aboutsummaryrefslogtreecommitdiff
path: root/src/crypto
diff options
context:
space:
mode:
Diffstat (limited to 'src/crypto')
-rw-r--r--src/crypto/blake256.c2
-rw-r--r--src/crypto/chacha.h12
-rw-r--r--src/crypto/crypto.cpp34
-rw-r--r--src/crypto/crypto.h1
-rw-r--r--src/crypto/crypto_ops_builder/ref10/README.md4
-rw-r--r--src/crypto/crypto_ops_builder/ref10/description2
-rw-r--r--src/crypto/crypto_ops_builder/ref10CommentedCombined/MakeCryptoOps.py4
-rw-r--r--src/crypto/crypto_ops_builder/ref10CommentedCombined/description2
-rw-r--r--src/crypto/initializer.h4
-rw-r--r--src/crypto/slow-hash.c4
-rw-r--r--src/crypto/tree-hash.c2
11 files changed, 47 insertions, 24 deletions
diff --git a/src/crypto/blake256.c b/src/crypto/blake256.c
index d503c47e0..6ef7d4207 100644
--- a/src/crypto/blake256.c
+++ b/src/crypto/blake256.c
@@ -31,7 +31,7 @@
* The blake256_* and blake224_* functions are largely copied from
* blake256_light.c and blake224_light.c from the BLAKE website:
*
- * http://131002.net/blake/
+ * https://131002.net/blake/
*
* The hmac_* functions implement HMAC-BLAKE-256 and HMAC-BLAKE-224.
* HMAC is specified by RFC 2104.
diff --git a/src/crypto/chacha.h b/src/crypto/chacha.h
index 2b3ed8043..1dc270faf 100644
--- a/src/crypto/chacha.h
+++ b/src/crypto/chacha.h
@@ -69,22 +69,26 @@ namespace crypto {
chacha20(data, length, key.data(), reinterpret_cast<const uint8_t*>(&iv), cipher);
}
- inline void generate_chacha_key(const void *data, size_t size, chacha_key& key) {
+ inline void generate_chacha_key(const void *data, size_t size, chacha_key& key, uint64_t kdf_rounds) {
static_assert(sizeof(chacha_key) <= sizeof(hash), "Size of hash must be at least that of chacha_key");
tools::scrubbed_arr<char, HASH_SIZE> pwd_hash;
crypto::cn_slow_hash(data, size, pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
+ for (uint64_t n = 1; n < kdf_rounds; ++n)
+ crypto::cn_slow_hash(pwd_hash.data(), pwd_hash.size(), pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
memcpy(&unwrap(key), pwd_hash.data(), sizeof(key));
}
- inline void generate_chacha_key_prehashed(const void *data, size_t size, chacha_key& key) {
+ inline void generate_chacha_key_prehashed(const void *data, size_t size, chacha_key& key, uint64_t kdf_rounds) {
static_assert(sizeof(chacha_key) <= sizeof(hash), "Size of hash must be at least that of chacha_key");
tools::scrubbed_arr<char, HASH_SIZE> pwd_hash;
crypto::cn_slow_hash(data, size, pwd_hash.data(), 0/*variant*/, 1/*prehashed*/);
+ for (uint64_t n = 1; n < kdf_rounds; ++n)
+ crypto::cn_slow_hash(pwd_hash.data(), pwd_hash.size(), pwd_hash.data(), 0/*variant*/, 0/*prehashed*/);
memcpy(&unwrap(key), pwd_hash.data(), sizeof(key));
}
- inline void generate_chacha_key(std::string password, chacha_key& key) {
- return generate_chacha_key(password.data(), password.size(), key);
+ inline void generate_chacha_key(std::string password, chacha_key& key, uint64_t kdf_rounds) {
+ return generate_chacha_key(password.data(), password.size(), key, kdf_rounds);
}
}
diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
index a2db14e08..4243c71fd 100644
--- a/src/crypto/crypto.cpp
+++ b/src/crypto/crypto.cpp
@@ -96,18 +96,32 @@ namespace crypto {
generate_random_bytes_not_thread_safe(N, bytes);
}
- /* generate a random 32-byte (256-bit) integer and copy it to res */
- static inline void random_scalar_not_thread_safe(ec_scalar &res) {
- unsigned char tmp[64];
- generate_random_bytes_not_thread_safe(64, tmp);
- sc_reduce(tmp);
- memcpy(&res, tmp, 32);
+ static inline bool less32(const unsigned char *k0, const unsigned char *k1)
+ {
+ for (int n = 31; n >= 0; --n)
+ {
+ if (k0[n] < k1[n])
+ return true;
+ if (k0[n] > k1[n])
+ return false;
+ }
+ return false;
}
+
+ void random32_unbiased(unsigned char *bytes)
+ {
+ // l = 2^252 + 27742317777372353535851937790883648493.
