eddsa-decompress.c

+/* eddsa-decompress.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "gmp-glue.h"
+
+mp_size_t
+_eddsa_decompress_itch (const struct ecc_curve *ecc)
+{
+  return 4*ecc->p.size + ecc->p.sqrt_ratio_itch;
+}
+
+int
+_eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p,
+		   const uint8_t *cp,
+		   mp_limb_t *scratch)
+{
+  mp_limb_t sign, cy;
+  mp_size_t nlimbs;
+  size_t nbytes;
+  int res;
+
+#define xp p
+#define yp (p + ecc->p.size)
+
+#define y2 scratch
+#define vp (scratch + ecc->p.size)
+#define up scratch
+#define tp (scratch + 2*ecc->p.size)
+#define scratch_out (scratch + 4*ecc->p.size)
+
+  nbytes = 1 + ecc->p.bit_size / 8;
+  /* By RFC 8032, sign bit is always the most significant bit of the
+     last byte. */
+  sign = cp[nbytes-1] >> 7;
+
+  /* May need an extra limb. */
+  nlimbs = (nbytes * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;
+  assert (nlimbs <= ecc->p.size + 1);
+  mpn_set_base256_le (scratch, nlimbs, cp, nbytes);
+
+  /* Clear out the sign bit */
+  scratch[nlimbs - 1] &=
+    ((mp_limb_t) 1 << ((nbytes * 8 - 1) % GMP_NUMB_BITS)) - 1;
+  mpn_copyi (yp, scratch, ecc->p.size);
+
+  /* Check range. */
+  if (nlimbs > ecc->p.size)
+    res = is_zero_limb (scratch[nlimbs - 1]);
+  else
+    res = 1;
+
+  /* For a valid input, y < p, so subtraction should underflow. */
+  res &= mpn_sub_n (scratch, scratch, ecc->p.m, ecc->p.size);
+
+  ecc_mod_sqr (&ecc->p, y2, yp, y2);
+  ecc_mod_mul (&ecc->p, vp, y2, ecc->b, vp);
+  ecc_mod_sub (&ecc->p, vp, vp, ecc->unit);
+  /* The sign is different between curve25519 and curve448.  */
+  if (ecc->p.bit_size == 255)
+    ecc_mod_sub (&ecc->p, up, ecc->unit, y2);
+  else
+    ecc_mod_sub (&ecc->p, up, y2, ecc->unit);
+  res &= ecc->p.sqrt_ratio (&ecc->p, tp, up, vp, scratch_out);
+
+  cy = mpn_sub_n (xp, tp, ecc->p.m, ecc->p.size);
+  cnd_copy (cy, xp, tp, ecc->p.size);
+  sign ^= xp[0] & 1;
+  mpn_sub_n (tp, ecc->p.m, xp, ecc->p.size);
+  cnd_copy (sign, xp, tp, ecc->p.size);
+  /* Fails if the square root is zero but (original) sign was 1 */
+  res &= mpn_sub_n (tp, xp, ecc->p.m, ecc->p.size);
+  return res;
+}

eddsa-expand.c

+/* eddsa-expand.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+#include <string.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+
+/* Expands a private key, generating the secret scalar K2 and leaving
+   the key K1 for nonce generation, at the end of the digest. */
+void
+_eddsa_expand_key (const struct ecc_curve *ecc,
+		   const struct ecc_eddsa *eddsa,
+		   void *ctx,
+		   const uint8_t *key,
+		   uint8_t *digest,
+		   mp_limb_t *k2)
+{
+  size_t nbytes = 1 + ecc->p.bit_size / 8;
+
+  eddsa->update (ctx, nbytes, key);
+  eddsa->digest (ctx, digest);
+
+  /* For ed448, ignores the most significant byte. */
+  mpn_set_base256_le (k2, ecc->p.size, digest, (ecc->p.bit_size + 7) / 8);
+
+  /* Clear low c bits */
+  k2[0] &= eddsa->low_mask;
+
+  /* Clear higher bits. */
+  k2[ecc->p.size - 1] &= eddsa->high_bit - 1;
+
+  /* Set bit number bit_size - 1 (bit 254 for curve25519, bit 447 for
+     curve448) */
+  k2[ecc->p.size - 1] |= eddsa->high_bit;
+}

eddsa-hash.c

+/* eddsa-hash.c
+
+   Copyright (C) 2014, 2019 Niels Möller
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-internal.h"
+
+/* Convert hash digest to integer, and reduce canonically modulo q.
+   Needs space for 2*m->size + 1 at rp. */
+void
+_eddsa_hash (const struct ecc_modulo *m,
+	     mp_limb_t *rp, size_t digest_size, const uint8_t *digest)
+{
+  mp_size_t nlimbs = NETTLE_OCTET_SIZE_TO_LIMB_SIZE (digest_size);
+  mp_limb_t cy;
+
+  mpn_set_base256_le (rp, nlimbs, digest, digest_size);
+
+  if (nlimbs > 2*m->size)
+    {
+      /* Special case for Ed448: reduce rp to 2*m->size limbs.
+	 After decoding rp from a hash of size 2*rn:
+
+	 rp = r2 || r1 || r0
+
+	 where r0 and r1 have m->size limbs.  Reduce this to:
+
+	 rp = r1' || r0
+
+	 where r1' has m->size limbs.  */
+      mp_limb_t hi = rp[2*m->size];
+      assert (nlimbs == 2*m->size + 1);
+
+      hi = mpn_addmul_1 (rp + m->size, m->B, m->size, hi);
+      assert_maybe (hi <= 1);
+      hi = mpn_cnd_add_n (hi, rp + m->size, rp + m->size, m->B, m->size);
+      assert_maybe (hi == 0);
+    }
+  m->mod (m, rp + m->size , rp);
+  /* Ensure canonical reduction. */
+  cy = mpn_sub_n (rp, rp + m->size, m->m, m->size);
+  cnd_copy (cy, rp, rp + m->size, m->size);
+}

