diff options
Diffstat (limited to 'src/lib/util/crypto_cs.c')
-rw-r--r-- | src/lib/util/crypto_cs.c | 366 |
1 files changed, 366 insertions, 0 deletions
diff --git a/src/lib/util/crypto_cs.c b/src/lib/util/crypto_cs.c new file mode 100644 index 000000000..049f63062 --- /dev/null +++ b/src/lib/util/crypto_cs.c | |||
@@ -0,0 +1,366 @@ | |||
1 | /* | ||
2 | This file is part of GNUnet | ||
3 | Copyright (C) 2014,2016,2019, 2023 GNUnet e.V. | ||
4 | |||
5 | GNUnet is free software: you can redistribute it and/or modify it | ||
6 | under the terms of the GNU Affero General Public License as published | ||
7 | by the Free Software Foundation, either version 3 of the License, | ||
8 | or (at your option) any later version. | ||
9 | |||
10 | GNUnet is distributed in the hope that it will be useful, but | ||
11 | WITHOUT ANY WARRANTY; without even the implied warranty of | ||
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
13 | Affero General Public License for more details. | ||
14 | |||
15 | You should have received a copy of the GNU Affero General Public License | ||
16 | along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
17 | |||
18 | SPDX-License-Identifier: AGPL3.0-or-later | ||
19 | */ | ||
20 | |||
21 | /** | ||
22 | * @file util/crypto_cs.c | ||
23 | * @brief Clause Blind Schnorr signatures using Curve25519 | ||
24 | * @author Lucien Heuzeveldt <lucienclaude.heuzeveldt@students.bfh.ch> | ||
25 | * @author Gian Demarmels <gian@demarmels.org> | ||
26 | */ | ||
27 | |||
28 | #include "platform.h" | ||
29 | #include "gnunet_util_lib.h" | ||
30 | #include <sodium.h> | ||
31 | #include <gcrypt.h> | ||
32 | |||
33 | /** | ||
34 | * IMPLEMENTATION NOTICE: | ||
35 | * | ||
36 | * This is an implementation of the Clause Blind Schnorr Signature Scheme using Curve25519. | ||
37 | * Further details about the Clause Blind Schnorr Signature Scheme can be found here: | ||
38 | * https://eprint.iacr.org/2019/877.pdf | ||
39 | * | ||
40 | * We use libsodium wherever possible. | ||
41 | */ | ||
42 | |||
43 | |||
44 | void | ||
45 | GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv) | ||
46 | { | ||
47 | crypto_core_ed25519_scalar_random (priv->scalar.d); | ||
48 | } | ||
49 | |||
50 | |||
51 | void | ||
52 | GNUNET_CRYPTO_cs_private_key_get_public ( | ||
53 | const struct GNUNET_CRYPTO_CsPrivateKey *priv, | ||
54 | struct GNUNET_CRYPTO_CsPublicKey *pub) | ||
55 | { | ||
56 | GNUNET_assert (0 == | ||
57 | crypto_scalarmult_ed25519_base_noclamp (pub->point.y, | ||
58 | priv->scalar.d)); | ||
59 | } | ||
60 | |||
61 | |||
62 | /** | ||
63 | * Maps 32 random bytes to a scalar. This is necessary because libsodium | ||
64 | * expects scalar to be in the prime order subgroup. | ||
65 | * | ||
66 | * @param[in,out] scalar containing 32 byte char array, is modified to be in prime order subgroup | ||
67 | */ | ||
68 | static void | ||
69 | map_to_scalar_subgroup (struct GNUNET_CRYPTO_Cs25519Scalar *scalar) | ||
70 | { | ||
71 | /* perform clamping as described in RFC7748 */ | ||
72 | scalar->d[0] &= 248; | ||
73 | scalar->d[31] &= 127; | ||
74 | scalar->d[31] |= 64; | ||
75 | } | ||
76 | |||
77 | |||
78 | void | ||
79 | GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsSessionNonce *nonce, | ||
80 | const char *seed, | ||
81 | const struct GNUNET_CRYPTO_CsPrivateKey *lts, | ||
