kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
2b8415e8ff
boringssl/include/openssl/newhope.h

148 lines
6.4 KiB
C
Raw Normal View History

Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
/* Copyright (c) 2016, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#ifndef OPENSSL_HEADER_NEWHOPE_H
#define OPENSSL_HEADER_NEWHOPE_H
#include <openssl/base.h>
#include <openssl/sha.h>
#if defined(__cplusplus)
extern "C" {
#endif
/* Post-quantum key agreement, based upon the reference
* implementation. Note: this implementation does not interoperate
* with the reference implementation!
*
* Source: https://github.com/tpoeppelmann/newhope
*
* The authors' permission to use their code is gratefully acknowledged. */
/* NEWHOPE_POLY_new returns a new |NEWHOPE_POLY| object, or NULL on error. */
OPENSSL_EXPORT NEWHOPE_POLY *NEWHOPE_POLY_new(void);
/* NEWHOPE_POLY_free frees |p|. */
OPENSSL_EXPORT void NEWHOPE_POLY_free(NEWHOPE_POLY *p);
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
/* NEWHOPE_POLY_LENGTH is the size in bytes of the packed representation of a
* polynomial, encoded with 14 bits per coefficient. */
#define NEWHOPE_POLY_LENGTH ((1024 * 14) / 8)
/* NEWHOPE_RECONCILIATION_LENGTH is the size in bytes of the packed
* representation of the reconciliation data, encoded as 2 bits per
* coefficient. */
#define NEWHOPE_RECONCILIATION_LENGTH ((1024 * 2) / 8)
Rename NEWHOPE functions to offer/accept/finish. This is consistent with the new convention in ssl_ecdh.c. Along the way, change newhope_test.c to not iterate 1000 times over each test. Change-Id: I7a500f45b838eba8f6df96957891aa8e880ba089 Reviewed-on: https://boringssl-review.googlesource.com/8012 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-19 18:30:52 +01:00
/* NEWHOPE_OFFERMSG_LENGTH is the length of the offering party's message to the
* accepting party. */
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
#define NEWHOPE_OFFERMSG_LENGTH (NEWHOPE_POLY_LENGTH + 32)
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
Rename NEWHOPE functions to offer/accept/finish. This is consistent with the new convention in ssl_ecdh.c. Along the way, change newhope_test.c to not iterate 1000 times over each test. Change-Id: I7a500f45b838eba8f6df96957891aa8e880ba089 Reviewed-on: https://boringssl-review.googlesource.com/8012 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-19 18:30:52 +01:00
/* NEWHOPE_ACCEPTMSG_LENGTH is the length of the accepting party's message to
* the offering party. */
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
#define NEWHOPE_ACCEPTMSG_LENGTH \
(NEWHOPE_POLY_LENGTH + NEWHOPE_RECONCILIATION_LENGTH)
/* NEWHOPE_KEY_LENGTH is the size of the result of the key agreement. This
* result is not exposed to callers: instead, it is whitened with SHA-256, whose
* output happens to be the same size. */
#define NEWHOPE_KEY_LENGTH 32
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
Rename NEWHOPE functions to offer/accept/finish. This is consistent with the new convention in ssl_ecdh.c. Along the way, change newhope_test.c to not iterate 1000 times over each test. Change-Id: I7a500f45b838eba8f6df96957891aa8e880ba089 Reviewed-on: https://boringssl-review.googlesource.com/8012 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-19 18:30:52 +01:00
/* NEWHOPE_offer initializes |out_msg| and |out_sk| for a new key
* exchange. |msg| must have room for |NEWHOPE_OFFERMSG_LENGTH| bytes. Neither
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
* output may be cached. */
Rename NEWHOPE functions to offer/accept/finish. This is consistent with the new convention in ssl_ecdh.c. Along the way, change newhope_test.c to not iterate 1000 times over each test. Change-Id: I7a500f45b838eba8f6df96957891aa8e880ba089 Reviewed-on: https://boringssl-review.googlesource.com/8012 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-19 18:30:52 +01:00
OPENSSL_EXPORT void NEWHOPE_offer(uint8_t out_msg[NEWHOPE_OFFERMSG_LENGTH],
NEWHOPE_POLY *out_sk);
/* NEWHOPE_accept completes a key exchange given an offer message |msg|. The
* result of the key exchange is written to |out_key|, which must have space for
* |SHA256_DIGEST_LENGTH| bytes. The message to be send to the offering party is
* written to |out_msg|, which must have room for |NEWHOPE_ACCEPTMSG_LENGTH|
* bytes. Returns 1 on success and 0 on error. */
OPENSSL_EXPORT int NEWHOPE_accept(uint8_t out_key[SHA256_DIGEST_LENGTH],
uint8_t out_msg[NEWHOPE_ACCEPTMSG_LENGTH],
const uint8_t msg[NEWHOPE_OFFERMSG_LENGTH],
size_t msg_len);
/* NEWHOPE_finish completes a key exchange for the offering party, given an
* accept message |msg| and the previously generated secret |sk|. The result of
* the key exchange is written to |out_key|, which must have space for
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
* |SHA256_DIGEST_LENGTH| bytes. Returns 1 on success and 0 on error. */
Rename NEWHOPE functions to offer/accept/finish. This is consistent with the new convention in ssl_ecdh.c. Along the way, change newhope_test.c to not iterate 1000 times over each test. Change-Id: I7a500f45b838eba8f6df96957891aa8e880ba089 Reviewed-on: https://boringssl-review.googlesource.com/8012 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-19 18:30:52 +01:00
