1- [ ed25519] ( http://ed25519.cr.yp.to/ ) is an
2- [ Elliptic Curve Digital Signature Algortithm] ( http://en.wikipedia.org/wiki/Elliptic_Curve_DSA ) ,
3- developed by [ Dan Bernstein] ( http://cr.yp.to/djb.html ) ,
4- [ Niels Duif] ( http://www.nielsduif.nl/ ) ,
5- [ Tanja Lange] ( http://hyperelliptic.org/tanja ) ,
6- [ Peter Schwabe] ( http://www.cryptojedi.org/users/peter/ ) ,
1+ [ ed25519] ( http://ed25519.cr.yp.to/ ) is an
2+ [ Elliptic Curve Digital Signature Algortithm] ( http://en.wikipedia.org/wiki/Elliptic_Curve_DSA ) ,
3+ developed by [ Dan Bernstein] ( http://cr.yp.to/djb.html ) ,
4+ [ Niels Duif] ( http://www.nielsduif.nl/ ) ,
5+ [ Tanja Lange] ( http://hyperelliptic.org/tanja ) ,
6+ [ Peter Schwabe] ( http://www.cryptojedi.org/users/peter/ ) ,
77and [ Bo-Yin Yang] ( http://www.iis.sinica.edu.tw/pages/byyang/ ) .
88
9- This project provides performant, portable 32-bit & 64-bit implementations. All implementations are
9+ This project provides performant, portable 32-bit & 64-bit implementations. All implementations are
1010of course constant time in regard to secret data.
1111
1212#### Performance
@@ -52,35 +52,35 @@ are made.
5252
5353#### Compilation
5454
55- No configuration is needed ** if you are compiling against OpenSSL** .
55+ No configuration is needed ** if you are compiling against OpenSSL** .
5656
5757##### Hash Options
5858
5959If you are not compiling aginst OpenSSL, you will need a hash function.
6060
61- To use a simple/** slow** implementation of SHA-512, use ` -DED25519_REFHASH ` when compiling ` ed25519.c ` .
61+ To use a simple/** slow** implementation of SHA-512, use ` -DED25519_REFHASH ` when compiling ` ed25519.c ` .
6262This should never be used except to verify the code works when OpenSSL is not available.
6363
64- To use a custom hash function, use ` -DED25519_CUSTOMHASH ` when compiling ` ed25519.c ` and put your
64+ To use a custom hash function, use ` -DED25519_CUSTOMHASH ` when compiling ` ed25519.c ` and put your
6565custom hash implementation in ed25519-hash-custom.h. The hash must have a 512bit digest and implement
6666
67- struct ed25519_hash_context;
67+ struct ed25519_hash_context;
6868
69- void ed25519_hash_init(ed25519_hash_context *ctx);
70- void ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen);
71- void ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash);
72- void ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen);
69+ void ed25519_hash_init(ed25519_hash_context *ctx);
70+ void ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen);
71+ void ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash);
72+ void ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen);
7373
7474##### Random Options
7575
7676If you are not compiling aginst OpenSSL, you will need a random function for batch verification.
7777
78- To use a custom random function, use ` -DED25519_CUSTOMRANDOM ` when compiling ` ed25519.c ` and put your
78+ To use a custom random function, use ` -DED25519_CUSTOMRANDOM ` when compiling ` ed25519.c ` and put your
7979custom hash implementation in ed25519-randombytes-custom.h. The random function must implement:
8080
81- void ED25519_FN(ed25519_randombytes_unsafe) (void *p, size_t len);
81+ void ED25519_FN(ed25519_randombytes_unsafe) (void *p, size_t len);
8282
83- Use ` -DED25519_TEST ` when compiling ` ed25519.c ` to use a deterministically seeded, non-thread safe CSPRNG
83+ Use ` -DED25519_TEST ` when compiling ` ed25519.c ` to use a deterministically seeded, non-thread safe CSPRNG
8484variant of Bob Jenkins [ ISAAC] ( http://en.wikipedia.org/wiki/ISAAC_%28cipher%29 )
8585
8686##### Minor options
@@ -91,79 +91,80 @@ Use `-DED25519_FORCE_32BIT` to force the use of 32 bit routines even when compil
9191
9292##### 32-bit
9393
94- gcc ed25519.c -m32 -O3 -c
94+ gcc ed25519.c -m32 -O3 -c
9595
9696##### 64-bit
9797
98- gcc ed25519.c -m64 -O3 -c
98+ gcc ed25519.c -m64 -O3 -c
9999
100100##### SSE2
101101
102- gcc ed25519.c -m32 -O3 -c -DED25519_SSE2 -msse2
103- gcc ed25519.c -m64 -O3 -c -DED25519_SSE2
102+ gcc ed25519.c -m32 -O3 -c -DED25519_SSE2 -msse2
103+ gcc ed25519.c -m64 -O3 -c -DED25519_SSE2
104104
105105clang and icc are also supported
106106
107+
107108#### Usage
108109
109110To use the code, link against ` ed25519.o -mbits ` and:
110111
111- #include "ed25519.h"
112+ #include "ed25519.h"
112113
113114Add ` -lssl -lcrypto ` when using OpenSSL (Some systems don't need -lcrypto? It might be trial and error).
