X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/blobdiff_plain/cb2f9158c60e7ba4ae333c79407e7eb4a9c48069..7b0d1a63587f3cb1ae3bb8b248bbb1b82bdca7bd:/pub/ed25519.c diff --git a/pub/ed25519.c b/pub/ed25519.c index 4680a537..676fe8ca 100644 --- a/pub/ed25519.c +++ b/pub/ed25519.c @@ -32,6 +32,7 @@ #include "f25519.h" #include "ed25519.h" #include "scaf.h" +#include "scmul.h" #include "sha512.h" /*----- Key fetching ------------------------------------------------------*/ @@ -172,7 +173,7 @@ static void ptadd(f25519 *X, f25519 *Y, f25519 *Z, const f25519 *X0, const f25519 *Y0, const f25519 *Z0, const f25519 *X1, const f25519 *Y1, const f25519 *Z1) { - f25519 t0, t1, t2, t3, t4, t5; + f25519 t0, t1, t2, t3; /* Bernstein, Birkner, Joye, Lange, and Peters, `Twisted Edwards Curves', * 2008-03-13, https://cr.yp.to/newelliptic/twisted-20080313.pdf shows the @@ -187,23 +188,23 @@ static void ptadd(f25519 *X, f25519 *Y, f25519 *Z, */ f25519_mul(&t0, Z0, Z1); /* t0 = A = Z0 Z1 */ - f25519_sqr(&t1, &t0); /* t1 = B = A^2 */ + f25519_add(&t1, X0, Y0); /* t1 = X0 + Y0 */ + f25519_add(&t2, X1, Y1); /* t2 = X1 + Y1 */ + f25519_mul(&t1, &t1, &t2); /* t1 = (X0 + Y0) (X1 + Y1) */ f25519_mul(&t2, X0, X1); /* t2 = C = X0 X1 */ f25519_mul(&t3, Y0, Y1); /* t3 = D = Y0 Y1 */ - f25519_mul(&t4, &t2, &t3); /* t4 = C D */ - f25519_mul(&t4, &t4, D); /* t4 = E = d C D */ - f25519_sub(&t5, &t1, &t4); /* t5 = F = B - E */ - f25519_add(&t4, &t1, &t4); /* t4 = G = B + E */ - f25519_add(&t1, &t2, &t3); /* t1 = C + D */ - f25519_add(&t2, X0, Y0); /* t2 = X0 + Y0 */ - f25519_add(&t3, X1, Y1); /* t3 = X1 + Y1 */ - f25519_mul(X, &t0, &t5); /* X = A F */ - f25519_mul(Y, &t0, &t4); /* Y = A G */ - f25519_mul(Z, &t5, &t4); /* Z = F G */ - f25519_mul(Y, Y, &t1); /* Y = A G (C + D) = A G (D - a C) */ - f25519_mul(&t0, &t2, &t3); /* t0 = (X0 + Y0) (X1 + Y1) */ - f25519_sub(&t0, &t0, &t1); /* t0 = (X0 + Y0) (X1 + Y1) - C - D */ - f25519_mul(X, X, &t0); /* X = A F ((X0 + Y0) (X1 + Y1) - C - D) */ + f25519_add(Y, &t2, &t3); /* Y = C + D = D - a C */ + f25519_sub(X, &t1, Y); /* X = (X0 + Y0) (X1 + Y1) - C - D */ + f25519_mul(X, X, &t0); /* X = A ((X0 + Y0) (X1 + Y1) - C - D) */ + f25519_mul(Y, Y, &t0); /* Y = A (D - a C) */ + f25519_sqr(&t0, &t0); /* t0 = B = A^2 */ + f25519_mul(&t1, &t2, &t3); /* t1 = C D */ + f25519_mul(&t1, &t1, D); /* t1 = E = d C D */ + f25519_sub(&t2, &t0, &t1); /* t2 = F = B - E */ + f25519_add(&t1, &t0, &t1); /* t1 = G = B + E */ + f25519_mul(X, X, &t2); /* X = A F ((X0 + Y0) (X1 + Y1) - C - D) */ + f25519_mul(Y, Y, &t1); /* Y = A G (D - a C) */ + f25519_mul(Z, &t1, &t2); /* Z = F G */ } static void ptdbl(f25519 *X, f25519 *Y, f25519 *Z, @@ -231,7 +232,7 @@ static void ptdbl(f25519 *X, f25519 *Y, f25519 *Z, /* (E = a C = -C) */ f25519_sub(&t0, &t2, &t1); /* t0 = F = D - C = E + D */ f25519_sqr(&t1, Z0); /* t1 = H = Z0^2 */ - f25519_mulconst(&t1, &t1, 2); /* t1 = 2 H */ + f25519_add(&t1, &t1, &t1); /* t1 = 2 H */ f25519_sub(&t1, &t0, &t1); /* t1 = J = F - 2 H */ f25519_mul(X, X, &t1); /* X = (B - C - D) J */ f25519_mul(Y, Y, &t0); /* Y = -F (E - D) */ @@ -239,144 +240,8 @@ static void ptdbl(f25519 *X, f25519 *Y, f25519 *Z, f25519_mul(Z, &t0, &t1); /* Z = F J */ } -static void ptmul(f25519 *X, f25519 *Y, f25519 *Z, - const scaf_piece n[NPIECE], - const f25519 *X0, const f25519 *Y0, const f25519 *Z0) -{ - /* We assume that the window width divides the scalar piece width. */ -#define WINWD 4 -#define WINLIM (1 << WINWD) -#define WINMASK (WINLIM - 1) -#define TABSZ (WINLIM/2 + 1) - - f25519 VX[TABSZ], VY[TABSZ], VZ[TABSZ]; - f25519 TX, TY, TZ, UX, UY, UZ; - unsigned i, j, k, w; - uint32 m_neg; - scaf_piece ni; - - /* Build a table of small multiples. */ - f25519_set(&VX[0], 0); f25519_set(&VY[0], 1); f25519_set(&VZ[0], 1); - VX[1] = *X0; VY[1] = *Y0; VZ[1] = *Z0; - ptdbl(&VX[2], &VY[2], &VZ[2], &VX[1], &VY[1], &VZ[1]); - for (i = 3; i < TABSZ; i += 2) { - ptadd(&VX[i], &VY[i], &VZ[i], - &VX[i - 1], &VY[i - 1], &VZ[i - 1], X0, Y0, Z0); - ptdbl(&VX[i + 1], &VY[i + 1], &VZ[i + 1], - &VX[(i + 1)/2], &VY[(i + 1)/2], &VZ[(i + 1)/2]); - } - - /* Now do the multiplication. We lag a window behind the cursor position - * because of the scalar recoding we do. - */ - f25519_set(&TX, 0); f25519_set(&TY, 1); f25519_set(&TZ, 1); - for (i = NPIECE, w = 0, m_neg = 0; i--; ) { - ni = n[i]; - - /* Work through each window in the scalar piece. */ - for (j = 0; j < PIECEWD; j += WINWD) { - - /* Shift along by a window. */ - for (k = 0; k < WINWD; k++) ptdbl(&TX, &TY, &TZ, &TX, &TY, &TZ); - - /* Peek at the next window of four bits. If the top bit is set we lend - * a bit leftwards, into w. It's too late for this to affect the sign - * now, but if we negated earlier then the addition would be wrong. - */ - w += (ni >> (PIECEWD - 1))&0x1u; - w = ((WINLIM - w)&m_neg) | (w&~m_neg); - - /* Collect the entry from the table, and add or subtract. */ - f25519_pickn(&UX, VX, TABSZ, w); - f25519_pickn(&UY, VY, TABSZ, w); - f25519_pickn(&UZ, VZ, TABSZ, w); - f25519_condneg(&UX, &UX, m_neg); - ptadd(&TX, &TY, &TZ, &TX, &TY, &TZ, &UX, &UY, &UZ); - - /* Move the next window into the delay slot. If its top bit is set, - * then negate it and set m_neg. - */ - w = (ni >> (PIECEWD - WINWD))&WINMASK; - m_neg = -(uint32)((w >> (WINWD - 1))&0x1u); - ni <<= WINWD; - } - } - - /* Do the final window. Just fix