fuzz-ed25519.c

#if defined(_WIN32)
	#include <windows.h>
	#include <wincrypt.h>
	typedef unsigned int uint32_t;
#else
	#include <stdint.h>
#endif

#include <string.h>
#include <stdio.h>

#include "ed25519-donna.h"
#include "ed25519-ref10.h"

static void
print_diff(const char *desc, const unsigned char *a, const unsigned char *b, size_t len) {
	size_t p = 0;
	unsigned char diff;
	printf("%s diff:\n", desc);
	while (len--) {
		diff = *a++ ^ *b++;
		if (!diff)
			printf("____,");
		else
			printf("0x%02x,", diff);
		if ((++p & 15) == 0)
			printf("\n");
	}
	printf("\n");
}

static void
print_bytes(const char *desc, const unsigned char *bytes, size_t len) {
	size_t p = 0;
	printf("%s:\n", desc);
	while (len--) {
		printf("0x%02x,", *bytes++);
		if ((++p & 15) == 0)
			printf("\n");
	}
	printf("\n");
}


/* chacha20/12 prng */
void
prng(unsigned char *out, size_t bytes) {
	static uint32_t state[16];
	static int init = 0;
	uint32_t x[16], t;
	size_t i;

	if (!init) {
	#if defined(_WIN32)
		HCRYPTPROV csp = NULL;
		if (!CryptAcquireContext(&csp, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) {
			printf("CryptAcquireContext failed\n");
			exit(1);
		}
		if (!CryptGenRandom(csp, (DWORD)sizeof(state), (BYTE*)state)) {
			printf("CryptGenRandom failed\n");
			exit(1);
		}
		CryptReleaseContext(csp, 0);
	#else
		FILE *f = NULL;
		f = fopen("/dev/urandom", "rb");
		if (!f) {
			printf("failed to open /dev/urandom\n");
			exit(1);
		}
		if (fread(state, sizeof(state), 1, f) != 1) {
			printf("read error on /dev/urandom\n");
			exit(1);
		}
	#endif
		init = 1;
	}

	while (bytes) {
		for (i = 0; i < 16; i++) x[i] = state[i];

		#define rotl32(x,k) ((x << k) | (x >> (32 - k)))
		#define quarter(a,b,c,d) \
			x[a] += x[b]; t = x[d]^x[a]; x[d] = rotl32(t,16); \
			x[c] += x[d]; t = x[b]^x[c]; x[b] = rotl32(t,12); \
			x[a] += x[b]; t = x[d]^x[a]; x[d] = rotl32(t, 8); \
			x[c] += x[d]; t = x[b]^x[c]; x[b] = rotl32(t, 7);

		for (i = 0; i < 12; i += 2) {
			quarter( 0, 4, 8,12)
			quarter( 1, 5, 9,13)
			quarter( 2, 6,10,14)
			quarter( 3, 7,11,15)
			quarter( 0, 5,10,15)
			quarter( 1, 6,11,12)
			quarter( 2, 7, 8,13)
			quarter( 3, 4, 9,14)
		};

		if (bytes <= 64) {
			memcpy(out, x, bytes);
			bytes = 0;
		} else {
			memcpy(out, x, 64);
			bytes -= 64;
			out += 64;
		}

		/* don't need a nonce, so last 4 words are the counter. 2^136 bytes can be generated */
		if (!++state[12]) if (!++state[13]) if (!++state[14]) ++state[15];
	}
}

typedef struct random_data_t {
	unsigned char sk[32];
	unsigned char m[128];
} random_data;

typedef struct generated_data_t {
	unsigned char pk[32];
	unsigned char sig[64];
	int valid;
} generated_data;

static void
print_generated(const char *desc, generated_data *g) {
	printf("%s:\n", desc);
	print_bytes("pk", g->pk, 32);
	print_bytes("sig", g->sig, 64);
	printf("valid: %s\n\n", g->valid ? "no" : "yes");
}

static void
print_generated_diff(const char *desc, const generated_data *base, generated_data *g) {
	printf("%s:\n", desc);
	print_diff("pk", base->pk, g->pk, 32);
	print_diff("sig", base->sig, g->sig, 64);
	printf("valid: %s\n\n", (base->valid == g->valid) ? "___" : (g->valid ? "no" : "yes"));
}

int main() {
	const size_t rndmax = 128;
	static random_data rnd[128];
	static generated_data gen[3];
	random_data *r;
	generated_data *g;
	unsigned long long dummylen;
	unsigned char dummysk[64];
	unsigned char dummymsg[2][128+64];
	size_t rndi, geni, i, j;
	uint64_t ctr;

	printf("fuzzing: ");
	printf(" ref10");
	printf(" ed25519-donna");
#if defined(ED25519_SSE2)
	printf(" ed25519-donna-sse2");
#endif
	printf("\n\n");

	for (ctr = 0, rndi = rndmax;;ctr++) {
		if (rndi == rndmax) {
			prng((unsigned char *)rnd, sizeof(rnd));
			rndi = 0;
		}
		r = &rnd[rndi++];

		/* ref10, lots of horrible gymnastics to work around the wonky api */
		geni = 0;
		g = &gen[geni++];
		memcpy(dummysk, r->sk, 32); /* pk is appended to the sk, need to copy the sk to a larger buffer */
		crypto_sign_pk_ref10(dummysk + 32, dummysk);
		memcpy(g->pk, dummysk + 32, 32); 
		crypto_sign_ref10(dummymsg[0], &dummylen, r->m, 128, dummysk);
		memcpy(g->sig, dummymsg[0], 64); /* sig is placed in front of the signed message */
		g->valid = crypto_sign_open_ref10(dummymsg[1], &dummylen, dummymsg[0], 128 + 64, g->pk);

		/* ed25519-donna */
		g = &gen[geni++];
		ed25519_publickey(r->sk, g->pk);
		ed25519_sign(r->m, 128, r->sk, g->pk, g->sig);
		g->valid = ed25519_sign_open(r->m, 128, g->pk, g->sig);

		#if defined(ED25519_SSE2)
			/* ed25519-donna-sse2 */
			g = &gen[geni++];
			ed25519_publickey_sse2(r->sk, g->pk);
			ed25519_sign_sse2(r->m, 128, r->sk, g->pk, g->sig);
			g->valid = ed25519_sign_open_sse2(r->m, 128, g->pk, g->sig);
		#endif

		/* compare implementations 1..geni against the reference */
		for (i = 1; i < geni; i++) {
			if (memcmp(&gen[0], &gen[i], sizeof(generated_data)) != 0) {
				printf("\n\n");
				print_bytes("sk", r->sk, 32);
				print_bytes("m", r->m, 128);
				print_generated("ref10", &gen[0]);
				print_generated_diff("ed25519-donna", &gen[0], &gen[1]);
				#if defined(ED25519_SSE2)
					print_generated_diff("ed25519-donna-sse2", &gen[0], &gen[2]);
				#endif
				exit(1);
			}
		}

		/* print out status */
		if (ctr && (ctr % 0x1000 == 0)) {
			printf(".");
			if ((ctr % 0x20000) == 0) {
				printf(" [");
				for (i = 0; i < 8; i++)
					printf("%02x", (unsigned char)(ctr >> ((7 - i) * 8)));
				printf("]\n");
			}
		}
	}
}