3 * The X448 key-agreement algorithm
5 * (c) 2017 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #include <mLib/bits.h>
32 #include "montladder.h"
36 /*----- Important constants -----------------------------------------------*/
38 const octet x448_base[56] = { 5, 0, /* ... */ };
42 /*----- Key fetching ------------------------------------------------------*/
44 const key_fetchdef x448_pubfetch[] = {
45 { "pub", offsetof(x448_pub, pub), KENC_BINARY, 0 },
49 static const key_fetchdef priv[] = {
50 { "priv", offsetof(x448_priv, priv), KENC_BINARY, 0 },
54 const key_fetchdef x448_privfetch[] = {
55 { "pub", offsetof(x448_priv, pub), KENC_BINARY, 0 },
56 { "private", 0, KENC_STRUCT, priv },
60 /*----- Main code ---------------------------------------------------------*/
64 * Arguments: @octet zz[X448_OUTSZ]@ = where to put the result
65 * @const octet k[X448_KEYSZ]@ = pointer to private key
66 * @const octet qx[X448_PUBSZ]@ = pointer to public value
70 * Use: Calculates X448 of @k@ and @qx@.
73 void x448(octet zz[X448_OUTSZ],
74 const octet k[X448_KEYSZ],
75 const octet qx[X448_PUBSZ])
81 /* Load and clamp the key. The low bits are cleared to kill the small
82 * subgroups on the curve and its twist, and a high bit is set to guard
83 * against careless implementations, though this isn't one of those.
85 for (i = 0; i < 14; i++) kw[i] = LOAD32_L(k + 4*i);
86 kw[0] &= 0xfffffffc; kw[13] |= 0x80000000;
88 /* And run the ladder. */
90 #define MULA0(z, x) do { fgoldi_mulconst((z), (x), A0); } while (0)
91 MONT_LADDER(fgoldi, MULA0, kw, 14, 32, &x1, &x1);
93 fgoldi_store(zz, &x1);
96 /*----- Test rig ----------------------------------------------------------*/
100 #include <mLib/report.h>
101 #include <mLib/str.h>
102 #include <mLib/testrig.h>
104 static int vrf_x448(dstr dv[])
109 if (dv[0].len != 56) die(1, "bad key length");
110 if (dv[1].len != 56) die(1, "bad public length");
111 if (dv[2].len != 56) die(1, "bad result length");
113 dstr_ensure(&dz, 56); dz.len = 56;
114 x448((octet *)dz.buf,
115 (const octet *)dv[0].buf,
116 (const octet *)dv[1].buf);
117 if (memcmp(dz.buf, dv[2].buf, 56) != 0) {
119 fprintf(stderr, "failed!");
120 fprintf(stderr, "\n\t k = "); type_hex.dump(&dv[0], stderr);
121 fprintf(stderr, "\n\t p = "); type_hex.dump(&dv[1], stderr);
122 fprintf(stderr, "\n\twant = "); type_hex.dump(&dv[2], stderr);
123 fprintf(stderr, "\n\tcalc = "); type_hex.dump(&dz, stderr);
124 fprintf(stderr, "\n");
131 static int vrf_mct(dstr dv[])
133 octet b0[56], b1[56], *k = b0, *x = b1, *t;
134 unsigned long i, niter;
138 if (dv[0].len != sizeof(b0)) { fprintf(stderr, "k len\n"); exit(2); }
139 if (dv[1].len != sizeof(b1)) { fprintf(stderr, "x len\n"); exit(2); }
140 if (dv[3].len != sizeof(b0)) { fprintf(stderr, "result len\n"); exit(2); }
141 memcpy(b0, dv[0].buf, sizeof(b0));
142 memcpy(b1, dv[1].buf, sizeof(b1));
143 niter = *(unsigned long *)dv[2].buf;
144 dstr_ensure(&d, 56); d.len = 56; t = (octet *)d.buf;
146 for (i = 0; i < niter; i++) {
150 memcpy(d.buf, k, d.len);
152 if (memcmp(d.buf, dv[3].buf, d.len) != 0) {
154 fprintf(stderr, "failed...");
155 fprintf(stderr, "\n\tinitial k = "); type_hex.dump(&dv[0], stderr);
156 fprintf(stderr, "\n\tinitial x = "); type_hex.dump(&dv[1], stderr);
157 fprintf(stderr, "\n\titerations = %lu", niter);
158 fprintf(stderr, "\n\texpected = "); type_hex.dump(&dv[3], stderr);
159 fprintf(stderr, "\n\tcalculated = "); type_hex.dump(&d, stderr);
167 static test_chunk tests[] = {
168 { "x448", vrf_x448, { &type_hex, &type_hex, &type_hex } },
169 { "x448-mct", vrf_mct,
170 { &type_hex, &type_hex, &type_ulong, &type_hex } },
174 int main(int argc, char *argv[])
176 test_run(argc, argv, tests, SRCDIR "/t/x448");
182 /*----- That's all, folks -------------------------------------------------*/