82 | struct GNUNET_CRYPTO_CsRSecret r[2]) | ||
83 | { | ||
84 | GNUNET_assert ( | ||
85 | GNUNET_YES == | ||
86 | GNUNET_CRYPTO_kdf ( | ||
87 | r, sizeof (struct GNUNET_CRYPTO_CsRSecret) * 2, | ||
88 | seed, strlen (seed), | ||
89 | lts, sizeof (*lts), | ||
90 | nonce, sizeof (*nonce), | ||
91 | NULL, 0)); | ||
92 | map_to_scalar_subgroup (&r[0].scalar); | ||
93 | map_to_scalar_subgroup (&r[1].scalar); | ||
94 | } | ||
95 | |||
96 | |||
97 | void | ||
98 | GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv, | ||
99 | struct GNUNET_CRYPTO_CsRPublic *r_pub) | ||
100 | { | ||
101 | GNUNET_assert (0 == | ||
102 | crypto_scalarmult_ed25519_base_noclamp (r_pub->point.y, | ||
103 | r_priv->scalar.d)); | ||
104 | } | ||
105 | |||
106 | |||
107 | void | ||
108 | GNUNET_CRYPTO_cs_blinding_secrets_derive ( | ||
109 | const struct GNUNET_CRYPTO_CsBlindingNonce *blind_seed, | ||
110 | struct GNUNET_CRYPTO_CsBlindingSecret bs[2]) | ||
111 | { | ||
112 | GNUNET_assert ( | ||
113 | GNUNET_YES == | ||
114 | GNUNET_CRYPTO_hkdf (bs, | ||
115 | sizeof (struct GNUNET_CRYPTO_CsBlindingSecret) * 2, | ||
116 | GCRY_MD_SHA512, | ||
117 | GCRY_MD_SHA256, | ||
118 | "alphabeta", | ||
119 | strlen ("alphabeta"), | ||
120 | blind_seed, | ||
121 | sizeof(*blind_seed), | ||
122 | NULL, | ||
123 | 0)); | ||
124 | map_to_scalar_subgroup (&bs[0].alpha); | ||
125 | map_to_scalar_subgroup (&bs[0].beta); | ||
126 | map_to_scalar_subgroup (&bs[1].alpha); | ||
127 | map_to_scalar_subgroup (&bs[1].beta); | ||
128 | } | ||
129 | |||
130 | |||
131 | /* | ||
132 | order of subgroup required for scalars by libsodium | ||
133 | 2^252 + 27742317777372353535851937790883648493 | ||
134 | copied from https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c | ||
135 | and converted to big endian | ||
136 | */ | ||
137 | static const unsigned char L_BIG_ENDIAN[32] = { | ||
138 | 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | ||
139 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7, | ||
140 | 0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed | ||
141 | }; | ||
142 | |||
143 | |||
144 | /** | ||
145 | * Computes a Hash of (R', m) mapped to a Curve25519 scalar | ||
146 | * | ||
147 | * @param hash initial hash of the message to be signed | ||
148 | * @param pub denomination public key (used as salt) | ||
149 | * @param[out] c C containing scalar | ||
150 | */ | ||
151 | static void | ||
152 | cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash, | ||
153 | const void *msg, | ||
154 | size_t msg_len, | ||
155 | const struct GNUNET_CRYPTO_CsPublicKey *pub, | ||
156 | struct GNUNET_CRYPTO_CsC *c) | ||
157 | { | ||
158 | // SHA-512 hash of R' and message | ||
159 | size_t r_m_concat_len = sizeof(struct GNUNET_CRYPTO_CsRPublic) + msg_len; | ||
160 | char r_m_concat[r_m_concat_len]; | ||
161 | memcpy (r_m_concat, | ||
162 | r_dash, | ||
163 | sizeof(struct GNUNET_CRYPTO_CsRPublic)); | ||
164 | memcpy (r_m_concat + sizeof(struct GNUNET_CRYPTO_CsRPublic), | ||
165 | msg, | ||
166 | msg_len); | ||
167 | struct GNUNET_HashCode prehash; | ||
168 | |||
169 | GNUNET_CRYPTO_hash (r_m_concat, | ||
170 | r_m_concat_len, | ||
171 | &prehash); | ||
172 | |||
173 | // modulus converted to MPI representation | ||
174 | gcry_mpi_t l_mpi; | ||
