diff --git a/curve25519-dalek/Cargo.toml b/curve25519-dalek/Cargo.toml index e0c0a057..f8874e8c 100644 --- a/curve25519-dalek/Cargo.toml +++ b/curve25519-dalek/Cargo.toml @@ -37,6 +37,8 @@ hex = "0.4.2" json = "0.12.4" rand = "0.8" rand_core = { version = "0.6", default-features = false, features = ["getrandom"] } +rand_distr = "0.4.3" +kolmogorov_smirnov = "1.1.0" [build-dependencies] rustc_version = "0.4.0" diff --git a/curve25519-dalek/src/edwards.rs b/curve25519-dalek/src/edwards.rs index 7392a571..f1978f98 100644 --- a/curve25519-dalek/src/edwards.rs +++ b/curve25519-dalek/src/edwards.rs @@ -103,8 +103,8 @@ use core::ops::{Mul, MulAssign}; use cfg_if::cfg_if; -#[cfg(feature = "digest")] -use crate::elligator2::map_to_point; +#[cfg(feature = "elligator2")] +use crate::elligator2::{map_fe_to_edwards, MASK_UNSET_BYTE}; #[cfg(feature = "digest")] use digest::{generic_array::typenum::U64, Digest}; @@ -598,7 +598,7 @@ impl EdwardsPoint { let sign_bit = (res[31] & 0x80) >> 7; - let fe1 = map_to_point(&res); + let fe1 = MontgomeryPoint::map_to_point_unbounded(&res); let E1_opt = fe1.to_edwards(sign_bit); E1_opt @@ -606,49 +606,34 @@ impl EdwardsPoint { .mul_by_cofactor() } - #[cfg(elligator2)] - /// Build an [`EdwardsPoint`] using the birational mapping from (the - /// extended `(u, v)` form of) a montgomery point. - pub fn from_uv(u: &[u8; 32], v: &[u8; 32]) -> EdwardsPoint { - let u_fe = FieldElement::from_bytes(u); - let v_fe = FieldElement::from_bytes(v); - let (x, y) = Self::new_edwards_point(&u_fe, &v_fe); - Self::from_xy(x, y) - } - - #[cfg(elligator2)] - fn new_edwards_point(u: &FieldElement, v: &FieldElement) -> (FieldElement, FieldElement) { - // Per RFC 7748: (x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1)) - - let two = &FieldElement::ONE + &FieldElement::ONE; - let (_, sqrt_neg_a_plus_two) = - FieldElement::sqrt_ratio_i(&(&MONTGOMERY_A_NEG + &two), &FieldElement::ONE); - - let mut x = &(u * &v.invert()) * &sqrt_neg_a_plus_two; - - let u_plus_one = u + &FieldElement::ONE; - let u_minus_one = u - &FieldElement::ONE; - - let mut y = &u_minus_one * &u_plus_one.invert(); - - // This mapping is undefined when t == 0 or s == -1, i.e., when the - // denominator of either of the above rational functions is zero. - // Implementations MUST detect exceptional cases and return the value - // (v, w) = (0, 1), which is the identity point on all twisted Edwards - // curves. - let result_undefined = v.is_zero() | u_plus_one.is_zero(); - x.conditional_assign(&FieldElement::ZERO, result_undefined); - y.conditional_assign(&FieldElement::ONE, result_undefined); - - // Convert from Edwards (x, y) to extended (x, y, z, t) coordinates. - // new_edwards_from_xy(x, y) - - (x, y) + #[cfg(feature = "elligator2")] + /// Perform the Elligator2 mapping to an [`EdwardsPoint`]. + /// + /// Calculates a point on elliptic curve E (Curve25519) from an element of + /// the finite field F over which E is defined. See section 6.7.1 of the + /// RFC. + /// + /// The input u and output P are elements of the field F. Note that + /// the output P is a point on the edwards curve and as such it's byte + /// representation is distinguishable from uniform random. + /// + /// Input: + /// * u -> an element of field F. + /// + /// Output: + /// * P - a point on the Edwards elliptic curve. + /// + /// See + pub fn map_to_point(r: &[u8; 32]) -> EdwardsPoint { + let mut clamped = *r; + clamped[31] &= MASK_UNSET_BYTE; + let r_0 = FieldElement::from_bytes(&clamped); + let (x, y) = map_fe_to_edwards(&r_0); + Self::from_xy(&x, &y) } - #[cfg(elligator2)] + #[cfg(feature = "elligator2")] fn from_xy(x: &FieldElement, y: &FieldElement) -> EdwardsPoint { - // Yeah yeah yeah, no where better to put this. :( let z = FieldElement::ONE; let t = x * y; @@ -2275,10 +2260,6 @@ mod test { "2eb10d432702ea7f79207da95d206f82d5a3b374f5f89f17a199531f78d3bea6", "d8f8b508edffbb8b6dab0f602f86a9dd759f800fe18f782fdcac47c234883e7f", ], - vec![ - "84cbe9accdd32b46f4a8ef51c85fd39d028711f77fb00e204a613fc235fd68b9", - "93c73e0289afd1d1fc9e4e78a505d5d1b2642fbdf91a1eff7d281930654b1453", - ], vec![ "c85165952490dc1839cb69012a3d9f2cc4b02343613263ab93a26dc89fd58267", "43cbe8685fd3c90665b91835debb89ff1477f906f5170f38a192f6a199556537", @@ -2291,22 +2272,27 @@ mod test { "1618c08ef0233f94f0f163f9435ec7457cd7a8cd4bb6b160315d15818c30f7a2", "da0b703593b29dbcd28ebd6e7baea17b6f61971f3641cae774f6a5137a12294c", ], - vec![ - "48b73039db6fcdcb6030c4a38e8be80b6390d8ae46890e77e623f87254ef149c", - "ca11b25acbc80566603eabeb9364ebd50e0306424c61049e1ce9385d9f349966", - ], vec![ "a744d582b3a34d14d311b7629da06d003045ae77cebceeb4e0e72734d63bd07d", "fad25a5ea15d4541258af8785acaf697a886c1b872c793790e60a6837b1adbc0", ], - vec![ - "80a6ff33494c471c5eff7efb9febfbcf30a946fe6535b3451cda79f2154a7095", - "57ac03913309b3f8cd3c3d4c49d878bb21f4d97dc74a1eaccbe5c601f7f06f47", - ], vec![ "f06fc939bc10551a0fd415aebf107ef0b9c4ee1ef9a164157bdd089127782617", "785b2a6a00a5579cc9da1ff997ce8339b6f9fb46c6f10cf7a12ff2986341a6e0", ], + // Non Least-Square-Root representative