eddsa-internal.h

+/* eddsa.h
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_EDDSA_INTERNAL_H
+#define NETTLE_EDDSA_INTERNAL_H
+
+#include "nettle-types.h"
+#include "bignum.h"
+
+#define _eddsa_compress _nettle_eddsa_compress
+#define _eddsa_compress_itch _nettle_eddsa_compress_itch
+#define _eddsa_decompress _nettle_eddsa_decompress
+#define _eddsa_decompress_itch _nettle_eddsa_decompress_itch
+#define _eddsa_hash _nettle_eddsa_hash
+#define _eddsa_expand_key _nettle_eddsa_expand_key
+#define _eddsa_sign _nettle_eddsa_sign
+#define _eddsa_sign_itch _nettle_eddsa_sign_itch
+#define _eddsa_verify _nettle_eddsa_verify
+#define _eddsa_verify_itch _nettle_eddsa_verify_itch
+#define _eddsa_public_key_itch _nettle_eddsa_public_key_itch
+#define _eddsa_public_key _nettle_eddsa_public_key
+
+/* Low-level internal functions */
+
+struct ecc_curve;
+struct ecc_modulo;
+
+typedef void nettle_eddsa_dom_func(void *ctx);
+
+struct ecc_eddsa
+{
+  /* Hash function to use, digest size must be 2*key-size. */
+  nettle_hash_update_func *update;
+  nettle_hash_digest_func *digest;
+  nettle_eddsa_dom_func *dom;
+  /* For generating the secret scalar */
+  mp_limb_t low_mask;
+  mp_limb_t high_bit;
+};
+
+extern const struct ecc_eddsa _nettle_ed25519_sha512;
+extern const struct ecc_eddsa _nettle_ed448_shake256;
+
+mp_size_t
+_eddsa_compress_itch (const struct ecc_curve *ecc);
+void
+_eddsa_compress (const struct ecc_curve *ecc, uint8_t *r, mp_limb_t *p,
+		 mp_limb_t *scratch);
+
+mp_size_t
+_eddsa_decompress_itch (const struct ecc_curve *ecc);
+int
+_eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p,
+		   const uint8_t *cp,
+		   mp_limb_t *scratch);
+
+void
+_eddsa_hash (const struct ecc_modulo *m,
+	     mp_limb_t *rp, size_t digest_size, const uint8_t *digest);
+
+mp_size_t
+_eddsa_sign_itch (const struct ecc_curve *ecc);
+
+void
+_eddsa_sign (const struct ecc_curve *ecc,
+	     const struct ecc_eddsa *eddsa,
+	     void *ctx,
+	     const uint8_t *pub,
+	     const uint8_t *k1,
+	     const mp_limb_t *k2,
+	     size_t length,
+	     const uint8_t *msg,
+	     uint8_t *signature,
+	     mp_limb_t *scratch);
+
+mp_size_t
+_eddsa_verify_itch (const struct ecc_curve *ecc);
+
+int
+_eddsa_verify (const struct ecc_curve *ecc,
+	       const struct ecc_eddsa *eddsa,
+	       const uint8_t *pub,
+	       const mp_limb_t *A,
+	       void *ctx,
+	       size_t length,
+	       const uint8_t *msg,
+	       const uint8_t *signature,
+	       mp_limb_t *scratch);
+
+void
+_eddsa_expand_key (const struct ecc_curve *ecc,
+		   const struct ecc_eddsa *eddsa,
+		   void *ctx,
+		   const uint8_t *key,
+		   uint8_t *digest,
+		   mp_limb_t *k2);
+
+mp_size_t
+_eddsa_public_key_itch (const struct ecc_curve *ecc);
+
+void
+_eddsa_public_key (const struct ecc_curve *ecc,
+		   const mp_limb_t *k, uint8_t *pub, mp_limb_t *scratch);
+
+#endif /* NETTLE_EDDSA_INTERNAL_H */

eddsa-pubkey.c

+/* eddsa-pubkey.c
+
+   Copyright (C) 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+
+mp_size_t
+_eddsa_public_key_itch (const struct ecc_curve *ecc)
+{
+  assert (ecc->mul_g_itch <= _eddsa_compress_itch (ecc));
+  return 3*ecc->p.size + _eddsa_compress_itch (ecc);
+}
+
+void
+_eddsa_public_key (const struct ecc_curve *ecc,
+		   const mp_limb_t *k, uint8_t *pub, mp_limb_t *scratch)
+{
+#define P scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+  ecc->mul_g (ecc, P, k, scratch_out);
+  _eddsa_compress (ecc, pub, P, scratch_out);
+#undef P
+#undef scratch_out
+}

