Git Product home page Git Product logo

jced25519's Introduction

JCEd25519

JCEd25519 is a JavaCard implementation of Ed25519 signature algorithm for smartcards that do not support Named Elliptic Curves and the EdDSA signature algorithm introduced in JavaCard API version 3.1.

The implementation uses (modified) JCMathLib library to perform necessary operations with elliptic curve points and modular arithmetic. In case SHA512 is not supported by a JavaCard, its software re-implementation is used.

⚠️ WARNING ⚠️

This implementation is only suited for proof-of-concept purposes and NOT for production use. The implementation relies on the JCMathLib library, that provides the underlying low-level operations, but not in constant time. An attacker observing signing time with sufficient precision may be able to use this information to extract the private key.

Usage

  • Clone this repository with submodules
git clone --recursive https://github.com/dufkan/JCEd25519
  • Configure your card type in JCEd25519.java file (currently are supported only SIMULATOR, J3R180, J2E145G)

  • Build the applet

./gradlew buildJavaCard  --info --rerun-tasks
  • Send initialize APDU 00DF000000 to the card. For example, using GlobalPlatform Pro
gp --apdu 00A404000C6A6365643235353139617070 --apdu 00DF000000 -d

Details

The optimizations in the implementation require the nonce to be generated randomly to be secure; otherwise, the implementation could be made to reuse nonce for signing of a different challenge. This is a minor deviation from Ed25519 specification, but it cannot be externally observed, unless multiple signatures of the same data are issued.

Supported Cards

The implementation was tested on NXP J3R200, NXP J3H145, NXP J2E145G, and Infineon Secora ID S.

jced25519's People

Contributors

dufkan avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

jced25519's Issues

Nonce Generation security and Signing performance

Hi @dufkan,

I am planning to integrate your implementation into our project for signing Cardano transactions as a proof-of-concept while we await the arrival of chips supporting Javacard 3.1 in the market.

To accomplish this, I intend to use deterministic nonce generation, based on the transaction hash (32 bytes) and the private key.

Question 1) Does the security "WARNING" mentioned in the README also apply to the deterministic nonce generation, or is it related solely to the random generation process?

Question 2) How long does it typically take to sign 32 bytes with offloading disabled? I attempted to run tests with J3R180 using two different card readers, but I encountered the error "No card terminal found".

Question 3) Which card reader do you recommend using?

Thank you for your excellent work on this project!

Key Generation doesn't work with JCIDE (javacardOS) simulator or with P71D600

The applet compiles and run in the JCIDE simulator. Initialization works well but when key generation is requested, the error F101 is received.

image

The code returns a cryptographic exception on the function setW on a ECPublic key

I tried with different javacard runtime (3.04, 3.05...) but the error remains:
(ILLEGAL VALUE)

The profile SIMULATOR is used, I tried changing some settings but error remain.

When the applet is loaded on a P71D600, it returns the same error.

Signature verification api

Hello. As far as I can see there are no signature verification api in this applet. I'm exploring possibilities for using smartcard for multiparty authentication schemes and want to add public key authentication to some of the methods. I.e. smartcard will hold its own private key and separate trusted public key and there will be sign method that will check that request is signed by stored public key.

I'm not a cryptography expert and I've looked to signature verification in other implementations and I'm not sure I can port them over there with enough confidence. Can you help me with this?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.