16 Jan, 2020

1 commit

  • If CRYPTO_CURVE25519 is y, CRYPTO_LIB_CURVE25519_GENERIC will be
    y, but CRYPTO_LIB_CURVE25519 may be set to m, this causes build
    errors:

    lib/crypto/curve25519-selftest.o: In function `curve25519':
    curve25519-selftest.c:(.text.unlikely+0xc): undefined reference to `curve25519_arch'
    lib/crypto/curve25519-selftest.o: In function `curve25519_selftest':
    curve25519-selftest.c:(.init.text+0x17e): undefined reference to `curve25519_base_arch'

    This is because the curve25519 self-test code is being controlled
    by the GENERIC option rather than the overall CURVE25519 option,
    as is the case with blake2s. To recap, the GENERIC and ARCH options
    for CURVE25519 are internal only and selected by users such as
    the Crypto API, or the externally visible CURVE25519 option which
    in turn is selected by wireguard. The self-test is specific to the
    the external CURVE25519 option and should not be enabled by the
    Crypto API.

    This patch fixes this by splitting the GENERIC module from the
    CURVE25519 module with the latter now containing just the self-test.

    Reported-by: Hulk Robot
    Fixes: aa127963f1ca ("crypto: lib/curve25519 - re-add selftests")
    Signed-off-by: Herbert Xu
    Reviewed-by: Jason A. Donenfeld
    Signed-off-by: Herbert Xu

    Herbert Xu
     

27 Dec, 2019

1 commit

  • Somehow these were dropped when Zinc was being integrated, which is
    problematic, because testing the library interface for Curve25519 is
    important.. This commit simply adds them back and wires them in in the
    same way that the blake2s selftests are wired in.

    Signed-off-by: Jason A. Donenfeld
    Signed-off-by: Herbert Xu

    Jason A. Donenfeld
     

17 Nov, 2019

1 commit

  • This contains two formally verified C implementations of the Curve25519
    scalar multiplication function, one for 32-bit systems, and one for
    64-bit systems whose compiler supports efficient 128-bit integer types.
    Not only are these implementations formally verified, but they are also
    the fastest available C implementations. They have been modified to be
    friendly to kernel space and to be generally less horrendous looking,
    but still an effort has been made to retain their formally verified
    characteristic, and so the C might look slightly unidiomatic.

    The 64-bit version comes from HACL*: https://github.com/project-everest/hacl-star
    The 32-bit version comes from Fiat: https://github.com/mit-plv/fiat-crypto

    Information: https://cr.yp.to/ecdh.html

    Signed-off-by: Jason A. Donenfeld
    [ardb: - move from lib/zinc to lib/crypto
    - replace .c #includes with Kconfig based object selection
    - drop simd handling and simplify support for per-arch versions ]
    Signed-off-by: Ard Biesheuvel
    Signed-off-by: Herbert Xu

    Jason A. Donenfeld