noise: store clamped key instead of raw key

9 files changed, 18 insertions, 18 deletions

diff --git a/src/crypto/include/zinc/curve25519.h b/src/crypto/include/zinc/curve25519.h
index 0b46552..127d8a3 100644
--- a/src/crypto/include/zinc/curve25519.h
+++ b/src/crypto/include/zinc/curve25519.h
@@ -19,4 +19,10 @@ void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE]);
 bool __must_check curve25519_generate_public(
 	u8 pub[CURVE25519_KEY_SIZE], const u8 secret[CURVE25519_KEY_SIZE]);
 
+static inline void curve25519_clamp_secret(u8 secret[CURVE25519_KEY_SIZE])
+{
+	secret[0] &= 248;
+	secret[31] = (secret[31] & 127) | 64;
+}
+
 #endif /* _ZINC_CURVE25519_H */
diff --git a/src/crypto/zinc/curve25519/curve25519-fiat32.c b/src/crypto/zinc/curve25519/curve25519-fiat32.c
index 7f4f01c..42cfb6c 100644
--- a/src/crypto/zinc/curve25519/curve25519-fiat32.c
+++ b/src/crypto/zinc/curve25519/curve25519-fiat32.c
@@ -760,7 +760,7 @@ static void curve25519_generic(u8 out[CURVE25519_KEY_SIZE],
 	u8 e[32];
 
 	memcpy(e, scalar, 32);
-	clamp_secret(e);
+	curve25519_clamp_secret(e);
 
 	/* The following implementation was transcribed to Coq and proven to
 	 * correspond to unary scalar multiplication in affine coordinates given
diff --git a/src/crypto/zinc/curve25519/curve25519-hacl64.c b/src/crypto/zinc/curve25519/curve25519-hacl64.c
index ff22d3b..0f729ec 100644
--- a/src/crypto/zinc/curve25519/curve25519-hacl64.c
+++ b/src/crypto/zinc/curve25519/curve25519-hacl64.c
@@ -767,7 +767,7 @@ static void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
 		u8 e[32] __aligned(32) = { 0 };
 		u8 *scalar;
 		memcpy(e, secret, 32);
-		clamp_secret(e);
+		curve25519_clamp_secret(e);
 		scalar = e;
 		{
 			u64 buf[15] = { 0 };
diff --git a/src/crypto/zinc/curve25519/curve25519-x86_64.c b/src/crypto/zinc/curve25519/curve25519-x86_64.c
index 81ef575..3d1806f 100644
--- a/src/crypto/zinc/curve25519/curve25519-x86_64.c
+++ b/src/crypto/zinc/curve25519/curve25519-x86_64.c
@@ -1975,7 +1975,7 @@ static void curve25519_adx(u8 shared[CURVE25519_KEY_SIZE],
 	memcpy(m.private, private_key, sizeof(m.private));
 	memcpy(m.session, session_key, sizeof(m.session));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	/* As in the draft:
 	 * When receiving such an array, implementations of curve25519
@@ -2072,7 +2072,7 @@ static void curve25519_adx_base(u8 session_key[CURVE25519_KEY_SIZE],
 
 	memcpy(m.private, private_key, sizeof(m.private));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	setzero_eltfp25519_1w(Ur1);
 	setzero_eltfp25519_1w(Zr1);
@@ -2170,7 +2170,7 @@ static void curve25519_bmi2(u8 shared[CURVE25519_KEY_SIZE],
 	memcpy(m.private, private_key, sizeof(m.private));
 	memcpy(m.session, session_key, sizeof(m.session));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	/* As in the draft:
 	 * When receiving such an array, implementations of curve25519
@@ -2267,7 +2267,7 @@ static void curve25519_bmi2_base(u8 session_key[CURVE25519_KEY_SIZE],
 
 	memcpy(m.private, private_key, sizeof(m.private));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	setzero_eltfp25519_1w(Ur1);
 	setzero_eltfp25519_1w(Zr1);
diff --git a/src/crypto/zinc/curve25519/curve25519.c b/src/crypto/zinc/curve25519/curve25519.c
index 6b3f12a..82c669e 100644
--- a/src/crypto/zinc/curve25519/curve25519.c
+++ b/src/crypto/zinc/curve25519/curve25519.c
@@ -20,13 +20,6 @@
 #include <linux/init.h>
 #include <crypto/algapi.h> // For crypto_memneq.
 
