Milestone 6 (ACL/PKI): Ed25519 verify + SHA-512, built from scratch
New freestanding, verify-only Ed25519 (RFC 8032) implementation:
include/starkernel/{sha512,fe25519,scalar25519,ed25519}.h +
src/starkernel/crypto/{sha512,fe25519,scalar25519,ed25519}.c, wired into
Makefile.starkernel. Kernel never signs or generates keys -- only
ed25519_verify() is needed; signing happens in the host-side mkcapsule
build tool via libsodium/OpenSSL.
Confirmed __int128 multiply/add/shift-by-constant compile with zero
undefined symbols on all three target toolchains (only division needs
libgcc's __udivti3, per timer.c's existing documented finding -- that
file's comment updated to narrow the claim, since it had been read as
"avoid __int128 entirely"). This enabled the standard 5-limb radix-2^51
field arithmetic representation.
An abandoned first attempt (10-limb radix-2^26, avoiding __int128 out of
premature caution) hit two real bugs, both invisible on inspection and
found only by property-based testing against Python's own bignum
arithmetic: a non-uniform-radix limb misalignment in multiplication, and
a double-counted carry. Verification chain: SHA-512 against known +
boundary vectors (7/7); field arithmetic property-tested 25,045 cases;
scalar-mod-L arithmetic 300 cases (L confirmed prime via Miller-Rabin
first); full verify() end-to-end against 110 real signatures from
Python's cryptography library, including tampered inputs and the RFC
8032 S>=L malleability attack -- all correctly accepted/rejected.
Compiles clean (zero warnings) and links on all three architectures,
confirmed via the mandatory three-arch QEMU boot. The code is linked but
not yet called from anywhere -- wiring into capsule_birth.c needs a
from-scratch X.509/DER parser first (Captain Bob chose real X.509 over a
raw-blob cert format this session), which is the next open item.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZ8kNoTuP63pbQtro4qvrm
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
2b7743027c
commit
2e7e957680
@@ -0,0 +1,23 @@
|
||||
/* ed25519.h -- EdDSA signature VERIFICATION only (RFC 8032), freestanding
|
||||
* C99. No signing, no key generation, no RNG -- this kernel never signs;
|
||||
* signing happens in the host-side build tool, which can link
|
||||
* libsodium/OpenSSL because it's a normal Linux binary. That halves the
|
||||
* implementation surface here: no scalar clamping, no key derivation, no
|
||||
* constant-time discipline (verify operates only on public data --
|
||||
* public key, message, signature -- there's no secret-dependent branch
|
||||
* to leak).
|
||||
*/
|
||||
#ifndef ED25519_H
|
||||
#define ED25519_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
/* Returns 1 if signature (64 bytes: R || S) is a valid Ed25519 signature
|
||||
* by pubkey (32 bytes, compressed point) over msg, else 0. Rejects
|
||||
* malformed inputs (S >= L, an undecodable point) as invalid rather than
|
||||
* faulting. */
|
||||
int ed25519_verify(const uint8_t pubkey[32], const uint8_t *msg, size_t msg_len,
|
||||
const uint8_t sig[64]);
|
||||
|
||||
#endif /* ED25519_H */
|
||||
@@ -0,0 +1,60 @@
|
||||
/* fe25519.h -- arithmetic mod p = 2^255-19, for Ed25519.
|
||||
*
|
||||
* Five-limb representation, uniform radix 2^51 (value =
|
||||
* sum(limb[i] * 2^(51*i)), limb i in roughly [0, 2^51)) -- the standard
|
||||
* Ed25519 reference layout (matches the widely-reviewed "amd64-51"-style
|
||||
* implementations), not something invented for this codebase. 51*5=255
|
||||
* exactly, so unlike a mismatched limb-count/width choice, the reduction
|
||||
* constant is the clean 2^255 mod p = 19 with no extra scaling.
|
||||
*
|
||||
* Uses __int128 for multiply-accumulate (product of two ~51-bit limbs is
|
||||
* up to ~102 bits, summed across up to 5 terms per bucket -- needs a
|
||||
* wide type). Confirmed safe in this kernel's freestanding -nostdlib
|
||||
* build by direct toolchain testing (gcc/aarch64-linux-gnu-gcc/
|
||||
* riscv64-linux-gnu-gcc, matching Makefile.starkernel's exact flags):
|
||||
* __int128 multiply, add, and shift-by-constant all compile with zero
|
||||
* undefined symbols on all three target architectures. This is DIFFERENT
|
||||
* from __int128 DIVISION, which src/starkernel/arch/amd64/timer.c
|
||||
* documents as broken (needs libgcc's __udivti3, undefined in this
|
||||
* -nostdlib build) -- this file never divides __int128 values, so that
|
||||
* restriction doesn't apply here. An earlier draft of this file avoided
|
||||
* __int128 entirely (10 limbs, radix 2^26, int64_t only) out of
|
||||
* over-caution before this was checked directly; abandoned after running
|
||||
* into real bugs from that scheme's own complexity, not from __int128
|
||||
* unavailability -- __int128 was never actually the constraint once
|
||||
* verified.
