+++ /dev/null
-From 3d12521735e7ef7e48be217af0f27d68e23050a7 Mon Sep 17 00:00:00 2001
-From: Vladislav Grishenko <themiron@users.noreply.github.com>
-Date: Wed, 11 Mar 2020 21:09:45 +0500
-Subject: [PATCH] Add Ed25519 support (#91)
-
-* Add support for Ed25519 as a public key type
-
-Ed25519 is a elliptic curve signature scheme that offers
-better security than ECDSA and DSA and good performance. It may be
-used for both user and host keys.
-
-OpenSSH key import and fuzzer are not supported yet.
-
-Initially inspired by Peter Szabo.
-
-* Add curve25519 and ed25519 fuzzers
-
-* Add import and export of Ed25519 keys
----
- .travis.yml | 1 +
- FUZZER-NOTES.md | 3 +
- LICENSE | 71 ++--
- Makefile.in | 12 +-
- README | 1 +
- cli-kex.c | 2 +-
- common-algo.c | 3 +
- common-kex.c | 14 +-
- curve25519-donna.c | 860 -----------------------------------------
- curve25519.c | 502 ++++++++++++++++++++++++
- curve25519.h | 37 ++
- default_options.h | 7 +-
- dropbear.8 | 6 +-
- dropbearkey.c | 25 ++
- ed25519.c | 184 +++++++++
- ed25519.h | 54 +++
- filelist.txt | 4 +
- fuzz-common.c | 8 +
- fuzz-hostkeys.c | 10 +
- fuzzer-kexcurve25519.c | 72 ++++
- gened25519.c | 47 +++
- gened25519.h | 36 ++
- gensignkey.c | 10 +
- keyimport.c | 158 +++++++-
- signkey.c | 60 ++-
- signkey.h | 7 +
- ssh.h | 2 +
- svr-kex.c | 8 +-
- svr-runopts.c | 24 ++
- sysoptions.h | 7 +-
- 30 files changed, 1289 insertions(+), 946 deletions(-)
- delete mode 100644 curve25519-donna.c
- create mode 100644 curve25519.c
- create mode 100644 curve25519.h
- create mode 100644 ed25519.c
- create mode 100644 ed25519.h
- create mode 100644 fuzzer-kexcurve25519.c
- create mode 100644 gened25519.c
- create mode 100644 gened25519.h
-
-diff --git a/.travis.yml b/.travis.yml
-index 9bcbce4..99499c8 100644
---- a/.travis.yml
-+++ b/.travis.yml
-@@ -57,6 +57,7 @@ script:
- - ~/inst/bin/dropbearkey -t ecdsa -f testec256 -s 256
- - ~/inst/bin/dropbearkey -t ecdsa -f testec384 -s 384
- - ~/inst/bin/dropbearkey -t ecdsa -f testec521 -s 521
-+ - ~/inst/bin/dropbearkey -t ed25519 -f tested25519
- - test -z $DO_FUZZ || ./fuzzers_test.sh
-
- branches:
-diff --git a/FUZZER-NOTES.md b/FUZZER-NOTES.md
-index 7b88238..4967eba 100644
---- a/FUZZER-NOTES.md
-+++ b/FUZZER-NOTES.md
-@@ -72,3 +72,6 @@ Current fuzzers are
-
- - [fuzzer-kexecdh](fuzzer-kexecdh.c) - test Elliptic Curve Diffie-Hellman key exchange like fuzzer-kexdh.
- This is testing libtommath ECC routines.
-+
-+- [fuzzer-kexcurve25519](fuzzer-kexcurve25519.c) - test Curve25519 Elliptic Curve Diffie-Hellman key exchange
-+ like fuzzer-kexecdh. This is testing `dropbear_curve25519_scalarmult()` and other libtommath routines.
-diff --git a/LICENSE b/LICENSE
-index c400d94..a4849ff 100644
---- a/LICENSE
-+++ b/LICENSE
-@@ -90,52 +90,25 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
- =====
-
--curve25519-donna:
--
--/* Copyright 2008, Google Inc.
-- * All rights reserved.
-- *
-- * Redistribution and use in source and binary forms, with or without
-- * modification, are permitted provided that the following conditions are
-- * met:
-- *
-- * * Redistributions of source code must retain the above copyright
-- * notice, this list of conditions and the following disclaimer.
-- * * Redistributions in binary form must reproduce the above
-- * copyright notice, this list of conditions and the following disclaimer
-- * in the documentation and/or other materials provided with the
-- * distribution.
-- * * Neither the name of Google Inc. nor the names of its
-- * contributors may be used to endorse or promote products derived from
-- * this software without specific prior written permission.
-- *
-- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-- *
-- * curve25519-donna: Curve25519 elliptic curve, public key function
-- *
-- * http://code.google.com/p/curve25519-donna/
-- *
-- * Adam Langley <agl@imperialviolet.org>
-- *
-- * Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
-- *
-- * More information about curve25519 can be found here
-- * http://cr.yp.to/ecdh.html
-- *
-- * djb's sample implementation of curve25519 is written in a special assembly
-- * language called qhasm and uses the floating point registers.
-- *
-- * This is, almost, a clean room reimplementation from the curve25519 paper. It
-- * uses many of the tricks described therein. Only the crecip function is taken
-- * from the sample implementation.
-- */
-+crypto25519.c:
-+crypto26619.h:
-+
-+Modified TweetNaCl version 20140427, a self-contained public-domain C library.
-+https://tweetnacl.cr.yp.to/
-+
-+Contributors (alphabetical order)
-+Daniel J. Bernstein, University of Illinois at Chicago and Technische
-+Universiteit Eindhoven
-+Bernard van Gastel, Radboud Universiteit Nijmegen
-+Wesley Janssen, Radboud Universiteit Nijmegen
-+Tanja Lange, Technische Universiteit Eindhoven
-+Peter Schwabe, Radboud Universiteit Nijmegen
-+Sjaak Smetsers, Radboud Universiteit Nijmegen
-+
-+Acknowledgments
-+This work was supported by the U.S. National Science Foundation under grant
-+1018836. "Any opinions, findings, and conclusions or recommendations expressed
-+in this material are those of the author(s) and do not necessarily reflect the
-+views of the National Science Foundation."
-+This work was supported by the Netherlands Organisation for Scientific
-+Research (NWO) under grant 639.073.005 and Veni 2013 project 13114.
-diff --git a/Makefile.in b/Makefile.in
-index bc55b7d..aaf7b3b 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -36,8 +36,9 @@ COMMONOBJS=dbutil.o buffer.o dbhelpers.o \
- queue.o \
- atomicio.o compat.o fake-rfc2553.o \
- ltc_prng.o ecc.o ecdsa.o crypto_desc.o \
-+ curve25519.o ed25519.o \
- dbmalloc.o \
-- gensignkey.o gendss.o genrsa.o
-+ gensignkey.o gendss.o genrsa.o gened25519.o
-
- SVROBJS=svr-kex.o svr-auth.o sshpty.o \
- svr-authpasswd.o svr-authpubkey.o svr-authpubkeyoptions.o svr-session.o svr-service.o \
-@@ -52,7 +53,7 @@ CLIOBJS=cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
- CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
- common-channel.o common-chansession.o termcodes.o loginrec.o \
- tcp-accept.o listener.o process-packet.o dh_groups.o \
-- common-runopts.o circbuffer.o curve25519-donna.o list.o netio.o
-+ common-runopts.o circbuffer.o list.o netio.o
-
- KEYOBJS=dropbearkey.o
-
-@@ -264,7 +265,7 @@ tidy:
- ## Fuzzing targets
-
- # list of fuzz targets
--FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey fuzzer-verify fuzzer-preauth_nomaths fuzzer-kexdh fuzzer-kexecdh
-+FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey fuzzer-verify fuzzer-preauth_nomaths fuzzer-kexdh fuzzer-kexecdh fuzzer-kexcurve25519
-
- FUZZER_OPTIONS = $(addsuffix .options, $(FUZZ_TARGETS))
-
-@@ -303,6 +304,9 @@ fuzzer-kexdh: fuzzer-kexdh.o fuzz-harness.o
- fuzzer-kexecdh: fuzzer-kexecdh.o fuzz-harness.o
- $(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@
-
-+fuzzer-kexcurve25519: fuzzer-kexcurve25519.o fuzz-harness.o
-+ $(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@
-+
- fuzzer-%.options: Makefile
- echo "[libfuzzer]" > $@
- echo "max_len = 50000" >> $@
-@@ -313,7 +317,9 @@ fuzz-hostkeys:
- dropbearkey -t rsa -f keyr
- dropbearkey -t dss -f keyd
- dropbearkey -t ecdsa -size 256 -f keye
-+ dropbearkey -t ed25519 -f keyed25519
- echo > hostkeys.c
- /usr/bin/xxd -i -a keyr >> hostkeys.c
- /usr/bin/xxd -i -a keye >> hostkeys.c
- /usr/bin/xxd -i -a keyd >> hostkeys.c
-+ /usr/bin/xxd -i -a keyed25519 >> hostkeys.c
-diff --git a/README b/README
-index b8a6fd2..d197ec7 100644
---- a/README
-+++ b/README
-@@ -55,6 +55,7 @@ To run the server, you need to generate server keys, this is one-off:
- ./dropbearkey -t rsa -f dropbear_rsa_host_key
- ./dropbearkey -t dss -f dropbear_dss_host_key
- ./dropbearkey -t ecdsa -f dropbear_ecdsa_host_key
-+./dropbearkey -t ed25519 -f dropbear_ed25519_host_key
-
- or alternatively convert OpenSSH keys to Dropbear:
- ./dropbearconvert openssh dropbear /etc/ssh/ssh_host_dsa_key dropbear_dss_host_key
-diff --git a/cli-kex.c b/cli-kex.c
-index b02cfc7..7cefb5f 100644
---- a/cli-kex.c
-+++ b/cli-kex.c
-@@ -81,7 +81,7 @@ void send_msg_kexdh_init() {
- }
- cli_ses.curve25519_param = gen_kexcurve25519_param();
- }
-- buf_putstring(ses.writepayload, (const char*)cli_ses.curve25519_param->pub, CURVE25519_LEN);
-+ buf_putstring(ses.writepayload, cli_ses.curve25519_param->pub, CURVE25519_LEN);
- break;
- #endif
- }
-diff --git a/common-algo.c b/common-algo.c
-index 2f896ab..558aad2 100644
---- a/common-algo.c
-+++ b/common-algo.c
-@@ -222,6 +222,9 @@ algo_type ssh_nocompress[] = {
- };
-
- algo_type sshhostkey[] = {
-+#if DROPBEAR_ED25519
-+ {"ssh-ed25519", DROPBEAR_SIGNKEY_ED25519, NULL, 1, NULL},
-+#endif
- #if DROPBEAR_ECDSA
- #if DROPBEAR_ECC_256
- {"ecdsa-sha2-nistp256", DROPBEAR_SIGNKEY_ECDSA_NISTP256, NULL, 1, NULL},
-diff --git a/common-kex.c b/common-kex.c
-index d4933dd..16b7e27 100644
---- a/common-kex.c
-+++ b/common-kex.c
-@@ -36,6 +36,7 @@
- #include "dbrandom.h"
- #include "runopts.h"
- #include "ecc.h"
-+#include "curve25519.h"
- #include "crypto_desc.h"
-
- static void kexinitialise(void);
-@@ -703,23 +704,18 @@ void kexecdh_comb_key(struct kex_ecdh_param *param, buffer *pub_them,
- #endif /* DROPBEAR_ECDH */
-
- #if DROPBEAR_CURVE25519
--struct kex_curve25519_param *gen_kexcurve25519_param () {
-+struct kex_curve25519_param *gen_kexcurve25519_param() {
- /* Per http://cr.yp.to/ecdh.html */
- struct kex_curve25519_param *param = m_malloc(sizeof(*param));
- const unsigned char basepoint[32] = {9};
-
- genrandom(param->priv, CURVE25519_LEN);
-- param->priv[0] &= 248;
-- param->priv[31] &= 127;
-- param->priv[31] |= 64;
--
-- curve25519_donna(param->pub, param->priv, basepoint);
-+ dropbear_curve25519_scalarmult(param->pub, param->priv, basepoint);
-
- return param;
- }
-
--void free_kexcurve25519_param(struct kex_curve25519_param *param)
--{
-+void free_kexcurve25519_param(struct kex_curve25519_param *param) {
- m_burn(param->priv, CURVE25519_LEN);
- m_free(param);
- }
-@@ -736,7 +732,7 @@ void kexcurve25519_comb_key(const struct kex_curve25519_param *param, const buff
- dropbear_exit("Bad curve25519");
- }
-
-- curve25519_donna(out, param->priv, buf_pub_them->data);
-+ dropbear_curve25519_scalarmult(out, param->priv, buf_pub_them->data);
-
- if (constant_time_memcmp(zeroes, out, CURVE25519_LEN) == 0) {
- dropbear_exit("Bad curve25519");
-diff --git a/curve25519-donna.c b/curve25519-donna.c
-deleted file mode 100644
-index ef0b6d1..0000000
---- a/curve25519-donna.c
-+++ /dev/null
-@@ -1,860 +0,0 @@
--/* Copyright 2008, Google Inc.
-- * All rights reserved.
-- *
-- * Redistribution and use in source and binary forms, with or without
-- * modification, are permitted provided that the following conditions are
-- * met:
-- *
-- * * Redistributions of source code must retain the above copyright
-- * notice, this list of conditions and the following disclaimer.
-- * * Redistributions in binary form must reproduce the above
-- * copyright notice, this list of conditions and the following disclaimer
-- * in the documentation and/or other materials provided with the
-- * distribution.
-- * * Neither the name of Google Inc. nor the names of its
-- * contributors may be used to endorse or promote products derived from
-- * this software without specific prior written permission.
-- *
-- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-- *
-- * curve25519-donna: Curve25519 elliptic curve, public key function
-- *
-- * http://code.google.com/p/curve25519-donna/
-- *
-- * Adam Langley <agl@imperialviolet.org>
-- *
-- * Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
-- *
-- * More information about curve25519 can be found here
-- * http://cr.yp.to/ecdh.html
-- *
-- * djb's sample implementation of curve25519 is written in a special assembly
-- * language called qhasm and uses the floating point registers.
-- *
-- * This is, almost, a clean room reimplementation from the curve25519 paper. It
-- * uses many of the tricks described therein. Only the crecip function is taken
-- * from the sample implementation. */
--
--#include <string.h>
--#include <stdint.h>
--
--#ifdef _MSC_VER
--#define inline __inline
--#endif
--
--typedef uint8_t u8;
--typedef int32_t s32;
--typedef int64_t limb;
--
--/* Field element representation:
-- *
-- * Field elements are written as an array of signed, 64-bit limbs, least
-- * significant first. The value of the field element is:
-- * x[0] + 2^26·x[1] + x^51·x[2] + 2^102·x[3] + ...
-- *
-- * i.e. the limbs are 26, 25, 26, 25, ... bits wide. */
--
--/* Sum two numbers: output += in */
--static void fsum(limb *output, const limb *in) {
-- unsigned i;
-- for (i = 0; i < 10; i += 2) {
-- output[0+i] = output[0+i] + in[0+i];
-- output[1+i] = output[1+i] + in[1+i];
-- }
--}
--
--/* Find the difference of two numbers: output = in - output
-- * (note the order of the arguments!). */
--static void fdifference(limb *output, const limb *in) {
-- unsigned i;
-- for (i = 0; i < 10; ++i) {
-- output[i] = in[i] - output[i];
-- }
--}
--
--/* Multiply a number by a scalar: output = in * scalar */
--static void fscalar_product(limb *output, const limb *in, const limb scalar) {
-- unsigned i;
-- for (i = 0; i < 10; ++i) {
-- output[i] = in[i] * scalar;
-- }
--}
--
--/* Multiply two numbers: output = in2 * in
-- *
-- * output must be distinct to both inputs. The inputs are reduced coefficient
-- * form, the output is not.
