Crypto++ 8.0 Free C++ class library of cryptographic schemes

xed25519.h
Go to the documentation of this file.
1 // xed25519.h - written and placed in public domain by Jeffrey Walton
2 // Crypto++ specific implementation wrapped around Andrew
3 // Moon's public domain curve25519-donna and ed25519-donna,
4 // http://github.com/floodyberry/curve25519-donna and
5 // http://github.com/floodyberry/ed25519-donna.
6
7 // Typically the key agreement classes encapsulate their data more
8 // than x25519 does below. They are a little more accessible
9 // due to crypto_box operations.
10
11 /// \file xed25519.h
12 /// \brief Classes for x25519 and ed25519 operations
13 /// \details This implementation integrates Andrew Moon's public domain code
14 /// for curve25519-donna and ed25519-donna.
15 /// \details Moving keys into and out of the library proceeds as follows.
16 /// If an Integer class is accepted or returned, then the data is in big
17 /// endian format. That is, the MSB is at byte position 0, and the LSB
18 /// is at byte position 31. The Integer will work as expected, just like
19 /// an int or a long.
20 /// \details If a byte array is accepted, then the byte array is in little
21 /// endian format. That is, the LSB is at byte position 0, and the MSB is
22 /// at byte position 31. This follows the implementation where byte 0 is
23 /// clamed with 248. That is my_arr[0] &= 248 to mask the lower 3 bits.
24 /// \details PKCS8 and X509 keys encoded using ASN.1 follow little endian
25 /// arrays. The format is specified in <A HREF=
26 /// "http:///tools.ietf.org/html/draft-ietf-curdle-pkix">draft-ietf-curdle-pkix</A>.
27 /// \details If you have a little endian array and you want to wrap it in
28 /// an Integer using big endian then you can perform the following:
29 /// <pre>Integer x(my_arr, SECRET_KEYLENGTH, UNSIGNED, LITTLE_ENDIAN_ORDER);</pre>
30 /// \sa Andrew Moon's x22519 GitHub <A
31 /// HREF="http://github.com/floodyberry/curve25519-donna">curve25519-donna</A>,
32 /// ed22519 GitHub <A
33 /// HREF="http://github.com/floodyberry/ed25519-donna">ed25519-donna</A>, and
34 /// <A HREF="http:///tools.ietf.org/html/draft-ietf-curdle-pkix">draft-ietf-curdle-pkix</A>
35 /// \since Crypto++ 8.0
36
37 #ifndef CRYPTOPP_XED25519_H
38 #define CRYPTOPP_XED25519_H
39
40 #include "cryptlib.h"
41 #include "pubkey.h"
42 #include "oids.h"
43
44 NAMESPACE_BEGIN(CryptoPP)
45
46 class Integer;
47 struct ed25519Signer;
48 struct ed25519Verifier;
49
50 // ******************** x25519 Agreement ************************* //
51
52 /// \brief x25519 with key validation
53 /// \since Crypto++ 8.0
54 class x25519 : public SimpleKeyAgreementDomain, public CryptoParameters, public PKCS8PrivateKey
55 {
56 public:
57 /// \brief Size of the private key
58 /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
59 CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32)
60 /// \brief Size of the public key
61 /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
62 CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32)
63 /// \brief Size of the shared key
64 /// \details SHARED_KEYLENGTH is the size of the shared key, in bytes.
65 CRYPTOPP_CONSTANT(SHARED_KEYLENGTH = 32)
66
67 virtual ~x25519() {}
68
69 /// \brief Create a x25519 object
70 /// \param y public key
71 /// \param x private key
72 /// \details This constructor creates a x25519 object using existing parameters.
73 /// \note The public key is not validated.
74 x25519(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
75
76 /// \brief Create a x25519 object
77 /// \param x private key
78 /// \details This constructor creates a x25519 object using existing parameters.
79 /// The public key is calculated from the private key.
80 x25519(const byte x[SECRET_KEYLENGTH]);
81
82 /// \brief Create a x25519 object
83 /// \param y public key
84 /// \param x private key
85 /// \details This constructor creates a x25519 object using existing parameters.
86 /// \note The public key is not validated.
87 x25519(const Integer &y, const Integer &x);
88
89 /// \brief Create a x25519 object
90 /// \param x private key
91 /// \details This constructor creates a x25519 object using existing parameters.
92 /// The public key is calculated from the private key.
93 x25519(const Integer &x);
94
95 /// \brief Create a x25519 object
96 /// \param rng RandomNumberGenerator derived class
97 /// \details This constructor creates a new x25519 using the random number generator.
98 x25519(RandomNumberGenerator &rng);
99
100 /// \brief Create a x25519 object
101 /// \param params public and private key
102 /// \details This constructor creates a x25519 object using existing parameters.
103 /// The <tt>params</tt> can be created with <tt>Save</tt>.
104 /// \note The public key is not validated.
105 x25519(BufferedTransformation &params);
106
107 /// \brief Create a x25519 object
108 /// \param oid an object identifier
109 /// \details This constructor creates a new x25519 using the specified OID. The public
110 /// and private points are uninitialized.
111 x25519(const OID &oid);
112
113 /// \brief Clamp a private key
114 /// \param x private key
115 /// \details ClampKeys() clamps a private key and then regenerates the
116 /// public key from the private key.
117 void ClampKey(byte x[SECRET_KEYLENGTH]) const;
118
119 /// \brief Determine if private key is clamped
120 /// \param x private key
121 bool IsClamped(const byte x[SECRET_KEYLENGTH]) const;
122
123 /// \brief Test if a key has small order
124 /// \param y public key
125 bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
126
127 /// \brief Get the Object Identifier
128 /// \returns the Object Identifier
129 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
130 /// The default private key format is RFC 5208.
131 OID GetAlgorithmID() const {
132 return m_oid.Empty() ? ASN1::X25519() : m_oid;
133 }
134
135 /// \brief Set the Object Identifier
136 /// \param oid the new Object Identifier
137 void SetAlgorithmID(const OID& oid) {
138 m_oid = oid;
139 }
140
141 // CryptoParameters
142 bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
143 bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
144 void AssignFrom(const NameValuePairs &source);
145
146 // CryptoParameters
147 CryptoParameters & AccessCryptoParameters() {return *this;}
148
149 /// \brief DER encode ASN.1 object
150 /// \param bt BufferedTransformation object
151 /// \details Save() will write the OID associated with algorithm or scheme.
152 /// In the case of public and private keys, this function writes the
153 /// subjectPubicKeyInfo parts.
154 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
155 /// The default private key format is RFC 5208, which is the old format.
156 /// The old format provides the best interop, and keys will work
157 /// with OpenSSL.
