Claude
3bd81097e1
The header scan (Captain Bob, 2026-11-10): 788 source files -- 351 with the
SL-1.0 header, 12 with the old name (docs/working/experiments, kept by
ruling), 31 under someone else's licence (tools/kconfig, Linux's, GPL-2.0:
kept), and 394 with none. Ruled: the SPDX form; capsules (.4th, .f18) and
proofs (.thy) left for a ruling of their own (mkcapsule's 64x16 block format,
content-addressed capsules).
253 files now begin
SPDX-License-Identifier: LicenseRef-Starship-1.0
Copyright (c) 2023-2026 Robert A. James
as a /* */ block (C, headers, assembly, linker scripts) or # lines (scripts,
Makefiles, Kconfig; below a shebang or a coding line); tools/mkcapsule.c,
which had the copyright line, gets the SPDX line only.
Not touched: docs/working/ (archive and old campaign material, as the
ruling kept the experiments); v4/system/post_cases.c (generated by
v4/tools/mkpost.py, "do not edit" -- the generator has the header).
Comments only: the kernel builds on amd64, aarch64, riscv64; make -C v4
test-32: 39 programs, 0 failures; every changed script parses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
51 lines
2.3 KiB
C
51 lines
2.3 KiB
C
/* SPDX-License-Identifier: LicenseRef-Starship-1.0
|
|
* Copyright (c) 2023-2026 Robert A. James
|
|
*/
|
|
/* ed25519.h -- EdDSA (RFC 8032), freestanding C99.
|
|
*
|
|
* Originally verify-only ("this kernel never signs; signing happens in
|
|
* the host-side build tool") -- that was correct for capsule signing
|
|
* (build-time, offline, a normal Linux binary can link libsodium/
|
|
* OpenSSL) but conflicts with an on-device Zuse session minting new
|
|
* user certs live at runtime, which requires the kernel itself to sign.
|
|
* Decided (Phase 8, 2026-08-26): add real keygen/signing rather than
|
|
* reshape that flow around verify-only. Entropy for keygen comes from
|
|
* virtio_rng.h -- this header still has no RNG of its own, and takes a
|
|
* caller-supplied seed rather than generating one, deliberately: keygen
|
|
* has no business deciding how the seed's randomness quality is
|
|
* guaranteed, that's the caller's job.
|
|
*
|
|
* Signing is NOT constant-time (same non-constant-time double-and-add
|
|
* scalar_mult() verify already used) -- acceptable for this project's
|
|
* actual threat model (an emulated/embedded kernel with no untrusted
|
|
* co-tenant able to observe timing), not acceptable if this code is
|
|
* ever reused somewhere with a real timing-attack surface.
|
|
*/
|
|
#ifndef ED25519_H
|
|
#define ED25519_H
|
|
|
|
#include <stdint.h>
|
|
#include <stddef.h>
|
|
|
|
/* Returns 1 if signature (64 bytes: R || S) is a valid Ed25519 signature
|
|
* by pubkey (32 bytes, compressed point) over msg, else 0. Rejects
|
|
* malformed inputs (S >= L, an undecodable point) as invalid rather than
|
|
* faulting. */
|
|
int ed25519_verify(const uint8_t pubkey[32], const uint8_t *msg, size_t msg_len,
|
|
const uint8_t sig[64]);
|
|
|
|
/* Derive the public key (compressed point A = [a]B) from a 32-byte
|
|
* seed. seed must be real, uniformly random entropy -- see this file's
|
|
* header comment; ed25519_keygen() does not check or generate it. */
|
|
void ed25519_keygen(const uint8_t seed[32], uint8_t pubkey_out[32]);
|
|
|
|
/* Sign msg with the keypair derived from seed (the same seed passed to
|
|
* ed25519_keygen() to obtain the matching public key). Deterministic
|
|
* per RFC 8032 (the nonce is derived from seed + message, not fresh
|
|
* randomness at sign time) -- only keygen needs real entropy, signing
|
|
* needs none. */
|
|
void ed25519_sign(const uint8_t seed[32], const uint8_t *msg, size_t msg_len,
|
|
uint8_t sig_out[64]);
|
|
|
|
#endif /* ED25519_H */
|