-- *
-- * output[x] <= 14 * the largest product of the input limbs. */
--static void fproduct(limb *output, const limb *in2, const limb *in) {
-- output[0] = ((limb) ((s32) in2[0])) * ((s32) in[0]);
-- output[1] = ((limb) ((s32) in2[0])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[0]);
-- output[2] = 2 * ((limb) ((s32) in2[1])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[0]);
-- output[3] = ((limb) ((s32) in2[1])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[0]);
-- output[4] = ((limb) ((s32) in2[2])) * ((s32) in[2]) +
-- 2 * (((limb) ((s32) in2[1])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[1])) +
-- ((limb) ((s32) in2[0])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[0]);
-- output[5] = ((limb) ((s32) in2[2])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[0]);
-- output[6] = 2 * (((limb) ((s32) in2[3])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[1])) +
-- ((limb) ((s32) in2[2])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[0]);
-- output[7] = ((limb) ((s32) in2[3])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[0]);
-- output[8] = ((limb) ((s32) in2[4])) * ((s32) in[4]) +
-- 2 * (((limb) ((s32) in2[3])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[1])) +
-- ((limb) ((s32) in2[2])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[0]);
-- output[9] = ((limb) ((s32) in2[4])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[2]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[1]) +
-- ((limb) ((s32) in2[0])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[0]);
-- output[10] = 2 * (((limb) ((s32) in2[5])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[1])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[1])) +
-- ((limb) ((s32) in2[4])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[2]);
-- output[11] = ((limb) ((s32) in2[5])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[4]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[3]) +
-- ((limb) ((s32) in2[2])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[2]);
-- output[12] = ((limb) ((s32) in2[6])) * ((s32) in[6]) +
-- 2 * (((limb) ((s32) in2[5])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[3])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[3])) +
-- ((limb) ((s32) in2[4])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[4]);
-- output[13] = ((limb) ((s32) in2[6])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[7])) * ((s32) in[6]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[5]) +
-- ((limb) ((s32) in2[4])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[4]);
-- output[14] = 2 * (((limb) ((s32) in2[7])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[5])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[5])) +
-- ((limb) ((s32) in2[6])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[6]);
-- output[15] = ((limb) ((s32) in2[7])) * ((s32) in[8]) +
-- ((limb) ((s32) in2[8])) * ((s32) in[7]) +
-- ((limb) ((s32) in2[6])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[6]);
-- output[16] = ((limb) ((s32) in2[8])) * ((s32) in[8]) +
-- 2 * (((limb) ((s32) in2[7])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[7]));
-- output[17] = ((limb) ((s32) in2[8])) * ((s32) in[9]) +
-- ((limb) ((s32) in2[9])) * ((s32) in[8]);
-- output[18] = 2 * ((limb) ((s32) in2[9])) * ((s32) in[9]);
--}
--
--/* Reduce a long form to a short form by taking the input mod 2^255 - 19.
-- *
-- * On entry: |output[i]| < 14*2^54
-- * On exit: |output[0..8]| < 280*2^54 */
--static void freduce_degree(limb *output) {
-- /* Each of these shifts and adds ends up multiplying the value by 19.
-- *
-- * For output[0..8], the absolute entry value is < 14*2^54 and we add, at
-- * most, 19*14*2^54 thus, on exit, |output[0..8]| < 280*2^54. */
-- output[8] += output[18] << 4;
-- output[8] += output[18] << 1;
-- output[8] += output[18];
-- output[7] += output[17] << 4;
-- output[7] += output[17] << 1;
-- output[7] += output[17];
-- output[6] += output[16] << 4;
-- output[6] += output[16] << 1;
-- output[6] += output[16];
-- output[5] += output[15] << 4;
-- output[5] += output[15] << 1;
-- output[5] += output[15];
-- output[4] += output[14] << 4;
-- output[4] += output[14] << 1;
-- output[4] += output[14];
-- output[3] += output[13] << 4;
-- output[3] += output[13] << 1;
-- output[3] += output[13];
-- output[2] += output[12] << 4;
-- output[2] += output[12] << 1;
-- output[2] += output[12];
-- output[1] += output[11] << 4;
-- output[1] += output[11] << 1;
-- output[1] += output[11];
-- output[0] += output[10] << 4;
-- output[0] += output[10] << 1;
-- output[0] += output[10];
--}
--
--#if (-1 & 3) != 3
--#error "This code only works on a two's complement system"
--#endif
--
--/* return v / 2^26, using only shifts and adds.
-- *
-- * On entry: v can take any value. */
--static inline limb
--div_by_2_26(const limb v)
--{
-- /* High word of v; no shift needed. */
-- const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
-- /* Set to all 1s if v was negative; else set to 0s. */
-- const int32_t sign = ((int32_t) highword) >> 31;
-- /* Set to 0x3ffffff if v was negative; else set to 0. */
-- const int32_t roundoff = ((uint32_t) sign) >> 6;
-- /* Should return v / (1<<26) */
-- return (v + roundoff) >> 26;
--}
--
--/* return v / (2^25), using only shifts and adds.
-- *
-- * On entry: v can take any value. */
--static inline limb
--div_by_2_25(const limb v)
--{
-- /* High word of v; no shift needed*/
-- const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);
-- /* Set to all 1s if v was negative; else set to 0s. */
-- const int32_t sign = ((int32_t) highword) >> 31;
-- /* Set to 0x1ffffff if v was negative; else set to 0. */
-- const int32_t roundoff = ((uint32_t) sign) >> 7;
-- /* Should return v / (1<<25) */
-- return (v + roundoff) >> 25;
--}
--
--/* Reduce all coefficients of the short form input so that |x| < 2^26.
-- *
-- * On entry: |output[i]| < 280*2^54 */
--static void freduce_coefficients(limb *output) {
-- unsigned i;
--
-- output[10] = 0;
--
-- for (i = 0; i < 10; i += 2) {
-- limb over = div_by_2_26(output[i]);
-- /* The entry condition (that |output[i]| < 280*2^54) means that over is, at
-- * most, 280*2^28 in the first iteration of this loop. This is added to the
-- * next limb and we can approximate the resulting bound of that limb by
-- * 281*2^54. */
-- output[i] -= over << 26;
-- output[i+1] += over;
--
-- /* For the first iteration, |output[i+1]| < 281*2^54, thus |over| <
-- * 281*2^29. When this is added to the next limb, the resulting bound can
-- * be approximated as 281*2^54.
-- *
-- * For subsequent iterations of the loop, 281*2^54 remains a conservative
-- * bound and no overflow occurs. */
-- over = div_by_2_25(output[i+1]);
-- output[i+1] -= over << 25;
-- output[i+2] += over;
-- }
-- /* Now |output[10]| < 281*2^29 and all other coefficients are reduced. */
-- output[0] += output[10] << 4;
-- output[0] += output[10] << 1;
-- output[0] += output[10];
--
-- output[10] = 0;
--
-- /* Now output[1..9] are reduced, and |output[0]| < 2^26 + 19*281*2^29
-- * So |over| will be no more than 2^16. */
-- {
-- limb over = div_by_2_26(output[0]);
-- output[0] -= over << 26;
-- output[1] += over;
-- }
--
-- /* Now output[0,2..9] are reduced, and |output[1]| < 2^25 + 2^16 < 2^26. The
-- * bound on |output[1]| is sufficient to meet our needs. */
--}
--
--/* A helpful wrapper around fproduct: output = in * in2.
-- *
-- * On entry: |in[i]| < 2^27 and |in2[i]| < 2^27.
-- *
-- * output must be distinct to both inputs. The output is reduced degree
-- * (indeed, one need only provide storage for 10 limbs) and |output[i]| < 2^26. */
--static void
--fmul(limb *output, const limb *in, const limb *in2) {
-- limb t[19];
-- fproduct(t, in, in2);
-- /* |t[i]| < 14*2^54 */
-- freduce_degree(t);
-- freduce_coefficients(t);
-- /* |t[i]| < 2^26 */
-- memcpy(output, t, sizeof(limb) * 10);
--}
--
--/* Square a number: output = in**2
-- *
-- * output must be distinct from the input. The inputs are reduced coefficient
-- * form, the output is not.
-- *
-- * output[x] <= 14 * the largest product of the input limbs. */
--static void fsquare_inner(limb *output, const limb *in) {
-- output[0] = ((limb) ((s32) in[0])) * ((s32) in[0]);
-- output[1] = 2 * ((limb) ((s32) in[0])) * ((s32) in[1]);
-- output[2] = 2 * (((limb) ((s32) in[1])) * ((s32) in[1]) +
-- ((limb) ((s32) in[0])) * ((s32) in[2]));
-- output[3] = 2 * (((limb) ((s32) in[1])) * ((s32) in[2]) +
-- ((limb) ((s32) in[0])) * ((s32) in[3]));
-- output[4] = ((limb) ((s32) in[2])) * ((s32) in[2]) +
-- 4 * ((limb) ((s32) in[1])) * ((s32) in[3]) +
-- 2 * ((limb) ((s32) in[0])) * ((s32) in[4]);
-- output[5] = 2 * (((limb) ((s32) in[2])) * ((s32) in[3]) +
-- ((limb) ((s32) in[1])) * ((s32) in[4]) +
-- ((limb) ((s32) in[0])) * ((s32) in[5]));
-- output[6] = 2 * (((limb) ((s32) in[3])) * ((s32) in[3]) +
-- ((limb) ((s32) in[2])) * ((s32) in[4]) +
-- ((limb) ((s32) in[0])) * ((s32) in[6]) +
-- 2 * ((limb) ((s32) in[1])) * ((s32) in[5]));
-- output[7] = 2 * (((limb) ((s32) in[3])) * ((s32) in[4]) +
-- ((limb) ((s32) in[2])) * ((s32) in[5]) +
-- ((limb) ((s32) in[1])) * ((s32) in[6]) +
-- ((limb) ((s32) in[0])) * ((s32) in[7]));
-- output[8] = ((limb) ((s32) in[4])) * ((s32) in[4]) +
-- 2 * (((limb) ((s32) in[2])) * ((s32) in[6]) +
-- ((limb) ((s32) in[0])) * ((s32) in[8]) +
-- 2 * (((limb) ((s32) in[1])) * ((s32) in[7]) +
-- ((limb) ((s32) in[3])) * ((s32) in[5])));
-- output[9] = 2 * (((limb) ((s32) in[4])) * ((s32) in[5]) +
-- ((limb) ((s32) in[3])) * ((s32) in[6]) +
-- ((limb) ((s32) in[2])) * ((s32) in[7]) +
-- ((limb) ((s32) in[1])) * ((s32) in[8]) +
-- ((limb) ((s32) in[0])) * ((s32) in[9]));
-- output[10] = 2 * (((limb) ((s32) in[5])) * ((s32) in[5]) +
-- ((limb) ((s32) in[4])) * ((s32) in[6]) +
-- ((limb) ((s32) in[2])) * ((s32) in[8]) +
-- 2 * (((limb) ((s32) in[3])) * ((s32) in[7]) +
-- ((limb) ((s32) in[1])) * ((s32) in[9])));
-- output[11] = 2 * (((limb) ((s32) in[5])) * ((s32) in[6]) +
-- ((limb) ((s32) in[4])) * ((s32) in[7]) +
-- ((limb) ((s32) in[3])) * ((s32) in[8]) +
-- ((limb) ((s32) in[2])) * ((s32) in[9]));
-- output[12] = ((limb) ((s32) in[6])) * ((s32) in[6]) +
-- 2 * (((limb) ((s32) in[4])) * ((s32) in[8]) +
-- 2 * (((limb) ((s32) in[5])) * ((s32) in[7]) +
-- ((limb) ((s32) in[3])) * ((s32) in[9])));
-- output[13] = 2 * (((limb) ((s32) in[6])) * ((s32) in[7]) +
-- ((limb) ((s32) in[5])) * ((s32) in[8]) +
-- ((limb) ((s32) in[4])) * ((s32) in[9]));
-- output[14] = 2 * (((limb) ((s32) in[7])) * ((s32) in[7]) +
-- ((limb) ((s32) in[6])) * ((s32) in[8]) +
-- 2 * ((limb) ((s32) in[5])) * ((s32) in[9]));
-- output[15] = 2 * (((limb) ((s32) in[7])) * ((s32) in[8]) +
-- ((limb) ((s32) in[6])) * ((s32) in[9]));
-- output[16] = ((limb) ((s32) in[8])) * ((s32) in[8]) +
-- 4 * ((limb) ((s32) in[7])) * ((s32) in[9]);
-- output[17] = 2 * ((limb) ((s32) in[8])) * ((s32) in[9]);
-- output[18] = 2 * ((limb) ((s32) in[9])) * ((s32) in[9]);
--}
--
--/* fsquare sets output = in^2.
-- *
-- * On entry: The |in| argument is in reduced coefficients form and |in[i]| <
-- * 2^27.
-- *
-- * On exit: The |output| argument is in reduced coefficients form (indeed, one
-- * need only provide storage for 10 limbs) and |out[i]| < 2^26. */
--static void
--fsquare(limb *output, const limb *in) {
-- limb t[19];
-- fsquare_inner(t, in);
-- /* |t[i]| < 14*2^54 because the largest product of two limbs will be <
-- * 2^(27+27) and fsquare_inner adds together, at most, 14 of those
-- * products. */
-- freduce_degree(t);
-- freduce_coefficients(t);
-- /* |t[i]| < 2^26 */
-- memcpy(output, t, sizeof(limb) * 10);
--}
--
--/* Take a little-endian, 32-byte number and expand it into polynomial form */
--static void
--fexpand(limb *output, const u8 *input) {
--#define F(n,start,shift,mask) \
-- output[n] = ((((limb) input[start + 0]) | \
-- ((limb) input[start + 1]) << 8 | \
-- ((limb) input[start + 2]) << 16 | \
-- ((limb) input[start + 3]) << 24) >> shift) & mask;
-- F(0, 0, 0, 0x3ffffff);
-- F(1, 3, 2, 0x1ffffff);
-- F(2, 6, 3, 0x3ffffff);
-- F(3, 9, 5, 0x1ffffff);
-- F(4, 12, 6, 0x3ffffff);
-- F(5, 16, 0, 0x1ffffff);
-- F(6, 19, 1, 0x3ffffff);
-- F(7, 22, 3, 0x1ffffff);
-- F(8, 25, 4, 0x3ffffff);
-- F(9, 28, 6, 0x1ffffff);
--#undef F
--}
--
--#if (-32 >> 1) != -16
--#error "This code only works when >> does sign-extension on negative numbers"
--#endif
--
--/* s32_eq returns 0xffffffff iff a == b and zero otherwise. */
--static s32 s32_eq(s32 a, s32 b) {
-- a = ~(a ^ b);
-- a &= a << 16;
-- a &= a << 8;
-- a &= a << 4;
-- a &= a << 2;
-- a &= a << 1;
-- return a >> 31;
--}
--
--/* s32_gte returns 0xffffffff if a >= b and zero otherwise, where a and b are
-- * both non-negative. */
--static s32 s32_gte(s32 a, s32 b) {
-- a -= b;
-- /* a >= 0 iff a >= b. */
-- return ~(a >> 31);
--}
--
--/* Take a fully reduced polynomial form number and contract it into a
-- * little-endian, 32-byte array.
-- *
-- * On entry: |input_limbs[i]| < 2^26 */
--static void
--fcontract(u8 *output, limb *input_limbs) {
-- int i;
-- int j;
-- s32 input[10];
-- s32 mask;
--
-- /* |input_limbs[i]| < 2^26, so it's valid to convert to an s32. */
-- for (i = 0; i < 10; i++) {
-- input[i] = input_limbs[i];
-- }
--
-- for (j = 0; j < 2; ++j) {
-- for (i = 0; i < 9; ++i) {
-- if ((i & 1) == 1) {
-- /* This calculation is a time-invariant way to make input[i]
-- * non-negative by borrowing from the next-larger limb. */
-- const s32 mask = input[i] >> 31;
-- const s32 carry = -((input[i] & mask) >> 25);
-- input[i] = input[i] + (carry << 25);
-- input[i+1] = input[i+1] - carry;
-- } else {
-- const s32 mask = input[i] >> 31;
-- const s32 carry = -((input[i] & mask) >> 26);
-- input[i] = input[i] + (carry << 26);
-- input[i+1] = input[i+1] - carry;
-- }
-- }
--
-- /* There's no greater limb for input[9] to borrow from, but we can multiply
-- * by 19 and borrow from input[0], which is valid mod 2^255-19. */
-- {
-- const s32 mask = input[9] >> 31;
-- const s32 carry = -((input[9] & mask) >> 25);
-- input[9] = input[9] + (carry << 25);
-- input[0] = input[0] - (carry * 19);
-- }
--
-- /* After the first iteration, input[1..9] are non-negative and fit within
-- * 25 or 26 bits, depending on position. However, input[0] may be
-- * negative. */
-- }
--
-- /* The first borrow-propagation pass above ended with every limb
-- except (possibly) input[0] non-negative.
--
-- If input[0] was negative after the first pass, then it was because of a
-- carry from input[9]. On entry, input[9] < 2^26 so the carry was, at most,
-- one, since (2**26-1) >> 25 = 1. Thus input[0] >= -19.
