BA / SerialCom

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Fork of OmniWheels by Gustav Atmel

mbed-os/features/mbedtls/src/ecdsa.c@2:798925c9e4a8, 2018-05-01 (annotated)

Committer:
gustavatmel
Date:
Tue May 01 15:55:34 2018 +0000
Revision:
2:798925c9e4a8
Parent:
1:9c5af431a1f1 
bluetooth

Who changed what in which revision?

UserRevisionLine numberNew contents of line
gustavatmel 1:9c5af431a1f1 1 /*
gustavatmel 1:9c5af431a1f1 2 * Elliptic curve DSA
gustavatmel 1:9c5af431a1f1 3 *
gustavatmel 1:9c5af431a1f1 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
gustavatmel 1:9c5af431a1f1 5 * SPDX-License-Identifier: Apache-2.0
gustavatmel 1:9c5af431a1f1 6 *
gustavatmel 1:9c5af431a1f1 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
gustavatmel 1:9c5af431a1f1 8 * not use this file except in compliance with the License.
gustavatmel 1:9c5af431a1f1 9 * You may obtain a copy of the License at
gustavatmel 1:9c5af431a1f1 10 *
gustavatmel 1:9c5af431a1f1 11 * http://www.apache.org/licenses/LICENSE-2.0
gustavatmel 1:9c5af431a1f1 12 *
gustavatmel 1:9c5af431a1f1 13 * Unless required by applicable law or agreed to in writing, software
gustavatmel 1:9c5af431a1f1 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
gustavatmel 1:9c5af431a1f1 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
gustavatmel 1:9c5af431a1f1 16 * See the License for the specific language governing permissions and
gustavatmel 1:9c5af431a1f1 17 * limitations under the License.
gustavatmel 1:9c5af431a1f1 18 *
gustavatmel 1:9c5af431a1f1 19 * This file is part of mbed TLS (https://tls.mbed.org)
gustavatmel 1:9c5af431a1f1 20 */
gustavatmel 1:9c5af431a1f1 21
gustavatmel 1:9c5af431a1f1 22 /*
gustavatmel 1:9c5af431a1f1 23 * References:
gustavatmel 1:9c5af431a1f1 24 *
gustavatmel 1:9c5af431a1f1 25 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
gustavatmel 1:9c5af431a1f1 26 */
gustavatmel 1:9c5af431a1f1 27
gustavatmel 1:9c5af431a1f1 28 #if !defined(MBEDTLS_CONFIG_FILE)
gustavatmel 1:9c5af431a1f1 29 #include "mbedtls/config.h"
gustavatmel 1:9c5af431a1f1 30 #else
gustavatmel 1:9c5af431a1f1 31 #include MBEDTLS_CONFIG_FILE
gustavatmel 1:9c5af431a1f1 32 #endif
gustavatmel 1:9c5af431a1f1 33
gustavatmel 1:9c5af431a1f1 34 #if defined(MBEDTLS_ECDSA_C)
gustavatmel 1:9c5af431a1f1 35
gustavatmel 1:9c5af431a1f1 36 #include "mbedtls/ecdsa.h"
gustavatmel 1:9c5af431a1f1 37 #include "mbedtls/asn1write.h"
gustavatmel 1:9c5af431a1f1 38
gustavatmel 1:9c5af431a1f1 39 #include <string.h>
gustavatmel 1:9c5af431a1f1 40
gustavatmel 1:9c5af431a1f1 41 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
gustavatmel 1:9c5af431a1f1 42 #include "mbedtls/hmac_drbg.h"
gustavatmel 1:9c5af431a1f1 43 #endif
gustavatmel 1:9c5af431a1f1 44
gustavatmel 1:9c5af431a1f1 45 /*
gustavatmel 1:9c5af431a1f1 46 * Derive a suitable integer for group grp from a buffer of length len
gustavatmel 1:9c5af431a1f1 47 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
gustavatmel 1:9c5af431a1f1 48 */
gustavatmel 1:9c5af431a1f1 49 static int derive_mpi( const mbedtls_ecp_group *grp, mbedtls_mpi *x,
gustavatmel 1:9c5af431a1f1 50 const unsigned char *buf, size_t blen )
gustavatmel 1:9c5af431a1f1 51 {
gustavatmel 1:9c5af431a1f1 52 int ret;
gustavatmel 1:9c5af431a1f1 53 size_t n_size = ( grp->nbits + 7 ) / 8;
gustavatmel 1:9c5af431a1f1 54 size_t use_size = blen > n_size ? n_size : blen;
gustavatmel 1:9c5af431a1f1 55
gustavatmel 1:9c5af431a1f1 56 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( x, buf, use_size ) );
gustavatmel 1:9c5af431a1f1 57 if( use_size * 8 > grp->nbits )
