diff --git a/Makefile b/Makefile index f19c2c5..95ba7c9 100644 --- a/Makefile +++ b/Makefile @@ -216,11 +216,12 @@ $(BATNAME): include/* src/* src/*/* test/batarch.map $(BUILD_C)/decaf_tables.c # (cd $(BATNAME)/.. && tar czf $(BATBASE).tgz $(BATBASE) ) # Finds todo items in .h and .c files +TODO_TYPES ?= HACK TODO FIXME BUG XXX PERF FUTURE REMOVE MAGIC todo:: @(find * -name '*.h' -or -name '*.c' -or -name '*.cxx' -or -name '*.hxx') | xargs egrep --color=auto -w \ - 'HACK|TODO|FIXME|BUG|XXX|PERF|FUTURE|REMOVE|MAGIC' + `echo $(TODO_TYPES) | tr ' ' '|'` @echo '=============================' - @(for i in FIXME BUG XXX TODO HACK PERF FUTURE REMOVE MAGIC; do \ + @(for i in $(TODO_TYPES); do \ (find * -name '*.h' -or -name '*.c' -or -name '*.cxx' -or -name '*.hxx') | xargs egrep -w $$i > /dev/null || continue; \ /bin/echo -n $$i' ' | head -c 10; \ (find * -name '*.h' -or -name '*.c' -or -name '*.cxx' -or -name '*.hxx') | xargs egrep -w $$i| wc -l; \ @@ -228,7 +229,7 @@ todo:: @echo '=============================' @echo -n 'Total ' @(find * -name '*.h' -or -name '*.c' -or -name '*.cxx' -or -name '*.hxx') | xargs egrep -w \ - 'HACK|TODO|FIXME|BUG|XXX|PERF|FUTURE|REMOVE|MAGIC' | wc -l + `echo $(TODO_TYPES) | tr ' ' '|'` | wc -l bench: $(BUILD_IBIN)/bench ./$< diff --git a/src/public_include/decaf/decaf_255.hxx b/src/public_include/decaf/decaf_255.hxx index 462cbf0..39a43b0 100644 --- a/src/public_include/decaf/decaf_255.hxx +++ b/src/public_include/decaf/decaf_255.hxx @@ -10,7 +10,7 @@ * * The Decaf library implements cryptographic operations on a an elliptic curve * group of prime order p. It accomplishes this by using a twisted Edwards - * curve (isogenous to Ed255-Goldilocks) and wiping out the cofactor. + * curve (isogenous to Curve25519) and wiping out the cofactor. * * The formulas are all complete and have no special cases, except that * decaf_255_decode can fail because not every sequence of bytes is a valid group @@ -33,8 +33,6 @@ #include #include -/* TODO: attribute nonnull */ - /** @cond internal */ #if __cplusplus >= 201103L #define NOEXCEPT noexcept @@ -46,7 +44,7 @@ namespace decaf { /** - * @brief Ed255-Goldilocks/Decaf instantiation of group. + * @brief Curve25519/Decaf instantiation of group. */ struct Ed255 { @@ -60,12 +58,16 @@ class Precomputed; * Supports the usual arithmetic operations, all in constant time. */ class Scalar { +private: + /** @brief wrapped C type */ + typedef decaf_255_scalar_t Wrapped; + public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_255_SCALAR_BYTES; /** @brief access to the underlying scalar object */ - decaf_255_scalar_t s; + Wrapped s; /** @brief Don't initialize. */ inline Scalar(const NOINIT &) NOEXCEPT {} @@ -83,7 +85,7 @@ public: } /** @brief Construct from decaf_scalar_t object. */ - inline Scalar(const decaf_255_scalar_t &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); } + inline Scalar(const Wrapped &t = decaf_255_scalar_zero) NOEXCEPT { decaf_255_scalar_copy(s,t); } /** @brief Copy constructor. */ inline Scalar(const Scalar &x) NOEXCEPT { *this = x; } @@ -118,26 +120,18 @@ public: * @return DECAF_FAILURE if the scalar is greater than or equal to the group order q. */ static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Scalar &sc, const unsigned char buffer[SER_BYTES] - ) NOEXCEPT { - return decaf_255_scalar_decode(sc.s,buffer); - } - - /** @brief Decode from correct-length little-endian byte sequence in C++ string. */ - static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Scalar &sc, const Block &buffer + Scalar &sc, const FixedBlock buffer ) NOEXCEPT { - if (buffer.size() != SER_BYTES) return DECAF_FAILURE; return decaf_255_scalar_decode(sc.s,buffer); } /** @brief