158 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
159 /// Key Packages</A>
160 void Save(BufferedTransformation &bt) const {
161 DEREncode(bt, 0);
162 }
163
164 /// \brief DER encode ASN.1 object
165 /// \param bt BufferedTransformation object
166 /// \param v1 flag indicating v1
167 /// \details Save() will write the OID associated with algorithm or scheme.
168 /// In the case of public and private keys, this function writes the
169 /// subjectPubicKeyInfo parts.
170 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
171 /// The default private key format is RFC 5208.
172 /// \details v1 means INTEGER 0 is written. INTEGER 0 means
173 /// RFC 5208 format, which is the old format. The old format provides
174 /// the best interop, and keys will work with OpenSSL. The other
175 /// option uses INTEGER 1. INTEGER 1 means RFC 5958 format,
176 /// which is the new format.
177 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
178 /// Key Packages</A>
179 void Save(BufferedTransformation &bt, bool v1) const {
180 DEREncode(bt, v1 ? 0 : 1);
181 }
182
183 /// \brief BER decode ASN.1 object
184 /// \param bt BufferedTransformation object
185 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
186 /// Key Packages</A>
187 void Load(BufferedTransformation &bt) {
188 BERDecode(bt);
189 }
190
191 // PKCS8PrivateKey
192 void BERDecode(BufferedTransformation &bt);
193 void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
194 void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
195 void DEREncodePrivateKey(BufferedTransformation &bt) const;
196
197 /// \brief DER encode ASN.1 object
198 /// \param bt BufferedTransformation object
199 /// \param version indicates version
200 /// \details DEREncode() will write the OID associated with algorithm or
201 /// scheme. In the case of public and private keys, this function writes
202 /// the subjectPubicKeyInfo parts.
203 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
204 /// The default private key format is RFC 5208.
205 /// \details The value of version is written as the INTEGER. INTEGER 0 means
206 /// RFC 5208 format, which is the old format. The old format provides
207 /// the best interop, and keys will work with OpenSSL. The INTEGER 1
208 /// means RFC 5958 format, which is the new format.
209 void DEREncode(BufferedTransformation &bt, int version) const;
210
211 /// \brief Determine if OID is valid for this object
212 /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
213 /// <tt>bt</tt> and determines if it valid for this object. The
214 /// problem in practice is there are multiple OIDs available to
215 /// denote curve25519 operations. The OIDs include an old GNU
216 /// OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
217 /// and OIDs specified in draft-ietf-curdle-pkix.
218 /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
219 /// OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::X25519()</tt>.
220 /// <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
221 /// curve25519 operations". <tt>ASN1::X25519()</tt> is specific and says
222 /// "this key is valid for x25519 key exchange."
223 void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
224
225 // DL_PrivateKey
226 void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
227
228 // SimpleKeyAgreementDomain
229 unsigned int AgreedValueLength() const {return SHARED_KEYLENGTH;}
230 unsigned int PrivateKeyLength() const {return SECRET_KEYLENGTH;}
231 unsigned int PublicKeyLength() const {return PUBLIC_KEYLENGTH;}
232
233 // SimpleKeyAgreementDomain
234 void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const;
235 void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const;
236 bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const;
237
238 protected:
239 // Create a public key from a private key
240 void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
241
242 protected:
243 FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
244 FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
245 OID m_oid; // preferred OID
246 };
247
248 // ****************** ed25519 Signer *********************** //
249
250 /// \brief ed25519 message accumulator
251 /// \details ed25519 buffers the entire message, and does not
252 /// digest the message incrementally. You should be careful with
253 /// large messages like files on-disk. The behavior is by design
254 /// because Bernstein feels small messages should be authenticated;
255 /// and larger messages will be digested by the application.
256 /// \details The accumulator is used for signing and verification.
257 /// The first 64-bytes of storage is reserved for the signature.
258 /// During signing the signature storage is unused. During
259 /// verification the first 64 bytes holds the signature. The
260 /// signature is provided by the PK_Verifier framework and the
261 /// call to PK_Signer::InputSignature. Member functions data()
262 /// and size() refer to the accumulated message. Member function
263 /// signature() refers to the signature with an implicit size of
264 /// SIGNATURE_LENGTH bytes.
265 /// \details Applications which digest large messages, like an ISO
266 /// disk file, should take care because the design effectively
267 /// disgorges the format operation from the signing operation.
268 /// Put another way, be careful to ensure what you are signing is
269 /// is in fact a digest of the intended message, and not a different
270 /// message digest supplied by an attacker.
271 struct ed25519_MessageAccumulator : public PK_MessageAccumulator
272 {
273 CRYPTOPP_CONSTANT(RESERVE_SIZE=2048+64)
274 CRYPTOPP_CONSTANT(SIGNATURE_LENGTH=64)
275
276 /// \brief Create a message accumulator
277 ed25519_MessageAccumulator() {
278 Restart();
279 }
280
281 /// \brief Create a message accumulator
282 /// \details ed25519 does not use a RNG. You can safely use
283 /// NullRNG() because IsProbablistic returns false.
284 ed25519_MessageAccumulator(RandomNumberGenerator &rng) {
285 CRYPTOPP_UNUSED(rng); Restart();
286 }
287
288 /// \brief Add data to the accumulator
289 /// \param msg pointer to the data to accumulate
290 /// \param len the size of the data, in bytes
291 void Update(const byte* msg, size_t len) {
292 if (msg && len)
293 m_msg.insert(m_msg.end(), msg, msg+len);
294 }
295
296 /// \brief Reset the accumulator
297 void Restart() {
298 m_msg.reserve(RESERVE_SIZE);
299 m_msg.resize(SIGNATURE_LENGTH);
300 }
301
302 /// \brief Retrieve pointer to signature buffer
303 /// \returns pointer to signature buffer
304 byte* signature() {
305 return &m_msg[0];
306 }
307
308 /// \brief Retrieve pointer to signature buffer
309 /// \returns pointer to signature buffer
310 const byte* signature() const {
311 return &m_msg[0];
312 }
313
314 /// \brief Retrieve pointer to data buffer
315 /// \returns pointer to data buffer
316 const byte* data() const {
317 return &m_msg[0]+SIGNATURE_LENGTH;
318 }
319
320 /// \brief Retrieve size of data buffer
321 /// \returns size of the data buffer, in bytes
322 size_t size() const {
323 return m_msg.size()-SIGNATURE_LENGTH;
324 }
325
326 protected:
327 // TODO: Find an equivalent Crypto++ structure.
328 std::vector<byte, AllocatorWithCleanup<byte> > m_msg;
329 };
330
331 /// \brief Ed25519 private key
332 /// \details ed25519PrivateKey is somewhat of a hack. It needed to
333 /// provide DL_PrivateKey interface to fit into the existing
334 /// framework, but it lacks a lot of the internals of a true
335 /// DL_PrivateKey. The missing pieces include GroupParameters
336 /// and Point, which provide the low level field operations
337 /// found in traditional implementations like NIST curves over
338 /// prime and binary fields.