eddsa-sign.c

+/* eddsa-sign.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-meta.h"
+
+mp_size_t
+_eddsa_sign_itch (const struct ecc_curve *ecc)
+{
+  assert (ecc->mul_g_itch <= _eddsa_compress_itch (ecc));
+  return 5*ecc->p.size + _eddsa_compress_itch (ecc);
+}
+
+void
+_eddsa_sign (const struct ecc_curve *ecc,
+	     const struct ecc_eddsa *eddsa,
+	     void *ctx,
+	     const uint8_t *pub,
+	     const uint8_t *k1,
+	     const mp_limb_t *k2,
+	     size_t length,
+	     const uint8_t *msg,
+	     uint8_t *signature,
+	     mp_limb_t *scratch)
+{
+  mp_size_t size;
+  size_t nbytes;
+  mp_limb_t q, cy;
+
+#define rp scratch
+#define hp (scratch + size)
+#define P (scratch + 2*size)
+#define sp (scratch + 2*size)
+#define hash ((uint8_t *) (scratch + 3*size))
+#define scratch_out (scratch + 5*size)
+
+  size = ecc->p.size;
+  nbytes = 1 + ecc->p.bit_size / 8;
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, k1);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, rp, 2*nbytes, hash);
+
+  ecc->mul_g (ecc, P, rp, scratch_out);
+  _eddsa_compress (ecc, signature, P, scratch_out);
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, signature);
+  eddsa->update (ctx, nbytes, pub);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, hp, 2*nbytes, hash);
+
+  ecc_mod_mul (&ecc->q, sp, hp, k2, sp);
+  ecc_mod_add (&ecc->q, sp, sp, rp); /* FIXME: Can be plain add */
+  if (ecc->p.bit_size == 255)
+    {
+      /* FIXME: Special code duplicated in ecc_curve25519_modq
+	 Define a suitable method for canonical reduction? */
+
+      /* q is slightly larger than 2^252, underflow from below
+	 mpn_submul_1 is unlikely. */
+      unsigned shift = 252 - GMP_NUMB_BITS * (ecc->p.size - 1);
+      q = sp[ecc->p.size-1] >> shift;
+    }
+  else
+    {
+      unsigned shift;
+
+      assert (ecc->p.bit_size == 448);
+      /* q is slightly smaller than 2^446 */
+      shift = 446 - GMP_NUMB_BITS * (ecc->p.size - 1);
+      /* Add one, then it's possible but unlikely that below
+	 mpn_submul_1 does *not* underflow. */
+      q = (sp[ecc->p.size-1] >> shift) + 1;
+    }
+
+  cy = mpn_submul_1 (sp, ecc->q.m, ecc->p.size, q);
+  assert_maybe (cy < 2);
+  cy -= mpn_cnd_add_n (cy, sp, sp, ecc->q.m, ecc->p.size);
+  assert_maybe (cy == 0);
+
+  mpn_get_base256_le (signature + nbytes, nbytes, sp, ecc->q.size);
+#undef rp
+#undef hp
+#undef P
+#undef sp
+#undef hash
+}

eddsa-verify.c

+/* eddsa-verify.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-meta.h"
+
+/* Checks if x1/z1 == x2/z2 (mod p). Assumes z1 and z2 are
+   non-zero. */
+static int
+equal_h (const struct ecc_modulo *p,
+	 const mp_limb_t *x1, const mp_limb_t *z1,
+	 const mp_limb_t *x2, const mp_limb_t *z2,
+	 mp_limb_t *scratch)
+{
+#define t0 scratch
+#define t1 (scratch + p->size)
+
+  ecc_mod_mul_canonical (p, t0, x1, z2, t0);
+  ecc_mod_mul_canonical (p, t1, x2, z1, t1);
+
+  return mpn_cmp (t0, t1, p->size) == 0;
+
+#undef t0
+#undef t1
+}
+
+mp_size_t
+_eddsa_verify_itch (const struct ecc_curve *ecc)
+{
+  assert (_eddsa_decompress_itch (ecc) <= ecc->mul_itch);
+  return 8*ecc->p.size + ecc->mul_itch;
+}
+
+int
+_eddsa_verify (const struct ecc_curve *ecc,
+	       const struct ecc_eddsa *eddsa,
+	       const uint8_t *pub,
+	       const mp_limb_t *A,
+	       void *ctx,
+	       size_t length,
+	       const uint8_t *msg,
+	       const uint8_t *signature,
+	       mp_limb_t *scratch)
+{
+  size_t nbytes;
+#define R scratch
+#define sp (scratch + 2*ecc->p.size)
+#define hp (scratch + 3*ecc->p.size)
+#define P (scratch + 5*ecc->p.size)
+#define scratch_out (scratch + 8*ecc->p.size)
+#define S R
+#define hash ((uint8_t *) P)
+
+  nbytes = 1 + ecc->p.bit_size / 8;
+
+  /* Could maybe save some storage by delaying the R and S operations,
+     but it makes sense to check them for validity up front. */
+  if (!_eddsa_decompress (ecc, R, signature, R+2*ecc->p.size))
+    return 0;
+
+  mpn_set_base256_le (sp, ecc->q.size, signature + nbytes, nbytes);
+  /* Check that s < q */
+  if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0)
+    return 0;
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, signature);
+  eddsa->update (ctx, nbytes, pub);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, hp, 2*nbytes, hash);
+
+  /* Compute h A + R - s G, which should be the neutral point */
+  ecc->mul (ecc, P, hp, A, scratch_out);
+  ecc->add_hh (ecc, P, P, R, scratch_out);
+  /* Move out of the way. */
+  mpn_copyi (hp, sp, ecc->q.size);
+  ecc->mul_g (ecc, S, hp, scratch_out);
+
+  return equal_h (&ecc->p,
+		   P, P + 2*ecc->p.size,
+		   S, S + 2*ecc->p.size, scratch_out)
+    && equal_h (&ecc->p,
+		P + ecc->p.size, P + 2*ecc->p.size,
+		S + ecc->p.size, S + 2*ecc->p.size, scratch_out);
+
+#undef R
+#undef sp
+#undef hp
+#undef P
+#undef S
+}

eddsa.h

+/* eddsa.h
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_EDDSA_H
+#define NETTLE_EDDSA_H
+
+#include "nettle-types.h"
+
+#include "bignum.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define ed25519_sha512_set_private_key nettle_ed25519_sha512_set_private_key
+#define ed25519_sha512_public_key nettle_ed25519_sha512_public_key
+#define ed25519_sha512_sign nettle_ed25519_sha512_sign
+#define ed25519_sha512_verify nettle_ed25519_sha512_verify
+#define ed448_shake256_public_key nettle_ed448_shake256_public_key
+#define ed448_shake256_sign nettle_ed448_shake256_sign
+#define ed448_shake256_verify nettle_ed448_shake256_verify
+
+#define ED25519_KEY_SIZE 32
+#define ED25519_SIGNATURE_SIZE 64
+
+void
+ed25519_sha512_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed25519_sha512_sign (const uint8_t *pub,
+		     const uint8_t *priv,		     
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature);
+
+int
+ed25519_sha512_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature);
+
+#define ED448_KEY_SIZE 57
+#define ED448_SIGNATURE_SIZE 114
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature);
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature);
+			   
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_EDDSA_H */

