ed25519/src/verify.c

#include "ed25519.h"
#include "sha512.h"
#include "ge.h"
#include "sc.h"

static int consttime_equal(const unsigned char *x, const unsigned char *y) {
    unsigned char r = 0;

    r = x[0] ^ y[0];
    #define F(i) r |= x[i] ^ y[i]
    F(1);
    F(2);
    F(3);
    F(4);
    F(5);
    F(6);
    F(7);
    F(8);
    F(9);
    F(10);
    F(11);
    F(12);
    F(13);
    F(14);
    F(15);
    F(16);
    F(17);
    F(18);
    F(19);
    F(20);
    F(21);
    F(22);
    F(23);
    F(24);
    F(25);
    F(26);
    F(27);
    F(28);
    F(29);
    F(30);
    F(31);
    #undef F

    return !r;
}

int ed25519_verify(const unsigned char *signature, const unsigned char *message, size_t message_len, const unsigned char *public_key) {
    unsigned char h[64];
    unsigned char checker[32];
    sha512_context hash;
    ge_p3 A;
    ge_p2 R;

    if (signature[63] & 224) {
        return 0;
    }

    if (ge_frombytes_negate_vartime(&A, public_key) != 0) {
        return 0;
    }

    sha512_init(&hash);
    sha512_update(&hash, signature, 32);
    sha512_update(&hash, public_key, 32);
    sha512_update(&hash, message, message_len);
    sha512_final(&hash, h);
    
    sc_reduce(h);
    ge_double_scalarmult_vartime(&R, h, &A, signature + 32);
    ge_tobytes(checker, &R);

    if (!consttime_equal(checker, signature)) {
        return 0;
    }

    return 1;
}
Revision:	1.1
Committed:	Fri Mar 27 20:23:13 2015 UTC (11 years, 7 months ago) by root
Content type:	text/plain
Branch:	MAIN
CVS Tags:	rel-0_1, rel-1_0, rel-1_02, rel-1_03, rel-1_01, rel-1_04, rel-1_05, rel-0_9, HEAD
Log Message:	* empty log message *
#	User	Rev	Content
1	root	1.1	#include "ed25519.h"
2			#include "sha512.h"
3			#include "ge.h"
4			#include "sc.h"
5
6			static int consttime_equal(const unsigned char x, const unsigned char y) {
7			unsigned char r = 0;
8
9			r = x[0] ^ y[0];
10			#define F(i) r \|= x[i] ^ y[i]
11			F(1);
12			F(2);
13			F(3);
14			F(4);
15			F(5);
16			F(6);
17			F(7);
18			F(8);
19			F(9);
20			F(10);
21			F(11);
22			F(12);
23			F(13);
24			F(14);
25			F(15);
26			F(16);
27			F(17);
28			F(18);
29			F(19);
30			F(20);
31			F(21);
32			F(22);
33			F(23);
34			F(24);
35			F(25);
36			F(26);
37			F(27);
38			F(28);
39			F(29);
40			F(30);
41			F(31);
42			#undef F
43
44			return !r;
45			}
46
47			int ed25519_verify(const unsigned char signature, const unsigned char message, size_t message_len, const unsigned char *public_key) {
48			unsigned char h[64];
49			unsigned char checker[32];
50			sha512_context hash;
51			ge_p3 A;
52			ge_p2 R;
53
54			if (signature[63] & 224) {
55			return 0;
56			}
57
58			if (ge_frombytes_negate_vartime(&A, public_key) != 0) {
59			return 0;
60			}
61
62			sha512_init(&hash);
63			sha512_update(&hash, signature, 32);
64			sha512_update(&hash, public_key, 32);
65			sha512_update(&hash, message, message_len);
66			sha512_final(&hash, h);
67
68			sc_reduce(h);
69			ge_double_scalarmult_vartime(&R, h, &A, signature + 32);
70			ge_tobytes(checker, &R);
71
72			if (!consttime_equal(checker, signature)) {
73			return 0;
74			}
75
76			return 1;
77			}