MONOREPO MERGE trezor-crypto

.gitmodules

@@ -23,3 +23,6 @@
 [submodule "common/defs/ethereum/tokens"]
 	path = common/defs/ethereum/tokens
 	url = https://github.com/ethereum-lists/tokens.git
+[submodule "crypto/tests/wycheproof"]
+	path = crypto/tests/wycheproof
+	url = https://github.com/google/wycheproof

crypto/.clang-format

@@ -0,0 +1,2 @@
+---
+BasedOnStyle:  Google

crypto/.gitignore

@@ -0,0 +1,14 @@
+.cache/
+.vscode/
+_attic/
+*.o
+*.d
+*.exe
+*~
+tests/aestst
+tests/test_openssl
+tests/test_speed
+tests/test_check
+tests/libtrezor-crypto.so
+*.os
+*.pyc

crypto/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "tests/wycheproof"]
+	path = tests/wycheproof
+	url = https://github.com/google/wycheproof

crypto/.travis.yml

@@ -0,0 +1,38 @@
+sudo: false
+dist: trusty
+language: c
+
+compiler:
+  - clang
+  - gcc
+
+addons:
+  apt:
+    packages:
+    - check
+    - libssl-dev
+    - python3-pip
+    - valgrind
+
+env:
+  global:
+    - PYTHON=python3
+
+install:
+  - $PYTHON -m pip install --user pytest ecdsa curve25519-donna pyasn1
+
+script:
+  - make
+  - ./tests/aestst
+  - ./tests/test_check
+  - CK_TIMEOUT_MULTIPLIER=20 valgrind -q --error-exitcode=1 ./tests/test_check
+  - ./tests/test_openssl 1000
+  - ITERS=10 $PYTHON -m pytest tests/
+
+notifications:
+  webhooks:
+    urls:
+      - http://ci-bot.satoshilabs.com:5000/travis
+    on_success: always
+    on_failure: always
+    on_start: always

crypto/AUTHORS

@@ -0,0 +1,2 @@
+Tomas Dzetkulic <[email protected]>
+Pavol Rusnak <[email protected]>

crypto/CONTRIBUTORS

@@ -0,0 +1,15 @@
+Tomas Dzetkulic <[email protected]>
+Pavol Rusnak <[email protected]>
+Jochen Hoenicke <[email protected]>
+Dustin Laurence <[email protected]>
+Ondrej Mikle <[email protected]>
+Roman Zeyde <[email protected]>
+Alex Beregszaszi <[email protected]>
+netanelkl <[email protected]>
+Jan Pochyla <[email protected]>
+Ondrej Mikle <[email protected]>
+Josh Billings <[email protected]>
+Adam Mackler <[email protected]>
+Oleg Andreev <[email protected]>
+mog <[email protected]>
+John Dvorak <[email protected]>

crypto/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2013 Tomas Dzetkulic
+Copyright (c) 2013 Pavol Rusnak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crypto/Makefile