339 /// \details ed25519PrivateKey is also unusual because the
340 /// class members of interest are byte arrays and not Integers.
341 /// In addition, the byte arrays are little-endian meaning
342 /// LSB is at element 0 and the MSB is at element 31.
343 /// If you call GetPrivateExponent() then the little-endian byte
344 /// array is converted to a big-endian Integer() so it can be
345 /// returned the way a caller expects. And calling
346 /// SetPrivateExponent perfoms a similar internal conversion.
347 /// \since Crypto++ 8.0
348 struct ed25519PrivateKey : public PKCS8PrivateKey
349 {
350 /// \brief Size of the private key
351 /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
352 CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32)
353 /// \brief Size of the public key
354 /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
355 CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32)
356 /// \brief Size of the siganture
357 /// \details SIGNATURE_LENGTH is the size of the signature, in bytes.
358 /// ed25519 is a DL-based signature scheme. The signature is the
359 /// concatenation of <tt>r || s</tt>.
360 CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64)
361
362 // CryptoMaterial
363 bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
364 bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
365 void AssignFrom(const NameValuePairs &source);
366
367 // GroupParameters
368 OID GetAlgorithmID() const {
369 return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
370 }
371
372 /// \brief DER encode ASN.1 object
373 /// \param bt BufferedTransformation object
374 /// \details Save() will write the OID associated with algorithm or scheme.
375 /// In the case of public and private keys, this function writes the
376 /// subjectPubicKeyInfo parts.
377 /// \details The default OID is from RFC 8410 using <tt>id-Ed25519</tt>.
378 /// The default private key format is RFC 5208, which is the old format.
379 /// The old format provides the best interop, and keys will work
380 /// with OpenSSL.
381 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
382 /// Key Packages</A>
383 void Save(BufferedTransformation &bt) const {
384 DEREncode(bt, 0);
385 }
386
387 /// \brief DER encode ASN.1 object
388 /// \param bt BufferedTransformation object
389 /// \param v1 flag indicating v1
390 /// \details Save() will write the OID associated with algorithm or scheme.
391 /// In the case of public and private keys, this function writes the
392 /// subjectPubicKeyInfo parts.
393 /// \details The default OID is from RFC 8410 using <tt>id-Ed25519</tt>.
394 /// The default private key format is RFC 5208.
395 /// \details v1 means INTEGER 0 is written. INTEGER 0 means
396 /// RFC 5208 format, which is the old format. The old format provides
397 /// the best interop, and keys will work with OpenSSL. The other
398 /// option uses INTEGER 1. INTEGER 1 means RFC 5958 format,
399 /// which is the new format.
400 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
401 /// Key Packages</A>
402 void Save(BufferedTransformation &bt, bool v1) const {
403 DEREncode(bt, v1 ? 0 : 1);
404 }
405
406 /// \brief BER decode ASN.1 object
407 /// \param bt BufferedTransformation object
408 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
409 /// Key Packages</A>
410 void Load(BufferedTransformation &bt) {
411 BERDecode(bt);
412 }
413
414 /// \brief Initializes a public key from this key
415 /// \param pub reference to a public key
416 void MakePublicKey(PublicKey &pub) const;
417
418 // PKCS8PrivateKey
419 void BERDecode(BufferedTransformation &bt);
420 void DEREncode(BufferedTransformation &bt) const { DEREncode(bt, 0); }
421 void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
422 void DEREncodePrivateKey(BufferedTransformation &bt) const;
423
424 /// \brief DER encode ASN.1 object
425 /// \param bt BufferedTransformation object
426 /// \param version indicates version
427 /// \details DEREncode() will write the OID associated with algorithm or
428 /// scheme. In the case of public and private keys, this function writes
429 /// the subjectPubicKeyInfo parts.
430 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
431 /// The default private key format is RFC 5208.
432 /// \details The value of version is written as the INTEGER. INTEGER 0 means
433 /// RFC 5208 format, which is the old format. The old format provides
434 /// the best interop, and keys will work with OpenSSL. The INTEGER 1
435 /// means RFC 5958 format, which is the new format.
436 void DEREncode(BufferedTransformation &bt, int version) const;
437
438 /// \brief Determine if OID is valid for this object
439 /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
440 /// <tt>bt</tt> and determines if it valid for this object. The
441 /// problem in practice is there are multiple OIDs available to
442 /// denote curve25519 operations. The OIDs include an old GNU
443 /// OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
444 /// and OIDs specified in draft-ietf-curdle-pkix.
445 /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
446 /// OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::Ed25519()</tt>.
447 /// <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
448 /// curve25519 operations". <tt>ASN1::Ed25519()</tt> is specific and says
449 /// "this key is valid for ed25519 signing."
450 void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
451
452 // PKCS8PrivateKey
453 void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params);
454 void SetPrivateExponent(const byte x[SECRET_KEYLENGTH]);
455 void SetPrivateExponent(const Integer &x);
456 const Integer& GetPrivateExponent() const;
457
458 /// \brief Test if a key has small order
459 /// \param y public key
460 bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const;
461
462 /// \brief Retrieve private key byte array
463 /// \returns the private key byte array
464 /// \details GetPrivateKeyBytePtr() is used by signing code to call ed25519_sign.
465 const byte* GetPrivateKeyBytePtr() const {
466 return m_sk.begin();
467 }
468
469 /// \brief Retrieve public key byte array
470 /// \returns the public key byte array
471 /// \details GetPublicKeyBytePtr() is used by signing code to call ed25519_sign.
472 const byte* GetPublicKeyBytePtr() const {
473 return m_pk.begin();
474 }
475
476 protected:
477 // Create a public key from a private key
478 void SecretToPublicKey(byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]) const;
479
480 protected:
481 FixedSizeSecBlock<byte, SECRET_KEYLENGTH> m_sk;
482 FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
483 OID m_oid; // preferred OID
484 mutable Integer m_x; // for DL_PrivateKey
485 };
486
487 /// \brief Ed25519 signature algorithm
488 /// \since Crypto++ 8.0
489 struct ed25519Signer : public PK_Signer
490 {
491 /// \brief Size of the private key
492 /// \details SECRET_KEYLENGTH is the size of the private key, in bytes.
493 CRYPTOPP_CONSTANT(SECRET_KEYLENGTH = 32)
494 /// \brief Size of the public key
495 /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
496 CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32)
497 /// \brief Size of the siganture
498 /// \details SIGNATURE_LENGTH is the size of the signature, in bytes.
