File syn_x25519.c¶

FileList > crypto > syn_x25519.c

X25519 Diffie-Hellman — RFC 7748. More...

#include "../util/syn_pack.h"
#include "syn_x25519.h"
#include <string.h>

Public Types¶

Type	Name
typedef int64_t	gf Field element (GF(2^255 - 19)) represented by 16 × 16-bit limbs.

Public Static Attributes¶

Type	Name
const gf	_121665 = `{0xDB41, 1}` Constant (121665) used in Montgomery arithmetic.
const gf	gf0 = `{0}` Field element 0.
const gf	gf1 = `{1}` Field element 1.

Public Functions¶

Type	Name
void	syn_x25519 (uint8_t shared_out, const uint8_t scalar, const uint8_t point) X25519 scalar multiplication.
void	syn_x25519_pubkey (uint8_t public_out, const uint8_t private_key) Derive a public key from a private key.

Public Static Functions¶

Type	Name
void	A (gf o, const gf a, const gf b) Field addition: o = a + b.
void	M (gf o, const gf a, const gf b) Field multiplication: o = a b mod p.*
void	S (gf o, const gf a) Field squaring: o = a^2 mod p.
void	Z (gf o, const gf a, const gf b) Field subtraction: o = a - b.
void	car25519 (gf o) Carry-propagate across 16 limbs of a GF(2^255-19) element.
void	inv25519 (gf o, const gf a) Field inversion: o = a^(-1) mod p via Fermat's little theorem.
void	pack25519 (uint8_t o, const gf n) Reduce and serialise a GF element to 32 bytes (little-endian).
void	sel25519 (gf p, gf q, int b) Constant-time conditional swap of `p` and`q` (if b=1).
void	unpack25519 (gf o, const uint8_t n) Deserialise 32 bytes into a GF element.

Detailed Description¶

Based on the TweetNaCl approach: 16 × int64_t limbs (16 bits each). Simpler and more auditable than 10-limb donna at the cost of some speed. The entire scalar multiplication takes ~10M multiplies.

On Cortex-M4 @ 64 MHz this is ~2-4 seconds — acceptable since handshakes only happen every ~2 minutes.

Public Types Documentation¶

typedef gf¶

Field element (GF(2^255 - 19)) represented by 16 × 16-bit limbs.

typedef int64_t gf[16];

Public Static Attributes Documentation¶

variable _121665¶

Constant (121665) used in Montgomery arithmetic.

const gf _121665;

variable gf0¶

Field element 0.

const gf gf0;

variable gf1¶

Field element 1.

const gf gf1;

Public Functions Documentation¶

function syn_x25519¶

X25519 scalar multiplication.

void syn_x25519 (
    uint8_t shared_out,
    const uint8_t scalar,
    const uint8_t point
)

Computes shared = scalar * point on Curve25519.

Parameters:

shared_out Output: 32-byte shared secret.
scalar 32-byte private scalar (should be clamped).
point 32-byte public point (peer's public key).

function syn_x25519_pubkey¶

Derive a public key from a private key.

void syn_x25519_pubkey (
    uint8_t public_out,
    const uint8_t private_key
)

Computes public = scalar * basepoint (the Curve25519 generator, u=9).

Parameters:

public_out Output: 32-byte public key.
private_key 32-byte private key (should be clamped).

Public Static Functions Documentation¶

function A¶

Field addition: o = a + b.

static void A (
    gf o,
    const gf a,
    const gf b
)

Parameters:

o Output element.
a First operand.
b Second operand.

function M¶

Field multiplication: o = a * b mod p.

static void M (
    gf o,
    const gf a,
    const gf b
)

Parameters:

o Output element.
a Multiplicand.
b Multiplier.

function S¶

Field squaring: o = a^2 mod p.

static void S (
    gf o,
    const gf a
)

Parameters:

o Output element.
a Element to square.

function Z¶

Field subtraction: o = a - b.

static void Z (
    gf o,
    const gf a,
    const gf b
)

Parameters:

o Output element.
a Minuend.
b Subtrahend.

function car25519¶

Carry-propagate across 16 limbs of a GF(2^255-19) element.

static void car25519 (
    gf o
)

Parameters:

o Element to normalize.

function inv25519¶

Field inversion: o = a^(-1) mod p via Fermat's little theorem.

static void inv25519 (
    gf o,
    const gf a
)

Parameters:

o Output element.
a Element to invert.

function pack25519¶

Reduce and serialise a GF element to 32 bytes (little-endian).

static void pack25519 (
    uint8_t o,
    const gf n
)

Parameters:

o Output buffer (32 bytes).
n Field element to serialize.

function sel25519¶

Constant-time conditional swap of p andq (if b=1).

static void sel25519 (
    gf p,
    gf q,
    int b
)

Parameters:

p First element.
q Second element.
b Condition (1 to swap, 0 to keep).

function unpack25519¶

Deserialise 32 bytes into a GF element.

static void unpack25519 (
    gf o,
    const uint8_t n
)

Parameters:

o Output field element.
n 32-byte input buffer.

The documentation for this class was generated from the following file src/syntropic/crypto/syn_x25519.c