diff --git a/ChangeLog b/ChangeLog
index 93a91d5aa087106c497263baac134c9e37bd26ca..aa208c29ff9e076463961a90f118ec56c6eec9cc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,23 @@
* eddsa-pubkey.c (_eddsa_public_key_itch): Assert that
_eddsa_compress_itch isn't too large.
+ Implementation of ed448-shake256, based on patch by Daiki Ueno.
+ * ed448-shake256-pubkey.c (ed448_shake256_public_key): New file
+ and function.
+ * ed448-shake256-sign.c (ed448_shake256_sign): New file and function.
+ * ed448-shake256-verify.c (ed448_shake256_verify): New file and function.
+
+ * Makefile.in (hogweed_SOURCES): Add new ed448 files.
+
+ * testsuite/eddsa-verify-test.c (test_ed448): New function.
+ (test_main): New ed448 tests.
+ * testsuite/eddsa-sign-test.c (test_ed448_sign): New function.
+ (test_main): New ed448 tests.
+ * testsuite/ed448-test.c: New tests.
+ * testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add ed448-test.c.
+
+ * nettle.texinfo (Curve 25519 and Curve 448): Document ed448.
+
2020-01-01 Niels Möller <nisse@lysator.liu.se>
* ecc-448.c (ecc_mod_pow_2kp1): New function.
diff --git a/Makefile.in b/Makefile.in
index 162b50b1c28eb7c6088e57027b0c50a0c6e2c214..e0c9f5f7de663a69eeec49a174b40e9354af548a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -192,7 +192,9 @@ hogweed_SOURCES = sexp.c sexp-format.c \
eddsa-compress.c eddsa-decompress.c eddsa-expand.c \
eddsa-hash.c eddsa-pubkey.c eddsa-sign.c eddsa-verify.c \
ed25519-sha512.c ed25519-sha512-pubkey.c \
- ed25519-sha512-sign.c ed25519-sha512-verify.c
+ ed25519-sha512-sign.c ed25519-sha512-verify.c \
+ ed448-shake256.c ed448-shake256-pubkey.c \
+ ed448-shake256-sign.c ed448-shake256-verify.c
OPT_SOURCES = fat-x86_64.c fat-arm.c mini-gmp.c
diff --git a/ed448-shake256-pubkey.c b/ed448-shake256-pubkey.c
new file mode 100644
index 0000000000000000000000000000000000000000..bde1827874498b9610472e93edcb5e9b26e840d7
--- /dev/null
+++ b/ed448-shake256-pubkey.c
@@ -0,0 +1,61 @@
+/* ed448-shake256-pubkey.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ struct sha3_256_ctx ctx;
+ uint8_t digest[ED448_SIGNATURE_SIZE];
+ mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+
+#define k scratch
+#define scratch_out (scratch + ecc->q.size)
+ sha3_256_init (&ctx);
+ _eddsa_expand_key (ecc, &_nettle_ed448_shake256, &ctx, priv, digest, k);
+ _eddsa_public_key (ecc, k, pub, scratch_out);
+
+ gmp_free_limbs (scratch, itch);
+#undef k
+#undef scratch_out
+}
diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c
new file mode 100644
index 0000000000000000000000000000000000000000..c524593dd1dc3b3bd7d626bbad7b50c095c13deb
--- /dev/null
+++ b/ed448-shake256-sign.c
@@ -0,0 +1,69 @@
+/* ed448-shake256-sign.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+ const uint8_t *priv,
+ size_t length, const uint8_t *msg,
+ uint8_t *signature)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ const struct ecc_eddsa *eddsa = &_nettle_ed448_shake256;
+ mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+#define k2 scratch
+#define scratch_out (scratch + ecc->q.size)
+ struct sha3_256_ctx ctx;
+ uint8_t digest[ED448_SIGNATURE_SIZE];
+
+ sha3_256_init (&ctx);
+ _eddsa_expand_key (ecc, eddsa, &ctx, priv, digest, k2);
+
+ _eddsa_sign (ecc, eddsa, &ctx,
+ pub, digest + ED448_KEY_SIZE, k2,
+ length, msg, signature, scratch_out);
+
+ gmp_free_limbs (scratch, itch);
+#undef k1
+#undef k2
+#undef scratch_out
+}