499 /// ed25519 is a DL-based signature scheme. The signature is the
500 /// concatenation of <tt>r || s</tt>.
501 CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64)
502 typedef Integer Element;
503
504 virtual ~ed25519Signer() {}
505
506 /// \brief Create a ed25519Signer object
507 ed25519Signer() {}
508
509 /// \brief Create a ed25519Signer object
510 /// \param y public key
511 /// \param x private key
512 /// \details This constructor creates a ed25519Signer object using existing parameters.
513 /// \note The public key is not validated.
514 ed25519Signer(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH]);
515
516 /// \brief Create a ed25519Signer object
517 /// \param x private key
518 /// \details This constructor creates a ed25519Signer object using existing parameters.
519 /// The public key is calculated from the private key.
520 ed25519Signer(const byte x[SECRET_KEYLENGTH]);
521
522 /// \brief Create a ed25519Signer object
523 /// \param y public key
524 /// \param x private key
525 /// \details This constructor creates a ed25519Signer object using existing parameters.
526 /// \note The public key is not validated.
527 ed25519Signer(const Integer &y, const Integer &x);
528
529 /// \brief Create a ed25519Signer object
530 /// \param x private key
531 /// \details This constructor creates a ed25519Signer object using existing parameters.
532 /// The public key is calculated from the private key.
533 ed25519Signer(const Integer &x);
534
535 /// \brief Create a ed25519Signer object
536 /// \param rng RandomNumberGenerator derived class
537 /// \details This constructor creates a new ed25519Signer using the random number generator.
538 ed25519Signer(RandomNumberGenerator &rng);
539
540 /// \brief Create a ed25519Signer object
541 /// \param params public and private key
542 /// \details This constructor creates a ed25519Signer object using existing parameters.
543 /// The <tt>params</tt> can be created with <tt>Save</tt>.
544 /// \note The public key is not validated.
545 ed25519Signer(BufferedTransformation &params);
546
547 // DL_ObjectImplBase
548 /// \brief Retrieves a reference to a Private Key
549 /// \details AccessKey() retrieves a non-const reference to a private key.
550 PrivateKey& AccessKey() { return m_key; }
551 PrivateKey& AccessPrivateKey() { return m_key; }
552
553 /// \brief Retrieves a reference to a Private Key
554 /// \details AccessKey() retrieves a const reference to a private key.
555 const PrivateKey& GetKey() const { return m_key; }
556 const PrivateKey& GetPrivateKey() const { return m_key; }
557
558 // DL_SignatureSchemeBase
559 size_t SignatureLength() const { return SIGNATURE_LENGTH; }
560 size_t MaxRecoverableLength() const { return 0; }
561 size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
562 CRYPTOPP_UNUSED(signatureLength); return 0;
563 }
564
565 bool IsProbabilistic() const { return false; }
566 bool AllowNonrecoverablePart() const { return false; }
567 bool RecoverablePartFirst() const { return false; }
568
569 PK_MessageAccumulator* NewSignatureAccumulator(RandomNumberGenerator &rng) const {
570 return new ed25519_MessageAccumulator(rng);
571 }
572
573 void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const {
574 CRYPTOPP_UNUSED(messageAccumulator); CRYPTOPP_UNUSED(recoverableMessage);
575 CRYPTOPP_UNUSED(recoverableMessageLength);
576 throw NotImplemented("ed25519Signer: this object does not support recoverable messages");
577 }
578
579 size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const;
580
581 /// \brief Sign a stream
582 /// \param rng a RandomNumberGenerator derived class
583 /// \param stream an std::istream derived class
584 /// \param signature a block of bytes for the signature
585 /// \return actual signature length
586 /// \details SignStream() handles large streams. The Stream functions were added to
587 /// ed25519 for signing and verifying files that are too large for a memory allocation.
588 /// The functions are not present in other library signers and verifiers.
589 /// \details ed25519 is a determinsitic signature scheme. <tt>IsProbabilistic()</tt>
590 /// returns false and the random number generator can be <tt>NullRNG()</tt>.
591 /// \pre <tt>COUNTOF(signature) == MaxSignatureLength()</tt>
592 /// \since Crypto++ 8.1
593 size_t SignStream (RandomNumberGenerator &rng, std::istream& stream, byte *signature) const;
594
595 protected:
596 ed25519PrivateKey m_key;
597 };
598
599 // ****************** ed25519 Verifier *********************** //
600
601 /// \brief Ed25519 public key
602 /// \details ed25519PublicKey is somewhat of a hack. It needed to
603 /// provide DL_PublicKey interface to fit into the existing
604 /// framework, but it lacks a lot of the internals of a true
605 /// DL_PublicKey. The missing pieces include GroupParameters
606 /// and Point, which provide the low level field operations
607 /// found in traditional implementations like NIST curves over
608 /// prime and binary fields.
609 /// \details ed25519PublicKey is also unusual because the
610 /// class members of interest are byte arrays and not Integers.
611 /// In addition, the byte arrays are little-endian meaning
612 /// LSB is at element 0 and the MSB is at element 31.
613 /// If you call GetPublicElement() then the little-endian byte
614 /// array is converted to a big-endian Integer() so it can be
615 /// returned the way a caller expects. And calling
616 /// SetPublicElement() perfoms a similar internal conversion.
617 /// \since Crypto++ 8.0
618 struct ed25519PublicKey : public X509PublicKey
619 {
620 /// \brief Size of the public key
621 /// \details PUBLIC_KEYLENGTH is the size of the public key, in bytes.
622 CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32)
623 typedef Integer Element;
624
625 OID GetAlgorithmID() const {
626 return m_oid.Empty() ? ASN1::Ed25519() : m_oid;
627 }
628
629 /// \brief DER encode ASN.1 object
630 /// \param bt BufferedTransformation object
631 /// \details Save() will write the OID associated with algorithm or scheme.
632 /// In the case of public and private keys, this function writes the
633 /// subjectPubicKeyInfo parts.
634 /// \details The default OID is from RFC 8410 using <tt>id-X25519</tt>.
635 /// The default private key format is RFC 5208, which is the old format.
636 /// The old format provides the best interop, and keys will work
637 /// with OpenSSL.
638 void Save(BufferedTransformation &bt) const {
639 BEREncode(bt);
640 }
641
642 /// \brief BER decode ASN.1 object
643 /// \param bt BufferedTransformation object
644 /// \sa <A HREF="http://tools.ietf.org/rfc/rfc5958.txt">RFC 5958, Asymmetric
645 /// Key Packages</A>
646 void Load(BufferedTransformation &bt) {
647 BERDecode(bt);
648 }
649
650 // X509PublicKey
651 void BERDecode(BufferedTransformation &bt);
652 void DEREncode(BufferedTransformation &bt) const;
653 void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size);
654 void DEREncodePublicKey(BufferedTransformation &bt) const;
655
656 /// \brief Determine if OID is valid for this object
657 /// \details BERDecodeAndCheckAlgorithmID() parses the OID from
658 /// <tt>bt</tt> and determines if it valid for this object. The
659 /// problem in practice is there are multiple OIDs available to
660 /// denote curve25519 operations. The OIDs include an old GNU
661 /// OID used by SSH, OIDs specified in draft-josefsson-pkix-newcurves,
662 /// and OIDs specified in draft-ietf-curdle-pkix.
