s/dangerous/dirty

Those functions are not that dangerous, and such a scary word
would send the wrong message.  The manual though will make clear
this is not for everyone

diff --git a/src/monocypher.c b/src/monocypher.c
index 3460b99cefc37e21f8932efff7b8b59413a4366c..0d656b5785caa9a23d2cfbf6d98adcdc01f87bb8 100644 (file)
--- a/src/monocypher.c
+++ b/src/monocypher.c
@@ -2235,9 +2235,9 @@ int crypto_check(const u8  signature[64],
     return crypto_check_final(actx);
 }
 
-/////////////////////////////////////////////////
-/// Dangerous ephemeral public key generation ///
-/////////////////////////////////////////////////
+/////////////////////////////////////////////
+/// Dirty ephemeral public key generation ///
+/////////////////////////////////////////////
 
 // Those functions generates a public key, *without* clearing the
 // cofactor.  Sending that key over the network leaks 3 bits of the
@@ -2295,7 +2295,7 @@ static void add_xl(u8 s[32], u8 x)
     }
 }
 
-// "Small" dangerous ephemeral key.
+// "Small" dirty ephemeral key.
 // Use if you need to shrink the size of the binary, and can tolerate a
 // slowdow by a factor of two (compared to the fast version)
 //
@@ -2306,14 +2306,14 @@ static void add_xl(u8 s[32], u8 x)
 //
 // Cofactor and main factor are combined into a single scalar, which is
 // then multiplied by a point of order 8*L (unlike the base point, which
-// has prime order).  That "dangerous" base point is the addition of the
+// has prime order).  That "dirty" base point is the addition of the
 // regular base point (9), and a point of order 8.
-void crypto_x25519_dangerous_small(u8 public_key[32], const u8 secret_key[32])
+void crypto_x25519_dirty_small(u8 public_key[32], const u8 secret_key[32])
 {
     // Base point of order 8*L
     // Raw scalar multiplication with it does not clear the cofactor,
     // and the resulting public key will reveal 3 bits of the scalar.
-    static const u8 dangerous_base_point[32] = {
+    static const u8 dirty_base_point[32] = {
         0x34, 0xfc, 0x6c, 0xb7, 0xc8, 0xde, 0x58, 0x97,
         0x77, 0x70, 0xd9, 0x52, 0x16, 0xcc, 0xdc, 0x6c,
         0x85, 0x90, 0xbe, 0xcd, 0x91, 0x9c, 0x07, 0x59,
@@ -2334,18 +2334,18 @@ void crypto_x25519_dangerous_small(u8 public_key[32], const u8 secret_key[32])
     //   combined = scalar + cofactor       (modulo 8*L)
     //   combined = scalar + (lsb * 5 * L)  (modulo 8*L)
     add_xl(scalar, secret_key[0] * 5);
-    scalarmult(public_key, scalar, dangerous_base_point, 256);
+    scalarmult(public_key, scalar, dirty_base_point, 256);
     WIPE_BUFFER(scalar);
 }
 
-// "Fast" dangerous ephemeral key
+// "Fast" dirty ephemeral key
 // We use this one by default.
 //
 // This version works by performing a regular scalar multiplication,
 // then add a low order point.  The scalar multiplication is done in
 // Edwards space for more speed (*2 compared to the "small" version).
 // The cost is a bigger binary programs that don't also sign messages.
-void crypto_x25519_dangerous_fast(u8 public_key[32], const u8 secret_key[32])
+void crypto_x25519_dirty_fast(u8 public_key[32], const u8 secret_key[32])
 {
     static const fe lop_x = {
         21352778, 5345713, 4660180, -8347857, 24143090,
@@ -2593,7 +2593,7 @@ void crypto_hidden_key_pair(u8 hidden[32], u8 secret_key[32], u8 seed[32])
     COPY(buf + 32, seed, 32);
     do {
         crypto_chacha20(buf, 0, 64, buf+32, zero);
-        crypto_x25519_dangerous_fast(pk, buf); // or the "small" version
+        crypto_x25519_dirty_fast(pk, buf); // or the "small" version
     } while(crypto_curve_to_hidden(buf+32, pk, buf[32]));
     // Note that the return value of crypto_private_to_hidden() is
     // independent from its tweak parameter.