@@ -0,0 +1,110 @@
+CC       ?= gcc
+
+OPTFLAGS ?= -O3 -g
+
+CFLAGS   += $(OPTFLAGS) \
+            -std=gnu99 \
+            -W \
+            -Wall \
+            -Wextra \
+            -Wimplicit-function-declaration \
+            -Wredundant-decls \
+            -Wstrict-prototypes \
+            -Wundef \
+            -Wshadow \
+            -Wpointer-arith \
+            -Wformat \
+            -Wreturn-type \
+            -Wsign-compare \
+            -Wmultichar \
+            -Wformat-nonliteral \
+            -Winit-self \
+            -Wuninitialized \
+            -Wformat-security \
+            -Werror
+
+VALGRIND ?= 1
+
+CFLAGS += -I.
+CFLAGS += -DVALGRIND=$(VALGRIND)
+CFLAGS += -DUSE_ETHEREUM=1
+CFLAGS += -DUSE_GRAPHENE=1
+CFLAGS += -DUSE_KECCAK=1
+CFLAGS += -DUSE_MONERO=1
+CFLAGS += -DUSE_NEM=1
+CFLAGS += -DUSE_CARDANO=1
+CFLAGS += $(shell pkg-config --cflags openssl)
+
+# disable certain optimizations and features when small footprint is required
+ifdef SMALL
+CFLAGS += -DUSE_PRECOMPUTED_CP=0
+endif
+
+SRCS   = bignum.c ecdsa.c curves.c secp256k1.c nist256p1.c rand.c hmac.c bip32.c bip39.c pbkdf2.c base58.c base32.c
+SRCS  += address.c
+SRCS  += script.c
+SRCS  += ripemd160.c
+SRCS  += sha2.c
+SRCS  += sha3.c
+SRCS  += hasher.c
+SRCS  += aes/aescrypt.c aes/aeskey.c aes/aestab.c aes/aes_modes.c
+SRCS  += ed25519-donna/curve25519-donna-32bit.c ed25519-donna/curve25519-donna-helpers.c ed25519-donna/modm-donna-32bit.c
+SRCS  += ed25519-donna/ed25519-donna-basepoint-table.c ed25519-donna/ed25519-donna-32bit-tables.c ed25519-donna/ed25519-donna-impl-base.c
+SRCS  += ed25519-donna/ed25519.c ed25519-donna/curve25519-donna-scalarmult-base.c ed25519-donna/ed25519-sha3.c ed25519-donna/ed25519-keccak.c
+SRCS  += monero/base58.c
+SRCS  += monero/serialize.c
+SRCS  += monero/xmr.c
+SRCS  += monero/range_proof.c
+SRCS  += blake256.c
+SRCS  += blake2b.c blake2s.c
+SRCS  += groestl.c
+SRCS  += chacha20poly1305/chacha20poly1305.c chacha20poly1305/chacha_merged.c chacha20poly1305/poly1305-donna.c chacha20poly1305/rfc7539.c
+SRCS  += rc4.c
+SRCS  += nem.c
+SRCS  += segwit_addr.c cash_addr.c
+SRCS  += memzero.c
+
+OBJS   = $(SRCS:.c=.o)
+
+TESTLIBS = $(shell pkg-config --libs check) -lpthread -lm
+TESTSSLLIBS = $(shell pkg-config --libs openssl)
+
+all: tools tests
+
+%.o: %.c %.h options.h
+	$(CC) $(CFLAGS) -o $@ -c $<
+
+tests: tests/test_check tests/test_openssl tests/test_speed tests/libtrezor-crypto.so tests/aestst
+
+tests/aestst: aes/aestst.o aes/aescrypt.o aes/aeskey.o aes/aestab.o
+	$(CC) $^ -o $@
+
+tests/test_check.o: tests/test_check_cardano.h tests/test_check_monero.h tests/test_check_cashaddr.h tests/test_check_segwit.h
+
+tests/test_check: tests/test_check.o $(OBJS)
+	$(CC) tests/test_check.o $(OBJS) $(TESTLIBS) -o tests/test_check
+
+tests/test_speed: tests/test_speed.o $(OBJS)
+	$(CC) tests/test_speed.o $(OBJS) -o tests/test_speed
+
+tests/test_openssl: tests/test_openssl.o $(OBJS)
+	$(CC) tests/test_openssl.o $(OBJS) $(TESTSSLLIBS) -o tests/test_openssl
+
+tests/libtrezor-crypto.so: $(SRCS)
+	$(CC) $(CFLAGS) -DAES_128 -DAES_192 -fPIC -shared $(SRCS) -o tests/libtrezor-crypto.so
+
+tools: tools/xpubaddrgen tools/mktable tools/bip39bruteforce
+
+tools/xpubaddrgen: tools/xpubaddrgen.o $(OBJS)
+	$(CC) tools/xpubaddrgen.o $(OBJS) -o tools/xpubaddrgen
+
+tools/mktable: tools/mktable.o $(OBJS)
+	$(CC) tools/mktable.o $(OBJS) -o tools/mktable
+
+tools/bip39bruteforce: tools/bip39bruteforce.o $(OBJS)
+	$(CC) tools/bip39bruteforce.o $(OBJS) -o tools/bip39bruteforce
+
+clean:
+	rm -f *.o aes/*.o chacha20poly1305/*.o ed25519-donna/*.o
+	rm -f tests/test_check tests/test_speed tests/test_openssl tests/libtrezor-crypto.so tests/aestst
+	rm -f tools/*.o tools/xpubaddrgen tools/mktable tools/bip39bruteforce

crypto/README.md

@@ -0,0 +1,44 @@
+# trezor-crypto
+
+[![Build Status](https://travis-ci.org/trezor/trezor-crypto.svg?branch=master)](https://travis-ci.org/trezor/trezor-crypto) [![gitter](https://badges.gitter.im/trezor/community.svg)](https://gitter.im/trezor/community)
+
+Heavily optimized cryptography algorithms for embedded devices.
+
+These include:
+- AES/Rijndael encryption/decryption
+- Big Number (256 bit) Arithmetics
+- BIP32 Hierarchical Deterministic Wallets
+- BIP39 Mnemonic code
+- ECDSA signing/verifying (supports secp256k1 and nist256p1 curves,
+  uses RFC6979 for deterministic signatures)
+- ECDSA public key derivation
+- Base32 (RFC4648 and custom alphabets)
+- Base58 address representation
+- Ed25519 signing/verifying (also SHA3 and Keccak variants)
+- ECDH using secp256k1, nist256p1 and Curve25519
+- HMAC-SHA256 and HMAC-SHA512
+- PBKDF2
+- RIPEMD-160
+- SHA1
+- SHA2-256/SHA2-512
+- SHA3/Keccak
+- BLAKE2s/BLAKE2b
+- Chacha20-Poly1305
+- unit tests (using Check - check.sf.net; in test_check.c)
+- tests against OpenSSL (in test_openssl.c)
+- integrated Wycheproof tests
+
+Distibuted under MIT License.
+
+## Some parts of the library come from external sources:
+
+- AES: https://github.com/BrianGladman/aes
+- Base58: https://github.com/luke-jr/libbase58
+- BLAKE2s/BLAKE2b: https://github.com/BLAKE2/BLAKE2
+- RIPEMD-160: https://github.com/ARMmbed/mbedtls
+- SHA1/SHA2: http://www.aarongifford.com/computers/sha.html
+- SHA3: https://github.com/rhash/RHash
+- Curve25519: https://github.com/agl/curve25519-donna
+- Ed25519: https://github.com/floodyberry/ed25519-donna
+- Chacha20: https://github.com/wg/c20p1305
+- Poly1305: https://github.com/floodyberry/poly1305-donna