gustavatmel 1:9c5af431a1f1 58 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( x, use_size * 8 - grp->nbits ) );
gustavatmel 1:9c5af431a1f1 59
gustavatmel 1:9c5af431a1f1 60 /* While at it, reduce modulo N */
gustavatmel 1:9c5af431a1f1 61 if( mbedtls_mpi_cmp_mpi( x, &grp->N ) >= 0 )
gustavatmel 1:9c5af431a1f1 62 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
gustavatmel 1:9c5af431a1f1 63
gustavatmel 1:9c5af431a1f1 64 cleanup:
gustavatmel 1:9c5af431a1f1 65 return( ret );
gustavatmel 1:9c5af431a1f1 66 }
gustavatmel 1:9c5af431a1f1 67
gustavatmel 1:9c5af431a1f1 68 #if !defined(MBEDTLS_ECDSA_SIGN_ALT)
gustavatmel 1:9c5af431a1f1 69 /*
gustavatmel 1:9c5af431a1f1 70 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
gustavatmel 1:9c5af431a1f1 71 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
gustavatmel 1:9c5af431a1f1 72 */
gustavatmel 1:9c5af431a1f1 73 int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
gustavatmel 1:9c5af431a1f1 74 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
gustavatmel 1:9c5af431a1f1 75 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
gustavatmel 1:9c5af431a1f1 76 {
gustavatmel 1:9c5af431a1f1 77 int ret, key_tries, sign_tries, blind_tries;
gustavatmel 1:9c5af431a1f1 78 mbedtls_ecp_point R;
gustavatmel 1:9c5af431a1f1 79 mbedtls_mpi k, e, t;
gustavatmel 1:9c5af431a1f1 80
gustavatmel 1:9c5af431a1f1 81 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
gustavatmel 1:9c5af431a1f1 82 if( grp->N.p == NULL )
gustavatmel 1:9c5af431a1f1 83 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
gustavatmel 1:9c5af431a1f1 84
gustavatmel 1:9c5af431a1f1 85 /* Make sure d is in range 1..n-1 */
gustavatmel 1:9c5af431a1f1 86 if( mbedtls_mpi_cmp_int( d, 1 ) < 0 || mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
gustavatmel 1:9c5af431a1f1 87 return( MBEDTLS_ERR_ECP_INVALID_KEY );
gustavatmel 1:9c5af431a1f1 88
gustavatmel 1:9c5af431a1f1 89 mbedtls_ecp_point_init( &R );
gustavatmel 1:9c5af431a1f1 90 mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
gustavatmel 1:9c5af431a1f1 91
gustavatmel 1:9c5af431a1f1 92 sign_tries = 0;
gustavatmel 1:9c5af431a1f1 93 do
gustavatmel 1:9c5af431a1f1 94 {
gustavatmel 1:9c5af431a1f1 95 /*
gustavatmel 1:9c5af431a1f1 96 * Steps 1-3: generate a suitable ephemeral keypair
gustavatmel 1:9c5af431a1f1 97 * and set r = xR mod n
gustavatmel 1:9c5af431a1f1 98 */
gustavatmel 1:9c5af431a1f1 99 key_tries = 0;
gustavatmel 1:9c5af431a1f1 100 do
gustavatmel 1:9c5af431a1f1 101 {
gustavatmel 1:9c5af431a1f1 102 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
gustavatmel 1:9c5af431a1f1 103 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( r, &R.X, &grp->N ) );
gustavatmel 1:9c5af431a1f1 104
gustavatmel 1:9c5af431a1f1 105 if( key_tries++ > 10 )
gustavatmel 1:9c5af431a1f1 106 {
gustavatmel 1:9c5af431a1f1 107 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
gustavatmel 1:9c5af431a1f1 108 goto cleanup;
gustavatmel 1:9c5af431a1f1 109 }
gustavatmel 1:9c5af431a1f1 110 }
gustavatmel 1:9c5af431a1f1 111 while( mbedtls_mpi_cmp_int( r, 0 ) == 0 );
gustavatmel 1:9c5af431a1f1 112
gustavatmel 1:9c5af431a1f1 113 /*
gustavatmel 1:9c5af431a1f1 114 * Step 5: derive MPI from hashed message
gustavatmel 1:9c5af431a1f1 115 */
gustavatmel 1:9c5af431a1f1 116 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
gustavatmel 1:9c5af431a1f1 117
gustavatmel 1:9c5af431a1f1 118 /*
gustavatmel 1:9c5af431a1f1 119 * Generate a random value to blind inv_mod in next step,
gustavatmel 1:9c5af431a1f1 120 * avoiding a potential timing leak.