diff --git a/ed448-shake256-verify.c b/ed448-shake256-verify.c
new file mode 100644
index 0000000000000000000000000000000000000000..af16f1079863592f94107b89ef8c929e555fe617
--- /dev/null
+++ b/ed448-shake256-verify.c
@@ -0,0 +1,69 @@
+/* ed448-shake256-verify.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+ size_t length, const uint8_t *msg,
+ const uint8_t *signature)
+{
+ const struct ecc_curve *ecc = &_nettle_curve448;
+ mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc);
+ mp_limb_t *scratch = gmp_alloc_limbs (itch);
+ struct sha3_256_ctx ctx;
+ int res;
+#define A scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+ sha3_256_init (&ctx);
+
+ res = (_eddsa_decompress (ecc,
+ A, pub, scratch_out)
+ && _eddsa_verify (ecc, &_nettle_ed448_shake256, pub, A,
+ &ctx,
+ length, msg, signature,
+ scratch_out));
+ gmp_free_limbs (scratch, itch);
+ return res;
+#undef A
+#undef scratch_out
+}
diff --git a/ed448-shake256.c b/ed448-shake256.c
new file mode 100644
index 0000000000000000000000000000000000000000..4e54b2c61daef9e8ff90f9be757db1e3bc65a02a
--- /dev/null
+++ b/ed448-shake256.c
@@ -0,0 +1,52 @@
+/* ed448-shake256.c
+
+ Copyright (C) 2019 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa-internal.h"
+
+#include "nettle-types.h"
+#include "sha3.h"
+
+#define DOM_SIZE 10
+static const uint8_t ed448_dom[DOM_SIZE] =
+ { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+
+const struct ecc_eddsa _nettle_ed448_shake256 =
+ {
+ (nettle_hash_update_func *) sha3_256_update,
+ (nettle_hash_digest_func *) sha3_256_shake,
+ ed448_dom, DOM_SIZE,
+ ~(mp_limb_t) 3,
+ (mp_limb_t) 1 << (447 % GMP_NUMB_BITS),
+ };
diff --git a/eddsa-internal.h b/eddsa-internal.h
index ea4c5e349516fd0ad523139568bb036b9c67f73e..f7730a38144177084a97263c06655ae90628ab93 100644
--- a/eddsa-internal.h
+++ b/eddsa-internal.h
@@ -66,6 +66,7 @@ struct ecc_eddsa
};
extern const struct ecc_eddsa _nettle_ed25519_sha512;
+extern const struct ecc_eddsa _nettle_ed448_shake256;
mp_size_t
_eddsa_compress_itch (const struct ecc_curve *ecc);
diff --git a/eddsa.h b/eddsa.h
index 968ffffbbbb079c4dc6218bed4215f89a31c97ff..c85d8321c736a9c5f472002ebbec9bf0a05bcd4b 100644
--- a/eddsa.h
+++ b/eddsa.h
@@ -45,6 +45,9 @@ extern "C" {
#define ed25519_sha512_public_key nettle_ed25519_sha512_public_key
#define ed25519_sha512_sign nettle_ed25519_sha512_sign
#define ed25519_sha512_verify nettle_ed25519_sha512_verify
+#define ed448_shake256_public_key nettle_ed448_shake256_public_key
+#define ed448_shake256_sign nettle_ed448_shake256_sign
+#define ed448_shake256_verify nettle_ed448_shake256_verify
#define ED25519_KEY_SIZE 32
#define ED25519_SIGNATURE_SIZE 64
@@ -63,6 +66,22 @@ ed25519_sha512_verify (const uint8_t *pub,
size_t length, const uint8_t *msg,
const uint8_t *signature);
+#define ED448_KEY_SIZE 57
+#define ED448_SIGNATURE_SIZE 114
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+ const uint8_t *priv,
+ size_t length, const uint8_t *msg,
+ uint8_t *signature);
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+ size_t length, const uint8_t *msg,
+ const uint8_t *signature);
#ifdef __cplusplus
}
diff --git a/nettle.texinfo b/nettle.texinfo
index 2df85e77faf9fe00725d4ed4d90e4e462a5a1dff..65b36e315f81e7e0e01f04fb21d4929c8475eb20 100644
--- a/nettle.texinfo
+++ b/nettle.texinfo
@@ -5213,6 +5213,31 @@ Verifies a message using the provided public key. Returns 1 if the
signature is valid, otherwise 0.