Encode to fixed-length string */ inline operator SecureBuffer() const NOEXCEPT { - SecureBuffer buf(SER_BYTES); decaf_255_scalar_encode(buf,s); return buf; + SecureBuffer buf(SER_BYTES); encode(buf); return buf; } /** @brief Encode to fixed-length buffer */ - inline void encode(unsigned char buffer[SER_BYTES]) const NOEXCEPT{ + inline void encode(FixedBuffer buffer) const NOEXCEPT{ decaf_255_scalar_encode(buffer, s); } @@ -188,12 +182,7 @@ public: const Block &in, decaf_bool_t allow_identity=DECAF_FALSE, decaf_bool_t short_circuit=DECAF_TRUE - ) const throw(CryptoException) { - SecureBuffer out(/*FIXME Point::*/SER_BYTES); - if (!decaf_255_direct_scalarmul(out, in.data(), s, allow_identity, short_circuit)) - throw CryptoException(); - return out; - } + ) const throw(CryptoException); }; /** @@ -201,23 +190,25 @@ public: */ class Point { public: + typedef decaf_255_point_t Wrapped; + /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_255_SER_BYTES; - /** @brief Size of a stegged element */ - static const size_t STEG_BYTES = DECAF_255_SER_BYTES + 8; - /** @brief Bytes required for hash */ - static const size_t HASH_BYTES = DECAF_255_SER_BYTES; + static const size_t HASH_BYTES = SER_BYTES; + + /** @brief Size of a stegged element */ + static const size_t STEG_BYTES = HASH_BYTES * 2; /** The c-level object. */ - decaf_255_point_t p; + Wrapped p; /** @brief Don't initialize. */ inline Point(const NOINIT &) NOEXCEPT {} /** @brief Constructor sets to identity by default. */ - inline Point(const decaf_255_point_t &q = decaf_255_point_identity) NOEXCEPT { decaf_255_point_copy(p,q); } + inline Point(const Wrapped &q = decaf_255_point_identity) NOEXCEPT { decaf_255_point_copy(p,q); } /** @brief Copy constructor. */ inline Point(const Point &q) NOEXCEPT { *this = q; } @@ -251,29 +242,15 @@ public: } /** - * @brief Initialize from C fixed-length byte string. + * @brief Initialize from a fixed-length byte string. * The all-zero string maps to the identity. * * @throw CryptoException the string was the wrong length, or wasn't the encoding of a point, * or was the identity and allow_identity was DECAF_FALSE. */ - inline explicit Point(const unsigned char buffer[SER_BYTES], decaf_bool_t allow_identity=DECAF_TRUE) + inline explicit Point(const FixedBuffer buffer, decaf_bool_t allow_identity=DECAF_TRUE) throw(CryptoException) { if (!decode(*this,buffer,allow_identity)) throw CryptoException(); } - /** - * @brief Initialize from C fixed-length byte string. - * The all-zero string maps to the identity. - * - * @retval DECAF_SUCCESS the string was successfully decoded. - * @return DECAF_FAILURE the string wasn't the encoding of a point, or was the identity - * and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. - */ - static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Point &p, const unsigned char buffer[SER_BYTES], decaf_bool_t allow_identity=DECAF_TRUE - ) NOEXCEPT { - return decaf_255_point_decode(p.p,buffer,allow_identity); - } - /** * @brief Initialize from C++ fixed-length byte string. * The all-zero string maps to the identity. @@ -283,9 +260,8 @@ public: * or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. */ static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Point &p, const Block &buffer, decaf_bool_t allow_identity=DECAF_TRUE + Point &p, const FixedBlock buffer, decaf_bool_t allow_identity=DECAF_TRUE ) NOEXCEPT { - if (buffer.size() != SER_BYTES) return DECAF_FAILURE; return decaf_255_point_decode(p.p,buffer.data(),allow_identity); } @@ -325,15 +301,13 @@ public: * @brief Encode to string. The identity encodes to the all-zero string. */ inline operator SecureBuffer() const NOEXCEPT { - SecureBuffer