-static __always_inline void clamp_secret(u8 secret[CURVE25519_KEY_SIZE])
-{
-	secret[0] &= 248;
-	secret[31] &= 127;
-	secret[31] |= 64;
-}
-
 #if defined(CONFIG_ZINC_ARCH_X86_64)
 #include "curve25519-x86_64-glue.c"
 #elif defined(CONFIG_ZINC_ARCH_ARM)
@@ -84,7 +77,7 @@ EXPORT_SYMBOL(curve25519_generate_public);
 void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE])
 {
 	get_random_bytes_wait(secret, CURVE25519_KEY_SIZE);
-	clamp_secret(secret);
+	curve25519_clamp_secret(secret);
 }
 EXPORT_SYMBOL(curve25519_generate_secret);
 
diff --git a/src/noise.c b/src/noise.c
index e1d4519..4405125 100644
--- a/src/noise.c
+++ b/src/noise.c
@@ -285,6 +285,7 @@ void wg_noise_set_static_identity_private_key(
 {
 	memcpy(static_identity->static_private, private_key,
 	       NOISE_PUBLIC_KEY_LEN);
+	curve25519_clamp_secret(static_identity->static_private);
 	static_identity->has_identity = curve25519_generate_public(
 		static_identity->static_public, private_key);
 }
diff --git a/src/tests/netns.sh b/src/tests/netns.sh
index 46c30e5..91111f6 100755
--- a/src/tests/netns.sh
+++ b/src/tests/netns.sh
@@ -483,6 +483,8 @@ n0 wg set wg0 peer "$pub2"
 n0 wg set wg0 private-key <(echo "$key1")
 n0 wg set wg0 peer "$pub2"
 [[ $(n0 wg show wg0 peers) == "$pub2" ]]
+n0 wg set wg0 private-key <(echo "/${key1:1}")
+[[ $(n0 wg show wg0 private-key) == "+${key1:1}" ]]
 ip0 link del wg0
 
 declare -A objects
diff --git a/src/tools/curve25519.c b/src/tools/curve25519.c
index 0d52bc8..648daed 100644
--- a/src/tools/curve25519.c
+++ b/src/tools/curve25519.c
@@ -68,7 +68,6 @@ static inline void put_unaligned_le64(u64 s, u8 *d)
 #ifndef __force
 #define __force
 #endif
-#define clamp_secret(a) curve25519_clamp_secret(a)
 
 static noinline void memzero_explicit(void *s, size_t count)
 {
diff --git a/src/tools/curve25519.h b/src/tools/curve25519.h
index badcda0..c047019 100644
--- a/src/tools/curve25519.h
+++ b/src/tools/curve25519.h
@@ -10,7 +10,7 @@
 #include <sys/types.h>
 
 enum curve25519_lengths {
-	CURVE25519_KEY_SIZE = 32,
+	CURVE25519_KEY_SIZE = 32
 };
 
 void curve25519(uint8_t mypublic[static CURVE25519_KEY_SIZE], const uint8_t secret[static CURVE25519_KEY_SIZE], const uint8_t basepoint[static CURVE25519_KEY_SIZE]);
@@ -18,8 +18,7 @@ void curve25519_generate_public(uint8_t pub[static CURVE25519_KEY_SIZE], const u
 static inline void curve25519_clamp_secret(uint8_t secret[static CURVE25519_KEY_SIZE])
 {
 	secret[0] &= 248;
-	secret[31] &= 127;
-	secret[31] |= 64;
+	secret[31] = (secret[31] & 127) | 64;
 }
 
 #endif