values. (i.e. representative > 2^254-10 ) + vec![ + "84cbe9accdd32b46f4a8ef51c85fd39d028711f77fb00e204a613fc235fd68b9", + "93c73e0289afd1d1fc9e4e78a505d5d1b2642fbdf91a1eff7d281930654b1453", + ], + vec![ + "48b73039db6fcdcb6030c4a38e8be80b6390d8ae46890e77e623f87254ef149c", + "ca11b25acbc80566603eabeb9364ebd50e0306424c61049e1ce9385d9f349966", + ], + vec![ + "80a6ff33494c471c5eff7efb9febfbcf30a946fe6535b3451cda79f2154a7095", + "57ac03913309b3f8cd3c3d4c49d878bb21f4d97dc74a1eaccbe5c601f7f06f47", + ], ] } @@ -2314,12 +2300,16 @@ mod test { #[allow(deprecated)] #[cfg(all(feature = "alloc", feature = "digest"))] fn elligator_signal_test_vectors() { - for vector in test_vectors().iter() { - let input = hex::decode(vector[0]).unwrap(); - let output = hex::decode(vector[1]).unwrap(); + for (n, vector) in test_vectors().iter().enumerate() { + let input = hex::decode(vector[0]).expect("failed to decode hex input"); + let output = hex::decode(vector[1]).expect("failed to decode hex output"); let point = EdwardsPoint::nonspec_map_to_curve::(&input); - assert_eq!(point.compress().to_bytes(), output[..]); + assert_eq!( + hex::encode(point.compress().to_bytes()), + hex::encode(&output[..]), + "signal map_to_curve failed for test {n}" + ); } } } diff --git a/curve25519-dalek/src/elligator2.rs b/curve25519-dalek/src/elligator2.rs index 085cdbfa..18b3b926 100644 --- a/curve25519-dalek/src/elligator2.rs +++ b/curve25519-dalek/src/elligator2.rs @@ -12,17 +12,53 @@ use subtle::{ CtOption, }; +/// bitmask for a single byte when clearing the high order two bits of a representative +pub(crate) const MASK_UNSET_BYTE: u8 = 0x3f; +/// bitmask for a single byte when setting the high order two bits of a representative +pub(crate) const MASK_SET_BYTE: u8 = 0xc0; + /// (p - 1) / 2 = 2^254 - 10 pub(crate) const DIVIDE_MINUS_P_1_2_BYTES: [u8; 32] = [ 0xf6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, ]; -/// Gets the public representative for a key pair using the private key -pub fn representative_from_privkey(privkey: &[u8; 32]) -> Option<[u8; 32]> { +/// Gets a public representative for a key pair using the private key. +/// +/// The `tweak` parameter is used to adjust the computed representative making +/// it computationally indistinguishable from uniform random. If this property +/// is not required then the provided tweak value does not matter. +/// +/// The tweak allows us to overcome three limitations: +/// - Representatives are not always canonical. +/// - Bit 255 (the most significant bit) was always zero. +/// - Only points from the large prime-order subgroup are represented. +/// +/// In order for the returned representative to be canonical a tweak to the +/// high order two bits must be applied. +/// ```txt +/// [An adversary could] observe a representative, interpret it as a field +/// element, square it, then take the square root using the same +/// non-canonical square root algorithm. With representatives produced by +/// an affected version of [the elligator2 implementation], the output of +/// the square-then-root operation would always match the input. With +/// random strings, the output would match only half the time. +/// ``` +/// +/// For a more in-depth explanation see: +/// https://github.com/agl/ed25519/issues/27 +/// https://www.bamsoftware.com/papers/fep-flaws/ +pub fn representative_from_privkey(privkey: &[u8; 32], tweak: u8) -> Option<[u8; 32]> { let pubkey = EdwardsPoint::mul_base_clamped(*privkey).to_montgomery(); let v_in_sqrt = v_in_sqrt(privkey); - point_to_representative(&pubkey, v_in_sqrt.into()).into() + let p: Option<[u8; 32]> = point_to_representative(&pubkey, v_in_sqrt.into()).into(); + match p { + None => None, + Some(mut a) => { + a[31] |= MASK_SET_BYTE & tweak; + Some(a) + } + } } /// This function is used to map a curve point (i.e. an x25519 public key) @@ -116,7 +152,7 @@ fn is_encodable(u: &FieldElement) -> Choice { #[inline] pub(crate) fn high_y(d: &FieldElement) -> Choice { let d_sq = &d.square(); - let au = &MONTGOMERY_A * &d; + let au = &MONTGOMERY_A * d; let inner = &(d_sq + &au) + &FieldElement::ONE; let eps = d * &inner; /* eps = d^3 + Ad^2 + d */ @@ -184,32 +220,9 @@ pub fn v_in_sqrt_pubkey_edwards(pubkey: &EdwardsPoint) -> Choice { // ---------------------------------------------------------------------------- // ---------------------------------------------------------------------------- -#[allow(unused, non_snake_case)] -/// Perform the Elligator2 mapping to Curve25519 in accordance with RFC9380. -/// -/// Calculates a point on elliptic curve E (Curve25519) from an element of -/// the finite field F over which E is defined. See section 6.7.1 of the -/// RFC. -/// -/// The input r and outputs u and v are elements of the field F. The -/// affine coordinates (u, v) specify a point on an elliptic curve -/// defined over F. Note, however, that the point (u, v) is not a -/// uniformly random point. -/// -/// Input: -/// * r -> an element of field F. -/// -/// Output: -/// * Q - a point in `(u,v)` for on the Montgomery elliptic curve. -/// -/// See -pub fn