aboutsummaryrefslogtreecommitdiffstatshomepage
diff options
context:
space:
mode:
authorJason A. Donenfeld <Jason@zx2c4.com>2019-02-03 21:50:54 +0100
committerJason A. Donenfeld <Jason@zx2c4.com>2019-02-03 21:51:18 +0100
commit897548e927fc90d13a19e1b1f29a549e7f885621 (patch)
treed27bc7200af21ab98724973011b5a78de6dcdba8
parentchacha20poly1305: permit unaligned strides on certain platforms (diff)
downloadWireGuard-897548e927fc90d13a19e1b1f29a549e7f885621.tar.xz
WireGuard-897548e927fc90d13a19e1b1f29a549e7f885621.zip
noise: store clamped key instead of raw key
-rw-r--r--src/crypto/include/zinc/curve25519.h6
-rw-r--r--src/crypto/zinc/curve25519/curve25519-fiat32.c2
-rw-r--r--src/crypto/zinc/curve25519/curve25519-hacl64.c2
-rw-r--r--src/crypto/zinc/curve25519/curve25519-x86_64.c8
-rw-r--r--src/crypto/zinc/curve25519/curve25519.c9
-rw-r--r--src/noise.c1
-rwxr-xr-xsrc/tests/netns.sh2
-rw-r--r--src/tools/curve25519.c1
-rw-r--r--src/tools/curve25519.h5
9 files changed, 18 insertions, 18 deletions
diff --git a/src/crypto/include/zinc/curve25519.h b/src/crypto/include/zinc/curve25519.h
index 0b46552..127d8a3 100644
--- a/src/crypto/include/zinc/curve25519.h
+++ b/src/crypto/include/zinc/curve25519.h
@@ -19,4 +19,10 @@ void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE]);
bool __must_check curve25519_generate_public(
u8 pub[CURVE25519_KEY_SIZE], const u8 secret[CURVE25519_KEY_SIZE]);
+static inline void curve25519_clamp_secret(u8 secret[CURVE25519_KEY_SIZE])
+{
+ secret[0] &= 248;
+ secret[31] = (secret[31] & 127) | 64;
+}
+
#endif /* _ZINC_CURVE25519_H */
diff --git a/src/crypto/zinc/curve25519/curve25519-fiat32.c b/src/crypto/zinc/curve25519/curve25519-fiat32.c
index 7f4f01c..42cfb6c 100644
--- a/src/crypto/zinc/curve25519/curve25519-fiat32.c
+++ b/src/crypto/zinc/curve25519/curve25519-fiat32.c
@@ -760,7 +760,7 @@ static void curve25519_generic(u8 out[CURVE25519_KEY_SIZE],
u8 e[32];
memcpy(e, scalar, 32);
- clamp_secret(e);
+ curve25519_clamp_secret(e);
/* The following implementation was transcribed to Coq and proven to
* correspond to unary scalar multiplication in affine coordinates given
diff --git a/src/crypto/zinc/curve25519/curve25519-hacl64.c b/src/crypto/zinc/curve25519/curve25519-hacl64.c
index ff22d3b..0f729ec 100644
--- a/src/crypto/zinc/curve25519/curve25519-hacl64.c
+++ b/src/crypto/zinc/curve25519/curve25519-hacl64.c
@@ -767,7 +767,7 @@ static void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
u8 e[32] __aligned(32) = { 0 };
u8 *scalar;
memcpy(e, secret, 32);
- clamp_secret(e);
+ curve25519_clamp_secret(e);
scalar = e;
{
u64 buf[15] = { 0 };
diff --git a/src/crypto/zinc/curve25519/curve25519-x86_64.c b/src/crypto/zinc/curve25519/curve25519-x86_64.c
index 81ef575..3d1806f 100644
--- a/src/crypto/zinc/curve25519/curve25519-x86_64.c
+++ b/src/crypto/zinc/curve25519/curve25519-x86_64.c
@@ -1975,7 +1975,7 @@ static void curve25519_adx(u8 shared[CURVE25519_KEY_SIZE],
memcpy(m.private, private_key, sizeof(m.private));
memcpy(m.session, session_key, sizeof(m.session));
- clamp_secret(m.private);
+ curve25519_clamp_secret(m.private);
/* As in the draft:
* When receiving such an array, implementations of curve25519
@@ -2072,7 +2072,7 @@ static void curve25519_adx_base(u8 session_key[CURVE25519_KEY_SIZE],
memcpy(m.private, private_key, sizeof(m.private));
- clamp_secret(m.private);
+ curve25519_clamp_secret(m.private);
setzero_eltfp25519_1w(Ur1);
setzero_eltfp25519_1w(Zr1);
@@ -2170,7 +2170,7 @@ static void curve25519_bmi2(u8 shared[CURVE25519_KEY_SIZE],
memcpy(m.private, private_key, sizeof(m.private));
memcpy(m.session, session_key, sizeof(m.session));
- clamp_secret(m.private);
+ curve25519_clamp_secret(m.private);
/* As in the draft:
* When receiving such an array, implementations of curve25519
@@ -2267,7 +2267,7 @@ static void curve25519_bmi2_base(u8 session_key[CURVE25519_KEY_SIZE],
memcpy(m.private, private_key, sizeof(m.private));
- clamp_secret(m.private);
+ curve25519_clamp_secret(m.private);
setzero_eltfp25519_1w(Ur1);
setzero_eltfp25519_1w(Zr1);
diff --git a/src/crypto/zinc/curve25519/curve25519.c b/src/crypto/zinc/curve25519/curve25519.c
index 6b3f12a..82c669e 100644
--- a/src/crypto/zinc/curve25519/curve25519.c
+++ b/src/crypto/zinc/curve25519/curve25519.c
@@ -20,13 +20,6 @@
#include <linux/init.h>
#include <crypto/algapi.h> // For crypto_memneq.