--
-- In the second pass, each limb is decreased by at most one. Thus the second
-- borrow-propagation pass could only have wrapped around to decrease
-- input[0] again if the first pass left input[0] negative *and* input[1]
-- through input[9] were all zero. In that case, input[1] is now 2^25 - 1,
-- and this last borrow-propagation step will leave input[1] non-negative. */
-- {
-- const s32 mask = input[0] >> 31;
-- const s32 carry = -((input[0] & mask) >> 26);
-- input[0] = input[0] + (carry << 26);
-- input[1] = input[1] - carry;
-- }
--
-- /* All input[i] are now non-negative. However, there might be values between
-- * 2^25 and 2^26 in a limb which is, nominally, 25 bits wide. */
-- for (j = 0; j < 2; j++) {
-- for (i = 0; i < 9; i++) {
-- if ((i & 1) == 1) {
-- const s32 carry = input[i] >> 25;
-- input[i] &= 0x1ffffff;
-- input[i+1] += carry;
-- } else {
-- const s32 carry = input[i] >> 26;
-- input[i] &= 0x3ffffff;
-- input[i+1] += carry;
-- }
-- }
--
-- {
-- const s32 carry = input[9] >> 25;
-- input[9] &= 0x1ffffff;
-- input[0] += 19*carry;
-- }
-- }
--
-- /* If the first carry-chain pass, just above, ended up with a carry from
-- * input[9], and that caused input[0] to be out-of-bounds, then input[0] was
-- * < 2^26 + 2*19, because the carry was, at most, two.
-- *
-- * If the second pass carried from input[9] again then input[0] is < 2*19 and
-- * the input[9] -> input[0] carry didn't push input[0] out of bounds. */
--
-- /* It still remains the case that input might be between 2^255-19 and 2^255.
-- * In this case, input[1..9] must take their maximum value and input[0] must
-- * be >= (2^255-19) & 0x3ffffff, which is 0x3ffffed. */
-- mask = s32_gte(input[0], 0x3ffffed);
-- for (i = 1; i < 10; i++) {
-- if ((i & 1) == 1) {
-- mask &= s32_eq(input[i], 0x1ffffff);
-- } else {
-- mask &= s32_eq(input[i], 0x3ffffff);
-- }
-- }
--
-- /* mask is either 0xffffffff (if input >= 2^255-19) and zero otherwise. Thus
-- * this conditionally subtracts 2^255-19. */
-- input[0] -= mask & 0x3ffffed;
--
-- for (i = 1; i < 10; i++) {
-- if ((i & 1) == 1) {
-- input[i] -= mask & 0x1ffffff;
-- } else {
-- input[i] -= mask & 0x3ffffff;
-- }
-- }
--
-- input[1] <<= 2;
-- input[2] <<= 3;
-- input[3] <<= 5;
-- input[4] <<= 6;
-- input[6] <<= 1;
-- input[7] <<= 3;
-- input[8] <<= 4;
-- input[9] <<= 6;
--#define F(i, s) \
-- output[s+0] |= input[i] & 0xff; \
-- output[s+1] = (input[i] >> 8) & 0xff; \
-- output[s+2] = (input[i] >> 16) & 0xff; \
-- output[s+3] = (input[i] >> 24) & 0xff;
-- output[0] = 0;
-- output[16] = 0;
-- F(0,0);
-- F(1,3);
-- F(2,6);
-- F(3,9);
-- F(4,12);
-- F(5,16);
-- F(6,19);
-- F(7,22);
-- F(8,25);
-- F(9,28);
--#undef F
--}
--
--/* Input: Q, Q', Q-Q'
-- * Output: 2Q, Q+Q'
-- *
-- * x2 z3: long form
-- * x3 z3: long form
-- * x z: short form, destroyed
-- * xprime zprime: short form, destroyed
-- * qmqp: short form, preserved
-- *
-- * On entry and exit, the absolute value of the limbs of all inputs and outputs
-- * are < 2^26. */
--static void fmonty(limb *x2, limb *z2, /* output 2Q */
-- limb *x3, limb *z3, /* output Q + Q' */
-- limb *x, limb *z, /* input Q */
-- limb *xprime, limb *zprime, /* input Q' */
-- const limb *qmqp /* input Q - Q' */) {
-- limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],
-- zzprime[19], zzzprime[19], xxxprime[19];
--
-- memcpy(origx, x, 10 * sizeof(limb));
-- fsum(x, z);
-- /* |x[i]| < 2^27 */
-- fdifference(z, origx); /* does x - z */
-- /* |z[i]| < 2^27 */
--
-- memcpy(origxprime, xprime, sizeof(limb) * 10);
-- fsum(xprime, zprime);
-- /* |xprime[i]| < 2^27 */
-- fdifference(zprime, origxprime);
-- /* |zprime[i]| < 2^27 */
-- fproduct(xxprime, xprime, z);
-- /* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <
-- * 2^(27+27) and fproduct adds together, at most, 14 of those products.
-- * (Approximating that to 2^58 doesn't work out.) */
-- fproduct(zzprime, x, zprime);
-- /* |zzprime[i]| < 14*2^54 */
-- freduce_degree(xxprime);
-- freduce_coefficients(xxprime);
-- /* |xxprime[i]| < 2^26 */
-- freduce_degree(zzprime);
-- freduce_coefficients(zzprime);
-- /* |zzprime[i]| < 2^26 */
-- memcpy(origxprime, xxprime, sizeof(limb) * 10);
-- fsum(xxprime, zzprime);
-- /* |xxprime[i]| < 2^27 */
-- fdifference(zzprime, origxprime);
-- /* |zzprime[i]| < 2^27 */
-- fsquare(xxxprime, xxprime);
-- /* |xxxprime[i]| < 2^26 */
-- fsquare(zzzprime, zzprime);
-- /* |zzzprime[i]| < 2^26 */
-- fproduct(zzprime, zzzprime, qmqp);
-- /* |zzprime[i]| < 14*2^52 */
-- freduce_degree(zzprime);
-- freduce_coefficients(zzprime);
-- /* |zzprime[i]| < 2^26 */
-- memcpy(x3, xxxprime, sizeof(limb) * 10);
-- memcpy(z3, zzprime, sizeof(limb) * 10);
--
-- fsquare(xx, x);
-- /* |xx[i]| < 2^26 */
-- fsquare(zz, z);
-- /* |zz[i]| < 2^26 */
-- fproduct(x2, xx, zz);
-- /* |x2[i]| < 14*2^52 */
-- freduce_degree(x2);
-- freduce_coefficients(x2);
-- /* |x2[i]| < 2^26 */
-- fdifference(zz, xx); /* does zz = xx - zz */
-- /* |zz[i]| < 2^27 */
-- memset(zzz + 10, 0, sizeof(limb) * 9);
-- fscalar_product(zzz, zz, 121665);
-- /* |zzz[i]| < 2^(27+17) */
-- /* No need to call freduce_degree here:
-- fscalar_product doesn't increase the degree of its input. */
-- freduce_coefficients(zzz);
-- /* |zzz[i]| < 2^26 */
-- fsum(zzz, xx);
-- /* |zzz[i]| < 2^27 */
-- fproduct(z2, zz, zzz);
-- /* |z2[i]| < 14*2^(26+27) */
-- freduce_degree(z2);
-- freduce_coefficients(z2);
-- /* |z2|i| < 2^26 */
--}
--
--/* Conditionally swap two reduced-form limb arrays if 'iswap' is 1, but leave
-- * them unchanged if 'iswap' is 0. Runs in data-invariant time to avoid
-- * side-channel attacks.
-- *
-- * NOTE that this function requires that 'iswap' be 1 or 0; other values give
-- * wrong results. Also, the two limb arrays must be in reduced-coefficient,
-- * reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
-- * and all all values in a[0..9],b[0..9] must have magnitude less than
-- * INT32_MAX. */
--static void
--swap_conditional(limb a[19], limb b[19], limb iswap) {
-- unsigned i;
-- const s32 swap = (s32) -iswap;
--
-- for (i = 0; i < 10; ++i) {
-- const s32 x = swap & ( ((s32)a[i]) ^ ((s32)b[i]) );
-- a[i] = ((s32)a[i]) ^ x;
-- b[i] = ((s32)b[i]) ^ x;
-- }
--}
--
--/* Calculates nQ where Q is the x-coordinate of a point on the curve
-- *
-- * resultx/resultz: the x coordinate of the resulting curve point (short form)
-- * n: a little endian, 32-byte number
-- * q: a point of the curve (short form) */
--static void
--cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
-- limb a[19] = {0}, b[19] = {1}, c[19] = {1}, d[19] = {0};
-- limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
-- limb e[19] = {0}, f[19] = {1}, g[19] = {0}, h[19] = {1};
-- limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
--
-- unsigned i, j;
--
-- memcpy(nqpqx, q, sizeof(limb) * 10);
--
-- for (i = 0; i < 32; ++i) {
-- u8 byte = n[31 - i];
-- for (j = 0; j < 8; ++j) {
-- const limb bit = byte >> 7;
--
-- swap_conditional(nqx, nqpqx, bit);
-- swap_conditional(nqz, nqpqz, bit);
-- fmonty(nqx2, nqz2,
-- nqpqx2, nqpqz2,
-- nqx, nqz,
-- nqpqx, nqpqz,
-- q);
-- swap_conditional(nqx2, nqpqx2, bit);
-- swap_conditional(nqz2, nqpqz2, bit);
--
-- t = nqx;
-- nqx = nqx2;
-- nqx2 = t;
-- t = nqz;
-- nqz = nqz2;
-- nqz2 = t;
-- t = nqpqx;
-- nqpqx = nqpqx2;
-- nqpqx2 = t;
-- t = nqpqz;
-- nqpqz = nqpqz2;
-- nqpqz2 = t;
--
-- byte <<= 1;
-- }
-- }
--
-- memcpy(resultx, nqx, sizeof(limb) * 10);
-- memcpy(resultz, nqz, sizeof(limb) * 10);
--}
--
--/* -----------------------------------------------------------------------------
-- * Shamelessly copied from djb's code
-- * ----------------------------------------------------------------------------- */
--static void
--crecip(limb *out, const limb *z) {
-- limb z2[10];
-- limb z9[10];
-- limb z11[10];
-- limb z2_5_0[10];
-- limb z2_10_0[10];
-- limb z2_20_0[10];
-- limb z2_50_0[10];
-- limb z2_100_0[10];
-- limb t0[10];
-- limb t1[10];
-- int i;
--
-- /* 2 */ fsquare(z2,z);
-- /* 4 */ fsquare(t1,z2);
-- /* 8 */ fsquare(t0,t1);
-- /* 9 */ fmul(z9,t0,z);
-- /* 11 */ fmul(z11,z9,z2);
-- /* 22 */ fsquare(t0,z11);
-- /* 2^5 - 2^0 = 31 */ fmul(z2_5_0,t0,z9);
--
-- /* 2^6 - 2^1 */ fsquare(t0,z2_5_0);
-- /* 2^7 - 2^2 */ fsquare(t1,t0);
-- /* 2^8 - 2^3 */ fsquare(t0,t1);
-- /* 2^9 - 2^4 */ fsquare(t1,t0);
-- /* 2^10 - 2^5 */ fsquare(t0,t1);
-- /* 2^10 - 2^0 */ fmul(z2_10_0,t0,z2_5_0);
--
-- /* 2^11 - 2^1 */ fsquare(t0,z2_10_0);
-- /* 2^12 - 2^2 */ fsquare(t1,t0);
-- /* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
-- /* 2^20 - 2^0 */ fmul(z2_20_0,t1,z2_10_0);
--
-- /* 2^21 - 2^1 */ fsquare(t0,z2_20_0);
-- /* 2^22 - 2^2 */ fsquare(t1,t0);
-- /* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
-- /* 2^40 - 2^0 */ fmul(t0,t1,z2_20_0);
--
-- /* 2^41 - 2^1 */ fsquare(t1,t0);
-- /* 2^42 - 2^2 */ fsquare(t0,t1);
-- /* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
-- /* 2^50 - 2^0 */ fmul(z2_50_0,t0,z2_10_0);
--
-- /* 2^51 - 2^1 */ fsquare(t0,z2_50_0);
-- /* 2^52 - 2^2 */ fsquare(t1,t0);
-- /* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
-- /* 2^100 - 2^0 */ fmul(z2_100_0,t1,z2_50_0);
--
-- /* 2^101 - 2^1 */ fsquare(t1,z2_100_0);
-- /* 2^102 - 2^2 */ fsquare(t0,t1);
-- /* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }
-- /* 2^200 - 2^0 */ fmul(t1,t0,z2_100_0);
--
-- /* 2^201 - 2^1 */ fsquare(t0,t1);
-- /* 2^202 - 2^2 */ fsquare(t1,t0);
-- /* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }
-- /* 2^250 - 2^0 */ fmul(t0,t1,z2_50_0);
--
-- /* 2^251 - 2^1 */ fsquare(t1,t0);
-- /* 2^252 - 2^2 */ fsquare(t0,t1);
-- /* 2^253 - 2^3 */ fsquare(t1,t0);
-- /* 2^254 - 2^4 */ fsquare(t0,t1);
-- /* 2^255 - 2^5 */ fsquare(t1,t0);
-- /* 2^255 - 21 */ fmul(out,t1,z11);
--}
--
--int
--curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
-- limb bp[10], x[10], z[11], zmone[10];
-- uint8_t e[32];
-- int i;
--
-- for (i = 0; i < 32; ++i) e[i] = secret[i];
-- e[0] &= 248;
-- e[31] &= 127;
-- e[31] |= 64;
--
-- fexpand(bp, basepoint);
-- cmult(x, z, e, bp);
-- crecip(zmone, z);
-- fmul(z, x, zmone);
-- fcontract(mypublic, z);
-- return 0;
--}
-diff --git a/curve25519.c b/curve25519.c
-new file mode 100644
-index 0000000..4b83776
---- /dev/null
-+++ b/curve25519.c
-@@ -0,0 +1,502 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#include "includes.h"
-+#include "dbrandom.h"
-+#include "curve25519.h"
-+
-+#if DROPBEAR_CURVE25519 || DROPBEAR_ED25519
-+
-+/* Modified TweetNaCl version 20140427, a self-contained public-domain C library.