examples/.c-style

+"gnu"

examples/.gitignore

+/*.d
+/Makefile
+/base16dec
+/base16enc
+/base64dec
+/base64enc
+/ecc-benchmark
+/eratosthenes
+/hogweed-benchmark
+/nettle-benchmark
+/next-prime
+/random-prime
+/rsa-decrypt
+/rsa-encrypt
+/rsa-keygen
+/rsa-sign
+/rsa-verify
+/sexp-conv
+/test*

examples/Makefile.in

+@SET_MAKE@
+
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+top_srcdir = @top_srcdir@
+
+include ../config.make
+
+PRE_CPPFLAGS = -I.. -I$(top_srcdir)
+PRE_LDFLAGS = -L..
+
+OPENSSL_LIBFLAGS = @OPENSSL_LIBFLAGS@
+BENCH_LIBS = @BENCH_LIBS@ -lm
+
+HOGWEED_TARGETS = rsa-keygen$(EXEEXT) rsa-sign$(EXEEXT) \
+	      rsa-verify$(EXEEXT) rsa-encrypt$(EXEEXT) rsa-decrypt$(EXEEXT) \
+	      random-prime$(EXEEXT) \
+	      hogweed-benchmark$(EXEEXT) ecc-benchmark$(EXEEXT)
+
+ENC_TARGETS = base16enc$(EXEEXT) base16dec$(EXEEXT) \
+	      base64enc$(EXEEXT) base64dec$(EXEEXT)
+TARGETS = nettle-benchmark$(EXEEXT) \
+	  $(ENC_TARGETS) @IF_HOGWEED@ $(HOGWEED_TARGETS)
+
+SOURCES = nettle-benchmark.c hogweed-benchmark.c ecc-benchmark.c \
+	random-prime.c \
+	nettle-openssl.c \
+	io.c read_rsa_key.c \
+	rsa-encrypt.c rsa-decrypt.c rsa-keygen.c rsa-sign.c rsa-verify.c \
+	base16enc.c base16dec.c base64enc.c base64dec.c timing.c
+
+
+GETOPT_OBJS = ../getopt.$(OBJEXT) ../getopt1.$(OBJEXT)
+
+TS_ALL = rsa-sign-test rsa-verify-test rsa-encrypt-test
+
+DISTFILES= $(SOURCES) Makefile.in $(TS_ALL) setup-env teardown-env \
+	io.h rsa-session.h timing.h
+
+all: $(TARGETS)
+
+%.$(OBJEXT): %.c
+	$(COMPILE) -c $< && $(DEP_PROCESS)
+
+# NOTE: If we required GNU make, we could use a single rule with $(@F)
+# or $(notdir $@)
+../getopt.$(OBJEXT):
+	( cd .. && $(MAKE) getopt.$(OBJEXT))
+../getopt1.$(OBJEXT):
+	( cd .. && $(MAKE) getopt1.$(OBJEXT))
+../non-nettle.$(OBJEXT):
+	( cd .. && $(MAKE) non-nettle.$(OBJEXT))
+
+# For Solaris and BSD make, we have to use an explicit rule for each executable
+random-prime$(EXEEXT): random-prime.$(OBJEXT) io.$(OBJEXT) $(GETOPT_OBJS)
+	$(LINK) random-prime.$(OBJEXT) io.$(OBJEXT) $(GETOPT_OBJS) \
+	-lhogweed -lnettle $(LIBS) -o random-prime$(EXEEXT)
+
+rsa-keygen$(EXEEXT): rsa-keygen.$(OBJEXT) io.$(OBJEXT) $(GETOPT_OBJS)
+	$(LINK) rsa-keygen.$(OBJEXT) io.$(OBJEXT) $(GETOPT_OBJS) \
+	-lhogweed -lnettle $(LIBS) -o rsa-keygen$(EXEEXT)
+
+rsa-sign$(EXEEXT): rsa-sign.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT)
+	$(LINK) rsa-sign.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT) \
+	-lhogweed -lnettle $(LIBS) -o rsa-sign$(EXEEXT)
+
+rsa-verify$(EXEEXT): rsa-verify.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT)
+	$(LINK) rsa-verify.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT) \
+	-lhogweed -lnettle $(LIBS) -o rsa-verify$(EXEEXT)
+
+rsa-encrypt$(EXEEXT): rsa-encrypt.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT) $(GETOPT_OBJS)
+	$(LINK) rsa-encrypt.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT) \
+	$(GETOPT_OBJS) \
+	-lhogweed -lnettle $(LIBS) -o rsa-encrypt$(EXEEXT)
+
+rsa-decrypt$(EXEEXT): rsa-decrypt.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT)
+	$(LINK) rsa-decrypt.$(OBJEXT) io.$(OBJEXT) read_rsa_key.$(OBJEXT) \
+	-lhogweed -lnettle $(LIBS) -o rsa-decrypt$(EXEEXT)
+
+base16enc$(EXEEXT): base16enc.$(OBJEXT) io.$(OBJEXT)
+	$(LINK) base16enc.$(OBJEXT) io.$(OBJEXT) \
+	-lnettle $(LIBS) -o base16enc$(EXEEXT)
+
+base16dec$(EXEEXT): base16dec.$(OBJEXT) io.$(OBJEXT)
+	$(LINK) base16dec.$(OBJEXT) io.$(OBJEXT) \
+	-lnettle $(LIBS) -o base16dec$(EXEEXT)
+
+base64enc$(EXEEXT): base64enc.$(OBJEXT) io.$(OBJEXT)
+	$(LINK) base64enc.$(OBJEXT) io.$(OBJEXT) \
+	-lnettle $(LIBS) -o base64enc$(EXEEXT)
+
+base64dec$(EXEEXT): base64dec.$(OBJEXT) io.$(OBJEXT)
+	$(LINK) base64dec.$(OBJEXT) io.$(OBJEXT) \
+	-lnettle $(LIBS) -o base64dec$(EXEEXT)
+
+BENCH_OBJS = nettle-benchmark.$(OBJEXT) nettle-openssl.$(OBJEXT) \
+	$(GETOPT_OBJS) ../non-nettle.$(OBJEXT) timing.$(OBJEXT)
+nettle-benchmark$(EXEEXT): $(BENCH_OBJS)
+	$(LINK) $(BENCH_OBJS) -lnettle $(BENCH_LIBS) $(OPENSSL_LIBFLAGS) -o nettle-benchmark$(EXEEXT)
+
+ECC_BENCH_OBJS = ecc-benchmark.$(OBJEXT) timing.$(OBJEXT)
+ecc-benchmark$(EXEEXT): $(ECC_BENCH_OBJS)
+	$(LINK) $(ECC_BENCH_OBJS) -lhogweed -lnettle $(BENCH_LIBS) $(LIBS) \
+	-o ecc-benchmark$(EXEEXT)
+
+HOGWEED_BENCH_OBJS = hogweed-benchmark.$(OBJEXT) timing.$(OBJEXT)
+hogweed-benchmark$(EXEEXT): $(HOGWEED_BENCH_OBJS)
+	$(LINK) $(HOGWEED_BENCH_OBJS) \
+	-lhogweed -lnettle $(BENCH_LIBS) $(LIBS) $(OPENSSL_LIBFLAGS) \
+	-o hogweed-benchmark$(EXEEXT)
+
+$(TARGETS) : io.$(OBJEXT) ../libnettle.stamp
+$(HOGWEED_TARGETS): ../libhogweed.stamp
+
+check: $(TS_ALL)
+	TEST_SHLIB_DIR="$(TEST_SHLIB_DIR)" \
+	  srcdir="$(srcdir)" EMULATOR="$(EMULATOR)" EXEEXT="$(EXEEXT)" \
+          "$(top_srcdir)"/run-tests $(TS_ALL)
+
+Makefile: $(srcdir)/Makefile.in ../config.status
+	cd .. && $(SHELL) ./config.status examples/$@
+
+install uninstall:
+	true
+
+# NOTE: I'd like to use $^, but that's a GNU extension. $? should be
+# more portable, equivalent for phony targets.
+distdir: $(DISTFILES)
+	cp $? $(distdir)
+
+clean:
+	-rm -f $(TARGETS) *.$(OBJEXT) *.$(OBJEXT).d
+
+distclean: clean
+	-rm -f Makefile *.d
+
+tags:
+	etags -o $(srcdir)/TAGS --include $(top_srcdir) $(srcdir)/*.c $(srcdir)/*.h
+
+-include $(SOURCES:.c=.$(OBJEXT).d)

