openbsd/src/lib/libcrypto/curve25519, branch OPENBSD_7_8_BASE

curve25519.c: zap trailing whitespace introduced in previous

2025-07-29T10:52:20+00:00

avoid undefined behavior when shifting into sign bit

2025-07-17T00:55:48+00:00

Shifting a signed int64_t into the sign bit is undefined behavior in C. /dev/portable/crypto/curve25519/curve25519.c:3900:18: runtime error: left shift of negative value -222076011 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /dev/portable To avoid this, import int64_lshift21() from BoringSSL, a helper function that casts the input to uint64_t before shifting and back to int64_t afterward. This ensures defined behavior when shifting left by 21 bits, avoiding undefined behavior in expressions like `carry << 21`. This change addresses potential runtime issues detected by sanitizers when shifting signed values with high bits set. ok tb beck

Hide symbols in curve22519

2023-07-08T15:12:49+00:00

ok tb@

Revert r1.9 and reinstate r1.6

2023-04-02T15:36:53+00:00

The argument change to x5519_ge_scalarmult_base() was made to match the prototype in the header. More recent compilers warn about such ptr vs array mismatches.

Prevent Ed25519 signature malleability

2022-11-17T19:01:59+00:00

Add a check that ensures that the upper half s of an Ed25519 signature is bounded by the group order, i.e, 0 <= s < order. This is required by the Verify procedure in RFC 8032, section 5.1.7, step 1, and prevents simple modifications of signatures such as adding (a multiple of) the group order to the upper half of the signature. Found with EdDSA testcase 63 of project Wycheproof. ok beck jsing

Expose direct access API for Ed25519.

2022-11-13T14:05:04+00:00

zap stray space (CRITICAL!)

2022-11-11T01:44:26+00:00

Make X25519_public_from_private() internally reachable.

2022-11-09T17:45:55+00:00

Rename public_value to public_key for consistency.

2022-11-09T17:40:51+00:00

ok tb@

Rework ED25519 API.

2022-11-09T17:39:29+00:00

BoringSSL implemented a compound private key, which includes a copy of the public key as a performance optimisation for signing. However, this does not readily match with how EVP works, makes the ED25519 API inconsistent with the X25519 API, diverges from th RFC and does not align with the OpenSSL API. Instead, the caller can readily compute the public key and pass this in to the signing process. ok tb@