gustavatmel 1:9c5af431a1f1 121 */
gustavatmel 1:9c5af431a1f1 122 blind_tries = 0;
gustavatmel 1:9c5af431a1f1 123 do
gustavatmel 1:9c5af431a1f1 124 {
gustavatmel 1:9c5af431a1f1 125 size_t n_size = ( grp->nbits + 7 ) / 8;
gustavatmel 1:9c5af431a1f1 126 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &t, n_size, f_rng, p_rng ) );
gustavatmel 1:9c5af431a1f1 127 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
gustavatmel 1:9c5af431a1f1 128
gustavatmel 1:9c5af431a1f1 129 /* See mbedtls_ecp_gen_keypair() */
gustavatmel 1:9c5af431a1f1 130 if( ++blind_tries > 30 )
gustavatmel 1:9c5af431a1f1 131 return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
gustavatmel 1:9c5af431a1f1 132 }
gustavatmel 1:9c5af431a1f1 133 while( mbedtls_mpi_cmp_int( &t, 1 ) < 0 ||
gustavatmel 1:9c5af431a1f1 134 mbedtls_mpi_cmp_mpi( &t, &grp->N ) >= 0 );
gustavatmel 1:9c5af431a1f1 135
gustavatmel 1:9c5af431a1f1 136 /*
gustavatmel 1:9c5af431a1f1 137 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
gustavatmel 1:9c5af431a1f1 138 */
gustavatmel 1:9c5af431a1f1 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, r, d ) );
gustavatmel 1:9c5af431a1f1 140 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
gustavatmel 1:9c5af431a1f1 141 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
gustavatmel 1:9c5af431a1f1 142 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &k, &k, &t ) );
gustavatmel 1:9c5af431a1f1 143 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, &k, &grp->N ) );
gustavatmel 1:9c5af431a1f1 144 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
gustavatmel 1:9c5af431a1f1 145 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
gustavatmel 1:9c5af431a1f1 146
gustavatmel 1:9c5af431a1f1 147 if( sign_tries++ > 10 )
gustavatmel 1:9c5af431a1f1 148 {
gustavatmel 1:9c5af431a1f1 149 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
gustavatmel 1:9c5af431a1f1 150 goto cleanup;
gustavatmel 1:9c5af431a1f1 151 }
gustavatmel 1:9c5af431a1f1 152 }
gustavatmel 1:9c5af431a1f1 153 while( mbedtls_mpi_cmp_int( s, 0 ) == 0 );
gustavatmel 1:9c5af431a1f1 154
gustavatmel 1:9c5af431a1f1 155 cleanup:
gustavatmel 1:9c5af431a1f1 156 mbedtls_ecp_point_free( &R );
gustavatmel 1:9c5af431a1f1 157 mbedtls_mpi_free( &k ); mbedtls_mpi_free( &e ); mbedtls_mpi_free( &t );
gustavatmel 1:9c5af431a1f1 158
gustavatmel 1:9c5af431a1f1 159 return( ret );
gustavatmel 1:9c5af431a1f1 160 }
gustavatmel 1:9c5af431a1f1 161 #endif /* MBEDTLS_ECDSA_SIGN_ALT */
gustavatmel 1:9c5af431a1f1 162
gustavatmel 1:9c5af431a1f1 163 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
gustavatmel 1:9c5af431a1f1 164 /*
gustavatmel 1:9c5af431a1f1 165 * Deterministic signature wrapper
gustavatmel 1:9c5af431a1f1 166 */
gustavatmel 1:9c5af431a1f1 167 int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
