Move curve25519 implementations to fips module except spake25519

crypto/CMakeLists.txt

@@ -400,10 +400,6 @@ add_library(
   cipher_extra/tls_cbc.c
   conf/conf.c
   crypto.c
-  curve25519/curve25519.c
-  curve25519/curve25519_nohw.c
-  curve25519/curve25519_s2n_bignum_asm.c
-  curve25519/spake25519.c
   des/des.c
   dh_extra/params.c
   dh_extra/dh_asn1.c
@@ -491,6 +487,7 @@ add_library(
   rsa_extra/rsa_print.c
   stack/stack.c
   siphash/siphash.c
+  spake25519/spake25519.c
   thread.c
   thread_none.c
   thread_pthread.c
@@ -771,9 +768,6 @@ if(BUILD_TESTING)
     conf/conf_test.cc
     constant_time_test.cc
     crypto_test.cc
-    curve25519/ed25519_test.cc
-    curve25519/spake25519_test.cc
-    curve25519/x25519_test.cc
     ecdh_extra/ecdh_test.cc
     dh_extra/dh_test.cc
     digest_extra/digest_test.cc
@@ -789,6 +783,8 @@ if(BUILD_TESTING)
     fipsmodule/bn/bn_test.cc
     fipsmodule/bn/bn_assert_test.cc
     fipsmodule/cmac/cmac_test.cc
+    fipsmodule/curve25519/ed25519_test.cc
+    fipsmodule/curve25519/x25519_test.cc
     fipsmodule/ec/ec_test.cc
     fipsmodule/ec/p256-nistz_test.cc
     fipsmodule/ecdsa/ecdsa_test.cc
@@ -828,6 +824,7 @@ if(BUILD_TESTING)
     self_test.cc
     stack/stack_test.cc
     siphash/siphash_test.cc
+    spake25519/spake25519_test.cc
     test/file_test_gtest.cc
     thread_test.cc
     trust_token/trust_token_test.cc

crypto/fipsmodule/bcm.c

@@ -83,6 +83,9 @@
 #include "cpucap/cpu_ppc64le.c"
 
 #include "cmac/cmac.c"
+#include "curve25519/curve25519.c"
+#include "curve25519/curve25519_nohw.c"
+#include "curve25519/curve25519_s2n_bignum_asm.c"
 #include "dh/check.c"
 #include "dh/dh.c"
 #include "digest/digest.c"

crypto/curve25519/curve25519.c → crypto/fipsmodule/curve25519/curve25519.c

@@ -28,8 +28,8 @@
 #include <openssl/sha.h>
 
 #include "internal.h"
-#include "../internal.h"
-#include "../fipsmodule/cpucap/internal.h"
+#include "../../internal.h"
+#include "../cpucap/internal.h"
 
 // X25519 [1] and Ed25519 [2] is an ECDHE protocol and signature scheme,
 // respectively. This file contains an implementation of both using two

crypto/curve25519/curve25519_nohw.c → crypto/fipsmodule/curve25519/curve25519_nohw.c

@@ -25,15 +25,15 @@
 #include <openssl/type_check.h>
 
 #include "internal.h"
-#include "../internal.h"
+#include "../../internal.h"
 
 // Various pre-computed constants.
 #include "./curve25519_tables.h"
 
 #if defined(BORINGSSL_CURVE25519_64BIT)
-#include "../../third_party/fiat/curve25519_64.h"
+#include "../../../third_party/fiat/curve25519_64.h"
 #else
-#include "../../third_party/fiat/curve25519_32.h"
+#include "../../../third_party/fiat/curve25519_32.h"
 #endif  // BORINGSSL_CURVE25519_64BIT
 
 
@@ -1015,10 +1015,10 @@ static void ge_double_scalarmult_vartime(ge_p2 *r, const uint8_t *a,
 
     if (bslide[i] > 0) {
       x25519_ge_p1p1_to_p3(&u, &t);
-      ge_madd(&t, &u, &Bi[bslide[i] / 2]);
+      ge_madd(&t, &u, &k25519Bi[bslide[i] / 2]);
     } else if (bslide[i] < 0) {
       x25519_ge_p1p1_to_p3(&u, &t);
-      ge_msub(&t, &u, &Bi[(-bslide[i]) / 2]);
+      ge_msub(&t, &u, &k25519Bi[(-bslide[i]) / 2]);
     }
 
     x25519_ge_p1p1_to_p2(r, &t);

crypto/curve25519/curve25519_s2n_bignum_asm.c → crypto/fipsmodule/curve25519/curve25519_s2n_bignum_asm.c

@@ -2,10 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0 OR ISC
 
 #include "internal.h"
-#include "../fipsmodule/cpucap/internal.h"
+#include "../cpucap/internal.h"
 
 #if defined(CURVE25519_S2N_BIGNUM_CAPABLE)
-#include "../../third_party/s2n-bignum/include/s2n-bignum_aws-lc.h"
+#include "../../../third_party/s2n-bignum/include/s2n-bignum_aws-lc.h"
 
 void x25519_scalar_mult_generic_s2n_bignum(
   uint8_t out_shared_key[X25519_SHARED_KEY_LEN],

crypto/curve25519/curve25519_tables.h → crypto/fipsmodule/curve25519/curve25519_tables.h

@@ -15,7 +15,6 @@
 // This file is generated from
 //    ./make_curve25519_tables.py > curve25519_tables.h
 
