Merge pull request #120 from oasisprotocol/feature/x25519-private-and…

…-public-keys

primitives/x25519: Add x25519 private and public key types

primitives/x25519/x25519.go

@@ -33,9 +33,11 @@
 package x25519
 
 import (
+	cryptorand "crypto/rand"
 	"crypto/sha512"
 	"crypto/subtle"
 	"fmt"
+	"io"
 
 	"github.com/oasisprotocol/curve25519-voi/curve"
 	"github.com/oasisprotocol/curve25519-voi/curve/scalar"
@@ -44,12 +46,90 @@ import (
 )
 
 const (
-	// ScalarSize is the size of the scalar input to X25519.
+	// ScalarSize is the size, in bytes, of the scalar input to X25519.
 	ScalarSize = 32
-	// PointSize is the size of the point input to X25519.
+
+	// PointSize is the size, in bytes, of the point input to X25519.
 	PointSize = 32
+
+	// PrivateKeySize is the size, in bytes, of private keys as used in this package.
+	PrivateKeySize = ScalarSize
+
+	// PublicKeySize is the size, in bytes, of public keys as used in this package.
+	PublicKeySize = PointSize
+
+	// SharedSecretSize is the size, in bytes, of shared secrets generated by this package.
+	SharedSecretSize = PointSize
+
+	// seedSize is the size, in bytes, of the seeds as used in this package.
+	seedSize = 32
 )
 
+// PrivateKey is the type of X25519 private keys.
+type PrivateKey [PrivateKeySize]byte
+
+// Public returns the public key corresponding to the private key.
+func (priv *PrivateKey) Public() *PublicKey {
+	var pub PublicKey
+	ScalarBaseMult((*[PointSize]byte)(&pub), (*[ScalarSize]byte)(priv))
+	return &pub
+}
+
+// DiffieHellman performs a Diffie-Hellman key exchange between the private key
+// and the given public key to produce a shared secret.
+//
+// When provided a low-order public key, Diffe-Hellman key exchange will
+// return a secret containing only zeroes, irrespective of the private key.
+// Handle this case appropriately, if needed.
+func (priv *PrivateKey) DiffieHellman(pub *PublicKey) *SharedSecret {
+	var sec SharedSecret
+	ScalarMult((*[PointSize]byte)(&sec), (*[ScalarSize]byte)(priv), (*[PointSize]byte)(pub))
+	return &sec
+}
+
+// PublicKey is the type of X25519 public keys.
+type PublicKey [PublicKeySize]byte
+
+// SharedSecret is the type of the result of a Diffie-Hellman key exchange.
+type SharedSecret [SharedSecretSize]byte
+
+// IsZero returns true iff the shared secret is the all-zero value.
+//
+// Comparison is performed without leaking extra information about the secret.
+func (ss *SharedSecret) IsZero() bool {
+	var zero SharedSecret
+	return subtle.ConstantTimeCompare(ss[:], zero[:]) == 1
+}
+
+// GeneratePrivateKey generates a private key using entropy from rand.
+// If rand is nil, crypto/rand.Reader will be used.
+func GeneratePrivateKey(rand io.Reader) (*PrivateKey, error) {
+	if rand == nil {
+		rand = cryptorand.Reader
+	}
+
+	var seed [seedSize]byte
+	if _, err := io.ReadFull(rand, seed[:]); err != nil {
+		return nil, err
+	}
+
+	digest := sha512.Sum512_256(seed[:]) // Mitigate poor quality entropy.
+
+	return (*PrivateKey)(&digest), nil
+}
+
+// GenerateKey generates a public/private key pair using entropy from rand.
+// If rand is nil, crypto/rand.Reader will be used.
+func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) {
+	privateKey, err := GeneratePrivateKey(rand)
+	if err != nil {
+		return nil, nil, err
+	}
+	publicKey := privateKey.Public()
+
+	return publicKey, privateKey, nil
+}
+
 // Basepoint is the canonical Curve25519 generator.
 var Basepoint []byte
 

primitives/x25519/x25519_test.go

@@ -245,3 +245,53 @@ func benchScalarMult(b *testing.B, scalarMult func(dst, scalar, in *[32]byte)) {
 		scalarMult(&out, &scalar, &in)
 	}
 }
+
+func TestX25519DiffieHellman(t *testing.T) {
+	// Alice
+	privateKeyAliceRaw := [32]byte{0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d, 0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45, 0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a, 0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a}
+	publicKeyAliceRaw := [32]byte{0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54, 0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a, 0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4, 0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a}
+
+	privateKeyAlice := (PrivateKey)(privateKeyAliceRaw)
+	publicKeyAlice := privateKeyAlice.Public()
+
+	if !bytes.Equal(publicKeyAlice[:], publicKeyAliceRaw[:]) {
+		t.Errorf("invalid public key: %x != %x", *publicKeyAlice, publicKeyAliceRaw)
+	}
+
+	// Bob
+	privateKeyBobRaw := [32]byte{0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b, 0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6, 0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd, 0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb}
+	publicKeyBobRaw := [32]byte{0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4, 0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37, 0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d, 0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f}
+
+	privateKeyBob := (PrivateKey)(privateKeyBobRaw)
+	publicKeyBob := privateKeyBob.Public()
+
+	if !bytes.Equal(publicKeyBob[:], publicKeyBobRaw[:]) {
+		t.Errorf("invalid public key: %x != %x", *publicKeyBob, publicKeyBobRaw)
+	}
+
+	// Diffie-Hellman
+	sharedSecretRaw := [32]byte{0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1, 0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25, 0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33, 0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42}
+
+	sharedSecretAlice := privateKeyAlice.DiffieHellman(publicKeyBob)
+	sharedSecretBob := privateKeyBob.DiffieHellman(publicKeyAlice)
+
+	if !bytes.Equal(sharedSecretAlice[:], sharedSecretBob[:]) {
+		t.Errorf("mismatched shared secrets: %x != %x", *sharedSecretAlice, *sharedSecretBob)
+	}
+	if !bytes.Equal(sharedSecretAlice[:], sharedSecretRaw[:]) {
+		t.Errorf("invalid shared secrets: %x != %x", *sharedSecretAlice, sharedSecretRaw)
+	}
+}
+
+func TestX25519GenerateKey(t *testing.T) {
+	pub, priv, err := GenerateKey(nil)
+	if err != nil {
+		t.Errorf("failed to generate key pair: %s", err)
+	}
+
+	var expected [32]byte
+	ScalarBaseMult(&expected, (*[ScalarSize]byte)(priv))
+	if !bytes.Equal(pub[:], expected[:]) {
+		t.Errorf("generated key pair doesn't match: %s", err)
+	}
+}