examples/base16dec.c

+/* base16dec -- an decoder for base16
+
+   Copyright (C) 2006, 2012 Jeronimo Pellegrini, Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#ifdef WIN32
+#include <fcntl.h>
+#endif
+
+#include "base16.h"
+
+#include "io.h"
+
+#define CHUNK_SIZE 16392
+
+/* The maximum number of bytes generated for each chunk: */
+#define DECODED_SIZE BASE16_DECODE_LENGTH(CHUNK_SIZE)
+
+
+/*
+ * Reads base-16 encoded from stdin, writes decoded to stdout.
+ */
+int
+main(int argc UNUSED, char **argv UNUSED)
+{
+  /* "buffer" will hold the bytes from disk: */
+  char * buffer = xalloc (CHUNK_SIZE);
+
+  /* "result" will hold bytes before output: */
+  uint8_t * result = xalloc (DECODED_SIZE);
+
+  /* We need a Base16 context for decoding: */
+  struct base16_decode_ctx b16_ctx;
+
+  /* Init the context: */
+  base16_decode_init (&b16_ctx);
+
+#ifdef WIN32
+  _setmode(1, O_BINARY);
+#endif
+
+  for (;;)
+    {
+      int nbytes; /* Number of bytes read frmo disk at each iteration */
+      size_t decoded_bytes; /* Bytes actually generated at each iteration */
+
+      nbytes = fread(buffer, 1, CHUNK_SIZE, stdin);
+
+      if (nbytes < CHUNK_SIZE && ferror(stdin))
+	{
+	  werror ("Error reading file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+      
+      /* Decodes one chunk: */
+      if (!base16_decode_update(&b16_ctx, &decoded_bytes, result, nbytes, buffer))
+	{
+	  werror ("Error decoding input (not base16?)\n");
+	  return EXIT_FAILURE;
+	}
+
+      if (!write_data (stdout, decoded_bytes, result))
+	{
+	  werror ("Error writing file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+      if (nbytes < CHUNK_SIZE)
+	{
+	  /* Check if decoding finalized OK: */
+	  if (!base16_decode_final(&b16_ctx))
+	    {
+	      werror("Decoding did not finish properly.\n");
+	      return EXIT_FAILURE;
+	    }
+	  break;
+	}
+    }
+
+  if (fflush (stdout) != 0)
+    {
+      werror ("Error writing file: %s\n", strerror(errno));
+      return EXIT_FAILURE;
+    }
+
+  free (buffer);
+  free (result);
+
+  return EXIT_SUCCESS;
+}
+