gustavatmel 1:9c5af431a1f1 168 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
gustavatmel 1:9c5af431a1f1 169 mbedtls_md_type_t md_alg )
gustavatmel 1:9c5af431a1f1 170 {
gustavatmel 1:9c5af431a1f1 171 int ret;
gustavatmel 1:9c5af431a1f1 172 mbedtls_hmac_drbg_context rng_ctx;
gustavatmel 1:9c5af431a1f1 173 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
gustavatmel 1:9c5af431a1f1 174 size_t grp_len = ( grp->nbits + 7 ) / 8;
gustavatmel 1:9c5af431a1f1 175 const mbedtls_md_info_t *md_info;
gustavatmel 1:9c5af431a1f1 176 mbedtls_mpi h;
gustavatmel 1:9c5af431a1f1 177
gustavatmel 1:9c5af431a1f1 178 if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
gustavatmel 1:9c5af431a1f1 179 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
gustavatmel 1:9c5af431a1f1 180
gustavatmel 1:9c5af431a1f1 181 mbedtls_mpi_init( &h );
gustavatmel 1:9c5af431a1f1 182 mbedtls_hmac_drbg_init( &rng_ctx );
gustavatmel 1:9c5af431a1f1 183
gustavatmel 1:9c5af431a1f1 184 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
gustavatmel 1:9c5af431a1f1 185 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( d, data, grp_len ) );
gustavatmel 1:9c5af431a1f1 186 MBEDTLS_MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
gustavatmel 1:9c5af431a1f1 187 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, data + grp_len, grp_len ) );
gustavatmel 1:9c5af431a1f1 188 mbedtls_hmac_drbg_seed_buf( &rng_ctx, md_info, data, 2 * grp_len );
gustavatmel 1:9c5af431a1f1 189
gustavatmel 1:9c5af431a1f1 190 ret = mbedtls_ecdsa_sign( grp, r, s, d, buf, blen,
gustavatmel 1:9c5af431a1f1 191 mbedtls_hmac_drbg_random, &rng_ctx );
gustavatmel 1:9c5af431a1f1 192
gustavatmel 1:9c5af431a1f1 193 cleanup:
gustavatmel 1:9c5af431a1f1 194 mbedtls_hmac_drbg_free( &rng_ctx );
gustavatmel 1:9c5af431a1f1 195 mbedtls_mpi_free( &h );
gustavatmel 1:9c5af431a1f1 196
gustavatmel 1:9c5af431a1f1 197 return( ret );
gustavatmel 1:9c5af431a1f1 198 }
gustavatmel 1:9c5af431a1f1 199 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
gustavatmel 1:9c5af431a1f1 200
gustavatmel 1:9c5af431a1f1 201 #if !defined(MBEDTLS_ECDSA_VERIFY_ALT)
gustavatmel 1:9c5af431a1f1 202 /*
gustavatmel 1:9c5af431a1f1 203 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
gustavatmel 1:9c5af431a1f1 204 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
gustavatmel 1:9c5af431a1f1 205 */
gustavatmel 1:9c5af431a1f1 206 int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
gustavatmel 1:9c5af431a1f1 207 const unsigned char *buf, size_t blen,
gustavatmel 1:9c5af431a1f1 208 const mbedtls_ecp_point *Q, const mbedtls_mpi *r, const mbedtls_mpi *s)
gustavatmel 1:9c5af431a1f1 209 {
gustavatmel 1:9c5af431a1f1 210 int ret;
gustavatmel 1:9c5af431a1f1 211 mbedtls_mpi e, s_inv, u1, u2;
