Support all five EdDSA instances from RFC 8032

Fixes #6277

Description:
Make each of the five EdDSA instances defined in RFC 8032 -- Ed25519,
Ed25519ctx, Ed25519ph, Ed448, Ed448ph -- available via the EVP APIs.

The desired EdDSA instance is specified via an OSSL_PARAM.

All instances, except for Ed25519, allow context strings as input.
Context strings are passed via an OSSL_PARAM.  For Ed25519ctx, the
context string must be nonempty.

Ed25519, Ed25519ctx, Ed448 are PureEdDSA instances, which means that
the full message (not a digest) must be passed to sign and verify
operations.

Ed25519ph, Ed448ph are HashEdDSA instances, which means that the input
message is hashed before sign and verify.

Testing:
All 21 test vectors from RFC 8032 have been added to evppkey_ecx.txt
(thanks to Shane Lontis for showing how to do that).  Those 21 test
vectors are exercised by evp_test.c and cover all five instances.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/19705)

1 files changed, 15 insertions, 9 deletions

diff --git a/include/crypto/ecx.h b/include/crypto/ecx.h
index 79026b6c41..e6b61b5a79 100644
--- a/include/crypto/ecx.h
+++ b/include/crypto/ecx.h
@@ -97,27 +97,33 @@ ossl_ed25519_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[32],
                                  const uint8_t private_key[32],
                                  const char *propq);
 int
-ossl_ed25519_sign(uint8_t *out_sig, const uint8_t *message, size_t message_len,
+ossl_ed25519_sign(uint8_t *out_sig, const uint8_t *tbs, size_t tbs_len,
                   const uint8_t public_key[32], const uint8_t private_key[32],
+                  const uint8_t dom2flag, const uint8_t phflag, const uint8_t csflag,
+                  const uint8_t *context, size_t context_len,
                   OSSL_LIB_CTX *libctx, const char *propq);
 int
-ossl_ed25519_verify(const uint8_t *message, size_t message_len,
+ossl_ed25519_verify(const uint8_t *tbs, size_t tbs_len,
                     const uint8_t signature[64], const uint8_t public_key[32],
+                    const uint8_t dom2flag, const uint8_t phflag, const uint8_t csflag,
+                    const uint8_t *context, size_t context_len,
                     OSSL_LIB_CTX *libctx, const char *propq);
-
 int
 ossl_ed448_public_from_private(OSSL_LIB_CTX *ctx, uint8_t out_public_key[57],
                                const uint8_t private_key[57], const char *propq);
 int
-ossl_ed448_sign(OSSL_LIB_CTX *ctx, uint8_t *out_sig, const uint8_t *message,
-                size_t message_len, const uint8_t public_key[57],
-                const uint8_t private_key[57], const uint8_t *context,
-                size_t context_len, const char *propq);
+ossl_ed448_sign(OSSL_LIB_CTX *ctx, uint8_t *out_sig,
+                const uint8_t *message, size_t message_len,
+                const uint8_t public_key[57], const uint8_t private_key[57],
+                const uint8_t *context, size_t context_len,
+                const uint8_t phflag, const char *propq);
 
 int
-ossl_ed448_verify(OSSL_LIB_CTX *ctx, const uint8_t *message, size_t message_len,
+ossl_ed448_verify(OSSL_LIB_CTX *ctx,
+                  const uint8_t *message, size_t message_len,
                   const uint8_t signature[114], const uint8_t public_key[57],
-                  const uint8_t *context, size_t context_len, const char *propq);
+                  const uint8_t *context, size_t context_len,
+                  const uint8_t phflag, const char *propq);
 
 int
 ossl_x448(uint8_t out_shared_key[56], const uint8_t private_key[56],