)
|
||||||
|
goto err;
|
||||||
|
if (R_bytes == NULL || r_scalar == NULL ||
|
||||||
|
K_bytes == NULL || k_scalar == NULL ||
|
||||||
|
Z == NULL || M_buf == NULL)
|
||||||
|
goto err;
|
||||||
|
if (extra == NULL && extra_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (extra != NULL && extra_len == 0)
|
||||||
|
goto err;
|
||||||
|
if (extra != NULL && labelset_is_empty(labelset, labelset_len))
|
||||||
|
goto err;
|
||||||
|
if (HASHLEN != 64)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
prefix_len = 0;
|
||||||
|
prefix_len += POINTLEN + labelset_len + RANDLEN;
|
||||||
|
prefix_len += ((BLOCKLEN - (prefix_len % BLOCKLEN)) % BLOCKLEN);
|
||||||
|
prefix_len += SCALARLEN;
|
||||||
|
prefix_len += ((BLOCKLEN - (prefix_len % BLOCKLEN)) % BLOCKLEN);
|
||||||
|
prefix_len += labelset_len + POINTLEN + extra_len;
|
||||||
|
if (prefix_len > M_start)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
bufstart = M_buf + M_start - prefix_len;
|
||||||
|
bufptr = bufstart;
|
||||||
|
bufend = M_buf + M_start;
|
||||||
|
bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, Z, RANDLEN);
|
||||||
|
bufptr = buffer_pad(bufstart, bufptr, bufend);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, k_scalar, SCALARLEN);
|
||||||
|
bufptr = buffer_pad(bufstart, bufptr, bufend);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, K_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, extra, extra_len);
|
||||||
|
if (bufptr != bufend || bufptr != M_buf + M_start || bufptr - bufstart != prefix_len)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
crypto_hash_sha512(hash, M_buf + M_start - prefix_len, prefix_len + M_len);
|
||||||
|
sc_reduce(hash);
|
||||||
|
ge_scalarmult_base(&R_point, hash);
|
||||||
|
ge_p3_tobytes(R_bytes, &R_point);
|
||||||
|
memcpy(r_scalar, hash, SCALARLEN);
|
||||||
|
|
||||||
|
zeroize(hash, HASHLEN);
|
||||||
|
zeroize(bufstart, prefix_len);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
zeroize(hash, HASHLEN);
|
||||||
|
zeroize(M_buf, M_start);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* if is_labelset_empty(labelset):
|
||||||
|
return hash(R || K || M) (mod q)
|
||||||
|
else:
|
||||||
|
return hash(B || labelset || R || labelset || K || extra || M) (mod q)
|
||||||
|
*/
|
||||||
|
int generalized_challenge(unsigned char* h_scalar,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const unsigned char* extra, const unsigned long extra_len,
|
||||||
|
const unsigned char* R_bytes,
|
||||||
|
const unsigned char* K_bytes,
|
||||||
|
unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len)
|
||||||
|
{
|
||||||
|
unsigned char hash[HASHLEN];
|
||||||
|
unsigned char* bufstart = NULL;
|
||||||
|
unsigned char* bufptr = NULL;
|
||||||
|
unsigned char* bufend = NULL;
|
||||||
|
unsigned long prefix_len = 0;
|
||||||
|
|
||||||
|
if (h_scalar == NULL)
|
||||||
|
goto err;
|
||||||
|
memset(h_scalar, 0, SCALARLEN);
|
||||||
|
|
||||||
|
if (labelset_validate(labelset, labelset_len) != 0)
|
||||||
|
goto err;
|
||||||
|
if (R_bytes == NULL || K_bytes == NULL || M_buf == NULL)
|
||||||
|
goto err;
|
||||||
|
if (extra == NULL && extra_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (extra != NULL && extra_len == 0)
|
||||||
|
goto err;
|
||||||
|
if (extra != NULL && labelset_is_empty(labelset, labelset_len))
|
||||||
|
goto err;
|
||||||
|
if (HASHLEN != 64)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (labelset_is_empty(labelset, labelset_len)) {
|
||||||
|
if (2*POINTLEN > M_start)
|
||||||
|
goto err;
|
||||||
|
if (extra != NULL || extra_len != 0)
|
||||||
|
goto err;
|
||||||
|
memcpy(M_buf + M_start - (2*POINTLEN), R_bytes, POINTLEN);
|
||||||
|
memcpy(M_buf + M_start - (1*POINTLEN), K_bytes, POINTLEN);
|
||||||
|
prefix_len = 2*POINTLEN;
|
||||||
|
} else {
|
||||||
|
prefix_len = 3*POINTLEN + 2*labelset_len + extra_len;
|
||||||
|
if (prefix_len > M_start)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
bufstart = M_buf + M_start - prefix_len;
|
||||||
|
bufptr = bufstart;
|
||||||
|
bufend = M_buf + M_start;
|
||||||
|
bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, R_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, K_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, extra, extra_len);
|
||||||
|
|
||||||
|
if (bufptr == NULL)
|
||||||
|
goto err;
|
||||||
|
if (bufptr != bufend || bufptr != M_buf + M_start || bufptr - bufstart != prefix_len)
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
crypto_hash_sha512(hash, M_buf + M_start - prefix_len, prefix_len + M_len);
|
||||||
|
sc_reduce(hash);
|
||||||
|
memcpy(h_scalar, hash, SCALARLEN);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* return r + kh (mod q) */
|
||||||
|
int generalized_prove(unsigned char* out_scalar,
|
||||||
|
const unsigned char* r_scalar, const unsigned char* k_scalar, const unsigned char* h_scalar)
|
||||||
|
{
|
||||||
|
sc_muladd(out_scalar, h_scalar, k_scalar, r_scalar);
|
||||||
|
zeroize_stack();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* R = s*B - h*K */
|
||||||
|
int generalized_solve_commitment(unsigned char* R_bytes_out, ge_p3* K_point_out,
|
||||||
|
const ge_p3* B_point, const unsigned char* s_scalar,
|
||||||
|
const unsigned char* K_bytes, const unsigned char* h_scalar)
|
||||||
|
{
|
||||||
|
|
||||||
|
ge_p3 Kneg_point;
|
||||||
|
ge_p2 R_calc_point_p2;
|
||||||
|
|
||||||
|
ge_p3 sB;
|
||||||
|
ge_p3 hK;
|
||||||
|
ge_p3 R_calc_point_p3;
|
||||||
|
|
||||||
|
if (ge_frombytes_negate_vartime(&Kneg_point, K_bytes) != 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
if (B_point == NULL) {
|
||||||
|
ge_double_scalarmult_vartime(&R_calc_point_p2, h_scalar, &Kneg_point, s_scalar);
|
||||||
|
ge_tobytes(R_bytes_out, &R_calc_point_p2);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
// s * Bv
|
||||||
|
ge_scalarmult(&sB, s_scalar, B_point);
|
||||||
|
|
||||||
|
// h * -K
|
||||||
|
ge_scalarmult(&hK, h_scalar, &Kneg_point);
|
||||||
|
|
||||||
|
// R = sB - hK
|
||||||
|
ge_p3_add(&R_calc_point_p3, &sB, &hK);
|
||||||
|
ge_p3_tobytes(R_bytes_out, &R_calc_point_p3);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (K_point_out) {
|
||||||
|
ge_neg(K_point_out, &Kneg_point);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
int generalized_eddsa_25519_sign(
|
||||||
|
unsigned char* signature_out,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* eddsa_25519_privkey_scalar,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char labelset[LABELSETMAXLEN];
|
||||||
|
unsigned long labelset_len = 0;
|
||||||
|
unsigned char R_bytes[POINTLEN];
|
||||||
|
unsigned char r_scalar[SCALARLEN];
|
||||||
|
unsigned char h_scalar[SCALARLEN];
|
||||||
|
unsigned char s_scalar[SCALARLEN];
|
||||||
|
unsigned char* M_buf = NULL;
|
||||||
|
|
||||||
|
if (signature_out == NULL)
|
||||||
|
goto err;
|
||||||
|
memset(signature_out, 0, SIGNATURELEN);
|
||||||
|
|
||||||
|
if (eddsa_25519_pubkey_bytes == NULL)
|
||||||
|
goto err;
|
||||||
|
if (eddsa_25519_privkey_scalar == NULL)
|
||||||
|
goto err;
|
||||||
|
if (msg == NULL)
|
||||||
|
goto err;
|
||||||
|
if (customization_label == NULL && customization_label_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (customization_label_len > LABELMAXLEN)
|
||||||
|
goto err;
|
||||||
|
if (msg_len > MSGMAXLEN)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if ((M_buf = malloc(msg_len + MSTART)) == 0)
|
||||||
|
goto err;
|
||||||
|
memcpy(M_buf + MSTART, msg, msg_len);
|
||||||
|
|
||||||
|
if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, NULL, 0,
|
||||||
|
customization_label, customization_label_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (generalized_commit(R_bytes, r_scalar, labelset, labelset_len, NULL, 0,
|
||||||
|
eddsa_25519_pubkey_bytes, eddsa_25519_privkey_scalar,
|
||||||
|
random, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (generalized_challenge(h_scalar, labelset, labelset_len, NULL, 0,
|
||||||
|
R_bytes, eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (generalized_prove(s_scalar, r_scalar, eddsa_25519_privkey_scalar, h_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
memcpy(signature_out, R_bytes, POINTLEN);
|
||||||
|
memcpy(signature_out + POINTLEN, s_scalar, SCALARLEN);
|
||||||
|
|
||||||
|
zeroize(r_scalar, SCALARLEN);
|
||||||
|
zeroize_stack();
|
||||||
|
free(M_buf);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
zeroize(r_scalar, SCALARLEN);
|
||||||
|
zeroize_stack();
|
||||||
|
free(M_buf);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_eddsa_25519_verify(
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char labelset[LABELSETMAXLEN];
|
||||||
|
unsigned long labelset_len = 0;
|
||||||
|
const unsigned char* R_bytes = NULL;
|
||||||
|
const unsigned char* s_scalar = NULL;
|
||||||
|
unsigned char h_scalar[SCALARLEN];
|
||||||
|
unsigned char* M_buf = NULL;
|
||||||
|
unsigned char R_calc_bytes[POINTLEN];
|
||||||
|
|
||||||
|
if (signature == NULL)
|
||||||
|
goto err;
|
||||||
|
if (eddsa_25519_pubkey_bytes == NULL)
|
||||||
|
goto err;
|
||||||
|
if (msg == NULL)
|
||||||
|
goto err;
|
||||||
|
if (customization_label == NULL && customization_label_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (customization_label_len > LABELMAXLEN)
|
||||||
|
goto err;
|
||||||
|
if (msg_len > MSGMAXLEN)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if ((M_buf = malloc(msg_len + MSTART)) == 0)
|
||||||
|
goto err;
|
||||||
|
memcpy(M_buf + MSTART, msg, msg_len);
|
||||||
|
|
||||||
|
if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN, NULL, 0,
|
||||||
|
customization_label, customization_label_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
R_bytes = signature;
|
||||||
|
s_scalar = signature + POINTLEN;
|
||||||
|
|
||||||
|
if (!point_isreduced(eddsa_25519_pubkey_bytes))
|
||||||
|
goto err;
|
||||||
|
if (!point_isreduced(R_bytes))
|
||||||
|
goto err;
|
||||||
|
if (!sc_isreduced(s_scalar))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (generalized_challenge(h_scalar, labelset, labelset_len,
|
||||||
|
NULL, 0, R_bytes, eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (generalized_solve_commitment(R_calc_bytes, NULL, NULL,
|
||||||
|
s_scalar, eddsa_25519_pubkey_bytes, h_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if (crypto_verify_32(R_bytes, R_calc_bytes) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
free(M_buf);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
free(M_buf);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
65
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_eddsa.h
Executable file
65
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_eddsa.h
Executable file
|
|
@ -0,0 +1,65 @@
|
||||||
|
#ifndef __GEN_EDDSA_H__
|
||||||
|
#define __GEN_EDDSA_H__
|
||||||
|
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/* B: base point
|
||||||
|
R: commitment (point),
|
||||||
|
r: private nonce (scalar)
|
||||||
|
K: encoded public key
|
||||||
|
k: private key (scalar)
|
||||||
|
Z: 32-bytes random
|
||||||
|
M: buffer containing message, message starts at M_start, continues for M_len
|
||||||
|
|
||||||
|
r = hash(B || labelset || Z || pad1 || k || pad2 || labelset || K || extra || M) (mod q)
|
||||||
|
*/
|
||||||
|
int generalized_commit(unsigned char* R_bytes, unsigned char* r_scalar,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const unsigned char* extra, const unsigned long extra_len,
|
||||||
|
const unsigned char* K_bytes, const unsigned char* k_scalar,
|
||||||
|
const unsigned char* Z,
|
||||||
|
unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len);
|
||||||
|
|
||||||
|
/* if is_labelset_empty(labelset):
|
||||||
|
return hash(R || K || M) (mod q)
|
||||||
|
else:
|
||||||
|
return hash(B || labelset || R || labelset || K || extra || M) (mod q)
|
||||||
|
*/
|
||||||
|
int generalized_challenge(unsigned char* h_scalar,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const unsigned char* extra, const unsigned long extra_len,
|
||||||
|
const unsigned char* R_bytes,
|
||||||
|
const unsigned char* K_bytes,
|
||||||
|
unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len);
|
||||||
|
|
||||||
|
/* return r + kh (mod q) */
|
||||||
|
int generalized_prove(unsigned char* out_scalar,
|
||||||
|
const unsigned char* r_scalar,
|
||||||
|
const unsigned char* k_scalar,
|
||||||
|
const unsigned char* h_scalar);
|
||||||
|
|
||||||
|
/* R = B^s / K^h */
|
||||||
|
int generalized_solve_commitment(unsigned char* R_bytes_out, ge_p3* K_point_out,
|
||||||
|
const ge_p3* B_point, const unsigned char* s_scalar,
|
||||||
|
const unsigned char* K_bytes, const unsigned char* h_scalar);
|
||||||
|
|
||||||
|
|
||||||
|
int generalized_eddsa_25519_sign(
|
||||||
|
unsigned char* signature_out,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* eddsa_25519_privkey_scalar,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
int generalized_eddsa_25519_verify(
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* eddsa_25519_pubkey,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
#endif
|
||||||
157
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_labelset.c
Executable file
157
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_labelset.c
Executable file
|
|
@ -0,0 +1,157 @@
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include "gen_labelset.h"
|
||||||
|
#include "gen_constants.h"
|
||||||
|
|
||||||
|
const unsigned char B_bytes[] = {
|
||||||
|
0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||||
|
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||||
|
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||||
|
0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
|
||||||
|
};
|
||||||
|
|
||||||
|
unsigned char* buffer_add(unsigned char* bufptr, const unsigned char* bufend,
|
||||||
|
const unsigned char* in, const unsigned long in_len)
|
||||||
|
{
|
||||||
|
unsigned long count = 0;
|
||||||
|
|
||||||
|
if (bufptr == NULL || bufend == NULL || bufptr > bufend)
|
||||||
|
return NULL;
|
||||||
|
if (in == NULL && in_len != 0)
|
||||||
|
return NULL;
|
||||||
|
if (bufend - bufptr < in_len)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
for (count=0; count < in_len; count++) {
|
||||||
|
if (bufptr >= bufend)
|
||||||
|
return NULL;
|
||||||
|
*bufptr++ = *in++;
|
||||||
|
}
|
||||||
|
return bufptr;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned char* buffer_pad(const unsigned char* buf, unsigned char* bufptr, const unsigned char* bufend)
|
||||||
|
{
|
||||||
|
unsigned long count = 0;
|
||||||
|
unsigned long pad_len = 0;
|
||||||
|
|
||||||
|
if (buf == NULL || bufptr == NULL || bufend == NULL || bufptr >= bufend || bufptr < buf)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
pad_len = (BLOCKLEN - ((bufptr-buf) % BLOCKLEN)) % BLOCKLEN;
|
||||||
|
if (bufend - bufptr < pad_len)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
for (count=0; count < pad_len; count++) {
|
||||||
|
if (bufptr >= bufend)
|
||||||
|
return NULL;
|
||||||
|
*bufptr++ = 0;
|
||||||
|
}
|
||||||
|
return bufptr;
|
||||||
|
}
|
||||||
|
|
||||||
|
int labelset_new(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen,
|
||||||
|
const unsigned char* protocol_name, const unsigned char protocol_name_len,
|
||||||
|
const unsigned char* customization_label, const unsigned char customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char* bufptr;
|
||||||
|
|
||||||
|
*labelset_len = 0;
|
||||||
|
if (labelset == NULL)
|
||||||
|
return -1;
|
||||||
|
if (labelset_len == NULL)
|
||||||
|
return -1;
|
||||||
|
if (labelset_maxlen > LABELSETMAXLEN)
|
||||||
|
return -1;
|
||||||
|
if (labelset_maxlen < 3 + protocol_name_len + customization_label_len)
|
||||||
|
return -1;
|
||||||
|
if (protocol_name == NULL && protocol_name_len != 0)
|
||||||
|
return -1;
|
||||||
|
if (customization_label == NULL && customization_label_len != 0)
|
||||||
|
return -1;
|
||||||
|
if (protocol_name_len > LABELMAXLEN)
|
||||||
|
return -1;
|
||||||
|
if (customization_label_len > LABELMAXLEN)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
bufptr = labelset;
|
||||||
|
*bufptr++ = 2;
|
||||||
|
*bufptr++ = protocol_name_len;
|
||||||
|
bufptr = buffer_add(bufptr, labelset + labelset_maxlen, protocol_name, protocol_name_len);
|
||||||
|
if (bufptr != NULL && bufptr < labelset + labelset_maxlen)
|
||||||
|
*bufptr++ = customization_label_len;
|
||||||
|
bufptr = buffer_add(bufptr, labelset + labelset_maxlen,
|
||||||
|
customization_label, customization_label_len);
|
||||||
|
|
||||||
|
if (bufptr != NULL && bufptr - labelset == 3 + protocol_name_len + customization_label_len) {
|
||||||
|
*labelset_len = bufptr - labelset;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
int labelset_add(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen,