map_to_curve(r: &[u8; 32]) -> ([u8; 32], [u8; 32]) { - let fe = FieldElement::from_bytes(r); - let (x, y) = map_fe_to_curve(&fe); - (x.as_bytes(), y.as_bytes()) -} - -pub(crate) fn map_fe_to_curve(r: &FieldElement) -> (FieldElement, FieldElement) { +fn map_to_curve_parts( + r: &FieldElement, +) -> (FieldElement, FieldElement, FieldElement, FieldElement) { let zero = FieldElement::ZERO; let one = FieldElement::ONE; let mut minus_one = FieldElement::ONE; @@ -239,30 +252,49 @@ pub(crate) fn map_fe_to_curve(r: &FieldElement) -> (FieldElement, FieldElement) let (_, mut y) = FieldElement::sqrt_ratio_i(&y2, &one); y.conditional_negate(eps_is_sq ^ y.is_negative()); - (x, y) + (&x * &d_1, d_1, y, one) } -#[allow(unused, non_snake_case)] -/// Perform the Elligator2 mapping to a [`MontgomeryPoint`]. -/// -/// Calculates a point on elliptic curve E (Curve25519) from an element of -/// the finite field F over which E is defined. See section 6.7.1 of the -/// RFC. -/// -/// The input u and output P are elements of the field F. Note, however, that -/// the output point P is not a uniformly random point. -/// -/// Input: -/// * u -> an element of field F. -/// -/// Output: -/// * P - a point on the Montgomery elliptic curve. -/// -/// See -pub fn map_to_point(r: &[u8; 32]) -> MontgomeryPoint { - let r_0 = FieldElement::from_bytes(r); - let (p, _) = map_fe_to_curve(&r_0); - MontgomeryPoint(p.as_bytes()) +pub(crate) fn map_fe_to_montgomery(r: &FieldElement) -> (FieldElement, FieldElement) { + let (xmn, xmd, y, _) = map_to_curve_parts(r); + (&xmn * &(xmd.invert()), y) +} + +pub(crate) fn map_fe_to_edwards(r: &FieldElement) -> (FieldElement, FieldElement) { + // 1. (xMn, xMd, yMn, yMd) = map_to_curve_elligator2_curve25519(u) + let (xmn, xmd, ymn, ymd) = map_to_curve_parts(r); + // c1 = sqrt(-486664) + // this cannot fail as it computes a constant + let c1 = &(&MONTGOMERY_A_NEG - &FieldElement::ONE) - &FieldElement::ONE; + let (_, c1) = FieldElement::sqrt_ratio_i(&c1, &FieldElement::ONE); + + // 2. xn = xMn * yMd + // 3. xn = xn * c1 + let mut xn = &(&xmn * &ymd) * &c1; + + // 4. xd = xMd * yMn # xn / xd = c1 * xM / yM + let mut xd = &xmd * &ymn; + + // 5. yn = xMn - xMd + let mut yn = &xmn - &xmd; + // 6. yd = xMn + xMd # (n / d - 1) / (n / d + 1) = (n - d) / (n + d) + let mut yd = &xmn + &xmd; + + // 7. tv1 = xd * yd + // 8. e = tv1 == 0 + let cond = (&xd * &yd).is_zero(); + + // 9. xn = CMOV(xn, 0, e) + // 10. xd = CMOV(xd, 1, e) + // 11. yn = CMOV(yn, 1, e) + // 12. yd = CMOV(yd, 1, e) + xn = FieldElement::conditional_select(&xn, &FieldElement::ZERO, cond); + xd = FieldElement::conditional_select(&xd, &FieldElement::ONE, cond); + yn = FieldElement::conditional_select(&yn, &FieldElement::ONE, cond); + yd = FieldElement::conditional_select(&yd, &FieldElement::ONE, cond); + + // 13. return (xn, xd, yn, yd) + (&xn * &(xd.invert()), &yn * &(yd.invert())) } // ------------------------------------------------------------------------ @@ -275,7 +307,7 @@ pub fn map_to_point(r: &[u8; 32]) -> MontgomeryPoint { mod test { use super::*; - const MASK_UNSET_BYTE: u8 = 0x3f; + use hex::FromHex; //////////////////////////////////////////////////////////// // Ntor tests // @@ -286,26 +318,26 @@ mod test { fn repres_from_pubkey_kleshni() { // testcases from kleshni for (i, testcase) in encoding_testcases().iter().enumerate() { - let point: [u8; 32] = hex::decode(testcase.point).unwrap().try_into().unwrap(); + let point = <[u8; 32]>::from_hex(testcase.point).expect("failed to decode hex point"); let edw_point = MontgomeryPoint(point) .to_edwards(testcase.high_y as u8) - .unwrap(); + .expect("failed to convert point to edwards"); let v_in_sqrt = v_in_sqrt_pubkey_edwards(&edw_point); let repres: Option<[u8; 32]> = point_to_representative(&MontgomeryPoint(point), v_in_sqrt.into()).into(); if testcase.representative.is_some() { assert_eq!( - testcase.representative.unwrap(), - hex::encode(repres.unwrap()), + testcase.representative.expect("checked, is some"), + hex::encode(repres.expect("failed to get representative from point")), "[good case] kleshni ({i}) bad pubkey from true representative" ); } else { assert!( repres.is_none(), "[good case] kleshni ({i}) expected none got repres {}", - hex::encode(repres.unwrap()) + hex::encode(repres.expect("this should not fail")) ); } } @@ -317,17 +349,16 @@ mod test { /// are generated from agl/ed25519 to ensure compatibility. fn repres_from_privkey_agl() { for (i, vector) in ntor_valid_test_vectors().iter().enumerate() { - let privkey: [u8; 32] = hex::decode(vector[0]).unwrap().try_into().unwrap(); + let privkey = <[u8; 32]>::from_hex(vector[0]).expect("failed to decode hex privatekey"); let true_repres = vector[2]; - let repres_res = representative_from_privkey(&privkey); + let repres_res = representative_from_privkey(&privkey, 0u8); assert!( Into::::into(repres_res.is_some()), "failed to get representative when we should have gotten one :(" ); - let mut repres = repres_res.unwrap(); + let repres = repres_res.expect("failed to get representative from pubkey"); - repres[31] &= MASK_UNSET_BYTE; assert_eq!