OPENSSL_EXPORT int NEWHOPE_finish(uint8_t out_key[SHA256_DIGEST_LENGTH],
const NEWHOPE_POLY *sk,
const uint8_t msg[NEWHOPE_ACCEPTMSG_LENGTH],
size_t msg_len);
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
/* Lower-level functions. */
newhope: restore statistical tests. One of these tests the distribution of noise polynomials; the other tests that that agreed-upon keys (prior to whitening) have roughly equal numbers of 0s and 1s. Along the way, expose a few more API bits. Change-Id: I6b04708d41590de45d82ea95bae1033cfccd5d67 Reviewed-on: https://boringssl-review.googlesource.com/8130 Reviewed-by: Adam Langley <agl@google.com>
2016-06-03 01:23:29 +01:00
/* NEWHOPE_POLY_noise sets |r| to a random polynomial where the coefficients are
* sampled from the noise distribution. */
crypto/newhope: add OPENSSL_EXPORT to functions used by tests. Change-Id: Ie6701d6ea809f5c590f0773cb4b733a208553879
2016-06-03 22:45:18 +01:00
OPENSSL_EXPORT void NEWHOPE_POLY_noise(NEWHOPE_POLY* r);
newhope: restore statistical tests. One of these tests the distribution of noise polynomials; the other tests that that agreed-upon keys (prior to whitening) have roughly equal numbers of 0s and 1s. Along the way, expose a few more API bits. Change-Id: I6b04708d41590de45d82ea95bae1033cfccd5d67 Reviewed-on: https://boringssl-review.googlesource.com/8130 Reviewed-by: Adam Langley <agl@google.com>
2016-06-03 01:23:29 +01:00
crypto/newhope: fix comment typo. Change-Id: Ic7dc57680e8cc8306fb1541249fb356eece30999
2016-06-03 22:37:03 +01:00
/* NEWHOPE_POLY_noise_ntt sets |r| to an output of NEWHOPE_POLY_noise, and then
newhope: restore statistical tests. One of these tests the distribution of noise polynomials; the other tests that that agreed-upon keys (prior to whitening) have roughly equal numbers of 0s and 1s. Along the way, expose a few more API bits. Change-Id: I6b04708d41590de45d82ea95bae1033cfccd5d67 Reviewed-on: https://boringssl-review.googlesource.com/8130 Reviewed-by: Adam Langley <agl@google.com>
2016-06-03 01:23:29 +01:00
* applies NTT(r) in-place. */
crypto/newhope: add OPENSSL_EXPORT to functions used by tests. Change-Id: Ie6701d6ea809f5c590f0773cb4b733a208553879
2016-06-03 22:45:18 +01:00
OPENSSL_EXPORT void NEWHOPE_POLY_noise_ntt(NEWHOPE_POLY* r);
newhope: restore statistical tests. One of these tests the distribution of noise polynomials; the other tests that that agreed-upon keys (prior to whitening) have roughly equal numbers of 0s and 1s. Along the way, expose a few more API bits. Change-Id: I6b04708d41590de45d82ea95bae1033cfccd5d67 Reviewed-on: https://boringssl-review.googlesource.com/8130 Reviewed-by: Adam Langley <agl@google.com>
2016-06-03 01:23:29 +01:00
newhope: improve test vectors. This commit adds coverage of the "offer" (first) step, as well as testing all outputs of the "accept" (second) step, not just the shared key. Change-Id: Id11fe24029abc302442484a6c01fa496a1578b3a Reviewed-on: https://boringssl-review.googlesource.com/8100 Reviewed-by: Adam Langley <agl@google.com>
2016-06-02 00:28:48 +01:00
/* NEWHOPE_offer_computation is the work of |NEWHOPE_offer|, less the encoding
* parts. The inputs are the noise polynomials |s| and |e|, and random
* polynomial |a|. The output is the polynomial |pk|. */
OPENSSL_EXPORT void NEWHOPE_offer_computation(
NEWHOPE_POLY *out_pk,
const NEWHOPE_POLY *s, const NEWHOPE_POLY *e, const NEWHOPE_POLY *a);
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
/* NEWHOPE_accept_computation is the work of |NEWHOPE_accept|, less the encoding
* parts. The inputs from the peer are |pk| and |a|. The locally-generated
newhope: improve test vectors. This commit adds coverage of the "offer" (first) step, as well as testing all outputs of the "accept" (second) step, not just the shared key. Change-Id: Id11fe24029abc302442484a6c01fa496a1578b3a Reviewed-on: https://boringssl-review.googlesource.com/8100 Reviewed-by: Adam Langley <agl@google.com>
2016-06-02 00:28:48 +01:00
* inputs are the noise polynomials |sp|, |ep|, and |epp|, and the random bytes
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
* |rand|. The outputs are |out_bp| and |out_reconciliation|, and the result of
* key agreement |key|. Returns 1 on success and 0 on failure. */
OPENSSL_EXPORT void NEWHOPE_accept_computation(
uint8_t out_key[NEWHOPE_KEY_LENGTH], NEWHOPE_POLY *out_bp,
newhope: improve test vectors. This commit adds coverage of the "offer" (first) step, as well as testing all outputs of the "accept" (second) step, not just the shared key. Change-Id: Id11fe24029abc302442484a6c01fa496a1578b3a Reviewed-on: https://boringssl-review.googlesource.com/8100 Reviewed-by: Adam Langley <agl@google.com>
2016-06-02 00:28:48 +01:00
NEWHOPE_POLY *out_reconciliation,
const NEWHOPE_POLY *sp, const NEWHOPE_POLY *ep, const NEWHOPE_POLY *epp,
const uint8_t rand[32],
const NEWHOPE_POLY *pk, const NEWHOPE_POLY *a);
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
/* NEWHOPE_finish_computation is the work of |NEWHOPE_finish|, less the encoding
* parts. Given the peer's |bp| and |reconciliation|, and locally-generated
* noise |noise|, the result of the key agreement is written to out_key.