the sign and go. */ - for (k = 0; k < WINWD; k++) ptdbl(&TX, &TY, &TZ, &TX, &TY, &TZ); - w = ((WINLIM - w)&m_neg) | (w&~m_neg); - f25519_pickn(&UX, VX, TABSZ, w); - f25519_pickn(&UY, VY, TABSZ, w); - f25519_pickn(&UZ, VZ, TABSZ, w); - f25519_condneg(&UX, &UX, m_neg); - ptadd(X, Y, Z, &TX, &TY, &TZ, &UX, &UY, &UZ); - -#undef WINWD -#undef WINLIM -#undef WINMASK -#undef TABSZ -} - -static void ptsimmul(f25519 *X, f25519 *Y, f25519 *Z, - const scaf_piece n0[NPIECE], - const f25519 *X0, const f25519 *Y0, const f25519 *Z0, - const scaf_piece n1[NPIECE], - const f25519 *X1, const f25519 *Y1, const f25519 *Z1) -{ - /* We assume that the window width divides the scalar piece width. */ -#define WINWD 2 -#define WINLIM (1 << WINWD) -#define WINMASK (WINLIM - 1) -#define TABSZ (1 << 2*WINWD) - - f25519 VX[TABSZ], VY[TABSZ], VZ[TABSZ]; - f25519 TX, TY, TZ, UX, UY, UZ; - unsigned i, j, k, w, ni0, ni1; - - /* Build a table of small linear combinations. */ - f25519_set(&VX[0], 0); f25519_set(&VY[0], 1); f25519_set(&VZ[0], 1); - VX[1] = *X0; VX[WINLIM] = *X1; - VY[1] = *Y0; VY[WINLIM] = *Y1; - VZ[1] = *Z0; VZ[WINLIM] = *Z1; - for (i = 2; i < WINLIM; i <<= 1) { - ptdbl(&VX[i], &VY[i], &VZ[i], - &VX[i/2], &VY[i/2], &VZ[i/2]); - ptdbl(&VX[i*WINLIM], &VY[i*WINLIM], &VZ[i*WINLIM], - &VX[i*WINLIM/2], &VY[i*WINLIM/2], &VZ[i*WINLIM/2]); - } - for (i = 2; i < TABSZ; i <<= 1) { - for (j = 1; j < i; j++) - ptadd(&VX[i + j], &VY[i + j], &VZ[i + j], - &VX[i], &VY[i], &VZ[i], &VX[j], &VY[j], &VZ[j]); - } - - /* Do the multiplication. */ - f25519_set(&TX, 0); f25519_set(&TY, 1); f25519_set(&TZ, 1); - for (i = NPIECE; i--; ) { - ni0 = n0[i]; ni1 = n1[i]; - - /* Work through each window in the scalar pieces. */ - for (j = 0; j < PIECEWD; j += WINWD) { - - /* Shift along by a window. */ - for (k = 0; k < WINWD; k++) ptdbl(&TX, &TY, &TZ, &TX, &TY, &TZ); - - /* Collect the next window from the scalars. */ - w = ((ni0 >> (PIECEWD - WINWD))&WINMASK) | - ((ni1 >> (PIECEWD - 2*WINWD))&(WINMASK << WINWD)); - ni0 <<= WINWD; ni1 <<= WINWD; - - /* Collect the entry from the table, and add. */ - f25519_pickn(&UX, VX, TABSZ, w); - f25519_pickn(&UY, VY, TABSZ, w); - f25519_pickn(&UZ, VZ, TABSZ, w); - ptadd(&TX, &TY, &TZ, &TX, &TY, &TZ, &UX, &UY, &UZ); - } - } - - /* Done. */ - *X = TX; *Y = TY; *Z = TZ; -} +static DEFINE_SCMUL(ptmul, f25519, 4, PIECEWD, NPIECE, ptadd, ptdbl) +static DEFINE_SCSIMMUL(ptsimmul, f25519, 2, PIECEWD, NPIECE, ptadd, ptdbl) /*----- Key derivation utilities ------------------------------------------*/ @@ -392,6 +257,17 @@ static void unpack_key(scaf_piece a[NPIECE], octet h1[32], if (h1) memcpy(h1, b + 32, 32); } +#define PREFIX_BUFSZ 290 +static