buffer(SER_BYTES); - decaf_255_point_encode(buffer, p); - return buffer; + SecureBuffer buffer(SER_BYTES); encode(buffer); return buffer; } /** * @brief Encode to a C buffer. The identity encodes to all zeros. */ - inline void encode(unsigned char buffer[SER_BYTES]) const NOEXCEPT{ + inline void encode(FixedBuffer buffer) const NOEXCEPT { decaf_255_point_encode(buffer, p); } @@ -393,7 +367,7 @@ public: static inline Point double_scalarmul ( const Scalar &qs, const Point &q, const Scalar &rs, const Point &r ) NOEXCEPT { - Point p((NOINIT())); decaf_255_point_double_scalarmul(p.p,q.p,qs.s,r.p,rs.s); return p; + return double_scalarmul(q,qs,r,rs); } /** @@ -407,22 +381,17 @@ public: /** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */ inline Point debugging_torque() const NOEXCEPT { - Point q; - decaf_255_point_debugging_torque(q.p,p); - return q; + Point q; decaf_255_point_debugging_torque(q.p,p); return q; } /** @brief Return a point equal to *this, whose internal data has a modified representation. */ - inline Point debugging_pscale(const uint8_t factor[/*SER_BYTES*/]) const NOEXCEPT { - Point q; - decaf_255_point_debugging_pscale(q.p,p,factor); - return q; + inline Point debugging_pscale(const FixedBlock factor) const NOEXCEPT { + Point q; decaf_255_point_debugging_pscale(q.p,p,factor); return q; } /** @brief Return a point equal to *this, whose internal data has a randomized representation. */ inline Point debugging_pscale(Rng &r) const NOEXCEPT { - StackBuffer sb(r); - return debugging_pscale(sb); + StackBuffer sb(r); return debugging_pscale(sb); } /** @@ -564,7 +533,22 @@ public: /** @endcond */ }; -}; /* struct Decaf255 */ +}; /* struct Ed255 */ + + + +/** @cond internal */ +inline SecureBuffer Ed255::Scalar::direct_scalarmul ( + const Block &in, + decaf_bool_t allow_identity, + decaf_bool_t short_circuit +) const throw(CryptoException) { + SecureBuffer out(Ed255::Point::SER_BYTES); + if (!decaf_255_direct_scalarmul(out, in.data(), s, allow_identity, short_circuit)) + throw CryptoException(); + return out; +} +/** endcond */ #undef NOEXCEPT } /* namespace decaf */ diff --git a/src/public_include/decaf/decaf_448.hxx b/src/public_include/decaf/decaf_448.hxx index 2968d95..8448a18 100644 --- a/src/public_include/decaf/decaf_448.hxx +++ b/src/public_include/decaf/decaf_448.hxx @@ -28,208 +28,21 @@ #include /* for memcpy */ #include +#include #include #include #include -/* TODO: This is incomplete */ -/* TODO: attribute nonnull */ - /** @cond internal */ #if __cplusplus >= 201103L #define NOEXCEPT noexcept -#define EXPLICIT_CON explicit -#define GET_DATA(str) ((const unsigned char *)&(str)[0]) #else #define NOEXCEPT throw() -#define EXPLICIT_CON -#define GET_DATA(str) ((const unsigned char *)((str).data())) #endif /** @endcond */ namespace decaf { -/** @brief An exception for when crypto (ie point decode) has failed. */ -class CryptoException : public std::exception { -public: - /** @return "CryptoException" */ - virtual const char * what() const NOEXCEPT { return "CryptoException"; } -}; - -/** @brief An exception for when crypto (ie point decode) has failed. */ -class LengthException : public std::exception { -public: - /** @return "CryptoException" */ - virtual const char * what() const NOEXCEPT { return "LengthException"; } -}; - -/** - * Securely erase contents of memory. - */ -static inline void really_bzero(void *data, size_t size) { decaf_bzero(data,size); } - -/** Block object */ -class Block { -protected: - unsigned char *data_; - size_t size_; - -public: - /** Empty init */ - inline Block() NOEXCEPT : data_(NULL), size_(0) {} - - /** Init from C string */ - inline Block(const char *data) NOEXCEPT : data_((unsigned char *)data), size_(strlen(data)) {} - - /** Unowned