|
||||||
|
const unsigned char* label, const unsigned char label_len)
|
||||||
|
{
|
||||||
|
unsigned char* bufptr;
|
||||||
|
if (labelset_len == NULL)
|
||||||
|
return -1;
|
||||||
|
if (*labelset_len > LABELSETMAXLEN || labelset_maxlen > LABELSETMAXLEN)
|
||||||
|
return -1;
|
||||||
|
if (*labelset_len >= labelset_maxlen || *labelset_len + label_len + 1 > labelset_maxlen)
|
||||||
|
return -1;
|
||||||
|
if (*labelset_len < 3 || labelset_maxlen < 4)
|
||||||
|
return -1;
|
||||||
|
if (label_len > LABELMAXLEN)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
labelset[0]++;
|
||||||
|
labelset[*labelset_len] = label_len;
|
||||||
|
bufptr = labelset + *labelset_len + 1;
|
||||||
|
bufptr = buffer_add(bufptr, labelset + labelset_maxlen, label, label_len);
|
||||||
|
if (bufptr == NULL)
|
||||||
|
return -1;
|
||||||
|
if (bufptr - labelset >= labelset_maxlen)
|
||||||
|
return -1;
|
||||||
|
if (bufptr - labelset != *labelset_len + 1 + label_len)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
*labelset_len += (1 + label_len);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int labelset_validate(const unsigned char* labelset, const unsigned long labelset_len)
|
||||||
|
{
|
||||||
|
unsigned char num_labels = 0;
|
||||||
|
unsigned char count = 0;
|
||||||
|
unsigned long offset = 0;
|
||||||
|
unsigned char label_len = 0;
|
||||||
|
|
||||||
|
if (labelset == NULL)
|
||||||
|
return -1;
|
||||||
|
if (labelset_len < 3 || labelset_len > LABELSETMAXLEN)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
num_labels = labelset[0];
|
||||||
|
offset = 1;
|
||||||
|
for (count = 0; count < num_labels; count++) {
|
||||||
|
label_len = labelset[offset];
|
||||||
|
if (label_len > LABELMAXLEN)
|
||||||
|
return -1;
|
||||||
|
offset += 1 + label_len;
|
||||||
|
if (offset > labelset_len)
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (offset != labelset_len)
|
||||||
|
return -1;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int labelset_is_empty(const unsigned char* labelset, const unsigned long labelset_len)
|
||||||
|
{
|
||||||
|
if (labelset_len != 3)
|
||||||
|
return 0;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
23
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_labelset.h
Executable file
23
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_labelset.h
Executable file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#ifndef __GEN_LABELSET_H__
|
||||||
|
#define __GEN_LABELSET_H__
|
||||||
|
|
||||||
|
extern const unsigned char B_bytes[];
|
||||||
|
|
||||||
|
unsigned char* buffer_add(unsigned char* bufptr, const unsigned char* bufend,
|
||||||
|
const unsigned char* in, const unsigned long in_len);
|
||||||
|
|
||||||
|
unsigned char* buffer_pad(const unsigned char* buf, unsigned char* bufptr, const unsigned char* bufend);
|
||||||
|
|
||||||
|
|
||||||
|
int labelset_new(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen,
|
||||||
|
const unsigned char* protocol_name, const unsigned char protocol_name_len,
|
||||||
|
const unsigned char* customization_label, const unsigned char customization_label_len);
|
||||||
|
|
||||||
|
int labelset_add(unsigned char* labelset, unsigned long* labelset_len, const unsigned long labelset_maxlen,
|
||||||
|
const unsigned char* label, const unsigned char label_len);
|
||||||
|
|
||||||
|
int labelset_validate(const unsigned char* labelset, const unsigned long labelset_len);
|
||||||
|
|
||||||
|
int labelset_is_empty(const unsigned char* labelset, const unsigned long labelset_len);
|
||||||
|
|
||||||
|
#endif
|
||||||
312
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_veddsa.c
Executable file
312
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_veddsa.c
Executable file
|
|
@ -0,0 +1,312 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "gen_eddsa.h"
|
||||||
|
#include "gen_veddsa.h"
|
||||||
|
#include "gen_constants.h"
|
||||||
|
#include "gen_labelset.h"
|
||||||
|
#include "gen_crypto_additions.h"
|
||||||
|
#include "crypto_hash_sha512.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "zeroize.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "sc.h"
|
||||||
|
#include "utility.h"
|
||||||
|
|
||||||
|
static int generalized_calculate_Bv(ge_p3* Bv_point,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const unsigned char* K_bytes,
|
||||||
|
unsigned char* M_buf, const unsigned long M_start, const unsigned long M_len)
|
||||||
|
{
|
||||||
|
unsigned char* bufptr;
|
||||||
|
unsigned long prefix_len = 0;
|
||||||
|
|
||||||
|
if (labelset_validate(labelset, labelset_len) != 0)
|
||||||
|
return -1;
|
||||||
|
if (Bv_point == NULL || K_bytes == NULL || M_buf == NULL)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
prefix_len = 2*POINTLEN + labelset_len;
|
||||||
|
if (prefix_len > M_start)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
bufptr = M_buf + M_start - prefix_len;
|
||||||
|
bufptr = buffer_add(bufptr, M_buf + M_start, B_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, M_buf + M_start, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, M_buf + M_start, K_bytes, POINTLEN);
|
||||||
|
if (bufptr == NULL || bufptr != M_buf + M_start)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
hash_to_point(Bv_point, M_buf + M_start - prefix_len, prefix_len + M_len);
|
||||||
|
if (ge_isneutral(Bv_point))
|
||||||
|
return -1;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int generalized_calculate_vrf_output(unsigned char* vrf_output,
|
||||||
|
const unsigned char* labelset, const unsigned long labelset_len,
|
||||||
|
const ge_p3* cKv_point)
|
||||||
|
{
|
||||||
|
unsigned char buf[BUFLEN];
|
||||||
|
unsigned char* bufptr = buf;
|
||||||
|
unsigned char* bufend = buf + BUFLEN;
|
||||||
|
unsigned char cKv_bytes[POINTLEN];
|
||||||
|
unsigned char hash[HASHLEN];
|
||||||
|
|
||||||
|
if (vrf_output == NULL)
|
||||||
|
return -1;
|
||||||
|
memset(vrf_output, 0, VRFOUTPUTLEN);
|
||||||
|
|
||||||
|
if (labelset_len + 2*POINTLEN > BUFLEN)
|
||||||
|
return -1;
|
||||||
|
if (labelset_validate(labelset, labelset_len) != 0)
|
||||||
|
return -1;
|
||||||
|
if (cKv_point == NULL)
|
||||||
|
return -1;
|
||||||
|
if (VRFOUTPUTLEN > HASHLEN)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
ge_p3_tobytes(cKv_bytes, cKv_point);
|
||||||
|
|
||||||
|
bufptr = buffer_add(bufptr, bufend, B_bytes, POINTLEN);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, labelset, labelset_len);
|
||||||
|
bufptr = buffer_add(bufptr, bufend, cKv_bytes, POINTLEN);
|
||||||
|
if (bufptr == NULL)
|
||||||
|
return -1;
|
||||||
|
if (bufptr - buf > BUFLEN)
|
||||||
|
return -1;
|
||||||
|
crypto_hash_sha512(hash, buf, bufptr - buf);
|
||||||
|
memcpy(vrf_output, hash, VRFOUTPUTLEN);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_veddsa_25519_sign(
|
||||||
|
unsigned char* signature_out,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* eddsa_25519_privkey_scalar,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char labelset[LABELSETMAXLEN];
|
||||||
|
unsigned long labelset_len = 0;
|
||||||
|
ge_p3 Bv_point;
|
||||||
|
ge_p3 Kv_point;
|
||||||
|
ge_p3 Rv_point;
|
||||||
|
unsigned char Bv_bytes[POINTLEN];
|
||||||
|
unsigned char Kv_bytes[POINTLEN];
|
||||||
|
unsigned char Rv_bytes[POINTLEN];
|
||||||
|
unsigned char R_bytes[POINTLEN];
|
||||||
|
unsigned char r_scalar[SCALARLEN];
|
||||||
|
unsigned char h_scalar[SCALARLEN];
|
||||||
|
unsigned char s_scalar[SCALARLEN];
|
||||||
|
unsigned char extra[3*POINTLEN];
|
||||||
|
unsigned char* M_buf = NULL;
|
||||||
|
char* protocol_name = "VEdDSA_25519_SHA512_Elligator2";
|
||||||
|
|
||||||
|
if (signature_out == NULL)
|
||||||
|
goto err;
|
||||||
|
memset(signature_out, 0, VRFSIGNATURELEN);
|
||||||
|
|
||||||
|
if (eddsa_25519_pubkey_bytes == NULL)
|
||||||
|
goto err;
|
||||||
|
if (eddsa_25519_privkey_scalar == NULL)
|
||||||
|
goto err;
|
||||||
|
if (msg == NULL)
|
||||||
|
goto err;
|
||||||
|
if (customization_label == NULL && customization_label_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (customization_label_len > LABELMAXLEN)
|
||||||
|
goto err;
|
||||||
|
if (msg_len > MSGMAXLEN)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if ((M_buf = malloc(msg_len + MSTART)) == 0) {
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
memcpy(M_buf + MSTART, msg, msg_len);
|
||||||
|
|
||||||
|
// labelset = new_labelset(protocol_name, customization_label)
|
||||||
|
if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN,
|
||||||
|
(unsigned char*)protocol_name, strlen(protocol_name),
|
||||||
|
customization_label, customization_label_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// labelset1 = add_label(labels, "1")
|
||||||
|
// Bv = hash(hash(labelset1 || K) || M)
|
||||||
|
// Kv = k * Bv
|
||||||
|
labelset_add(labelset, &labelset_len, LABELSETMAXLEN, (unsigned char*)"1", 1);
|
||||||
|
if (generalized_calculate_Bv(&Bv_point, labelset, labelset_len,
|
||||||
|
eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
ge_scalarmult(&Kv_point, eddsa_25519_privkey_scalar, &Bv_point);
|
||||||
|
ge_p3_tobytes(Bv_bytes, &Bv_point);
|
||||||
|
ge_p3_tobytes(Kv_bytes, &Kv_point);
|
||||||
|
|
||||||
|
// labelset2 = add_label(labels, "2")
|
||||||
|
// R, r = commit(labelset2, (Bv || Kv), (K,k), Z, M)
|
||||||
|
labelset[labelset_len-1] = (unsigned char)'2';
|
||||||
|
memcpy(extra, Bv_bytes, POINTLEN);
|
||||||
|
memcpy(extra + POINTLEN, Kv_bytes, POINTLEN);
|
||||||
|
if (generalized_commit(R_bytes, r_scalar,
|
||||||
|
labelset, labelset_len,
|
||||||
|
extra, 2*POINTLEN,
|
||||||
|
eddsa_25519_pubkey_bytes, eddsa_25519_privkey_scalar,
|
||||||
|
random, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// Rv = r * Bv
|
||||||
|
ge_scalarmult(&Rv_point, r_scalar, &Bv_point);
|
||||||
|
ge_p3_tobytes(Rv_bytes, &Rv_point);
|
||||||
|
|
||||||
|
// labelset3 = add_label(labels, "3")
|
||||||
|
// h = challenge(labelset3, (Bv || Kv || Rv), R, K, M)
|
||||||
|
labelset[labelset_len-1] = (unsigned char)'3';
|
||||||
|
memcpy(extra + 2*POINTLEN, Rv_bytes, POINTLEN);
|
||||||
|
if (generalized_challenge(h_scalar,
|
||||||
|
labelset, labelset_len,
|
||||||
|
extra, 3*POINTLEN,
|
||||||
|
R_bytes, eddsa_25519_pubkey_bytes,
|
||||||
|
M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// s = prove(r, k, h)
|
||||||
|
if (generalized_prove(s_scalar, r_scalar, eddsa_25519_privkey_scalar, h_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// return (Kv || h || s)
|
||||||
|
memcpy(signature_out, Kv_bytes, POINTLEN);
|
||||||
|
memcpy(signature_out + POINTLEN, h_scalar, SCALARLEN);
|
||||||
|
memcpy(signature_out + POINTLEN + SCALARLEN, s_scalar, SCALARLEN);
|
||||||
|
|
||||||
|
zeroize(r_scalar, SCALARLEN);
|
||||||
|
zeroize_stack();
|
||||||
|
free(M_buf);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
zeroize(r_scalar, SCALARLEN);
|
||||||
|
zeroize_stack();
|
||||||
|
free(M_buf);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_veddsa_25519_verify(
|
||||||
|
unsigned char* vrf_out,
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char labelset[LABELSETMAXLEN];
|
||||||
|
unsigned long labelset_len = 0;
|
||||||
|
const unsigned char* Kv_bytes;
|
||||||
|
const unsigned char* h_scalar;
|
||||||
|
const unsigned char* s_scalar;
|
||||||
|
ge_p3 Bv_point, K_point, Kv_point, cK_point, cKv_point;
|
||||||
|
unsigned char Bv_bytes[POINTLEN];
|
||||||
|
unsigned char R_calc_bytes[POINTLEN];
|
||||||
|
unsigned char Rv_calc_bytes[POINTLEN];
|
||||||
|
unsigned char h_calc_scalar[SCALARLEN];
|
||||||
|
unsigned char extra[3*POINTLEN];
|
||||||
|
unsigned char* M_buf = NULL;
|
||||||
|
char* protocol_name = "VEdDSA_25519_SHA512_Elligator2";
|
||||||
|
|
||||||
|
if (vrf_out == NULL)
|
||||||
|
goto err;
|
||||||
|
memset(vrf_out, 0, VRFOUTPUTLEN);
|
||||||
|
|
||||||
|
if (signature == NULL)
|
||||||
|
goto err;
|
||||||
|
if (eddsa_25519_pubkey_bytes == NULL)
|
||||||
|
goto err;
|
||||||
|
if (msg == NULL)
|
||||||
|
goto err;
|
||||||
|
if (customization_label == NULL && customization_label_len != 0)
|
||||||
|
goto err;
|
||||||
|
if (customization_label_len > LABELMAXLEN)
|
||||||
|
goto err;
|
||||||
|
if (msg_len > MSGMAXLEN)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
if ((M_buf = malloc(msg_len + MSTART)) == 0) {
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
memcpy(M_buf + MSTART, msg, msg_len);
|
||||||
|
|
||||||
|
Kv_bytes = signature;
|
||||||
|
h_scalar = signature + POINTLEN;
|
||||||
|
s_scalar = signature + POINTLEN + SCALARLEN;
|
||||||
|
|
||||||
|
if (!point_isreduced(eddsa_25519_pubkey_bytes))
|
||||||
|
goto err;
|
||||||
|
if (!point_isreduced(Kv_bytes))
|
||||||
|
goto err;
|
||||||
|
if (!sc_isreduced(h_scalar))
|
||||||
|
goto err;
|
||||||
|
if (!sc_isreduced(s_scalar))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// labelset = new_labelset(protocol_name, customization_label)
|
||||||
|
if (labelset_new(labelset, &labelset_len, LABELSETMAXLEN,
|
||||||
|
(unsigned char*)protocol_name, strlen(protocol_name),
|
||||||
|
customization_label, customization_label_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// labelset1 = add_label(labels, "1")
|
||||||
|
// Bv = hash(hash(labelset1 || K) || M)
|
||||||
|
labelset_add(labelset, &labelset_len, LABELSETMAXLEN, (unsigned char*)"1", 1);
|
||||||
|
if (generalized_calculate_Bv(&Bv_point, labelset, labelset_len,
|
||||||
|
eddsa_25519_pubkey_bytes, M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
ge_p3_tobytes(Bv_bytes, &Bv_point);
|
||||||
|
|
||||||
|
// R = solve_commitment(B, s, K, h)
|
||||||
|
if (generalized_solve_commitment(R_calc_bytes, &K_point, NULL,
|
||||||
|
s_scalar, eddsa_25519_pubkey_bytes, h_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// Rv = solve_commitment(Bv, s, Kv, h)
|
||||||
|
if (generalized_solve_commitment(Rv_calc_bytes, &Kv_point, &Bv_point,
|
||||||
|
s_scalar, Kv_bytes, h_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
ge_scalarmult_cofactor(&cK_point, &K_point);
|
||||||
|
ge_scalarmult_cofactor(&cKv_point, &Kv_point);
|
||||||
|
if (ge_isneutral(&cK_point) || ge_isneutral(&cKv_point) || ge_isneutral(&Bv_point))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// labelset3 = add_label(labels, "3")
|
||||||
|
// h = challenge(labelset3, (Bv || Kv || Rv), R, K, M)
|
||||||
|
labelset[labelset_len-1] = (unsigned char)'3';
|
||||||
|
memcpy(extra, Bv_bytes, POINTLEN);
|
||||||
|
memcpy(extra + POINTLEN, Kv_bytes, POINTLEN);
|
||||||
|
memcpy(extra + 2*POINTLEN, Rv_calc_bytes, POINTLEN);
|
||||||
|
if (generalized_challenge(h_calc_scalar,
|
||||||
|
labelset, labelset_len,
|
||||||
|
extra, 3*POINTLEN,
|
||||||
|
R_calc_bytes, eddsa_25519_pubkey_bytes,
|
||||||
|
M_buf, MSTART, msg_len) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// if bytes_equal(h, h')
|
||||||
|
if (crypto_verify_32(h_scalar, h_calc_scalar) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
// labelset4 = add_label(labels, "4")
|
||||||
|
// v = hash(labelset4 || c*Kv)
|
||||||
|
labelset[labelset_len-1] = (unsigned char)'4';
|
||||||
|
if (generalized_calculate_vrf_output(vrf_out, labelset, labelset_len, &cKv_point) != 0)
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
free(M_buf);
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
err:
|
||||||
|
free(M_buf);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
23
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_veddsa.h
Executable file
23
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_veddsa.h
Executable file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#ifndef __GEN_VEDDSA_H__
|
||||||
|
#define __GEN_VEDDSA_H__
|
||||||
|
|
||||||
|
int generalized_veddsa_25519_sign(
|
||||||
|
unsigned char* signature_out,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* eddsa_25519_privkey_scalar,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
int generalized_veddsa_25519_verify(
|
||||||
|
unsigned char* vrf_out,
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* eddsa_25519_pubkey_bytes,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
#endif
|
||||||
131
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_x.c
Executable file
131
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_x.c
Executable file
|
|
@ -0,0 +1,131 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "gen_x.h"
|
||||||
|
#include "gen_constants.h"
|
||||||
|
#include "gen_eddsa.h"
|
||||||
|
#include "gen_veddsa.h"
|
||||||
|
#include "gen_crypto_additions.h"
|
||||||
|
#include "zeroize.h"
|
||||||
|
|
||||||
|
static int convert_25519_pubkey(unsigned char* ed_pubkey_bytes, const unsigned char* x25519_pubkey_bytes) {
|
||||||
|
fe u;
|
||||||
|
fe y;
|
||||||
|
|
||||||
|
/* Convert the X25519 public key into an Ed25519 public key.