size_t prefix(octet b[PREFIX_BUFSZ], + int phflag, const octet *p, size_t psz) +{ + if (phflag < 0) return (0); + memcpy(b, "SigEd25519 no Ed25519 collisions", 32); + b[32] = phflag; + assert(psz < ED25519_MAXPERSOSZ); b[33] = psz; memcpy(b + 34, p, psz); + return (psz + 34); +} + /*----- Main code ---------------------------------------------------------*/ /* --- @ed25519_pubkey@ --- * @@ -415,52 +291,65 @@ void ed25519_pubkey(octet K[ED25519_PUBSZ], const void *k, size_t ksz) ptencode(K, &AX, &AY, &AZ); } -/* --- @ed25519_sign@ --- * +/* --- @ed25519_sign@, @ed25519ctx_sign@ --- * * * Arguments: @octet sig[ED25519_SIGSZ]@ = where to put the signature * @const void *k@ = private key * @size_t ksz@ = length of private key * @const octet K[ED25519_PUBSZ]@ = public key + * @int phflag@ = whether the `message' has been hashed already + * @const void *p@ = personalization string + * @size_t psz@ = length of personalization string * @const void *m@ = message to sign * @size_t msz@ = length of message * * Returns: --- * * Use: Signs a message. + * + * In @ed25519ctx_sign@, if @phflag@ is @-1@ then you get plain + * old Ed25519: the personalization string pointer @p@ will be + * ignored. If @phflag > 0@ then the `message' @m@ should be a + * SHA512 hash of the actual message. */ -void ed25519_sign(octet sig[ED25519_SIGSZ], - const void *k, size_t ksz, - const octet K[ED25519_PUBSZ], - const void *m, size_t msz) +void ed25519ctx_sign(octet sig[ED25519_SIGSZ], + const void *k, size_t ksz, const octet K[ED25519_PUBSZ], + int phflag, const void *p, size_t psz, + const void *m, size_t msz) { sha512_ctx h; - scaf_piece a[NPIECE], r[NPIECE], t[NPIECE], scratch[3*NPIECE + 1]; + scaf_piece a[NPIECE], r[NPIECE], t[NPIECE], scratch[3*NPIECE]; scaf_dblpiece tt[2*NPIECE]; f25519 RX, RY, RZ; - octet h1[32], b[SHA512_HASHSZ]; + octet h1[32], pb[PREFIX_BUFSZ], rb[SHA512_HASHSZ]; unsigned i; /* Get my private key. */ unpack_key(a, h1, k, ksz); + /* Determine the prefix string. */ + psz = prefix(pb, phflag, p, psz); + /* Select the nonce and the vector part. */ sha512_init(&h); + sha512_hash(&h, pb, psz); sha512_hash(&h, h1, 32); sha512_hash(&h, m, msz); - sha512_done(&h, b); - scaf_loaddbl(tt, b, 64, 2*NPIECE, PIECEWD); + sha512_done(&h, rb); + scaf_loaddbl(tt, rb, 64, 2*NPIECE, PIECEWD); scaf_reduce(r, tt, l, mu, NPIECE, PIECEWD, scratch); ptmul(&RX, &RY, &RZ, r, BX, BY, BZ); ptencode(sig, &RX, &RY, &RZ); /* Calculate the scalar part. */ sha512_init(&h); + sha512_hash(&h, pb, psz); sha512_hash(&h, sig, 32); sha512_hash(&h, K, 32); sha512_hash(&h, m, msz); - sha512_done(&h, b); - scaf_loaddbl(tt, b, 64, 2*NPIECE, PIECEWD); + sha512_done(&h, rb); + scaf_loaddbl(tt, rb, 