fix: multi-repo local dev (file:../ deps, package exports, missing deps)

2026-05-21 20:14:54 -04:00
parent 76e3272ced
commit b63275c6cc
802 changed files with 94636 additions and 4 deletions
@@ -0,0 +1,90 @@
+/*-
+ * Copyright 2005,2007,2009 Colin Percival
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Adapted from libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf-sha256.c
+ */
+
+#include <string.h>
+#include <sodium.h>
+
+#include "pbkdf2.h"
+
+/**
+ * pbkdf2_sha512(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
+ * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
+ * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
+ */
+int
+sn__extension_pbkdf2_sha512(const unsigned char *passwd, size_t passwdlen,
+                      const unsigned char *salt, size_t saltlen, uint64_t c,
+                      unsigned char *buf, size_t dkLen)
+{
+    crypto_auth_hmacsha512_state PShctx, hctx;
+    size_t                       i;
+    unsigned char                ivec[4];
+    unsigned char                U[64];
+    unsigned char                T[64];
+    uint64_t                     j;
+    unsigned int                 k;
+    size_t                       clen;
+
+    if (dkLen > sn__extension_pbkdf2_sha512_BYTES_MAX) {
+        return -1;
+    }
+
+    crypto_auth_hmacsha512_init(&PShctx, passwd, passwdlen);
+    crypto_auth_hmacsha512_update(&PShctx, salt, saltlen);
+
+    for (i = 0; i * crypto_auth_hmacsha512_BYTES < dkLen; i++) {
+        SN_PBKDF2_STORE32_BE(ivec, (uint32_t)(i + 1));
+        memcpy(&hctx, &PShctx, sizeof(crypto_auth_hmacsha512_state));
+        crypto_auth_hmacsha512_update(&hctx, ivec, 4);
+        crypto_auth_hmacsha512_final(&hctx, U);
+
+        memcpy(T, U, crypto_auth_hmacsha512_BYTES);
+        /* LCOV_EXCL_START */
+        for (j = 2; j <= c; j++) {
+            crypto_auth_hmacsha512_init(&hctx, passwd, passwdlen);
+            crypto_auth_hmacsha512_update(&hctx, U, crypto_auth_hmacsha512_BYTES);
+            crypto_auth_hmacsha512_final(&hctx, U);
+
+            for (k = 0; k < crypto_auth_hmacsha512_BYTES; k++) {
+                T[k] ^= U[k];
+            }
+        }
+        /* LCOV_EXCL_STOP */
+
+        clen = dkLen - i * crypto_auth_hmacsha512_BYTES;
+        if (clen > crypto_auth_hmacsha512_BYTES) {
+            clen = crypto_auth_hmacsha512_BYTES;
+        }
+        memcpy(&buf[i * crypto_auth_hmacsha512_BYTES], T, clen);
+    }
+    sodium_memzero((void *) &PShctx, sizeof PShctx);
+
+    return 0;
+}
@@ -0,0 +1,60 @@
+/*-
+ * Copyright 2005,2007,2009 Colin Percival
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+/*
+ * Adapted from libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf-sha256.c
+ */
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sodium.h>
+
+#define SN_PBKDF2_STORE32_BE(buf, n32) \
+  buf[0] = n32 >> 24 & 0xff; \
+  buf[1] = n32 >> 16 & 0xff; \
+  buf[2] = n32 >> 8 & 0xff; \
+  buf[3] = n32 >> 0 & 0xff;
+
+#define sn__extension_pbkdf2_sha512_SALTBYTES 16U
+
+#define sn__extension_pbkdf2_sha512_HASHBYTES crypto_hash_sha512_BYTES
+
+#define sn__extension_pbkdf2_sha512_ITERATIONS_MIN 1U
+
+#define sn__extension_pbkdf2_sha512_BYTES_MAX 0x3fffffffc0ULL
+
+/**
+ * extension_pbkdf2_sha512(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
+ * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
+ * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
+ */
+int sn__extension_pbkdf2_sha512(const unsigned char *, size_t, const unsigned char *, size_t,
+                           uint64_t, unsigned char *, size_t);
+#ifdef __cplusplus
+};
+#endif
@@ -0,0 +1,206 @@
+#include "tweak.h"
+
+/*
+  *EXPERIMENTAL API*
+
+  This module is an experimental implementation of a key tweaking protocol
+  over ed25519 keys. The signature algorithm has been reimplemented from
+  libsodium, but the nonce generation algorithm is *non-standard*.