init */ - inline Block(const unsigned char *data, size_t size) NOEXCEPT : data_((unsigned char *)data), size_(size) {} - - /** Block from std::string */ - inline Block(const std::string &s) : data_((unsigned char *)GET_DATA(s)), size_(s.size()) {} - - /** Get const data */ - inline const unsigned char *data() const NOEXCEPT { return data_; } - - /** Get the size */ - inline size_t size() const NOEXCEPT { return size_; } - - /** Autocast to const unsigned char * */ - inline operator const unsigned char*() const NOEXCEPT { return data_; } - - /** Convert to C++ string */ - inline std::string get_string() const { - return std::string((const char *)data_,size_); - } - - /** Slice the buffer*/ - inline Block slice(size_t off, size_t length) const throw(LengthException) { - if (off > size() || length > size() - off) - throw LengthException(); - return Block(data()+off, length); - } - - /** Virtual destructor for SecureBlock. TODO: probably means vtable? Make bool? */ - inline virtual ~Block() {}; -}; - -class TmpBuffer; - -class Buffer : public Block { -public: - /** Null init */ - inline Buffer() NOEXCEPT : Block() {} - - /** Unowned init */ - inline Buffer(unsigned char *data, size_t size) NOEXCEPT : Block(data,size) {} - - /** Get unconst data */ - inline unsigned char *data() NOEXCEPT { return data_; } - - /** Get const data */ - inline const unsigned char *data() const NOEXCEPT { return data_; } - - /** Autocast to const unsigned char * */ - inline operator const unsigned char*() const NOEXCEPT { return data_; } - - /** Autocast to unsigned char */ - inline operator unsigned char*() NOEXCEPT { return data_; } - - /** Slice the buffer*/ - inline TmpBuffer slice(size_t off, size_t length) throw(LengthException); -}; - -class TmpBuffer : public Buffer { -public: - /** Unowned init */ - inline TmpBuffer(unsigned char *data, size_t size) NOEXCEPT : Buffer(data,size) {} -}; - -TmpBuffer Buffer::slice(size_t off, size_t length) throw(LengthException) { - if (off > size() || length > size() - off) throw LengthException(); - return TmpBuffer(data()+off, length); -} - -/** A self-erasing block of data */ -class SecureBuffer : public Buffer { -public: - /** Null secure block */ - inline SecureBuffer() NOEXCEPT : Buffer() {} - - /** Construct empty from size */ - inline SecureBuffer(size_t size) { - data_ = new unsigned char[size_ = size]; - memset(data_,0,size); - } - - /** Construct from data */ - inline SecureBuffer(const unsigned char *data, size_t size){ - data_ = new unsigned char[size_ = size]; - memcpy(data_, data, size); - } - - /** Copy constructor */ - inline SecureBuffer(const Block ©) : Buffer() { *this = copy; } - - /** Copy-assign constructor */ - inline SecureBuffer& operator=(const Block ©) throw(std::bad_alloc) { - if (© == this) return *this; - clear(); - data_ = new unsigned char[size_ = copy.size()]; - memcpy(data_,copy.data(),size_); - return *this; - } - - /** Copy-assign constructor */ - inline SecureBuffer& operator=(const SecureBuffer ©) throw(std::bad_alloc) { - if (© == this) return *this; - clear(); - data_ = new unsigned char[size_ = copy.size()]; - memcpy(data_,copy.data(),size_); - return *this; - } - - /** Destructor erases data */ - ~SecureBuffer() NOEXCEPT { clear(); } - - /** Clear data */ - inline void clear() NOEXCEPT { - if (data_ == NULL) return; - really_bzero(data_,size_); - delete[] data_; - data_ = NULL; - size_ = 0; - } - -#if __cplusplus >= 201103L - /** Move constructor */ - inline SecureBuffer(SecureBuffer &&move) { *this = move; } - - /** Move non-constructor */ - inline SecureBuffer(Block &&move) { *this = (Block &)move; } - - /** Move-assign constructor. TODO: check that this actually gets used.