114115
115116To generate a private key, simply generate 32 bytes from a secure
116117cryptographic source:
117118
118- ed25519_secret_key sk;
119- randombytes(sk, sizeof(ed25519_secret_key));
119+ ed25519_secret_key sk;
120+ randombytes(sk, sizeof(ed25519_secret_key));
120121
121122To generate a public key:
122123
123- ed25519_public_key pk;
124- ed25519_publickey(sk, pk);
124+ ed25519_public_key pk;
125+ ed25519_publickey(sk, pk);
125126
126127To sign a message:
127128
128- ed25519_signature sig;
129- ed25519_sign(message, message_len, sk, pk, signature);
129+ ed25519_signature sig;
130+ ed25519_sign(message, message_len, sk, pk, signature);
130131
131132To verify a signature:
132133
133- int valid = ed25519_sign_open(message, message_len, pk, signature) == 0;
134+ int valid = ed25519_sign_open(message, message_len, pk, signature) == 0;
134135
135136To batch verify signatures:
136137
137- const unsigned char *mp[num] = {message1, message2..}
138- size_t ml[num] = {message_len1, message_len2..}
139- const unsigned char *pkp[num] = {pk1, pk2..}
140- const unsigned char *sigp[num] = {signature1, signature2..}
141- int valid[num]
138+ const unsigned char *mp[num] = {message1, message2..}
139+ size_t ml[num] = {message_len1, message_len2..}
140+ const unsigned char *pkp[num] = {pk1, pk2..}
141+ const unsigned char *sigp[num] = {signature1, signature2..}
142+ int valid[num]
142143
143- /* valid[i] will be set to 1 if the individual signature was valid, 0 otherwise */
144- int all_valid = ed25519_sign_open_batch(mp, ml, pkp, sigp, num, valid) == 0;
144+ /* valid[i] will be set to 1 if the individual signature was valid, 0 otherwise */
145+ int all_valid = ed25519_sign_open_batch(mp, ml, pkp, sigp, num, valid) == 0;
145146
146- ** Note** : Batch verification uses ` ed25519_randombytes_unsafe ` , implemented in
147- ` ed25519-randombytes.h ` , to generate random scalars for the verification code.
147+ ** Note** : Batch verification uses ` ed25519_randombytes_unsafe ` , implemented in
148+ ` ed25519-randombytes.h ` , to generate random scalars for the verification code.
148149The default implementation now uses OpenSSLs ` RAND_bytes ` .
149150
150151Unlike the [ SUPERCOP] ( http://bench.cr.yp.to/supercop.html ) version, signatures are
151- not appended to messages, and there is no need for padding in front of messages.
152- Additionally, the secret key does not contain a copy of the public key, so it is
152+ not appended to messages, and there is no need for padding in front of messages.
153+ Additionally, the secret key does not contain a copy of the public key, so it is
15315432 bytes instead of 64 bytes, and the public key must be provided to the signing
154155function.
155156
156157##### Curve25519
157158
158- Curve25519 public keys can be generated thanks to
159- [ Adam Langley] ( http://www.imperialviolet.org/2013/05/10/fastercurve25519.html )
159+ Curve25519 public keys can be generated thanks to
160+ [ Adam Langley] ( http://www.imperialviolet.org/2013/05/10/fastercurve25519.html )
160161leveraging Ed25519's precomputed basepoint scalar multiplication.
161162
162- curved25519_key sk, pk;
163- randombytes(sk, sizeof(curved25519_key));
164- curved25519_scalarmult_basepoint(pk, sk);
163+ curved25519_key sk, pk;
164+ randombytes(sk, sizeof(curved25519_key));
165+ curved25519_scalarmult_basepoint(pk, sk);
165166
166- Note the name is curved25519, a combination of curve and ed25519, to prevent
167+ Note the name is curved25519, a combination of curve and ed25519, to prevent
167168name clashes. Performance is slightly faster than short message ed25519
168169signing due to both using the same code for the scalar multiply.
169170
@@ -179,4 +180,4 @@ with extreme values to ensure they function correctly. SSE2 is now supported.
179180
180181#### Papers
181182
182- [ Available on the Ed25519 website] ( http://ed25519.cr.yp.to/papers.html )
183+ [ Available on the Ed25519 website] ( http://ed25519.cr.yp.to/papers.html )
0 commit comments