+
+  Use at your own risk
+*/
+
+static void _extension_tweak_nonce (unsigned char *nonce, const unsigned char *n,
+                                 const unsigned char *m, unsigned long long mlen)
+{
+  // dom2(x, y) with x = 0 (not prehashed) and y = "crypto_tweak_ed25519"
+  static const unsigned char TWEAK_PREFIX[32 + 2 + 20] = {
+      'S', 'i', 'g', 'E', 'd', '2', '5', '5', '1', '9', ' ',
+      'n', 'o', ' ', 'E', 'd', '2', '5', '5', '1', '9', ' ',
+      'c', 'o', 'l', 'l', 'i', 's', 'i', 'o', 'n', 's', 0,
+       20, 'c', 'r', 'y', 'p', 't', 'o', '_', 't', 'w', 'e',
+      'a', 'k', '_', 'e', 'd', '2', '5', '5', '1', '9'
+  };
+
+  crypto_hash_sha512_state hs;
+
+  crypto_hash_sha512_init(&hs);
+  crypto_hash_sha512_update(&hs, TWEAK_PREFIX, sizeof TWEAK_PREFIX);
+  crypto_hash_sha512_update(&hs, n, 32);
+  crypto_hash_sha512_update(&hs, m, mlen);
+  crypto_hash_sha512_final(&hs, nonce);
+}
+
+static inline void
+_crypto_sign_ed25519_clamp(unsigned char k[32])
+{
+    k[0] &= 248;
+    k[31] &= 127;
+    k[31] |= 64;
+}
+
+static void _extension_tweak_ed25519(unsigned char *q, unsigned char *n,
+                           const unsigned char *ns, unsigned long long nslen)
+{
+  sodium_memzero(q, sizeof q);
+
+  crypto_hash(n, ns, nslen);
+  n[31] &= 127; // clear highest bit
+
+  crypto_scalarmult_ed25519_base_noclamp(q, n);
+
+  // hash tweak until we get a valid tweaked q
+  while (crypto_core_ed25519_is_valid_point(q) != 1) {
+    crypto_hash(n, n, 32);
+    n[31] &= 127; // clear highest bit
+
+    crypto_scalarmult_ed25519_base_noclamp(q, n);
+  }
+}
+
+void sn__extension_tweak_ed25519_base(unsigned char *pk, unsigned char *scalar,
+                               const unsigned char *ns, unsigned long long nslen)
+{
+  unsigned char n64[64];
+
+  _extension_tweak_ed25519(pk, n64, ns, nslen);
+
+  SN_TWEAK_COPY_32(scalar, n64)
+}
+
+int sn__extension_tweak_ed25519_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
+                                       const unsigned char *m, unsigned long long mlen,
+                                       const unsigned char *n, unsigned char *pk)
+{
+  crypto_hash_sha512_state hs;
+
+  unsigned char            nonce[64];
+  unsigned char            R[32];
+  unsigned char            hram[64];
+  unsigned char            _pk[32];
+
+  // check if pk was passed
+  if (pk == NULL) {
+    pk = _pk;
+
+    // derive pk from scalar
+    if (crypto_scalarmult_ed25519_base_noclamp(pk, n) != 0) {
+      return -1;
+    }
+  }
+
+  _extension_tweak_nonce(nonce, n, m, mlen);
+  crypto_core_ed25519_scalar_reduce(nonce, nonce);
+
+  // R = G ^ nonce : curve point from nonce
+  if (crypto_scalarmult_ed25519_base_noclamp(R, nonce) != 0) {
+    return -1;
+  }
+
+  // generate challenge as h(ram) = hash(R, pk, message)
+  crypto_hash_sha512_init(&hs);
+  crypto_hash_sha512_update(&hs, R, 32);
+  crypto_hash_sha512_update(&hs, pk, 32);
+  crypto_hash_sha512_update(&hs, m, mlen);
+
+  crypto_hash_sha512_final(&hs, hram);
+
+  crypto_core_ed25519_scalar_reduce(hram, hram);
+
+  // sig = nonce + n * h(ram)
+  crypto_core_ed25519_scalar_mul(sig, hram, n);
+  crypto_core_ed25519_scalar_add(sig + 32, nonce, sig);
+
+  SN_TWEAK_COPY_32(sig, R)
+
+  if (siglen_p != NULL) {
+    *siglen_p = 64U;
+  }
+
+  return 0;
+}
+
+// tweak a secret key
+void sn__extension_tweak_ed25519_sk_to_scalar(unsigned char *n, const unsigned char *sk)
+{
+  unsigned char n64[64];
+
+  // get sk scalar from seed, cf. crypto_sign_keypair_seed
+  crypto_hash(n64, sk, 32);
+  _crypto_sign_ed25519_clamp(n64);
+
+  SN_TWEAK_COPY_32(n, n64)
+}
+
+// tweak a secret key
+void sn__extension_tweak_ed25519_scalar(unsigned char *scalar_out,
+                                 const unsigned char *scalar,
+                                 const unsigned char *ns,
+                                 unsigned long long nslen)
+{
+  unsigned char n[64];
+  unsigned char q[32];
+
+  _extension_tweak_ed25519(q, n, ns, nslen);
+  crypto_core_ed25519_scalar_add(scalar_out, scalar, n);
+}
+
+// tweak a public key
+int sn__extension_tweak_ed25519_pk(unsigned char *tpk,
+                                    const unsigned char *pk,
+                                    const unsigned char *ns,
+                                    unsigned long long nslen)
