From 897548e927fc90d13a19e1b1f29a549e7f885621 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Sun, 3 Feb 2019 21:50:54 +0100 Subject: noise: store clamped key instead of raw key --- src/crypto/include/zinc/curve25519.h | 6 ++++++ src/crypto/zinc/curve25519/curve25519-fiat32.c | 2 +- src/crypto/zinc/curve25519/curve25519-hacl64.c | 2 +- src/crypto/zinc/curve25519/curve25519-x86_64.c | 8 ++++---- src/crypto/zinc/curve25519/curve25519.c | 9 +-------- src/noise.c | 1 + src/tests/netns.sh | 2 ++ src/tools/curve25519.c | 1 - src/tools/curve25519.h | 5 ++--- 9 files changed, 18 insertions(+), 18 deletions(-) (limited to 'src') diff --git a/src/crypto/include/zinc/curve25519.h b/src/crypto/include/zinc/curve25519.h index 0b46552..127d8a3 100644 --- a/src/crypto/include/zinc/curve25519.h +++ b/src/crypto/include/zinc/curve25519.h @@ -19,4 +19,10 @@ void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE]); bool __must_check curve25519_generate_public( u8 pub[CURVE25519_KEY_SIZE], const u8 secret[CURVE25519_KEY_SIZE]); +static inline void curve25519_clamp_secret(u8 secret[CURVE25519_KEY_SIZE]) +{ + secret[0] &= 248; + secret[31] = (secret[31] & 127) | 64; +} + #endif /* _ZINC_CURVE25519_H */ diff --git a/src/crypto/zinc/curve25519/curve25519-fiat32.c b/src/crypto/zinc/curve25519/curve25519-fiat32.c index 7f4f01c..42cfb6c 100644 --- a/src/crypto/zinc/curve25519/curve25519-fiat32.c +++ b/src/crypto/zinc/curve25519/curve25519-fiat32.c @@ -760,7 +760,7 @@ static void curve25519_generic(u8 out[CURVE25519_KEY_SIZE], u8 e[32]; memcpy(e, scalar, 32); - clamp_secret(e); + curve25519_clamp_secret(e); /* The following implementation was transcribed to Coq and proven to * correspond to unary scalar multiplication in affine coordinates given diff --git a/src/crypto/zinc/curve25519/curve25519-hacl64.c b/src/crypto/zinc/curve25519/curve25519-hacl64.c index ff22d3b..0f729ec 100644 --- a/src/crypto/zinc/curve25519/curve25519-hacl64.c +++ b/src/crypto/zinc/curve25519/curve25519-hacl64.c @@ -767,7 +767,7 @@ static void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE], u8 e[32] __aligned(32) = { 0 }; u8 *scalar; memcpy(e, secret, 32); - clamp_secret(e); + curve25519_clamp_secret(e); scalar = e; { u64 buf[15] = { 0 }; diff --git a/src/crypto/zinc/curve25519/curve25519-x86_64.c b/src/crypto/zinc/curve25519/curve25519-x86_64.c index 81ef575..3d1806f 100644 --- a/src/crypto/zinc/curve25519/curve25519-x86_64.c +++ b/src/crypto/zinc/curve25519/curve25519-x86_64.c @@ -1975,7 +1975,7 @@ static void curve25519_adx(u8 shared[CURVE25519_KEY_SIZE], memcpy(m.private, private_key, sizeof(m.private)); memcpy(m.session, session_key, sizeof(m.session)); - clamp_secret(m.private); + curve25519_clamp_secret(m.private); /* As in the draft: * When receiving such an array, implementations of curve25519 @@ -2072,7 +2072,7 @@ static void curve25519_adx_base(u8 session_key[CURVE25519_KEY_SIZE], memcpy(m.private, private_key, sizeof(m.private)); - clamp_secret(m.private); + curve25519_clamp_secret(m.private); setzero_eltfp25519_1w(Ur1); setzero_eltfp25519_1w(Zr1); @@ -2170,7 +2170,7 @@ static void curve25519_bmi2(u8 