65 lines
1.9 KiB
C
65 lines
1.9 KiB
C
/* Edwards curve signature system
|
||
* Daniel Beer <dlbeer@gmail.com>, 22 Apr 2014
|
||
*
|
||
* This file is in the public domain.
|
||
*/
|
||
|
||
#ifndef EDSIGN_H_
|
||
#define EDSIGN_H_
|
||
|
||
#include <stdint.h>
|
||
#include <stdbool.h>
|
||
#include "sha512.h"
|
||
|
||
/* This is the Ed25519 signature system, as described in:
|
||
*
|
||
* Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin
|
||
* Yang. High-speed high-security signatures. Journal of Cryptographic
|
||
* Engineering 2 (2012), 77–89. Document ID:
|
||
* a1a62a2f76d23f65d622484ddd09caf8. URL:
|
||
* http://cr.yp.to/papers.html#ed25519. Date: 2011.09.26.
|
||
*
|
||
* The format and calculation of signatures is compatible with the
|
||
* Ed25519 implementation in SUPERCOP. Note, however, that our secret
|
||
* keys are half the size: we don't store a copy of the public key in
|
||
* the secret key (we generate it on demand).
|
||
*/
|
||
|
||
/* Any string of 32 random bytes is a valid secret key. There is no
|
||
* clamping of bits, because we don't use the key directly as an
|
||
* exponent (the exponent is derived from part of a key expansion).
|
||
*/
|
||
#define EDSIGN_SECRET_KEY_SIZE 32
|
||
|
||
/* Given a secret key, produce the public key (a packed Edwards-curve
|
||
* point).
|
||
*/
|
||
#define EDSIGN_PUBLIC_KEY_SIZE 32
|
||
|
||
void edsign_sec_to_pub(void *pub, const void *secret);
|
||
|
||
/* Produce a signature for a message. */
|
||
#define EDSIGN_SIGNATURE_SIZE 64
|
||
|
||
void edsign_sign(uint8_t *signature, const uint8_t *pub,
|
||
const uint8_t *secret,
|
||
const uint8_t *message, size_t len);
|
||
|
||
struct edsign_verify_state {
|
||
struct sha512_state sha;
|
||
};
|
||
|
||
void edsign_verify_init(struct edsign_verify_state *st, const void *sig,
|
||
const void *pub);
|
||
|
||
static inline void
|
||
edsign_verify_add(struct edsign_verify_state *st, const void *data, int len)
|
||
{
|
||
sha512_add(&st->sha, data, len);
|
||
}
|
||
|
||
/* Verify a message signature. Returns non-zero if ok. */
|
||
bool edsign_verify(struct edsign_verify_state *st, const void *sig, const void *pub);
|
||
|
||
#endif
|