( true_repres, hex::encode(repres), @@ -341,27 +372,33 @@ mod test { fn pubkey_from_repres() { // testcases from kleshni for (i, testcase) in decoding_testcases().iter().enumerate() { - let repres: [u8; 32] = hex::decode(testcase.representative) - .unwrap() - .try_into() - .unwrap(); + let repres = <[u8; 32]>::from_hex(testcase.representative) + .expect("failed to decode hex representative"); - let point = MontgomeryPoint::from_representative(&MontgomeryPoint(repres)); + let point = MontgomeryPoint::map_to_point(&repres); assert_eq!( testcase.point, hex::encode(point.to_bytes()), "[good case] kleshni ({i}) bad representative from point" ); + + let point_from_unbounded = MontgomeryPoint::map_to_point_unbounded(&repres); + assert_eq!( + testcase.non_lsr_point, + hex::encode(point_from_unbounded.to_bytes()), + "[good case] kleshni ({i}) bad representative from point" + ); } // testcases from golang agl/ed25519 for (i, vector) in ntor_valid_test_vectors().iter().enumerate() { let true_pubkey = vector[1]; - let repres: [u8; 32] = hex::decode(vector[2]).unwrap().try_into().unwrap(); + let repres = + <[u8; 32]>::from_hex(vector[2]).expect("failed to decode hex representative"); // ensure that the representative can be reversed to recover the // original public key. - let pubkey = MontgomeryPoint::from_representative(&MontgomeryPoint(repres)); + let pubkey = MontgomeryPoint::map_to_point(&repres); assert_eq!( true_pubkey, hex::encode(pubkey.to_bytes()), @@ -374,15 +411,15 @@ mod test { #[cfg(feature = "elligator2")] fn non_representable_points() { for (i, key) in ntor_invalid_keys().iter().enumerate() { - let privkey: [u8; 32] = hex::decode(key).unwrap().try_into().unwrap(); + let privkey = <[u8; 32]>::from_hex(key).expect("failed to decode hex privkey"); // ensure that the representative can be reversed to recover the // original public key. - let res: Option<[u8; 32]> = representative_from_privkey(&privkey).into(); + let res: Option<[u8; 32]> = representative_from_privkey(&privkey, 0u8); assert!( res.is_none(), "[bad case] agl/ed25519 ({i}) expected None, got Some({})", - hex::encode(res.unwrap()) + hex::encode(res.expect("this shouldn't happen")) ); } } @@ -534,7 +571,7 @@ mod test { ] } - const ENCODING_TESTS_COUNT: usize = 6; + const ENCODING_TESTS_COUNT: usize = 10; struct EncodingTestCase { high_y: bool, point: &'static str, @@ -585,13 +622,50 @@ mod test { "0000000000000000000000000000000000000000000000000000000000000000", ), }, + // A not encodable point with both "high_y" values + EncodingTestCase { + point: "10745497d35c6ede6ea6b330546a6fcbf15c903a7be28ae69b1ca14e0bf09b60", + high_y: false, + representative: Some( + "d660db8cf212d31ce8c6f7139e69b9ac47fd81c7c0bfcb93e364b2d424e24813", + ), + }, + EncodingTestCase { + point: "10745497d35c6ede6ea6b330546a6fcbf15c903a7be28ae69b1ca14e0bf09b60", + high_y: true, + representative: Some( + "489a2e0f6955e08f1ae6eb8dcdbc0f867a87a96a02d2dfd2aca21d8b536f0f1b", + ), + }, + // A not encodable point with both "high_y" values + EncodingTestCase { + point: "6d3187192afc3bcc05a497928816e3e2336dc539aa7fc296a9ee013f560db843", + high_y: false, + representative: Some( + "63d0d79e7f3c279cf4a0a5c3833fd85aa1f2c004c4e466f3a3844b3c2e06e410", + ), + }, + EncodingTestCase { + point: "6d3187192afc3bcc05a497928816e3e2336dc539aa7fc296a9ee013f560db843", + high_y: true, + representative: Some( + "0f03b41c86aeb49acf2f76b39cc90a55a0b140b7290f1c9e032591ddcb074537", + ), + }, ] } const DECODING_TESTS_COUNT: usize = 7; struct DecodingTestCase { representative: &'static str, + /// if we only allow least-square-root values as the representative and + /// clear the high order two bits (effectively) ensuring that the + /// representative value is less than `2^254 - 10`, this is the point + /// that we should receive. point: &'static str, + /// if we allow unbounded values to be used directly as representatives, + /// not only least-square-root values, this is the point we should receive. + non_lsr_point: &'static str, } fn decoding_testcases() -> [DecodingTestCase; DECODING_TESTS_COUNT] { @@ -600,36 +674,45 @@ mod test { DecodingTestCase { representative: "e73507d38bae63992b3f57aac48c0abc14509589288457995a2b4ca3490aa207", point: "1e8afffed6bf53fe271ad572473262ded8faec68e5e67ef45ebb82eeba52604f", + non_lsr_point: "1e8afffed6bf53fe271ad572473262ded8faec68e5e67ef45ebb82eeba52604f", }, // A small representative with true "high_y" property DecodingTestCase { representative: "95a16019041dbefed9832048ede11928d90365f24a38aa7aef1b97e23954101b", point: "794f05ba3e3a72958022468c88981e0be5782be1e1145ce2c3c6fde16ded5363", + non_lsr_point: "794f05ba3e3a72958022468c88981e0be5782be1e1145ce2c3c6fde16ded5363", }, // The last representative returning true: (p - 1) / 2 DecodingTestCase { representative: "f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f", point: "9cdb525555555555555555555555555555555555555555555555555555555555", + non_lsr_point: "9cdb525555555555555555555555555555555555555555555555555555555555", }, // The first representative