663 /// \details By default BERDecodeAndCheckAlgorithmID() accepts an
664 /// OID set by the user, <tt>ASN1::curve25519()</tt> and <tt>ASN1::Ed25519()</tt>.
665 /// <tt>ASN1::curve25519()</tt> is generic and says "this key is valid for
666 /// curve25519 operations". <tt>ASN1::Ed25519()</tt> is specific and says
667 /// "this key is valid for ed25519 signing."
668 void BERDecodeAndCheckAlgorithmID(BufferedTransformation& bt);
669
670 bool Validate(RandomNumberGenerator &rng, unsigned int level) const;
671 bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const;
672 void AssignFrom(const NameValuePairs &source);
673
674 // DL_PublicKey
675 void SetPublicElement(const byte y[PUBLIC_KEYLENGTH]);
676 void SetPublicElement(const Element &y);
677 const Element& GetPublicElement() const;
678
679 /// \brief Retrieve public key byte array
680 /// \returns the public key byte array
681 /// \details GetPublicKeyBytePtr() is used by signing code to call ed25519_sign.
682 const byte* GetPublicKeyBytePtr() const {
683 return m_pk.begin();
684 }
685
686 protected:
687 FixedSizeSecBlock<byte, PUBLIC_KEYLENGTH> m_pk;
688 OID m_oid; // preferred OID
689 mutable Integer m_y; // for DL_PublicKey
690 };
691
692 /// \brief Ed25519 signature verification algorithm
693 /// \since Crypto++ 8.0
694 struct ed25519Verifier : public PK_Verifier
695 {
696 CRYPTOPP_CONSTANT(PUBLIC_KEYLENGTH = 32)
697 CRYPTOPP_CONSTANT(SIGNATURE_LENGTH = 64)
698 typedef Integer Element;
699
700 virtual ~ed25519Verifier() {}
701
702 /// \brief Create a ed25519Verifier object
703 ed25519Verifier() {}
704
705 /// \brief Create a ed25519Verifier object
706 /// \param y public key
707 /// \details This constructor creates a ed25519Verifier object using existing parameters.
708 /// \note The public key is not validated.
709 ed25519Verifier(const byte y[PUBLIC_KEYLENGTH]);
710
711 /// \brief Create a ed25519Verifier object
712 /// \param y public key
713 /// \details This constructor creates a ed25519Verifier object using existing parameters.
714 /// \note The public key is not validated.
715 ed25519Verifier(const Integer &y);
716
717 /// \brief Create a ed25519Verifier object
718 /// \param params public and private key
719 /// \details This constructor creates a ed25519Verifier object using existing parameters.
720 /// The <tt>params</tt> can be created with <tt>Save</tt>.
721 /// \note The public key is not validated.
722 ed25519Verifier(BufferedTransformation &params);
723
724 /// \brief Create a ed25519Verifier object
725 /// \param signer ed25519 signer object
726 /// \details This constructor creates a ed25519Verifier object using existing parameters.
727 /// The <tt>params</tt> can be created with <tt>Save</tt>.
728 /// \note The public key is not validated.
729 ed25519Verifier(const ed25519Signer& signer);
730
731 // DL_ObjectImplBase
732 /// \brief Retrieves a reference to a Public Key
733 /// \details AccessKey() retrieves a non-const reference to a public key.
734 PublicKey& AccessKey() { return m_key; }
735 PublicKey& AccessPublicKey() { return m_key; }
736
737 /// \brief Retrieves a reference to a Public Key
738 /// \details GetKey() retrieves a const reference to a public key.
739 const PublicKey& GetKey() const { return m_key; }
740 const PublicKey& GetPublicKey() const { return m_key; }
741
742 // DL_SignatureSchemeBase
743 size_t SignatureLength() const { return SIGNATURE_LENGTH; }
744 size_t MaxRecoverableLength() const { return 0; }
745 size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const {
746 CRYPTOPP_UNUSED(signatureLength); return 0;
747 }
748
749 bool IsProbabilistic() const { return false; }
750 bool AllowNonrecoverablePart() const { return false; }
751 bool RecoverablePartFirst() const { return false; }
752
753 ed25519_MessageAccumulator* NewVerificationAccumulator() const {
754 return new ed25519_MessageAccumulator;
755 }
756
757 void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const {
758 CRYPTOPP_ASSERT(signature != NULLPTR);
759 CRYPTOPP_ASSERT(signatureLength == SIGNATURE_LENGTH);
760 ed25519_MessageAccumulator& accum = static_cast<ed25519_MessageAccumulator&>(messageAccumulator);
761 if (signature && signatureLength)
762 std::memcpy(accum.signature(), signature, STDMIN((size_t)SIGNATURE_LENGTH, signatureLength));
763 }
764
765 bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const;
766
767 /// \brief Check whether input signature is a valid signature for input message
768 /// \param stream an std::istream derived class
769 /// \param signature a pointer to the signature over the message
770 /// \param signatureLen the size of the signature
771 /// \return true if the signature is valid, false otherwise
772 /// \details VerifyStream() handles large streams. The Stream functions were added to
773 /// ed25519 for signing and verifying files that are too large for a memory allocation.
774 /// The functions are not present in other library signers and verifiers.
775 /// \since Crypto++ 8.1
776 bool VerifyStream(std::istream& stream, const byte *signature, size_t signatureLen) const;
777
778 DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const {
779 CRYPTOPP_UNUSED(recoveredMessage); CRYPTOPP_UNUSED(messageAccumulator);
780 throw NotImplemented("ed25519Verifier: this object does not support recoverable messages");
781 }
782
783 protected:
784 ed25519PublicKey m_key;
785 };
786
787 /// \brief Ed25519 signature scheme
788 /// \sa <A HREF="http://cryptopp.com/wiki/Ed25519">Ed25519</A> on the Crypto++ wiki.
789 /// \since Crypto++ 8.0
790 struct ed25519
791 {
792 /// \brief ed25519 Signer
793 typedef ed25519Signer Signer;
794 /// \brief ed25519 Verifier
795 typedef ed25519Verifier Verifier;
796 };
797
798 NAMESPACE_END // CryptoPP
799
800 #endif // CRYPTOPP_XED25519_H
x25519
x25519 with key validation
Definition: xed25519.h:54
ed25519Signer::SECRET_KEYLENGTH
static const int SECRET_KEYLENGTH
Size of the private key.
