diff --git a/ChangeLog b/ChangeLog index aa208c29ff9e076463961a90f118ec56c6eec9cc..bf4c231e737e1a0c3508413301d0a65f484ee80d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,18 @@ 2020-01-02 Niels Möller <nisse@lysator.liu.se> - * eddsa-internal.h (struct ecc_eddsa): Add magic "dom" string, + * eddsa-internal.h (nettle_eddsa_dom_func): New typedef. + (struct ecc_eddsa): Use function pointer to represent eddsa dom + string. To avoid calling sha512_update with empty input for + ed25519. + * ed448-shake256.c (ed448_dom): New function, calling + sha3_256_update with the magic dom prefix. + (_nettle_ed448_shake256): Point to it. + * ed25519-sha512.c (_nettle_ed25519_sha512): Add do-nothing dom function. + + * eddsa-sign.c (_eddsa_sign): Update to use dom function pointer. + * eddsa-verify.c (_eddsa_verify): Likewise. + + * eddsa-internal.h (struct ecc_eddsa): Add magic dom string, needed for ed448. * ed25519-sha512.c (_nettle_ed25519_sha512): Empty dom string. * ed448-shake256.c (_nettle_ed448_shake256): New file and diff --git a/ed25519-sha512.c b/ed25519-sha512.c index 09d0f8a5900cb215e2963a00c3914c54168f7f78..72c4e5171a9e5b3f5ccd6217d598967ceb68baf3 100644 --- a/ed25519-sha512.c +++ b/ed25519-sha512.c @@ -38,11 +38,15 @@ #include "nettle-types.h" #include "sha2.h" +static nettle_eddsa_dom_func ed25519_dom; + +static void ed25519_dom(void *ctx UNUSED) {} + const struct ecc_eddsa _nettle_ed25519_sha512 = { (nettle_hash_update_func *) sha512_update, (nettle_hash_digest_func *) sha512_digest, - NULL, 0, + ed25519_dom, ~(mp_limb_t) 7, (mp_limb_t) 1 << (254 % GMP_NUMB_BITS), }; diff --git a/ed448-shake256.c b/ed448-shake256.c index 4e54b2c61daef9e8ff90f9be757db1e3bc65a02a..25d878f02eab5f29f7e80cf2169218c06b850f2a 100644 --- a/ed448-shake256.c +++ b/ed448-shake256.c @@ -39,14 +39,22 @@ #include "sha3.h" #define DOM_SIZE 10 -static const uint8_t ed448_dom[DOM_SIZE] = - { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0}; + +static nettle_eddsa_dom_func ed448_dom; + +static void +ed448_dom(void *ctx) +{ + static const uint8_t dom[DOM_SIZE] = + { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0}; + sha3_256_update (ctx, DOM_SIZE, dom); +} const struct ecc_eddsa _nettle_ed448_shake256 = { (nettle_hash_update_func *) sha3_256_update, (nettle_hash_digest_func *) sha3_256_shake, - ed448_dom, DOM_SIZE, + ed448_dom, ~(mp_limb_t) 3, (mp_limb_t) 1 << (447 % GMP_NUMB_BITS), }; diff --git a/eddsa-internal.h b/eddsa-internal.h index f7730a38144177084a97263c06655ae90628ab93..098ab39c123b1d0149abe865355f65c6a64d8570 100644 --- a/eddsa-internal.h +++ b/eddsa-internal.h @@ -53,13 +53,14 @@ struct ecc_curve; struct ecc_modulo; +typedef void nettle_eddsa_dom_func(void *ctx); + struct ecc_eddsa { /* Hash function to use */ nettle_hash_update_func *update; nettle_hash_digest_func *digest; - const uint8_t *dom; - unsigned dom_size; + nettle_eddsa_dom_func *dom; /* For generating the secret scalar */ mp_limb_t low_mask; mp_limb_t high_bit; diff --git a/eddsa-sign.c b/eddsa-sign.c index a5970e984d84871e23882f7c454754f05cd4f890..052770645f290ed8f315dd7f6b73671ddd14e203 100644 --- a/eddsa-sign.c +++ b/eddsa-sign.c @@ -75,7 +75,7 @@ _eddsa_sign (const struct ecc_curve *ecc, size = ecc->p.size; nbytes = 1 + ecc->p.bit_size / 8; - eddsa->update (ctx, eddsa->dom_size, eddsa->dom); + eddsa->dom (ctx); eddsa->update (ctx, nbytes, k1); eddsa->update (ctx, length, msg); eddsa->digest (ctx, 2*nbytes, hash); @@ -84,7 +84,7 @@ _eddsa_sign (const struct ecc_curve *ecc, ecc->mul_g (ecc, P, rp, scratch_out); _eddsa_compress (ecc, signature, P, scratch_out); - eddsa->update (ctx, eddsa->dom_size, eddsa->dom); + eddsa->dom (ctx); eddsa->update (ctx, nbytes, signature); eddsa->update (ctx, nbytes, pub); eddsa->update (ctx, length, msg); diff --git a/eddsa-verify.c b/eddsa-verify.c index c4e65d69c6a71961463f830c52285b604826639c..a0ffe0c40bf8d404ac46cf5022b961015af382d9 100644 --- a/eddsa-verify.c +++ b/eddsa-verify.c @@ -106,7 +106,7 @@ _eddsa_verify (const struct ecc_curve *ecc, if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0) return 0; - eddsa->update (ctx, eddsa->dom_size, eddsa->dom); + eddsa->dom (ctx); eddsa->update (ctx, nbytes, signature); eddsa->update (ctx, nbytes, pub); eddsa->update (ctx, length, msg);