returning false: (p + 1) / 2 DecodingTestCase { representative: "f7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f", point: "9cdb525555555555555555555555555555555555555555555555555555555555", + non_lsr_point: "9cdb525555555555555555555555555555555555555555555555555555555555", }, + // 0 + DecodingTestCase { + representative: "0000000000000000000000000000000000000000000000000000000000000000", + point: "0000000000000000000000000000000000000000000000000000000000000000", + non_lsr_point: "0000000000000000000000000000000000000000000000000000000000000000", + }, + // These two tests are not least-square-root representations. + // A large representative with false "high_y" property DecodingTestCase { representative: "179f24730ded2ce3173908ec61964653b8027e383f40346c1c9b4d2bdb1db76c", - point: "10745497d35c6ede6ea6b330546a6fcbf15c903a7be28ae69b1ca14e0bf09b60", + point: "e6e5355e0482e952cc951f13db26316ab111ae9edb58c45428a984ce7042d349", + non_lsr_point: "10745497d35c6ede6ea6b330546a6fcbf15c903a7be28ae69b1ca14e0bf09b60", }, // A large representative with true "high_y" property DecodingTestCase { representative: "8a2f286180c3d8630b5f5a3c7cc027a55e0d3ffb3b1b990c5c7bb4c3d1f91b6f", - point: "6d3187192afc3bcc05a497928816e3e2336dc539aa7fc296a9ee013f560db843", - }, - // 0 - DecodingTestCase { - representative: "0000000000000000000000000000000000000000000000000000000000000000", - point: "0000000000000000000000000000000000000000000000000000000000000000", + point: "27e222fec324b0293842a59a63b8201b0f97b1dd599ebcd478a896b7261aff3e", + non_lsr_point: "6d3187192afc3bcc05a497928816e3e2336dc539aa7fc296a9ee013f560db843", }, ] } @@ -645,15 +728,13 @@ mod rfc9380 { #[test] fn map_to_curve_test_go_ed25519_extra() { - for i in 0..CURVE25519_ELL2.len() { - let testcase = &CURVE25519_ELL2[i]; - + for (i, testcase) in CURVE25519_ELL2.iter().enumerate() { let u = testcase[0].must_from_be(); - let mut clamped = u.clone(); + let mut clamped = u; clamped[31] &= 63; // map point to curve - let (q_x, _) = map_fe_to_curve(&FieldElement::from_bytes(&clamped)); + let (q_x, _) = map_fe_to_montgomery(&FieldElement::from_bytes(&clamped)); // check resulting point assert_eq!( @@ -666,12 +747,11 @@ mod rfc9380 { #[test] fn map_to_curve_test_curve25519() { - for i in 0..curve25519_XMD_SHA512_ELL2_NU.len() { - let testcase = &curve25519_XMD_SHA512_ELL2_NU[i]; + for (i, testcase) in curve25519_XMD_SHA512_ELL2_NU.iter().enumerate() { let u = FieldElement::from_bytes(&testcase.u_0.must_from_le()); // map point to curve - let (q_x, q_y) = map_fe_to_curve(&u); + let (q_x, q_y) = map_fe_to_montgomery(&u); // check resulting point assert_eq!( @@ -687,14 +767,13 @@ mod rfc9380 { testcase ); } - for i in 0..curve25519_XMD_SHA512_ELL2_RO.len() { - let testcase = &curve25519_XMD_SHA512_ELL2_RO[i]; + for (i, testcase) in curve25519_XMD_SHA512_ELL2_RO.iter().enumerate() { let u0 = FieldElement::from_bytes(&testcase.u_0.must_from_le()); let u1 = FieldElement::from_bytes(&testcase.u_1.must_from_le()); // map points to curve - let (q0_x, q0_y) = map_fe_to_curve(&u0); - let (q1_x, q1_y) = map_fe_to_curve(&u1); + let (q0_x, q0_y) = map_fe_to_montgomery(&u0); + let (q1_x, q1_y) = map_fe_to_montgomery(&u1); // check resulting points assert_eq!( @@ -726,59 +805,55 @@ mod rfc9380 { #[test] fn map_to_curve_test_edwards25519() { - for i in 0..edwards25519_XMD_SHA512_ELL2_NU.len() { - let testcase = &curve25519_XMD_SHA512_ELL2_NU[i]; + for (i, testcase) in edwards25519_XMD_SHA512_ELL2_NU.iter().enumerate() { let u = FieldElement::from_bytes(&testcase.u_0.must_from_le()); - - // map point to curve - let (q_x, q_y) = map_fe_to_curve(&u); + let (q_x, q_y) = map_fe_to_edwards(&u); // check resulting point assert_eq!( q_x.encode_le(), testcase.Q_x, - "({i}) incorrect Q0_x curve25519 NU\n{:?}", + "({i}) incorrect Q0_x edwards25519 NU\n{:?}", testcase ); assert_eq!( q_y.encode_le(), testcase.Q_y, - "({i}) incorrect Q0_y curve25519 NU\n{:?}", + "({i}) incorrect Q0_y edwards25519 NU\n{:?}", testcase ); } - for i in 0..edwards25519_XMD_SHA512_ELL2_RO.len() { - let testcase = &curve25519_XMD_SHA512_ELL2_RO[i]; + for (i, testcase) in edwards25519_XMD_SHA512_ELL2_RO.iter().enumerate() { let u0 = FieldElement::from_bytes(&testcase.u_0.must_from_le()); let u1 = FieldElement::from_bytes(&testcase.u_1.must_from_le()); // map points to curve - let (q0_x, q0_y) = map_fe_to_curve(&u0); - let (q1_x, q1_y) = map_fe_to_curve(&u1); + let (q0_x, q0_y) = map_fe_to_edwards(&u0); + let (q1_x, q1_y) = map_fe_to_edwards(&u1); // check resulting points assert_eq!( q0_x.encode_le(), testcase.Q0_x, - "({i}) incorrect Q0_x curve25519 RO\n{:?}", + "({i}) incorrect Q0_x edwards25519 RO\n{:?}", testcase ); assert_eq!( q0_y.encode_le(), testcase.Q0_y, - "({i}) incorrect Q0_y curve25519 RO\n{:?}", + "({i}) incorrect Q0_y edwards25519 RO\n{:?}", testcase ); assert_eq!( q1_x.encode_le(), testcase.Q1_x, - "({i}) incorrect Q1_x curve25519 RO\n{:?}", + "({i}) incorrect Q1_x edwards25519 RO\n{:?}", testcase ); assert_eq!( q1_y.encode_le(), testcase.Q1_y, - "({i}) incorrect Q1_y curve25519 RO\n{:?