-+ * https://tweetnacl.cr.yp.to/ */
-+
-+#define FOR(i,n) for (i = 0;i < n;++i)
-+#define sv static void
-+
-+typedef unsigned char u8;
-+typedef unsigned long u32;
-+typedef unsigned long long u64;
-+typedef long long i64;
-+typedef i64 gf[16];
-+
-+#if DROPBEAR_CURVE25519
-+static const gf
-+ _121665 = {0xDB41,1};
-+#endif /* DROPBEAR_CURVE25519 */
-+#if DROPBEAR_ED25519
-+static const gf
-+ gf0,
-+ gf1 = {1},
-+ D2 = {0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406},
-+ X = {0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169},
-+ Y = {0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666};
-+#if DROPBEAR_SIGNKEY_VERIFY
-+static const gf
-+ D = {0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203},
-+ I = {0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83};
-+#endif /* DROPBEAR_SIGNKEY_VERIFY */
-+#endif /* DROPBEAR_ED25519 */
-+
-+#if DROPBEAR_ED25519
-+#if DROPBEAR_SIGNKEY_VERIFY
-+static int vn(const u8 *x,const u8 *y,u32 n)
-+{
-+ u32 i,d = 0;
-+ FOR(i,n) d |= x[i]^y[i];
-+ return (1 & ((d - 1) >> 8)) - 1;
-+}
-+
-+static int crypto_verify_32(const u8 *x,const u8 *y)
-+{
-+ return vn(x,y,32);
-+}
-+#endif /* DROPBEAR_SIGNKEY_VERIFY */
-+
-+sv set25519(gf r, const gf a)
-+{
-+ int i;
-+ FOR(i,16) r[i]=a[i];
-+}
-+#endif /* DROPBEAR_ED25519 */
-+
-+sv car25519(gf o)
-+{
-+ int i;
-+ i64 c;
-+ FOR(i,16) {
-+ o[i]+=(1LL<<16);
-+ c=o[i]>>16;
-+ o[(i+1)*(i<15)]+=c-1+37*(c-1)*(i==15);
-+ o[i]-=c<<16;
-+ }
-+}
-+
-+sv sel25519(gf p,gf q,int b)
-+{
-+ i64 t,i,c=~(b-1);
-+ FOR(i,16) {
-+ t= c&(p[i]^q[i]);
-+ p[i]^=t;
-+ q[i]^=t;
-+ }
-+}
-+
-+sv pack25519(u8 *o,const gf n)
-+{
-+ int i,j,b;
-+ gf m,t;
-+ FOR(i,16) t[i]=n[i];
-+ car25519(t);
-+ car25519(t);
-+ car25519(t);
-+ FOR(j,2) {
-+ m[0]=t[0]-0xffed;
-+ for(i=1;i<15;i++) {
-+ m[i]=t[i]-0xffff-((m[i-1]>>16)&1);
-+ m[i-1]&=0xffff;
-+ }
-+ m[15]=t[15]-0x7fff-((m[14]>>16)&1);
-+ b=(m[15]>>16)&1;
-+ m[14]&=0xffff;
-+ sel25519(t,m,1-b);
-+ }
-+ FOR(i,16) {
-+ o[2*i]=t[i]&0xff;
-+ o[2*i+1]=t[i]>>8;
-+ }
-+}
-+
-+#if DROPBEAR_ED25519
-+#if DROPBEAR_SIGNKEY_VERIFY
-+static int neq25519(const gf a, const gf b)
-+{
-+ u8 c[32],d[32];
-+ pack25519(c,a);
-+ pack25519(d,b);
-+ return crypto_verify_32(c,d);
-+}
-+#endif /* DROPBEAR_SIGNKEY_VERIFY */
-+
-+static u8 par25519(const gf a)
-+{
-+ u8 d[32];
-+ pack25519(d,a);
-+ return d[0]&1;
-+}
-+#endif /* DROPBEAR_ED25519 */
-+
-+sv unpack25519(gf o, const u8 *n)
-+{
-+ int i;
-+ FOR(i,16) o[i]=n[2*i]+((i64)n[2*i+1]<<8);
-+ o[15]&=0x7fff;
-+}
-+
-+sv A(gf o,const gf a,const gf b)
-+{
-+ int i;
-+ FOR(i,16) o[i]=a[i]+b[i];
-+}
-+
-+sv Z(gf o,const gf a,const gf b)
-+{
-+ int i;
-+ FOR(i,16) o[i]=a[i]-b[i];
-+}
-+
-+sv M(gf o,const gf a,const gf b)
-+{
-+ i64 i,j,t[31];
-+ FOR(i,31) t[i]=0;
-+ FOR(i,16) FOR(j,16) t[i+j]+=a[i]*b[j];
-+ FOR(i,15) t[i]+=38*t[i+16];
-+ FOR(i,16) o[i]=t[i];
-+ car25519(o);
-+ car25519(o);
-+}
-+
-+sv S(gf o,const gf a)
-+{
-+ M(o,a,a);
-+}
-+
-+sv inv25519(gf o,const gf i)
-+{
-+ gf c;
-+ int a;
-+ FOR(a,16) c[a]=i[a];
-+ for(a=253;a>=0;a--) {
-+ S(c,c);
-+ if(a!=2&&a!=4) M(c,c,i);
-+ }
-+ FOR(a,16) o[a]=c[a];
-+}
-+
-+#if DROPBEAR_ED25519 && DROPBEAR_SIGNKEY_VERIFY
-+sv pow2523(gf o,const gf i)
-+{
-+ gf c;
-+ int a;
-+ FOR(a,16) c[a]=i[a];
-+ for(a=250;a>=0;a--) {
-+ S(c,c);
-+ if(a!=1) M(c,c,i);
-+ }
-+ FOR(a,16) o[a]=c[a];
-+}
-+#endif /* DROPBEAR_ED25519 && DROPBEAR_SIGNKEY_VERIFY */
-+
-+#if DROPBEAR_CURVE25519
-+int dropbear_curve25519_scalarmult(u8 *q,const u8 *n,const u8 *p)
-+{
-+ u8 z[32];
-+ i64 x[80],r,i;
-+ gf a,b,c,d,e,f;
-+ FOR(i,31) z[i]=n[i];
-+ z[31]=(n[31]&127)|64;
-+ z[0]&=248;
-+ unpack25519(x,p);
-+ FOR(i,16) {
-+ b[i]=x[i];
-+ d[i]=a[i]=c[i]=0;
-+ }
-+ a[0]=d[0]=1;
-+ for(i=254;i>=0;--i) {
-+ r=(z[i>>3]>>(i&7))&1;
-+ sel25519(a,b,r);
-+ sel25519(c,d,r);
-+ A(e,a,c);
-+ Z(a,a,c);
-+ A(c,b,d);
-+ Z(b,b,d);
-+ S(d,e);
-+ S(f,a);
-+ M(a,c,a);
-+ M(c,b,e);
-+ A(e,a,c);
-+ Z(a,a,c);
-+ S(b,a);
-+ Z(c,d,f);
-+ M(a,c,_121665);
-+ A(a,a,d);
-+ M(c,c,a);
-+ M(a,d,f);
-+ M(d,b,x);
-+ S(b,e);
-+ sel25519(a,b,r);
-+ sel25519(c,d,r);
-+ }
-+ FOR(i,16) {
-+ x[i+16]=a[i];
-+ x[i+32]=c[i];
-+ x[i+48]=b[i];
-+ x[i+64]=d[i];
-+ }
-+ inv25519(x+32,x+32);
-+ M(x+16,x+16,x+32);
-+ pack25519(q,x+16);
-+ return 0;
-+}
-+#endif /* DROPBEAR_CURVE25519 */
-+
-+#if DROPBEAR_ED25519
-+static int crypto_hash(u8 *out,const u8 *m,u64 n)
-+{
-+ hash_state hs;
-+
-+ sha512_init(&hs);
-+ sha512_process(&hs, m, n);
-+ return sha512_done(&hs, out);
-+}
-+
-+sv add(gf p[4],gf q[4])
-+{
-+ gf a,b,c,d,t,e,f,g,h;
-+
-+ Z(a, p[1], p[0]);
-+ Z(t, q[1], q[0]);
-+ M(a, a, t);
-+ A(b, p[0], p[1]);
-+ A(t, q[0], q[1]);
-+ M(b, b, t);
-+ M(c, p[3], q[3]);
-+ M(c, c, D2);
-+ M(d, p[2], q[2]);
-+ A(d, d, d);
-+ Z(e, b, a);
-+ Z(f, d, c);
-+ A(g, d, c);
-+ A(h, b, a);
-+
-+ M(p[0], e, f);
-+ M(p[1], h, g);
-+ M(p[2], g, f);
-+ M(p[3], e, h);
-+}
-+
-+sv cswap(gf p[4],gf q[4],u8 b)
-+{
-+ int i;
-+ FOR(i,4)
-+ sel25519(p[i],q[i],b);
-+}
-+
-+sv pack(u8 *r,gf p[4])
-+{
-+ gf tx, ty, zi;
-+ inv25519(zi, p[2]);
-+ M(tx, p[0], zi);
-+ M(ty, p[1], zi);
-+ pack25519(r, ty);
-+ r[31] ^= par25519(tx) << 7;
-+}
-+
-+sv scalarmult(gf p[4],gf q[4],const u8 *s)
-+{
-+ int i;
-+ set25519(p[0],gf0);
-+ set25519(p[1],gf1);
-+ set25519(p[2],gf1);
-+ set25519(p[3],gf0);
-+ for (i = 255;i >= 0;--i) {
-+ u8 b = (s[i/8]>>(i&7))&1;
-+ cswap(p,q,b);
-+ add(q,p);
-+ add(p,p);
-+ cswap(p,q,b);
-+ }
-+}
-+
-+sv scalarbase(gf p[4],const u8 *s)
-+{
-+ gf q[4];
-+ set25519(q[0],X);
-+ set25519(q[1],Y);
-+ set25519(q[2],gf1);
-+ M(q[3],X,Y);
-+ scalarmult(p,q,s);
-+}
-+
-+int dropbear_ed25519_make_key(u8 *pk,u8 *sk)
-+{
-+ u8 d[64];
-+ gf p[4];
-+
-+ genrandom(sk, 32);
-+
-+ crypto_hash(d, sk, 32);
-+ d[0] &= 248;
-+ d[31] &= 127;
-+ d[31] |= 64;
-+
-+ scalarbase(p,d);
-+ pack(pk,p);
-+
-+ return 0;
-+}
-+
-+static const u64 L[32] = {0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10};
-+
-+sv modL(u8 *r,i64 x[64])
-+{
-+ i64 carry,i,j;
-+ for (i = 63;i >= 32;--i) {
-+ carry = 0;
-+ for (j = i - 32;j < i - 12;++j) {
-+ x[j] += carry - 16 * x[i] * L[j - (i - 32)];
-+ carry = (x[j] + 128) >> 8;
-+ x[j] -= carry << 8;
-+ }
-+ x[j] += carry;
-+ x[i] = 0;
-+ }
-+ carry = 0;
-+ FOR(j,32) {
-+ x[j] += carry - (x[31] >> 4) * L[j];
-+ carry = x[j] >> 8;
-+ x[j] &= 255;
-+ }
-+ FOR(j,32) x[j] -= carry * L[j];
-+ FOR(i,32) {
-+ x[i+1] += x[i] >> 8;
-+ r[i] = x[i] & 255;
-+ }
-+}
-+
-+sv reduce(u8 *r)
-+{
-+ i64 x[64],i;
-+ FOR(i,64) x[i] = (u64) r[i];
-+ FOR(i,64) r[i] = 0;
-+ modL(r,x);
-+}
-+
-+int dropbear_ed25519_sign(const u8 *m,u32 mlen,u8 *s,u32 *slen,const u8 *sk, const u8 *pk)
-+{
-+ hash_state hs;
-+ u8 d[64],h[64],r[64];
-+ i64 x[64];
-+ gf p[4];
-+ u32 i,j;
-+
-+ crypto_hash(d, sk, 32);
-+ d[0] &= 248;
-+ d[31] &= 127;
-+ d[31] |= 64;
-+
-+ *slen = 64;
-+
-+ sha512_init(&hs);
-+ sha512_process(&hs,d + 32,32);
-+ sha512_process(&hs,m,mlen);
-+ sha512_done(&hs,r);
-+ reduce(r);
-+ scalarbase(p,r);
-+ pack(s,p);
-+
-+ sha512_init(&hs);
-+ sha512_process(&hs,s,32);
-+ sha512_process(&hs,pk,32);
-+ sha512_process(&hs,m,mlen);
-+ sha512_done(&hs,h);
-+ reduce(h);
-+
-+ FOR(i,64) x[i] = 0;
-+ FOR(i,32) x[i] = (u64) r[i];
-+ FOR(i,32) FOR(j,32) x[i+j] += h[i] * (u64) d[j];
-+ modL(s + 32,x);
-+
-+ return 0;
-+}
-+
-+#if DROPBEAR_SIGNKEY_VERIFY
-+static int unpackneg(gf r[4],const u8 p[32])
-+{
-+ gf t, chk, num, den, den2, den4, den6;
-+ set25519(r[2],gf1);
-+ unpack25519(r[1],p);
-+ S(num,r[1]);
-+ M(den,num,D);
-+ Z(num,num,r[2]);
-+ A(den,r[2],den);
-+
-+ S(den2,den);
-+ S(den4,den2);
-+ M(den6,den4,den2);
-+ M(t,den6,num);
-+ M(t,t,den);
-+
-+ pow2523(t,t);
-+ M(t,t,num);
-+ M(t,t,den);
-+ M(t,t,den);
-+ M(r[0],t,den);
-+
-+ S(chk,r[0]);
-+ M(chk,chk,den);
-+ if (neq25519(chk, num)) M(r[0],r[0],I);
-+
-+ S(chk,r[0]);
-+ M(chk,chk,den);
-+ if (neq25519(chk, num)) return -1;
-+
-+ if (par25519(r[0]) == (p[31]>>7)) Z(r[0],gf0,r[0]);
-+
-+ M(r[3],r[0],r[1]);
-+ return 0;
-+}
-+
-+int dropbear_ed25519_verify(const u8 *m,u32 mlen,const u8 *s,u32 slen,const u8 *pk)
-+{
-+ hash_state hs;
-+ u8 t[32],h[64];
-+ gf p[4],q[4];
-+
-+ if (slen < 64) return -1;
-+
-+ if (unpackneg(q,pk)) return -1;
-+
-+ sha512_init(&hs);
-+ sha512_process(&hs,s,32);
-+ sha512_process(&hs,pk,32);
-+ sha512_process(&hs,m,mlen);
-+ sha512_done(&hs,h);
-+
-+ reduce(h);
-+ scalarmult(p,q,h);
-+
-+ scalarbase(q,s + 32);
-+ add(p,q);
-+ pack(t,p);
-+
-+ if (crypto_verify_32(s, t))
-+ return -1;
-+
-+ return 0;
-+}
-+#endif /* DROPBEAR_SIGNKEY_VERIFY */
-+
-+#endif /* DROPBEAR_ED25519 */
-+
-+#endif /* DROPBEAR_CURVE25519 || DROPBEAR_ED25519 */
-diff --git a/curve25519.h b/curve25519.h
-new file mode 100644
-index 0000000..7f75aed
---- /dev/null
-+++ b/curve25519.h
-@@ -0,0 +1,37 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#ifndef DROPBEAR_CURVE25519_H
-+#define DROPBEAR_CURVE25519_H
-+
-+int dropbear_curve25519_scalarmult(unsigned char *q, const unsigned char *n, const unsigned char *p);
-+int dropbear_ed25519_make_key(unsigned char *pk, unsigned char *sk);
-+int dropbear_ed25519_sign(const unsigned char *m, unsigned long mlen,
-+ unsigned char *s, unsigned long *slen,
-+ const unsigned char *sk, const unsigned char *pk);
-+int dropbear_ed25519_verify(const unsigned char *m, unsigned long mlen,
-+ const unsigned char *s, unsigned long slen,
-+ const unsigned char *pk);
-+
-+#endif /* DROPBEAR_CURVE25519_H */
-diff --git a/default_options.h b/default_options.h
-index 9000fcc..5b232dd 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -22,6 +22,7 @@ IMPORTANT: Some options will require "make clean" after changes */
- #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
- #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
- #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
-+#define ED25519_PRIV_FILENAME "/etc/dropbear/dropbear_ed25519_host_key"
-
- /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
- * on chosen ports and keeps accepting connections. This is the default.
-@@ -116,11 +117,15 @@ IMPORTANT: Some options will require "make clean" after changes */
- * code (either ECDSA or ECDH) increases binary size - around 30kB
- * on x86-64 */
- #define DROPBEAR_ECDSA 1
-+/* Ed25519 is faster than ECDSA. Compiling in Ed25519 code increases
-+ binary size - around 7,5kB on x86-64 */
-+#define DROPBEAR_ED25519 1
-
- /* RSA must be >=1024 */
- #define DROPBEAR_DEFAULT_RSA_SIZE 2048
- /* DSS is always 1024 */
- /* ECDSA defaults to largest size configured, usually 521 */
-+/* Ed25519 is always 256 */
-
- /* Add runtime flag "-R" to generate hostkeys as-needed when the first
- connection using that key type occurs.
-@@ -143,7 +148,7 @@ IMPORTANT: Some options will require "make clean" after changes */
- * group14 is supported by most implementations.
- * group16 provides a greater strength level but is slower and increases binary size
- * curve25519 and ecdh algorithms are faster than non-elliptic curve methods
-- * curve25519 increases binary size by ~8kB on x86-64
-+ * curve25519 increases binary size by ~2,5kB on x86-64
- * including either ECDH or ECDSA increases binary size by ~30kB on x86-64
-
- * Small systems should generally include either curve25519 or ecdh for performance.
-diff --git a/dropbear.8 b/dropbear.8
-index 71c955a..345954f 100644
---- a/dropbear.8
-+++ b/dropbear.8
-@@ -107,7 +107,7 @@ Print the version
- Authorized Keys
-
- ~/.ssh/authorized_keys can be set up to allow remote login with a RSA,
--ECDSA, or DSS
-+ECDSA, Ed25519 or DSS
- key. Each line is of the form
- .TP
- [restrictions] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIgAsp... [comment]
-@@ -146,8 +146,8 @@ key authentication.
- Host Key Files
-
- Host key files are read at startup from a standard location, by default
--/etc/dropbear/dropbear_dss_host_key, /etc/dropbear/dropbear_rsa_host_key, and
--/etc/dropbear/dropbear_ecdsa_host_key
-+/etc/dropbear/dropbear_dss_host_key, /etc/dropbear/dropbear_rsa_host_key,
-+/etc/dropbear/dropbear_ecdsa_host_key and /etc/dropbear/dropbear_ed25519_host_key
-
- If the -r command line option is specified the default files are not loaded.
- Host key files are of the form generated by dropbearkey.