shared[CURVE25519_KEY_SIZE], memcpy(m.private, private_key, sizeof(m.private)); memcpy(m.session, session_key, sizeof(m.session)); - clamp_secret(m.private); + curve25519_clamp_secret(m.private); /* As in the draft: * When receiving such an array, implementations of curve25519 @@ -2267,7 +2267,7 @@ static void curve25519_bmi2_base(u8 session_key[CURVE25519_KEY_SIZE], memcpy(m.private, private_key, sizeof(m.private)); - clamp_secret(m.private); + curve25519_clamp_secret(m.private); setzero_eltfp25519_1w(Ur1); setzero_eltfp25519_1w(Zr1); diff --git a/src/crypto/zinc/curve25519/curve25519.c b/src/crypto/zinc/curve25519/curve25519.c index 6b3f12a..82c669e 100644 --- a/src/crypto/zinc/curve25519/curve25519.c +++ b/src/crypto/zinc/curve25519/curve25519.c @@ -20,13 +20,6 @@ #include #include // For crypto_memneq. -static __always_inline void clamp_secret(u8 secret[CURVE25519_KEY_SIZE]) -{ - secret[0] &= 248; - secret[31] &= 127; - secret[31] |= 64; -} - #if defined(CONFIG_ZINC_ARCH_X86_64) #include "curve25519-x86_64-glue.c" #elif defined(CONFIG_ZINC_ARCH_ARM) @@ -84,7 +77,7 @@ EXPORT_SYMBOL(curve25519_generate_public); void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE]) { get_random_bytes_wait(secret, CURVE25519_KEY_SIZE); - clamp_secret(secret); + curve25519_clamp_secret(secret); } EXPORT_SYMBOL(curve25519_generate_secret); diff --git a/src/noise.c b/src/noise.c index e1d4519..4405125 100644 --- a/src/noise.c +++ b/src/noise.c @@ -285,6 +285,7 @@ void wg_noise_set_static_identity_private_key( { memcpy(static_identity->static_private, private_key, NOISE_PUBLIC_KEY_LEN); + curve25519_clamp_secret(static_identity->static_private); static_identity->has_identity = curve25519_generate_public( static_identity->static_public, private_key); } diff --git a/src/tests/netns.sh b/src/tests/netns.sh index 46c30e5..91111f6 100755 --- a/src/tests/netns.sh +++ b/src/tests/netns.sh @@ -483,6 +483,8 @@ n0 wg set wg0 peer "$pub2" n0 wg set wg0 private-key <(echo "$key1") n0 wg set wg0 peer "$pub2" [[ $(n0 wg show wg0 peers) == "$pub2" ]] +n0 wg set wg0 private-key <(echo "/${key1:1}") +[[ $(n0 wg show wg0 private-key) == "+${key1:1}" ]] ip0 link del wg0 declare -A objects diff --git a/src/tools/curve25519.c b/src/tools/curve25519.c index 0d52bc8..648daed 100644 --- a/src/tools/curve25519.c +++ b/src/tools/curve25519.c @@ -68,7 +68,6 @@ static inline void put_unaligned_le64(u64 s, u8 *d) #ifndef __force #define __force #endif -#define clamp_secret(a) curve25519_clamp_secret(a) static noinline void memzero_explicit(void *s, size_t count) { diff --git a/src/tools/curve25519.h b/src/tools/curve25519.h index badcda0..c047019 100644 --- a/src/tools/curve25519.h +++ b/src/tools/curve25519.h @@ -10,7 +10,7 @@ #include enum curve25519_lengths { - CURVE25519_KEY_SIZE = 32, + CURVE25519_KEY_SIZE = 32 }; void curve25519(uint8_t mypublic[static CURVE25519_KEY_SIZE], const uint8_t secret[static CURVE25519_KEY_SIZE], const uint8_t basepoint[static CURVE25519_KEY_SIZE]); @@ -18,8 +18,7 @@ void curve25519_generate_public(uint8_t pub[static CURVE25519_KEY_SIZE], const u static inline void curve25519_clamp_secret(uint8_t secret[static CURVE25519_KEY_SIZE]) { secret[0] &= 248; - secret[31] &= 127; - secret[31] |= 64; + secret[31] = (secret[31] & 127) | 64; } #endif -- cgit v1.2.3-59-g8ed1b