Definition: xed25519.h:493
ed25519PrivateKey::Save
void Save(BufferedTransformation &bt) const
DER encode ASN.1 object.
Definition: xed25519.h:383
x25519::SHARED_KEYLENGTH
static const int SHARED_KEYLENGTH
Size of the shared key.
Definition: xed25519.h:65
x25519::PublicKeyLength
unsigned int PublicKeyLength() const
Provides the size of the public key.
Definition: xed25519.h:231
ed25519PrivateKey
Ed25519 private key.
Definition: xed25519.h:348
ed25519PrivateKey::Save
void Save(BufferedTransformation &bt, bool v1) const
DER encode ASN.1 object.
Definition: xed25519.h:402
ed25519PublicKey::Load
void Load(BufferedTransformation &bt)
BER decode ASN.1 object.
Definition: xed25519.h:646
x25519::GenerateRandom
void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params)
Generate a random key or crypto parameters.
Definition: xed25519.cpp:340
ed25519Verifier::IsProbabilistic
bool IsProbabilistic() const
Determines whether a signature scheme requires a random number generator.
Definition: xed25519.h:749
x25519::DEREncode
void DEREncode(BufferedTransformation &bt) const
Encode this object into a BufferedTransformation.
Definition: xed25519.h:193
ed25519Verifier::VerifyAndRestart
bool VerifyAndRestart(PK_MessageAccumulator &messageAccumulator) const
Check whether messageAccumulator contains a valid signature and message, and restart messageAccumulat...
Definition: xed25519.cpp:860
ed25519Verifier::RecoverAndRestart
DecodingResult RecoverAndRestart(byte *recoveredMessage, PK_MessageAccumulator &messageAccumulator) const
Recover a message from its signature.
Definition: xed25519.h:778
pubkey.h
This file contains helper classes/functions for implementing public key algorithms.
ed25519PublicKey::Validate
bool Validate(RandomNumberGenerator &rng, unsigned int level) const
Check this object for errors.
Definition: xed25519.cpp:824
ed25519Signer::MaxRecoverableLength
size_t MaxRecoverableLength() const
Provides the length of longest message that can be recovered.
Definition: xed25519.h:560
ed25519PublicKey::GetPublicKeyBytePtr
const byte * GetPublicKeyBytePtr() const
Retrieve public key byte array.
Definition: xed25519.h:682
ed25519PrivateKey::SIGNATURE_LENGTH
static const int SIGNATURE_LENGTH
Size of the siganture.
Definition: xed25519.h:360
PKCS8PrivateKey
Encodes and Decodes privateKeyInfo.
Definition: asn.h:421
ed25519Verifier
Ed25519 signature verification algorithm.
Definition: xed25519.h:694
ed25519Verifier::AccessKey
PublicKey & AccessKey()
Retrieves a reference to a Public Key.
Definition: xed25519.h:734
PK_Signer
Interface for public-key signers.
Definition: cryptlib.h:2761
ed25519PublicKey::BERDecodePublicKey
void BERDecodePublicKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
decode subjectPublicKey part of subjectPublicKeyInfo, without the BIT STRING header ...
Definition: xed25519.cpp:780
cryptlib.h
Abstract base classes that provide a uniform interface to this library.
ed25519_MessageAccumulator::Update
void Update(const byte *msg, size_t len)
Add data to the accumulator.
Definition: xed25519.h:291
ed25519Signer::AllowNonrecoverablePart
bool AllowNonrecoverablePart() const
Determines whether the non-recoverable message part can be signed.
Definition: xed25519.h:566
oids.h
ASN.1 object identifiers for algorthms and schemes.
ed25519Signer::IsProbabilistic
bool IsProbabilistic() const
Determines whether a signature scheme requires a random number generator.
Definition: xed25519.h:565
ed25519Verifier::AllowNonrecoverablePart
bool AllowNonrecoverablePart() const
Determines whether the non-recoverable message part can be signed.
Definition: xed25519.h:750
ed25519Verifier::InputSignature
void InputSignature(PK_MessageAccumulator &messageAccumulator, const byte *signature, size_t signatureLength) const
Input signature into a message accumulator.
Definition: xed25519.h:757
ed25519_MessageAccumulator::Restart
void Restart()
Reset the accumulator.
Definition: xed25519.h:297
ed25519_MessageAccumulator::size
size_t size() const
Retrieve size of data buffer.
Definition: xed25519.h:322
x25519::GeneratePublicKey
void GeneratePublicKey(RandomNumberGenerator &rng, const byte *privateKey, byte *publicKey) const
Generate a public key from a private key in this domain.
Definition: xed25519.cpp:357
ed25519Signer::AccessKey
PrivateKey & AccessKey()
Retrieves a reference to a Private Key.
Definition: xed25519.h:550
std
STL namespace.
RandomNumberGenerator
Interface for random number generators.
Definition: cryptlib.h:1383
ed25519PrivateKey::MakePublicKey
void MakePublicKey(PublicKey &pub) const
Initializes a public key from this key.
Definition: xed25519.cpp:474
ed25519Verifier::ed25519Verifier
ed25519Verifier()
Create a ed25519Verifier object.
Definition: xed25519.h:703
x25519::SECRET_KEYLENGTH
static const int SECRET_KEYLENGTH
Size of the private key.
Definition: xed25519.h:59
ed25519::Signer
ed25519Signer Signer
ed25519 Signer
Definition: xed25519.h:793
ed25519PublicKey::DEREncodePublicKey
void DEREncodePublicKey(BufferedTransformation &bt) const
encode subjectPublicKey part of subjectPublicKeyInfo, without the BIT STRING header ...
Definition: xed25519.cpp:798
BufferedTransformation
Interface for buffered transformations.
Definition: cryptlib.h:1598
PrivateKey
Interface for private keys.
Definition: cryptlib.h:2430
ed25519PublicKey::GetAlgorithmID
OID GetAlgorithmID() const
Retrieves the OID of the algorithm.
Definition: xed25519.h:625
ed25519PublicKey::DEREncode
void DEREncode(BufferedTransformation &bt) const
Encode this object into a BufferedTransformation.
Definition: xed25519.cpp:767
ed25519PrivateKey::GetVoidValue
bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
Get a named value.
Definition: xed25519.cpp:407
ed25519Signer::MaxRecoverableLengthFromSignatureLength
size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const
Provides the length of longest message that can be recovered from a signature of given length...
Definition: xed25519.h:561
ed25519Verifier::AccessPublicKey
PublicKey & AccessPublicKey()
Retrieves a reference to a Public Key.
