Curve25519 field arithmetic (GF(2^255-19), radix-2^16) + X25519 (RFC 7748). More...

#include "network_drivers/presentation/ssh/crypto/ssh_curve25519.h"
#include "network_drivers/presentation/ssh/crypto/ssh_fe25519.h"
#include "sdkconfig.h"
#include <mbedtls/bignum.h>

Functions
void	ssh_gf_copy (ssh_gf out, const ssh_gf in)
	out = in

void	ssh_gf_add (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a + b (unreduced)

void	ssh_gf_sub (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a - b (unreduced)

void	ssh_gf_mul (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a * b mod p

void	ssh_gf_sq (ssh_gf out, const ssh_gf a)
	out = a^2 mod p

void	ssh_gf_inv (ssh_gf out, const ssh_gf a)
	out = a^-1 mod p (= a^(p-2))

void	ssh_gf_cswap (ssh_gf p, ssh_gf q, int b)
	constant-time conditional swap of p,q when b==1

void	ssh_gf_pack (uint8_t out[32], const ssh_gf a)
	canonical little-endian 32-byte encoding

void	ssh_gf_unpack (ssh_gf out, const uint8_t in[32])
	decode 32 bytes (high bit ignored)

void	ssh_x25519 (uint8_t out[32], const uint8_t scalar[32], const uint8_t point[32])
	X25519 scalar multiplication: `out` = `scalar` * `point` (RFC 7748 §5).

void	ssh_x25519_base (uint8_t out[32], const uint8_t scalar[32])
	X25519 with the standard base point u=9: `out` = `scalar` * G.

Detailed Description

Curve25519 field arithmetic (GF(2^255-19), radix-2^16) + X25519 (RFC 7748).

The field element is sixteen int64 limbs of ~16 bits each; a full 16x16 schoolbook product fits in int64 (no 128-bit type, so it builds on 32-bit xtensa). Reduction folds anything at or above 2^256 back as *38 (2^256 = 2*2^255 = 2*19 mod p). The X25519 scalar multiplication is the RFC 7748 §5 Montgomery ladder with constant-time conditional swaps. Validated against the RFC 7748 §5.2 vectors (test_ssh_ed25519).

On the ESP32-S3 (Arduino) X25519 has a second, byte-identical implementation that runs the ladder in canonical uint32[8] and does each field multiply as one 256-bit modular multiply on the RSA/MPI accelerator (~4.3x the software/PIE ladder); the field layer is in ssh_fe25519.h (shared with Ed25519, active as DETWS_FE25519_MPI_HW). It shares the accelerator lock with mbedtls, so a scalar-mult is bracketed by ssh_fe_hw_enable()/ssh_fe_hw_disable() (esp_mpi_{enable,disable}_hardware_hw_op()).

Definition in file ssh_curve25519.cpp.

Function Documentation

◆ ssh_gf_copy()

void ssh_gf_copy	(	ssh_gf	out,
		const ssh_gf	in
	)

out = in

Definition at line 50 of file ssh_curve25519.cpp.

Referenced by ssh_gf_pack().

◆ ssh_gf_add()

void ssh_gf_add	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a + b (unreduced)

Definition at line 56 of file ssh_curve25519.cpp.

Referenced by ssh_x25519().

◆ ssh_gf_sub()

void ssh_gf_sub	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a - b (unreduced)

Definition at line 62 of file ssh_curve25519.cpp.

Referenced by ssh_x25519().

◆ ssh_gf_mul()

void ssh_gf_mul	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a * b mod p

Definition at line 166 of file ssh_curve25519.cpp.

Referenced by ssh_gf_sq(), and ssh_x25519().

◆ ssh_gf_sq()

void ssh_gf_sq	(	ssh_gf	out,
		const ssh_gf	a
	)

out = a^2 mod p

Definition at line 191 of file ssh_curve25519.cpp.

References ssh_gf_mul().

Referenced by ssh_x25519().

◆ ssh_gf_inv()

void ssh_gf_inv	(	ssh_gf	out,
		const ssh_gf	a
	)

out = a^-1 mod p (= a^(p-2))

Definition at line 228 of file ssh_curve25519.cpp.

References ssh_gf_pack(), and ssh_gf_unpack().

Referenced by ssh_x25519().

◆ ssh_gf_cswap()

void ssh_gf_cswap	(	ssh_gf	p,
		ssh_gf	q,
		int	b
	)

constant-time conditional swap of p,q when b==1

Definition at line 268 of file ssh_curve25519.cpp.

Referenced by ssh_gf_pack(), and ssh_x25519().

◆ ssh_gf_pack()

void ssh_gf_pack	(	uint8_t	out[32],
		const ssh_gf	a
	)

canonical little-endian 32-byte encoding

Definition at line 281 of file ssh_curve25519.cpp.

References ssh_gf_copy(), and ssh_gf_cswap().

Referenced by ssh_gf_inv(), and ssh_x25519().

◆ ssh_gf_unpack()

void ssh_gf_unpack	(	ssh_gf	out,
		const uint8_t	in[32]
	)

decode 32 bytes (high bit ignored)

Definition at line 310 of file ssh_curve25519.cpp.

Referenced by ssh_gf_inv(), and ssh_x25519().

◆ ssh_x25519()

void ssh_x25519	(	uint8_t	out[32],
		const uint8_t	scalar[32],
		const uint8_t	point[32]
	)

X25519 scalar multiplication: out = scalar * point (RFC 7748 §5).

scalar and point are 32-byte little-endian; the scalar is clamped internally. out may alias neither input. Constant-time in the scalar (Montgomery ladder with conditional swaps).

Definition at line 394 of file ssh_curve25519.cpp.

References ssh_gf_add(), ssh_gf_cswap(), ssh_gf_inv(), ssh_gf_mul(), ssh_gf_pack(), ssh_gf_sq(), ssh_gf_sub(), and ssh_gf_unpack().

Referenced by ssh_kexdh_handle(), and ssh_x25519_base().