}", + "({i}) incorrect Q1_y edwards25519 RO\n{:?}", testcase ); } @@ -790,7 +865,7 @@ mod rfc9380 { /// 2. associated point /// /// These test cases need the upper two bits cleared to be properly mapped. - const CURVE25519_ELL2: [[&'static str; 2]; 14] = [ + const CURVE25519_ELL2: [[&str; 2]; 14] = [ [ "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", @@ -1051,12 +1126,12 @@ mod rfc9380 { impl<'a> FromByteString for &'a str { fn must_from_le(&self) -> [u8; 32] { - let mut u = <[u8; 32]>::from_hex(self).unwrap(); + let mut u = <[u8; 32]>::from_hex(self).expect("failed to unhex"); u.reverse(); u } fn must_from_be(&self) -> [u8; 32] { - <[u8; 32]>::from_hex(self).unwrap() + <[u8; 32]>::from_hex(self).expect("failed to unhex from be") } } @@ -1069,7 +1144,7 @@ mod rfc9380 { fn encode_le(&self) -> String { let mut b = self.as_bytes(); b.reverse(); - hex::encode(&b) + hex::encode(b) } fn encode_be(&self) -> String { @@ -1079,9 +1154,9 @@ mod rfc9380 { impl ToByteString for [u8; 32] { fn encode_le(&self) -> String { - let mut b = self.clone(); + let mut b = *self; b.reverse(); - hex::encode(&b) + hex::encode(b) } fn encode_be(&self) -> String { @@ -1089,3 +1164,186 @@ mod rfc9380 { } } } + +#[cfg(test)] +#[cfg(feature = "elligator2")] +mod randomness { + use super::*; + + use kolmogorov_smirnov as ks; + use rand::{thread_rng, RngCore}; + use rand_distr::{Binomial, Distribution}; + use std::vec::Vec; + + struct BitCounts { + counts: [[u64; 100]; 32 * 8], + entries: usize, + } + + impl BitCounts { + fn new() -> Self { + BitCounts { + counts: [[0u64; 100]; 256], + entries: 0, + } + } + fn entry(&mut self, arr: &[u8; 32]) { + for (i, arr_byte) in arr.iter().enumerate() { + for j in 0..8 { + self.counts[i * 8 + j][self.entries % 100] += ((arr_byte >> j) & 0x01) as u64; + } + } + self.entries += 1; + } + fn outliers(&self) -> Vec { + let mut rng = thread_rng(); + let binomial_100 = + Binomial::new(100, 0.5).expect("failed to build binomial distribution"); + let expected_dist: [u64; 100] = binomial_100 + .sample_iter(&mut rng) + .take(100) + .collect::>() + .try_into() + .expect("failed to build example binomial expected distribution"); + // this is a high confidence, but we want to avoid this test failing + // due to statistical variability on repeat runs. + let confidence = 0.95; + let mut outlier_indices = vec![]; + + for (n, bit_trial) in self.counts.iter().enumerate() { + let result = ks::test(bit_trial, &expected_dist, confidence); + // require reject_probability == 1.0 to avoid statistical variability on re-runs + if result.is_rejected && result.reject_probability == 1.0 { + // samples definitely not from same distribution + outlier_indices.push(n); + println!( + "{n}, {} {} {} {}", + result.statistic, + result.reject_probability, + result.critical_value, + result.confidence + ); + if n == 255 { + println!("{:?}\n{:?}", bit_trial, expected_dist); + } + } + } + outlier_indices + } + } + + #[test] + /// If we use a "random" value for the tweak the high order bits will be + /// set such that the representative is: + /// 1) unchanged w.r.t. the public key value derived from the representative + /// i.e) it still derives the same public key value from the (clamped) + /// representative that we get from the private key. + /// 2) statistically indistinguishable from uniform random. + /// 4) computationally indistinguishable from random strings for the `a ?= sqrt(a^2)` test. + /// + /// (To see this test fail change `rng.next_u32() as u8` to `0u8`) + fn bitwise_entropy() { + const ITERATIONS: usize = 10000; + // number of iterations + let mut i = 0usize; + let mut rng = thread_rng(); + let mut privkey = [0u8; 32]; + + // count of occurences of a 1 per bit in the representative + let mut bitcounts = BitCounts::new(); + + while i < ITERATIONS { + rng.fill_bytes(&mut privkey); + let alice_representative = + match representative_from_privkey(&privkey, rng.next_u32() as u8) { + None => continue, + Some(r) => r, + }; + + bitcounts.entry(&alice_representative); + + let pub_from_repr = MontgomeryPoint::map_to_point(&alice_representative); + let pub_from_priv = EdwardsPoint::mul_base_clamped(privkey).to_montgomery(); + assert_eq!( + hex::encode(pub_from_priv.as_bytes()), + hex::encode(pub_from_repr.as_bytes()), + "failed pubkey match at iteration {i}" + ); + + i += 1; + } + + let outliers = bitcounts.outliers(); + assert!(outliers.is_empty(), "bad bits: {:?