-
 static const fe k25519d = {{
 #if defined(BORINGSSL_CURVE25519_64BIT)
     929955233495203, 466365720129213, 1662059464998953, 2033849074728123,
@@ -7636,7 +7635,7 @@ static const ge_precomp k25519Precomp[32][8] = {
 #endif  // OPENSSL_SMALL
 
 // Bi[i] = (2*i+1)*B
-static const ge_precomp Bi[8] = {
+static const ge_precomp k25519Bi[8] = {
     {
         {{
 #if defined(BORINGSSL_CURVE25519_64BIT)

crypto/curve25519/ed25519_test.cc → crypto/fipsmodule/curve25519/ed25519_test.cc

@@ -19,13 +19,13 @@
 
 #include <openssl/curve25519.h>
 
-#include "../internal.h"
-#include "../test/file_test.h"
-#include "../test/test_util.h"
+#include "../../internal.h"
+#include "../../test/file_test.h"
+#include "../../test/test_util.h"
 
 
 TEST(Ed25519Test, TestVectors) {
-  FileTestGTest("crypto/curve25519/ed25519_tests.txt", [](FileTest *t) {
+  FileTestGTest("crypto/fipsmodule/curve25519/ed25519_tests.txt", [](FileTest *t) {
     std::vector<uint8_t> private_key, public_key, message, expected_signature;
     ASSERT_TRUE(t->GetBytes(&private_key, "PRIV"));
     ASSERT_EQ(64u, private_key.size());

crypto/curve25519/internal.h → crypto/fipsmodule/curve25519/internal.h

@@ -20,9 +20,8 @@ extern "C" {
 #endif
 
 #include <openssl/base.h>
-#include <openssl/curve25519.h>
 
-#include "../internal.h"
+#include "../../internal.h"
 
 // If (1) x86_64 or aarch64, (2) linux or apple, and (3) OPENSSL_NO_ASM is not
 // set, s2n-bignum path is capable.
@@ -186,26 +185,6 @@ void ed25519_sha512(uint8_t out[SHA512_DIGEST_LENGTH],
   const void *input1, size_t len1, const void *input2, size_t len2,
   const void *input3, size_t len3);
 
-enum spake2_state_t {
-  spake2_state_init = 0,
-  spake2_state_msg_generated,
-  spake2_state_key_generated,
-};
-
-struct spake2_ctx_st {
-  uint8_t private_key[32];
-  uint8_t my_msg[32];
-  uint8_t password_scalar[32];
-  uint8_t password_hash[64];
-  uint8_t *my_name;
-  size_t my_name_len;
-  uint8_t *their_name;
-  size_t their_name_len;
-  enum spake2_role_t my_role;
-  enum spake2_state_t state;
-  char disable_password_scalar_hack;
-};
-
 #if defined(__cplusplus)
 }  // extern C
 #endif

crypto/curve25519/x25519_test.cc → crypto/fipsmodule/curve25519/x25519_test.cc

@@ -20,11 +20,11 @@
 
 #include <openssl/curve25519.h>
 
-#include "../internal.h"
-#include "../test/abi_test.h"
-#include "../test/file_test.h"
-#include "../test/test_util.h"
-#include "../test/wycheproof_util.h"
+#include "../../internal.h"
+#include "../../test/abi_test.h"
+#include "../../test/file_test.h"
+#include "../../test/test_util.h"
+#include "../../test/wycheproof_util.h"
 #include "internal.h"
 
 static inline int ctwrapX25519(uint8_t out_shared_key[32],

crypto/spake25519/internal.h

@@ -0,0 +1,35 @@
+#ifndef OPENSSL_HEADER_SPAKE25519_INTERNAL_H
+#define OPENSSL_HEADER_SPAKE25519_INTERNAL_H
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+#include <openssl/base.h>
+#include <openssl/curve25519.h>
+
+enum spake2_state_t {
+  spake2_state_init = 0,
+  spake2_state_msg_generated,
+  spake2_state_key_generated,
+};
+
+struct spake2_ctx_st {
+  uint8_t private_key[32];
+  uint8_t my_msg[32];
+  uint8_t password_scalar[32];
+  uint8_t password_hash[64];
+  uint8_t *my_name;
+  size_t my_name_len;
+  uint8_t *their_name;
+  size_t their_name_len;
+  enum spake2_role_t my_role;
+  enum spake2_state_t state;
+  char disable_password_scalar_hack;
+};
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_SPAKE25519_INTERNAL_H

crypto/curve25519/spake25519.c → crypto/spake25519/spake25519.c

@@ -23,6 +23,7 @@
 #include <openssl/sha.h>
 
 #include "../fipsmodule/bn/internal.h"
+#include "../fipsmodule/curve25519/internal.h"
 #include "../internal.h"
 #include "./internal.h"
 

sources.cmake

@@ -50,7 +50,6 @@ set(
   crypto/cipher_extra/test/nist_cavp/aes_256_gcm.txt
   crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt
   crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt
-  crypto/curve25519/ed25519_tests.txt
   crypto/dilithium/kat/dilithium3_r3.txt
   crypto/ecdh_extra/ecdh_tests.txt
   crypto/evp_extra/kbkdf_expand_tests.txt
@@ -73,6 +72,7 @@ set(
   crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt
   crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt
   crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt
+  crypto/fipsmodule/curve25519/ed25519_tests.txt
   crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt
   crypto/fipsmodule/ec/large_x_coordinate_points.txt
   crypto/fipsmodule/ec/p256-nistz_tests.txt