Add Curve25519 based on curve25519-donna by Adam Langley.

This uses only the c64 version from curve25519-donna; on systems that
don't have a native uint128_t type, a donna128 type stands in for just
enough 128-bit operations to satisfy donna.cpp

4 files changed, 137 insertions, 0 deletions

diff --git a/src/tests/data/pubkey/c25519_scalar.vec b/src/tests/data/pubkey/c25519_scalar.vec
new file mode 100644
index 000000000..0b8f7e72b
--- /dev/null
+++ b/src/tests/data/pubkey/c25519_scalar.vec
@@ -0,0 +1,79 @@
+
+# scalarmult1 from libsodium
+Secret    = 77076D0A7318A57D3C16C17251B26645DF4C2F87EBC0992AB177FBA51DB92C2A
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out       = 8520F0098930A754748B7DDCB43EF75A0DBF3A0D26381AF4EBA4A98EAA9B4E6A
+
+# scalarmult2
+Secret = 5DAB087E624A8A4B79E17F8B83800EE66F3BB1292618B6FD1C2F8B27FF88E0EB
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = DE9EDB7D7B7DC1B4D35B61C2ECE435373F8343C85B78674DADFC7E146F882B4F
+
+# scalarmult5
+Secret = 77076D0A7318A57D3C16C17251B26645DF4C2F87EBC0992AB177FBA51DB92C2A
+Basepoint = DE9EDB7D7B7DC1B4D35B61C2ECE435373F8343C85B78674DADFC7E146F882B4F
+Out = 4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
+
+# scalarmult6
+Secret = 5DAB087E624A8A4B79E17F8B83800EE66F3BB1292618B6FD1C2F8B27FF88E0EB
+Basepoint = 8520F0098930A754748B7DDCB43EF75A0DBF3A0D26381AF4EBA4A98EAA9B4E6A
+Out = 4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
+
+# test-noncanon from donna
+Secret = 0100000000000000000000000000000000000000000000000000000000000000
+Basepoint = 2500000000000000000000000000000000000000000000000000000000000000
+Out = 3C7777CAF997B264416077665B4E229D0B9548DC0CD81998DDCDC5C8533C797F
+
+Secret    = 0100000000000000000000000000000000000000000000000000000000000000
+Basepoint = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
+Out = B32D1362C248D62FE62619CFF04DD43DB73FFC1B6308EDE30B78D87380F1E834
+
+# Following values generated at random by curve25519-donna
+
+Secret = D55FF01DA1262795A4E50E607F87B80DCCD447A6EE0F6CD8D25177F79575744D
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = D5BDC7055ABA7855692CC861009E3AE6B6339329826B11F8B92E5ADAEB85335E
+
+Secret = 0224D9367436089D81B1150DFC748EC851F9A41389E21C8C1181E01BA1760C23
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = AD7E1E41C6AC0544F949EB76D71C75120ADD345C44384BDD830974D2DD329644
+
+Secret = D55FF01DA1262795A4E50E607F87B80DCCD447A6EE0F6CD8D25177F79575744D
+Basepoint = AD7E1E41C6AC0544F949EB76D71C75120ADD345C44384BDD830974D2DD329644
+Out = FC343E1965225D8666F4AE8E70E04039D21C603F7CE7F17C0CC8440C62C03575
+
+Secret = 0224D9367436089D81B1150DFC748EC851F9A41389E21C8C1181E01BA1760C23
+Basepoint = D5BDC7055ABA7855692CC861009E3AE6B6339329826B11F8B92E5ADAEB85335E
+Out = FC343E1965225D8666F4AE8E70E04039D21C603F7CE7F17C0CC8440C62C03575
+
+Secret = 65A06F749B010EA5738CDEBE3EF65F38C17A13F8CCC5B0AE51B5091D845C6DEB
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = B84AEDDA6C2CD17CCB62D94E3238E7093BA77D15BE4C563D1B11EA3C2EECA87F
+
+Secret = 92B158501611EF8521C101E28629130427B42D2DA65E9EC9387B94BC2F08B806
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = 06479EC3C771D635F54787DEA334149E07E20957127C816E3059258428C17970
+
+Secret = 65A06F749B010EA5738CDEBE3EF65F38C17A13F8CCC5B0AE51B5091D845C6DEB
+Basepoint = 06479EC3C771D635F54787DEA334149E07E20957127C816E3059258428C17970
