Use function pointer to represent eddsa dom prefix.

diff --git a/ChangeLog b/ChangeLog
index aa208c29ff9e076463961a90f118ec56c6eec9cc..bf4c231e737e1a0c3508413301d0a65f484ee80d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,18 @@
 2020-01-02  Niels Möller  <nisse@lysator.liu.se>
 
-       * eddsa-internal.h (struct ecc_eddsa): Add magic "dom" string,
+       * eddsa-internal.h (nettle_eddsa_dom_func): New typedef.
+       (struct ecc_eddsa): Use function pointer to represent eddsa dom
+       string. To avoid calling sha512_update with empty input for
+       ed25519.
+       * ed448-shake256.c (ed448_dom): New function, calling
+       sha3_256_update with the magic dom prefix.
+       (_nettle_ed448_shake256): Point to it.
+       * ed25519-sha512.c (_nettle_ed25519_sha512): Add do-nothing dom function.
+
+       * eddsa-sign.c (_eddsa_sign): Update to use dom function pointer.
+       * eddsa-verify.c (_eddsa_verify): Likewise.
+
+       * eddsa-internal.h (struct ecc_eddsa): Add magic dom string,
        needed for ed448.
        * ed25519-sha512.c (_nettle_ed25519_sha512): Empty dom string.
        * ed448-shake256.c (_nettle_ed448_shake256): New file and

diff --git a/ed25519-sha512.c b/ed25519-sha512.c
index 09d0f8a5900cb215e2963a00c3914c54168f7f78..72c4e5171a9e5b3f5ccd6217d598967ceb68baf3 100644 (file)
--- a/ed25519-sha512.c
+++ b/ed25519-sha512.c
@@ -38,11 +38,15 @@
 #include "nettle-types.h"
 #include "sha2.h"
 
+static nettle_eddsa_dom_func ed25519_dom;
+
+static void ed25519_dom(void *ctx UNUSED) {}
+
 const struct ecc_eddsa _nettle_ed25519_sha512 =
   {
     (nettle_hash_update_func *) sha512_update,
     (nettle_hash_digest_func *) sha512_digest,
-    NULL, 0,
+    ed25519_dom,
     ~(mp_limb_t) 7,
     (mp_limb_t) 1 << (254 % GMP_NUMB_BITS),
   };

diff --git a/ed448-shake256.c b/ed448-shake256.c
index 4e54b2c61daef9e8ff90f9be757db1e3bc65a02a..25d878f02eab5f29f7e80cf2169218c06b850f2a 100644 (file)
--- a/ed448-shake256.c
+++ b/ed448-shake256.c
@@ -39,14 +39,22 @@
 #include "sha3.h"
 
 #define DOM_SIZE 10
-static const uint8_t ed448_dom[DOM_SIZE] =
-  { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+
+static nettle_eddsa_dom_func ed448_dom;
+
+static void
+ed448_dom(void *ctx)
+{
+  static const uint8_t dom[DOM_SIZE] =
+    { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+  sha3_256_update (ctx, DOM_SIZE, dom);
+}
 
 const struct ecc_eddsa _nettle_ed448_shake256 =
   {
     (nettle_hash_update_func *) sha3_256_update,
     (nettle_hash_digest_func *) sha3_256_shake,
-    ed448_dom, DOM_SIZE,
+    ed448_dom,
     ~(mp_limb_t) 3,
     (mp_limb_t) 1 << (447 % GMP_NUMB_BITS),
   };

diff --git a/eddsa-internal.h b/eddsa-internal.h
index f7730a38144177084a97263c06655ae90628ab93..098ab39c123b1d0149abe865355f65c6a64d8570 100644 (file)
--- a/eddsa-internal.h
+++ b/eddsa-internal.h
@@ -53,13 +53,14 @@
 struct ecc_curve;
 struct ecc_modulo;
 
+typedef void nettle_eddsa_dom_func(void *ctx);
+
 struct ecc_eddsa
 {
   /* Hash function to use */
   nettle_hash_update_func *update;
   nettle_hash_digest_func *digest;
-  const uint8_t *dom;
-  unsigned dom_size;
+  nettle_eddsa_dom_func *dom;
   /* For generating the secret scalar */
   mp_limb_t low_mask;
   mp_limb_t high_bit;

diff --git a/eddsa-sign.c b/eddsa-sign.c
index a5970e984d84871e23882f7c454754f05cd4f890..052770645f290ed8f315dd7f6b73671ddd14e203 100644 (file)
--- a/eddsa-sign.c
+++ b/eddsa-sign.c
@@ -75,7 +75,7 @@ _eddsa_sign (const struct ecc_curve *ecc,
   size = ecc->p.size;
   nbytes = 1 + ecc->p.bit_size / 8;
 
-  eddsa->update (ctx, eddsa->dom_size, eddsa->dom);
+  eddsa->dom (ctx);
   eddsa->update (ctx, nbytes, k1);
   eddsa->update (ctx, length, msg);
   eddsa->digest (ctx, 2*nbytes, hash);
@@ -84,7 +84,7 @@ _eddsa_sign (const struct ecc_curve *ecc,
   ecc->mul_g (ecc, P, rp, scratch_out);
   _eddsa_compress (ecc, signature, P, scratch_out);
 
-  eddsa->update (ctx, eddsa->dom_size, eddsa->dom);
+  eddsa->dom (ctx);
   eddsa->update (ctx, nbytes, signature);
   eddsa->update (ctx, nbytes, pub);
   eddsa->update (ctx, length, msg);

diff --git a/eddsa-verify.c b/eddsa-verify.c
index c4e65d69c6a71961463f830c52285b604826639c..a0ffe0c40bf8d404ac46cf5022b961015af382d9 100644 (file)
--- a/eddsa-verify.c
+++ b/eddsa-verify.c
@@ -106,7 +106,7 @@ _eddsa_verify (const struct ecc_curve *ecc,
   if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0)
     return 0;
 
-  eddsa->update (ctx, eddsa->dom_size, eddsa->dom);
+  eddsa->dom (ctx);
   eddsa->update (ctx, nbytes, signature);
   eddsa->update (ctx, nbytes, pub);
   eddsa->update (ctx, length, msg);