Revert "Move EDDSA to another branch."

This reverts commit 1867f0330f.

src/fido/cbor.c

@@ -209,6 +209,14 @@ CborError COSE_key(mbedtls_ecp_keypair *key, CborEncoder *mapEncoderParent,
     else if (key->grp.id == MBEDTLS_ECP_DP_CURVE25519) {
         alg = FIDO2_ALG_ECDH_ES_HKDF_256;
     }
+#ifdef MBEDTLS_EDDSA_C
+    else if (key->grp.id == MBEDTLS_ECP_DP_ED25519) {
+        alg = FIDO2_ALG_EDDSA;
+    }
+    else if (key->grp.id == MBEDTLS_ECP_DP_ED448) {
+        alg = FIDO2_ALG_ED448;
+    }
+#endif
     return COSE_key_params(crv, alg, &key->grp, &key->Q, mapEncoderParent, mapEncoder);
 }
 CborError COSE_key_shared(mbedtls_ecdh_context *key,

src/fido/cbor_get_assertion.c

@@ -633,10 +633,20 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
         else if (ekey.grp.id == MBEDTLS_ECP_DP_SECP521R1) {
             md = mbedtls_md_info_from_type(MBEDTLS_MD_SHA512);
         }
+#ifdef MBEDTLS_EDDSA_C
+        else if (ekey.grp.id == MBEDTLS_ECP_DP_ED25519) {
+            md = NULL;
+        }
+#endif
         if (md != NULL) {
             ret = mbedtls_md(md, aut_data, aut_data_len + clientDataHash.len, hash);
             ret = mbedtls_ecdsa_write_signature(&ekey, mbedtls_md_get_type(md), hash, mbedtls_md_get_size(md), sig, sizeof(sig), &olen, random_gen, NULL);
         }
+#ifdef MBEDTLS_EDDSA_C
+        else {
+            ret = mbedtls_eddsa_write_signature(&ekey, aut_data, aut_data_len + clientDataHash.len, sig, sizeof(sig), &olen, MBEDTLS_EDDSA_PURE, NULL, 0, random_gen, NULL);
+        }
+#endif
     }
     else {
         // Bogus signature

src/fido/cbor_get_info.c

@@ -114,6 +114,9 @@ int cbor_get_info() {
     CBOR_CHECK(cbor_encode_uint(&mapEncoder, 0x0A));
 
     uint8_t curves = 3;
+#ifdef MBEDTLS_EDDSA_C
+    curves++;
+#endif
 #ifndef ENABLE_EMULATION
     if (phy_data.enabled_curves & PHY_CURVE_SECP256K1) {
 #endif
@@ -123,6 +126,9 @@ int cbor_get_info() {
 #endif
     CBOR_CHECK(cbor_encoder_create_array(&mapEncoder, &arrayEncoder, curves));
     CBOR_CHECK(COSE_public_key(FIDO2_ALG_ES256, &arrayEncoder, &mapEncoder2));
+#ifdef MBEDTLS_EDDSA_C
+    CBOR_CHECK(COSE_public_key(FIDO2_ALG_EDDSA, &arrayEncoder, &mapEncoder2));
+#endif
     CBOR_CHECK(COSE_public_key(FIDO2_ALG_ES384, &arrayEncoder, &mapEncoder2));
     CBOR_CHECK(COSE_public_key(FIDO2_ALG_ES512, &arrayEncoder, &mapEncoder2));
 #ifndef ENABLE_EMULATION

src/fido/cbor_make_credential.c

@@ -273,6 +273,18 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
                 curve = FIDO2_CURVE_P256K1;
             }
         }
+#ifdef MBEDTLS_EDDSA_C
+        else if (pubKeyCredParams[i].alg == FIDO2_ALG_EDDSA || pubKeyCredParams[i].alg == FIDO2_ALG_ED25519) {
+            if (curve <= 0) {
+                curve = FIDO2_CURVE_ED25519;
+            }
+        }
+        else if (pubKeyCredParams[i].alg == FIDO2_ALG_ED448) {
+            if (curve <= 0) {
+                curve = FIDO2_CURVE_ED448;
+            }
+        }
+#endif
         else if (pubKeyCredParams[i].alg <= FIDO2_ALG_RS256 && pubKeyCredParams[i].alg >= FIDO2_ALG_RS512) {
             // pass
         }
@@ -566,6 +578,11 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
     else if (ekey.grp.id == MBEDTLS_ECP_DP_SECP521R1 || ekey.grp.id == MBEDTLS_ECP_DP_BP512R1) {
         md = mbedtls_md_info_from_type(MBEDTLS_MD_SHA512);
     }
+#ifdef MBEDTLS_EDDSA_C
+    else if (ekey.grp.id == MBEDTLS_ECP_DP_ED25519 || ekey.grp.id == MBEDTLS_ECP_DP_ED448) {
+        md = NULL;
+    }
+#endif
     if (md != NULL) {
         ret = mbedtls_md(md, aut_data, aut_data_len + clientDataHash.len, hash);
     }
@@ -586,6 +603,11 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
     if (md != NULL) {
         ret = mbedtls_ecdsa_write_signature(&ekey, mbedtls_md_get_type(md), hash, mbedtls_md_get_size(md), sig, sizeof(sig), &olen, random_gen, NULL);
     }
+#ifdef MBEDTLS_EDDSA_C
+    else {
+        ret = mbedtls_eddsa_write_signature(&ekey, aut_data, aut_data_len + clientDataHash.len, sig, sizeof(sig), &olen, MBEDTLS_EDDSA_PURE, NULL, 0, random_gen, NULL);
+    }
+#endif
     mbedtls_ecp_keypair_free(&ekey);
     if (ret != 0) {
         CBOR_ERROR(CTAP2_ERR_PROCESSING);

