aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src/crypto/curve25519.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* curve25519: use precomp implementation instead of sandy2xJason A. Donenfeld2018-03-091-12/+14
| | | | It's faster and doesn't use the FPU.
* curve25519: replace fiat64 with faster hacl64Jason A. Donenfeld2018-02-011-1/+5
| | | | | This reverts commit da4ff396cc5d5e0ff21f9ecbc2f951c048c63fff and adds some optimizations to hacl64.
* curve25519: replace hacl64 with fiat64Jason A. Donenfeld2018-02-011-5/+1
| | | | | | | | | | For now, it's faster: hacl64: 109782 cycles per call fiat64: 108984 cycles per call It's quite possible this commit will be reverted with nice changes from INRIA, though.
* curve25519: wire up new impls and remove donnaJason A. Donenfeld2018-01-181-8/+3
|
* curve25519: modularize implementationJason A. Donenfeld2018-01-181-1610/+5
|
* global: year bumpJason A. Donenfeld2018-01-031-1/+1
|
* crypto: compile on UMLJason A. Donenfeld2017-12-131-0/+2
| | | | We basically just don't use FPU in UML.
* global: add SPDX tags to all filesGreg Kroah-Hartman2017-12-091-2/+4
| | | | | | | | | | | | | It's good to have SPDX identifiers in all files as the Linux kernel developers are working to add these identifiers to all files. Update all files with the correct SPDX license identifier based on the license text of the project or based on the license in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Modified-by: Jason A. Donenfeld <Jason@zx2c4.com>
* curve25519: explictly depend on AS_AVXJason A. Donenfeld2017-11-281-3/+3
|
* curve25519: modularize dispatchJason A. Donenfeld2017-11-281-91/+82
|
* poly1305: import MIPS64 primitive from OpenSSLJason A. Donenfeld2017-11-221-1/+1
|
* chacha20poly1305: import ARM primitives from OpenSSLJason A. Donenfeld2017-11-221-3/+3
| | | | ARMv4-ARMv8, with NEON for ARMv7 and ARMv8.
* curve25519-neon: compile in thumb modeJason A. Donenfeld2017-11-141-3/+3
| | | | | In thumb mode, it's not possible to use sp as an operand of and, so we have to muck around with r3 as a scratch register.
* curve25519: reject deriving from NULL private keysJason A. Donenfeld2017-11-111-0/+7
| | | | | These aren't actually valid 25519 points pre-normalization, and doing this is required to make unsetting private keys based on all zeros.
* curve25519: only enable int128 if compiler support is soundJason A. Donenfeld2017-10-311-1/+1
|
* global: style nitsJason A. Donenfeld2017-10-311-111/+168
|
* qemu: allow for cross compilationJason A. Donenfeld2017-10-311-3/+3
|
* crypto/avx: make sure we can actually use ymm registersJason A. Donenfeld2017-10-311-1/+1
|
* compat: ensure we can build without compat.hJason A. Donenfeld2017-09-161-0/+1
|
* curve25519: keep certain sandy2x functions in CJason A. Donenfeld2017-06-251-5/+84
| | | | We can let the compiler optimize how it sees fit.
* curve25519: satisfy sparse and use short typesJason A. Donenfeld2017-06-241-26/+26
|
* main: annotate init/exit functions to save memoryJason A. Donenfeld2017-06-241-2/+2
|
* random: wait for random bytes when generating nonces and ephemeralsJason A. Donenfeld2017-06-121-1/+1
| | | | | | | | | | | We can let userspace configure wireguard interfaces before the RNG is fully initialized, since what we mostly care about is having good randomness for ephemerals and xchacha nonces. By deferring the wait to actually asking for the randomness, we give a lot more opportunity for gathering entropy. This won't cover entropy for hash table secrets or cookie secrets (which rotate anyway), but those have far less catastrophic failure modes, so ensuring good randomness for elliptic curve points and nonces should be sufficient.
* curve25519: add NEON versions for ARMJason A. Donenfeld2017-05-311-27/+54
|
* curve25519: align the basepoint to 32 bytesJason A. Donenfeld2017-05-311-2/+2
|
* curve25519: actually, do some things on heap sometimesJason A. Donenfeld2017-05-311-0/+170
| | | | This reverts commit 42dd5bd87e418275203dd6644b6b6b0cc310d4d9.
* curve25519: protect against potential invalid point attacksJason A. Donenfeld2017-03-301-16/+28
|
* curve25519: 128-bit integer != x86_64Jason A. Donenfeld2017-03-241-2/+8
|
* curve25519: do dispatcher in C instead of asm, since shlx is haswell onlyJason A. Donenfeld2017-03-201-9/+73
|
* curve25519: add AVX implementationJason A. Donenfeld2017-03-191-23/+56
|
* curve25519: do everything on the stackJason A. Donenfeld2017-01-151-171/+0
| | | | | | With MIPS now supporting a separate IRQ stack, and with these changes being backported into OpenWRT (and likely the stable mainline releases), we no longer need to kmalloc more space for temporary variables.
* Update copyrightJason A. Donenfeld2017-01-101-1/+1
|
* global: move to consistent use of uN instead of uintN_t for kernel codeJason A. Donenfeld2016-12-111-212/+212
|
* headers: cleanup noticesJason A. Donenfeld2016-11-211-1/+1
|
* curve25519: use kmalloc in order to not overflow stackexperimental-0.0.20161110Jason A. Donenfeld2016-11-101-89/+260
| | | | | | | | | | | | | | | | | On MIPS, the IRQ and SoftIRQ handlers share the stack with whatever kernel thread was interrupted. This means that Curve25519 can be interrupted by, say, an ethernet controller, that then gets handled by a SoftIRQ. If something like l2tp is being used, which uses quite a bit of stack, then by the time the SoftIRQ handler gets to WireGuard code and calls into the stack-heavy ChaPoly functions, our 8k stack is shot. In other words, since Curve25519 is such a big consumer of stack, if it's interrupted by anything else that uses a healthy amount of stack, then disaster strikes. The solution here is just to allocate using kmalloc. This is quite ugly, and if performance becomes an issue, we might consider moving to a kmem_cache allocator, or even having each peer keep its own preallocated space. But for now, we'll try this.
* c89: the static keyword is okay in c99, but not in c89Jason A. Donenfeld2016-11-051-7/+7
|
* Rework headers and includesJason A. Donenfeld2016-09-291-1/+1
|
* selftest: move to subfolderJason A. Donenfeld2016-08-021-64/+1
|
* c: specify static array size in function paramsJason A. Donenfeld2016-08-021-7/+7
| | | | | | | | | | | | | | | The C standard states: A declaration of a parameter as ``array of type'' shall be adjusted to ``qualified pointer to type'', where the type qualifiers (if any) are those specified within the [ and ] of the array type derivation. If the keyword static also appears within the [ and ] of the array type derivation, then for each call to the function, the value of the corresponding actual argument shall provide access to the first element of an array with at least as many elements as specified by the size expression. By changing void func(int array[4]) to void func(int array[static 4]), we automatically get the compiler checking argument sizes for us, which is quite nice.
* curve25519: unneeded zeros variableJason A. Donenfeld2016-07-071-2/+0
|
* tests: make fatalJason A. Donenfeld2016-06-251-2/+3
|
* Initial commitJason A. Donenfeld2016-06-251-0/+1304
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.