gustavatmel 1:9c5af431a1f1 212 mbedtls_ecp_point R;
gustavatmel 1:9c5af431a1f1 213
gustavatmel 1:9c5af431a1f1 214 mbedtls_ecp_point_init( &R );
gustavatmel 1:9c5af431a1f1 215 mbedtls_mpi_init( &e ); mbedtls_mpi_init( &s_inv ); mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
gustavatmel 1:9c5af431a1f1 216
gustavatmel 1:9c5af431a1f1 217 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
gustavatmel 1:9c5af431a1f1 218 if( grp->N.p == NULL )
gustavatmel 1:9c5af431a1f1 219 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
gustavatmel 1:9c5af431a1f1 220
gustavatmel 1:9c5af431a1f1 221 /*
gustavatmel 1:9c5af431a1f1 222 * Step 1: make sure r and s are in range 1..n-1
gustavatmel 1:9c5af431a1f1 223 */
gustavatmel 1:9c5af431a1f1 224 if( mbedtls_mpi_cmp_int( r, 1 ) < 0 || mbedtls_mpi_cmp_mpi( r, &grp->N ) >= 0 ||
gustavatmel 1:9c5af431a1f1 225 mbedtls_mpi_cmp_int( s, 1 ) < 0 || mbedtls_mpi_cmp_mpi( s, &grp->N ) >= 0 )
gustavatmel 1:9c5af431a1f1 226 {
gustavatmel 1:9c5af431a1f1 227 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
gustavatmel 1:9c5af431a1f1 228 goto cleanup;
gustavatmel 1:9c5af431a1f1 229 }
gustavatmel 1:9c5af431a1f1 230
gustavatmel 1:9c5af431a1f1 231 /*
gustavatmel 1:9c5af431a1f1 232 * Additional precaution: make sure Q is valid
gustavatmel 1:9c5af431a1f1 233 */
gustavatmel 1:9c5af431a1f1 234 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, Q ) );
gustavatmel 1:9c5af431a1f1 235
gustavatmel 1:9c5af431a1f1 236 /*
gustavatmel 1:9c5af431a1f1 237 * Step 3: derive MPI from hashed message
gustavatmel 1:9c5af431a1f1 238 */
gustavatmel 1:9c5af431a1f1 239 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
gustavatmel 1:9c5af431a1f1 240
gustavatmel 1:9c5af431a1f1 241 /*
gustavatmel 1:9c5af431a1f1 242 * Step 4: u1 = e / s mod n, u2 = r / s mod n
gustavatmel 1:9c5af431a1f1 243 */
gustavatmel 1:9c5af431a1f1 244 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &s_inv, s, &grp->N ) );
gustavatmel 1:9c5af431a1f1 245
gustavatmel 1:9c5af431a1f1 246 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u1, &e, &s_inv ) );
gustavatmel 1:9c5af431a1f1 247 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u1, &u1, &grp->N ) );
gustavatmel 1:9c5af431a1f1 248
gustavatmel 1:9c5af431a1f1 249 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u2, r, &s_inv ) );
gustavatmel 1:9c5af431a1f1 250 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u2, &u2, &grp->N ) );
gustavatmel 1:9c5af431a1f1 251
gustavatmel 1:9c5af431a1f1 252 /*
gustavatmel 1:9c5af431a1f1 253 * Step 5: R = u1 G + u2 Q
gustavatmel 1:9c5af431a1f1 254 *
gustavatmel 1:9c5af431a1f1 255 * Since we're not using any secret data, no need to pass a RNG to
gustavatmel 1:9c5af431a1f1 256 * mbedtls_ecp_mul() for countermesures.