|
||||
*/
|
||||
#ifndef FE25519_H
|
||||
#define FE25519_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
/* int64_t, not uint64_t: fe25519_sub produces negative intermediate
|
||||
* limbs (a[i] - b[i] can be < 0 for a specific limb even when the total
|
||||
* value a-b, mod p, is what's wanted), and fe25519_carry() relies on
|
||||
* arithmetic right shift to propagate negative "borrows" the same way
|
||||
* it propagates positive carries -- proven correct by the property-based
|
||||
* host test, not just assumed. */
|
||||
typedef struct { int64_t v[5]; } fe25519;
|
||||
|
||||
void fe25519_0(fe25519 *r);
|
||||
void fe25519_1(fe25519 *r);
|
||||
void fe25519_copy(fe25519 *r, const fe25519 *a);
|
||||
void fe25519_add(fe25519 *r, const fe25519 *a, const fe25519 *b);
|
||||
void fe25519_sub(fe25519 *r, const fe25519 *a, const fe25519 *b);
|
||||
void fe25519_neg(fe25519 *r, const fe25519 *a);
|
||||
void fe25519_mul(fe25519 *r, const fe25519 *a, const fe25519 *b);
|
||||
void fe25519_sq(fe25519 *r, const fe25519 *a);
|
||||
void fe25519_invert(fe25519 *r, const fe25519 *a);
|
||||
void fe25519_mul_small(fe25519 *r, const fe25519 *a, uint32_t c);
|
||||
|
||||
/* Pack to 32 little-endian bytes (fully reduced mod p) / unpack from same. */
|
||||
void fe25519_pack(uint8_t out[32], const fe25519 *a);
|
||||
void fe25519_unpack(fe25519 *r, const uint8_t in[32]);
|
||||
|
||||
/* 1 if a == b (as field elements, after full reduction), else 0. */
|
||||
int fe25519_eq(const fe25519 *a, const fe25519 *b);
|
||||
/* Parity of the fully-reduced value's low bit (used for point decompression's sign bit). */
|
||||
int fe25519_parity(const fe25519 *a);
|
||||
|
||||
#endif /* FE25519_H */
|
||||
@@ -0,0 +1,29 @@
|
||||
/* scalar25519.h -- arithmetic mod L (the Ed25519 base point's order),
|
||||
* for reducing SHA-512 output to a valid scalar and checking a
|
||||
* signature's S component for the RFC 8032 malleability requirement
|
||||
* (S < L, not just S < 2^256).
|
||||
*
|
||||
* Deliberately NOT the intricate hand-tuned "sc_reduce" reduction most
|
||||
* reference implementations use (a bespoke Barrett-style reduction with
|
||||
* constants specific to L, notoriously easy to transcribe wrong) --
|
||||
* this is a plain binary long-division reduction, one bit at a time.
|
||||
* O(512) steps per reduction; this is a verify-only, non-hot-path
|
||||
* library (one reduction per signature check), so the simpler,
|
||||
* more obviously-correct approach is the right tradeoff here.
|
||||
*/
|
||||
#ifndef SCALAR25519_H
|
||||
#define SCALAR25519_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
/* 32-byte little-endian scalars, reduced mod L where noted. */
|
||||
|
||||
/* Reduce a 64-byte little-endian value (e.g. raw SHA-512 output) mod L,
|
||||
* producing a 32-byte little-endian result < L. */
|
||||
void scalar_reduce512(uint8_t out[32], const uint8_t in[64]);
|
||||
|
||||
/* 1 if the 32-byte little-endian scalar is < L (a well-formed,
|
||||
* non-malleable signature component per RFC 8032), else 0. */
|
||||
int scalar_lt_L(const uint8_t s[32]);
|
||||
|
||||
#endif /* SCALAR25519_H */
|
||||
@@ -0,0 +1,30 @@
|
||||
/* sha512.h -- freestanding SHA-512 (FIPS 180-4 / RFC 6234), C99, no libc
|
||||
* beyond memcpy/memset (both available in the kernel via
|
||||
* src/starkernel/vm/host/shim.c). No __int128 used -- 64-bit words only,
|
||||
* portable to amd64/aarch64/riscv64 without libgcc helpers.
|
||||
*/
|
||||
#ifndef SHA512_H
|
||||
#define SHA512_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
typedef struct {
|
||||
uint64_t state[8];
|
||||
uint64_t bitlen; /* total message length in bits, low 64 bits
|
||||
* (SHA-512 defines a 128-bit length field; a
|
||||
* single uint64_t of bit-length is enough for
|
||||
* any message this kernel will ever hash --
|
||||
* capsules and certs, not exabyte streams) */
|
||||
uint8_t buf[128];
|
||||
size_t buf_len;
|
||||
} sha512_ctx_t;
|
||||
|
||||
void sha512_init(sha512_ctx_t *ctx);
|
||||
void sha512_update(sha512_ctx_t *ctx, const uint8_t *data, size_t len);
|
||||
void sha512_final(sha512_ctx_t *ctx, uint8_t out[64]);
|
||||
|
||||
/* Convenience one-shot. */
|
||||
void sha512(const uint8_t *data, size_t len, uint8_t out[64]);
|
||||
|
||||
#endif /* SHA512_H */
|
||||
Reference in New Issue
Block a user