examples/base16enc.c

+/* base16enc -- an encoder for base16
+
+   Copyright (C) 2006, 2012 Jeronimo Pellegrini, Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#ifdef WIN32
+#include <fcntl.h>
+#endif
+
+#include "base16.h"
+
+#include "io.h"
+
+/* The number of bytes read in each iteration, we do one line at a time: */
+#define CHUNK_SIZE 36
+
+/* The *maximum* size of an encoded chunk: */
+#define ENCODED_SIZE BASE16_ENCODE_LENGTH(CHUNK_SIZE)
+
+/*
+ * Reads bytes from standard input and writes base64-encoded
+ * on standard output.
+ */
+int
+main(int argc UNUSED, char **argv UNUSED)
+{
+
+#ifdef WIN32
+  _setmode(0, O_BINARY);
+#endif
+  
+  /* There is no context to initialize. */
+
+  for (;;)
+    {
+      /* "buffer" will hold the bytes from disk: */
+      uint8_t buffer[CHUNK_SIZE];
+      /* "result" will hold bytes before output: */
+      char result[ENCODED_SIZE + 1];
+      unsigned nbytes; /* Number of bytes read from stdin */
+      int encoded_bytes; /* Total number of bytes encoded per iteration */
+      
+      nbytes = fread(buffer,1,CHUNK_SIZE,stdin);
+
+      /* We overwrite result with more data */
+      base16_encode_update(result, nbytes, buffer);
+      encoded_bytes = BASE16_ENCODE_LENGTH(nbytes);
+      result[encoded_bytes++] = '\n';
+      
+      if (nbytes < CHUNK_SIZE)
+	{
+	  if (ferror(stdin))
+	    {
+	      werror ("Error reading file: %s\n", strerror(errno));
+	      return EXIT_FAILURE;
+	    }
+	  if (!write_data (stdout, encoded_bytes, result)
+	      || fflush (stdout) != 0)
+	    {
+	      werror ("Error writing file: %s\n", strerror(errno));
+	      return EXIT_FAILURE;
+	    }
+	  return EXIT_SUCCESS;
+	}
+      /* The result vector is printed */
+      if (!write_data(stdout, encoded_bytes, result))
+	{
+	  werror ("Error writing file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+    }
+}
+

examples/base64dec.c

+/* base64dec -- an decoder for base64
+
+   Copyright (C) 2006, 2012 Jeronimo Pellegrini, Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#ifdef WIN32
+#include <fcntl.h>
+#endif
+
+#include "base64.h"
+
+#include "io.h"
+
+#define CHUNK_SIZE 16392
+
+/* The maximum number of bytes generated for each chunk: */
+#define DECODED_SIZE BASE64_DECODE_LENGTH(CHUNK_SIZE)
+
+
+/*
+ * Reads base-64 encoded from stdin, writes decoded to stdout.
+ */
+int
+main(int argc UNUSED, char **argv UNUSED)
+{
+  /* "buffer" will hold the bytes from disk: */
+  char * buffer = xalloc (CHUNK_SIZE);
+
+  /* "result" will hold bytes before output: */
+  uint8_t * result = xalloc (DECODED_SIZE);
+
+  /* We need a Base64 context for decoding: */
+  struct base64_decode_ctx b64_ctx;
+
+  /* Init the context: */
+  base64_decode_init(&b64_ctx);
+
+#ifdef WIN32
+  _setmode(1, O_BINARY);
+#endif
+
+  for (;;)
+    {
+      int nbytes; /* Number of bytes read frmo disk at each iteration */
+      size_t decoded_bytes; /* Bytes actually generated at each iteration */
+
+      nbytes = fread(buffer, 1, CHUNK_SIZE, stdin);
+
+      if (nbytes < CHUNK_SIZE && ferror(stdin))
+	{
+	  werror ("Error reading file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+
+      /* Decodes one chunk: */
+      if (!base64_decode_update(&b64_ctx, &decoded_bytes, result, nbytes, buffer))
+	{
+	  werror ("Error decoding input (not base64?)\n");
+	  return EXIT_FAILURE;
+	}
+
+      if (!write_data (stdout, decoded_bytes, result))
+	{
+	  werror ("Error writing file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+
+      if (nbytes < CHUNK_SIZE)
+	{
+	  /* Check if decoding finalized OK: */
+	  if (!base64_decode_final(&b64_ctx))
+	    {
+	      werror ("Decoding did not finish properly.\n");
+	      return EXIT_FAILURE;
+	    }
+	  break;
+	}
+    }
+
+  if (fflush (stdout) != 0)
+    {
+      werror ("Error writing file: %s\n", strerror(errno));
+      return EXIT_FAILURE;
+    }
+
+  free (buffer);
+  free (result);
+
+  return EXIT_SUCCESS;
+}