*/ - inline SecureBuffer& operator=(SecureBuffer &&move) { - clear(); - data_ = move.data_; move.data_ = NULL; - size_ = move.size_; move.size_ = 0; - return *this; - } - - /** C++11-only explicit cast */ - inline explicit operator std::string() const { return get_string(); } -#endif -}; - - -/** @brief Passed to constructors to avoid (conservative) initialization */ -struct NOINIT {}; - -/**@cond internal*/ -/** Forward-declare sponge RNG object */ -class SpongeRng; -/**@endcond*/ - - /** * @brief Ed448-Goldilocks/Decaf instantiation of group. */ @@ -245,12 +58,16 @@ class Precomputed; * Supports the usual arithmetic operations, all in constant time. */ class Scalar { +private: + /** @brief wrapped C type */ + typedef decaf_448_scalar_t Wrapped; + public: /** @brief Size of a serialized element */ static const size_t SER_BYTES = DECAF_448_SCALAR_BYTES; /** @brief access to the underlying scalar object */ - decaf_448_scalar_t s; + Wrapped s; /** @brief Don't initialize. */ inline Scalar(const NOINIT &) NOEXCEPT {} @@ -262,7 +79,10 @@ public: inline Scalar(const int w) NOEXCEPT { *this = w; } /** @brief Construct from RNG */ - inline explicit Scalar(SpongeRng &rng) NOEXCEPT; + inline explicit Scalar(Rng &rng) NOEXCEPT { + StackBuffer sb(rng); + *this = sb; + } /** @brief Construct from decaf_scalar_t object. */ inline Scalar(const decaf_448_scalar_t &t = decaf_448_scalar_zero) NOEXCEPT { decaf_448_scalar_copy(s,t); } @@ -287,7 +107,7 @@ public: return *this; } - /** Destructor securely erases the scalar. */ + /** Destructor securely zeorizes the scalar. */ inline ~Scalar() NOEXCEPT { decaf_448_scalar_destroy(s); } /** @brief Assign from arbitrary-length little-endian byte sequence in a Block. */ @@ -300,26 +120,18 @@ public: * @return DECAF_FAILURE if the scalar is greater than or equal to the group order q. */ static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Scalar &sc, const unsigned char buffer[SER_BYTES] - ) NOEXCEPT { - return decaf_448_scalar_decode(sc.s,buffer); - } - - /** @brief Decode from correct-length little-endian byte sequence in C++ string. */ - static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Scalar &sc, const Block &buffer + Scalar &sc, const FixedBlock buffer ) NOEXCEPT { - if (buffer.size() != SER_BYTES) return DECAF_FAILURE; return decaf_448_scalar_decode(sc.s,buffer); } /** @brief Encode to fixed-length string */ - inline EXPLICIT_CON operator SecureBuffer() const NOEXCEPT { + inline operator SecureBuffer() const NOEXCEPT { SecureBuffer buf(SER_BYTES); decaf_448_scalar_encode(buf,s); return buf; } /** @brief Encode to fixed-length buffer */ - inline void encode(unsigned char buffer[SER_BYTES]) const NOEXCEPT{ + inline void encode(FixedBuffer buffer) const NOEXCEPT{ decaf_448_scalar_encode(buffer, s); } @@ -402,16 +214,24 @@ public: inline Point(const decaf_448_point_t &q = decaf_448_point_identity) NOEXCEPT { decaf_448_point_copy(p,q); } /** @brief Copy constructor. */ - inline Point(const Point &q) NOEXCEPT { decaf_448_point_copy(p,q.p); } + inline Point(const Point &q) NOEXCEPT { *this = q; } /** @brief Assignment. */ inline Point& operator=(const Point &q) NOEXCEPT { decaf_448_point_copy(p,q.p); return *this; } - /** @brief Destructor securely erases the point. */ + /** @brief Destructor securely zeorizes the point. */ inline ~Point() NOEXCEPT { decaf_448_point_destroy(p); } /** @brief Construct from RNG */ - inline explicit Point(SpongeRng &rng, bool uniform = true) NOEXCEPT; + inline explicit Point(Rng &rng, bool uniform = true) NOEXCEPT { + if (uniform) { + StackBuffer<2*HASH_BYTES> b(rng); + set_to_hash(b); + } else { + StackBuffer b(rng); + set_to_hash(b); + } + } /** * @brief Initialize