64, 2*NPIECE, PIECEWD); scaf_reduce(t, tt, l, mu, NPIECE, PIECEWD, scratch); scaf_mul(tt, t, a, NPIECE); for (i = 0; i < NPIECE; i++) tt[i] += r[i]; @@ -468,9 +357,17 @@ void ed25519_sign(octet sig[ED25519_SIGSZ], scaf_store(sig + 32, 32, t, NPIECE, PIECEWD); } -/* --- @ed25519_verify@ --- * +void ed25519_sign(octet sig[ED25519_SIGSZ], + const void *k, size_t ksz, const octet K[ED25519_PUBSZ], + const void *m, size_t msz) + { ed25519ctx_sign(sig, k, ksz, K, -1, 0, 0, m, msz); } + +/* --- @ed25519_verify@, @ed25519ctx_verify@ --- * * * Arguments: @const octet K[ED25519_PUBSZ]@ = public key + * @int phflag@ = whether the `message' has been hashed already + * @const void *p@ = personalization string + * @size_t psz@ = length of personalization string * @const void *m@ = message to sign * @size_t msz@ = length of message * @const octet sig[ED25519_SIGSZ]@ = signature @@ -478,17 +375,23 @@ void ed25519_sign(octet sig[ED25519_SIGSZ], * Returns: Zero if OK, negative on failure. * * Use: Verify a signature. + * + * In @ed25519ctx_verify@, if @phflag@ is @-1@ then you get + * plain old Ed25519: the personalization string pointer @p@ + * will be ignored. If @phflag > 0@ then the `message' @m@ + * should be a SHA512 hash of the actual message. */ -int ed25519_verify(const octet K[ED25519_PUBSZ], - const void *m, size_t msz, - const octet sig[ED25519_SIGSZ]) +int ed25519ctx_verify(const octet K[ED25519_PUBSZ], + int phflag, const void *p, size_t psz, + const void *m, size_t msz, + const octet sig[ED25519_SIGSZ]) { sha512_ctx h; - scaf_piece s[NPIECE], t[NPIECE], scratch[3*NPIECE + 1]; + scaf_piece s[NPIECE], t[NPIECE], scratch[3*NPIECE]; scaf_dblpiece tt[2*NPIECE]; f25519 AX, AY, AZ, RX, RY, RZ; - octet b[SHA512_HASHSZ]; + octet b[PREFIX_BUFSZ]; /* Unpack the public key. Negate it: we're meant to subtract the term * involving the public key point, and this is easier than negating the @@ -506,7 +409,9 @@ int ed25519_verify(const octet K[ED25519_PUBSZ], if (memcmp(b, sig + 32, 32) != 0) return (-1); /* Check the signature. */ + psz = prefix(b, phflag, p, psz); sha512_init(&h); + sha512_hash(&h, b, psz); sha512_hash(&h, sig, 32); sha512_hash(&h, K, 32); sha512_hash(&h, m, msz); @@ -521,6 +426,11 @@ int ed25519_verify(const octet K[ED25519_PUBSZ], return (0); } +int ed25519_verify(const octet K[ED25519_PUBSZ], + const void *m, size_t msz, + const octet sig[ED25519_SIGSZ]) + { return (ed25519ctx_verify(K, -1, 0, 0, m, msz, sig)); } + /*----- Test rig ----------------------------------------------------------*/ #ifdef TEST_RIG @@ -531,6 +441,8 @@ int ed25519_verify(const octet K[ED25519_PUBSZ], #include #include +#include "ct.h" + static int vrf_pubkey(dstr dv[]) { dstr dpub = DSTR_INIT; @@ -538,8 +450,10 @@ static int vrf_pubkey(dstr dv[]) if (dv[1].len != ED25519_PUBSZ) die(1, "bad pub length"); + ct_poison(dv[0].buf, dv[0].len); dstr_ensure(&dpub, ED25519_PUBSZ); dpub.len = ED25519_PUBSZ; ed25519_pubkey((octet *)dpub.buf, dv[0].buf, dv[0].len); + ct_remedy(dpub.buf, dpub.len); if (memcmp(dpub.buf, dv[1].buf, ED25519_PUBSZ) != 0) { ok = 0; fprintf(stderr, "failed!"); @@ -553,25 +467,45 @@ static int vrf_pubkey(dstr dv[]) return (ok); } -static int vrf_sign(dstr dv[]) +static int vrf_sign(dstr *priv, int phflag, dstr *perso, + dstr *msg, dstr *want) { + sha512_ctx h; octet K[ED25519_PUBSZ]; - dstr dsig = DSTR_INIT; + dstr d = DSTR_INIT, dsig = DSTR_INIT, *m; int ok = 1; - if (dv[2].len != ED25519_SIGSZ) die(1, "bad result length"); + if (want->len != ED25519_SIGSZ) die(1, "bad result length"); + ct_poison(priv->buf, priv->len); dstr_ensure(&dsig, ED25519_SIGSZ); dsig.len = ED25519_SIGSZ; - ed25519_pubkey(K, dv[0].buf, dv[0].len); - ed25519_sign((octet *)dsig.buf, dv[0].buf, dv[0].len, K, - dv[1].buf, dv[1].len); - if (memcmp(dsig.buf, dv[2].buf, ED25519_SIGSZ) != 0) { + if (phflag <= 0) + m = msg; + else { + dstr_ensure(&d, SHA512_HASHSZ); d.len = SHA512_HASHSZ; + sha512_init(&h); + sha512_hash(&h, msg->buf, msg->len); + sha512_done(&h, d.buf); + m = &d; + } + ed25519_pubkey(K, priv->buf, priv->len); + ed25519ctx_sign((octet *)dsig.buf, priv->buf, priv->len, K, + phflag, perso ? perso->buf : 0, perso ? perso->len : 0, + m->buf, m->len); + ct_remedy(dsig.buf, dsig.len); + if (memcmp(dsig.buf, want->buf, ED25519_SIGSZ) != 0) { ok = 0; fprintf(stderr, "failed!"); - fprintf(stderr, "\n\tpriv = "); type_hex.dump(&dv[0], stderr); - fprintf(stderr, "\n\t msg = "); type_hex.dump(&dv[1], stderr); + fprintf(stderr, "\n\tpriv = "); type_hex.dump(priv, stderr); + if (phflag >= 0) { + fprintf(stderr, "\n\t ph = %d", phflag); + fprintf(stderr, "\n\tpers = "); type_hex.dump(perso, stderr); + } + fprintf(stderr, "\n\t msg = "); type_hex.dump(msg, stderr); + if (phflag > 0) + { fprintf(stderr, "\n\thash = "); type_hex.dump(m, stderr); } fprintf(stderr, "\n\tcalc = "); type_hex.dump(&dsig, stderr); - fprintf(stderr, "\n\twant = "); type_hex.dump(&dv[2], stderr); + fprintf(stderr, "\n\twant = "); type_hex.dump(want, stderr); fprintf(stderr, "\n"); } @@ -579,24 +513,49 @@ static int vrf_sign(dstr dv[]) return (ok); } -static int vrf_verify(dstr dv[]) +static int vrf_sign_trad(dstr *dv) + { return (vrf_sign(&dv[0], -1, 0, &dv[1], &dv[2])); } + +static int vrf_sign_ctx(dstr *dv) + { return (vrf_sign(&dv[0], *(int *)dv[1].buf, &dv[2], &dv[3], &dv[4])); } + +static