1 /*************************************************************************
2 * Written in 2024 by Sebastian Falbesoner *
3 * To the extent possible under law, the author(s) have dedicated all *
4 * copyright and related and neighboring rights to the software in this *
5 * file to the public domain worldwide. This software is distributed *
6 * without any warranty. For the CC0 Public Domain Dedication, see *
7 * EXAMPLES_COPYING or https://creativecommons.org/publicdomain/zero/1.0 *
8 *************************************************************************/
9 10 /** This file demonstrates how to use the ElligatorSwift module to perform
11 * a key exchange according to BIP 324. Additionally, see the documentation
12 * in include/secp256k1_ellswift.h and doc/ellswift.md.
13 */
14 15 #include <stdio.h>
16 #include <assert.h>
17 #include <string.h>
18 19 #include <secp256k1.h>
20 #include <secp256k1_ellswift.h>
21 22 #include "examples_util.h"
23 24 int main(void) {
25 secp256k1_context* ctx;
26 unsigned char randomize[32];
27 unsigned char auxrand1[32];
28 unsigned char auxrand2[32];
29 unsigned char seckey1[32];
30 unsigned char seckey2[32];
31 unsigned char ellswift_pubkey1[64];
32 unsigned char ellswift_pubkey2[64];
33 unsigned char shared_secret1[32];
34 unsigned char shared_secret2[32];
35 int return_val;
36 37 /* Create a secp256k1 context */
38 ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
39 if (!fill_random(randomize, sizeof(randomize))) {
40 printf("Failed to generate randomness\n");
41 return 1;
42 }
43 /* Randomizing the context is recommended to protect against side-channel
44 * leakage. See `secp256k1_context_randomize` in secp256k1.h for more
45 * information about it. This should never fail. */
46 return_val = secp256k1_context_randomize(ctx, randomize);
47 assert(return_val);
48 49 /*** Generate secret keys ***/
50 if (!fill_random(seckey1, sizeof(seckey1)) || !fill_random(seckey2, sizeof(seckey2))) {
51 printf("Failed to generate randomness\n");
52 return 1;
53 }
54 /* If the secret key is zero or out of range (greater than secp256k1's
55 * order), we fail. Note that the probability of this occurring is negligible
56 * with a properly functioning random number generator. */
57 if (!secp256k1_ec_seckey_verify(ctx, seckey1) || !secp256k1_ec_seckey_verify(ctx, seckey2)) {
58 printf("Generated secret key is invalid. This indicates an issue with the random number generator.\n");
59 return 1;
60 }
61 62 /* Generate ElligatorSwift public keys. This should never fail with valid context and
63 verified secret keys. Note that providing additional randomness (fourth parameter) is
64 optional, but recommended. */
65 if (!fill_random(auxrand1, sizeof(auxrand1)) || !fill_random(auxrand2, sizeof(auxrand2))) {
66 printf("Failed to generate randomness\n");
67 return 1;
68 }
69 return_val = secp256k1_ellswift_create(ctx, ellswift_pubkey1, seckey1, auxrand1);
70 assert(return_val);
71 return_val = secp256k1_ellswift_create(ctx, ellswift_pubkey2, seckey2, auxrand2);
72 assert(return_val);
73 74 /*** Create the shared secret on each side ***/
75 76 /* Perform x-only ECDH with seckey1 and ellswift_pubkey2. Should never fail
77 * with a verified seckey and valid pubkey. Note that both parties pass both
78 * EllSwift pubkeys in the same order; the pubkey of the calling party is
79 * determined by the "party" boolean (sixth parameter). */
80 return_val = secp256k1_ellswift_xdh(ctx, shared_secret1, ellswift_pubkey1, ellswift_pubkey2,
81 seckey1, 0, secp256k1_ellswift_xdh_hash_function_bip324, NULL);
82 assert(return_val);
83 84 /* Perform x-only ECDH with seckey2 and ellswift_pubkey1. Should never fail
85 * with a verified seckey and valid pubkey. */
86 return_val = secp256k1_ellswift_xdh(ctx, shared_secret2, ellswift_pubkey1, ellswift_pubkey2,
87 seckey2, 1, secp256k1_ellswift_xdh_hash_function_bip324, NULL);
88 assert(return_val);
89 90 /* Both parties should end up with the same shared secret */
91 return_val = memcmp(shared_secret1, shared_secret2, sizeof(shared_secret1));
92 assert(return_val == 0);
93 94 printf( " Secret Key1: ");
95 print_hex(seckey1, sizeof(seckey1));
96 printf( "EllSwift Pubkey1: ");
97 print_hex(ellswift_pubkey1, sizeof(ellswift_pubkey1));
98 printf("\n Secret Key2: ");
99 print_hex(seckey2, sizeof(seckey2));
100 printf( "EllSwift Pubkey2: ");
101 print_hex(ellswift_pubkey2, sizeof(ellswift_pubkey2));
102 printf("\n Shared Secret: ");
103 print_hex(shared_secret1, sizeof(shared_secret1));
104 105 /* This will clear everything from the context and free the memory */
106 secp256k1_context_destroy(ctx);
107 108 /* It's best practice to try to clear secrets from memory after using them.
109 * This is done because some bugs can allow an attacker to leak memory, for
110 * example through "out of bounds" array access (see Heartbleed), or the OS
111 * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
112 *
113 * Here we are preventing these writes from being optimized out, as any good compiler
114 * will remove any writes that aren't used. */
115 secure_erase(seckey1, sizeof(seckey1));
116 secure_erase(seckey2, sizeof(seckey2));
117 secure_erase(shared_secret1, sizeof(shared_secret1));
118 secure_erase(shared_secret2, sizeof(shared_secret2));
119 120 return 0;
121 }
122