diff --git a/src/monocypher.h b/src/monocypher.h
index ed1123c96f450e68569d544131c2e3dbb747653e..2269bd6e9c67a279f7ce9c9e9441fa5150a259f6 100644 (file)
--- a/src/monocypher.h
+++ b/src/monocypher.h
@@ -335,10 +335,10 @@ void crypto_x25519(uint8_t       raw_shared_secret[32],
                    const uint8_t your_secret_key  [32],
                    const uint8_t their_public_key [32]);
 
-// "Dangerous" versions of x25519_public_key()
+// "Dirty" versions of x25519_public_key()
 // Only use to generate ephemeral keys you want to hide.
-void crypto_x25519_dangerous_small(uint8_t pk[32], const uint8_t sk[32]);
-void crypto_x25519_dangerous_fast (uint8_t pk[32], const uint8_t sk[32]);
+void crypto_x25519_dirty_small(uint8_t pk[32], const uint8_t sk[32]);
+void crypto_x25519_dirty_fast (uint8_t pk[32], const uint8_t sk[32]);
 
 // scalar division
 // ---------------

diff --git a/tests/speed/speed.c b/tests/speed/speed.c
index 258c37c5e74cbddb83043d82ae7afef976bc4046..225488431209e80c72b9e0ed382e69957d4b0754 100644 (file)
--- a/tests/speed/speed.c
+++ b/tests/speed/speed.c
@@ -188,7 +188,7 @@ static u64 x25519_sp_fast(void)
 {
     RANDOM_INPUT(sk, 32);
     TIMING_START {
-        crypto_x25519_dangerous_fast(sk, sk);
+        crypto_x25519_dirty_fast(sk, sk);
     }
     TIMING_END;
 }
@@ -197,7 +197,7 @@ static u64 x25519_sp_small(void)
 {
     RANDOM_INPUT(sk, 32);
     TIMING_START {
-        crypto_x25519_dangerous_small(sk, sk);
+        crypto_x25519_dirty_small(sk, sk);
     }
     TIMING_END;
 }
@@ -214,8 +214,8 @@ int main()
     print("EdDSA(sign)         ",edDSA_sign()        ,"signatures per second");
     print("EdDSA(check)        ",edDSA_check()       ,"checks     per second");
     print("x25519 inverse      ",x25519_inverse()    ,"scalar inv per second");
-    print("x25519 special fast ",x25519_sp_fast()    ,"scalar inv per second");
-    print("x25519 special small",x25519_sp_small()    ,"scalar inv per second");
+    print("x25519 dirty fast   ",x25519_sp_fast()    ,"scalar inv per second");
+    print("x25519 dirty small  ",x25519_sp_small()    ,"scalar inv per second");
     printf("\n");
     return 0;
 }

diff --git a/tests/test.c b/tests/test.c
index f9181f6e4dd33407b297308f11dee1ee95a9e7e3..a24ed318ada5f3884644dc7578b296381a431eaa 100644 (file)
--- a/tests/test.c
+++ b/tests/test.c
@@ -927,9 +927,9 @@ static int p_elligator_x25519()
         // Maximise tweak diversity.
         // We want to set the bits 1 (sign) and 6-7 (padding)
         u8 tweak = (i & 1) + (i << 6);
-        // Both dangerous functions behave the same
-        u8 pks[32];  crypto_x25519_dangerous_small(pks, sk1);
-        u8 pkf[32];  crypto_x25519_dangerous_fast (pkf, sk1);
+        // Both dirty functions behave the same
+        u8 pks[32];  crypto_x25519_dirty_small(pks, sk1);
+        u8 pkf[32];  crypto_x25519_dirty_fast (pkf, sk1);
         status |= memcmp(pks, pkf, 32);
         u8 r[32];
         if (crypto_curve_to_hidden(r, pkf, tweak)) {
@@ -940,7 +940,7 @@ static int p_elligator_x25519()
         u8 pkr[32];  crypto_hidden_to_curve(pkr, r);
         status |= memcmp(pkr, pkf, 32);
 
-        // Dangerous and safe keys are compatible
+        // Dirty and safe keys are compatible
         u8 e1 [32];  crypto_x25519(e1, sk2, pk1);
         u8 e2 [32];  crypto_x25519(e2, sk2, pkr);
         status |= memcmp(e1, e2, 32);