@end deftypefun
+Nettle also provides Ed448, an EdDSA signature scheme based on an
+Edwards curve equivalent to curve448.
+
+@defvr Constant ED448_KEY_SIZE
+The size of a private or public Ed448 key, 57 octets.
+@end defvr
+
+@defvr Constant ED448_SIGNATURE_SIZE
+The size of an Ed448 signature, 114 octets.
+@end defvr
+
+@deftypefun void ed448_shake256_public_key (uint8_t *@var{pub}, const uint8_t *@var{priv})
+Computes the public key corresponding to the given private key. Both
+input and output are of size @code{ED448_KEY_SIZE}.
+@end deftypefun
+
+@deftypefun void ed448_shake256_sign (const uint8_t *@var{pub}, const uint8_t *@var{priv}, size_t @var{length}, const uint8_t *@var{msg}, uint8_t *@var{signature})
+Signs a message using the provided key pair.
+@end deftypefun
+
+@deftypefun int ed448_shake256_verify (const uint8_t *@var{pub}, size_t @var{length}, const uint8_t *@var{msg}, const uint8_t *@var{signature})
+Verifies a message using the provided public key. Returns 1 if the
+signature is valid, otherwise 0.
+@end deftypefun
+
@node Randomness, ASCII encoding, Public-key algorithms, Reference
@comment node-name, next, previous, up
@section Randomness
diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make
index c9344e5e2aa351b8ba4057d94ac9efa0473a7583..6dbef7e24a27f5dda3966b5abd64696d8b4e9b4b 100644
--- a/testsuite/.test-rules.make
+++ b/testsuite/.test-rules.make
@@ -286,6 +286,9 @@ eddsa-verify-test$(EXEEXT): eddsa-verify-test.$(OBJEXT)
ed25519-test$(EXEEXT): ed25519-test.$(OBJEXT)
$(LINK) ed25519-test.$(OBJEXT) $(TEST_OBJS) -o ed25519-test$(EXEEXT)
+ed448-test$(EXEEXT): ed448-test.$(OBJEXT)
+ $(LINK) ed448-test.$(OBJEXT) $(TEST_OBJS) -o ed448-test$(EXEEXT)
+
sha1-huge-test$(EXEEXT): sha1-huge-test.$(OBJEXT)
$(LINK) sha1-huge-test.$(OBJEXT) $(TEST_OBJS) -o sha1-huge-test$(EXEEXT)
diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in
index f49c803be0b1471ea226c70686160021ba537bf9..97128040912efe4a9232811e2c126d37c494cae5 100644
--- a/testsuite/Makefile.in
+++ b/testsuite/Makefile.in
@@ -53,7 +53,7 @@ TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \
ecdsa-sign-test.c ecdsa-verify-test.c \
ecdsa-keygen-test.c ecdh-test.c \
eddsa-compress-test.c eddsa-sign-test.c \
- eddsa-verify-test.c ed25519-test.c
+ eddsa-verify-test.c ed25519-test.c ed448-test.c
TS_SOURCES = $(TS_NETTLE_SOURCES) $(TS_HOGWEED_SOURCES)
CXX_SOURCES = cxx-test.cxx
diff --git a/testsuite/ed448-test.c b/testsuite/ed448-test.c
new file mode 100644
index 0000000000000000000000000000000000000000..56dc6277115cd0bc104536c45bf497c8458d3b6a
--- /dev/null
+++ b/testsuite/ed448-test.c
@@ -0,0 +1,240 @@
+/* ed448-test.c
+
+ Copyright (C) 2017 Daiki Ueno
+ Copyright (C) 2017 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#include "testutils.h"
+
+#include <errno.h>
+
+#include "eddsa.h"
+
+#include "base16.h"
+
+static void
+decode_hex (size_t length, uint8_t *dst, const char *src)
+{
+ struct base16_decode_ctx ctx;
+ size_t out_size;
+ base16_decode_init (&ctx);
+ ASSERT (base16_decode_update (&ctx, &out_size, dst, 2*length, src));
+ ASSERT (out_size == length);
+ ASSERT (base16_decode_final (&ctx));
+}
+
+/* Processes a single line in the format of
+ http://ed25519.cr.yp.to/python/sign.input:
+
+ sk pk : pk : m : s m :
+
+ where sk (secret key) and pk (public key) are 57 bytes each, m is
+ variable size, and s is 114 bytes. All values hex encoded.