gustavatmel 1:9c5af431a1f1 257 */
gustavatmel 1:9c5af431a1f1 258 MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, &R, &u1, &grp->G, &u2, Q ) );
gustavatmel 1:9c5af431a1f1 259
gustavatmel 1:9c5af431a1f1 260 if( mbedtls_ecp_is_zero( &R ) )
gustavatmel 1:9c5af431a1f1 261 {
gustavatmel 1:9c5af431a1f1 262 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
gustavatmel 1:9c5af431a1f1 263 goto cleanup;
gustavatmel 1:9c5af431a1f1 264 }
gustavatmel 1:9c5af431a1f1 265
gustavatmel 1:9c5af431a1f1 266 /*
gustavatmel 1:9c5af431a1f1 267 * Step 6: convert xR to an integer (no-op)
gustavatmel 1:9c5af431a1f1 268 * Step 7: reduce xR mod n (gives v)
gustavatmel 1:9c5af431a1f1 269 */
gustavatmel 1:9c5af431a1f1 270 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
gustavatmel 1:9c5af431a1f1 271
gustavatmel 1:9c5af431a1f1 272 /*
gustavatmel 1:9c5af431a1f1 273 * Step 8: check if v (that is, R.X) is equal to r
gustavatmel 1:9c5af431a1f1 274 */
gustavatmel 1:9c5af431a1f1 275 if( mbedtls_mpi_cmp_mpi( &R.X, r ) != 0 )
gustavatmel 1:9c5af431a1f1 276 {
gustavatmel 1:9c5af431a1f1 277 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
gustavatmel 1:9c5af431a1f1 278 goto cleanup;
gustavatmel 1:9c5af431a1f1 279 }
gustavatmel 1:9c5af431a1f1 280
gustavatmel 1:9c5af431a1f1 281 cleanup:
gustavatmel 1:9c5af431a1f1 282 mbedtls_ecp_point_free( &R );
gustavatmel 1:9c5af431a1f1 283 mbedtls_mpi_free( &e ); mbedtls_mpi_free( &s_inv ); mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
gustavatmel 1:9c5af431a1f1 284
gustavatmel 1:9c5af431a1f1 285 return( ret );
gustavatmel 1:9c5af431a1f1 286 }
gustavatmel 1:9c5af431a1f1 287 #endif /* MBEDTLS_ECDSA_VERIFY_ALT */
gustavatmel 1:9c5af431a1f1 288
gustavatmel 1:9c5af431a1f1 289 /*
gustavatmel 1:9c5af431a1f1 290 * Convert a signature (given by context) to ASN.1
gustavatmel 1:9c5af431a1f1 291 */
gustavatmel 1:9c5af431a1f1 292 static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
gustavatmel 1:9c5af431a1f1 293 unsigned char *sig, size_t *slen )
gustavatmel 1:9c5af431a1f1 294 {
gustavatmel 1:9c5af431a1f1 295 int ret;
gustavatmel 1:9c5af431a1f1 296 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
gustavatmel 1:9c5af431a1f1 297 unsigned char *p = buf + sizeof( buf );
gustavatmel 1:9c5af431a1f1 298 size_t len = 0;
gustavatmel 1:9c5af431a1f1 299
gustavatmel 1:9c5af431a1f1 300 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, s ) );
gustavatmel 1:9c5af431a1f1 301 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, r ) );
gustavatmel 1:9c5af431a1f1 302
gustavatmel 1:9c5af431a1f1 303 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, len ) );
gustavatmel 1:9c5af431a1f1 304 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
gustavatmel 1:9c5af431a1f1 305 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
gustavatmel 1:9c5af431a1f1 306
gustavatmel 1:9c5af431a1f1 307 memcpy( sig, p, len );
gustavatmel 1:9c5af431a1f1 308 *slen = len;
gustavatmel 1:9c5af431a1f1 309
gustavatmel 1:9c5af431a1f1 310 return( 0 );
gustavatmel 1:9c5af431a1f1 311 }
gustavatmel 1:9c5af431a1f1 312
gustavatmel 1:9c5af431a1f1 313 /*
gustavatmel 1:9c5af431a1f1 314 * Compute and write signature
gustavatmel 1:9c5af431a1f1 315 */