from C++ fixed-length byte string. @@ -425,29 +245,15 @@ public: } /** - * @brief Initialize from C fixed-length byte string. + * @brief Initialize from a fixed-length byte string. * The all-zero string maps to the identity. * * @throw CryptoException the string was the wrong length, or wasn't the encoding of a point, * or was the identity and allow_identity was DECAF_FALSE. */ - inline explicit Point(const unsigned char buffer[SER_BYTES], decaf_bool_t allow_identity=DECAF_TRUE) + inline explicit Point(const FixedBuffer buffer, decaf_bool_t allow_identity=DECAF_TRUE) throw(CryptoException) { if (!decode(*this,buffer,allow_identity)) throw CryptoException(); } - /** - * @brief Initialize from C fixed-length byte string. - * The all-zero string maps to the identity. - * - * @retval DECAF_SUCCESS the string was successfully decoded. - * @return DECAF_FAILURE the string wasn't the encoding of a point, or was the identity - * and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. - */ - static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Point &p, const unsigned char buffer[SER_BYTES], decaf_bool_t allow_identity=DECAF_TRUE - ) NOEXCEPT { - return decaf_448_point_decode(p.p,buffer,allow_identity); - } - /** * @brief Initialize from C++ fixed-length byte string. * The all-zero string maps to the identity. @@ -457,9 +263,8 @@ public: * or was the identity and allow_identity was DECAF_FALSE. Contents of the buffer are undefined. */ static inline decaf_bool_t __attribute__((warn_unused_result)) decode ( - Point &p, const Block &buffer, decaf_bool_t allow_identity=DECAF_TRUE + Point &p, const FixedBlock buffer, decaf_bool_t allow_identity=DECAF_TRUE ) NOEXCEPT { - if (buffer.size() != SER_BYTES) return DECAF_FAILURE; return decaf_448_point_decode(p.p,buffer.data(),allow_identity); } @@ -479,26 +284,26 @@ public: * If the buffer is shorter than 2*HASH_BYTES, well, it won't be as uniform, * but the buffer will be zero-padded on the right. */ - inline unsigned char set_to_hash( const Block &s ) NOEXCEPT { + inline void set_to_hash( const Block &s ) NOEXCEPT { if (s.size() < HASH_BYTES) { SecureBuffer b(HASH_BYTES); memcpy(b.data(), s.data(), s.size()); - return decaf_448_point_from_hash_nonuniform(p,b); + decaf_448_point_from_hash_nonuniform(p,b); } else if (s.size() == HASH_BYTES) { - return decaf_448_point_from_hash_nonuniform(p,s); + decaf_448_point_from_hash_nonuniform(p,s); } else if (s.size() < 2*HASH_BYTES) { SecureBuffer b(2*HASH_BYTES); memcpy(b.data(), s.data(), s.size()); - return decaf_448_point_from_hash_uniform(p,b); + decaf_448_point_from_hash_uniform(p,b); } else { - return decaf_448_point_from_hash_uniform(p,s); + decaf_448_point_from_hash_uniform(p,s); } } /** * @brief Encode to string. The identity encodes to the all-zero string. */ - inline EXPLICIT_CON operator SecureBuffer() const NOEXCEPT { + inline operator SecureBuffer() const NOEXCEPT { SecureBuffer buffer(SER_BYTES); decaf_448_point_encode(buffer, p); return buffer; @@ -507,7 +312,7 @@ public: /** * @brief Encode to a C buffer. The identity encodes to all zeros. */ - inline void encode(unsigned char buffer[SER_BYTES]) const NOEXCEPT{ + inline void encode(FixedBuffer buffer) const NOEXCEPT{ decaf_448_point_encode(buffer, p); } @@ -579,13 +384,32 @@ public: Point r((NOINIT())); decaf_448_base_double_scalarmul_non_secret(r.p,s_base.s,p,s.s); return r; } - inline Point& debugging_torque_in_place() { - decaf_448_point_debugging_torque(p,p); - return *this; + /** @brief Return a point equal to *this, whose internal data is rotated by a torsion element. */ + inline Point debugging_torque() const NOEXCEPT { + Point q; + decaf_448_point_debugging_torque(q.p,p); + return