-diff --git a/dropbearkey.c b/dropbearkey.c
-index dd0e697..f881855 100644
---- a/dropbearkey.c
-+++ b/dropbearkey.c
-@@ -43,6 +43,10 @@
- * mp_int y
- * mp_int x
- *
-+ * Ed25519:
-+ * string "ssh-ed25519"
-+ * string k (32 bytes) + A (32 bytes)
-+ *
- */
- #include "includes.h"
- #include "signkey.h"
-@@ -51,6 +55,7 @@
-
- #include "genrsa.h"
- #include "gendss.h"
-+#include "gened25519.h"
- #include "ecdsa.h"
- #include "crypto_desc.h"
- #include "dbrandom.h"
-@@ -75,6 +80,9 @@ static void printhelp(char * progname) {
- #endif
- #if DROPBEAR_ECDSA
- " ecdsa\n"
-+#endif
-+#if DROPBEAR_ED25519
-+ " ed25519\n"
- #endif
- "-f filename Use filename for the secret key.\n"
- " ~/.ssh/id_dropbear is recommended for client keys.\n"
-@@ -94,6 +102,9 @@ static void printhelp(char * progname) {
- "521 "
- #endif
- "\n"
-+#endif
-+#if DROPBEAR_ED25519
-+ " Ed25519 has a fixed size of 256 bits\n"
- #endif
- "-y Just print the publickey and fingerprint for the\n private key in <filename>.\n"
- #if DEBUG_TRACE
-@@ -106,6 +117,14 @@ static void printhelp(char * progname) {
- static void check_signkey_bits(enum signkey_type type, int bits)
- {
- switch (type) {
-+#if DROPBEAR_ED25519
-+ case DROPBEAR_SIGNKEY_ED25519:
-+ if (bits != 256) {
-+ dropbear_exit("Ed25519 keys have a fixed size of 256 bits\n");
-+ exit(EXIT_FAILURE);
-+ }
-+ break;
-+#endif
- #if DROPBEAR_RSA
- case DROPBEAR_SIGNKEY_RSA:
- if (bits < 512 || bits > 4096 || (bits % 8 != 0)) {
-@@ -224,6 +243,12 @@ int main(int argc, char ** argv) {
- keytype = DROPBEAR_SIGNKEY_ECDSA_KEYGEN;
- }
- #endif
-+#if DROPBEAR_ED25519
-+ if (strcmp(typetext, "ed25519") == 0)
-+ {
-+ keytype = DROPBEAR_SIGNKEY_ED25519;
-+ }
-+#endif
-
- if (keytype == DROPBEAR_SIGNKEY_NONE) {
- fprintf(stderr, "Unknown key type '%s'\n", typetext);
-diff --git a/ed25519.c b/ed25519.c
-new file mode 100644
-index 0000000..3fb544c
---- /dev/null
-+++ b/ed25519.c
-@@ -0,0 +1,184 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+/* Perform Ed25519 operations on data, including reading keys, signing and
-+ * verification. */
-+
-+#include "includes.h"
-+#include "dbutil.h"
-+#include "buffer.h"
-+#include "ssh.h"
-+#include "curve25519.h"
-+#include "ed25519.h"
-+
-+#if DROPBEAR_ED25519
-+
-+/* Load a public ed25519 key from a buffer, initialising the values.
-+ * The key will have the same format as buf_put_ed25519_key.
-+ * These should be freed with ed25519_key_free.
-+ * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
-+int buf_get_ed25519_pub_key(buffer *buf, dropbear_ed25519_key *key) {
-+
-+ unsigned int len;
-+
-+ TRACE(("enter buf_get_ed25519_pub_key"))
-+ dropbear_assert(key != NULL);
-+
-+ buf_incrpos(buf, 4+SSH_SIGNKEY_ED25519_LEN); /* int + "ssh-ed25519" */
-+
-+ len = buf_getint(buf);
-+ if (len != CURVE25519_LEN || buf->len - buf->pos < len) {
-+ TRACE(("leave buf_get_ed25519_pub_key: failure"))
-+ return DROPBEAR_FAILURE;
-+ }
-+
-+ m_burn(key->priv, CURVE25519_LEN);
-+ memcpy(key->pub, buf_getptr(buf, CURVE25519_LEN), CURVE25519_LEN);
-+ buf_incrpos(buf, CURVE25519_LEN);
-+
-+ TRACE(("leave buf_get_ed25519_pub_key: success"))
-+ return DROPBEAR_SUCCESS;
-+}
-+
-+/* Same as buf_get_ed25519_pub_key, but reads private key at the end.
-+ * Loads a public and private ed25519 key from a buffer
-+ * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
-+int buf_get_ed25519_priv_key(buffer *buf, dropbear_ed25519_key *key) {
-+
-+ unsigned int len;
-+
-+ TRACE(("enter buf_get_ed25519_priv_key"))
-+ dropbear_assert(key != NULL);
-+
-+ buf_incrpos(buf, 4+SSH_SIGNKEY_ED25519_LEN); /* int + "ssh-ed25519" */
-+
-+ len = buf_getint(buf);
-+ if (len != CURVE25519_LEN*2 || buf->len - buf->pos < len) {
-+ TRACE(("leave buf_get_ed25519_priv_key: failure"))
-+ return DROPBEAR_FAILURE;
-+ }
-+
-+ memcpy(key->priv, buf_getptr(buf, CURVE25519_LEN), CURVE25519_LEN);
-+ buf_incrpos(buf, CURVE25519_LEN);
-+ memcpy(key->pub, buf_getptr(buf, CURVE25519_LEN), CURVE25519_LEN);
-+ buf_incrpos(buf, CURVE25519_LEN);
-+
-+ TRACE(("leave buf_get_ed25519_pub_key: success"))
-+ return DROPBEAR_SUCCESS;
-+}
-+
-+/* Clear and free the memory used by a public or private key */
-+void ed25519_key_free(dropbear_ed25519_key *key) {
-+
-+ TRACE2(("enter ed25519_key_free"))
-+
-+ if (key == NULL) {
-+ TRACE2(("leave ed25519_key_free: key == NULL"))
-+ return;
-+ }
-+ m_burn(key->priv, CURVE25519_LEN);
-+ m_free(key);
-+
-+ TRACE2(("leave rsa_key_free"))
-+}
-+
-+/* Put the public ed25519 key into the buffer in the required format */
-+void buf_put_ed25519_pub_key(buffer *buf, const dropbear_ed25519_key *key) {
-+
-+ TRACE(("enter buf_put_ed25519_pub_key"))
-+ dropbear_assert(key != NULL);
-+
-+ buf_putstring(buf, SSH_SIGNKEY_ED25519, SSH_SIGNKEY_ED25519_LEN);
-+ buf_putstring(buf, key->pub, CURVE25519_LEN);
-+
-+ TRACE(("leave buf_put_ed25519_pub_key"))
-+}
-+
-+/* Put the public and private ed25519 key into the buffer in the required format */
-+void buf_put_ed25519_priv_key(buffer *buf, const dropbear_ed25519_key *key) {
-+
-+ TRACE(("enter buf_put_ed25519_priv_key"))
-+ dropbear_assert(key != NULL);
-+
-+ buf_putstring(buf, SSH_SIGNKEY_ED25519, SSH_SIGNKEY_ED25519_LEN);
-+ buf_putint(buf, CURVE25519_LEN*2);
-+ buf_putbytes(buf, key->priv, CURVE25519_LEN);
-+ buf_putbytes(buf, key->pub, CURVE25519_LEN);
-+
-+ TRACE(("leave buf_put_ed25519_priv_key"))
-+}
-+
-+/* Sign the data presented with key, writing the signature contents
-+ * to the buffer */
-+void buf_put_ed25519_sign(buffer* buf, const dropbear_ed25519_key *key, const buffer *data_buf) {
-+
-+ unsigned char s[64];
-+ unsigned long slen = sizeof(s);
-+
-+ TRACE(("enter buf_put_ed25519_sign"))
-+ dropbear_assert(key != NULL);
-+
-+ if (dropbear_ed25519_sign(data_buf->data, data_buf->len,
-+ s, &slen, key->priv, key->pub) == 0) {
-+ buf_putstring(buf, SSH_SIGNKEY_ED25519, SSH_SIGNKEY_ED25519_LEN);
-+ buf_putstring(buf, s, slen);
-+ }
-+
-+ TRACE(("leave buf_put_ed25519_sign"))
-+}
-+
-+#if DROPBEAR_SIGNKEY_VERIFY
-+/* Verify a signature in buf, made on data by the key given.
-+ * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
-+int buf_ed25519_verify(buffer *buf, const dropbear_ed25519_key *key, const buffer *data_buf) {
-+
-+ int ret = DROPBEAR_FAILURE;
-+ unsigned char *s;
-+ unsigned long slen;
-+
-+ TRACE(("enter buf_ed25519_verify"))
-+ dropbear_assert(key != NULL);
-+
-+ slen = buf_getint(buf);
-+ if (slen != 64 || buf->len - buf->pos < slen) {
-+ TRACE(("bad size"))
-+ goto out;
-+ }
-+ s = buf_getptr(buf, slen);
-+
-+ if (dropbear_ed25519_verify(data_buf->data, data_buf->len,
-+ s, slen, key->pub) == 0) {
-+ /* signature is valid */
-+ TRACE(("success!"))
-+ ret = DROPBEAR_SUCCESS;
-+ }
-+
-+out:
-+ TRACE(("leave buf_ed25519_verify: ret %d", ret))
-+ return ret;
-+}
-+
-+#endif /* DROPBEAR_SIGNKEY_VERIFY */
-+
-+#endif /* DROPBEAR_ED25519 */
-diff --git a/ed25519.h b/ed25519.h
-new file mode 100644
-index 0000000..16c0d7b
---- /dev/null
-+++ b/ed25519.h
-@@ -0,0 +1,54 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#ifndef DROPBEAR_ED25519_H_
-+#define DROPBEAR_ED25519_H_
-+
-+#include "includes.h"
-+#include "buffer.h"
-+
-+#if DROPBEAR_ED25519
-+
-+#define CURVE25519_LEN 32
-+
-+typedef struct {
-+
-+ unsigned char priv[CURVE25519_LEN];
-+ unsigned char pub[CURVE25519_LEN];
-+
-+} dropbear_ed25519_key;
-+
-+void buf_put_ed25519_sign(buffer* buf, const dropbear_ed25519_key *key, const buffer *data_buf);
-+#if DROPBEAR_SIGNKEY_VERIFY
-+int buf_ed25519_verify(buffer * buf, const dropbear_ed25519_key *key, const buffer *data_buf);
-+#endif
-+int buf_get_ed25519_pub_key(buffer* buf, dropbear_ed25519_key *key);
-+int buf_get_ed25519_priv_key(buffer* buf, dropbear_ed25519_key *key);
-+void buf_put_ed25519_pub_key(buffer* buf, const dropbear_ed25519_key *key);
-+void buf_put_ed25519_priv_key(buffer* buf, const dropbear_ed25519_key *key);
-+void ed25519_key_free(dropbear_ed25519_key *key);
-+
-+#endif /* DROPBEAR_ED25519 */
-+
-+#endif /* DROPBEAR_ED25519_H_ */
-diff --git a/filelist.txt b/filelist.txt
-index 8281c14..3b9bb67 100644
---- a/filelist.txt
-+++ b/filelist.txt
-@@ -99,6 +99,10 @@ rsa.c RSA asymmetric crypto routines
-
- dss.c DSS asymmetric crypto routines
-
-+ed25519.c Ed25519 asymmetric crypto routines
-+
-+gened25519.c Ed25519 key generation
-+
- gendss.c DSS key generation
-
- genrsa.c RSA key generation
-diff --git a/fuzz-common.c b/fuzz-common.c
-index 5c90c45..b1b00f6 100644
---- a/fuzz-common.c
-+++ b/fuzz-common.c
-@@ -112,6 +112,14 @@ static void load_fixed_hostkeys(void) {
- dropbear_exit("failed fixed ecdsa hostkey");
- }
-
-+ buf_setlen(b, 0);
-+ buf_putbytes(b, keyed25519, keyed25519_len);
-+ buf_setpos(b, 0);
-+ type = DROPBEAR_SIGNKEY_ED25519;
-+ if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) {
-+ dropbear_exit("failed fixed ed25519 hostkey");
-+ }
-+
- buf_free(b);
- }
-
-diff --git a/fuzz-hostkeys.c b/fuzz-hostkeys.c
-index dc1615d..3fff5cb 100644
---- a/fuzz-hostkeys.c
-+++ b/fuzz-hostkeys.c
-@@ -127,3 +127,13 @@ unsigned char keyd[] = {
- 0xf9, 0x39
- };
- unsigned int keyd_len = 458;
-+unsigned char keyed25519[] = {
-+ 0x00, 0x00, 0x00, 0x0b, 0x73, 0x73, 0x68, 0x2d, 0x65, 0x64, 0x32, 0x35,
-+ 0x35, 0x31, 0x39, 0x00, 0x00, 0x00, 0x40, 0x10, 0xb3, 0x79, 0x06, 0xe5,
-+ 0x9b, 0xe7, 0xe4, 0x6e, 0xec, 0xfe, 0xa5, 0x39, 0x21, 0x7c, 0xf6, 0x66,
-+ 0x8c, 0x0b, 0x6a, 0x01, 0x09, 0x05, 0xc7, 0x4f, 0x64, 0xa8, 0x24, 0xd2,
-+ 0x8d, 0xbd, 0xdd, 0xc6, 0x3c, 0x99, 0x1b, 0x2d, 0x3e, 0x33, 0x90, 0x19,
-+ 0xa4, 0xd5, 0xe9, 0x23, 0xfe, 0x8e, 0xd6, 0xd4, 0xf9, 0xb1, 0x11, 0x69,
-+ 0x7c, 0x57, 0x52, 0x0e, 0x41, 0xdb, 0x1b, 0x12, 0x87, 0xfa, 0xc9
-+};
-+unsigned int keyed25519_len = 83;
-diff --git a/fuzzer-kexcurve25519.c b/fuzzer-kexcurve25519.c
-new file mode 100644
-index 0000000..f2eab14
---- /dev/null
-+++ b/fuzzer-kexcurve25519.c
-@@ -0,0 +1,72 @@
-+#include "fuzz.h"
-+#include "session.h"
-+#include "fuzz-wrapfd.h"
-+#include "debug.h"
-+#include "runopts.h"
-+#include "algo.h"
-+#include "bignum.h"
-+
-+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-+ static int once = 0;
-+ static struct key_context* keep_newkeys = NULL;
-+ /* number of generated parameters is limited by the timeout for the first run.
-+ TODO move this to the libfuzzer initialiser function instead if the timeout
-+ doesn't apply there */
-+ #define NUM_PARAMS 20
-+ static struct kex_curve25519_param *curve25519_params[NUM_PARAMS];
-+
-+ if (!once) {
-+ fuzz_common_setup();
-+ fuzz_svr_setup();
-+
-+ keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
-+ keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "curve25519-sha256");
-+ keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
-+ ses.newkeys = keep_newkeys;
-+
-+ /* Pre-generate parameters */
-+ int i;
-+ for (i = 0; i < NUM_PARAMS; i++) {
-+ curve25519_params[i] = gen_kexcurve25519_param();
-+ }
-+
-+ once = 1;
-+ }
-+
-+ if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
-+ return 0;
-+ }
-+
-+ m_malloc_set_epoch(1);
-+
-+ if (setjmp(fuzz.jmp) == 0) {
-+ /* Based on recv_msg_kexdh_init()/send_msg_kexdh_reply()
-+ with DROPBEAR_KEX_CURVE25519 */
-+ ses.newkeys = keep_newkeys;
-+
-+ /* Choose from the collection of curve25519 params */
-+ unsigned int e = buf_getint(fuzz.input);
-+ struct kex_curve25519_param *curve25519_param = curve25519_params[e % NUM_PARAMS];
-+
-+ buffer * ecdh_qs = buf_getstringbuf(fuzz.input);
-+
-+ ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS);
-+ kexcurve25519_comb_key(curve25519_param, ecdh_qs, svr_opts.hostkey);
-+
-+ mp_clear(ses.dh_K);
-+ m_free(ses.dh_K);
-+ buf_free(ecdh_qs);
-+
-+ buf_free(ses.hash);
-+ buf_free(ses.session_id);
-+ /* kexhashbuf is freed in kexdh_comb_key */
-+
-+ m_malloc_free_epoch(1, 0);
-+ } else {
-+ m_malloc_free_epoch(1, 1);
-+ TRACE(("dropbear_exit longjmped"))
-+ /* dropbear_exit jumped here */
-+ }
-+
-+ return 0;
-+}
-diff --git a/gened25519.c b/gened25519.c
-new file mode 100644
-index 0000000..a027914
---- /dev/null
-+++ b/gened25519.c
-@@ -0,0 +1,47 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#include "includes.h"
-+#include "dbutil.h"
-+#include "dbrandom.h"
-+#include "curve25519.h"
-+#include "gened25519.h"
-+
-+#if DROPBEAR_ED25519
-+
-+dropbear_ed25519_key * gen_ed25519_priv_key(unsigned int size) {
-+
-+ dropbear_ed25519_key *key;
-+
-+ if (size != 256) {
-+ dropbear_exit("Ed25519 keys have a fixed size of 256 bits");
-+ }
-+
-+ key = m_malloc(sizeof(*key));
-+ dropbear_ed25519_make_key(key->pub, key->priv);
-+
-+ return key;
-+}
-+
-+#endif /* DROPBEAR_ED25519 */
-diff --git a/gened25519.h b/gened25519.h
-new file mode 100644
-index 0000000..8058310
---- /dev/null
-+++ b/gened25519.h
-@@ -0,0 +1,36 @@
-+/*
-+ * Dropbear - a SSH2 server
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#ifndef DROPBEAR_GENED25519_H_
-+#define DROPBEAR_GENED25519_H_
-+
-+#include "ed25519.h"
-+
-+#if DROPBEAR_ED25519
-+
-+dropbear_ed25519_key * gen_ed25519_priv_key(unsigned int size);
-+
-+#endif /* DROPBEAR_ED25519 */
-+
-+#endif /* DROPBEAR_GENED25519_H_ */
-diff --git a/gensignkey.c b/gensignkey.c
-index 34b6f5a..674d81f 100644
---- a/gensignkey.c
-+++ b/gensignkey.c
-@@ -4,6 +4,7 @@
- #include "ecdsa.h"
- #include "genrsa.h"
- #include "gendss.h"
-+#include "gened25519.h"
- #include "signkey.h"
- #include "dbrandom.h"
-
-@@ -68,6 +69,10 @@ static int get_default_bits(enum signkey_type keytype)
- return 384;
- case DROPBEAR_SIGNKEY_ECDSA_NISTP256:
- return 256;
-+#endif
-+#if DROPBEAR_ED25519
-+ case DROPBEAR_SIGNKEY_ED25519:
-+ return 256;
- #endif
- default:
- return 0;
-@@ -118,6 +123,11 @@ int signkey_generate(enum signkey_type keytype, int bits, const char* filename,
- *signkey_key_ptr(key, keytype) = ecckey;
- }
- break;
-+#endif
-+#if DROPBEAR_ED25519
-+ case DROPBEAR_SIGNKEY_ED25519:
-+ key->ed25519key = gen_ed25519_priv_key(bits);
-+ break;
- #endif
- default:
- dropbear_exit("Internal error");
-diff --git a/keyimport.c b/keyimport.c
-index 7304e58..ad0c530 100644
---- a/keyimport.c
-+++ b/keyimport.c
-@@ -35,6 +35,15 @@
- #include "buffer.h"
- #include "dbutil.h"
- #include "ecc.h"
-+#include "ssh.h"
-+
-+static const unsigned char OSSH_PKEY_BLOB[] =
-+ "openssh-key-v1\0" /* AUTH_MAGIC */
-+ "\0\0\0\4none" /* cipher name*/
-+ "\0\0\0\4none" /* kdf name */
-+ "\0\0\0\0" /* kdf */
-+ "\0\0\0\1"; /* key num */
-+#define OSSH_PKEY_BLOBLEN (sizeof(OSSH_PKEY_BLOB) - 1)
-
- #if DROPBEAR_ECDSA
- static const unsigned char OID_SEC256R1_BLOB[] = {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07};
-@@ -352,7 +361,7 @@ struct mpint_pos { void *start; int bytes; };
- * Code to read and write OpenSSH private keys.