int vrf_verify(dstr *pub, int phflag, dstr *perso, + dstr *msg, dstr *sig, int rc_want) { - int rc_want, rc_calc; + sha512_ctx h; + int rc_calc; + dstr d = DSTR_INIT, *m; int ok = 1; - if (dv[0].len != ED25519_PUBSZ) die(1, "bad pub length"); - if (dv[2].len != ED25519_SIGSZ) die(1, "bad sig length"); - rc_want = *(int *)dv[3].buf; - - rc_calc = ed25519_verify((const octet *)dv[0].buf, - dv[1].buf, dv[1].len, - (const octet *)dv[2].buf); + if (pub->len != ED25519_PUBSZ) die(1, "bad pub length"); + if (sig->len != ED25519_SIGSZ) die(1, "bad sig length"); + + if (phflag <= 0) + m = msg; + else { + dstr_ensure(&d, SHA512_HASHSZ); d.len = SHA512_HASHSZ; + sha512_init(&h); + sha512_hash(&h, msg->buf, msg->len); + sha512_done(&h, d.buf); + m = &d; + } + rc_calc = ed25519ctx_verify((const octet *)pub->buf, + phflag, perso ? perso->buf : 0, + perso ? perso->len : 0, + m->buf, m->len, + (const octet *)sig->buf); if (!rc_want != !rc_calc) { ok = 0; fprintf(stderr, "failed!"); - fprintf(stderr, "\n\t pub = "); type_hex.dump(&dv[0], stderr); - fprintf(stderr, "\n\t msg = "); type_hex.dump(&dv[1], stderr); - fprintf(stderr, "\n\t sig = "); type_hex.dump(&dv[2], stderr); + fprintf(stderr, "\n\t pub = "); type_hex.dump(pub, stderr); + if (phflag >= 0) { + fprintf(stderr, "\n\t ph = %d", phflag); + fprintf(stderr, "\n\tpers = "); type_hex.dump(perso, stderr); + } + fprintf(stderr, "\n\t msg = "); type_hex.dump(msg, stderr); + if (phflag > 0) + { fprintf(stderr, "\n\thash = "); type_hex.dump(m, stderr); } + fprintf(stderr, "\n\t sig = "); type_hex.dump(sig, stderr); fprintf(stderr, "\n\tcalc = %d", rc_calc); fprintf(stderr, "\n\twant = %d", rc_want); fprintf(stderr, "\n"); @@ -605,10 +564,26 @@ static int vrf_verify(dstr dv[]) return (ok); } +static int vrf_verify_trad(dstr *dv) + { return (vrf_verify(&dv[0], -1, 0, &dv[1], &dv[2], *(int *)dv[3].buf)); } + +static int vrf_verify_ctx(dstr *dv) +{ + return (vrf_verify(&dv[0], *(int *)dv[1].buf, &dv[2], + &dv[3], &dv[4], *(int *)dv[5].buf)); +} + static test_chunk tests[] = { - { "pubkey", vrf_pubkey, { &type_hex, &type_hex } }, - { "sign", vrf_sign, { &type_hex, &type_hex, &type_hex } }, - { "verify", vrf_verify, { &type_hex, &type_hex, &type_hex, &type_int } }, + { "pubkey", vrf_pubkey, + { &type_hex, &type_hex } }, + { "sign", vrf_sign_trad, + { &type_hex, &type_hex, &type_hex } }, + { "verify", vrf_verify_trad, + { &type_hex, &type_hex, &type_hex, &type_int } }, + { "sign-ctx", vrf_sign_ctx, + { &type_hex, &type_int, &type_hex, &type_hex, &type_hex } }, + { "verify-ctx", vrf_verify_ctx, + { &type_hex, &type_int, &type_hex, &type_hex, &type_hex, &type_int } }, { 0, 0, { 0 } } };