1 files changed, 70 insertions, 17 deletions
diff --git a/ed448.c b/ed448.c
index 63a0dd6..96c78a9 100644
--- a/ed448.c
+++ b/ed448.c
@@ -5,27 +5,80 @@
 /* temporarily use getrandom() */
 #include <sys/random.h>
 
-/* sk and pk are both 57 bytes, sk is not followed by pk */
+/* Ed448, no prehash or context */
+const static unsigned char ed448_dom4[10] = {'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+
+/* pk is 57 bytes, sk is 114 bytes, sk is followed by pk */
 int crypto_sign_ed448_keypair(
     unsigned char *pk,
     unsigned char *sk)
 {
-    sc448 scsk;
-    ge448 gepk;
-    unsigned char extsk[114];
-    sha3_ctx_t ctx;
+  int i;
+  sc448 scsk;
+  ge448 gepk;
+  unsigned char extsk[114];
+  sha3_ctx_t ctx;
+
+  (void)getrandom(sk, 57, 0);
+  shake256_init(&ctx);
+  shake_update(&ctx, sk, 57);
+  shake_xof(&ctx);
+  shake_out(&ctx, extsk, 114);
+  extsk[56] = 0;
+  extsk[55] |= 0x80;
+  extsk[0] &= 0xFC;
 
-    (void)getrandom(sk, 57, 0);
-    shake256_init(&ctx);
-    shake_update(&ctx, sk, 57);
-    shake_xof(&ctx);
-    shake_out(&ctx, extsk, 114);
-    extsk[56] = 0;
-    extsk[55] |= 0x80;
-    extsk[0] &= 0xFC;
+  sc448_from57bytes(&scsk, extsk);
+  ge448_scalarmult_base(&gepk, &scsk);
+  ge448_pack(pk, &gepk);
+  for (i = 0; i < 57; i++)
+    sk[57 + i] = pk[i];
+  return 0;
+}
+
+/* detached method, sign is 114 bytes */
+int crypto_sign_ed448_detached(
+    unsigned char *sign, unsigned long long *smlen,
+    const unsigned char *m, unsigned long long mlen,
+    const unsigned char *sk)
+{
+  sc448 scsk, scr, sck;
+  ge448 ger;
+  unsigned char extsk[114];
+  unsigned char hashr[114];
+  sha3_ctx_t ctx;
 
-    sc448_from57bytes(&scsk, extsk);
-    ge448_scalarmult_base(&gepk, &scsk);
-    ge448_pack(pk, &gepk);
-    return 0;
+  if (smlen != NULL)
+  {
+    *smlen = 114;
+  }
+  shake256_init(&ctx);
+  shake_update(&ctx, sk, 57);
+  shake_xof(&ctx);
+  shake_out(&ctx, extsk, 114);
+  extsk[56] = 0;
+  extsk[55] |= 0x80;
+  extsk[0] &= 0xFC;
+  shake256_init(&ctx);
+  shake_update(&ctx, ed448_dom4, 10);
+  shake_update(&ctx, extsk + 57, 57);
+  shake_update(&ctx, m, mlen);
+  shake_xof(&ctx);
+  shake_out(&ctx, hashr, 114);
+  sc448_from114bytes(&scr, hashr);
+  ge448_scalarmult_base(&ger, &scr);
+  ge448_pack(sign, &ger); /* part1: R=r[B] */
+  shake256_init(&ctx);
+  shake_update(&ctx, ed448_dom4, 10);
+  shake_update(&ctx, sign, 57);
+  shake_update(&ctx, sk + 57, 57);
+  shake_update(&ctx, m, mlen);
+  shake_xof(&ctx);
+  shake_out(&ctx, hashr, 114);
+  sc448_from114bytes(&sck, hashr);
+  sc448_from57bytes(&scsk, extsk);
+  sc448_mul(&scsk, &scsk, &sck);
+  sc448_add(&scsk, &scsk, &scr);
+  sc448_to57bytes(sign + 57, &scsk); /* part2: S=r+s*k */
+  return 0;
 }