-static __always_inline void clamp_secret(u8 secret[CURVE25519_KEY_SIZE])
-{
- secret[0] &= 248;
- secret[31] &= 127;
- secret[31] |= 64;
-}
-
#if defined(CONFIG_ZINC_ARCH_X86_64)
#include "curve25519-x86_64-glue.c"
#elif defined(CONFIG_ZINC_ARCH_ARM)
@@ -84,7 +77,7 @@ EXPORT_SYMBOL(curve25519_generate_public);
void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE])
{
get_random_bytes_wait(secret, CURVE25519_KEY_SIZE);
- clamp_secret(secret);
+ curve25519_clamp_secret(secret);
}
EXPORT_SYMBOL(curve25519_generate_secret);
diff --git a/src/noise.c b/src/noise.c
index e1d4519..4405125 100644
--- a/src/noise.c
+++ b/src/noise.c
@@ -285,6 +285,7 @@ void wg_noise_set_static_identity_private_key(
{
memcpy(static_identity->static_private, private_key,
NOISE_PUBLIC_KEY_LEN);
+ curve25519_clamp_secret(static_identity->static_private);
static_identity->has_identity = curve25519_generate_public(
static_identity->static_public, private_key);
}
diff --git a/src/tests/netns.sh b/src/tests/netns.sh
index 46c30e5..91111f6 100755
--- a/src/tests/netns.sh
+++ b/src/tests/netns.sh
@@ -483,6 +483,8 @@ n0 wg set wg0 peer "$pub2"
n0 wg set wg0 private-key <(echo "$key1")
n0 wg set wg0 peer "$pub2"
[[ $(n0 wg show wg0 peers) == "$pub2" ]]
+n0 wg set wg0 private-key <(echo "/${key1:1}")
+[[ $(n0 wg show wg0 private-key) == "+${key1:1}" ]]
ip0 link del wg0
declare -A objects
diff --git a/src/tools/curve25519.c b/src/tools/curve25519.c
index 0d52bc8..648daed 100644
--- a/src/tools/curve25519.c
+++ b/src/tools/curve25519.c
@@ -68,7 +68,6 @@ static inline void put_unaligned_le64(u64 s, u8 *d)
#ifndef __force
#define __force
#endif
-#define clamp_secret(a) curve25519_clamp_secret(a)
static noinline void memzero_explicit(void *s, size_t count)
{
diff --git a/src/tools/curve25519.h b/src/tools/curve25519.h
index badcda0..c047019 100644
--- a/src/tools/curve25519.h
+++ b/src/tools/curve25519.h
@@ -10,7 +10,7 @@
#include <sys/types.h>
enum curve25519_lengths {
- CURVE25519_KEY_SIZE = 32,
+ CURVE25519_KEY_SIZE = 32
};
void curve25519(uint8_t mypublic[static CURVE25519_KEY_SIZE], const uint8_t secret[static CURVE25519_KEY_SIZE], const uint8_t basepoint[static CURVE25519_KEY_SIZE]);
@@ -18,8 +18,7 @@ void curve25519_generate_public(uint8_t pub[static CURVE25519_KEY_SIZE], const u
static inline void curve25519_clamp_secret(uint8_t secret[static CURVE25519_KEY_SIZE])
{
secret[0] &= 248;
- secret[31] &= 127;
- secret[31] |= 64;
+ secret[31] = (secret[31] & 127) | 64;
}
#endif