}", outliers); + } + + /// TLDR: The sqrt_ratio_i function is canonical so this library does not + /// suffer from the describbed computational distinguisher. + /// + /// The specific issue that this is testing for can be described as: + /// ```txt + /// An instantiation of Elligator is parameterized by what might be called + /// a “canonical” square root function, one with the property that + /// `√a2 = √(−a)2` for all field elements `a`. That is, we designate just + /// over half the field elements as “non-negative,” and the image of the + /// square root function consists of exactly those elements. A convenient + /// definition of “non-negative” for Curve25519, suggested by its authors, + /// is the lower half of the field, the elements `{0, 1, …, (q − 1) / 2}`. + /// When there are two options for a square root, take the smaller of the two. + /// ``` + /// + /// Any Elligator implementation that does not do this canonicalization of + /// the final square root, and instead it maps a given input systematically + /// to either its negative or non-negative root is vulnerable to the + /// following computational distinguisher. + /// + /// ```txt + /// [An adversary could] observe a representative, interpret it as a field + /// element, square it, then take the square root using the same + /// non-canonical square root algorithm. With representatives produced by + /// an affected version of [the elligator2 implementation], the output of + /// the square-then-root operation would always match the input. With + /// random strings, the output would match only half the time. + /// ``` + /// + /// For a more in-depth explanation see: + /// https://github.com/agl/ed25519/issues/27 + /// https://www.bamsoftware.com/papers/fep-flaws/ + #[test] + fn test_canonical() { + const ITERATIONS: usize = 10000; + // number of iterations + let mut i = 0usize; + let mut rng = thread_rng(); + let mut privkey = [0u8; 32]; + + // number of times the representative (interpreted as a point) squared, then square_rooted, + // equals the original representative. Should happen w/ 50% probability. + let mut squares_equal = 0usize; + + while i < ITERATIONS { + rng.fill_bytes(&mut privkey); + let alice_representative = match representative_from_privkey(&privkey, 0u8) { + None => continue, + Some(r) => r, + }; + + if is_canonical(&alice_representative) { + squares_equal += 1; + } + i += 1; + } + + let expected_range = 4500..5500; // if truly binomial n=10000, p=0.5 then this should "always" pass (> 10x std dev) + assert!( + expected_range.contains(&squares_equal), + "squares_equal: {squares_equal} is not in [4500:5500]" + ); + } + + fn is_canonical(repres: &[u8; 32]) -> bool { + let r_fe = FieldElement::from_bytes(repres); + let (ok, r_fe_prime) = FieldElement::sqrt_ratio_i(&r_fe.square(), &FieldElement::ONE); + (r_fe.ct_eq(&r_fe_prime) & ok).into() + } +} diff --git a/curve25519-dalek/src/montgomery.rs b/curve25519-dalek/src/montgomery.rs index 1f235274..d0a3087e 100644 --- a/curve25519-dalek/src/montgomery.rs +++ b/curve25519-dalek/src/montgomery.rs @@ -248,9 +248,61 @@ impl MontgomeryPoint { } #[cfg(feature = "elligator2")] - /// This decodes an elligator2 hidden point to a curve point on Curve25519. - pub fn from_representative(&self) -> MontgomeryPoint { - elligator2::map_to_point(&self.0) + /// Perform the Elligator2 mapping to a [`MontgomeryPoint`]. + /// + /// Calculates a point on elliptic curve E (Curve25519) from an element of + /// the finite field F over which E is defined. See section 6.7.1 of the + /// RFC. The unbounded variant does NOT assume that input values are always + /// going to be the least-square-root representation of the field element. + /// This is divergent from both the elligator2 specification and RFC9380, + /// however, some implementations miss this detail. This allows us to be + /// compatible with those alternate implementations if necessary, since the + /// resulting point will be different for inputs with either of the + /// high-order two bits set. + /// + /// The input u and output P are elements of the field F. Note that + /// the output P is a point on the Montgomery curve and as such it's byte + /// representation is distinguishable from uniform random. + /// + /// Input: + /// * u -> an element of field F. + /// + /// Output: + /// * P - a point on the Montgomery elliptic curve. + /// + /// See + pub fn map_to_point_unbounded(r: &[u8; 32]) -> MontgomeryPoint { + let r_0 = FieldElement::from_bytes(r); + let (p, _) = elligator2::map_fe_to_montgomery(&r_0); + MontgomeryPoint(p.as_bytes()) + } + + #[cfg(feature = "elligator2")] + /// Perform the Elligator2 mapping to a [`MontgomeryPoint`]. + /// + /// Calculates a point on elliptic curve E (Curve25519) from an element of + /// the finite field F over which E is defined. See section 6.7.1 of the + /// RFC. It is assumed that input values are always going to be the + /// least-square-root representation of the field element in allignment + /// with both the elligator2 specification and RFC9380. + /// + /// The input u and output P are elements of the field F. Note that + /// the output P is a point on the Montgomery curve and as such it's byte + /// representation is distinguishable from uniform random. + /// + /// Input: + /// * u -> an element of field F. + /// + /// Output: + /// * P - a point on the Montgomery elliptic curve. + /// + /// See + pub fn map_to_point(r: &[u8; 32]) -> MontgomeryPoint { + let mut clamped = *r; + clamped[31] &= elligator2::MASK_UNSET_BYTE; + let r_0 = FieldElement::from_bytes(&clamped); + let (p, _) = elligator2::map_fe_to_montgomery(&r_0); + MontgomeryPoint(p.as_bytes()) } } @@ -408,6 +460,7 @@ mod test { use crate::constants; #[cfg(feature = "alloc")] + #[cfg(feature = "elligator2")] use alloc::vec::Vec; use rand_core::{CryptoRng, RngCore}; @@ -625,7 +678,7 @@ mod test { let bytes: Vec = (0u8..32u8).collect(); let bits_in: [u8; 32] = (&bytes[..]).try_into().expect("Range invariant broken"); - let eg = elligator2::map_to_point(&bits_in); + let eg = MontgomeryPoint::map_to_point(&bits_in); assert_eq!