Definition: xed25519.h:735
ed25519Verifier::GetPublicKey
const PublicKey & GetPublicKey() const
Retrieves a reference to a Public Key.
Definition: xed25519.h:740
ed25519Signer::SignStream
size_t SignStream(RandomNumberGenerator &rng, std::istream &stream, byte *signature) const
Sign a stream.
Definition: xed25519.cpp:688
ed25519PrivateKey::PUBLIC_KEYLENGTH
static const int PUBLIC_KEYLENGTH
Size of the public key.
Definition: xed25519.h:355
SimpleKeyAgreementDomain
Interface for domains of simple key agreement protocols.
Definition: cryptlib.h:2897
ed25519_MessageAccumulator::signature
const byte * signature() const
Retrieve pointer to signature buffer.
Definition: xed25519.h:310
DecodingResult
Returns a decoding results.
Definition: cryptlib.h:255
x25519::ClampKey
void ClampKey(byte x[SECRET_KEYLENGTH]) const
Clamp a private key.
Definition: xed25519.cpp:128
ed25519PrivateKey::BERDecode
void BERDecode(BufferedTransformation &bt)
Decode this object from a BufferedTransformation.
Definition: xed25519.cpp:496
x25519::GeneratePrivateKey
void GeneratePrivateKey(RandomNumberGenerator &rng, byte *privateKey) const
Generate private key in this domain.
Definition: xed25519.cpp:351
ed25519_MessageAccumulator::data
const byte * data() const
Retrieve pointer to data buffer.
Definition: xed25519.h:316
NotImplemented
A method was called which was not implemented.
Definition: cryptlib.h:223
ed25519PublicKey::BERDecode
void BERDecode(BufferedTransformation &bt)
Decode this object from a BufferedTransformation.
Definition: xed25519.cpp:753
x25519::SetAlgorithmID
void SetAlgorithmID(const OID &oid)
Set the Object Identifier.
Definition: xed25519.h:137
ed25519PrivateKey::Validate
bool Validate(RandomNumberGenerator &rng, unsigned int level) const
Check this object for errors.
Definition: xed25519.cpp:387
ed25519Signer::PUBLIC_KEYLENGTH
static const int PUBLIC_KEYLENGTH
Size of the public key.
Definition: xed25519.h:496
ed25519Verifier::RecoverablePartFirst
bool RecoverablePartFirst() const
Determines whether the recoverable part must be input before the non-recoverable part.
Definition: xed25519.h:751
x25519::GetVoidValue
bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
Get a named value.
Definition: xed25519.cpp:287
x25519::PUBLIC_KEYLENGTH
static const int PUBLIC_KEYLENGTH
Size of the public key.
Definition: xed25519.h:62
x25519::PrivateKeyLength
unsigned int PrivateKeyLength() const
Provides the size of the private key.
Definition: xed25519.h:230
ed25519Verifier::GetKey
const PublicKey & GetKey() const
Retrieves a reference to a Public Key.
Definition: xed25519.h:739
Integer
Multiple precision integer with arithmetic operations.
Definition: integer.h:49
ed25519Verifier::SignatureLength
size_t SignatureLength() const
Provides the signature length if it only depends on the key.
Definition: xed25519.h:743
ed25519Signer::GetPrivateKey
const PrivateKey & GetPrivateKey() const
Retrieves a reference to a Private Key.
Definition: xed25519.h:556
ed25519PrivateKey::DEREncode
void DEREncode(BufferedTransformation &bt) const
Encode this object into a BufferedTransformation.
Definition: xed25519.h:420
ed25519Signer::InputRecoverableMessage
void InputRecoverableMessage(PK_MessageAccumulator &messageAccumulator, const byte *recoverableMessage, size_t recoverableMessageLength) const
Input a recoverable message to an accumulator.
Definition: xed25519.h:573
ed25519Signer::RecoverablePartFirst
bool RecoverablePartFirst() const
Determines whether the recoverable part must be input before the non-recoverable part.
Definition: xed25519.h:567
FixedSizeSecBlock< byte, SECRET_KEYLENGTH >
x25519::BERDecode
void BERDecode(BufferedTransformation &bt)
Decode this object from a BufferedTransformation.
Definition: xed25519.cpp:163
ed25519PrivateKey::AssignFrom
void AssignFrom(const NameValuePairs &source)
Assign values to this object.
Definition: xed25519.cpp:436
ed25519Signer::NewSignatureAccumulator
PK_MessageAccumulator * NewSignatureAccumulator(RandomNumberGenerator &rng) const
Create a new HashTransformation to accumulate the message to be signed.
Definition: xed25519.h:569
x25519::BERDecodePrivateKey
void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
decode privateKey part of privateKeyInfo, without the OCTET STRING header
Definition: xed25519.cpp:235
STDMIN
const T & STDMIN(const T &a, const T &b)
Replacement function for std::min.
Definition: misc.h:535
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:69
x25519::Save
void Save(BufferedTransformation &bt, bool v1) const
DER encode ASN.1 object.
Definition: xed25519.h:179
ed25519PrivateKey::SECRET_KEYLENGTH
static const int SECRET_KEYLENGTH
Size of the private key.
Definition: xed25519.h:352
ed25519_MessageAccumulator
ed25519 message accumulator
Definition: xed25519.h:271
SecBlock::begin
iterator begin()
Provides an iterator pointing to the first element in the memory block.
Definition: secblock.h:772
x25519::Validate
bool Validate(RandomNumberGenerator &rng, unsigned int level) const
Check this object for errors.
Definition: xed25519.cpp:264
ed25519Signer
Ed25519 signature algorithm.
Definition: xed25519.h:489
PK_MessageAccumulator
Interface for accumulating messages to be signed or verified.
Definition: cryptlib.h:2745
ed25519_MessageAccumulator::ed25519_MessageAccumulator
ed25519_MessageAccumulator(RandomNumberGenerator &rng)
Create a message accumulator.
Definition: xed25519.h:284
ed25519Signer::SignAndRestart
size_t SignAndRestart(RandomNumberGenerator &rng, PK_MessageAccumulator &messageAccumulator, byte *signature, bool restart) const
Sign and restart messageAccumulator.
Definition: xed25519.cpp:673
ed25519::Verifier
ed25519Verifier Verifier
ed25519 Verifier
Definition: xed25519.h:795
x25519::IsClamped
bool IsClamped(const byte x[SECRET_KEYLENGTH]) const
Determine if private key is clamped.
Definition: xed25519.cpp:133
ed25519Signer::GetKey
const PrivateKey & GetKey() const
Retrieves a reference to a Private Key.
Definition: xed25519.h:555
x25519::Save
void Save(BufferedTransformation &bt) const
DER encode ASN.1 object.