|
||||||
|
|
||||||
|
y = (u - 1) / (u + 1)
|
||||||
|
|
||||||
|
NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp
|
||||||
|
*/
|
||||||
|
if (!fe_isreduced(x25519_pubkey_bytes))
|
||||||
|
return -1;
|
||||||
|
fe_frombytes(u, x25519_pubkey_bytes);
|
||||||
|
fe_montx_to_edy(y, u);
|
||||||
|
fe_tobytes(ed_pubkey_bytes, y);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int calculate_25519_keypair(unsigned char* K_bytes, unsigned char* k_scalar,
|
||||||
|
const unsigned char* x25519_privkey_scalar)
|
||||||
|
{
|
||||||
|
unsigned char kneg[SCALARLEN];
|
||||||
|
ge_p3 ed_pubkey_point;
|
||||||
|
unsigned char sign_bit = 0;
|
||||||
|
|
||||||
|
if (SCALARLEN != 32)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
/* Convert the Curve25519 privkey to an Ed25519 public key */
|
||||||
|
ge_scalarmult_base(&ed_pubkey_point, x25519_privkey_scalar);
|
||||||
|
ge_p3_tobytes(K_bytes, &ed_pubkey_point);
|
||||||
|
|
||||||
|
/* Force Edwards sign bit to zero */
|
||||||
|
sign_bit = (K_bytes[31] & 0x80) >> 7;
|
||||||
|
memcpy(k_scalar, x25519_privkey_scalar, 32);
|
||||||
|
sc_neg(kneg, k_scalar);
|
||||||
|
sc_cmov(k_scalar, kneg, sign_bit);
|
||||||
|
K_bytes[31] &= 0x7F;
|
||||||
|
|
||||||
|
zeroize(kneg, SCALARLEN);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_xeddsa_25519_sign(unsigned char* signature_out,
|
||||||
|
const unsigned char* x25519_privkey_scalar,
|
||||||
|
const unsigned char* msg, const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char K_bytes[POINTLEN];
|
||||||
|
unsigned char k_scalar[SCALARLEN];
|
||||||
|
int retval = -1;
|
||||||
|
|
||||||
|
if (calculate_25519_keypair(K_bytes, k_scalar, x25519_privkey_scalar) != 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
retval = generalized_eddsa_25519_sign(signature_out,
|
||||||
|
K_bytes, k_scalar,
|
||||||
|
msg, msg_len, random,
|
||||||
|
customization_label, customization_label_len);
|
||||||
|
zeroize(k_scalar, SCALARLEN);
|
||||||
|
return retval;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_xveddsa_25519_sign(
|
||||||
|
unsigned char* signature_out,
|
||||||
|
const unsigned char* x25519_privkey_scalar,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char K_bytes[POINTLEN];
|
||||||
|
unsigned char k_scalar[SCALARLEN];
|
||||||
|
int retval = -1;
|
||||||
|
|
||||||
|
if (calculate_25519_keypair(K_bytes, k_scalar, x25519_privkey_scalar) != 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
retval = generalized_veddsa_25519_sign(signature_out, K_bytes, k_scalar,
|
||||||
|
msg, msg_len, random,
|
||||||
|
customization_label, customization_label_len);
|
||||||
|
zeroize(k_scalar, SCALARLEN);
|
||||||
|
return retval;
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_xeddsa_25519_verify(
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* x25519_pubkey_bytes,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char K_bytes[POINTLEN];
|
||||||
|
|
||||||
|
if (convert_25519_pubkey(K_bytes, x25519_pubkey_bytes) != 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
return generalized_eddsa_25519_verify(signature, K_bytes, msg, msg_len,
|
||||||
|
customization_label, customization_label_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
int generalized_xveddsa_25519_verify(
|
||||||
|
unsigned char* vrf_out,
|
||||||
|
const unsigned char* signature,
|
||||||
|
const unsigned char* x25519_pubkey_bytes,
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len)
|
||||||
|
{
|
||||||
|
unsigned char K_bytes[POINTLEN];
|
||||||
|
|
||||||
|
if (convert_25519_pubkey(K_bytes, x25519_pubkey_bytes) != 0)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
return generalized_veddsa_25519_verify(vrf_out, signature, K_bytes, msg, msg_len,
|
||||||
|
customization_label, customization_label_len);
|
||||||
|
}
|
||||||
37
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_x.h
Executable file
37
Sources/libsignal/curve25519/ed25519/additions/generalized/gen_x.h
Executable file
|
|
@ -0,0 +1,37 @@
|
||||||
|
#ifndef __GEN_X_H
|
||||||
|
#define __GEN_X_H
|
||||||
|
|
||||||
|
int generalized_xeddsa_25519_sign(unsigned char* signature_out, /* 64 bytes */
|
||||||
|
const unsigned char* x25519_privkey_scalar, /* 32 bytes */
|
||||||
|
const unsigned char* msg, const unsigned long msg_len,
|
||||||
|
const unsigned char* random, /* 32 bytes */
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
int generalized_xeddsa_25519_verify(
|
||||||
|
const unsigned char* signature, /* 64 bytes */
|
||||||
|
const unsigned char* x25519_pubkey_bytes, /* 32 bytes */
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
int generalized_xveddsa_25519_sign(
|
||||||
|
unsigned char* signature_out, /* 96 bytes */
|
||||||
|
const unsigned char* x25519_privkey_scalar, /* 32 bytes */
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* random, /* 32 bytes */
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
int generalized_xveddsa_25519_verify(
|
||||||
|
unsigned char* vrf_out, /* 32 bytes */
|
||||||
|
const unsigned char* signature, /* 96 bytes */
|
||||||
|
const unsigned char* x25519_pubkey_bytes, /* 32 bytes */
|
||||||
|
const unsigned char* msg,
|
||||||
|
const unsigned long msg_len,
|
||||||
|
const unsigned char* customization_label,
|
||||||
|
const unsigned long customization_label_len);
|
||||||
|
|
||||||
|
#endif
|
||||||
12
Sources/libsignal/curve25519/ed25519/additions/generalized/point_isreduced.c
Executable file
12
Sources/libsignal/curve25519/ed25519/additions/generalized/point_isreduced.c
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
#include<string.h>
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
int point_isreduced(const unsigned char* p)
|
||||||
|
{
|
||||||
|
unsigned char strict[32];
|
||||||
|
|
||||||
|
memmove(strict, p, 32);
|
||||||
|
strict[31] &= 0x7F; /* mask off sign bit */
|
||||||
|
return fe_isreduced(strict);
|
||||||
|
}
|
||||||
17
Sources/libsignal/curve25519/ed25519/additions/generalized/sc_isreduced.c
Executable file
17
Sources/libsignal/curve25519/ed25519/additions/generalized/sc_isreduced.c
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "fe.h"
|
||||||
|
#include "sc.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
|
||||||
|
int sc_isreduced(const unsigned char* s)
|
||||||
|
{
|
||||||
|
unsigned char strict[64];
|
||||||
|
|
||||||
|
memset(strict, 0, 64);
|
||||||
|
memmove(strict, s, 32);
|
||||||
|
sc_reduce(strict);
|
||||||
|
if (crypto_verify_32(strict, s) != 0)
|
||||||
|
return 0;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
21
Sources/libsignal/curve25519/ed25519/additions/keygen.c
Executable file
21
Sources/libsignal/curve25519/ed25519/additions/keygen.c
Executable file
|
|
@ -0,0 +1,21 @@
|
||||||
|
#include "ge.h"
|
||||||
|
#include "keygen.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
void curve25519_keygen(unsigned char* curve25519_pubkey_out,
|
||||||
|
const unsigned char* curve25519_privkey_in)
|
||||||
|
{
|
||||||
|
/* Perform a fixed-base multiplication of the Edwards base point,
|
||||||
|
(which is efficient due to precalculated tables), then convert
|
||||||
|
to the Curve25519 montgomery-format public key.
|
||||||
|
|
||||||
|
NOTE: y=1 is converted to u=0 since fe_invert is mod-exp
|
||||||
|
*/
|
||||||
|
|
||||||
|
ge_p3 ed; /* Ed25519 pubkey point */
|
||||||
|
fe u;
|
||||||
|
|
||||||
|
ge_scalarmult_base(&ed, curve25519_privkey_in);
|
||||||
|
ge_p3_to_montx(u, &ed);
|
||||||
|
fe_tobytes(curve25519_pubkey_out, u);
|
||||||
|
}
|
||||||
12
Sources/libsignal/curve25519/ed25519/additions/keygen.h
Executable file
12
Sources/libsignal/curve25519/ed25519/additions/keygen.h
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
|
||||||
|
#ifndef __KEYGEN_H__
|
||||||
|
#define __KEYGEN_H__
|
||||||
|
|
||||||
|
/* Sets and clears bits to make a random 32 bytes into a private key */
|
||||||
|
void sc_clamp(unsigned char* a);
|
||||||
|
|
||||||
|
/* The private key should be 32 random bytes "clamped" by sc_clamp() */
|
||||||
|
void curve25519_keygen(unsigned char* curve25519_pubkey_out, /* 32 bytes */
|
||||||
|
const unsigned char* curve25519_privkey_in); /* 32 bytes */
|
||||||
|
|
||||||
|
#endif
|
||||||
45
Sources/libsignal/curve25519/ed25519/additions/open_modified.c
Executable file
45
Sources/libsignal/curve25519/ed25519/additions/open_modified.c
Executable file
|
|
@ -0,0 +1,45 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "crypto_sign.h"
|
||||||
|
#include "crypto_hash_sha512.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "sc.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
int crypto_sign_open_modified(
|
||||||
|
unsigned char *m,
|
||||||
|
const unsigned char *sm,unsigned long long smlen,
|
||||||
|
const unsigned char *pk
|
||||||
|
)
|
||||||
|
{
|
||||||
|
unsigned char pkcopy[32];
|
||||||
|
unsigned char rcopy[32];
|
||||||
|
unsigned char scopy[32];
|
||||||
|
unsigned char h[64];
|
||||||
|
unsigned char rcheck[32];
|
||||||
|
ge_p3 A;
|
||||||
|
ge_p2 R;
|
||||||
|
|
||||||
|
if (smlen < 64) goto badsig;
|
||||||
|
if (sm[63] & 224) goto badsig; /* strict parsing of s */
|
||||||
|
if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
|
||||||
|
|
||||||
|
memmove(pkcopy,pk,32);
|
||||||
|
memmove(rcopy,sm,32);
|
||||||
|
memmove(scopy,sm + 32,32);
|
||||||
|
|
||||||
|
memmove(m,sm,smlen);
|
||||||
|
memmove(m + 32,pkcopy,32);
|
||||||
|
crypto_hash_sha512(h,m,smlen);
|
||||||
|
sc_reduce(h);
|
||||||
|
|
||||||
|
ge_double_scalarmult_vartime(&R,h,&A,scopy);
|
||||||
|
ge_tobytes(rcheck,&R);
|
||||||
|
|
||||||
|
if (crypto_verify_32(rcheck,rcopy) == 0) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
badsig:
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
8
Sources/libsignal/curve25519/ed25519/additions/sc_clamp.c
Executable file
8
Sources/libsignal/curve25519/ed25519/additions/sc_clamp.c
Executable file
|
|
@ -0,0 +1,8 @@
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
void sc_clamp(unsigned char* a)
|
||||||
|
{
|
||||||
|
a[0] &= 248;
|
||||||
|
a[31] &= 127;
|
||||||
|
a[31] |= 64;
|
||||||
|
}
|
||||||
21
Sources/libsignal/curve25519/ed25519/additions/sc_cmov.c
Executable file
21
Sources/libsignal/curve25519/ed25519/additions/sc_cmov.c
Executable file
|
|
@ -0,0 +1,21 @@
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
Replace (f,g) with (g,g) if b == 1;
|
||||||
|
replace (f,g) with (f,g) if b == 0.
|
||||||
|
|
||||||
|
Preconditions: b in {0,1}.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void sc_cmov(unsigned char* f, const unsigned char* g, unsigned char b)
|
||||||
|
{
|
||||||
|
int count=32;
|
||||||
|
unsigned char x[32];
|
||||||
|
for (count=0; count < 32; count++)
|
||||||
|
x[count] = f[count] ^ g[count];
|
||||||
|
b = -b;
|
||||||
|
for (count=0; count < 32; count++)
|
||||||
|
x[count] &= b;
|
||||||
|
for (count=0; count < 32; count++)
|
||||||
|
f[count] = f[count] ^ x[count];
|
||||||
|
}
|
||||||
25
Sources/libsignal/curve25519/ed25519/additions/sc_neg.c
Executable file
25
Sources/libsignal/curve25519/ed25519/additions/sc_neg.c
Executable file
|
|
@ -0,0 +1,25 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "sc.h"
|
||||||
|
|
||||||
|
/* l = order of base point = 2^252 + 27742317777372353535851937790883648493 */
|
||||||
|
|
||||||
|
/*
|
||||||
|
static unsigned char l[32] = {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
|
||||||
|
0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
|
||||||
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0, 0x10};
|
||||||
|
*/
|
||||||
|
|
||||||
|
static unsigned char lminus1[32] = {0xec, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
|
||||||
|
0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
|
||||||
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10};
|
||||||
|
|
||||||
|
/* b = -a (mod l) */
|
||||||
|
void sc_neg(unsigned char *b, const unsigned char *a)
|
||||||
|
{
|
||||||
|
unsigned char zero[32];
|
||||||
|
memset(zero, 0, 32);
|
||||||
|
sc_muladd(b, lminus1, a, zero); /* b = (-1)a + 0 (mod l) */
|
||||||
|
}
|
||||||
53
Sources/libsignal/curve25519/ed25519/additions/sign_modified.c
Executable file
53
Sources/libsignal/curve25519/ed25519/additions/sign_modified.c
Executable file
|
|
@ -0,0 +1,53 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "crypto_sign.h"
|
||||||
|
#include "crypto_hash_sha512.h"
|
||||||
|
#include "ge.h"
|
||||||
|
#include "sc.h"
|
||||||
|
#include "zeroize.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
|
||||||
|
/* NEW: Compare to pristine crypto_sign()
|
||||||
|
Uses explicit private key for nonce derivation and as scalar,
|
||||||
|
instead of deriving both from a master key.