+ // it fits 15 in 32 bytes
+ static const unsigned char limit[32] = { 0xe3, 0x6a, 0x67, 0x72, 0x8b, 0xce, 0x13, 0x29, 0x8f, 0x30, 0x82, 0x8c, 0x0b, 0xa4, 0x10, 0x39, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0 };
+ do
+ {
+ generate_random_bytes_thread_safe(32, bytes);
+ } while (!less32(bytes, limit)); // should be good about 15/16 of the time
+ sc_reduce32(bytes);
+ }
+ /* generate a random 32-byte (256-bit) integer and copy it to res */
static inline void random_scalar(ec_scalar &res) {
- unsigned char tmp[64];
- generate_random_bytes_thread_safe(64, tmp);
- sc_reduce(tmp);
- memcpy(&res, tmp, 32);
+ random32_unbiased((unsigned char*)res.data);
}
void hash_to_scalar(const void *data, size_t length, ec_scalar &res) {
diff --git a/src/crypto/crypto.h b/src/crypto/crypto.h
index 073707876..a2d61b04e 100644
--- a/src/crypto/crypto.h
+++ b/src/crypto/crypto.h
@@ -98,6 +98,7 @@ namespace crypto {
#pragma pack(pop)
void hash_to_scalar(const void *data, size_t length, ec_scalar &res);
+ void random32_unbiased(unsigned char *bytes);
static_assert(sizeof(ec_point) == 32 && sizeof(ec_scalar) == 32 &&
sizeof(public_key) == 32 && sizeof(secret_key) == 32 &&
diff --git a/src/crypto/crypto_ops_builder/ref10/README.md b/src/crypto/crypto_ops_builder/ref10/README.md
new file mode 100644
index 000000000..59193305b
--- /dev/null
+++ b/src/crypto/crypto_ops_builder/ref10/README.md
@@ -0,0 +1,4 @@
+This code comes from Daniel J. Bernstein's SUPERCOP source,
+released in the public domain.
+
+[http://ed25519.cr.yp.to/software.html](http://ed25519.cr.yp.to/software.html)
diff --git a/src/crypto/crypto_ops_builder/ref10/description b/src/crypto/crypto_ops_builder/ref10/description
index cbfcb2cba..99f747747 100644
--- a/src/crypto/crypto_ops_builder/ref10/description
+++ b/src/crypto/crypto_ops_builder/ref10/description
@@ -1,2 +1,2 @@
EdDSA signatures using Curve25519
-from http://hyperelliptic.org/ebats/supercop-20141124.tar.bz2
+from https://hyperelliptic.org/ebats/supercop-20141124.tar.bz2
diff --git a/src/crypto/crypto_ops_builder/ref10CommentedCombined/MakeCryptoOps.py b/src/crypto/crypto_ops_builder/ref10CommentedCombined/MakeCryptoOps.py
index 9b55d260d..0ed97d5f4 100644
--- a/src/crypto/crypto_ops_builder/ref10CommentedCombined/MakeCryptoOps.py
+++ b/src/crypto/crypto_ops_builder/ref10CommentedCombined/MakeCryptoOps.py
@@ -1,5 +1,5 @@
#assumes you have gnu sed, osx sed might need slight syntax changeo
-#c.f. http://unix.stackexchange.com/questions/112023/how-can-i-replace-a-string-in-a-files
+#c.f. https://unix.stackexchange.com/questions/112023/how-can-i-replace-a-string-in-a-files
#written by shen-noether monero research labs
@@ -8,7 +8,7 @@ import glob #for copy files
import textwrap #for comments etc
print("make sure you have cat and grep installed")
-print("also assumes gnu sed syntax, c.f. :http://unix.stackexchange.com/questions/112023/how-can-i-replace-a-string-in-a-files")
+print("also assumes gnu sed syntax, c.f. :https://unix.stackexchange.com/questions/112023/how-can-i-replace-a-string-in-a-files")
print("I believe osx may have slightly different version of sed")
print("maybe someone smart can replace the sed with perl..")