175 | GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi, | ||
176 | L_BIG_ENDIAN, | ||
177 | sizeof(L_BIG_ENDIAN)); | ||
178 | |||
179 | // calculate full domain hash | ||
180 | gcry_mpi_t c_mpi; | ||
181 | GNUNET_CRYPTO_kdf_mod_mpi (&c_mpi, | ||
182 | l_mpi, | ||
183 | pub, | ||
184 | sizeof(struct GNUNET_CRYPTO_CsPublicKey), | ||
185 | &prehash, | ||
186 | sizeof(struct GNUNET_HashCode), | ||
187 | "Curve25519FDH"); | ||
188 | gcry_mpi_release (l_mpi); | ||
189 | |||
190 | // convert c from mpi | ||
191 | unsigned char c_big_endian[256 / 8]; | ||
192 | GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian, | ||
193 | sizeof(c_big_endian), | ||
194 | c_mpi); | ||
195 | gcry_mpi_release (c_mpi); | ||
196 | for (size_t i = 0; i<32; i++) | ||
197 | c->scalar.d[i] = c_big_endian[31 - i]; | ||
198 | } | ||
199 | |||
200 | |||
201 | /** | ||
202 | * calculate R' | ||
203 | * | ||
204 | * @param bs blinding secret | ||
205 | * @param r_pub R | ||
206 | * @param pub public key | ||
207 | * @param[out] blinded_r_pub R' | ||
208 | */ | ||
209 | static void | ||
210 | calc_r_dash (const struct GNUNET_CRYPTO_CsBlindingSecret *bs, | ||
211 | const struct GNUNET_CRYPTO_CsRPublic *r_pub, | ||
212 | const struct GNUNET_CRYPTO_CsPublicKey *pub, | ||
213 | struct GNUNET_CRYPTO_CsRPublic *blinded_r_pub) | ||
214 | { | ||
215 | // R'i = Ri + alpha i*G + beta i*pub | ||
216 | struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base; | ||
217 | GNUNET_assert (0 == | ||
218 | crypto_scalarmult_ed25519_base_noclamp ( | ||
219 | alpha_mul_base.y, | ||
220 | bs->alpha.d)); | ||
221 | struct GNUNET_CRYPTO_Cs25519Point beta_mul_pub; | ||
222 | GNUNET_assert (0 == | ||
223 | crypto_scalarmult_ed25519_noclamp ( | ||
224 | beta_mul_pub.y, | ||
225 | bs->beta.d, | ||
226 | pub->point.y)); | ||
227 | struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base_plus_beta_mul_pub; | ||
228 | GNUNET_assert (0 == crypto_core_ed25519_add ( | ||
229 | alpha_mul_base_plus_beta_mul_pub.y, | ||
230 | alpha_mul_base.y, | ||
231 | beta_mul_pub.y)); | ||
232 | GNUNET_assert (0 == | ||
233 | crypto_core_ed25519_add ( | ||
234 | blinded_r_pub->point.y, | ||
235 | r_pub->point.y, | ||
236 | alpha_mul_base_plus_beta_mul_pub.y)); | ||
237 | } | ||
238 | |||
239 | |||
240 | void | ||
241 | GNUNET_CRYPTO_cs_calc_blinded_c ( | ||
242 | const struct GNUNET_CRYPTO_CsBlindingSecret bs[2], | ||
243 | const struct GNUNET_CRYPTO_CsRPublic r_pub[2], | ||
244 | const struct GNUNET_CRYPTO_CsPublicKey *pub, | ||
245 | const void *msg, | ||
246 | size_t msg_len, | ||
247 | struct GNUNET_CRYPTO_CsC blinded_c[2], | ||
248 | struct GNUNET_CRYPTO_CSPublicRPairP *r_pub_blind) | ||
249 | { | ||
250 | /* for i 0/1: R'i = Ri + alpha i*G + beta i*pub */ | ||
251 | calc_r_dash (&bs[0], | ||
252 | &r_pub[0], | ||
253 | pub, | ||
254 | &r_pub_blind->r_pub[0]); | ||
255 | calc_r_dash (&bs[1], | ||
256 | &r_pub[1], | ||
257 | pub, | ||
258 | &r_pub_blind->r_pub[1]); | ||
259 | |||
260 | /* for i 0/1: c'i = H(R'i, msg) */ | ||
261 | struct GNUNET_CRYPTO_CsC c_dash_0; | ||
262 | struct GNUNET_CRYPTO_CsC c_dash_1; | ||
263 | cs_full_domain_hash (&r_pub_blind->r_pub[0], | ||
264 | msg, | ||
265 | msg_len, | ||
266 | pub, | ||
267 | &c_dash_0); | ||
268 | cs_full_domain_hash (&r_pub_blind->r_pub[1], | ||
269 | msg, | ||
270 | msg_len, | ||