|
||||||
|
*/
|
||||||
|
int crypto_sign_modified(
|
||||||
|
unsigned char *sm,
|
||||||
|
const unsigned char *m,unsigned long long mlen,
|
||||||
|
const unsigned char *sk, const unsigned char* pk,
|
||||||
|
const unsigned char* random
|
||||||
|
)
|
||||||
|
{
|
||||||
|
unsigned char nonce[64];
|
||||||
|
unsigned char hram[64];
|
||||||
|
ge_p3 R;
|
||||||
|
int count=0;
|
||||||
|
|
||||||
|
memmove(sm + 64,m,mlen);
|
||||||
|
memmove(sm + 32,sk,32); /* NEW: Use privkey directly for nonce derivation */
|
||||||
|
|
||||||
|
/* NEW : add prefix to separate hash uses - see .h */
|
||||||
|
sm[0] = 0xFE;
|
||||||
|
for (count = 1; count < 32; count++)
|
||||||
|
sm[count] = 0xFF;
|
||||||
|
|
||||||
|
/* NEW: add suffix of random data */
|
||||||
|
memmove(sm + mlen + 64, random, 64);
|
||||||
|
|
||||||
|
crypto_hash_sha512(nonce,sm,mlen + 128);
|
||||||
|
memmove(sm + 32,pk,32);
|
||||||
|
|
||||||
|
sc_reduce(nonce);
|
||||||
|
|
||||||
|
ge_scalarmult_base(&R,nonce);
|
||||||
|
ge_p3_tobytes(sm,&R);
|
||||||
|
|
||||||
|
crypto_hash_sha512(hram,sm,mlen + 64);
|
||||||
|
sc_reduce(hram);
|
||||||
|
sc_muladd(sm + 32,hram,sk,nonce); /* NEW: Use privkey directly */
|
||||||
|
|
||||||
|
/* Erase any traces of private scalar or
|
||||||
|
nonce left in the stack from sc_muladd */
|
||||||
|
zeroize_stack();
|
||||||
|
zeroize(nonce, 64);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
29
Sources/libsignal/curve25519/ed25519/additions/utility.c
Executable file
29
Sources/libsignal/curve25519/ed25519/additions/utility.c
Executable file
|
|
@ -0,0 +1,29 @@
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include "utility.h"
|
||||||
|
|
||||||
|
void print_vector(const char* name, const unsigned char* v)
|
||||||
|
{
|
||||||
|
int count;
|
||||||
|
printf("%s = \n", name);
|
||||||
|
for (count = 0; count < 32; count++)
|
||||||
|
printf("%02x ", v[count]);
|
||||||
|
printf("\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
void print_bytes(const char* name, const unsigned char* v, int numbytes)
|
||||||
|
{
|
||||||
|
int count;
|
||||||
|
printf("%s = \n", name);
|
||||||
|
for (count = 0; count < numbytes; count++)
|
||||||
|
printf("%02x ", v[count]);
|
||||||
|
printf("\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
void print_fe(const char* name, const fe in)
|
||||||
|
{
|
||||||
|
unsigned char bytes[32];
|
||||||
|
fe_tobytes(bytes, in);
|
||||||
|
print_vector(name, bytes);
|
||||||
|
}
|
||||||
|
|
||||||
11
Sources/libsignal/curve25519/ed25519/additions/utility.h
Executable file
11
Sources/libsignal/curve25519/ed25519/additions/utility.h
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
|
||||||
|
#ifndef __UTILITY_H__
|
||||||
|
#define __UTILITY_H__
|
||||||
|
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
void print_vector(const char* name, const unsigned char* v);
|
||||||
|
void print_bytes(const char* name, const unsigned char* v, int numbytes);
|
||||||
|
void print_fe(const char* name, const fe in);
|
||||||
|
|
||||||
|
#endif
|
||||||
80
Sources/libsignal/curve25519/ed25519/additions/xeddsa.c
Executable file
80
Sources/libsignal/curve25519/ed25519/additions/xeddsa.c
Executable file
|
|
@ -0,0 +1,80 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include "ge.h"
|
||||||
|
#include "crypto_additions.h"
|
||||||
|
#include "zeroize.h"
|
||||||
|
#include "xeddsa.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
|
||||||
|
int xed25519_sign(unsigned char* signature_out,
|
||||||
|
const unsigned char* curve25519_privkey,
|
||||||
|
const unsigned char* msg, const unsigned long msg_len,
|
||||||
|
const unsigned char* random)
|
||||||
|
{
|
||||||
|
unsigned char a[32], aneg[32];
|
||||||
|
unsigned char A[32];
|
||||||
|
ge_p3 ed_pubkey_point;
|
||||||
|
unsigned char *sigbuf; /* working buffer */
|
||||||
|
unsigned char sign_bit = 0;
|
||||||
|
|
||||||
|
if ((sigbuf = malloc(msg_len + 128)) == 0) {
|
||||||
|
memset(signature_out, 0, 64);
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Convert the Curve25519 privkey to an Ed25519 public key */
|
||||||
|
ge_scalarmult_base(&ed_pubkey_point, curve25519_privkey);
|
||||||
|
ge_p3_tobytes(A, &ed_pubkey_point);
|
||||||
|
|
||||||
|
/* Force Edwards sign bit to zero */
|
||||||
|
sign_bit = (A[31] & 0x80) >> 7;
|
||||||
|
memcpy(a, curve25519_privkey, 32);
|
||||||
|
sc_neg(aneg, a);
|
||||||
|
sc_cmov(a, aneg, sign_bit);
|
||||||
|
A[31] &= 0x7F;
|
||||||
|
|
||||||
|
/* Perform an Ed25519 signature with explicit private key */
|
||||||
|
crypto_sign_modified(sigbuf, msg, msg_len, a, A, random);
|
||||||
|
memmove(signature_out, sigbuf, 64);
|
||||||
|
|
||||||
|
zeroize(a, 32);
|
||||||
|
zeroize(aneg, 32);
|
||||||
|
free(sigbuf);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int xed25519_verify(const unsigned char* signature,
|
||||||
|
const unsigned char* curve25519_pubkey,
|
||||||
|
const unsigned char* msg, const unsigned long msg_len)
|
||||||
|
{
|
||||||
|
fe u;
|
||||||
|
fe y;
|
||||||
|
unsigned char ed_pubkey[32];
|
||||||
|
unsigned char verifybuf[MAX_MSG_LEN + 64]; /* working buffer */
|
||||||
|
unsigned char verifybuf2[MAX_MSG_LEN + 64]; /* working buffer #2 */
|
||||||
|
|
||||||
|
if (msg_len > MAX_MSG_LEN) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Convert the Curve25519 public key into an Ed25519 public key.
|
||||||
|
|
||||||
|
y = (u - 1) / (u + 1)
|
||||||
|
|
||||||
|
NOTE: u=-1 is converted to y=0 since fe_invert is mod-exp
|
||||||
|
*/
|
||||||
|
if (!fe_isreduced(curve25519_pubkey))
|
||||||
|
return -1;
|
||||||
|
fe_frombytes(u, curve25519_pubkey);
|
||||||
|
fe_montx_to_edy(y, u);
|
||||||
|
fe_tobytes(ed_pubkey, y);
|
||||||
|
|
||||||
|
memmove(verifybuf, signature, 64);
|
||||||
|
memmove(verifybuf+64, msg, msg_len);
|
||||||
|
|
||||||
|
/* Then perform a normal Ed25519 verification, return 0 on success */
|
||||||
|
/* The below call has a strange API: */
|
||||||
|
/* verifybuf = R || S || message */
|
||||||
|
/* verifybuf2 = internal to next call gets a copy of verifybuf, S gets
|
||||||
|
replaced with pubkey for hashing */
|
||||||
|
return crypto_sign_open_modified(verifybuf2, verifybuf, 64 + msg_len, ed_pubkey);
|
||||||
|
}
|
||||||
16
Sources/libsignal/curve25519/ed25519/additions/xeddsa.h
Executable file
16
Sources/libsignal/curve25519/ed25519/additions/xeddsa.h
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
|
||||||
|
#ifndef __XEDDSA_H__
|
||||||
|
#define __XEDDSA_H__
|
||||||
|
|
||||||
|
/* returns 0 on success */
|
||||||
|
int xed25519_sign(unsigned char* signature_out, /* 64 bytes */
|
||||||
|
const unsigned char* curve25519_privkey, /* 32 bytes */
|
||||||
|
const unsigned char* msg, const unsigned long msg_len, /* <= 256 bytes */
|
||||||
|
const unsigned char* random); /* 64 bytes */
|
||||||
|
|
||||||
|
/* returns 0 on success */
|
||||||
|
int xed25519_verify(const unsigned char* signature, /* 64 bytes */
|
||||||
|
const unsigned char* curve25519_pubkey, /* 32 bytes */
|
||||||
|
const unsigned char* msg, const unsigned long msg_len); /* <= 256 bytes */
|
||||||
|
|
||||||
|
#endif
|
||||||
16
Sources/libsignal/curve25519/ed25519/additions/zeroize.c
Executable file
16
Sources/libsignal/curve25519/ed25519/additions/zeroize.c
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
#include "zeroize.h"
|
||||||
|
|
||||||
|
void zeroize(unsigned char* b, size_t len)
|
||||||
|
{
|
||||||
|
size_t count = 0;
|
||||||
|
volatile unsigned char *p = b;
|
||||||
|
|
||||||
|
for (count = 0; count < len; count++)
|
||||||
|
p[count] = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
void zeroize_stack()
|
||||||
|
{
|
||||||
|
unsigned char m[ZEROIZE_STACK_SIZE];
|
||||||
|
zeroize(m, ZEROIZE_STACK_SIZE);
|
||||||
|
}
|
||||||
12
Sources/libsignal/curve25519/ed25519/additions/zeroize.h
Executable file
12
Sources/libsignal/curve25519/ed25519/additions/zeroize.h
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
#ifndef __ZEROIZE_H__
|
||||||
|
#define __ZEROIZE_H__
|
||||||
|
|
||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
|
#define ZEROIZE_STACK_SIZE 1024
|
||||||
|
|
||||||
|
void zeroize(unsigned char* b, size_t len);
|
||||||
|
|
||||||
|
void zeroize_stack();
|
||||||
|
|
||||||
|
#endif
|
||||||
1344
Sources/libsignal/curve25519/ed25519/base.h
Executable file
1344
Sources/libsignal/curve25519/ed25519/base.h
Executable file
File diff suppressed because it is too large
Load diff
40
Sources/libsignal/curve25519/ed25519/base2.h
Executable file
40
Sources/libsignal/curve25519/ed25519/base2.h
Executable file
|
|
@ -0,0 +1,40 @@
|
||||||
|
{
|
||||||
|
{ 25967493,-14356035,29566456,3660896,-12694345,4014787,27544626,-11754271,-6079156,2047605 },
|
||||||
|
{ -12545711,934262,-2722910,3049990,-727428,9406986,12720692,5043384,19500929,-15469378 },
|
||||||
|
{ -8738181,4489570,9688441,-14785194,10184609,-12363380,29287919,11864899,-24514362,-4438546 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ 15636291,-9688557,24204773,-7912398,616977,-16685262,27787600,-14772189,28944400,-1550024 },
|
||||||
|
{ 16568933,4717097,-11556148,-1102322,15682896,-11807043,16354577,-11775962,7689662,11199574 },
|
||||||
|
{ 30464156,-5976125,-11779434,-15670865,23220365,15915852,7512774,10017326,-17749093,-9920357 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ 10861363,11473154,27284546,1981175,-30064349,12577861,32867885,14515107,-15438304,10819380 },
|
||||||
|
{ 4708026,6336745,20377586,9066809,-11272109,6594696,-25653668,12483688,-12668491,5581306 },
|
||||||
|
{ 19563160,16186464,-29386857,4097519,10237984,-4348115,28542350,13850243,-23678021,-15815942 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ 5153746,9909285,1723747,-2777874,30523605,5516873,19480852,5230134,-23952439,-15175766 },
|
||||||
|
{ -30269007,-3463509,7665486,10083793,28475525,1649722,20654025,16520125,30598449,7715701 },
|
||||||
|
{ 28881845,14381568,9657904,3680757,-20181635,7843316,-31400660,1370708,29794553,-1409300 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ -22518993,-6692182,14201702,-8745502,-23510406,8844726,18474211,-1361450,-13062696,13821877 },
|
||||||
|
{ -6455177,-7839871,3374702,-4740862,-27098617,-10571707,31655028,-7212327,18853322,-14220951 },
|
||||||
|
{ 4566830,-12963868,-28974889,-12240689,-7602672,-2830569,-8514358,-10431137,2207753,-3209784 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ -25154831,-4185821,29681144,7868801,-6854661,-9423865,-12437364,-663000,-31111463,-16132436 },
|
||||||
|
{ 25576264,-2703214,7349804,-11814844,16472782,9300885,3844789,15725684,171356,6466918 },
|
||||||
|
{ 23103977,13316479,9739013,-16149481,817875,-15038942,8965339,-14088058,-30714912,16193877 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ -33521811,3180713,-2394130,14003687,-16903474,-16270840,17238398,4729455,-18074513,9256800 },
|
||||||
|
{ -25182317,-4174131,32336398,5036987,-21236817,11360617,22616405,9761698,-19827198,630305 },
|
||||||
|
{ -13720693,2639453,-24237460,-7406481,9494427,-5774029,-6554551,-15960994,-2449256,-14291300 },
|
||||||
|
},
|
||||||
|
{
|
||||||
|
{ -3151181,-5046075,9282714,6866145,-31907062,-863023,-18940575,15033784,25105118,-7894876 },
|
||||||
|
{ -24326370,15950226,-31801215,-14592823,-11662737,-5090925,1573892,-2625887,2198790,-15804619 },
|
||||||
|
{ -3099351,10324967,-2241613,7453183,-5446979,-2735503,-13812022,-16236442,-32461234,-12290683 },
|
||||||
|
},
|
||||||
1
Sources/libsignal/curve25519/ed25519/d.h
Executable file
1
Sources/libsignal/curve25519/ed25519/d.h
Executable file
|
|
@ -0,0 +1 @@
|
||||||
|
-10913610,13857413,-15372611,6949391,114729,-8787816,-6275908,-3247719,-18696448,-12055116
|
||||||
1
Sources/libsignal/curve25519/ed25519/d2.h
Executable file
1
Sources/libsignal/curve25519/ed25519/d2.h
Executable file
|
|
@ -0,0 +1 @@
|
||||||
|
-21827239,-5839606,-30745221,13898782,229458,15978800,-12551817,-6495438,29715968,9444199
|
||||||
56
Sources/libsignal/curve25519/ed25519/fe.h
Executable file
56
Sources/libsignal/curve25519/ed25519/fe.h
Executable file
|
|
@ -0,0 +1,56 @@
|
||||||
|
#ifndef FE_H
|
||||||
|
#define FE_H
|
||||||
|
|
||||||
|
#include "crypto_int32.h"
|
||||||
|
|
||||||
|
typedef crypto_int32 fe[10];
|
||||||
|
|
||||||
|
/*
|
||||||
|
fe means field element.
|
||||||
|
Here the field is \Z/(2^255-19).
|
||||||
|
An element t, entries t[0]...t[9], represents the integer
|
||||||
|
t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9].
|
||||||
|
Bounds on each t[i] vary depending on context.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define fe_frombytes crypto_sign_ed25519_ref10_fe_frombytes
|
||||||
|
#define fe_tobytes crypto_sign_ed25519_ref10_fe_tobytes
|
||||||
|
#define fe_copy crypto_sign_ed25519_ref10_fe_copy
|
||||||
|
#define fe_isnonzero crypto_sign_ed25519_ref10_fe_isnonzero
|
||||||
|
#define fe_isnegative crypto_sign_ed25519_ref10_fe_isnegative
|
||||||
|
#define fe_0 crypto_sign_ed25519_ref10_fe_0
|
||||||
|
#define fe_1 crypto_sign_ed25519_ref10_fe_1
|
||||||
|
#define fe_cswap crypto_sign_ed25519_ref10_fe_cswap
|
||||||
|
#define fe_cmov crypto_sign_ed25519_ref10_fe_cmov
|
||||||
|
#define fe_add crypto_sign_ed25519_ref10_fe_add
|
||||||
|
#define fe_sub crypto_sign_ed25519_ref10_fe_sub
|
||||||
|
#define fe_neg crypto_sign_ed25519_ref10_fe_neg
|
||||||
|
#define fe_mul crypto_sign_ed25519_ref10_fe_mul
|
||||||
|
#define fe_sq crypto_sign_ed25519_ref10_fe_sq
|
||||||
|
#define fe_sq2 crypto_sign_ed25519_ref10_fe_sq2
|
||||||
|
#define fe_mul121666 crypto_sign_ed25519_ref10_fe_mul121666
|
||||||
|
#define fe_invert crypto_sign_ed25519_ref10_fe_invert
|
||||||
|
#define fe_pow22523 crypto_sign_ed25519_ref10_fe_pow22523
|
||||||
|
|
||||||
|
extern void fe_frombytes(fe,const unsigned char *);
|
||||||
|
extern void fe_tobytes(unsigned char *,const fe);
|
||||||
|
|
||||||
|
extern void fe_copy(fe,const fe);
|
||||||
|
extern int fe_isnonzero(const fe);
|
||||||
|
extern int fe_isnegative(const fe);
|
||||||
|
extern void fe_0(fe);
|
||||||
|
extern void fe_1(fe);
|
||||||
|
extern void fe_cswap(fe,fe,unsigned int);
|
||||||
|
extern void fe_cmov(fe,const fe,unsigned int);
|
||||||
|
|
||||||
|
extern void fe_add(fe,const fe,const fe);
|
||||||
|
extern void fe_sub(fe,const fe,const fe);
|
||||||
|
extern void fe_neg(fe,const fe);
|
||||||
|
extern void fe_mul(fe,const fe,const fe);
|
||||||
|
extern void fe_sq(fe,const fe);
|
||||||
|
extern void fe_sq2(fe,const fe);
|
||||||
|
extern void fe_mul121666(fe,const fe);
|
||||||
|
extern void fe_invert(fe,const fe);
|
||||||
|
extern void fe_pow22523(fe,const fe);
|
||||||
|
|
||||||
|
#endif
|
||||||
19
Sources/libsignal/curve25519/ed25519/fe_0.c
Executable file
19
Sources/libsignal/curve25519/ed25519/fe_0.c
Executable file
|
|
@ -0,0 +1,19 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = 0
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_0(fe h)
|
||||||
|
{
|
||||||
|
h[0] = 0;
|
||||||
|
h[1] = 0;
|
||||||
|
h[2] = 0;
|
||||||
|
h[3] = 0;
|
||||||
|
h[4] = 0;
|
||||||
|
h[5] = 0;
|
||||||
|
h[6] = 0;
|
||||||
|
h[7] = 0;
|
||||||
|
h[8] = 0;
|
||||||
|
h[9] = 0;
|
||||||
|
}
|
||||||
19
Sources/libsignal/curve25519/ed25519/fe_1.c
Executable file
19
Sources/libsignal/curve25519/ed25519/fe_1.c
Executable file
|
|
@ -0,0 +1,19 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = 1
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_1(fe h)
|
||||||
|
{
|
||||||
|
h[0] = 1;
|
||||||
|
h[1] = 0;
|
||||||
|
h[2] = 0;
|
||||||
|
h[3] = 0;
|
||||||
|
h[4] = 0;
|
||||||
|
h[5] = 0;
|
||||||
|
h[6] = 0;
|
||||||
|
h[7] = 0;
|
||||||
|
h[8] = 0;
|
||||||
|
h[9] = 0;
|
||||||
|
}
|
||||||
57
Sources/libsignal/curve25519/ed25519/fe_add.c
Executable file
57
Sources/libsignal/curve25519/ed25519/fe_add.c
Executable file
|
|
@ -0,0 +1,57 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = f + g
|
||||||
|
Can overlap h with f or g.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_add(fe h,const fe f,const fe g)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 g0 = g[0];
|
||||||
|
crypto_int32 g1 = g[1];
|
||||||
|
crypto_int32 g2 = g[2];
|
||||||
|
crypto_int32 g3 = g[3];
|
||||||
|
crypto_int32 g4 = g[4];
|
||||||
|
crypto_int32 g5 = g[5];
|
||||||
|
crypto_int32 g6 = g[6];
|
||||||
|
crypto_int32 g7 = g[7];
|
||||||
|
crypto_int32 g8 = g[8];
|
||||||
|
crypto_int32 g9 = g[9];
|
||||||
|
crypto_int32 h0 = f0 + g0;
|
||||||
|
crypto_int32 h1 = f1 + g1;
|
||||||
|
crypto_int32 h2 = f2 + g2;
|
||||||
|
crypto_int32 h3 = f3 + g3;
|
||||||
|
crypto_int32 h4 = f4 + g4;
|
||||||
|
crypto_int32 h5 = f5 + g5;
|
||||||
|
crypto_int32 h6 = f6 + g6;
|
||||||
|
crypto_int32 h7 = f7 + g7;
|
||||||
|
crypto_int32 h8 = f8 + g8;
|
||||||
|
crypto_int32 h9 = f9 + g9;
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
63
Sources/libsignal/curve25519/ed25519/fe_cmov.c
Executable file
63
Sources/libsignal/curve25519/ed25519/fe_cmov.c
Executable file
|
|
@ -0,0 +1,63 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
Replace (f,g) with (g,g) if b == 1;
|
||||||
|
replace (f,g) with (f,g) if b == 0.