src/fido/fido.c

@@ -111,6 +111,14 @@ mbedtls_ecp_group_id fido_curve_to_mbedtls(int curve) {
     else if (curve == FIDO2_CURVE_X448) {
         return MBEDTLS_ECP_DP_CURVE448;
     }
+#ifdef MBEDTLS_EDDSA_C
+    else if (curve == FIDO2_CURVE_ED25519) {
+        return MBEDTLS_ECP_DP_ED25519;
+    }
+    else if (curve == FIDO2_CURVE_ED448) {
+        return MBEDTLS_ECP_DP_ED448;
+    }
+#endif
     else if (curve == FIDO2_CURVE_BP256R1) {
         return MBEDTLS_ECP_DP_BP256R1;
     }
@@ -141,6 +149,14 @@ int mbedtls_curve_to_fido(mbedtls_ecp_group_id id) {
     else if (id == MBEDTLS_ECP_DP_CURVE448) {
         return FIDO2_CURVE_X448;
     }
+#ifdef MBEDTLS_EDDSA_C
+    else if (id == MBEDTLS_ECP_DP_ED25519) {
+        return FIDO2_CURVE_ED25519;
+    }
+    else if (id == MBEDTLS_ECP_DP_ED448) {
+        return FIDO2_CURVE_ED448;
+    }
+#endif
     return 0;
 }
 
@@ -314,6 +330,11 @@ int derive_key(const uint8_t *app_id, bool new_key, uint8_t *key_handle, int cur
         if (r != 0) {
             return r;
         }
+#ifdef MBEDTLS_EDDSA_C
+        if (curve == MBEDTLS_ECP_DP_ED25519) {
+            return mbedtls_ecp_point_edwards(&key->grp, &key->Q, &key->d, random_gen, NULL);
+        }
+#endif
         return mbedtls_ecp_mul(&key->grp, &key->Q, &key->d, &key->grp.G, random_gen, NULL);
     }
     mbedtls_platform_zeroize(outk, sizeof(outk));

src/fido/fido.h

@@ -28,6 +28,9 @@
 #endif
 
 #include "mbedtls/ecdsa.h"
+#ifdef MBEDTLS_EDDSA_C
+#include "mbedtls/eddsa.h"
+#endif
 #include "hid/ctap_hid.h"
 
 #define CTAP_PUBKEY_LEN (65)
@@ -54,13 +57,16 @@ extern int decrypt(uint8_t protocol, const uint8_t *key, const uint8_t *in, uint
 extern int ecdh(uint8_t protocol, const mbedtls_ecp_point *Q, uint8_t *sharedSecret);
 
 #define FIDO2_ALG_ES256     -7 //ECDSA-SHA256
+#define FIDO2_ALG_EDDSA     -8 //EdDSA
 #define FIDO2_ALG_ESP256    -9 //ECDSA-SHA256 P256
+#define FIDO2_ALG_ED25519   -19 //EDDSA Ed25519
 #define FIDO2_ALG_ES384     -35 //ECDSA-SHA384
 #define FIDO2_ALG_ES512     -36 //ECDSA-SHA512
 #define FIDO2_ALG_ECDH_ES_HKDF_256 -25 //ECDH-ES + HKDF-256
 #define FIDO2_ALG_ES256K    -47
 #define FIDO2_ALG_ESP384    -51 //ECDSA-SHA384 P384
 #define FIDO2_ALG_ESP512    -52 //ECDSA-SHA512 P521
+#define FIDO2_ALG_ED448     -53 //EDDSA Ed448
 #define FIDO2_ALG_RS256     -257
 #define FIDO2_ALG_RS384     -258
 #define FIDO2_ALG_RS512     -259
@@ -73,6 +79,8 @@ extern int ecdh(uint8_t protocol, const mbedtls_ecp_point *Q, uint8_t *sharedSec
 #define FIDO2_CURVE_P521        3
 #define FIDO2_CURVE_X25519      4
 #define FIDO2_CURVE_X448        5
+#define FIDO2_CURVE_ED25519     6
+#define FIDO2_CURVE_ED448       7
 #define FIDO2_CURVE_P256K1      8
 #define FIDO2_CURVE_BP256R1     9
 #define FIDO2_CURVE_BP384R1     10