crypto/address.c

@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) 2016 Daira Hopwood
+ * Copyright (c) 2016 Pavol Rusnak
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "address.h"
+#include "bignum.h"
+
+size_t address_prefix_bytes_len(uint32_t address_type) {
+  if (address_type <= 0xFF) return 1;
+  if (address_type <= 0xFFFF) return 2;
+  if (address_type <= 0xFFFFFF) return 3;
+  return 4;
+}
+
+void address_write_prefix_bytes(uint32_t address_type, uint8_t *out) {
+  if (address_type > 0xFFFFFF) *(out++) = address_type >> 24;
+  if (address_type > 0xFFFF) *(out++) = (address_type >> 16) & 0xFF;
+  if (address_type > 0xFF) *(out++) = (address_type >> 8) & 0xFF;
+  *(out++) = address_type & 0xFF;
+}
+
+bool address_check_prefix(const uint8_t *addr, uint32_t address_type) {
+  if (address_type <= 0xFF) {
+    return address_type == (uint32_t)(addr[0]);
+  }
+  if (address_type <= 0xFFFF) {
+    return address_type == (((uint32_t)addr[0] << 8) | ((uint32_t)addr[1]));
+  }
+  if (address_type <= 0xFFFFFF) {
+    return address_type == (((uint32_t)addr[0] << 16) |
+                            ((uint32_t)addr[1] << 8) | ((uint32_t)addr[2]));
+  }
+  return address_type ==
+         (((uint32_t)addr[0] << 24) | ((uint32_t)addr[1] << 16) |
+          ((uint32_t)addr[2] << 8) | ((uint32_t)addr[3]));
+}
+
+#if USE_ETHEREUM
+#include "sha3.h"
+
+void ethereum_address_checksum(const uint8_t *addr, char *address, bool rskip60,
+                               uint32_t chain_id) {
+  const char *hex = "0123456789abcdef";
+  for (int i = 0; i < 20; i++) {
+    address[i * 2] = hex[(addr[i] >> 4) & 0xF];
+    address[i * 2 + 1] = hex[addr[i] & 0xF];
+  }
+  address[40] = 0;
+
+  SHA3_CTX ctx;
+  uint8_t hash[32];
+  keccak_256_Init(&ctx);
+  if (rskip60) {
+    char prefix[16];
+    int prefix_size = bn_format_uint64(chain_id, NULL, "0x", 0, 0, false,
+                                       prefix, sizeof(prefix));
+    keccak_Update(&ctx, (const uint8_t *)prefix, prefix_size);
+  }
+  keccak_Update(&ctx, (const uint8_t *)address, 40);
+  keccak_Final(&ctx, hash);
+
+  for (int i = 0; i < 20; i++) {
+    if (hash[i] & 0x80 && address[i * 2] >= 'a' && address[i * 2] <= 'f') {
+      address[i * 2] -= 0x20;
+    }
+    if (hash[i] & 0x08 && address[i * 2 + 1] >= 'a' &&
+        address[i * 2 + 1] <= 'f') {
+      address[i * 2 + 1] -= 0x20;
+    }
+  }
+}
+#endif

crypto/address.h

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2016 Daira Hopwood
+ * Copyright (c) 2016 Pavol Rusnak
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+ * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __ADDRESS_H__
+#define __ADDRESS_H__
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include "options.h"
+
+size_t address_prefix_bytes_len(uint32_t address_type);
+void address_write_prefix_bytes(uint32_t address_type, uint8_t *out);
+bool address_check_prefix(const uint8_t *addr, uint32_t address_type);
+#if USE_ETHEREUM
+void ethereum_address_checksum(const uint8_t *addr, char *address, bool rskip60,
+                               uint32_t chain_id);
+#endif
+
+#endif