|
||||||
|
|
||||||
|
Preconditions: b in {0,1}.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_cmov(fe f,const fe g,unsigned int b)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 g0 = g[0];
|
||||||
|
crypto_int32 g1 = g[1];
|
||||||
|
crypto_int32 g2 = g[2];
|
||||||
|
crypto_int32 g3 = g[3];
|
||||||
|
crypto_int32 g4 = g[4];
|
||||||
|
crypto_int32 g5 = g[5];
|
||||||
|
crypto_int32 g6 = g[6];
|
||||||
|
crypto_int32 g7 = g[7];
|
||||||
|
crypto_int32 g8 = g[8];
|
||||||
|
crypto_int32 g9 = g[9];
|
||||||
|
crypto_int32 x0 = f0 ^ g0;
|
||||||
|
crypto_int32 x1 = f1 ^ g1;
|
||||||
|
crypto_int32 x2 = f2 ^ g2;
|
||||||
|
crypto_int32 x3 = f3 ^ g3;
|
||||||
|
crypto_int32 x4 = f4 ^ g4;
|
||||||
|
crypto_int32 x5 = f5 ^ g5;
|
||||||
|
crypto_int32 x6 = f6 ^ g6;
|
||||||
|
crypto_int32 x7 = f7 ^ g7;
|
||||||
|
crypto_int32 x8 = f8 ^ g8;
|
||||||
|
crypto_int32 x9 = f9 ^ g9;
|
||||||
|
b = -b;
|
||||||
|
x0 &= b;
|
||||||
|
x1 &= b;
|
||||||
|
x2 &= b;
|
||||||
|
x3 &= b;
|
||||||
|
x4 &= b;
|
||||||
|
x5 &= b;
|
||||||
|
x6 &= b;
|
||||||
|
x7 &= b;
|
||||||
|
x8 &= b;
|
||||||
|
x9 &= b;
|
||||||
|
f[0] = f0 ^ x0;
|
||||||
|
f[1] = f1 ^ x1;
|
||||||
|
f[2] = f2 ^ x2;
|
||||||
|
f[3] = f3 ^ x3;
|
||||||
|
f[4] = f4 ^ x4;
|
||||||
|
f[5] = f5 ^ x5;
|
||||||
|
f[6] = f6 ^ x6;
|
||||||
|
f[7] = f7 ^ x7;
|
||||||
|
f[8] = f8 ^ x8;
|
||||||
|
f[9] = f9 ^ x9;
|
||||||
|
}
|
||||||
29
Sources/libsignal/curve25519/ed25519/fe_copy.c
Executable file
29
Sources/libsignal/curve25519/ed25519/fe_copy.c
Executable file
|
|
@ -0,0 +1,29 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = f
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_copy(fe h,const fe f)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
h[0] = f0;
|
||||||
|
h[1] = f1;
|
||||||
|
h[2] = f2;
|
||||||
|
h[3] = f3;
|
||||||
|
h[4] = f4;
|
||||||
|
h[5] = f5;
|
||||||
|
h[6] = f6;
|
||||||
|
h[7] = f7;
|
||||||
|
h[8] = f8;
|
||||||
|
h[9] = f9;
|
||||||
|
}
|
||||||
73
Sources/libsignal/curve25519/ed25519/fe_frombytes.c
Executable file
73
Sources/libsignal/curve25519/ed25519/fe_frombytes.c
Executable file
|
|
@ -0,0 +1,73 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_int64.h"
|
||||||
|
#include "crypto_uint64.h"
|
||||||
|
|
||||||
|
static crypto_uint64 load_3(const unsigned char *in)
|
||||||
|
{
|
||||||
|
crypto_uint64 result;
|
||||||
|
result = (crypto_uint64) in[0];
|
||||||
|
result |= ((crypto_uint64) in[1]) << 8;
|
||||||
|
result |= ((crypto_uint64) in[2]) << 16;
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
static crypto_uint64 load_4(const unsigned char *in)
|
||||||
|
{
|
||||||
|
crypto_uint64 result;
|
||||||
|
result = (crypto_uint64) in[0];
|
||||||
|
result |= ((crypto_uint64) in[1]) << 8;
|
||||||
|
result |= ((crypto_uint64) in[2]) << 16;
|
||||||
|
result |= ((crypto_uint64) in[3]) << 24;
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Ignores top bit of h.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_frombytes(fe h,const unsigned char *s)
|
||||||
|
{
|
||||||
|
crypto_int64 h0 = load_4(s);
|
||||||
|
crypto_int64 h1 = load_3(s + 4) << 6;
|
||||||
|
crypto_int64 h2 = load_3(s + 7) << 5;
|
||||||
|
crypto_int64 h3 = load_3(s + 10) << 3;
|
||||||
|
crypto_int64 h4 = load_3(s + 13) << 2;
|
||||||
|
crypto_int64 h5 = load_4(s + 16);
|
||||||
|
crypto_int64 h6 = load_3(s + 20) << 7;
|
||||||
|
crypto_int64 h7 = load_3(s + 23) << 5;
|
||||||
|
crypto_int64 h8 = load_3(s + 26) << 4;
|
||||||
|
crypto_int64 h9 = (load_3(s + 29) & 8388607) << 2;
|
||||||
|
crypto_int64 carry0;
|
||||||
|
crypto_int64 carry1;
|
||||||
|
crypto_int64 carry2;
|
||||||
|
crypto_int64 carry3;
|
||||||
|
crypto_int64 carry4;
|
||||||
|
crypto_int64 carry5;
|
||||||
|
crypto_int64 carry6;
|
||||||
|
crypto_int64 carry7;
|
||||||
|
crypto_int64 carry8;
|
||||||
|
crypto_int64 carry9;
|
||||||
|
|
||||||
|
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||||
|
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||||
|
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||||
|
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||||
|
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||||
|
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||||
|
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
14
Sources/libsignal/curve25519/ed25519/fe_invert.c
Executable file
14
Sources/libsignal/curve25519/ed25519/fe_invert.c
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
void fe_invert(fe out,const fe z)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
fe t1;
|
||||||
|
fe t2;
|
||||||
|
fe t3;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
#include "pow225521.h"
|
||||||
|
|
||||||
|
return;
|
||||||
|
}
|
||||||
16
Sources/libsignal/curve25519/ed25519/fe_isnegative.c
Executable file
16
Sources/libsignal/curve25519/ed25519/fe_isnegative.c
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return 1 if f is in {1,3,5,...,q-2}
|
||||||
|
return 0 if f is in {0,2,4,...,q-1}
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
int fe_isnegative(const fe f)
|
||||||
|
{
|
||||||
|
unsigned char s[32];
|
||||||
|
fe_tobytes(s,f);
|
||||||
|
return s[0] & 1;
|
||||||
|
}
|
||||||
28
Sources/libsignal/curve25519/ed25519/fe_isnonzero.c
Executable file
28
Sources/libsignal/curve25519/ed25519/fe_isnonzero.c
Executable file
|
|
@ -0,0 +1,28 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_verify_32.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
return nonzero if f == 0
|
||||||
|
return 0 if f != 0
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* TREVOR'S COMMENT
|
||||||
|
*
|
||||||
|
* I think the above comment is wrong. Instead:
|
||||||
|
*
|
||||||
|
* return 0 if f == 0
|
||||||
|
* return -1 if f != 0
|
||||||
|
*
|
||||||
|
* */
|
||||||
|
|
||||||
|
static const unsigned char zero[32];
|
||||||
|
|
||||||
|
int fe_isnonzero(const fe f)
|
||||||
|
{
|
||||||
|
unsigned char s[32];
|
||||||
|
fe_tobytes(s,f);
|
||||||
|
return crypto_verify_32(s,zero);
|
||||||
|
}
|
||||||
253
Sources/libsignal/curve25519/ed25519/fe_mul.c
Executable file
253
Sources/libsignal/curve25519/ed25519/fe_mul.c
Executable file
|
|
@ -0,0 +1,253 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_int64.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = f * g
|
||||||
|
Can overlap h with f or g.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||||
|
|g| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
Notes on implementation strategy:
|
||||||
|
|
||||||
|
Using schoolbook multiplication.
|
||||||
|
Karatsuba would save a little in some cost models.
|
||||||
|
|
||||||
|
Most multiplications by 2 and 19 are 32-bit precomputations;
|
||||||
|
cheaper than 64-bit postcomputations.
|
||||||
|
|
||||||
|
There is one remaining multiplication by 19 in the carry chain;
|
||||||
|
one *19 precomputation can be merged into this,
|
||||||
|
but the resulting data flow is considerably less clean.
|
||||||
|
|
||||||
|
There are 12 carries below.
|
||||||
|
10 of them are 2-way parallelizable and vectorizable.
|
||||||
|
Can get away with 11 carries, but then data flow is much deeper.
|
||||||
|
|
||||||
|
With tighter constraints on inputs can squeeze carries into int32.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_mul(fe h,const fe f,const fe g)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 g0 = g[0];
|
||||||
|
crypto_int32 g1 = g[1];
|
||||||
|
crypto_int32 g2 = g[2];
|
||||||
|
crypto_int32 g3 = g[3];
|
||||||
|
crypto_int32 g4 = g[4];
|
||||||
|
crypto_int32 g5 = g[5];
|
||||||
|
crypto_int32 g6 = g[6];
|
||||||
|
crypto_int32 g7 = g[7];
|
||||||
|
crypto_int32 g8 = g[8];
|
||||||
|
crypto_int32 g9 = g[9];
|
||||||
|
crypto_int32 g1_19 = 19 * g1; /* 1.959375*2^29 */
|
||||||
|
crypto_int32 g2_19 = 19 * g2; /* 1.959375*2^30; still ok */
|
||||||
|
crypto_int32 g3_19 = 19 * g3;
|
||||||
|
crypto_int32 g4_19 = 19 * g4;
|
||||||
|
crypto_int32 g5_19 = 19 * g5;
|
||||||
|
crypto_int32 g6_19 = 19 * g6;
|
||||||
|
crypto_int32 g7_19 = 19 * g7;
|
||||||
|
crypto_int32 g8_19 = 19 * g8;
|
||||||
|
crypto_int32 g9_19 = 19 * g9;
|
||||||
|
crypto_int32 f1_2 = 2 * f1;
|
||||||
|
crypto_int32 f3_2 = 2 * f3;
|
||||||
|
crypto_int32 f5_2 = 2 * f5;
|
||||||
|
crypto_int32 f7_2 = 2 * f7;
|
||||||
|
crypto_int32 f9_2 = 2 * f9;
|
||||||
|
crypto_int64 f0g0 = f0 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f0g1 = f0 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f0g2 = f0 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f0g3 = f0 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f0g4 = f0 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f0g5 = f0 * (crypto_int64) g5;
|
||||||
|
crypto_int64 f0g6 = f0 * (crypto_int64) g6;
|
||||||
|
crypto_int64 f0g7 = f0 * (crypto_int64) g7;
|
||||||
|
crypto_int64 f0g8 = f0 * (crypto_int64) g8;
|
||||||
|
crypto_int64 f0g9 = f0 * (crypto_int64) g9;
|
||||||
|
crypto_int64 f1g0 = f1 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f1g1_2 = f1_2 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f1g2 = f1 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f1g3_2 = f1_2 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f1g4 = f1 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f1g5_2 = f1_2 * (crypto_int64) g5;
|
||||||
|
crypto_int64 f1g6 = f1 * (crypto_int64) g6;
|
||||||
|
crypto_int64 f1g7_2 = f1_2 * (crypto_int64) g7;
|
||||||
|
crypto_int64 f1g8 = f1 * (crypto_int64) g8;
|
||||||
|
crypto_int64 f1g9_38 = f1_2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f2g0 = f2 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f2g1 = f2 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f2g2 = f2 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f2g3 = f2 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f2g4 = f2 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f2g5 = f2 * (crypto_int64) g5;
|
||||||
|
crypto_int64 f2g6 = f2 * (crypto_int64) g6;
|
||||||
|
crypto_int64 f2g7 = f2 * (crypto_int64) g7;
|
||||||
|
crypto_int64 f2g8_19 = f2 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f2g9_19 = f2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f3g0 = f3 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f3g1_2 = f3_2 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f3g2 = f3 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f3g3_2 = f3_2 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f3g4 = f3 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f3g5_2 = f3_2 * (crypto_int64) g5;
|
||||||
|
crypto_int64 f3g6 = f3 * (crypto_int64) g6;
|
||||||
|
crypto_int64 f3g7_38 = f3_2 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f3g8_19 = f3 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f3g9_38 = f3_2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f4g0 = f4 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f4g1 = f4 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f4g2 = f4 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f4g3 = f4 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f4g4 = f4 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f4g5 = f4 * (crypto_int64) g5;
|
||||||
|
crypto_int64 f4g6_19 = f4 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f4g7_19 = f4 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f4g8_19 = f4 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f4g9_19 = f4 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f5g0 = f5 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f5g1_2 = f5_2 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f5g2 = f5 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f5g3_2 = f5_2 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f5g4 = f5 * (crypto_int64) g4;
|
||||||
|
crypto_int64 f5g5_38 = f5_2 * (crypto_int64) g5_19;
|
||||||
|
crypto_int64 f5g6_19 = f5 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f5g7_38 = f5_2 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f5g8_19 = f5 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f5g9_38 = f5_2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f6g0 = f6 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f6g1 = f6 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f6g2 = f6 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f6g3 = f6 * (crypto_int64) g3;
|
||||||
|
crypto_int64 f6g4_19 = f6 * (crypto_int64) g4_19;
|
||||||
|
crypto_int64 f6g5_19 = f6 * (crypto_int64) g5_19;
|
||||||
|
crypto_int64 f6g6_19 = f6 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f6g7_19 = f6 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f6g8_19 = f6 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f6g9_19 = f6 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f7g0 = f7 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f7g1_2 = f7_2 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f7g2 = f7 * (crypto_int64) g2;
|
||||||
|
crypto_int64 f7g3_38 = f7_2 * (crypto_int64) g3_19;
|
||||||
|
crypto_int64 f7g4_19 = f7 * (crypto_int64) g4_19;
|
||||||
|
crypto_int64 f7g5_38 = f7_2 * (crypto_int64) g5_19;
|
||||||
|
crypto_int64 f7g6_19 = f7 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f7g7_38 = f7_2 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f7g8_19 = f7 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f7g9_38 = f7_2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f8g0 = f8 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f8g1 = f8 * (crypto_int64) g1;
|
||||||
|
crypto_int64 f8g2_19 = f8 * (crypto_int64) g2_19;
|
||||||
|
crypto_int64 f8g3_19 = f8 * (crypto_int64) g3_19;
|
||||||
|
crypto_int64 f8g4_19 = f8 * (crypto_int64) g4_19;
|
||||||
|
crypto_int64 f8g5_19 = f8 * (crypto_int64) g5_19;
|
||||||
|
crypto_int64 f8g6_19 = f8 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f8g7_19 = f8 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f8g8_19 = f8 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f8g9_19 = f8 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 f9g0 = f9 * (crypto_int64) g0;
|
||||||
|
crypto_int64 f9g1_38 = f9_2 * (crypto_int64) g1_19;
|
||||||
|
crypto_int64 f9g2_19 = f9 * (crypto_int64) g2_19;
|
||||||
|
crypto_int64 f9g3_38 = f9_2 * (crypto_int64) g3_19;
|
||||||
|
crypto_int64 f9g4_19 = f9 * (crypto_int64) g4_19;
|
||||||
|
crypto_int64 f9g5_38 = f9_2 * (crypto_int64) g5_19;
|
||||||
|
crypto_int64 f9g6_19 = f9 * (crypto_int64) g6_19;
|
||||||
|
crypto_int64 f9g7_38 = f9_2 * (crypto_int64) g7_19;
|
||||||
|
crypto_int64 f9g8_19 = f9 * (crypto_int64) g8_19;
|
||||||
|
crypto_int64 f9g9_38 = f9_2 * (crypto_int64) g9_19;
|
||||||
|
crypto_int64 h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38;
|
||||||
|
crypto_int64 h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19;
|
||||||
|
crypto_int64 h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38;
|
||||||
|
crypto_int64 h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19;
|
||||||
|
crypto_int64 h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38;
|
||||||
|
crypto_int64 h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19;
|
||||||
|
crypto_int64 h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38;
|
||||||
|
crypto_int64 h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19;
|
||||||
|
crypto_int64 h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38;
|
||||||
|
crypto_int64 h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ;
|
||||||
|
crypto_int64 carry0;
|
||||||
|
crypto_int64 carry1;
|
||||||
|
crypto_int64 carry2;
|
||||||
|
crypto_int64 carry3;
|
||||||
|
crypto_int64 carry4;
|
||||||
|
crypto_int64 carry5;
|
||||||
|
crypto_int64 carry6;
|
||||||
|
crypto_int64 carry7;
|
||||||
|
crypto_int64 carry8;
|
||||||
|
crypto_int64 carry9;
|
||||||
|
|
||||||
|
/*
|
||||||
|
|h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38))
|
||||||
|
i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
|
||||||
|
|h1| <= (1.65*1.65*2^51*(1+1+19+19+19+19+19+19+19+19))
|
||||||
