From nobody Wed Jul 13 19:43:25 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 156921D22E84; Wed, 13 Jul 2022 19:43:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Ljp2P6HQpz46nf; Wed, 13 Jul 2022 19:43:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657741405; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dO2XvcTBc4SYHzUI0Tpa5mAwPePmGoMgObpk3IS4hYU=; b=tteSAFMI/NUveKdEbcPPGx5W1YnCmdBwlyw0iuNQXfxYRWYp2Yu/LmmZyneVCFSiZMsPsZ bf7uu3jejhrOzYVQ9PtcUp823PLNp45aHbJHd9S9g/1peZ0DFxXC2P5f9C4a2H0CUwM1uh 1jT675MWCK5bzcVelsvfIKNXJ5ZxDPiN7LepkiF8AfPso3RLp2MJpne4jyvGrNj/+6nGtV 6VydvvqJaiddjiCjonz6yWsxO336DZHBrYGFH0iCkqaRx/nxETAQHbXcdfwIRscBHaRM8J DzgppmGdmxFLq1olTnERfzk/7eig8l+IWWmQVzV5MlAriG1ZMobAy7BzhbSyow== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Ljp2P5NyBzbYD; Wed, 13 Jul 2022 19:43:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 26DJhPrI097111; Wed, 13 Jul 2022 19:43:25 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 26DJhP8K097109; Wed, 13 Jul 2022 19:43:25 GMT (envelope-from git) Date: Wed, 13 Jul 2022 19:43:25 GMT Message-Id: <202207131943.26DJhP8K097109@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: b29bd06e67d2 - stable/13 - crypto: Add an API supporting curve25519. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: b29bd06e67d249708f5429b07f722089e1fce63f Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657741405; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dO2XvcTBc4SYHzUI0Tpa5mAwPePmGoMgObpk3IS4hYU=; b=czM+nbwSQwOVSQp/AccjqprpTdGNMj7ZcBXPr7jfgktar7UC9lrX+9wiN/34Tp3TKtyKQZ XcjoBdy52kzDF4bdIEwFN6TAZFRFZTxopvSUBlxHaum2Qx4ghuMLgDM+w5ozTVGwQvhlXX sVvPn3Uf8JLXT3AF76+LeDEei/rMpST5ik4KCI6l4rnBxQPpNaEQyD0xX5vVvztG/GcuNi BWb49dwS/VgS5xblglPvUxh+W6Clm65EfIlYEWbC8m0YtETgm8+2qwPGBYXcthE6zA+C3f BagLKvuTfZ9J/xDQS4DPXJkgelZn2RlpI/gVUvdTXEQqJNSRTmFJVr6U7k2D7w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1657741405; a=rsa-sha256; cv=none; b=X2DV0M1MXLgpg+Ta6XlHWifD7X0RNJKkTFKlHvrZJypdd3LcJEB4hkBCCTisFx0wjbxmbE SvaInqpKEyhusKPZgNGrmUMZ9usgsSkhUKAIuukSds8UjVJypFMV89sFdZCw2T9UgvlqEK ageefeVzpFophkzcKWcarD/Fp/FK3sPlNuwOZAORXceq0P5hmgwHe62HOzUAySSn67Bype zFad8iT4Ga2XefBQSyPZtBKE5PwmN/jff6hZVLfRr1KbfDXmoIud7j0M5p7fPjdEb+hmbg 7auNm4z8qbNeqQSKS1gZNCPC9DttCLvKuvkREyzq5bzcLW07Ya1H6d+wSGlGcg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=b29bd06e67d249708f5429b07f722089e1fce63f commit b29bd06e67d249708f5429b07f722089e1fce63f Author: John Baldwin AuthorDate: 2022-01-24 23:27:39 +0000 Commit: John Baldwin CommitDate: 2022-07-13 19:28:41 +0000 crypto: Add an API supporting curve25519. This adds a wrapper around libsodium's curve25519 support matching Linux's curve25519 API. The intended use case for this is WireGuard. Note that this is not integrated with OCF as it is not related to symmetric operations on data. Reviewed by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33935 (cherry picked from commit 0c6274a819ffdf6d5a3713b2c0f7014840f01703) --- sys/conf/files | 11 ++++++++ sys/crypto/curve25519.c | 46 ++++++++++++++++++++++++++++++++++ sys/crypto/curve25519.h | 58 +++++++++++++++++++++++++++++++++++++++++++ sys/crypto/libsodium/stdlib.h | 3 +++ sys/crypto/libsodium/utils.c | 31 ++++++++++++++++++++++- sys/modules/crypto/Makefile | 12 +++++++++ 6 files changed, 160 insertions(+), 1 deletion(-) diff --git a/sys/conf/files b/sys/conf/files