+*/
+static void
+test_one (const char *line)
+{
+ const char *p;
+ const char *mp;
+ uint8_t sk[ED448_KEY_SIZE];
+ uint8_t pk[ED448_KEY_SIZE];
+ uint8_t t[ED448_KEY_SIZE];
+ uint8_t s[ED448_SIGNATURE_SIZE];
+ uint8_t *msg;
+ size_t msg_size;
+ uint8_t s2[ED448_SIGNATURE_SIZE];
+
+ decode_hex (ED448_KEY_SIZE, sk, line);
+
+ p = strchr (line, ':');
+ ASSERT (p == line + 228);
+ p++;
+ decode_hex (ED448_KEY_SIZE, pk, p);
+ p = strchr (p, ':');
+ ASSERT (p == line + 343);
+ mp = ++p;
+ p = strchr (p, ':');
+ ASSERT (p);
+ ASSERT ((p - mp) % 2 == 0);
+ msg_size = (p - mp) / 2;
+
+ decode_hex (ED448_SIGNATURE_SIZE, s, p+1);
+
+ msg = xalloc (msg_size + 1);
+ msg[msg_size] = 'x';
+
+ decode_hex (msg_size, msg, mp);
+
+ ed448_shake256_public_key (t, sk);
+ ASSERT (MEMEQ(ED448_KEY_SIZE, t, pk));
+
+ ed448_shake256_sign (pk, sk, msg_size, msg, s2);
+ ASSERT (MEMEQ (ED448_SIGNATURE_SIZE, s, s2));
+
+ ASSERT (ed448_shake256_verify (pk, msg_size, msg, s));
+
+ s2[ED448_SIGNATURE_SIZE/3] ^= 0x40;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+ memcpy (s2, s, ED448_SIGNATURE_SIZE);
+ s2[2*ED448_SIGNATURE_SIZE/3] ^= 0x40;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+ ASSERT (!ed448_shake256_verify (pk, msg_size + 1, msg, s));
+
+ if (msg_size > 0)
+ {
+ msg[msg_size-1] ^= 0x20;
+ ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s));
+ }
+ free (msg);
+}
+
+#ifndef HAVE_GETLINE
+static ssize_t
+getline(char **lineptr, size_t *n, FILE *f)
+{
+ size_t i;
+ int c;
+ if (!*lineptr)
+ {
+ *n = 500;
+ *lineptr = xalloc (*n);
+ }
+
+ i = 0;
+ do
+ {
+ c = getc(f);
+ if (c < 0)
+ {
+ if (i > 0)
+ break;
+ return -1;
+ }
+
+ (*lineptr) [i++] = c;
+ if (i == *n)
+ {
+ *n *= 2;
+ *lineptr = realloc (*lineptr, *n);
+ if (!*lineptr)
+ die ("Virtual memory exhausted.\n");
+ }
+ } while (c != '\n');
+
+ (*lineptr) [i] = 0;
+ return i;
+}
+#endif
+
+void
+test_main(void)
+{
+ const char *input = getenv ("ED448_SIGN_INPUT");
+ if (input)
+ {
+ size_t buf_size;
+ char *buf;
+ FILE *f = fopen (input, "r");
+ if (!f)
+ die ("Opening input file '%s' failed: %s\n",
+ input, strerror (errno));
+
+ for (buf = NULL; getline (&buf, &buf_size, f) >= 0; )
+ test_one (buf);
+
+ free (buf);
+ fclose (f);
+ }
+ else
+ {
+ /* Test vectors from RFC 8032. */
+ /* Blank */
+ test_one ("6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b"
+ "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+ "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+ ":"
+ "533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600"
+ ":");
+ /* 1 octet */
+ test_one ("c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e"
+ "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+ "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+ "03:"
+ "26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00"
+ "03:");
+ /* 11 octets */
+ test_one ("cd23d24f714274e744343237b93290f511f6425f98e64459ff203e8985083ffdf60500553abc0e05cd02184bdb89c4ccd67e187951267eb328"
+ "dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+ "dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+ "0c3e544074ec63b0265e0c:"
+ "1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00"
+ "0c3e544074ec63b0265e0c:");
+ /* 12 octets */
+ test_one ("258cdd4ada32ed9c9ff54e63756ae582fb8fab2ac721f2c8e676a72768513d939f63dddb55609133f29adf86ec9929dccb52c1c5fd2ff7e21b"
+ "3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+ "3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+ "64a65f3cdedcdd66811e2915:"
+ "7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00"
+ "64a65f3cdedcdd66811e2915:");
+ /* 13 octets */
+ test_one ("7ef4e84544236752fbb56b8f31a23a10e42814f5f55ca037cdcc11c64c9a3b2949c1bb60700314611732a6c2fea98eebc0266a11a93970100e"
+ "b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+ "b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+ "64a65f3cdedcdd66811e2915e7:"
+ "6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100"
+ "64a65f3cdedcdd66811e2915e7:");
+ /* 64 octets */
+ test_one ("d65df341ad13e008567688baedda8e9dcdc17dc024974ea5b4227b6530e339bff21f99e68ca6968f3cca6dfe0fb9f4fab4fa135d5542ea3f01"
+ "df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+ "df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+ "bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:"
+ "554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900"
+ "bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:");
+ /* 256 octets */
+ test_one ("2ec5fe3c17045abdb136a5e6a913e32ab75ae68b53d2fc149b77e504132d37569b7e766ba74a19bd6162343a21c8590aa9cebca9014c636df5"
+ "79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+ "79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+ "15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:"
+ "c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00"
+ "15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:");
+ /* 1023 octets */
+ test_one ("872d093780f5d3730df7c212664b37b8a0f24f56810daa8382cd4fa3f77634ec44dc54f1c2ed9bea86fafb7632d8be199ea165f5ad55dd9ce8"
+ "a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+ "a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+ "6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+ "06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+ "af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:"
+ "e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00"
+ "6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+ "06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+ "af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:");
+ }
+}
diff --git a/testsuite/eddsa-sign-test.c b/testsuite/eddsa-sign-test.c
index 47ca6e76037737c31b11450914849ec481b8ed56..2ea1e4bd5b8920d89ee33eba88d04ee307cfe417 100644
--- a/testsuite/eddsa-sign-test.c
+++ b/testsuite/eddsa-sign-test.c
@@ -33,6 +33,7 @@
#include "eddsa.h"
#include "eddsa-internal.h"
+#include "sha3.h"
static void
test_eddsa_sign (const struct ecc_curve *ecc,
@@ -112,6 +113,19 @@ test_ed25519_sign (const struct tstring *public,
public, private, msg, ref);
}
+static void
+test_ed448_sign (const struct tstring *public,
+ const struct tstring *private,
+ const struct tstring *msg,
+ const struct tstring *ref)
+{
+ struct sha3_256_ctx ctx;
+
+ sha3_256_init (&ctx);
+ test_eddsa_sign (&_nettle_curve448, &_nettle_ed448_shake256, &ctx,
+ public, private, msg, ref);
+}
+
void
test_main (void)
{
@@ -150,4 +164,59 @@ test_main (void)
"99df1340cce54626 183144ef46887163"
"4b0a5c0033534108 e1c67c0dc99d3014"
"f01084e98c95e101 4b309b1dbb2e6704"));
+ /* Based on a few of the test vectors from RFC 8032 */
+ test_ed448_sign (SHEX("5fd7449b59b461fd 2ce787ec616ad46a"
+ "1da1342485a70e1f 8a0ea75d80e96778"
+ "edf124769b46c706 1bd6783df1e50f6c"
+ "d1fa1abeafe82561 80"),
+ SHEX("6c82a562cb808d10 d632be89c8513ebf"
+ "6c929f34ddfa8c9f 63c9960ef6e348a3"
+ "528c8a3fcc2f044e 39a3fc5b94492f8f"
+ "032e7549a20098f9 5b"),
+ SHEX(""),
+ SHEX("533a37f6bbe45725 1f023c0d88f976ae"
+ "2dfb504a843e34d2 074fd823d41a591f"
+ "2b233f034f628281 f2fd7a22ddd47d78"
+ "28c59bd0a21bfd39 80ff0d2028d4b18a"
+ "9df63e006c5d1c2d 345b925d8dc00b41"
+ "04852db99ac5c7cd da8530a113a0f4db"
+ "b61149f05a736326 8c71d95808ff2e65"
+ "2600"));
+ test_ed448_sign (SHEX("43ba28f430cdff45 6ae531545f7ecd0a"
+ "c834a55d9358c037 2bfa0c6c6798c086"
+ "6aea01eb00742802 b8438ea4cb82169c"
+ "235160627b4c3a94 80"),
+ SHEX("c4eab05d357007c6 32f3dbb48489924d"
+ "552b08fe0c353a0d 4a1f00acda2c463a"
+ "fbea67c5e8d2877c 5e3bc397a659949e"
+ "f8021e954e0a1227 4e"),
+ SHEX("03"),
+ SHEX("26b8f91727bd6289 7af15e41eb43c377"
+ "efb9c610d48f2335 cb0bd0087810f435"
+ "2541b143c4b981b7 e18f62de8ccdf633"
+ "fc1bf037ab7cd779 805e0dbcc0aae1cb"
+ "cee1afb2e027df36 bc04dcecbf154336"
+ "c19f0af7e0a64729 05e799f1953d2a0f"
+ "f3348ab21aa4adaf d1d234441cf807c0"
+ "3a00"));
+ test_ed448_sign (SHEX("df9705f58edbab80 2c7f8363cfe5560a"
+ "b1c6132c20a9f1dd 163483a26f8ac53a"
+ "39d6808bf4a1dfbd 261b099bb03b3fb5"
+ "0906cb28bd8a081f 00"),
+ SHEX("d65df341ad13e008 567688baedda8e9d"
+ "cdc17dc024974ea5 b4227b6530e339bf"
+ "f21f99e68ca6968f 3cca6dfe0fb9f4fa"
+ "b4fa135d5542ea3f 01"),
+ SHEX("bd0f6a3747cd561b dddf4640a332461a"
+ "4a30a12a434cd0bf 40d766d9c6d458e5"
+ "512204a30c17d1f5 0b5079631f64eb31"
