crypto: Add an API supporting curve25519.

[jhb]

Summary

This adds a wrapper around libsodium's curve25519 support matching
Linux's curve25519 API. The intended use case for this is WireGuard.

Note that this is not integrated with OCF as it is not related to
symmetric operations on data.

Sponsored by: The FreeBSD Foundation

[emaste]

sys/crypto/curve25519.h

19

"REGENTS"?

sys/crypto/libsodium/utils.c

1–20

I wonder if we shouldn't use just the ISC license, with perhaps a special comment on sodium_memzero - I imagine that if we needed to extend what we support over time we'd just bring in more of libsodium's utils.c?

[markj]

sys/crypto/curve25519.c

46

I noticed that the Linux implementations check for an all-zeros secret, presumably as a seatbelt against programming errors? A clamped secret can't be all-zeros...

sys/crypto/curve25519.h

49

libsodium handles clamping for you, but I guess it doesn't hurt to be sure.

[jhb]

sys/crypto/curve25519.c

19

Similarly.

sys/crypto/curve25519.h

19

Sigh, I must have copied this from the wrong file, I will fix.

49

WireGuard expects to use this function directly, but yes, I noticed libsodium already does this.

sys/crypto/libsodium/utils.c

1–20

Mmm, yeah.

[jhb]

sys/crypto/curve25519.c

46

It also checks the computed value, perhaps as a seatbelt against broken backends (since they support MD backends)? I could add the check against all zeroes if you think it's warranted.

[markj]

sys/crypto/curve25519.c

46

I think the change is fine as-is.

[jhb]

License fixes.