|
i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9
|
||||||
|
*/
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
/* |h0| <= 2^25 */
|
||||||
|
/* |h4| <= 2^25 */
|
||||||
|
/* |h1| <= 1.71*2^59 */
|
||||||
|
/* |h5| <= 1.71*2^59 */
|
||||||
|
|
||||||
|
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||||
|
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||||
|
/* |h1| <= 2^24; from now on fits into int32 */
|
||||||
|
/* |h5| <= 2^24; from now on fits into int32 */
|
||||||
|
/* |h2| <= 1.41*2^60 */
|
||||||
|
/* |h6| <= 1.41*2^60 */
|
||||||
|
|
||||||
|
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||||
|
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||||
|
/* |h2| <= 2^25; from now on fits into int32 unchanged */
|
||||||
|
/* |h6| <= 2^25; from now on fits into int32 unchanged */
|
||||||
|
/* |h3| <= 1.71*2^59 */
|
||||||
|
/* |h7| <= 1.71*2^59 */
|
||||||
|
|
||||||
|
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||||
|
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||||
|
/* |h3| <= 2^24; from now on fits into int32 unchanged */
|
||||||
|
/* |h7| <= 2^24; from now on fits into int32 unchanged */
|
||||||
|
/* |h4| <= 1.72*2^34 */
|
||||||
|
/* |h8| <= 1.41*2^60 */
|
||||||
|
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||||
|
/* |h4| <= 2^25; from now on fits into int32 unchanged */
|
||||||
|
/* |h8| <= 2^25; from now on fits into int32 unchanged */
|
||||||
|
/* |h5| <= 1.01*2^24 */
|
||||||
|
/* |h9| <= 1.71*2^59 */
|
||||||
|
|
||||||
|
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||||
|
/* |h9| <= 2^24; from now on fits into int32 unchanged */
|
||||||
|
/* |h0| <= 1.1*2^39 */
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
/* |h0| <= 2^25; from now on fits into int32 unchanged */
|
||||||
|
/* |h1| <= 1.01*2^24 */
|
||||||
|
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
45
Sources/libsignal/curve25519/ed25519/fe_neg.c
Executable file
45
Sources/libsignal/curve25519/ed25519/fe_neg.c
Executable file
|
|
@ -0,0 +1,45 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = -f
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_neg(fe h,const fe f)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 h0 = -f0;
|
||||||
|
crypto_int32 h1 = -f1;
|
||||||
|
crypto_int32 h2 = -f2;
|
||||||
|
crypto_int32 h3 = -f3;
|
||||||
|
crypto_int32 h4 = -f4;
|
||||||
|
crypto_int32 h5 = -f5;
|
||||||
|
crypto_int32 h6 = -f6;
|
||||||
|
crypto_int32 h7 = -f7;
|
||||||
|
crypto_int32 h8 = -f8;
|
||||||
|
crypto_int32 h9 = -f9;
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
13
Sources/libsignal/curve25519/ed25519/fe_pow22523.c
Executable file
13
Sources/libsignal/curve25519/ed25519/fe_pow22523.c
Executable file
|
|
@ -0,0 +1,13 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
void fe_pow22523(fe out,const fe z)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
fe t1;
|
||||||
|
fe t2;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
#include "pow22523.h"
|
||||||
|
|
||||||
|
return;
|
||||||
|
}
|
||||||
149
Sources/libsignal/curve25519/ed25519/fe_sq.c
Executable file
149
Sources/libsignal/curve25519/ed25519/fe_sq.c
Executable file
|
|
@ -0,0 +1,149 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_int64.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = f * f
|
||||||
|
Can overlap h with f.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
See fe_mul.c for discussion of implementation strategy.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_sq(fe h,const fe f)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 f0_2 = 2 * f0;
|
||||||
|
crypto_int32 f1_2 = 2 * f1;
|
||||||
|
crypto_int32 f2_2 = 2 * f2;
|
||||||
|
crypto_int32 f3_2 = 2 * f3;
|
||||||
|
crypto_int32 f4_2 = 2 * f4;
|
||||||
|
crypto_int32 f5_2 = 2 * f5;
|
||||||
|
crypto_int32 f6_2 = 2 * f6;
|
||||||
|
crypto_int32 f7_2 = 2 * f7;
|
||||||
|
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||||
|
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||||
|
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||||
|
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||||
|
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||||
|
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||||
|
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||||
|
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||||
|
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||||
|
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||||
|
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||||
|
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||||
|
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||||
|
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||||
|
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||||
|
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||||
|
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||||
|
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||||
|
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||||
|
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||||
|
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||||
|
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||||
|
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||||
|
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||||
|
crypto_int64 carry0;
|
||||||
|
crypto_int64 carry1;
|
||||||
|
crypto_int64 carry2;
|
||||||
|
crypto_int64 carry3;
|
||||||
|
crypto_int64 carry4;
|
||||||
|
crypto_int64 carry5;
|
||||||
|
crypto_int64 carry6;
|
||||||
|
crypto_int64 carry7;
|
||||||
|
crypto_int64 carry8;
|
||||||
|
crypto_int64 carry9;
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
|
||||||
|
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||||
|
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||||
|
|
||||||
|
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||||
|
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||||
|
|
||||||
|
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||||
|
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||||
|
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||||
|
|
||||||
|
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
160
Sources/libsignal/curve25519/ed25519/fe_sq2.c
Executable file
160
Sources/libsignal/curve25519/ed25519/fe_sq2.c
Executable file
|
|
@ -0,0 +1,160 @@
|
||||||
|
#include "fe.h"
|
||||||
|
#include "crypto_int64.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = 2 * f * f
|
||||||
|
Can overlap h with f.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
See fe_mul.c for discussion of implementation strategy.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_sq2(fe h,const fe f)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 f0_2 = 2 * f0;
|
||||||
|
crypto_int32 f1_2 = 2 * f1;
|
||||||
|
crypto_int32 f2_2 = 2 * f2;
|
||||||
|
crypto_int32 f3_2 = 2 * f3;
|
||||||
|
crypto_int32 f4_2 = 2 * f4;
|
||||||
|
crypto_int32 f5_2 = 2 * f5;
|
||||||
|
crypto_int32 f6_2 = 2 * f6;
|
||||||
|
crypto_int32 f7_2 = 2 * f7;
|
||||||
|
crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
|
||||||
|
crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
|
||||||
|
crypto_int64 f0f0 = f0 * (crypto_int64) f0;
|
||||||
|
crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1;
|
||||||
|
crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7;
|
||||||
|
crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8;
|
||||||
|
crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9;
|
||||||
|
crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1;
|
||||||
|
crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2;
|
||||||
|
crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2;
|
||||||
|
crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2;
|
||||||
|
crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8;
|
||||||
|
crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f2f2 = f2 * (crypto_int64) f2;
|
||||||
|
crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7;
|
||||||
|
crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3;
|
||||||
|
crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2;
|
||||||
|
crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6;
|
||||||
|
crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f4f4 = f4 * (crypto_int64) f4;
|
||||||
|
crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5;
|
||||||
|
crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38;
|
||||||
|
crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19;
|
||||||
|
crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38;
|
||||||
|
crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19;
|
||||||
|
crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38;
|
||||||
|
crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
|
||||||
|
crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
|
||||||
|
crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
|
||||||
|
crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
|
||||||
|
crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38;
|
||||||
|
crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
|
||||||
|
crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
|
||||||
|
crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
|
||||||
|
crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38;
|
||||||
|
crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
|
||||||
|
crypto_int64 carry0;
|
||||||
|
crypto_int64 carry1;
|
||||||
|
crypto_int64 carry2;
|
||||||
|
crypto_int64 carry3;
|
||||||
|
crypto_int64 carry4;
|
||||||
|
crypto_int64 carry5;
|
||||||
|
crypto_int64 carry6;
|
||||||
|
crypto_int64 carry7;
|
||||||
|
crypto_int64 carry8;
|
||||||
|
crypto_int64 carry9;
|
||||||
|
|
||||||
|
h0 += h0;
|
||||||
|
h1 += h1;
|
||||||
|
h2 += h2;
|
||||||
|
h3 += h3;
|
||||||
|
h4 += h4;
|
||||||
|
h5 += h5;
|
||||||
|
h6 += h6;
|
||||||
|
h7 += h7;
|
||||||
|
h8 += h8;
|
||||||
|
h9 += h9;
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
|
||||||
|
carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||||
|
carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||||
|
|
||||||
|
carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||||
|
carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||||
|
|
||||||
|
carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||||
|
carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||||
|
|
||||||
|
carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||||
|
|
||||||
|
carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
|
||||||
|
|
||||||
|
carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
57
Sources/libsignal/curve25519/ed25519/fe_sub.c
Executable file
57
Sources/libsignal/curve25519/ed25519/fe_sub.c
Executable file
|
|
@ -0,0 +1,57 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
h = f - g
|
||||||
|
Can overlap h with f or g.
|
||||||
|
|
||||||
|
Preconditions:
|
||||||
|
|f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
|g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
|
||||||
|
|
||||||
|
Postconditions:
|
||||||
|
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_sub(fe h,const fe f,const fe g)
|
||||||
|
{
|
||||||
|
crypto_int32 f0 = f[0];
|
||||||
|
crypto_int32 f1 = f[1];
|
||||||
|
crypto_int32 f2 = f[2];
|
||||||
|
crypto_int32 f3 = f[3];
|
||||||
|
crypto_int32 f4 = f[4];
|
||||||
|
crypto_int32 f5 = f[5];
|
||||||
|
crypto_int32 f6 = f[6];
|
||||||
|
crypto_int32 f7 = f[7];
|
||||||
|
crypto_int32 f8 = f[8];
|
||||||
|
crypto_int32 f9 = f[9];
|
||||||
|
crypto_int32 g0 = g[0];
|
||||||
|
crypto_int32 g1 = g[1];
|
||||||
|
crypto_int32 g2 = g[2];
|
||||||
|
crypto_int32 g3 = g[3];
|
||||||
|
crypto_int32 g4 = g[4];
|
||||||
|
crypto_int32 g5 = g[5];
|
||||||
|
crypto_int32 g6 = g[6];
|
||||||
|
crypto_int32 g7 = g[7];
|
||||||
|
crypto_int32 g8 = g[8];
|
||||||
|
crypto_int32 g9 = g[9];
|
||||||
|
crypto_int32 h0 = f0 - g0;
|
||||||
|
crypto_int32 h1 = f1 - g1;
|
||||||
|
crypto_int32 h2 = f2 - g2;
|
||||||
|
crypto_int32 h3 = f3 - g3;
|
||||||
|
crypto_int32 h4 = f4 - g4;
|
||||||
|
crypto_int32 h5 = f5 - g5;
|
||||||
|
crypto_int32 h6 = f6 - g6;
|
||||||
|
crypto_int32 h7 = f7 - g7;
|
||||||
|
crypto_int32 h8 = f8 - g8;
|
||||||
|
crypto_int32 h9 = f9 - g9;
|
||||||
|
h[0] = h0;
|
||||||
|
h[1] = h1;
|
||||||
|
h[2] = h2;
|
||||||
|
h[3] = h3;
|
||||||
|
h[4] = h4;
|
||||||
|
h[5] = h5;
|
||||||
|
h[6] = h6;
|
||||||
|
h[7] = h7;
|
||||||
|
h[8] = h8;
|
||||||
|
h[9] = h9;
|
||||||
|
}
|
||||||
119
Sources/libsignal/curve25519/ed25519/fe_tobytes.c
Executable file
119
Sources/libsignal/curve25519/ed25519/fe_tobytes.c
Executable file
|
|
@ -0,0 +1,119 @@
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
Preconditions:
|
||||||
|
|h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
|
||||||
|
|
||||||
|
Write p=2^255-19; q=floor(h/p).
|
||||||
|
Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
|
||||||
|
|
||||||
|
Proof:
|
||||||
|
Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
|
||||||
|
Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
|
||||||
|
|
||||||
|
Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
|
||||||
|
Then 0<y<1.
|
||||||
|
|
||||||
|
Write r=h-pq.
|
||||||
|
Have 0<=r<=p-1=2^255-20.
|
||||||
|
Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
|
||||||
|
|
||||||
|
Write x=r+19(2^-255)r+y.
|
||||||
|
Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
|
||||||
|
|
||||||
|
Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
|
||||||
|
so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void fe_tobytes(unsigned char *s,const fe h)
|
||||||
|
{
|
||||||
|
crypto_int32 h0 = h[0];
|
||||||
|
crypto_int32 h1 = h[1];
|
||||||
|
crypto_int32 h2 = h[2];
|
||||||
|
crypto_int32 h3 = h[3];
|
||||||
|
crypto_int32 h4 = h[4];
|
||||||
|
crypto_int32 h5 = h[5];
|
||||||
|
crypto_int32 h6 = h[6];
|
||||||
|
crypto_int32 h7 = h[7];
|
||||||
|
crypto_int32 h8 = h[8];
|
||||||
|
crypto_int32 h9 = h[9];
|
||||||
|
crypto_int32 q;
|
||||||
|
crypto_int32 carry0;
|
||||||
|
crypto_int32 carry1;
|
||||||
|
crypto_int32 carry2;
|
||||||
|
crypto_int32 carry3;
|
||||||
|
crypto_int32 carry4;
|
||||||
|
crypto_int32 carry5;
|
||||||
|
crypto_int32 carry6;
|
||||||
|
crypto_int32 carry7;
|
||||||
|
crypto_int32 carry8;
|
||||||
|
crypto_int32 carry9;
|
||||||
|
|
||||||
|
q = (19 * h9 + (((crypto_int32) 1) << 24)) >> 25;
|
||||||
|
q = (h0 + q) >> 26;
|
||||||
|
q = (h1 + q) >> 25;
|
||||||
|
q = (h2 + q) >> 26;
|
||||||
|
q = (h3 + q) >> 25;
|
||||||
|
q = (h4 + q) >> 26;
|
||||||
|
q = (h5 + q) >> 25;
|
||||||
|
q = (h6 + q) >> 26;
|
||||||
|
q = (h7 + q) >> 25;
|
||||||
|
q = (h8 + q) >> 26;
|
||||||
|
q = (h9 + q) >> 25;
|
||||||
|
|
||||||
|
/* Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20. */
|
||||||
|
h0 += 19 * q;
|
||||||
|
/* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */
|
||||||
|
|
||||||
|
carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 << 26;
|
||||||
|
carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 << 25;
|
||||||
|
carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 << 26;
|
||||||
|
carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 << 25;
|
||||||
|
carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 << 26;
|
||||||
|
carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 << 25;
|
||||||
|
carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 << 26;
|
||||||
|
carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 << 25;
|
||||||
|
carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 << 26;
|
||||||
|
carry9 = h9 >> 25; h9 -= carry9 << 25;
|
||||||
|
/* h10 = carry9 */
|
||||||
|
|
||||||
|
/*
|
||||||
|
Goal: Output h0+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
|
||||||
|
Have h0+...+2^230 h9 between 0 and 2^255-1;
|
||||||
|
evidently 2^255 h10-2^255 q = 0.
|
||||||
|
Goal: Output h0+...+2^230 h9.