* Returns 1 on success and 0 on failure. */
OPENSSL_EXPORT void NEWHOPE_finish_computation(
uint8_t out_key[NEWHOPE_KEY_LENGTH], const NEWHOPE_POLY *noise,
const NEWHOPE_POLY *bp, const NEWHOPE_POLY *reconciliation);
/* NEWHOPE_POLY_frombytes decodes |a| into |r|. */
OPENSSL_EXPORT void NEWHOPE_POLY_frombytes(
NEWHOPE_POLY *r, const uint8_t a[NEWHOPE_POLY_LENGTH]);
newhope: improve test vectors. This commit adds coverage of the "offer" (first) step, as well as testing all outputs of the "accept" (second) step, not just the shared key. Change-Id: Id11fe24029abc302442484a6c01fa496a1578b3a Reviewed-on: https://boringssl-review.googlesource.com/8100 Reviewed-by: Adam Langley <agl@google.com>
2016-06-02 00:28:48 +01:00
/* NEWHOPE_POLY_tobytes packs the polynomial |p| into the compact representation
* |r|. */
OPENSSL_EXPORT void NEWHOPE_POLY_tobytes(uint8_t r[NEWHOPE_POLY_LENGTH],
const NEWHOPE_POLY* p);
newhope: restore statistical tests. One of these tests the distribution of noise polynomials; the other tests that that agreed-upon keys (prior to whitening) have roughly equal numbers of 0s and 1s. Along the way, expose a few more API bits. Change-Id: I6b04708d41590de45d82ea95bae1033cfccd5d67 Reviewed-on: https://boringssl-review.googlesource.com/8130 Reviewed-by: Adam Langley <agl@google.com>
2016-06-03 01:23:29 +01:00
/* NEWHOPE_offer_frommsg decodes an offer message |msg| into its constituent
* polynomials |out_pk| and |a|. */
OPENSSL_EXPORT void NEWHOPE_offer_frommsg(
NEWHOPE_POLY *out_pk, NEWHOPE_POLY *out_a,
const uint8_t msg[NEWHOPE_OFFERMSG_LENGTH]);
newhope: refactor and add test vectors. The test vectors are taken from the reference implementation, modified to output the results of its random-number generator, and the results of key generation prior to SHA3. This allows the interoperability of the two implementations to be tested somewhat. To accomplish the testing, this commit creates a new, lower-level API that leaves the generation of random numbers and all wire encoding and decoding up to the caller. Change-Id: Ifae3517696dde4be4a0b7c1998bdefb789bac599 Reviewed-on: https://boringssl-review.googlesource.com/8070 Reviewed-by: Adam Langley <agl@google.com>
2016-05-28 00:49:29 +01:00
Add missing newline in newhope.h. doc.go is still a little unhappy. Change-Id: I5a8f3da91dabb45d29d0e08f13b7dabdcd521c38 Reviewed-on: https://boringssl-review.googlesource.com/8145 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-03 23:00:34 +01:00
Import `newhope' (post-quantum key exchange). This derives from the reference implementation: Source: https://github.com/tpoeppelmann/newhope/tree/master/ref at bc06c1ac Paper: https://eprint.iacr.org/2015/1092 However, it does not interoperate, due to the replacement of SHAKE-128 with AES-CTR (for polynomial generation) and the replacement of SHA-3 with SHA-256 (for key whitening). Change-Id: I6a55507aea85331245e2fbd41bae5cc049fdca3c Reviewed-on: https://boringssl-review.googlesource.com/7690 Reviewed-by: Adam Langley <agl@google.com>
2016-04-18 19:30:19 +01:00
#if defined(__cplusplus)
} /* extern "C" */
#endif
#endif /* OPENSSL_HEADER_NEWHOPE_H */
Reference in New Issue Copy Permalink