q; } + /** @brief Return a point equal to *this, whose internal data has a modified representation. */ + inline Point debugging_pscale(const FixedBlock factor) const NOEXCEPT { + Point q; + decaf_448_point_debugging_pscale(q.p,p,factor); + return q; + } + + /** @brief Return a point equal to *this, whose internal data has a randomized representation. */ + inline Point debugging_pscale(Rng &r) const NOEXCEPT { + StackBuffer sb(r); + return debugging_pscale(sb); + } + + /** + * Modify buffer so that Point::from_hash(Buffer) == *this, and return true; + * or leave buf unmodified and return false. + */ inline bool invert_elligator ( - Buffer &buf, unsigned char hint + Buffer &buf, uint16_t hint ) const NOEXCEPT { unsigned char buf2[2*HASH_BYTES]; memset(buf2,0,sizeof(buf2)); @@ -599,13 +423,24 @@ public: if (buf.size() < HASH_BYTES) { ret &= decaf_memeq(&buf2[buf.size()], &buf2[HASH_BYTES], HASH_BYTES - buf.size()); } - memcpy(buf,buf2,(buf.size() < HASH_BYTES) ? buf.size() : HASH_BYTES); + if (ret) { + /* TODO: make this constant time?? */ + memcpy(buf,buf2,(buf.size() < HASH_BYTES) ? buf.size() : HASH_BYTES); + } decaf_bzero(buf2,sizeof(buf2)); return !!ret; } /** @brief Steganographically encode this */ - inline SecureBuffer steg_encode(SpongeRng &rng) const NOEXCEPT; + inline SecureBuffer steg_encode(Rng &rng) const throw(std::bad_alloc) { + SecureBuffer out(STEG_BYTES); + bool done; + do { + rng.read(out.slice(HASH_BYTES-1,STEG_BYTES-HASH_BYTES+1)); + done = invert_elligator(out, out[HASH_BYTES-1]); + } while (!done); + return out; + } /** @brief Return the base point */ static inline const Point base() NOEXCEPT { return Point(decaf_448_point_base); } @@ -619,7 +454,9 @@ public: * Minor difficulties arise here because the decaf API doesn't expose, as a constant, how big such an object is. * Therefore we have to call malloc() or friends, but that's probably for the best, because you don't want to * stack-allocate a 15kiB object anyway. - *//** @cond internal */ + */ + +/** @cond internal */ typedef decaf_448_precomputed_s Precomputed_U; /** @endcond */ class Precomputed @@ -709,8 +546,6 @@ public: }; /* struct Decaf448 */ #undef NOEXCEPT -#undef EXPLICIT_CON -#undef GET_DATA } /* namespace decaf */ #endif /* __DECAF_448_HXX__ */ diff --git a/src/public_include/decaf/secure_buffer.hxx b/src/public_include/decaf/secure_buffer.hxx index 7fc6f14..2ce19a2 100644 --- a/src/public_include/decaf/secure_buffer.hxx +++ b/src/public_include/decaf/secure_buffer.hxx @@ -87,8 +87,8 @@ protected: size_t size_; public: - /** Empty init */ - inline Block() NOEXCEPT : data_(NULL), size_(0) {} + /** Null initialization */ + inline Block() : data_(NULL), size_(0) {} /** Init from C string */ inline Block(const char *data) NOEXCEPT : data_((unsigned char *)data), size_(strlen(data)) {} @@ -148,6 +148,18 @@ public: inline virtual ~Block() {}; }; +/** A fixed-size block */ +template class FixedBlock : public Block { +public: + /** Check a block's length. */ + inline FixedBlock(const Block &b) throw(LengthException) : Block(b,Size) { + if (Size != b.size()) throw LengthException(); + } + + /** Explicitly pass a C buffer. */ + inline explicit FixedBlock(const uint8_t data[Size]) NOEXCEPT : Block(data,Size) {} +}; + /** A reference to a writable block of data */ class Buffer : public Block { public: @@ -176,6 +188,24 @@ public: inline void zeroize() NOEXCEPT { really_bzero(data(),size()); } }; + +/** A fixed-size block */ +template class FixedBuffer : public Buffer { +public: + /** Check a block's length. */ + inline FixedBuffer(Buffer &b) throw(LengthException) : Buffer(b,Size) { + if (Size != b.size()) throw LengthException(); + } + + /** Explicitly pass a C buffer. */ + inline explicit FixedBuffer(uint8_t dat[Size]) NOEXCEPT : Buffer(dat,Size) {} + + /** Cast to a FixedBlock. */ + inline operator FixedBlock() const NOEXCEPT { + return FixedBlock(data()); + } +}; + /** A temporary reference to a writeable buffer, for converting C to C++. */ class TmpBuffer : public Buffer { public: @@ -184,18 +214,20 @@ public: }; /** A fixed-size stack-allocated buffer (for NOEXCEPT semantics) */ -template class StackBuffer : public Buffer { +template class StackBuffer : public FixedBuffer { private: uint8_t storage[Size]; public: + using Buffer::zeroize; + /** New buffer initialized to zero. */ - inline StackBuffer() NOEXCEPT : Buffer(storage, Size) { memset(storage,0,Size); } + inline explicit StackBuffer() NOEXCEPT : FixedBuffer(storage) { memset(storage,0,Size); } /** New uninitialized buffer. */ - inline StackBuffer(const NOINIT &) NOEXCEPT : Buffer(storage, Size) { } + inline explicit StackBuffer(const NOINIT &) NOEXCEPT : FixedBuffer(storage) { } /** New random buffer */ - inline StackBuffer(Rng &r) NOEXCEPT : Buffer(storage, Size) { r.read(*this); } + inline explicit StackBuffer(Rng &r) NOEXCEPT : FixedBuffer(storage) { r.read(*this); } /** Destroy the buffer */ ~StackBuffer() NOEXCEPT { zeroize(); } @@ -212,13 +244,13 @@ public: inline SecureBuffer() NOEXCEPT : Buffer() {} /** Construct empty from size */ - inline SecureBuffer(size_t size) { + inline SecureBuffer(size_t size) throw(std::bad_alloc) { data_ = new unsigned char[size_ = size]; memset(data_,0,size); } /** Construct from data */ - inline SecureBuffer(const unsigned char *data, size_t size) { + inline SecureBuffer(const unsigned char *data, size_t size) throw(std::bad_alloc) { data_ = new unsigned char[size_ = size]; memcpy(data_, data, size); } @@ -230,7 +262,7 @@ public: } /** Copy constructor */ - inline SecureBuffer(const Block ©) : Buffer() { *this = copy; } + inline SecureBuffer(const Block ©) throw(std::bad_alloc) : Buffer() { *this = copy; } /** Copy-assign constructor */ inline SecureBuffer& operator=(const Block ©) throw(std::bad_alloc) { @@ -297,12 +329,12 @@ inline SecureBuffer Rng::read(size_t length) throw(std::bad_alloc) { /** A secure buffer which stores an owned or unowned underlying value. * If it is owned, it will be securely zeroed. */ -template +template class OwnedOrUnowned { protected: union { - Underlying *mine; - const Underlying *yours; + Wrapped *mine; + const Wrapped *yours; } ours; bool isMine; @@ -323,10 +355,10 @@ protected: } isMine = true; } - inline const Underlying *get() const NOEXCEPT { return isMine ? ours.mine : ours.yours; } + inline const Wrapped *get() const NOEXCEPT { return isMine ? ours.mine : ours.yours; } inline OwnedOrUnowned( - const Underlying &yours = *T::defaultValue() + const Wrapped &yours = *T::defaultValue() ) NOEXCEPT { ours.yours = &yours; isMine = false; diff --git a/test/test_decaf.cxx b/test/test_decaf.cxx index a68658c..a659856 100644 --- a/test/test_decaf.cxx +++ b/test/test_decaf.cxx @@ -49,7 +49,7 @@ typedef typename Group::Precomputed Precomputed; static void print(const char *name, const Scalar &x) { unsigned char buffer[Scalar::SER_BYTES]; - x.encode(buffer); + x.encode(decaf::FixedBuffer(buffer)); printf(" %s = 0x", name); for (int i=sizeof(buffer)-1; i>=0; i--) { printf("%02x", buffer[i]); @@ -66,10 +66,10 @@ static void hexprint(const char *name, const decaf::SecureBuffer &buffer) { } static void print(const char *name, const Point &x) { - unsigned char buffer[Point::SER_BYTES]; + decaf::StackBuffer buffer; x.encode(buffer); printf(" %s = 0x", name); - for (int i=sizeof(buffer)-1; i>=0; i--) { + for (int i=Point::SER_BYTES-1; i>=0; i--) { printf("%02x", buffer[i]); } printf("\n");