|
||||||
|
*/
|
||||||
|
|
||||||
|
s[0] = h0 >> 0;
|
||||||
|
s[1] = h0 >> 8;
|
||||||
|
s[2] = h0 >> 16;
|
||||||
|
s[3] = (h0 >> 24) | (h1 << 2);
|
||||||
|
s[4] = h1 >> 6;
|
||||||
|
s[5] = h1 >> 14;
|
||||||
|
s[6] = (h1 >> 22) | (h2 << 3);
|
||||||
|
s[7] = h2 >> 5;
|
||||||
|
s[8] = h2 >> 13;
|
||||||
|
s[9] = (h2 >> 21) | (h3 << 5);
|
||||||
|
s[10] = h3 >> 3;
|
||||||
|
s[11] = h3 >> 11;
|
||||||
|
s[12] = (h3 >> 19) | (h4 << 6);
|
||||||
|
s[13] = h4 >> 2;
|
||||||
|
s[14] = h4 >> 10;
|
||||||
|
s[15] = h4 >> 18;
|
||||||
|
s[16] = h5 >> 0;
|
||||||
|
s[17] = h5 >> 8;
|
||||||
|
s[18] = h5 >> 16;
|
||||||
|
s[19] = (h5 >> 24) | (h6 << 1);
|
||||||
|
s[20] = h6 >> 7;
|
||||||
|
s[21] = h6 >> 15;
|
||||||
|
s[22] = (h6 >> 23) | (h7 << 3);
|
||||||
|
s[23] = h7 >> 5;
|
||||||
|
s[24] = h7 >> 13;
|
||||||
|
s[25] = (h7 >> 21) | (h8 << 4);
|
||||||
|
s[26] = h8 >> 4;
|
||||||
|
s[27] = h8 >> 12;
|
||||||
|
s[28] = (h8 >> 20) | (h9 << 6);
|
||||||
|
s[29] = h9 >> 2;
|
||||||
|
s[30] = h9 >> 10;
|
||||||
|
s[31] = h9 >> 18;
|
||||||
|
}
|
||||||
95
Sources/libsignal/curve25519/ed25519/ge.h
Executable file
95
Sources/libsignal/curve25519/ed25519/ge.h
Executable file
|
|
@ -0,0 +1,95 @@
|
||||||
|
#ifndef GE_H
|
||||||
|
#define GE_H
|
||||||
|
|
||||||
|
/*
|
||||||
|
ge means group element.
|
||||||
|
|
||||||
|
Here the group is the set of pairs (x,y) of field elements (see fe.h)
|
||||||
|
satisfying -x^2 + y^2 = 1 + d x^2y^2
|
||||||
|
where d = -121665/121666.
|
||||||
|
|
||||||
|
Representations:
|
||||||
|
ge_p2 (projective): (X:Y:Z) satisfying x=X/Z, y=Y/Z
|
||||||
|
ge_p3 (extended): (X:Y:Z:T) satisfying x=X/Z, y=Y/Z, XY=ZT
|
||||||
|
ge_p1p1 (completed): ((X:Z),(Y:T)) satisfying x=X/Z, y=Y/T
|
||||||
|
ge_precomp (Duif): (y+x,y-x,2dxy)
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "fe.h"
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
fe X;
|
||||||
|
fe Y;
|
||||||
|
fe Z;
|
||||||
|
} ge_p2;
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
fe X;
|
||||||
|
fe Y;
|
||||||
|
fe Z;
|
||||||
|
fe T;
|
||||||
|
} ge_p3;
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
fe X;
|
||||||
|
fe Y;
|
||||||
|
fe Z;
|
||||||
|
fe T;
|
||||||
|
} ge_p1p1;
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
fe yplusx;
|
||||||
|
fe yminusx;
|
||||||
|
fe xy2d;
|
||||||
|
} ge_precomp;
|
||||||
|
|
||||||
|
typedef struct {
|
||||||
|
fe YplusX;
|
||||||
|
fe YminusX;
|
||||||
|
fe Z;
|
||||||
|
fe T2d;
|
||||||
|
} ge_cached;
|
||||||
|
|
||||||
|
#define ge_frombytes_negate_vartime crypto_sign_ed25519_ref10_ge_frombytes_negate_vartime
|
||||||
|
#define ge_tobytes crypto_sign_ed25519_ref10_ge_tobytes
|
||||||
|
#define ge_p3_tobytes crypto_sign_ed25519_ref10_ge_p3_tobytes
|
||||||
|
|
||||||
|
#define ge_p2_0 crypto_sign_ed25519_ref10_ge_p2_0
|
||||||
|
#define ge_p3_0 crypto_sign_ed25519_ref10_ge_p3_0
|
||||||
|
#define ge_precomp_0 crypto_sign_ed25519_ref10_ge_precomp_0
|
||||||
|
#define ge_p3_to_p2 crypto_sign_ed25519_ref10_ge_p3_to_p2
|
||||||
|
#define ge_p3_to_cached crypto_sign_ed25519_ref10_ge_p3_to_cached
|
||||||
|
#define ge_p1p1_to_p2 crypto_sign_ed25519_ref10_ge_p1p1_to_p2
|
||||||
|
#define ge_p1p1_to_p3 crypto_sign_ed25519_ref10_ge_p1p1_to_p3
|
||||||
|
#define ge_p2_dbl crypto_sign_ed25519_ref10_ge_p2_dbl
|
||||||
|
#define ge_p3_dbl crypto_sign_ed25519_ref10_ge_p3_dbl
|
||||||
|
|
||||||
|
#define ge_madd crypto_sign_ed25519_ref10_ge_madd
|
||||||
|
#define ge_msub crypto_sign_ed25519_ref10_ge_msub
|
||||||
|
#define ge_add crypto_sign_ed25519_ref10_ge_add
|
||||||
|
#define ge_sub crypto_sign_ed25519_ref10_ge_sub
|
||||||
|
#define ge_scalarmult_base crypto_sign_ed25519_ref10_ge_scalarmult_base
|
||||||
|
#define ge_double_scalarmult_vartime crypto_sign_ed25519_ref10_ge_double_scalarmult_vartime
|
||||||
|
|
||||||
|
extern void ge_tobytes(unsigned char *,const ge_p2 *);
|
||||||
|
extern void ge_p3_tobytes(unsigned char *,const ge_p3 *);
|
||||||
|
extern int ge_frombytes_negate_vartime(ge_p3 *,const unsigned char *);
|
||||||
|
|
||||||
|
extern void ge_p2_0(ge_p2 *);
|
||||||
|
extern void ge_p3_0(ge_p3 *);
|
||||||
|
extern void ge_precomp_0(ge_precomp *);
|
||||||
|
extern void ge_p3_to_p2(ge_p2 *,const ge_p3 *);
|
||||||
|
extern void ge_p3_to_cached(ge_cached *,const ge_p3 *);
|
||||||
|
extern void ge_p1p1_to_p2(ge_p2 *,const ge_p1p1 *);
|
||||||
|
extern void ge_p1p1_to_p3(ge_p3 *,const ge_p1p1 *);
|
||||||
|
extern void ge_p2_dbl(ge_p1p1 *,const ge_p2 *);
|
||||||
|
extern void ge_p3_dbl(ge_p1p1 *,const ge_p3 *);
|
||||||
|
|
||||||
|
extern void ge_madd(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||||
|
extern void ge_msub(ge_p1p1 *,const ge_p3 *,const ge_precomp *);
|
||||||
|
extern void ge_add(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||||
|
extern void ge_sub(ge_p1p1 *,const ge_p3 *,const ge_cached *);
|
||||||
|
extern void ge_scalarmult_base(ge_p3 *,const unsigned char *);
|
||||||
|
extern void ge_double_scalarmult_vartime(ge_p2 *,const unsigned char *,const ge_p3 *,const unsigned char *);
|
||||||
|
|
||||||
|
#endif
|
||||||
11
Sources/libsignal/curve25519/ed25519/ge_add.c
Executable file
11
Sources/libsignal/curve25519/ed25519/ge_add.c
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p + q
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_add(ge_p1p1 *r,const ge_p3 *p,const ge_cached *q)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
#include "ge_add.h"
|
||||||
|
}
|
||||||
97
Sources/libsignal/curve25519/ed25519/ge_add.h
Executable file
97
Sources/libsignal/curve25519/ed25519/ge_add.h
Executable file
|
|
@ -0,0 +1,97 @@
|
||||||
|
|
||||||
|
/* qhasm: enter ge_add */
|
||||||
|
|
||||||
|
/* qhasm: fe X1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z2 */
|
||||||
|
|
||||||
|
/* qhasm: fe T1 */
|
||||||
|
|
||||||
|
/* qhasm: fe ZZ */
|
||||||
|
|
||||||
|
/* qhasm: fe YpX2 */
|
||||||
|
|
||||||
|
/* qhasm: fe YmX2 */
|
||||||
|
|
||||||
|
/* qhasm: fe T2d2 */
|
||||||
|
|
||||||
|
/* qhasm: fe X3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z3 */
|
||||||
|
|
||||||
|
/* qhasm: fe T3 */
|
||||||
|
|
||||||
|
/* qhasm: fe YpX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe YmX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe A */
|
||||||
|
|
||||||
|
/* qhasm: fe B */
|
||||||
|
|
||||||
|
/* qhasm: fe C */
|
||||||
|
|
||||||
|
/* qhasm: fe D */
|
||||||
|
|
||||||
|
/* qhasm: YpX1 = Y1+X1 */
|
||||||
|
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_add(r->X,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: YmX1 = Y1-X1 */
|
||||||
|
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_sub(r->Y,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: A = YpX1*YpX2 */
|
||||||
|
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<YpX2=fe#15); */
|
||||||
|
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<YpX2=q->YplusX); */
|
||||||
|
fe_mul(r->Z,r->X,q->YplusX);
|
||||||
|
|
||||||
|
/* qhasm: B = YmX1*YmX2 */
|
||||||
|
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<YmX2=fe#16); */
|
||||||
|
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<YmX2=q->YminusX); */
|
||||||
|
fe_mul(r->Y,r->Y,q->YminusX);
|
||||||
|
|
||||||
|
/* qhasm: C = T2d2*T1 */
|
||||||
|
/* asm 1: fe_mul(>C=fe#4,<T2d2=fe#18,<T1=fe#14); */
|
||||||
|
/* asm 2: fe_mul(>C=r->T,<T2d2=q->T2d,<T1=p->T); */
|
||||||
|
fe_mul(r->T,q->T2d,p->T);
|
||||||
|
|
||||||
|
/* qhasm: ZZ = Z1*Z2 */
|
||||||
|
/* asm 1: fe_mul(>ZZ=fe#1,<Z1=fe#13,<Z2=fe#17); */
|
||||||
|
/* asm 2: fe_mul(>ZZ=r->X,<Z1=p->Z,<Z2=q->Z); */
|
||||||
|
fe_mul(r->X,p->Z,q->Z);
|
||||||
|
|
||||||
|
/* qhasm: D = 2*ZZ */
|
||||||
|
/* asm 1: fe_add(>D=fe#5,<ZZ=fe#1,<ZZ=fe#1); */
|
||||||
|
/* asm 2: fe_add(>D=t0,<ZZ=r->X,<ZZ=r->X); */
|
||||||
|
fe_add(t0,r->X,r->X);
|
||||||
|
|
||||||
|
/* qhasm: X3 = A-B */
|
||||||
|
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_sub(r->X,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Y3 = A+B */
|
||||||
|
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_add(r->Y,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Z3 = D+C */
|
||||||
|
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||||
|
fe_add(r->Z,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: T3 = D-C */
|
||||||
|
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||||
|
fe_sub(r->T,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: return */
|
||||||
96
Sources/libsignal/curve25519/ed25519/ge_double_scalarmult.c
Executable file
96
Sources/libsignal/curve25519/ed25519/ge_double_scalarmult.c
Executable file
|
|
@ -0,0 +1,96 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
static void slide(signed char *r,const unsigned char *a)
|
||||||
|
{
|
||||||
|
int i;
|
||||||
|
int b;
|
||||||
|
int k;
|
||||||
|
|
||||||
|
for (i = 0;i < 256;++i)
|
||||||
|
r[i] = 1 & (a[i >> 3] >> (i & 7));
|
||||||
|
|
||||||
|
for (i = 0;i < 256;++i)
|
||||||
|
if (r[i]) {
|
||||||
|
for (b = 1;b <= 6 && i + b < 256;++b) {
|
||||||
|
if (r[i + b]) {
|
||||||
|
if (r[i] + (r[i + b] << b) <= 15) {
|
||||||
|
r[i] += r[i + b] << b; r[i + b] = 0;
|
||||||
|
} else if (r[i] - (r[i + b] << b) >= -15) {
|
||||||
|
r[i] -= r[i + b] << b;
|
||||||
|
for (k = i + b;k < 256;++k) {
|
||||||
|
if (!r[k]) {
|
||||||
|
r[k] = 1;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
r[k] = 0;
|
||||||
|
}
|
||||||
|
} else
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
static ge_precomp Bi[8] = {
|
||||||
|
#include "base2.h"
|
||||||
|
} ;
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = a * A + b * B
|
||||||
|
where a = a[0]+256*a[1]+...+256^31 a[31].
|
||||||
|
and b = b[0]+256*b[1]+...+256^31 b[31].
|
||||||
|
B is the Ed25519 base point (x,4/5) with x positive.