- */
-
--enum { OSSH_DSA, OSSH_RSA, OSSH_EC };
-+enum { OSSH_DSA, OSSH_RSA, OSSH_EC, OSSH_PKEY };
- struct openssh_key {
- int type;
- int encrypted;
-@@ -364,11 +373,12 @@ struct openssh_key {
- static struct openssh_key *load_openssh_key(const char *filename)
- {
- struct openssh_key *ret;
-+ buffer *buf = NULL;
- FILE *fp = NULL;
- char buffer[256];
- char *errmsg = NULL, *p = NULL;
- int headers_done;
-- unsigned long len, outlen;
-+ unsigned long len;
-
- ret = (struct openssh_key*)m_malloc(sizeof(struct openssh_key));
- ret->keyblob = NULL;
-@@ -397,12 +407,15 @@ static struct openssh_key *load_openssh_key(const char *filename)
- ret->type = OSSH_DSA;
- else if (!strcmp(buffer, "-----BEGIN EC PRIVATE KEY-----\n"))
- ret->type = OSSH_EC;
-+ else if (!strcmp(buffer, "-----BEGIN OPENSSH PRIVATE KEY-----\n"))
-+ ret->type = OSSH_PKEY;
- else {
- errmsg = "Unrecognised key type";
- goto error;
- }
-
- headers_done = 0;
-+ buf = buf_new(0);
- while (1) {
- if (!fgets(buffer, sizeof(buffer), fp)) {
- errmsg = "Unexpected end of file";
-@@ -448,20 +461,31 @@ static struct openssh_key *load_openssh_key(const char *filename)
- } else {
- headers_done = 1;
- len = strlen(buffer);
-- outlen = len*4/3;
-- if (ret->keyblob_len + outlen > ret->keyblob_size) {
-- ret->keyblob_size = ret->keyblob_len + outlen + 256;
-- ret->keyblob = (unsigned char*)m_realloc(ret->keyblob,
-- ret->keyblob_size);
-- }
-- outlen = ret->keyblob_size - ret->keyblob_len;
-- if (base64_decode((const unsigned char *)buffer, len,
-- ret->keyblob + ret->keyblob_len, &outlen) != CRYPT_OK){
-- errmsg = "Error decoding base64";
-- goto error;
-- }
-- ret->keyblob_len += outlen;
-+ buf = buf_resize(buf, buf->size + len);
-+ buf_putbytes(buf, buffer, len);
-+ }
-+ }
-+
-+ if (buf && buf->len) {
-+ ret->keyblob_size = ret->keyblob_len + buf->len*4/3 + 256;
-+ ret->keyblob = (unsigned char*)m_realloc(ret->keyblob, ret->keyblob_size);
-+ len = ret->keyblob_size;
-+ if (base64_decode((const unsigned char *)buf->data, buf->len,
-+ ret->keyblob, &len) != CRYPT_OK){
-+ errmsg = "Error decoding base64";
-+ goto error;
-+ }
-+ ret->keyblob_len = len;
-+ }
-+
-+ if (ret->type == OSSH_PKEY) {
-+ if (ret->keyblob_len < OSSH_PKEY_BLOBLEN ||
-+ memcmp(ret->keyblob, OSSH_PKEY_BLOB, OSSH_PKEY_BLOBLEN)) {
-+ errmsg = "Error decoding OpenSSH key";
-+ goto error;
- }
-+ ret->keyblob_len -= OSSH_PKEY_BLOBLEN;
-+ memmove(ret->keyblob, ret->keyblob + OSSH_PKEY_BLOBLEN, ret->keyblob_len);
- }
-
- if (ret->keyblob_len == 0 || !ret->keyblob) {
-@@ -474,10 +498,18 @@ static struct openssh_key *load_openssh_key(const char *filename)
- goto error;
- }
-
-+ if (buf) {
-+ buf_burn(buf);
-+ buf_free(buf);
-+ }
- m_burn(buffer, sizeof(buffer));
- return ret;
-
- error:
-+ if (buf) {
-+ buf_burn(buf);
-+ buf_free(buf);
-+ }
- m_burn(buffer, sizeof(buffer));
- if (ret) {
- if (ret->keyblob) {
-@@ -569,6 +601,57 @@ static sign_key *openssh_read(const char *filename, const char * UNUSED(passphra
- #endif
- }
-
-+ /*
-+ * Now we have a decrypted key blob, which contains OpenSSH
-+ * encoded private key. We must now untangle the OpenSSH format.
-+ */
-+ if (key->type == OSSH_PKEY) {
-+ blobbuf = buf_new(key->keyblob_len);
-+ buf_putbytes(blobbuf, key->keyblob, key->keyblob_len);
-+ buf_setpos(blobbuf, 0);
-+
-+ /* limit length of private key blob */
-+ len = buf_getint(blobbuf);
-+ buf_setlen(blobbuf, blobbuf->pos + len);
-+
-+ type = DROPBEAR_SIGNKEY_ANY;
-+ if (buf_get_pub_key(blobbuf, retkey, &type)
-+ != DROPBEAR_SUCCESS) {
-+ errmsg = "Error parsing OpenSSH key";
-+ goto ossh_error;
-+ }
-+
-+ /* restore full length */
-+ buf_setlen(blobbuf, key->keyblob_len);
-+
-+ if (type != DROPBEAR_SIGNKEY_NONE) {
-+ retkey->type = type;
-+ /* limit length of private key blob */
-+ len = buf_getint(blobbuf);
-+ buf_setlen(blobbuf, blobbuf->pos + len);
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ buf_incrpos(blobbuf, 8);
-+ buf_eatstring(blobbuf);
-+ buf_eatstring(blobbuf);
-+ buf_incrpos(blobbuf, -SSH_SIGNKEY_ED25519_LEN-4);
-+ if (buf_get_ed25519_priv_key(blobbuf, retkey->ed25519key)
-+ == DROPBEAR_SUCCESS) {
-+ errmsg = NULL;
-+ retval = retkey;
-+ goto error;
-+ }
-+ }
-+#endif
-+ }
-+
-+ errmsg = "Unsupported OpenSSH key type";
-+ ossh_error:
-+ sign_key_free(retkey);
-+ retkey = NULL;
-+ goto error;
-+ }
-+
- /*
- * Now we have a decrypted key blob, which contains an ASN.1
- * encoded private key. We must now untangle the ASN.1.
-@@ -1129,6 +1212,51 @@ static int openssh_write(const char *filename, sign_key *key,
- }
- #endif
-
-+#if DROPBEAR_ED25519
-+ if (key->type == DROPBEAR_SIGNKEY_ED25519) {
-+ buffer *buf = buf_new(300);
-+ keyblob = buf_new(100);
-+ extrablob = buf_new(200);
-+
-+ /* private key blob w/o header */
-+ buf_put_priv_key(keyblob, key, key->type);
-+ buf_setpos(keyblob, 0);
-+ buf_incrpos(keyblob, buf_getint(keyblob));
-+ len = buf_getint(keyblob);
-+
-+ /* header */
-+ buf_putbytes(buf, OSSH_PKEY_BLOB, OSSH_PKEY_BLOBLEN);
-+
-+ /* public key */
-+ buf_put_pub_key(buf, key, key->type);
-+
-+ /* private key */
-+ buf_incrwritepos(extrablob, 4);
-+ buf_put_pub_key(extrablob, key, key->type);
-+ buf_putstring(extrablob, buf_getptr(keyblob, len), len);
-+ /* comment */
-+ buf_putstring(extrablob, "", 0);
-+ /* padding to cipher block length */
-+ len = (extrablob->len+8) & ~7;
-+ for (i = 1; len - extrablob->len > 0; i++)
-+ buf_putbyte(extrablob, i);
-+ buf_setpos(extrablob, 0);
-+ buf_putbytes(extrablob, "\0\0\0\0\0\0\0\0", 8);
-+ buf_putbufstring(buf, extrablob);
-+
-+ outlen = len = pos = buf->len;
-+ outblob = (unsigned char*)m_malloc(outlen);
-+ memcpy(outblob, buf->data, buf->len);
-+
-+ buf_burn(buf);
-+ buf_free(buf);
-+ buf = NULL;
-+
-+ header = "-----BEGIN OPENSSH PRIVATE KEY-----\n";
-+ footer = "-----END OPENSSH PRIVATE KEY-----\n";
-+ }
-+#endif
-+
- /*
- * Padding on OpenSSH keys is deterministic. The number of
- * padding bytes is always more than zero, and always at most
-diff --git a/signkey.c b/signkey.c
-index 88f06c7..a0af44a 100644
---- a/signkey.c
-+++ b/signkey.c
-@@ -39,8 +39,11 @@ static const char * const signkey_names[DROPBEAR_SIGNKEY_NUM_NAMED] = {
- #if DROPBEAR_ECDSA
- "ecdsa-sha2-nistp256",
- "ecdsa-sha2-nistp384",
-- "ecdsa-sha2-nistp521"
-+ "ecdsa-sha2-nistp521",
- #endif /* DROPBEAR_ECDSA */
-+#if DROPBEAR_ED25519
-+ "ssh-ed25519",
-+#endif /* DROPBEAR_ED25519 */
- };
-
- /* malloc a new sign_key and set the dss and rsa keys to NULL */
-@@ -107,6 +110,10 @@ Be sure to check both (ret != NULL) and (*ret != NULL) */
- void **
- signkey_key_ptr(sign_key *key, enum signkey_type type) {
- switch (type) {
-+#if DROPBEAR_ED25519
-+ case DROPBEAR_SIGNKEY_ED25519:
-+ return (void**)&key->ed25519key;
-+#endif
- #if DROPBEAR_ECDSA
- #if DROPBEAR_ECC_256
- case DROPBEAR_SIGNKEY_ECDSA_NISTP256:
-@@ -200,6 +207,17 @@ int buf_get_pub_key(buffer *buf, sign_key *key, enum signkey_type *type) {
- }
- }
- #endif
-+#if DROPBEAR_ED25519
-+ if (keytype == DROPBEAR_SIGNKEY_ED25519) {
-+ ed25519_key_free(key->ed25519key);
-+ key->ed25519key = m_malloc(sizeof(*key->ed25519key));
-+ ret = buf_get_ed25519_pub_key(buf, key->ed25519key);
-+ if (ret == DROPBEAR_FAILURE) {
-+ m_free(key->ed25519key);
-+ key->ed25519key = NULL;
-+ }
-+ }
-+#endif
-
- TRACE2(("leave buf_get_pub_key"))
-
-@@ -270,6 +288,17 @@ int buf_get_priv_key(buffer *buf, sign_key *key, enum signkey_type *type) {
- }
- }
- #endif
-+#if DROPBEAR_ED25519
-+ if (keytype == DROPBEAR_SIGNKEY_ED25519) {
-+ ed25519_key_free(key->ed25519key);
-+ key->ed25519key = m_malloc(sizeof(*key->ed25519key));
-+ ret = buf_get_ed25519_priv_key(buf, key->ed25519key);
-+ if (ret == DROPBEAR_FAILURE) {
-+ m_free(key->ed25519key);
-+ key->ed25519key = NULL;
-+ }
-+ }
-+#endif
-
- TRACE2(("leave buf_get_priv_key"))
-
-@@ -302,6 +331,11 @@ void buf_put_pub_key(buffer* buf, sign_key *key, enum signkey_type type) {
- buf_put_ecdsa_pub_key(pubkeys, *eck);
- }
- }
-+#endif
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ buf_put_ed25519_pub_key(pubkeys, key->ed25519key);
-+ }
- #endif
- if (pubkeys->len == 0) {
- dropbear_exit("Bad key types in buf_put_pub_key");
-@@ -341,6 +375,13 @@ void buf_put_priv_key(buffer* buf, sign_key *key, enum signkey_type type) {
- return;
- }
- }
-+#endif
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ buf_put_ed25519_priv_key(buf, key->ed25519key);
-+ TRACE(("leave buf_put_priv_key: ed25519 done"))
-+ return;
-+ }
- #endif
- dropbear_exit("Bad key types in put pub key");
- }
-@@ -379,6 +420,10 @@ void sign_key_free(sign_key *key) {
- key->ecckey521 = NULL;
- }
- #endif
-+#endif
-+#if DROPBEAR_ED25519
-+ ed25519_key_free(key->ed25519key);
-+ key->ed25519key = NULL;
- #endif
-
- m_free(key->filename);
-@@ -503,6 +548,11 @@ void buf_put_sign(buffer* buf, sign_key *key, enum signkey_type type,
- buf_put_ecdsa_sign(sigblob, *eck, data_buf);
- }
- }
-+#endif
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ buf_put_ed25519_sign(sigblob, key->ed25519key, data_buf);
-+ }
- #endif
- if (sigblob->len == 0) {
- dropbear_exit("Non-matching signing type");
-@@ -555,6 +605,14 @@ int buf_verify(buffer * buf, sign_key *key, const buffer *data_buf) {
- }
- }
- #endif
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ if (key->ed25519key == NULL) {
-+ dropbear_exit("No Ed25519 key to verify signature");
-+ }
-+ return buf_ed25519_verify(buf, key->ed25519key, data_buf);
-+ }
-+#endif
-
- dropbear_exit("Non-matching signing type");
- return DROPBEAR_FAILURE;
-diff --git a/signkey.h b/signkey.h
-index 59df3ee..fa39a02 100644
---- a/signkey.h
-+++ b/signkey.h
-@@ -28,6 +28,7 @@
- #include "buffer.h"
- #include "dss.h"
- #include "rsa.h"
-+#include "ed25519.h"
-
- enum signkey_type {
- #if DROPBEAR_RSA
-@@ -41,6 +42,9 @@ enum signkey_type {
- DROPBEAR_SIGNKEY_ECDSA_NISTP384,
- DROPBEAR_SIGNKEY_ECDSA_NISTP521,
- #endif /* DROPBEAR_ECDSA */
-+#if DROPBEAR_ED25519
-+ DROPBEAR_SIGNKEY_ED25519,
-+#endif
- DROPBEAR_SIGNKEY_NUM_NAMED,
- DROPBEAR_SIGNKEY_ECDSA_KEYGEN = 70, /* just "ecdsa" for keygen */
- DROPBEAR_SIGNKEY_ANY = 80,
-@@ -78,6 +82,9 @@ struct SIGN_key {
- ecc_key * ecckey521;
- #endif
- #endif
-+#if DROPBEAR_ED25519
-+ dropbear_ed25519_key * ed25519key;
-+#endif
- };
-
- typedef struct SIGN_key sign_key;
-diff --git a/ssh.h b/ssh.h
-index f40b65a..db723b8 100644
---- a/ssh.h
-+++ b/ssh.h
-@@ -105,6 +105,8 @@
- #define SSH_SIGNKEY_DSS_LEN 7
- #define SSH_SIGNKEY_RSA "ssh-rsa"
- #define SSH_SIGNKEY_RSA_LEN 7
-+#define SSH_SIGNKEY_ED25519 "ssh-ed25519"
-+#define SSH_SIGNKEY_ED25519_LEN 11
-
- /* Agent commands. These aren't part of the spec, and are defined
- * only on the openssh implementation. */
-diff --git a/svr-kex.c b/svr-kex.c
-index 406ad97..af16d2f 100644
---- a/svr-kex.c
-+++ b/svr-kex.c
-@@ -122,6 +122,11 @@ static void svr_ensure_hostkey() {
- case DROPBEAR_SIGNKEY_ECDSA_NISTP521:
- fn = ECDSA_PRIV_FILENAME;
- break;
-+#endif
-+#if DROPBEAR_ED25519
-+ case DROPBEAR_SIGNKEY_ED25519:
-+ fn = ED25519_PRIV_FILENAME;
-+ break;
- #endif
- default:
- dropbear_assert(0);
-@@ -219,7 +224,8 @@ static void send_msg_kexdh_reply(mp_int *dh_e, buffer *ecdh_qs) {
- {
- struct kex_curve25519_param *param = gen_kexcurve25519_param();
- kexcurve25519_comb_key(param, ecdh_qs, svr_opts.hostkey);
-- buf_putstring(ses.writepayload, (const char*)param->pub, CURVE25519_LEN);
-+
-+ buf_putstring(ses.writepayload, param->pub, CURVE25519_LEN);