index 491528a3d63b..87711570355a 100644 --- a/sys/conf/files +++ b/sys/conf/files @@ -742,6 +742,8 @@ crypto/chacha20/chacha.c standard crypto/chacha20/chacha-sw.c optional crypto crypto/chacha20_poly1305.c optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium" +crypto/curve25519.c optional crypto \ + compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium" crypto/des/des_ecb.c optional netsmb crypto/des/des_setkey.c optional netsmb crypto/openssl/ossl.c optional ossl @@ -4979,6 +4981,9 @@ opencrypto/xform_chacha20_poly1305.c optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium" opencrypto/xform_poly1305.c optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include -I$S/crypto/libsodium" +contrib/libsodium/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c \ + optional crypto \ + compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" contrib/libsodium/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c \ optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" @@ -4994,6 +4999,12 @@ contrib/libsodium/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305 contrib/libsodium/src/libsodium/crypto_onetimeauth/poly1305/donna/poly1305_donna.c \ optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" +contrib/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519.c \ + optional crypto \ + compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" +contrib/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c \ + optional crypto \ + compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" contrib/libsodium/src/libsodium/crypto_stream/chacha20/stream_chacha20.c \ optional crypto \ compile-with "${NORMAL_C} -I$S/contrib/libsodium/src/libsodium/include/sodium -I$S/crypto/libsodium" diff --git a/sys/crypto/curve25519.c b/sys/crypto/curve25519.c new file mode 100644 index 000000000000..711cfec3a9e5 --- /dev/null +++ b/sys/crypto/curve25519.c @@ -0,0 +1,46 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2021 The FreeBSD Foundation + * + * This software was developed by Ararat River Consulting, LLC under + * sponsorship from the FreeBSD Foundation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include + +bool +curve25519(uint8_t *public, const uint8_t *secret, + const uint8_t *basepoint) +{ + return (crypto_scalarmult_curve25519(public, secret, + basepoint) == 0); +} + +bool +curve25519_generate_public(uint8_t *public, const uint8_t *secret) +{ + return (crypto_scalarmult_curve25519_base(public, secret) == 0); +} diff --git a/sys/crypto/curve25519.h b/sys/crypto/curve25519.h new file mode 100644 index 000000000000..3a1f26df015c --- /dev/null +++ b/sys/crypto/curve25519.h @@ -0,0 +1,58 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2021 The FreeBSD Foundation + * + * This software was developed by Ararat River Consulting, LLC under + * sponsorship from the FreeBSD Foundation. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef __CRYPTO_CURVE25519_H__ +#define __CRYPTO_CURVE25519_H__ + +#include + +#define CURVE25519_KEY_SIZE 32 + +bool curve25519(uint8_t *public, const uint8_t *secret, + const uint8_t *basepoint); +bool curve25519_generate_public(uint8_t *public, + const uint8_t *secret); + +static __inline void +curve25519_clamp_secret(uint8_t *secret) +{ + secret[0] &= 248; + secret[31] &= 127; + secret[31] |= 64; +} + +static __inline void +curve25519_generate_secret(uint8_t *secret) +{ + arc4random_buf(secret, CURVE25519_KEY_SIZE); + curve25519_clamp_secret(secret); +} + +#endif /* __CRYPTO_CURVE25519_H__ */ diff --git a/sys/crypto/libsodium/stdlib.h b/sys/crypto/libsodium/stdlib.h index 69f4ed52d7e0..8a53b2b0456f 100644 --- a/sys/crypto/libsodium/stdlib.h +++ b/sys/crypto/libsodium/stdlib.h @@ -1,2 +1,5 @@ /* This file is in the public domain */ /* $FreeBSD$ */ + +#define abort() \ + panic("libsodium error at %s:%d", __FILE__, __LINE__) diff --git a/sys/crypto/libsodium/utils.c b/sys/crypto/libsodium/utils.c index 4743ba296e09..aebe6c1fca9e 100644 --- a/sys/crypto/libsodium/utils.c +++ b/sys/crypto/libsodium/utils.c @@ -1,4 +1,21 @@ -/* This file is in the public domain. */ +/* + * ISC License + * + * Copyright (c) 2013-2018 + * Frank Denis + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ #include __FBSDID("$FreeBSD$"); @@ -12,3 +29,15 @@ sodium_memzero(void *b, size_t n) { explicit_bzero(b, n); } + +int +sodium_is_zero(const unsigned char *n, const size_t nlen) +{ + size_t i; + volatile unsigned char d = 0U; + + for (i = 0U; i < nlen; i++) { + d |= n[i]; + } + return 1 & ((d - 1) >> 8); +} diff --git a/sys/modules/crypto/Makefile b/sys/modules/crypto/Makefile index c25d8f83929e..877bae8d930e 100644 --- a/sys/modules/crypto/Makefile +++ b/sys/modules/crypto/Makefile @@ -15,9 +15,12 @@ LIBSODIUM=${SRCTOP}/sys/contrib/libsodium/src/libsodium .PATH: ${SRCTOP}/sys/contrib/libb2 .PATH: ${LIBSODIUM}/crypto_aead/chacha20poly1305/sodium .PATH: ${LIBSODIUM}/crypto_aead/xchacha20poly1305/sodium +.PATH: ${LIBSODIUM}/crypto_core/ed25519/ref10 .PATH: ${LIBSODIUM}/crypto_core/hchacha20 .PATH: ${LIBSODIUM}/crypto_onetimeauth/poly1305 .PATH: ${LIBSODIUM}/crypto_onetimeauth/poly1305/donna +.PATH: ${LIBSODIUM}/crypto_scalarmult/curve25519 +.PATH: ${LIBSODIUM}/crypto_scalarmult/curve25519/ref10 .PATH: ${LIBSODIUM}/crypto_stream/chacha20 .PATH: ${LIBSODIUM}/crypto_stream/chacha20/ref .PATH: ${LIBSODIUM}/crypto_verify/sodium @@ -70,6 +73,8 @@ SRCS += aead_chacha20poly1305.c CFLAGS.aead_chacha20poly1305.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += aead_xchacha20poly1305.c CFLAGS.aead_xchacha20poly1305.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} +SRCS += ed25519_ref10.c +CFLAGS.ed25519_ref10.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += core_hchacha20.c CFLAGS.core_hchacha20.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += onetimeauth_poly1305.c @@ -80,6 +85,10 @@ SRCS += stream_chacha20.c CFLAGS.stream_chacha20.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += chacha20_ref.c CFLAGS.chacha20_ref.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} +SRCS += scalarmult_curve25519.c +CFLAGS.scalarmult_curve25519.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} +SRCS += x25519_ref10.c +CFLAGS.x25519_ref10.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += verify.c CFLAGS.verify.c += -I${LIBSODIUM_INC}/sodium -I${LIBSODIUM_COMPAT} SRCS += randombytes.c @@ -87,6 +96,9 @@ CFLAGS.randombytes.c += -I${LIBSODIUM_INC} -I${LIBSODIUM_COMPAT} SRCS += utils.c CFLAGS.utils.c += -I${LIBSODIUM_INC} -I${LIBSODIUM_COMPAT} +SRCS += curve25519.c +CFLAGS.curve25519.c += -I${LIBSODIUM_INC} -I${LIBSODIUM_COMPAT} + SRCS += opt_param.h cryptodev_if.h bus_if.h device_if.h SRCS += opt_compat.h SRCS += opt_ddb.h