Definition: xed25519.h:160
x25519::IsSmallOrder
bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const
Test if a key has small order.
Definition: xed25519.cpp:138
PK_Verifier
Interface for public-key signature verifiers.
Definition: cryptlib.h:2825
x25519::AccessCryptoParameters
CryptoParameters & AccessCryptoParameters()
Retrieves a reference to Crypto Parameters.
Definition: xed25519.h:147
x25519::x25519
x25519(const byte y[PUBLIC_KEYLENGTH], const byte x[SECRET_KEYLENGTH])
Create a x25519 object.
Definition: xed25519.cpp:74
x25519::GetAlgorithmID
OID GetAlgorithmID() const
Get the Object Identifier.
Definition: xed25519.h:131
ed25519PrivateKey::Load
void Load(BufferedTransformation &bt)
BER decode ASN.1 object.
Definition: xed25519.h:410
ed25519Verifier::MaxRecoverableLength
size_t MaxRecoverableLength() const
Provides the length of longest message that can be recovered.
Definition: xed25519.h:744
ed25519PublicKey::Save
void Save(BufferedTransformation &bt) const
DER encode ASN.1 object.
Definition: xed25519.h:638
ed25519Signer::AccessPrivateKey
PrivateKey & AccessPrivateKey()
Retrieves a reference to a Private Key.
Definition: xed25519.h:551
CryptoParameters
Interface for crypto prameters.
Definition: cryptlib.h:2435
ed25519Verifier::MaxRecoverableLengthFromSignatureLength
size_t MaxRecoverableLengthFromSignatureLength(size_t signatureLength) const
Provides the length of longest message that can be recovered from a signature of given length...
Definition: xed25519.h:745
ed25519PublicKey::AssignFrom
void AssignFrom(const NameValuePairs &source)
Assign values to this object.
Definition: xed25519.cpp:723
ed25519PrivateKey::BERDecodeAndCheckAlgorithmID
void BERDecodeAndCheckAlgorithmID(BufferedTransformation &bt)
Determine if OID is valid for this object.
Definition: xed25519.cpp:481
ed25519PrivateKey::IsSmallOrder
bool IsSmallOrder(const byte y[PUBLIC_KEYLENGTH]) const
Test if a key has small order.
Definition: xed25519.cpp:382
PublicKey
Interface for public keys.
Definition: cryptlib.h:2425
CryptoPP
Crypto++ library namespace.
X509PublicKey
Encodes and decodes subjectPublicKeyInfo.
Definition: asn.h:398
x25519::Agree
bool Agree(byte *agreedValue, const byte *privateKey, const byte *otherPublicKey, bool validateOtherPublicKey=true) const
Derive agreed value.
Definition: xed25519.cpp:363
ed25519Signer::ed25519Signer
ed25519Signer()
Create a ed25519Signer object.
Definition: xed25519.h:507
ed25519PrivateKey::BERDecodePrivateKey
void BERDecodePrivateKey(BufferedTransformation &bt, bool parametersPresent, size_t size)
decode privateKey part of privateKeyInfo, without the OCTET STRING header
Definition: xed25519.cpp:567
ed25519PrivateKey::GetPrivateKeyBytePtr
const byte * GetPrivateKeyBytePtr() const
Retrieve private key byte array.
Definition: xed25519.h:465
ASN1Object::BEREncode
virtual void BEREncode(BufferedTransformation &bt) const
Encode this object into a BufferedTransformation.
Definition: cryptlib.h:3187
ed25519PrivateKey::GenerateRandom
void GenerateRandom(RandomNumberGenerator &rng, const NameValuePairs &params)
Generate a random key or crypto parameters.
Definition: xed25519.cpp:463
x25519::AgreedValueLength
unsigned int AgreedValueLength() const
Provides the size of the agreed value.
Definition: xed25519.h:229
ed25519PublicKey::GetVoidValue
bool GetVoidValue(const char *name, const std::type_info &valueType, void *pValue) const
Get a named value.
Definition: xed25519.cpp:701
ed25519PrivateKey::GetAlgorithmID
OID GetAlgorithmID() const
Retrieves the OID of the algorithm.
Definition: xed25519.h:368
ed25519PublicKey
Ed25519 public key.
Definition: xed25519.h:618
ed25519Signer::SIGNATURE_LENGTH
static const int SIGNATURE_LENGTH
Size of the siganture.
Definition: xed25519.h:501
ed25519
Ed25519 signature scheme.
Definition: xed25519.h:790
ed25519Verifier::VerifyStream
bool VerifyStream(std::istream &stream, const byte *signature, size_t signatureLen) const
Check whether input signature is a valid signature for input message.
Definition: xed25519.cpp:870
x25519::AssignFrom
void AssignFrom(const NameValuePairs &source)
Assign values to this object.
Definition: xed25519.cpp:316
ed25519PrivateKey::DEREncodePrivateKey
void DEREncodePrivateKey(BufferedTransformation &bt) const
encode privateKey part of privateKeyInfo, without the OCTET STRING header
Definition: xed25519.cpp:588
OID
Object Identifier.
Definition: asn.h:166
ed25519PublicKey::PUBLIC_KEYLENGTH
static const int PUBLIC_KEYLENGTH
Size of the public key.
Definition: xed25519.h:622
typedef
x25519::BERDecodeAndCheckAlgorithmID
void BERDecodeAndCheckAlgorithmID(BufferedTransformation &bt)
Determine if OID is valid for this object.
Definition: xed25519.cpp:148
ed25519Signer::SignatureLength
size_t SignatureLength() const
Provides the signature length if it only depends on the key.
Definition: xed25519.h:559
x25519::DEREncodePrivateKey
void DEREncodePrivateKey(BufferedTransformation &bt) const
encode privateKey part of privateKeyInfo, without the OCTET STRING header
Definition: xed25519.cpp:256
x25519::Load
void Load(BufferedTransformation &bt)
BER decode ASN.1 object.
Definition: xed25519.h:187
ed25519PrivateKey::GetPublicKeyBytePtr
const byte * GetPublicKeyBytePtr() const
Retrieve public key byte array.
Definition: xed25519.h:472
ed25519Verifier::NewVerificationAccumulator
ed25519_MessageAccumulator * NewVerificationAccumulator() const
Create a new HashTransformation to accumulate the message to be verified.
Definition: xed25519.h:753
ed25519_MessageAccumulator::signature
byte * signature()
Retrieve pointer to signature buffer.
Definition: xed25519.h:304
NameValuePairs
Interface for retrieving values given their names.
Definition: cryptlib.h:293
ed25519PublicKey::BERDecodeAndCheckAlgorithmID
void BERDecodeAndCheckAlgorithmID(BufferedTransformation &bt)
Determine if OID is valid for this object.
Definition: xed25519.cpp:738