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_double_scalarmult_vartime(ge_p2 *r,const unsigned char *a,const ge_p3 *A,const unsigned char *b)
|
||||||
|
{
|
||||||
|
signed char aslide[256];
|
||||||
|
signed char bslide[256];
|
||||||
|
ge_cached Ai[8]; /* A,3A,5A,7A,9A,11A,13A,15A */
|
||||||
|
ge_p1p1 t;
|
||||||
|
ge_p3 u;
|
||||||
|
ge_p3 A2;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
slide(aslide,a);
|
||||||
|
slide(bslide,b);
|
||||||
|
|
||||||
|
ge_p3_to_cached(&Ai[0],A);
|
||||||
|
ge_p3_dbl(&t,A); ge_p1p1_to_p3(&A2,&t);
|
||||||
|
ge_add(&t,&A2,&Ai[0]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[1],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[1]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[2],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[2]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[3],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[3]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[4],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[4]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[5],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[5]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[6],&u);
|
||||||
|
ge_add(&t,&A2,&Ai[6]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[7],&u);
|
||||||
|
|
||||||
|
ge_p2_0(r);
|
||||||
|
|
||||||
|
for (i = 255;i >= 0;--i) {
|
||||||
|
if (aslide[i] || bslide[i]) break;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (;i >= 0;--i) {
|
||||||
|
ge_p2_dbl(&t,r);
|
||||||
|
|
||||||
|
if (aslide[i] > 0) {
|
||||||
|
ge_p1p1_to_p3(&u,&t);
|
||||||
|
ge_add(&t,&u,&Ai[aslide[i]/2]);
|
||||||
|
} else if (aslide[i] < 0) {
|
||||||
|
ge_p1p1_to_p3(&u,&t);
|
||||||
|
ge_sub(&t,&u,&Ai[(-aslide[i])/2]);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bslide[i] > 0) {
|
||||||
|
ge_p1p1_to_p3(&u,&t);
|
||||||
|
ge_madd(&t,&u,&Bi[bslide[i]/2]);
|
||||||
|
} else if (bslide[i] < 0) {
|
||||||
|
ge_p1p1_to_p3(&u,&t);
|
||||||
|
ge_msub(&t,&u,&Bi[(-bslide[i])/2]);
|
||||||
|
}
|
||||||
|
|
||||||
|
ge_p1p1_to_p2(r,&t);
|
||||||
|
}
|
||||||
|
}
|
||||||
50
Sources/libsignal/curve25519/ed25519/ge_frombytes.c
Executable file
50
Sources/libsignal/curve25519/ed25519/ge_frombytes.c
Executable file
|
|
@ -0,0 +1,50 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
static const fe d = {
|
||||||
|
#include "d.h"
|
||||||
|
} ;
|
||||||
|
|
||||||
|
static const fe sqrtm1 = {
|
||||||
|
#include "sqrtm1.h"
|
||||||
|
} ;
|
||||||
|
|
||||||
|
int ge_frombytes_negate_vartime(ge_p3 *h,const unsigned char *s)
|
||||||
|
{
|
||||||
|
fe u;
|
||||||
|
fe v;
|
||||||
|
fe v3;
|
||||||
|
fe vxx;
|
||||||
|
fe check;
|
||||||
|
|
||||||
|
fe_frombytes(h->Y,s);
|
||||||
|
fe_1(h->Z);
|
||||||
|
fe_sq(u,h->Y);
|
||||||
|
fe_mul(v,u,d);
|
||||||
|
fe_sub(u,u,h->Z); /* u = y^2-1 */
|
||||||
|
fe_add(v,v,h->Z); /* v = dy^2+1 */
|
||||||
|
|
||||||
|
fe_sq(v3,v);
|
||||||
|
fe_mul(v3,v3,v); /* v3 = v^3 */
|
||||||
|
fe_sq(h->X,v3);
|
||||||
|
fe_mul(h->X,h->X,v);
|
||||||
|
fe_mul(h->X,h->X,u); /* x = uv^7 */
|
||||||
|
|
||||||
|
fe_pow22523(h->X,h->X); /* x = (uv^7)^((q-5)/8) */
|
||||||
|
fe_mul(h->X,h->X,v3);
|
||||||
|
fe_mul(h->X,h->X,u); /* x = uv^3(uv^7)^((q-5)/8) */
|
||||||
|
|
||||||
|
fe_sq(vxx,h->X);
|
||||||
|
fe_mul(vxx,vxx,v);
|
||||||
|
fe_sub(check,vxx,u); /* vx^2-u */
|
||||||
|
if (fe_isnonzero(check)) {
|
||||||
|
fe_add(check,vxx,u); /* vx^2+u */
|
||||||
|
if (fe_isnonzero(check)) return -1;
|
||||||
|
fe_mul(h->X,h->X,sqrtm1);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (fe_isnegative(h->X) == (s[31] >> 7))
|
||||||
|
fe_neg(h->X,h->X);
|
||||||
|
|
||||||
|
fe_mul(h->T,h->X,h->Y);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
11
Sources/libsignal/curve25519/ed25519/ge_madd.c
Executable file
11
Sources/libsignal/curve25519/ed25519/ge_madd.c
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p + q
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_madd(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
#include "ge_madd.h"
|
||||||
|
}
|
||||||
88
Sources/libsignal/curve25519/ed25519/ge_madd.h
Executable file
88
Sources/libsignal/curve25519/ed25519/ge_madd.h
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
|
||||||
|
/* qhasm: enter ge_madd */
|
||||||
|
|
||||||
|
/* qhasm: fe X1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z1 */
|
||||||
|
|
||||||
|
/* qhasm: fe T1 */
|
||||||
|
|
||||||
|
/* qhasm: fe ypx2 */
|
||||||
|
|
||||||
|
/* qhasm: fe ymx2 */
|
||||||
|
|
||||||
|
/* qhasm: fe xy2d2 */
|
||||||
|
|
||||||
|
/* qhasm: fe X3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z3 */
|
||||||
|
|
||||||
|
/* qhasm: fe T3 */
|
||||||
|
|
||||||
|
/* qhasm: fe YpX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe YmX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe A */
|
||||||
|
|
||||||
|
/* qhasm: fe B */
|
||||||
|
|
||||||
|
/* qhasm: fe C */
|
||||||
|
|
||||||
|
/* qhasm: fe D */
|
||||||
|
|
||||||
|
/* qhasm: YpX1 = Y1+X1 */
|
||||||
|
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_add(r->X,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: YmX1 = Y1-X1 */
|
||||||
|
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_sub(r->Y,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: A = YpX1*ypx2 */
|
||||||
|
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ypx2=fe#15); */
|
||||||
|
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ypx2=q->yplusx); */
|
||||||
|
fe_mul(r->Z,r->X,q->yplusx);
|
||||||
|
|
||||||
|
/* qhasm: B = YmX1*ymx2 */
|
||||||
|
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ymx2=fe#16); */
|
||||||
|
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ymx2=q->yminusx); */
|
||||||
|
fe_mul(r->Y,r->Y,q->yminusx);
|
||||||
|
|
||||||
|
/* qhasm: C = xy2d2*T1 */
|
||||||
|
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||||
|
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||||
|
fe_mul(r->T,q->xy2d,p->T);
|
||||||
|
|
||||||
|
/* qhasm: D = 2*Z1 */
|
||||||
|
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||||
|
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||||
|
fe_add(t0,p->Z,p->Z);
|
||||||
|
|
||||||
|
/* qhasm: X3 = A-B */
|
||||||
|
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_sub(r->X,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Y3 = A+B */
|
||||||
|
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_add(r->Y,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Z3 = D+C */
|
||||||
|
/* asm 1: fe_add(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_add(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||||
|
fe_add(r->Z,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: T3 = D-C */
|
||||||
|
/* asm 1: fe_sub(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_sub(>T3=r->T,<D=t0,<C=r->T); */
|
||||||
|
fe_sub(r->T,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: return */
|
||||||
11
Sources/libsignal/curve25519/ed25519/ge_msub.c
Executable file
11
Sources/libsignal/curve25519/ed25519/ge_msub.c
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p - q
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_msub(ge_p1p1 *r,const ge_p3 *p,const ge_precomp *q)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
#include "ge_msub.h"
|
||||||
|
}
|
||||||
88
Sources/libsignal/curve25519/ed25519/ge_msub.h
Executable file
88
Sources/libsignal/curve25519/ed25519/ge_msub.h
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
|
||||||
|
/* qhasm: enter ge_msub */
|
||||||
|
|
||||||
|
/* qhasm: fe X1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z1 */
|
||||||
|
|
||||||
|
/* qhasm: fe T1 */
|
||||||
|
|
||||||
|
/* qhasm: fe ypx2 */
|
||||||
|
|
||||||
|
/* qhasm: fe ymx2 */
|
||||||
|
|
||||||
|
/* qhasm: fe xy2d2 */
|
||||||
|
|
||||||
|
/* qhasm: fe X3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z3 */
|
||||||
|
|
||||||
|
/* qhasm: fe T3 */
|
||||||
|
|
||||||
|
/* qhasm: fe YpX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe YmX1 */
|
||||||
|
|
||||||
|
/* qhasm: fe A */
|
||||||
|
|
||||||
|
/* qhasm: fe B */
|
||||||
|
|
||||||
|
/* qhasm: fe C */
|
||||||
|
|
||||||
|
/* qhasm: fe D */
|
||||||
|
|
||||||
|
/* qhasm: YpX1 = Y1+X1 */
|
||||||
|
/* asm 1: fe_add(>YpX1=fe#1,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_add(>YpX1=r->X,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_add(r->X,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: YmX1 = Y1-X1 */
|
||||||
|
/* asm 1: fe_sub(>YmX1=fe#2,<Y1=fe#12,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_sub(>YmX1=r->Y,<Y1=p->Y,<X1=p->X); */
|
||||||
|
fe_sub(r->Y,p->Y,p->X);
|
||||||
|
|
||||||
|
/* qhasm: A = YpX1*ymx2 */
|
||||||
|
/* asm 1: fe_mul(>A=fe#3,<YpX1=fe#1,<ymx2=fe#16); */
|
||||||
|
/* asm 2: fe_mul(>A=r->Z,<YpX1=r->X,<ymx2=q->yminusx); */
|
||||||
|
fe_mul(r->Z,r->X,q->yminusx);
|
||||||
|
|
||||||
|
/* qhasm: B = YmX1*ypx2 */
|
||||||
|
/* asm 1: fe_mul(>B=fe#2,<YmX1=fe#2,<ypx2=fe#15); */
|
||||||
|
/* asm 2: fe_mul(>B=r->Y,<YmX1=r->Y,<ypx2=q->yplusx); */
|
||||||
|
fe_mul(r->Y,r->Y,q->yplusx);
|
||||||
|
|
||||||
|
/* qhasm: C = xy2d2*T1 */
|
||||||
|
/* asm 1: fe_mul(>C=fe#4,<xy2d2=fe#17,<T1=fe#14); */
|
||||||
|
/* asm 2: fe_mul(>C=r->T,<xy2d2=q->xy2d,<T1=p->T); */
|
||||||
|
fe_mul(r->T,q->xy2d,p->T);
|
||||||
|
|
||||||
|
/* qhasm: D = 2*Z1 */
|
||||||
|
/* asm 1: fe_add(>D=fe#5,<Z1=fe#13,<Z1=fe#13); */
|
||||||
|
/* asm 2: fe_add(>D=t0,<Z1=p->Z,<Z1=p->Z); */
|
||||||
|
fe_add(t0,p->Z,p->Z);
|
||||||
|
|
||||||
|
/* qhasm: X3 = A-B */
|
||||||
|
/* asm 1: fe_sub(>X3=fe#1,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_sub(>X3=r->X,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_sub(r->X,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Y3 = A+B */
|
||||||
|
/* asm 1: fe_add(>Y3=fe#2,<A=fe#3,<B=fe#2); */
|
||||||
|
/* asm 2: fe_add(>Y3=r->Y,<A=r->Z,<B=r->Y); */
|
||||||
|
fe_add(r->Y,r->Z,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Z3 = D-C */
|
||||||
|
/* asm 1: fe_sub(>Z3=fe#3,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_sub(>Z3=r->Z,<D=t0,<C=r->T); */
|
||||||
|
fe_sub(r->Z,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: T3 = D+C */
|
||||||
|
/* asm 1: fe_add(>T3=fe#4,<D=fe#5,<C=fe#4); */
|
||||||
|
/* asm 2: fe_add(>T3=r->T,<D=t0,<C=r->T); */
|
||||||
|
fe_add(r->T,t0,r->T);
|
||||||
|
|
||||||
|
/* qhasm: return */
|
||||||
12
Sources/libsignal/curve25519/ed25519/ge_p1p1_to_p2.c
Executable file
12
Sources/libsignal/curve25519/ed25519/ge_p1p1_to_p2.c
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p
|
||||||
|
*/
|
||||||
|
|
||||||
|
extern void ge_p1p1_to_p2(ge_p2 *r,const ge_p1p1 *p)
|
||||||
|
{
|
||||||
|
fe_mul(r->X,p->X,p->T);
|
||||||
|
fe_mul(r->Y,p->Y,p->Z);
|
||||||
|
fe_mul(r->Z,p->Z,p->T);
|
||||||
|
}
|
||||||
13
Sources/libsignal/curve25519/ed25519/ge_p1p1_to_p3.c
Executable file
13
Sources/libsignal/curve25519/ed25519/ge_p1p1_to_p3.c
Executable file
|
|
@ -0,0 +1,13 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p
|
||||||
|
*/
|
||||||
|
|
||||||
|
extern void ge_p1p1_to_p3(ge_p3 *r,const ge_p1p1 *p)
|
||||||
|
{
|
||||||
|
fe_mul(r->X,p->X,p->T);
|
||||||
|
fe_mul(r->Y,p->Y,p->Z);
|
||||||
|
fe_mul(r->Z,p->Z,p->T);
|
||||||
|
fe_mul(r->T,p->X,p->Y);
|
||||||
|
}
|
||||||
8
Sources/libsignal/curve25519/ed25519/ge_p2_0.c
Executable file
8
Sources/libsignal/curve25519/ed25519/ge_p2_0.c
Executable file
|
|
@ -0,0 +1,8 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
void ge_p2_0(ge_p2 *h)
|
||||||
|
{
|
||||||
|
fe_0(h->X);
|
||||||
|
fe_1(h->Y);
|
||||||
|
fe_1(h->Z);
|
||||||
|
}
|
||||||
11
Sources/libsignal/curve25519/ed25519/ge_p2_dbl.c
Executable file
11
Sources/libsignal/curve25519/ed25519/ge_p2_dbl.c
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = 2 * p
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_p2_dbl(ge_p1p1 *r,const ge_p2 *p)
|
||||||
|
{
|
||||||
|
fe t0;
|
||||||
|
#include "ge_p2_dbl.h"
|
||||||
|
}
|
||||||
73
Sources/libsignal/curve25519/ed25519/ge_p2_dbl.h
Executable file
73
Sources/libsignal/curve25519/ed25519/ge_p2_dbl.h
Executable file
|
|
@ -0,0 +1,73 @@
|
||||||
|
|
||||||
|
/* qhasm: enter ge_p2_dbl */
|
||||||
|
|
||||||
|
/* qhasm: fe X1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y1 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z1 */
|
||||||
|
|
||||||
|
/* qhasm: fe A */
|
||||||
|
|
||||||
|
/* qhasm: fe AA */
|
||||||
|
|
||||||
|
/* qhasm: fe XX */
|
||||||
|
|
||||||
|
/* qhasm: fe YY */
|
||||||
|
|
||||||
|
/* qhasm: fe B */
|
||||||
|
|
||||||
|
/* qhasm: fe X3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Y3 */
|
||||||
|
|
||||||
|
/* qhasm: fe Z3 */
|
||||||
|
|
||||||
|
/* qhasm: fe T3 */
|
||||||
|
|
||||||
|
/* qhasm: XX=X1^2 */
|
||||||
|
/* asm 1: fe_sq(>XX=fe#1,<X1=fe#11); */
|
||||||
|
/* asm 2: fe_sq(>XX=r->X,<X1=p->X); */
|
||||||
|
fe_sq(r->X,p->X);
|
||||||
|
|
||||||
|
/* qhasm: YY=Y1^2 */
|
||||||
|
/* asm 1: fe_sq(>YY=fe#3,<Y1=fe#12); */
|
||||||
|
/* asm 2: fe_sq(>YY=r->Z,<Y1=p->Y); */
|
||||||
|
fe_sq(r->Z,p->Y);
|
||||||
|
|
||||||
|
/* qhasm: B=2*Z1^2 */
|
||||||
|
/* asm 1: fe_sq2(>B=fe#4,<Z1=fe#13); */
|
||||||
|
/* asm 2: fe_sq2(>B=r->T,<Z1=p->Z); */
|
||||||
|
fe_sq2(r->T,p->Z);
|
||||||
|
|
||||||
|
/* qhasm: A=X1+Y1 */
|
||||||
|
/* asm 1: fe_add(>A=fe#2,<X1=fe#11,<Y1=fe#12); */
|
||||||
|
/* asm 2: fe_add(>A=r->Y,<X1=p->X,<Y1=p->Y); */
|
||||||
|
fe_add(r->Y,p->X,p->Y);
|
||||||
|
|
||||||
|
/* qhasm: AA=A^2 */
|
||||||
|
/* asm 1: fe_sq(>AA=fe#5,<A=fe#2); */
|
||||||
|
/* asm 2: fe_sq(>AA=t0,<A=r->Y); */
|
||||||
|
fe_sq(t0,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: Y3=YY+XX */
|
||||||
|
/* asm 1: fe_add(>Y3=fe#2,<YY=fe#3,<XX=fe#1); */
|
||||||
|
/* asm 2: fe_add(>Y3=r->Y,<YY=r->Z,<XX=r->X); */
|
||||||
|
fe_add(r->Y,r->Z,r->X);
|
||||||
|
|
||||||
|
/* qhasm: Z3=YY-XX */
|
||||||
|
/* asm 1: fe_sub(>Z3=fe#3,<YY=fe#3,<XX=fe#1); */
|
||||||
|
/* asm 2: fe_sub(>Z3=r->Z,<YY=r->Z,<XX=r->X); */
|
||||||
|
fe_sub(r->Z,r->Z,r->X);
|
||||||
|
|
||||||
|
/* qhasm: X3=AA-Y3 */
|
||||||
|
/* asm 1: fe_sub(>X3=fe#1,<AA=fe#5,<Y3=fe#2); */
|
||||||
|
/* asm 2: fe_sub(>X3=r->X,<AA=t0,<Y3=r->Y); */
|
||||||
|
fe_sub(r->X,t0,r->Y);
|
||||||
|
|
||||||
|
/* qhasm: T3=B-Z3 */
|
||||||
|
/* asm 1: fe_sub(>T3=fe#4,<B=fe#4,<Z3=fe#3); */
|
||||||
|
/* asm 2: fe_sub(>T3=r->T,<B=r->T,<Z3=r->Z); */
|
||||||
|
fe_sub(r->T,r->T,r->Z);
|
||||||
|
|
||||||
|
/* qhasm: return */
|
||||||
9
Sources/libsignal/curve25519/ed25519/ge_p3_0.c
Executable file
9
Sources/libsignal/curve25519/ed25519/ge_p3_0.c
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
void ge_p3_0(ge_p3 *h)
|
||||||
|
{
|
||||||
|
fe_0(h->X);
|
||||||
|
fe_1(h->Y);
|
||||||
|
fe_1(h->Z);
|
||||||
|
fe_0(h->T);
|
||||||
|
}
|
||||||
12
Sources/libsignal/curve25519/ed25519/ge_p3_dbl.c
Executable file
12
Sources/libsignal/curve25519/ed25519/ge_p3_dbl.c
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = 2 * p
|
||||||
|
*/
|
||||||
|
|
||||||
|
void ge_p3_dbl(ge_p1p1 *r,const ge_p3 *p)
|
||||||
|
{
|
||||||
|
ge_p2 q;
|
||||||
|
ge_p3_to_p2(&q,p);
|
||||||
|
ge_p2_dbl(r,&q);
|
||||||
|
}
|
||||||
17
Sources/libsignal/curve25519/ed25519/ge_p3_to_cached.c
Executable file
17
Sources/libsignal/curve25519/ed25519/ge_p3_to_cached.c
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p
|
||||||
|
*/
|
||||||
|
|
||||||
|
static const fe d2 = {
|
||||||
|
#include "d2.h"
|
||||||
|
} ;
|
||||||
|
|
||||||
|
extern void ge_p3_to_cached(ge_cached *r,const ge_p3 *p)
|
||||||
|
{
|
||||||
|
fe_add(r->YplusX,p->Y,p->X);
|
||||||
|
fe_sub(r->YminusX,p->Y,p->X);
|
||||||
|
fe_copy(r->Z,p->Z);
|
||||||
|
fe_mul(r->T2d,p->T,d2);
|
||||||
|
}
|
||||||
12
Sources/libsignal/curve25519/ed25519/ge_p3_to_p2.c
Executable file
12
Sources/libsignal/curve25519/ed25519/ge_p3_to_p2.c
Executable file
|
|
@ -0,0 +1,12 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
r = p
|
||||||
|
*/
|
||||||
|
|
||||||
|
extern void ge_p3_to_p2(ge_p2 *r,const ge_p3 *p)
|
||||||
|
{
|
||||||
|
fe_copy(r->X,p->X);
|
||||||
|
fe_copy(r->Y,p->Y);
|
||||||
|
fe_copy(r->Z,p->Z);
|
||||||
|
}
|
||||||
14
Sources/libsignal/curve25519/ed25519/ge_p3_tobytes.c
Executable file
14
Sources/libsignal/curve25519/ed25519/ge_p3_tobytes.c
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
void ge_p3_tobytes(unsigned char *s,const ge_p3 *h)
|
||||||
|
{
|
||||||
|
fe recip;
|
||||||
|
fe x;
|
||||||
|
fe y;
|
||||||
|
|
||||||
|
fe_invert(recip,h->Z);
|
||||||
|
fe_mul(x,h->X,recip);
|
||||||
|
fe_mul(y,h->Y,recip);
|
||||||
|
fe_tobytes(s,y);
|
||||||
|
s[31] ^= fe_isnegative(x) << 7;
|
||||||
|
}
|
||||||
8
Sources/libsignal/curve25519/ed25519/ge_precomp_0.c
Executable file
8
Sources/libsignal/curve25519/ed25519/ge_precomp_0.c
Executable file
|
|
@ -0,0 +1,8 @@
|
||||||
|
#include "ge.h"
|
||||||
|
|
||||||
|
void ge_precomp_0(ge_precomp *h)
|
||||||
|
{
|
||||||
|
fe_1(h->yplusx);
|
||||||
|
fe_1(h->yminusx);
|
||||||
|
fe_0(h->xy2d);
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue