cheng/libsodium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reformat

Browse Source
This commit is contained in:
Frank Denis 2014-07-10 22:04:01 -07:00
parent f7c79dbea7
commit 5b4a3b5715
1 changed files with 43 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
src/libsodium/crypto_sign/ed25519/ref10/open.c
View File

@ -7,44 +7,52 @@
#include "ge.h" #include "ge.h"
#include "sc.h" #include "sc.h"
int crypto_sign_open( int
unsigned char *m,unsigned long long *mlen, crypto_sign_open(unsigned char *m, unsigned long long *mlen,
const unsigned char *sm,unsigned long long smlen, const unsigned char *sm, unsigned long long smlen,
const unsigned char *pk const unsigned char *pk)
)
{ {
crypto_hash_sha512_state hs; crypto_hash_sha512_state hs;
unsigned char h[64]; unsigned char h[64];
unsigned char rcheck[32]; unsigned char rcheck[32];
unsigned int i; unsigned int i;
unsigned char d = 0; unsigned char d = 0;
ge_p3 A; ge_p3 A;
ge_p2 R; ge_p2 R;
if (smlen < 64) goto badsig; if (smlen < 64) {
if (sm[63] & 224) goto badsig; goto badsig;
if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig; }
if (sm[63] & 224) {
goto badsig;
}
if (ge_frombytes_negate_vartime(&A, pk) != 0) {
goto badsig;
}
for (i = 0; i < 32; ++i) {
d |= pk[i];
}
if (d == 0) {
return -1;
}
crypto_hash_sha512_init(&hs);
crypto_hash_sha512_update(&hs, sm, 32);
crypto_hash_sha512_update(&hs, pk, 32);
crypto_hash_sha512_update(&hs, sm + 64, smlen - 64);
crypto_hash_sha512_final(&hs, h);
sc_reduce(h);
for (i = 0; i < 32; ++i) d |= pk[i]; ge_double_scalarmult_vartime(&R, h, &A, sm + 32);
if (d == 0) return -1; ge_tobytes(rcheck, &R);
if (crypto_verify_32(rcheck, sm) == 0) {
crypto_hash_sha512_init(&hs); memmove(m, sm + 64, smlen - 64);
crypto_hash_sha512_update(&hs, sm, 32); *mlen = smlen - 64;
crypto_hash_sha512_update(&hs, pk, 32); return 0;
crypto_hash_sha512_update(&hs, sm + 64, smlen - 64); }
crypto_hash_sha512_final(&hs, h);
sc_reduce(h);
ge_double_scalarmult_vartime(&R,h,&A,sm+32);
ge_tobytes(rcheck,&R);
if (crypto_verify_32(rcheck,sm) == 0) {
memmove(m, sm + 64,smlen - 64);
*mlen = smlen - 64;
return 0;
}
badsig: badsig:
*mlen = 0; *mlen = 0;
memset(m, 0, smlen - 64); memset(m, 0, smlen - 64);
return -1;
return -1;
} }