+Out = 47C69389596EA49AEE14F4259250808385C37F4EBBD6AA176779BFEB8042D834
+
+Secret = 92B158501611EF8521C101E28629130427B42D2DA65E9EC9387B94BC2F08B806
+Basepoint = B84AEDDA6C2CD17CCB62D94E3238E7093BA77D15BE4C563D1B11EA3C2EECA87F
+Out = 47C69389596EA49AEE14F4259250808385C37F4EBBD6AA176779BFEB8042D834
+
+Secret = 2D7B885AA77351153994425725F35AFB84D9729DECA3D9D832570569C973566E
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = 93928FCC20DFEA2AF6CA8B1268192B68D87FDA744FD67FCFAEF84165C504597C
+
+Secret = E3B07D96E4B5F3D265ACFE950707B62B053F2FD5CCF20D662F62AB09ED2AC325
+Basepoint = 0900000000000000000000000000000000000000000000000000000000000000
+Out = 68B7894FF03386C8C1907847866CD771519163D002FA7C3360650186A22F7263
+
+Secret = 2D7B885AA77351153994425725F35AFB84D9729DECA3D9D832570569C973566E
+Basepoint = 68B7894FF03386C8C1907847866CD771519163D002FA7C3360650186A22F7263
+Out = 0BE4BB615F362A21A28A404631F6832DD1019A7145C020031614D8B6F697983A
+
+Secret = E3B07D96E4B5F3D265ACFE950707B62B053F2FD5CCF20D662F62AB09ED2AC325
+Basepoint = 93928FCC20DFEA2AF6CA8B1268192B68D87FDA744FD67FCFAEF84165C504597C
+Out = 0BE4BB615F362A21A28A404631F6832DD1019A7145C020031614D8B6F697983A
diff --git a/src/tests/test_c25519.cpp b/src/tests/test_c25519.cpp
new file mode 100644
index 000000000..cb03ebf69
--- /dev/null
+++ b/src/tests/test_c25519.cpp
@@ -0,0 +1,56 @@
+#include "tests.h"
+#include "test_pubkey.h"
+
+#if defined(BOTAN_HAS_CURVE_25519)
+#include <botan/curve25519.h>
+#include <botan/hex.h>
+#include <iostream>
+#include <fstream>
+#endif
+
+using namespace Botan;
+
+#if defined(BOTAN_HAS_CURVE_25519)
+
+namespace {
+
+size_t curve25519_scalar_kat(const std::string& secret_h,
+                             const std::string& basepoint_h,
+                             const std::string& out_h)
+   {
+   const std::vector<byte> secret = hex_decode(secret_h);
+   const std::vector<byte> basepoint = hex_decode(basepoint_h);
+   const std::vector<byte> out = hex_decode(out_h);
+
+   std::vector<byte> got(32);
+   curve25519_donna(&got[0], &secret[0], &basepoint[0]);
+
+   if(got != out)
+      {
+      std::cout << "Got " << hex_encode(got) << " exp " << hex_encode(out) << "\n";
+      return 1;
+      }
+
+   return 0;
+   }
+
+}
+#endif
+
+size_t test_curve25519()
+   {
+   size_t fails = 0;
+
+#if defined(BOTAN_HAS_CURVE_25519)
+   std::ifstream c25519_scalar(PK_TEST_DATA_DIR "/c25519_scalar.vec");
+
+   fails += run_tests_bb(c25519_scalar, "Curve25519 ScalarMult", "Out", true,
+             [](std::map<std::string, std::string> m) -> size_t
+             {
+             return curve25519_scalar_kat(m["Secret"], m["Basepoint"], m["Out"]);
+             });
+#endif
+
+   return fails;
+   }
+
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index 3ec904c02..99a4d8e3a 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -261,6 +261,7 @@ int main(int argc, char* argv[])
    DEF_TEST(ecc_pointmul);
    DEF_TEST(ecdsa);
    DEF_TEST(gost_3410);
+   DEF_TEST(curve25519);
    DEF_TEST(mceliece);
 
    DEF_TEST(ecc_unit);
diff --git a/src/tests/tests.h b/src/tests/tests.h
index d4ccf91c1..61cc405a0 100644
--- a/src/tests/tests.h
+++ b/src/tests/tests.h
@@ -67,6 +67,7 @@ size_t test_elgamal();
 size_t test_ecc_pointmul();
 size_t test_ecdsa();
 size_t test_gost_3410();
+size_t test_curve25519();
 size_t test_mceliece();
 
 // One off tests