noise: store clamped key instead of raw key

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

4 files changed, 7 insertions, 14 deletions

diff --git a/src/crypto/zinc/curve25519/curve25519-fiat32.c b/src/crypto/zinc/curve25519/curve25519-fiat32.c
index 7f4f01c..42cfb6c 100644
--- a/src/crypto/zinc/curve25519/curve25519-fiat32.c
+++ b/src/crypto/zinc/curve25519/curve25519-fiat32.c
@@ -760,7 +760,7 @@ static void curve25519_generic(u8 out[CURVE25519_KEY_SIZE],
 	u8 e[32];
 
 	memcpy(e, scalar, 32);
-	clamp_secret(e);
+	curve25519_clamp_secret(e);
 
 	/* The following implementation was transcribed to Coq and proven to
 	 * correspond to unary scalar multiplication in affine coordinates given
diff --git a/src/crypto/zinc/curve25519/curve25519-hacl64.c b/src/crypto/zinc/curve25519/curve25519-hacl64.c
index ff22d3b..0f729ec 100644
--- a/src/crypto/zinc/curve25519/curve25519-hacl64.c
+++ b/src/crypto/zinc/curve25519/curve25519-hacl64.c
@@ -767,7 +767,7 @@ static void curve25519_generic(u8 mypublic[CURVE25519_KEY_SIZE],
 		u8 e[32] __aligned(32) = { 0 };
 		u8 *scalar;
 		memcpy(e, secret, 32);
-		clamp_secret(e);
+		curve25519_clamp_secret(e);
 		scalar = e;
 		{
 			u64 buf[15] = { 0 };
diff --git a/src/crypto/zinc/curve25519/curve25519-x86_64.c b/src/crypto/zinc/curve25519/curve25519-x86_64.c
index 81ef575..3d1806f 100644
--- a/src/crypto/zinc/curve25519/curve25519-x86_64.c
+++ b/src/crypto/zinc/curve25519/curve25519-x86_64.c
@@ -1975,7 +1975,7 @@ static void curve25519_adx(u8 shared[CURVE25519_KEY_SIZE],
 	memcpy(m.private, private_key, sizeof(m.private));
 	memcpy(m.session, session_key, sizeof(m.session));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	/* As in the draft:
 	 * When receiving such an array, implementations of curve25519
@@ -2072,7 +2072,7 @@ static void curve25519_adx_base(u8 session_key[CURVE25519_KEY_SIZE],
 
 	memcpy(m.private, private_key, sizeof(m.private));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	setzero_eltfp25519_1w(Ur1);
 	setzero_eltfp25519_1w(Zr1);
@@ -2170,7 +2170,7 @@ static void curve25519_bmi2(u8 shared[CURVE25519_KEY_SIZE],
 	memcpy(m.private, private_key, sizeof(m.private));
 	memcpy(m.session, session_key, sizeof(m.session));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	/* As in the draft:
 	 * When receiving such an array, implementations of curve25519
@@ -2267,7 +2267,7 @@ static void curve25519_bmi2_base(u8 session_key[CURVE25519_KEY_SIZE],
 
 	memcpy(m.private, private_key, sizeof(m.private));
 
-	clamp_secret(m.private);
+	curve25519_clamp_secret(m.private);
 
 	setzero_eltfp25519_1w(Ur1);
 	setzero_eltfp25519_1w(Zr1);
diff --git a/src/crypto/zinc/curve25519/curve25519.c b/src/crypto/zinc/curve25519/curve25519.c
index 6b3f12a..82c669e 100644
--- a/src/crypto/zinc/curve25519/curve25519.c
+++ b/src/crypto/zinc/curve25519/curve25519.c
@@ -20,13 +20,6 @@
 #include <linux/init.h>
 #include <crypto/algapi.h> // For crypto_memneq.
 
-static __always_inline void clamp_secret(u8 secret[CURVE25519_KEY_SIZE])
-{
-	secret[0] &= 248;
-	secret[31] &= 127;
-	secret[31] |= 64;
-}
-
 #if defined(CONFIG_ZINC_ARCH_X86_64)
 #include "curve25519-x86_64-glue.c"
 #elif defined(CONFIG_ZINC_ARCH_ARM)
@@ -84,7 +77,7 @@ EXPORT_SYMBOL(curve25519_generate_public);
 void curve25519_generate_secret(u8 secret[CURVE25519_KEY_SIZE])
 {
 	get_random_bytes_wait(secret, CURVE25519_KEY_SIZE);
-	clamp_secret(secret);
+	curve25519_clamp_secret(secret);
 }
 EXPORT_SYMBOL(curve25519_generate_secret);