271 | pub, | ||
272 | &c_dash_1); | ||
273 | |||
274 | /* for i 0/1: ci = c'i + beta i mod p */ | ||
275 | crypto_core_ed25519_scalar_add (blinded_c[0].scalar.d, | ||
276 | c_dash_0.scalar.d, | ||
277 | bs[0].beta.d); | ||
278 | crypto_core_ed25519_scalar_add (blinded_c[1].scalar.d, | ||
279 | c_dash_1.scalar.d, | ||
280 | bs[1].beta.d); | ||
281 | } | ||
282 | |||
283 | |||
284 | void | ||
285 | GNUNET_CRYPTO_cs_sign_derive ( | ||
286 | const struct GNUNET_CRYPTO_CsPrivateKey *priv, | ||
287 | const struct GNUNET_CRYPTO_CsRSecret r[2], | ||
288 | const struct GNUNET_CRYPTO_CsBlindedMessage *bm, | ||
289 | struct GNUNET_CRYPTO_CsBlindSignature *cs_blind_sig) | ||
290 | { | ||
291 | struct GNUNET_CRYPTO_Cs25519Scalar c_b_mul_priv; | ||
292 | uint32_t hkdf_out; | ||
293 | |||
294 | /* derive clause session identifier b (random bit) */ | ||
295 | GNUNET_assert (GNUNET_YES == | ||
296 | GNUNET_CRYPTO_hkdf (&hkdf_out, | ||
297 | sizeof (hkdf_out), | ||
298 | GCRY_MD_SHA512, | ||
299 | GCRY_MD_SHA256, | ||
300 | "b", | ||
301 | strlen ("b"), | ||
302 | priv, | ||
303 | sizeof (*priv), | ||
304 | &bm->nonce, | ||
305 | sizeof (bm->nonce), | ||
306 | NULL, | ||
307 | 0)); | ||
308 | cs_blind_sig->b = hkdf_out % 2; | ||
309 | |||
310 | /* s = r_b + c_b * priv */ | ||
311 | crypto_core_ed25519_scalar_mul (c_b_mul_priv.d, | ||
312 | bm->c[cs_blind_sig->b].scalar.d, | ||
313 | priv->scalar.d); | ||
314 | crypto_core_ed25519_scalar_add (cs_blind_sig->s_scalar.scalar.d, | ||
315 | r[cs_blind_sig->b].scalar.d, | ||
316 | c_b_mul_priv.d); | ||
317 | } | ||
318 | |||
319 | |||
320 | void | ||
321 | GNUNET_CRYPTO_cs_unblind ( | ||
322 | const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar, | ||
323 | const struct GNUNET_CRYPTO_CsBlindingSecret *bs, | ||
324 | struct GNUNET_CRYPTO_CsS *signature_scalar) | ||
325 | { | ||
326 | crypto_core_ed25519_scalar_add (signature_scalar->scalar.d, | ||
327 | blinded_signature_scalar->scalar.d, | ||
328 | bs->alpha.d); | ||
329 | } | ||
330 | |||
331 | |||
332 | enum GNUNET_GenericReturnValue | ||
333 | GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig, | ||
334 | const struct GNUNET_CRYPTO_CsPublicKey *pub, | ||
335 | const void *msg, | ||
336 | size_t msg_len) | ||
337 | { | ||
338 | // calculate c' = H(R, m) | ||
339 | struct GNUNET_CRYPTO_CsC c_dash; | ||
340 | |||
341 | cs_full_domain_hash (&sig->r_point, | ||
342 | msg, | ||
343 | msg_len, | ||
344 | pub, | ||
345 | &c_dash); | ||
346 | |||
347 | // s'G ?= R' + c' pub | ||
348 | struct GNUNET_CRYPTO_Cs25519Point sig_scal_mul_base; | ||
349 | GNUNET_assert (0 == | ||
350 | crypto_scalarmult_ed25519_base_noclamp ( | ||
351 | sig_scal_mul_base.y, | ||
352 | sig->s_scalar.scalar.d)); | ||
353 | struct GNUNET_CRYPTO_Cs25519Point c_dash_mul_pub; | ||
354 | GNUNET_assert (0 == crypto_scalarmult_ed25519_noclamp (c_dash_mul_pub.y, | ||
355 | c_dash.scalar.d, | ||
356 | pub->point.y)); | ||
357 | struct GNUNET_CRYPTO_Cs25519Point R_add_c_dash_mul_pub; | ||
358 | GNUNET_assert (0 == crypto_core_ed25519_add (R_add_c_dash_mul_pub.y, | ||
359 | sig->r_point.point.y, | ||
360 | c_dash_mul_pub.y)); | ||
361 | |||
362 | return 0 == GNUNET_memcmp (&sig_scal_mul_base, | ||
363 | &R_add_c_dash_mul_pub) | ||
364 | ? GNUNET_OK | ||
365 | : GNUNET_SYSERR; | ||
366 | } | ||