+ "12182da300583546 1113718d1a5ef944"),
+ SHEX("554bc2480860b49e ab8532d2a533b7d5"
+ "78ef473eeb58c98b b2d0e1ce488a98b1"
+ "8dfde9b9b90775e6 7f47d4a1c3482058"
+ "efc9f40d2ca033a0 801b63d45b3b722e"
+ "f552bad3b4ccb667 da350192b61c508c"
+ "f7b6b5adadc2c8d9 a446ef003fb05cba"
+ "5f30e88e36ec2703 b349ca229c267083"
+ "3900"));
}
diff --git a/testsuite/eddsa-verify-test.c b/testsuite/eddsa-verify-test.c
index 595fa4044739f1e2bb79ca865538f46bf3d4c1fa..cc853a55ea82237e429e2761026b22895afdf1a2 100644
--- a/testsuite/eddsa-verify-test.c
+++ b/testsuite/eddsa-verify-test.c
@@ -33,6 +33,7 @@
#include "eddsa.h"
#include "eddsa-internal.h"
+#include "sha3.h"
static void
test_eddsa (const struct ecc_curve *ecc,
@@ -136,6 +137,17 @@ test_ed25519 (const uint8_t *pub,
pub, msg, signature);
}
+static void
+test_ed448 (const uint8_t *pub,
+ const struct tstring *msg,
+ const uint8_t *signature)
+{
+ struct sha3_256_ctx ctx;
+
+ sha3_256_init (&ctx);
+ test_eddsa (&_nettle_curve448, &_nettle_ed448_shake256, &ctx,
+ pub, msg, signature);
+}
void
test_main (void)
@@ -167,4 +179,47 @@ test_main (void)
"99df1340cce54626 183144ef46887163"
"4b0a5c0033534108 e1c67c0dc99d3014"
"f01084e98c95e101 4b309b1dbb2e6704"));
+ /* Based on a few of the test vectors from RFC 8032 */
+ test_ed448 (H("5fd7449b59b461fd 2ce787ec616ad46a"
+ "1da1342485a70e1f 8a0ea75d80e96778"
+ "edf124769b46c706 1bd6783df1e50f6c"
+ "d1fa1abeafe82561 80"),
+ SHEX(""),
+ H("533a37f6bbe45725 1f023c0d88f976ae"
+ "2dfb504a843e34d2 074fd823d41a591f"
+ "2b233f034f628281 f2fd7a22ddd47d78"
+ "28c59bd0a21bfd39 80ff0d2028d4b18a"
+ "9df63e006c5d1c2d 345b925d8dc00b41"
+ "04852db99ac5c7cd da8530a113a0f4db"
+ "b61149f05a736326 8c71d95808ff2e65"
+ "2600"));
+ test_ed448 (H("43ba28f430cdff45 6ae531545f7ecd0a"
+ "c834a55d9358c037 2bfa0c6c6798c086"
+ "6aea01eb00742802 b8438ea4cb82169c"
+ "235160627b4c3a94 80"),
+ SHEX("03"),
+ H("26b8f91727bd6289 7af15e41eb43c377"
+ "efb9c610d48f2335 cb0bd0087810f435"
+ "2541b143c4b981b7 e18f62de8ccdf633"
+ "fc1bf037ab7cd779 805e0dbcc0aae1cb"
+ "cee1afb2e027df36 bc04dcecbf154336"
+ "c19f0af7e0a64729 05e799f1953d2a0f"
+ "f3348ab21aa4adaf d1d234441cf807c0"
+ "3a00"));
+ test_ed448 (H("df9705f58edbab80 2c7f8363cfe5560a"
+ "b1c6132c20a9f1dd 163483a26f8ac53a"
+ "39d6808bf4a1dfbd 261b099bb03b3fb5"
+ "0906cb28bd8a081f 00"),
+ SHEX("bd0f6a3747cd561b dddf4640a332461a"
+ "4a30a12a434cd0bf 40d766d9c6d458e5"
+ "512204a30c17d1f5 0b5079631f64eb31"
+ "12182da300583546 1113718d1a5ef944"),
+ H("554bc2480860b49e ab8532d2a533b7d5"
+ "78ef473eeb58c98b b2d0e1ce488a98b1"
+ "8dfde9b9b90775e6 7f47d4a1c3482058"
+ "efc9f40d2ca033a0 801b63d45b3b722e"
+ "f552bad3b4ccb667 da350192b61c508c"
+ "f7b6b5adadc2c8d9 a446ef003fb05cba"
+ "5f30e88e36ec2703 b349ca229c267083"
+ "3900"));
}