+{  
+  unsigned char n[64];
+  unsigned char q[32];
+
+  _extension_tweak_ed25519(q, n, ns, nslen);
+  return crypto_core_ed25519_add(tpk, q, pk);
+}
+
+
+void sn__extension_tweak_ed25519_keypair(unsigned char *pk, unsigned char *scalar_out,
+                                  unsigned char *scalar, const unsigned char *ns,
+                                  unsigned long long nslen)
+{
+  unsigned char n64[64];
+
+  crypto_hash(n64, ns, nslen);
+  n64[31] &= 127; // clear highest bit
+
+  sn__extension_tweak_ed25519_scalar_add(scalar_out, scalar, n64);
+  crypto_scalarmult_ed25519_base_noclamp(pk, scalar_out);
+
+  // hash tweak until we get a valid tweaked point
+  while (crypto_core_ed25519_is_valid_point(pk) != 1) {
+    crypto_hash(n64, n64, 32);
+    n64[31] &= 127; // clear highest bit
+
+    sn__extension_tweak_ed25519_scalar_add(scalar_out, scalar, n64);
+    crypto_scalarmult_ed25519_base_noclamp(pk, scalar_out);
+  }
+}
+
+// add tweak to scalar
+void sn__extension_tweak_ed25519_scalar_add(unsigned char *scalar_out,
+                                     const unsigned char *scalar,
+                                     const unsigned char *n)
+{
+  crypto_core_ed25519_scalar_add(scalar_out, scalar, n);
+}
+
+// add tweak point to public key
+int sn__extension_tweak_ed25519_pk_add(unsigned char *tpk,
+                                const unsigned char *pk,
+                                const unsigned char *q)
+{
+  return crypto_core_ed25519_add(tpk, pk, q);
+}
+
+
+int sn__extension_tweak_ed25519_keypair_add(unsigned char *pk, unsigned char *scalar_out,
+                                      unsigned char *scalar, const unsigned char *tweak)
+{
+  sn__extension_tweak_ed25519_scalar_add(scalar_out, scalar, tweak);
+  return crypto_scalarmult_ed25519_base_noclamp(pk, scalar_out);
+}
@@ -0,0 +1,62 @@
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <sodium.h>
+
+// copy 32 bytes using int64_t pointers
+#define SN_TWEAK_COPY_32(a, b) \
+  { \
+    long long *dst = (long long *) a; \
+    long long *src = (long long *) b; \
+    dst[0] = src[0]; \
+    dst[1] = src[1]; \
+    dst[2] = src[2]; \
+    dst[3] = src[3]; \
+  }
+
+#define sn__extension_tweak_ed25519_BYTES crypto_sign_ed25519_PUBLICKEYBYTES
+
+#define sn__extension_tweak_ed25519_SCALARBYTES crypto_scalarmult_ed25519_SCALARBYTES
+
+int sn__extension_tweak_ed25519_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
+                                       const unsigned char *m, unsigned long long mlen,
+                                       const unsigned char *n, unsigned char *pk);
+
+void sn__extension_tweak_ed25519_base(unsigned char *pk, unsigned char *scalar,
+                               const unsigned char *ns, unsigned long long nslen);
+
+void sn__extension_tweak_ed25519_sk_to_scalar(unsigned char *scalar, const unsigned char *sk);
+
+// tweak a secret key
+void sn__extension_tweak_ed25519_scalar(unsigned char *scalar_out,
+                                 const unsigned char *scalar,
+                                 const unsigned char *ns,
+                                 unsigned long long nslen);
+
+// tweak a public key
+int sn__extension_tweak_ed25519_pk(unsigned char *tpk,
+                            const unsigned char *pk,
+                            const unsigned char *ns,
+                            unsigned long long nslen);
+
+void sn__extension_tweak_ed25519_keypair(unsigned char *pk, unsigned char *scalar_out,
+                                  unsigned char *scalar, const unsigned char *ns,
+                                  unsigned long long nslen);
+
+// add tweak scalar to private key
+void sn__extension_tweak_ed25519_scalar_add(unsigned char *scalar_out,
+                                     const unsigned char *scalar,
+                                     const unsigned char *n);
+
+// add tweak point to public key
+int sn__extension_tweak_ed25519_pk_add(unsigned char *tpk,
+                                const unsigned char *pk,
+                                const unsigned char *q);
+
+int sn__extension_tweak_ed25519_keypair_add(unsigned char *pk, unsigned char *scalar_out,
+                                      unsigned char *scalar, const unsigned char *tweak);
+
+#ifdef __cplusplus
+};
+#endif