examples/base64enc.c

+/* base64enc -- an encoder for base64
+
+   Copyright (C) 2006, 2012 Jeronimo Pellegrini, Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#ifdef WIN32
+#include <fcntl.h>
+#endif
+
+#include "base64.h"
+
+#include "io.h"
+
+/* The number of bytes read in each iteration, we do one line at a time: */
+#define CHUNK_SIZE 54
+
+/* The *maximum* size of an encoded chunk: */
+#define ENCODED_SIZE BASE64_ENCODE_LENGTH(CHUNK_SIZE)
+
+/*
+ * Reads bytes from standard input and writes base64-encoded
+ * on standard output.
+ */
+int
+main(int argc UNUSED, char **argv UNUSED)
+{
+  struct base64_encode_ctx b64_ctx;
+
+  /* Init the context: */
+  base64_encode_init(&b64_ctx);
+
+#ifdef WIN32
+  _setmode(0, O_BINARY);
+#endif
+
+  for (;;)
+    {
+      /* "buffer" will hold the bytes from disk: */
+      uint8_t buffer[CHUNK_SIZE];
+      /* "result" is the result vector: */
+      char result[ENCODED_SIZE + BASE64_ENCODE_FINAL_LENGTH + 1];
+      unsigned nbytes; /* Number of bytes read from stdin */
+      int encoded_bytes; /* total number of bytes encoded per iteration */
+      nbytes = fread(buffer,1,CHUNK_SIZE,stdin);
+
+      /* We overwrite result with more data */
+      encoded_bytes = base64_encode_update(&b64_ctx, result, nbytes, buffer);
+
+      if (nbytes < CHUNK_SIZE)
+	{
+	  if (ferror(stdin))
+	    {
+	      werror ("Error reading file: %s\n", strerror(errno));
+	      return EXIT_FAILURE;
+	    }
+	  encoded_bytes += base64_encode_final(&b64_ctx,result + encoded_bytes);
+
+	  result[encoded_bytes++] = '\n';
+	  if (!write_data (stdout, encoded_bytes, result)
+	      || fflush (stdout) != 0)
+	    {
+	      werror ("Error writing file: %s\n", strerror(errno));
+	      return EXIT_FAILURE;
+	    }
+	  return EXIT_SUCCESS;
+	}
+
+      /* The result vector is written */
+      result[encoded_bytes++] = '\n';
+      if (!write_data (stdout, encoded_bytes, result))
+	{
+	  werror ("Error writing file: %s\n", strerror(errno));
+	  return EXIT_FAILURE;
+	}
+    }
+}

