nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-03-22 14:39:24 -05:00
Code Issues Projects Releases Wiki Activity

Support a per-instance hash prefix in EdDSA. (NFC)

Browse Source 
In Ed25519, when you hash things, you just feed them straight to
SHA-512. But in Ed448, you prefix them with a magic string before
feeding them to SHAKE256, and the magic string varies depending on
which variant of Ed448 is in use.

Add support for such a prefix, and for Ed25519, set it to the empty
string.
This commit is contained in:
Simon Tatham 2020-03-02 07:03:15 +00:00
parent 4e6c69d5df
commit 5f3d79332e
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sshecc.c
View File

@ -295,6 +295,10 @@ struct ecsign_extra {
/* These fields are used by the OpenSSH PEM format importer/exporter */ /* These fields are used by the OpenSSH PEM format importer/exporter */
const unsigned char *oid; const unsigned char *oid;
int oidlen; int oidlen;
/* Some EdDSA instances prefix a string to all hash preimages, to
* disambiguate which signature variant they're being used with */
ptrlen hash_prefix;
}; };
WeierstrassPoint *ecdsa_public(mp_int *private_key, const ssh_keyalg *alg) WeierstrassPoint *ecdsa_public(mp_int *private_key, const ssh_keyalg *alg)
@ -1005,6 +1009,7 @@ static mp_int *eddsa_signing_exponent_from_data(
/* Hash (r || public key || message) */ /* Hash (r || public key || message) */
unsigned char hash[MAX_HASH_LEN]; unsigned char hash[MAX_HASH_LEN];
ssh_hash *h = ssh_hash_new(extra->hash); ssh_hash *h = ssh_hash_new(extra->hash);
put_datapl(h, extra->hash_prefix);
put_datapl(h, r_encoded); put_datapl(h, r_encoded);
put_epoint(h, ek->publicKey, ek->curve, true); /* omit string header */ put_epoint(h, ek->publicKey, ek->curve, true); /* omit string header */
put_datapl(h, data); put_datapl(h, data);
@ -1157,6 +1162,7 @@ static void eddsa_sign(ssh_key *key, ptrlen data,
* generate the signature point r. * generate the signature point r.
*/ */
h = ssh_hash_new(extra->hash); h = ssh_hash_new(extra->hash);
put_datapl(h, extra->hash_prefix);
put_data(h, hash + ek->curve->fieldBytes, put_data(h, hash + ek->curve->fieldBytes,
extra->hash->hlen - ek->curve->fieldBytes); extra->hash->hlen - ek->curve->fieldBytes);
put_datapl(h, data); put_datapl(h, data);
@ -1202,7 +1208,7 @@ static void eddsa_sign(ssh_key *key, ptrlen data,
static const struct ecsign_extra sign_extra_ed25519 = { static const struct ecsign_extra sign_extra_ed25519 = {
ec_ed25519, &ssh_sha512, ec_ed25519, &ssh_sha512,
NULL, 0, NULL, 0, PTRLEN_DECL_LITERAL(""),
}; };
const ssh_keyalg ssh_ecdsa_ed25519 = { const ssh_keyalg ssh_ecdsa_ed25519 = {
eddsa_new_pub, eddsa_new_pub,