- free_kexcurve25519_param(param);
- }
- break;
-diff --git a/svr-runopts.c b/svr-runopts.c
-index d7a0d5a..d430825 100644
---- a/svr-runopts.c
-+++ b/svr-runopts.c
-@@ -57,6 +57,9 @@ static void printhelp(const char * progname) {
- #if DROPBEAR_ECDSA
- " ecdsa %s\n"
- #endif
-+#if DROPBEAR_ED25519
-+ " ed25519 %s\n"
-+#endif
- #if DROPBEAR_DELAY_HOSTKEY
- "-R Create hostkeys as required\n"
- #endif
-@@ -116,6 +119,9 @@ static void printhelp(const char * progname) {
- #endif
- #if DROPBEAR_ECDSA
- ECDSA_PRIV_FILENAME,
-+#endif
-+#if DROPBEAR_ED25519
-+ ED25519_PRIV_FILENAME,
- #endif
- MAX_AUTH_TRIES,
- DROPBEAR_MAX_PORTS, DROPBEAR_DEFPORT, DROPBEAR_PIDFILE,
-@@ -538,6 +544,13 @@ static void loadhostkey(const char *keyfile, int fatal_duplicate) {
- }
- #endif
- #endif /* DROPBEAR_ECDSA */
-+
-+#if DROPBEAR_ED25519
-+ if (type == DROPBEAR_SIGNKEY_ED25519) {
-+ loadhostkey_helper("ed25519", (void**)&read_key->ed25519key, (void**)&svr_opts.hostkey->ed25519key, fatal_duplicate);
-+ }
-+#endif
-+
- sign_key_free(read_key);
- TRACE(("leave loadhostkey"))
- }
-@@ -578,6 +591,9 @@ void load_all_hostkeys() {
-
- #if DROPBEAR_ECDSA
- loadhostkey(ECDSA_PRIV_FILENAME, 0);
-+#endif
-+#if DROPBEAR_ED25519
-+ loadhostkey(ED25519_PRIV_FILENAME, 0);
- #endif
- }
-
-@@ -642,6 +658,14 @@ void load_all_hostkeys() {
- #endif
- #endif /* DROPBEAR_ECDSA */
-
-+#if DROPBEAR_ED25519
-+ if (!svr_opts.delay_hostkey && !svr_opts.hostkey->ed25519key) {
-+ disablekey(DROPBEAR_SIGNKEY_ED25519);
-+ } else {
-+ any_keys = 1;
-+ }
-+#endif
-+
- if (!any_keys) {
- dropbear_exit("No hostkeys available. 'dropbear -R' may be useful or run dropbearkey.");
- }
-diff --git a/sysoptions.h b/sysoptions.h
-index cfd5469..2c27caf 100644
---- a/sysoptions.h
-+++ b/sysoptions.h
-@@ -145,7 +145,8 @@ If you test it please contact the Dropbear author */
- #define DROPBEAR_SHA384 (DROPBEAR_ECC_384)
- /* LTC SHA384 depends on SHA512 */
- #define DROPBEAR_SHA512 ((DROPBEAR_SHA2_512_HMAC) || (DROPBEAR_ECC_521) \
-- || (DROPBEAR_SHA384) || (DROPBEAR_DH_GROUP16))
-+ || (DROPBEAR_SHA384) || (DROPBEAR_DH_GROUP16) \
-+ || (DROPBEAR_ED25519))
- #define DROPBEAR_MD5 (DROPBEAR_MD5_HMAC)
-
- #define DROPBEAR_DH_GROUP14 ((DROPBEAR_DH_GROUP14_SHA256) || (DROPBEAR_DH_GROUP14_SHA1))
-@@ -186,7 +187,7 @@ If you test it please contact the Dropbear author */
- /* For a 4096 bit DSS key, empirically determined */
- #define MAX_PRIVKEY_SIZE 1700
-
--#define MAX_HOSTKEYS 3
-+#define MAX_HOSTKEYS 4
-
- /* The maximum size of the bignum portion of the kexhash buffer */
- /* Sect. 8 of the transport rfc 4253, K_S + e + f + K */
-@@ -252,7 +253,7 @@ If you test it please contact the Dropbear author */
- #error "At least one encryption algorithm must be enabled. AES128 is recommended."
- #endif
-
--#if !(DROPBEAR_RSA || DROPBEAR_DSS || DROPBEAR_ECDSA)
-+#if !(DROPBEAR_RSA || DROPBEAR_DSS || DROPBEAR_ECDSA || DROPBEAR_ED25519)
- #error "At least one hostkey or public-key algorithm must be enabled; RSA is recommended."
- #endif
-
---
-2.17.1
-
+++ /dev/null
-From 3cdf9ec918b37c17e12b33e4c244944d1ee836ca Mon Sep 17 00:00:00 2001
-From: Vladislav Grishenko <themiron@mail.ru>
-Date: Mon, 6 Apr 2020 23:28:09 +0500
-Subject: [PATCH] Add Chacha20-Poly1305 authenticated encryption
-
-* Add general AEAD approach.
-* Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and
- poly1305 routines.
-
-Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
-AES instructions, having the same key size.
-Compiling in will add ~5,5kB to binary size on x86-64.
----
- Makefile.in | 2 +-
- algo.h | 8 ++
- chachapoly.c | 148 ++++++++++++++++++++
- chachapoly.h | 44 ++++++
- common-algo.c | 11 +-
- common-kex.c | 44 ++++--
- default_options.h | 6 +
- libtomcrypt/src/headers/tomcrypt_dropbear.h | 4 +
- packet.c | 145 +++++++++++++------
- session.h | 4 +
- sysoptions.h | 8 +-
- 11 files changed, 368 insertions(+), 56 deletions(-)
- create mode 100644 chachapoly.c
- create mode 100644 chachapoly.h
-
-diff --git a/Makefile.in b/Makefile.in
-index aaf7b3b..3437cb2 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -53,7 +53,7 @@ CLIOBJS=cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
- CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
- common-channel.o common-chansession.o termcodes.o loginrec.o \
- tcp-accept.o listener.o process-packet.o dh_groups.o \
-- common-runopts.o circbuffer.o list.o netio.o
-+ common-runopts.o circbuffer.o list.o netio.o chachapoly.o
-
- KEYOBJS=dropbearkey.o
-
-diff --git a/algo.h b/algo.h
-index b12fb94..efd0d73 100644
---- a/algo.h
-+++ b/algo.h
-@@ -72,6 +72,14 @@ struct dropbear_cipher_mode {
- unsigned long len, void *cipher_state);
- int (*decrypt)(const unsigned char *ct, unsigned char *pt,
- unsigned long len, void *cipher_state);
-+ int (*aead_crypt)(unsigned int seq,
-+ const unsigned char *in, unsigned char *out,
-+ unsigned long len, unsigned long taglen,
-+ void *cipher_state, int direction);
-+ int (*aead_getlength)(unsigned int seq,
-+ const unsigned char *in, unsigned int *outlen,
-+ unsigned long len, void *cipher_state);
-+ const struct dropbear_hash *aead_mac;
- };
-
- struct dropbear_hash {
-diff --git a/chachapoly.c b/chachapoly.c
-new file mode 100644
-index 0000000..8fb06c5
---- /dev/null
-+++ b/chachapoly.c
-@@ -0,0 +1,148 @@
-+/*
-+ * Dropbear SSH
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * Copyright (c) 2020 by Vladislav Grishenko
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#include "includes.h"
-+#include "algo.h"
-+#include "dbutil.h"
-+#include "chachapoly.h"
-+
-+#if DROPBEAR_CHACHA20POLY1305
-+
-+#define CHACHA20_KEY_LEN 32
-+#define CHACHA20_BLOCKSIZE 8
-+#define POLY1305_KEY_LEN 32
-+#define POLY1305_TAG_LEN 16
-+
-+static const struct ltc_cipher_descriptor dummy = {.name = NULL};
-+
-+static const struct dropbear_hash dropbear_chachapoly_mac =
-+ {NULL, POLY1305_KEY_LEN, POLY1305_TAG_LEN};
-+
-+const struct dropbear_cipher dropbear_chachapoly =
-+ {&dummy, CHACHA20_KEY_LEN*2, CHACHA20_BLOCKSIZE};
-+
-+static int dropbear_chachapoly_start(int UNUSED(cipher), const unsigned char* UNUSED(IV),
-+ const unsigned char *key, int keylen,
-+ int UNUSED(num_rounds), dropbear_chachapoly_state *state) {
-+ int err;
-+
-+ TRACE2(("enter dropbear_chachapoly_start"))
-+
-+ if (keylen != CHACHA20_KEY_LEN*2) {
-+ return CRYPT_ERROR;
-+ }
-+
-+ if ((err = chacha_setup(&state->chacha, key,
-+ CHACHA20_KEY_LEN, 20)) != CRYPT_OK) {
-+ return err;
-+ }
-+
-+ if ((err = chacha_setup(&state->header, key + CHACHA20_KEY_LEN,
-+ CHACHA20_KEY_LEN, 20) != CRYPT_OK)) {
-+ return err;
-+ }
-+
-+ TRACE2(("leave dropbear_chachapoly_start"))
-+ return CRYPT_OK;
-+}
-+
-+static int dropbear_chachapoly_crypt(unsigned int seq,
-+ const unsigned char *in, unsigned char *out,
-+ unsigned long len, unsigned long taglen,
-+ dropbear_chachapoly_state *state, int direction) {
-+ poly1305_state poly;
-+ unsigned char seqbuf[8], key[POLY1305_KEY_LEN], tag[POLY1305_TAG_LEN];
-+ int err;
-+
-+ TRACE2(("enter dropbear_chachapoly_crypt"))
-+
-+ if (len < 4 || taglen != POLY1305_TAG_LEN) {
-+ return CRYPT_ERROR;
-+ }
-+
-+ STORE64H((uint64_t)seq, seqbuf);
-+ chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 0);
-+ if ((err = chacha_keystream(&state->chacha, key, sizeof(key))) != CRYPT_OK) {
-+ return err;
-+ }
-+
-+ poly1305_init(&poly, key, sizeof(key));
-+ if (direction == LTC_DECRYPT) {
-+ poly1305_process(&poly, in, len);
-+ poly1305_done(&poly, tag, &taglen);
-+ if (constant_time_memcmp(in + len, tag, taglen) != 0) {
-+ return CRYPT_ERROR;
-+ }
-+ }
-+
-+ chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
-+ if ((err = chacha_crypt(&state->header, in, 4, out)) != CRYPT_OK) {
-+ return err;
-+ }
-+
-+ chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 1);
-+ if ((err = chacha_crypt(&state->chacha, in + 4, len - 4, out + 4)) != CRYPT_OK) {
-+ return err;
-+ }
-+
-+ if (direction == LTC_ENCRYPT) {
-+ poly1305_process(&poly, out, len);
-+ poly1305_done(&poly, out + len, &taglen);
-+ }
-+
-+ TRACE2(("leave dropbear_chachapoly_crypt"))
-+ return CRYPT_OK;
-+}
-+
-+static int dropbear_chachapoly_getlength(unsigned int seq,
-+ const unsigned char *in, unsigned int *outlen,
-+ unsigned long len, dropbear_chachapoly_state *state) {
-+ unsigned char seqbuf[8], buf[4];
-+ int err;
-+
-+ TRACE2(("enter dropbear_chachapoly_getlength"))
-+
-+ if (len < sizeof(buf)) {
-+ return CRYPT_ERROR;
-+ }
-+
-+ STORE64H((uint64_t)seq, seqbuf);
-+ chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
-+ if ((err = chacha_crypt(&state->header, in, sizeof(buf), buf)) != CRYPT_OK) {
-+ return err;
-+ }
-+
-+ LOAD32H(*outlen, buf);
-+
-+ TRACE2(("leave dropbear_chachapoly_getlength"))
-+ return CRYPT_OK;
-+}
-+
-+const struct dropbear_cipher_mode dropbear_mode_chachapoly =
-+ {(void *)dropbear_chachapoly_start, NULL, NULL,
-+ (void *)dropbear_chachapoly_crypt,
-+ (void *)dropbear_chachapoly_getlength, &dropbear_chachapoly_mac};
-+
-+#endif /* DROPBEAR_CHACHA20POLY1305 */
-diff --git a/chachapoly.h b/chachapoly.h
-new file mode 100644
-index 0000000..5a7c5b2
---- /dev/null
-+++ b/chachapoly.h
-@@ -0,0 +1,44 @@
-+/*
-+ * Dropbear SSH
-+ *
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * Copyright (c) 2020 by Vladislav Grishenko
-+ * All rights reserved.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#ifndef DROPBEAR_DROPBEAR_CHACHAPOLY_H_
-+#define DROPBEAR_DROPBEAR_CHACHAPOLY_H_
-+
-+#include "includes.h"
-+#include "algo.h"
-+
-+#if DROPBEAR_CHACHA20POLY1305
-+
-+typedef struct {
-+ chacha_state chacha;
-+ chacha_state header;
-+} dropbear_chachapoly_state;
-+
-+extern const struct dropbear_cipher dropbear_chachapoly;
-+extern const struct dropbear_cipher_mode dropbear_mode_chachapoly;
-+
-+#endif /* DROPBEAR_CHACHA20POLY1305 */
-+
-+#endif /* DROPBEAR_DROPBEAR_CHACHAPOLY_H_ */
-diff --git a/common-algo.c b/common-algo.c
-index 558aad2..1436456 100644
---- a/common-algo.c
-+++ b/common-algo.c
-@@ -30,6 +30,7 @@
- #include "dh_groups.h"
- #include "ltc_prng.h"
- #include "ecc.h"
-+#include "chachapoly.h"
-
- /* This file (algo.c) organises the ciphers which can be used, and is used to
- * decide which ciphers/hashes/compression/signing to use during key exchange*/
-@@ -86,11 +87,11 @@ const struct dropbear_cipher dropbear_nocipher =
- * about the symmetric_CBC vs symmetric_CTR cipher_state pointer */
- #if DROPBEAR_ENABLE_CBC_MODE
- const struct dropbear_cipher_mode dropbear_mode_cbc =
-- {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt};
-+ {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt, NULL, NULL, NULL};
- #endif /* DROPBEAR_ENABLE_CBC_MODE */
-
- const struct dropbear_cipher_mode dropbear_mode_none =
-- {void_start, void_cipher, void_cipher};
-+ {void_start, void_cipher, void_cipher, NULL, NULL, NULL};
-
- #if DROPBEAR_ENABLE_CTR_MODE
- /* a wrapper to make ctr_start and cbc_start look the same */
-@@ -101,7 +102,7 @@ static int dropbear_big_endian_ctr_start(int cipher,
- return ctr_start(cipher, IV, key, keylen, num_rounds, CTR_COUNTER_BIG_ENDIAN, ctr);
- }
- const struct dropbear_cipher_mode dropbear_mode_ctr =
-- {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt};
-+ {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt, NULL, NULL, NULL};
- #endif /* DROPBEAR_ENABLE_CTR_MODE */
-
- /* Mapping of ssh hashes to libtomcrypt hashes, including keysize etc.