diff --git a/src/crypto/crypto_ops_builder/ref10CommentedCombined/description b/src/crypto/crypto_ops_builder/ref10CommentedCombined/description
index fadc9f9af..9407b400a 100644
--- a/src/crypto/crypto_ops_builder/ref10CommentedCombined/description
+++ b/src/crypto/crypto_ops_builder/ref10CommentedCombined/description
@@ -2,6 +2,6 @@ shen_ed25519_ref10
MakeCryptoOps.py makes crypto-ops.c in the Monero source from the ref10 implementation
EdDSA signatures using Curve25519
-from http://hyperelliptic.org/ebats/supercop-20141124.tar.bz2
+from https://hyperelliptic.org/ebats/supercop-20141124.tar.bz2
Commented / combined by Shen Noether, Monero Research Lab
diff --git a/src/crypto/initializer.h b/src/crypto/initializer.h
index afbace726..107988d2b 100644
--- a/src/crypto/initializer.h
+++ b/src/crypto/initializer.h
@@ -43,8 +43,8 @@
#elif defined(_MSC_VER)
#include <assert.h>
#include <stdlib.h>
-// http://stackoverflow.com/questions/1113409/attribute-constructor-equivalent-in-vc
-// http://msdn.microsoft.com/en-us/library/bb918180.aspx
+// https://stackoverflow.com/questions/1113409/attribute-constructor-equivalent-in-vc
+// https://msdn.microsoft.com/en-us/library/bb918180.aspx
#pragma section(".CRT$XCT", read)
#define INITIALIZER(name) \
static void __cdecl name(void); \
diff --git a/src/crypto/slow-hash.c b/src/crypto/slow-hash.c
index 35e98f2f5..9d4fc0dfa 100644
--- a/src/crypto/slow-hash.c
+++ b/src/crypto/slow-hash.c
@@ -309,7 +309,7 @@ STATIC INLINE void aes_256_assist2(__m128i* t1, __m128i * t3)
* CPU AES support.
* For more information about these functions, see page 19 of Intel's AES instructions
* white paper:
- * http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/aes-instructions-set-white-paper.pdf
+ * https://www.intel.com/content/dam/doc/white-paper/advanced-encryption-standard-new-instructions-set-paper.pdf
*
* @param key the input 128 bit key
* @param expandedKey An output buffer to hold the generated key schedule
@@ -558,7 +558,7 @@ void slow_hash_free_state(void)
* AES support on x86 CPUs.
*
* A diagram of the inner loop of this function can be found at
- * http://www.cs.cmu.edu/~dga/crypto/xmr/cryptonight.png
+ * https://www.cs.cmu.edu/~dga/crypto/xmr/cryptonight.png
*
* @param data the data to hash
* @param length the length in bytes of the data
diff --git a/src/crypto/tree-hash.c b/src/crypto/tree-hash.c
index e6d6a267c..57c38b86b 100644
--- a/src/crypto/tree-hash.c
+++ b/src/crypto/tree-hash.c
@@ -67,7 +67,7 @@ size_t tree_hash_cnt(size_t count) {
}
void tree_hash(const char (*hashes)[HASH_SIZE], size_t count, char *root_hash) {
-// The blockchain block at height 202612 http://monerochain.info/block/bbd604d2ba11ba27935e006ed39c9bfdd99b76bf4a50654bc1e1e61217962698
+// The blockchain block at height 202612 https://moneroblocks.info/block/202612
// contained 514 transactions, that triggered bad calculation of variable "cnt" in the original version of this function
// as from CryptoNote code.
//
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-21 02:40:17 +0000