examples/ecc-benchmark.c

+/* ecc-benchmark.c
+
+   Copyright (C) 2013 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+/* Development of Nettle's ECC support was funded by the .SE Internet Fund. */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <errno.h>
+
+#include <time.h>
+
+#include "timing.h"
+
+#include "../ecc.h"
+#include "../ecc-internal.h"
+#include "../gmp-glue.h"
+
+#define BENCH_INTERVAL 0.1
+
+static void *
+xalloc (size_t size)
+{
+  void *p = malloc (size);
+  if (!p)
+    {
+      fprintf (stderr, "Virtual memory exhausted\n");
+      abort ();
+    }
+  return p;
+}
+
+static mp_limb_t *
+xalloc_limbs (mp_size_t size)
+{
+  return xalloc (size * sizeof(mp_limb_t));
+}
+
+/* Returns second per function call */
+static double
+time_function(void (*f)(void *arg), void *arg)
+{
+  unsigned ncalls;
+  double elapsed;
+
+  /* Warm up */
+  f(arg);
+  for (ncalls = 10 ;;)
+    {
+      unsigned i;
+
+      time_start();
+      for (i = 0; i < ncalls; i++)
+	f(arg);
+      elapsed = time_end();
+      if (elapsed > BENCH_INTERVAL)
+	break;
+      else if (elapsed < BENCH_INTERVAL / 10)
+	ncalls *= 10;
+      else
+	ncalls *= 2;
+    }
+  return elapsed / ncalls;
+}
+
+#if !NETTLE_USE_MINI_GMP
+static int
+modinv_gcd (const struct ecc_curve *ecc,
+	    mp_limb_t *rp, mp_limb_t *ap, mp_limb_t *tp)
+{
+  mp_size_t size = ecc->p.size;
+  mp_limb_t *up = tp;
+  mp_limb_t *vp = tp + size+1;
+  mp_limb_t *gp = tp + 2*(size+1);
+  mp_limb_t *sp = tp + 3*(size+1);
+  mp_size_t gn, sn;
+
+  mpn_copyi (up, ap, size);
+  mpn_copyi (vp, ecc->p.m, size);
+  gn = mpn_gcdext (gp, sp, &sn, up, size, vp, size);
+  if (gn != 1 || gp[0] != 1)
+    return 0;
+  
+  if (sn < 0)
+    mpn_sub (sp, ecc->p.m, size, sp, -sn);
+  else if (sn < size)
+    /* Zero-pad. */
+    mpn_zero (sp + sn, size - sn);
+
+  mpn_copyi (rp, sp, size);
+  return 1;
+}
+#endif
+
+struct ecc_ctx {
+  const struct ecc_curve *ecc;
+  mp_limb_t *rp;
+  mp_limb_t *ap;
+  mp_limb_t *bp;
+  mp_limb_t *tp;
+};
+
+static void
+bench_modp (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  mpn_copyi (ctx->rp, ctx->ap, 2*ctx->ecc->p.size);
+  ctx->ecc->p.mod (&ctx->ecc->p, ctx->rp, ctx->rp);
+}
+
+static void
+bench_reduce (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  mpn_copyi (ctx->rp, ctx->ap, 2*ctx->ecc->p.size);
+  ctx->ecc->p.reduce (&ctx->ecc->p, ctx->rp, ctx->rp);
+}
+
+static void
+bench_modq (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  mpn_copyi (ctx->rp, ctx->ap, 2*ctx->ecc->p.size);
+  ctx->ecc->q.mod(&ctx->ecc->q, ctx->rp, ctx->rp);
+}
+
+static void
+bench_pinv (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->p.invert (&ctx->ecc->p, ctx->rp, ctx->ap, ctx->tp);
+}
+static void
+bench_qinv (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->q.invert (&ctx->ecc->p, ctx->rp, ctx->ap, ctx->tp);
+}
+
+#if !NETTLE_USE_MINI_GMP
+static void
+bench_modinv_gcd (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  mpn_copyi (ctx->rp + ctx->ecc->p.size, ctx->ap, ctx->ecc->p.size);
+  modinv_gcd (ctx->ecc, ctx->rp, ctx->rp + ctx->ecc->p.size, ctx->tp);  
+}
+#endif
+
+#ifdef mpn_sec_powm
+static void
+bench_modinv_powm (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  const struct ecc_curve *ecc = ctx->ecc;
+  mp_size_t size = ecc->p.size;
+  
+  mpn_sub_1 (ctx->rp + size, ecc->p.m, size, 2);
+  mpn_sec_powm (ctx->rp, ctx->ap, size,
+		ctx->rp + size, ecc->p.bit_size,
+		ecc->p.m, size, ctx->tp);
+}
+#endif
+
+static void
+bench_dup_hh (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->dup (ctx->ecc, ctx->rp, ctx->ap, ctx->tp);
+}
+
+static void
+bench_add_hh (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->add_hh (ctx->ecc, ctx->rp, ctx->ap, ctx->bp, ctx->tp);
+}
+
+static void
+bench_add_hhh (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->add_hhh (ctx->ecc, ctx->rp, ctx->ap, ctx->bp, ctx->tp);
+}
+
+static void
+bench_mul_g (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->mul_g (ctx->ecc, ctx->rp, ctx->ap, ctx->tp);
+}
+
+static void
+bench_mul_a (void *p)
+{
+  struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+  ctx->ecc->mul (ctx->ecc, ctx->rp, ctx->ap, ctx->bp, ctx->tp);
+}
+
+#if NETTLE_USE_MINI_GMP
+static void
+mpn_random (mp_limb_t *xp, mp_size_t n)
+{
+  mp_size_t i;
+  for (i = 0; i < n; i++)
+    xp[i] = rand();
+}
+#endif
+
+static void
+bench_curve (const struct ecc_curve *ecc)
+{
+  struct ecc_ctx ctx;  
+  double modp, reduce, modq, pinv, qinv, modinv_gcd, modinv_powm,
+    dup_hh, add_hh, add_hhh,
+    mul_g, mul_a;
+
+  mp_limb_t mask;
+  mp_size_t itch;
+
+  ctx.ecc = ecc;
+  ctx.rp = xalloc_limbs (3*ecc->p.size);
+  ctx.ap = xalloc_limbs (3*ecc->p.size);
+  ctx.bp = xalloc_limbs (3*ecc->p.size);
+  itch = ecc->mul_itch;
+#ifdef mpn_sec_powm
+  {
+    mp_size_t powm_itch
+      = mpn_sec_powm_itch (ecc->p.size, ecc->p.bit_size, ecc->p.size);
+    if (powm_itch > itch)
+      itch = powm_itch;
+  }
+#endif
+  ctx.tp = xalloc_limbs (itch);
+
+  mpn_random (ctx.ap, 3*ecc->p.size);
+  mpn_random (ctx.bp, 3*ecc->p.size);
+
+  mask = (~(mp_limb_t) 0) >> (ecc->p.size * GMP_NUMB_BITS - ecc->p.bit_size);
+  ctx.ap[ecc->p.size - 1] &= mask;
+  ctx.ap[2*ecc->p.size - 1] &= mask;
+  ctx.ap[3*ecc->p.size - 1] &= mask;
+  ctx.bp[ecc->p.size - 1] &= mask;
+  ctx.bp[2*ecc->p.size - 1] &= mask;
+  ctx.bp[3*ecc->p.size - 1] &= mask;
+
+  modp = time_function (bench_modp, &ctx);
+  reduce = time_function (bench_reduce, &ctx);
+
+  modq = time_function (bench_modq, &ctx);
+
+  pinv = time_function (bench_pinv, &ctx);
+  qinv = time_function (bench_qinv, &ctx);
+#if !NETTLE_USE_MINI_GMP
+  modinv_gcd = time_function (bench_modinv_gcd, &ctx);
+#else
+  modinv_gcd = 0;
+#endif
+#ifdef mpn_sec_powm
+  modinv_powm = time_function (bench_modinv_powm, &ctx);
+#else
+  modinv_powm = 0;
+#endif
+  dup_hh = time_function (bench_dup_hh, &ctx);
+  add_hh = time_function (bench_add_hh, &ctx);
+  add_hhh = time_function (bench_add_hhh, &ctx);
+  mul_g = time_function (bench_mul_g, &ctx);
+  mul_a = time_function (bench_mul_a, &ctx);
+
+  free (ctx.rp);
+  free (ctx.ap);
+  free (ctx.bp);
+  free (ctx.tp);
+
+  printf ("%4d %6.4f %6.4f %6.4f %6.2f %6.2f %6.3f %6.2f %6.3f %6.3f %6.3f %6.1f %6.1f\n",
+	  ecc->p.bit_size, 1e6 * modp, 1e6 * reduce, 1e6 * modq,
+	  1e6 * pinv, 1e6 * qinv, 1e6 * modinv_gcd, 1e6 * modinv_powm,
+	  1e6 * dup_hh, 1e6 * add_hh, 1e6 * add_hhh,
+	  1e6 * mul_g, 1e6 * mul_a);
+}
+
+const struct ecc_curve * const curves[] = {
+  &_nettle_secp_192r1,
+  &_nettle_secp_224r1,
+  &_nettle_curve25519,
+  &_nettle_secp_256r1,
+  &_nettle_secp_384r1,
+  &_nettle_curve448,
+  &_nettle_secp_521r1,
+  &_nettle_gost_gc256b,
+  &_nettle_gost_gc512a,
+};
+
+#define numberof(x)  (sizeof (x) / sizeof ((x)[0]))
+
+int
+main (int argc UNUSED, char **argv UNUSED)
+{
+  unsigned i;
+
+  time_init();
+  printf ("%4s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s (us)\n",
+	  "size", "modp", "reduce", "modq", "pinv", "qinv", "mi_gcd", "mi_pow",
+	  "dup_hh", "add_hh", "ad_hhh",
+	  "mul_g", "mul_a");
+  for (i = 0; i < numberof (curves); i++)
+    bench_curve (curves[i]);
+
+  return EXIT_SUCCESS;
+}