-@@ -137,6 +138,10 @@ const struct dropbear_hash dropbear_nohash =
- * that is also supported by the server will get used. */
-
- algo_type sshciphers[] = {
-+#if DROPBEAR_CHACHA20POLY1305
-+ {"chacha20-poly1305@openssh.com", 0, &dropbear_chachapoly, 1, &dropbear_mode_chachapoly},
-+#endif
-+
- #if DROPBEAR_ENABLE_CTR_MODE
- #if DROPBEAR_AES128
- {"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
-diff --git a/common-kex.c b/common-kex.c
-index 16b7e27..5e2923f 100644
---- a/common-kex.c
-+++ b/common-kex.c
-@@ -329,9 +329,12 @@ static void gen_new_keys() {
- hashkeys(S2C_key, sizeof(S2C_key), &hs, 'D');
-
- if (ses.newkeys->recv.algo_crypt->cipherdesc != NULL) {
-- int recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
-- if (recv_cipher < 0)
-- dropbear_exit("Crypto error");
-+ int recv_cipher = -1;
-+ if (ses.newkeys->recv.algo_crypt->cipherdesc->name != NULL) {
-+ recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
-+ if (recv_cipher < 0)
-+ dropbear_exit("Crypto error");
-+ }
- if (ses.newkeys->recv.crypt_mode->start(recv_cipher,
- recv_IV, recv_key,
- ses.newkeys->recv.algo_crypt->keysize, 0,
-@@ -341,9 +344,12 @@ static void gen_new_keys() {
- }
-
- if (ses.newkeys->trans.algo_crypt->cipherdesc != NULL) {
-- int trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
-- if (trans_cipher < 0)
-- dropbear_exit("Crypto error");
-+ int trans_cipher = -1;
-+ if (ses.newkeys->trans.algo_crypt->cipherdesc->name != NULL) {
-+ trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
-+ if (trans_cipher < 0)
-+ dropbear_exit("Crypto error");
-+ }
- if (ses.newkeys->trans.crypt_mode->start(trans_cipher,
- trans_IV, trans_key,
- ses.newkeys->trans.algo_crypt->keysize, 0,
-@@ -868,19 +874,29 @@ static void read_kex_algos() {
-
- /* mac_algorithms_client_to_server */
- c2s_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
-+#if DROPBEAR_AEAD_MODE
-+ if (((struct dropbear_cipher_mode*)c2s_cipher_algo->mode)->aead_crypt != NULL) {
-+ c2s_hash_algo = NULL;
-+ } else
-+#endif
- if (c2s_hash_algo == NULL) {
- erralgo = "mac c->s";
- goto error;
- }
-- TRACE(("hash c2s is %s", c2s_hash_algo->name))
-+ TRACE(("hash c2s is %s", c2s_hash_algo ? c2s_hash_algo->name : "<implicit>"))
-
- /* mac_algorithms_server_to_client */
- s2c_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
-+#if DROPBEAR_AEAD_MODE
-+ if (((struct dropbear_cipher_mode*)s2c_cipher_algo->mode)->aead_crypt != NULL) {
-+ s2c_hash_algo = NULL;
-+ } else
-+#endif
- if (s2c_hash_algo == NULL) {
- erralgo = "mac s->c";
- goto error;
- }
-- TRACE(("hash s2c is %s", s2c_hash_algo->name))
-+ TRACE(("hash s2c is %s", s2c_hash_algo ? s2c_hash_algo->name : "<implicit>"))
-
- /* compression_algorithms_client_to_server */
- c2s_comp_algo = buf_match_algo(ses.payload, ses.compress_algos, NULL, NULL);
-@@ -925,8 +941,14 @@ static void read_kex_algos() {
- ses.newkeys->trans.crypt_mode =
- (struct dropbear_cipher_mode*)c2s_cipher_algo->mode;
- ses.newkeys->recv.algo_mac =
-+#if DROPBEAR_AEAD_MODE
-+ s2c_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
-+#endif
- (struct dropbear_hash*)s2c_hash_algo->data;
- ses.newkeys->trans.algo_mac =
-+#if DROPBEAR_AEAD_MODE
-+ c2s_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
-+#endif
- (struct dropbear_hash*)c2s_hash_algo->data;
- ses.newkeys->recv.algo_comp = s2c_comp_algo->val;
- ses.newkeys->trans.algo_comp = c2s_comp_algo->val;
-@@ -941,8 +963,14 @@ static void read_kex_algos() {
- ses.newkeys->trans.crypt_mode =
- (struct dropbear_cipher_mode*)s2c_cipher_algo->mode;
- ses.newkeys->recv.algo_mac =
-+#if DROPBEAR_AEAD_MODE
-+ c2s_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
-+#endif
- (struct dropbear_hash*)c2s_hash_algo->data;
- ses.newkeys->trans.algo_mac =
-+#if DROPBEAR_AEAD_MODE
-+ s2c_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
-+#endif
- (struct dropbear_hash*)s2c_hash_algo->data;
- ses.newkeys->recv.algo_comp = c2s_comp_algo->val;
- ses.newkeys->trans.algo_comp = s2c_comp_algo->val;
-diff --git a/default_options.h b/default_options.h
-index bafbb07..1a2ab10 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -99,6 +99,12 @@ IMPORTANT: Some options will require "make clean" after changes */
- * and forwards compatibility */
- #define DROPBEAR_ENABLE_CTR_MODE 1
-
-+/* Enable Chacha20-Poly1305 authenticated encryption mode. This is
-+ * generally faster than AES256 on CPU w/o dedicated AES instructions,
-+ * having the same key size.
-+ * Compiling in will add ~5,5kB to binary size on x86-64 */
-+#define DROPBEAR_CHACHA20POLY1305 1
-+
- /* Message integrity. sha2-256 is recommended as a default,
- sha1 for compatibility */
- #define DROPBEAR_SHA1_HMAC 1
-diff --git a/libtomcrypt/src/headers/tomcrypt_dropbear.h b/libtomcrypt/src/headers/tomcrypt_dropbear.h
-index b0ce45b..59960e5 100644
---- a/libtomcrypt/src/headers/tomcrypt_dropbear.h
-+++ b/libtomcrypt/src/headers/tomcrypt_dropbear.h
-@@ -35,6 +35,10 @@
- #define LTC_CTR_MODE
- #endif
-
-+#if DROPBEAR_CHACHA20POLY1305
-+#define LTC_CHACHA
-+#define LTC_POLY1305
-+#endif
-
- #if DROPBEAR_SHA512
- #define LTC_SHA512
-diff --git a/packet.c b/packet.c
-index 9fda0d6..0454726 100644
---- a/packet.c
-+++ b/packet.c
-@@ -215,7 +215,7 @@ static int read_packet_init() {
-
- unsigned int maxlen;
- int slen;
-- unsigned int len;
-+ unsigned int len, plen;
- unsigned int blocksize;
- unsigned int macsize;
-
-@@ -254,21 +254,35 @@ static int read_packet_init() {
- /* now we have the first block, need to get packet length, so we decrypt
- * the first block (only need first 4 bytes) */
- buf_setpos(ses.readbuf, 0);
-- if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
-- buf_getwriteptr(ses.readbuf, blocksize),
-- blocksize,
-- &ses.keys->recv.cipher_state) != CRYPT_OK) {
-- dropbear_exit("Error decrypting");
-+#if DROPBEAR_AEAD_MODE
-+ if (ses.keys->recv.crypt_mode->aead_crypt) {
-+ if (ses.keys->recv.crypt_mode->aead_getlength(ses.recvseq,
-+ buf_getptr(ses.readbuf, blocksize), &plen,
-+ blocksize,
-+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
-+ dropbear_exit("Error decrypting");
-+ }
-+ len = plen + 4 + macsize;
-+ } else
-+#endif
-+ {
-+ if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
-+ buf_getwriteptr(ses.readbuf, blocksize),
-+ blocksize,
-+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
-+ dropbear_exit("Error decrypting");
-+ }
-+ plen = buf_getint(ses.readbuf) + 4;
-+ len = plen + macsize;
- }
-- len = buf_getint(ses.readbuf) + 4 + macsize;
-
- TRACE2(("packet size is %u, block %u mac %u", len, blocksize, macsize))
-
-
- /* check packet length */
- if ((len > RECV_MAX_PACKET_LEN) ||
-- (len < MIN_PACKET_LEN + macsize) ||
-- ((len - macsize) % blocksize != 0)) {
-+ (plen < blocksize) ||
-+ (plen % blocksize != 0)) {
- dropbear_exit("Integrity error (bad packet size %u)", len);
- }
-
-@@ -294,23 +308,42 @@ void decrypt_packet() {
-
- ses.kexstate.datarecv += ses.readbuf->len;
-
-- /* we've already decrypted the first blocksize in read_packet_init */
-- buf_setpos(ses.readbuf, blocksize);
--
-- /* decrypt it in-place */
-- len = ses.readbuf->len - macsize - ses.readbuf->pos;
-- if (ses.keys->recv.crypt_mode->decrypt(
-- buf_getptr(ses.readbuf, len),
-- buf_getwriteptr(ses.readbuf, len),
-- len,
-- &ses.keys->recv.cipher_state) != CRYPT_OK) {
-- dropbear_exit("Error decrypting");
-- }
-- buf_incrpos(ses.readbuf, len);
-+#if DROPBEAR_AEAD_MODE
-+ if (ses.keys->recv.crypt_mode->aead_crypt) {
-+ /* first blocksize is not decrypted yet */
-+ buf_setpos(ses.readbuf, 0);
-+
-+ /* decrypt it in-place */
-+ len = ses.readbuf->len - macsize - ses.readbuf->pos;
-+ if (ses.keys->recv.crypt_mode->aead_crypt(ses.recvseq,
-+ buf_getptr(ses.readbuf, len + macsize),
-+ buf_getwriteptr(ses.readbuf, len),
-+ len, macsize,
-+ &ses.keys->recv.cipher_state, LTC_DECRYPT) != CRYPT_OK) {
-+ dropbear_exit("Error decrypting");
-+ }
-+ buf_incrpos(ses.readbuf, len);
-+ } else
-+#endif
-+ {
-+ /* we've already decrypted the first blocksize in read_packet_init */
-+ buf_setpos(ses.readbuf, blocksize);
-+
-+ /* decrypt it in-place */
-+ len = ses.readbuf->len - macsize - ses.readbuf->pos;
-+ if (ses.keys->recv.crypt_mode->decrypt(
-+ buf_getptr(ses.readbuf, len),
-+ buf_getwriteptr(ses.readbuf, len),
-+ len,
-+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
-+ dropbear_exit("Error decrypting");
-+ }
-+ buf_incrpos(ses.readbuf, len);
-
-- /* check the hmac */
-- if (checkmac() != DROPBEAR_SUCCESS) {
-- dropbear_exit("Integrity error");
-+ /* check the hmac */
-+ if (checkmac() != DROPBEAR_SUCCESS) {
-+ dropbear_exit("Integrity error");
-+ }
- }
-
- /* get padding length */
-@@ -557,9 +590,16 @@ void encrypt_packet() {
- buf_setpos(ses.writepayload, 0);
- buf_setlen(ses.writepayload, 0);
-
-- /* length of padding - packet length must be a multiple of blocksize,
-- * with a minimum of 4 bytes of padding */
-- padlen = blocksize - (writebuf->len) % blocksize;
-+ /* length of padding - packet length excluding the packetlength uint32
-+ * field in aead mode must be a multiple of blocksize, with a minimum of
-+ * 4 bytes of padding */
-+ len = writebuf->len;
-+#if DROPBEAR_AEAD_MODE
-+ if (ses.keys->trans.crypt_mode->aead_crypt) {
-+ len -= 4;
-+ }
-+#endif
-+ padlen = blocksize - len % blocksize;
- if (padlen < 4) {
- padlen += blocksize;
- }
-@@ -579,23 +619,42 @@ void encrypt_packet() {
- buf_incrlen(writebuf, padlen);
- genrandom(buf_getptr(writebuf, padlen), padlen);
-
-- make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
-+#if DROPBEAR_AEAD_MODE
-+ if (ses.keys->trans.crypt_mode->aead_crypt) {
-+ /* do the actual encryption, in-place */
-+ buf_setpos(writebuf, 0);
-+ /* encrypt it in-place*/
-+ len = writebuf->len;
-+ buf_incrlen(writebuf, mac_size);
-+ if (ses.keys->trans.crypt_mode->aead_crypt(ses.transseq,
-+ buf_getptr(writebuf, len),
-+ buf_getwriteptr(writebuf, len + mac_size),
-+ len, mac_size,
-+ &ses.keys->trans.cipher_state, LTC_ENCRYPT) != CRYPT_OK) {
-+ dropbear_exit("Error encrypting");
-+ }
-+ buf_incrpos(writebuf, len + mac_size);
-+ } else
-+#endif
-+ {
-+ make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
-+
-+ /* do the actual encryption, in-place */
-+ buf_setpos(writebuf, 0);
-+ /* encrypt it in-place*/
-+ len = writebuf->len;
-+ if (ses.keys->trans.crypt_mode->encrypt(
-+ buf_getptr(writebuf, len),
-+ buf_getwriteptr(writebuf, len),
-+ len,
-+ &ses.keys->trans.cipher_state) != CRYPT_OK) {
-+ dropbear_exit("Error encrypting");
-+ }
-+ buf_incrpos(writebuf, len);
-
-- /* do the actual encryption, in-place */
-- buf_setpos(writebuf, 0);
-- /* encrypt it in-place*/
-- len = writebuf->len;
-- if (ses.keys->trans.crypt_mode->encrypt(
-- buf_getptr(writebuf, len),
-- buf_getwriteptr(writebuf, len),
-- len,
-- &ses.keys->trans.cipher_state) != CRYPT_OK) {
-- dropbear_exit("Error encrypting");
-+ /* stick the MAC on it */
-+ buf_putbytes(writebuf, mac_bytes, mac_size);
- }
-- buf_incrpos(writebuf, len);
--
-- /* stick the MAC on it */
-- buf_putbytes(writebuf, mac_bytes, mac_size);
-
- /* Update counts */
- ses.kexstate.datatrans += writebuf->len;
-diff --git a/session.h b/session.h
-index e436882..a8f8914 100644
---- a/session.h
-+++ b/session.h
-@@ -41,6 +41,7 @@
- #include "chansession.h"
- #include "dbutil.h"
- #include "netio.h"
-+#include "chachapoly.h"
-
- void common_session_init(int sock_in, int sock_out);
- void session_loop(void(*loophandler)(void)) ATTRIB_NORETURN;
-@@ -80,6 +81,9 @@ struct key_context_directional {
- symmetric_CBC cbc;
- #if DROPBEAR_ENABLE_CTR_MODE
- symmetric_CTR ctr;
-+#endif
-+#if DROPBEAR_CHACHA20POLY1305
-+ dropbear_chachapoly_state chachapoly;
- #endif
- } cipher_state;
- unsigned char mackey[MAX_MAC_LEN];
-diff --git a/sysoptions.h b/sysoptions.h
-index 2c27caf..2432779 100644
---- a/sysoptions.h
-+++ b/sysoptions.h
-@@ -92,7 +92,11 @@
- #define MD5_HASH_SIZE 16
- #define MAX_HASH_SIZE 64 /* sha512 */
-
-+#if DROPBEAR_CHACHA20POLY1305
-+#define MAX_KEY_LEN 64 /* 2 x 256 bits for chacha20 */
-+#else
- #define MAX_KEY_LEN 32 /* 256 bits for aes256 etc */
-+#endif
- #define MAX_IV_LEN 20 /* must be same as max blocksize, */
-
- #if DROPBEAR_SHA2_512_HMAC
-@@ -207,6 +211,8 @@ If you test it please contact the Dropbear author */
-
- #define DROPBEAR_TWOFISH ((DROPBEAR_TWOFISH256) || (DROPBEAR_TWOFISH128))
-
-+#define DROPBEAR_AEAD_MODE ((DROPBEAR_CHACHA20POLY1305))
-+
- #define DROPBEAR_CLI_ANYTCPFWD ((DROPBEAR_CLI_REMOTETCPFWD) || (DROPBEAR_CLI_LOCALTCPFWD))
-
- #define DROPBEAR_TCP_ACCEPT ((DROPBEAR_CLI_LOCALTCPFWD) || (DROPBEAR_SVR_REMOTETCPFWD))
-@@ -249,7 +255,7 @@ If you test it please contact the Dropbear author */
- #endif
-
- #if !(DROPBEAR_AES128 || DROPBEAR_3DES || DROPBEAR_AES256 || DROPBEAR_BLOWFISH \
-- || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128)
-+ || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128 || DROPBEAR_CHACHA20POLY1305)
- #error "At least one encryption algorithm must be enabled. AES128 is recommended."
- #endif
-
---
-2.17.1
-
projects / openwrt / staging / adrian.git / commitdiff