(eg.0, ELLIGATOR_CORRECT_OUTPUT); } @@ -633,7 +686,7 @@ mod test { #[cfg(feature = "elligator2")] fn montgomery_elligator_zero_zero() { let zero = [0u8; 32]; - let eg = elligator2::map_to_point(&zero); + let eg = MontgomeryPoint::map_to_point(&zero); assert_eq!(eg.0, zero); } } diff --git a/x25519-dalek/src/x25519.rs b/x25519-dalek/src/x25519.rs index cb18c1b0..244889e2 100644 --- a/x25519-dalek/src/x25519.rs +++ b/x25519-dalek/src/x25519.rs @@ -72,7 +72,7 @@ impl AsRef<[u8]> for PublicKey { /// secret is used at most once. #[cfg_attr(feature = "zeroize", derive(Zeroize))] #[cfg_attr(feature = "zeroize", zeroize(drop))] -pub struct EphemeralSecret(pub(crate) [u8; 32]); +pub struct EphemeralSecret(pub(crate) [u8; 32], pub(crate) u8); impl EphemeralSecret { /// Perform a Diffie-Hellman key agreement between `self` and @@ -94,8 +94,10 @@ impl EphemeralSecret { pub fn random_from_rng(mut csprng: T) -> Self { // The secret key is random bytes. Clamping is done later. let mut bytes = [0u8; 32]; + let mut tweak = [0u8; 1]; csprng.fill_bytes(&mut bytes); - EphemeralSecret(bytes) + csprng.fill_bytes(&mut tweak); + EphemeralSecret(bytes, tweak[0]) } /// Generate a new [`EphemeralSecret`]. @@ -134,7 +136,7 @@ impl<'a> From<&'a EphemeralSecret> for PublicKey { #[cfg_attr(feature = "zeroize", derive(Zeroize))] #[cfg_attr(feature = "zeroize", zeroize(drop))] #[derive(Clone)] -pub struct ReusableSecret(pub(crate) [u8; 32]); +pub struct ReusableSecret(pub(crate) [u8; 32], pub(crate) u8); #[cfg(feature = "reusable_secrets")] impl ReusableSecret { @@ -157,8 +159,10 @@ impl ReusableSecret { pub fn random_from_rng(mut csprng: T) -> Self { // The secret key is random bytes. Clamping is done later. let mut bytes = [0u8; 32]; + let mut tweak = [0u8; 1]; csprng.fill_bytes(&mut bytes); - ReusableSecret(bytes) + csprng.fill_bytes(&mut tweak); + ReusableSecret(bytes, tweak[0]) } /// Generate a new [`ReusableSecret`]. @@ -195,7 +199,7 @@ impl<'a> From<&'a ReusableSecret> for PublicKey { #[cfg_attr(feature = "zeroize", derive(Zeroize))] #[cfg_attr(feature = "zeroize", zeroize(drop))] #[derive(Clone)] -pub struct StaticSecret([u8; 32]); +pub struct StaticSecret([u8; 32], u8); #[cfg(feature = "static_secrets")] impl StaticSecret { @@ -218,8 +222,10 @@ impl StaticSecret { pub fn random_from_rng(mut csprng: T) -> Self { // The secret key is random bytes. Clamping is done later. let mut bytes = [0u8; 32]; + let mut tweak = [0u8; 1]; csprng.fill_bytes(&mut bytes); - StaticSecret(bytes) + csprng.fill_bytes(&mut tweak); + StaticSecret(bytes, tweak[0]) } /// Generate a new [`StaticSecret`]. @@ -245,7 +251,7 @@ impl StaticSecret { impl From<[u8; 32]> for StaticSecret { /// Load a secret key from a byte array. fn from(bytes: [u8; 32]) -> StaticSecret { - StaticSecret(bytes) + StaticSecret(bytes, 0u8) } } @@ -473,7 +479,7 @@ impl<'a> From<&'a [u8; 32]> for PublicRepresentative { impl<'a> From<&'a EphemeralSecret> for Option { /// Given an x25519 [`EphemeralSecret`] key, compute its corresponding [`PublicRepresentative`]. fn from(secret: &'a EphemeralSecret) -> Option { - let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0); + let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0, secret.1); let res: Option<[u8; 32]> = repres; Some(PublicRepresentative(res?)) } @@ -484,7 +490,7 @@ impl<'a> From<&'a EphemeralSecret> for Option { impl<'a> From<&'a ReusableSecret> for Option { /// Given an x25519 [`ReusableSecret`] key, compute its corresponding [`PublicRepresentative`]. fn from(secret: &'a ReusableSecret) -> Option { - let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0); + let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0, secret.1); let res: Option<[u8; 32]> = repres; Some(PublicRepresentative(res?)) } @@ -495,7 +501,7 @@ impl<'a> From<&'a ReusableSecret> for Option { impl<'a> From<&'a StaticSecret> for Option { /// Given an x25519 [`StaticSecret`] key, compute its corresponding [`PublicRepresentative`]. fn from(secret: &'a StaticSecret) -> Option { - let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0); + let repres = curve25519_dalek::elligator2::representative_from_privkey(&secret.0, secret.1); let res: Option<[u8; 32]> = repres; Some(PublicRepresentative(res?)) } @@ -505,7 +511,8 @@ impl<'a> From<&'a StaticSecret> for Option { impl<'a> From<&'a PublicRepresentative> for PublicKey { /// Given an elligator2 [`PublicRepresentative`], compute its corresponding [`PublicKey`]. fn from(representative: &'a PublicRepresentative) -> PublicKey { - let point = curve25519_dalek::elligator2::map_to_point(&representative.0); + let point = MontgomeryPoint::map_to_point(&representative.0); PublicKey(point) } } +