gustavatmel 1:9c5af431a1f1 316 int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, mbedtls_md_type_t md_alg,
gustavatmel 1:9c5af431a1f1 317 const unsigned char *hash, size_t hlen,
gustavatmel 1:9c5af431a1f1 318 unsigned char *sig, size_t *slen,
gustavatmel 1:9c5af431a1f1 319 int (*f_rng)(void *, unsigned char *, size_t),
gustavatmel 1:9c5af431a1f1 320 void *p_rng )
gustavatmel 1:9c5af431a1f1 321 {
gustavatmel 1:9c5af431a1f1 322 int ret;
gustavatmel 1:9c5af431a1f1 323 mbedtls_mpi r, s;
gustavatmel 1:9c5af431a1f1 324
gustavatmel 1:9c5af431a1f1 325 mbedtls_mpi_init( &r );
gustavatmel 1:9c5af431a1f1 326 mbedtls_mpi_init( &s );
gustavatmel 1:9c5af431a1f1 327
gustavatmel 1:9c5af431a1f1 328 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
gustavatmel 1:9c5af431a1f1 329 (void) f_rng;
gustavatmel 1:9c5af431a1f1 330 (void) p_rng;
gustavatmel 1:9c5af431a1f1 331
gustavatmel 1:9c5af431a1f1 332 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ctx->grp, &r, &s, &ctx->d,
gustavatmel 1:9c5af431a1f1 333 hash, hlen, md_alg ) );
gustavatmel 1:9c5af431a1f1 334 #else
gustavatmel 1:9c5af431a1f1 335 (void) md_alg;
gustavatmel 1:9c5af431a1f1 336
gustavatmel 1:9c5af431a1f1 337 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ctx->grp, &r, &s, &ctx->d,
gustavatmel 1:9c5af431a1f1 338 hash, hlen, f_rng, p_rng ) );
gustavatmel 1:9c5af431a1f1 339 #endif
gustavatmel 1:9c5af431a1f1 340
gustavatmel 1:9c5af431a1f1 341 MBEDTLS_MPI_CHK( ecdsa_signature_to_asn1( &r, &s, sig, slen ) );
gustavatmel 1:9c5af431a1f1 342
gustavatmel 1:9c5af431a1f1 343 cleanup:
gustavatmel 1:9c5af431a1f1 344 mbedtls_mpi_free( &r );
gustavatmel 1:9c5af431a1f1 345 mbedtls_mpi_free( &s );
gustavatmel 1:9c5af431a1f1 346
gustavatmel 1:9c5af431a1f1 347 return( ret );
gustavatmel 1:9c5af431a1f1 348 }
gustavatmel 1:9c5af431a1f1 349
gustavatmel 1:9c5af431a1f1 350 #if ! defined(MBEDTLS_DEPRECATED_REMOVED) && \
gustavatmel 1:9c5af431a1f1 351 defined(MBEDTLS_ECDSA_DETERMINISTIC)
gustavatmel 1:9c5af431a1f1 352 int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
gustavatmel 1:9c5af431a1f1 353 const unsigned char *hash, size_t hlen,
gustavatmel 1:9c5af431a1f1 354 unsigned char *sig, size_t *slen,
gustavatmel 1:9c5af431a1f1 355 mbedtls_md_type_t md_alg )
gustavatmel 1:9c5af431a1f1 356 {
gustavatmel 1:9c5af431a1f1 357 return( mbedtls_ecdsa_write_signature( ctx, md_alg, hash, hlen, sig, slen,
gustavatmel 1:9c5af431a1f1 358 NULL, NULL ) );
gustavatmel 1:9c5af431a1f1 359 }
gustavatmel 1:9c5af431a1f1 360 #endif
gustavatmel 1:9c5af431a1f1 361
gustavatmel 1:9c5af431a1f1 362 /*
gustavatmel 1:9c5af431a1f1 363 * Read and check signature
gustavatmel 1:9c5af431a1f1 364 */
gustavatmel 1:9c5af431a1f1 365 int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
gustavatmel 1:9c5af431a1f1 366 const unsigned char *hash, size_t hlen,
gustavatmel 1:9c5af431a1f1 367 const unsigned char *sig, size_t slen )
gustavatmel 1:9c5af431a1f1 368 {
gustavatmel 1:9c5af431a1f1 369 int ret;
gustavatmel 1:9c5af431a1f1 370 unsigned char *p = (unsigned char *) sig;
gustavatmel 1:9c5af431a1f1 371 const unsigned char *end = sig + slen;
gustavatmel 1:9c5af431a1f1 372 size_t len;
gustavatmel 1:9c5af431a1f1 373 mbedtls_mpi r, s;
gustavatmel 1:9c5af431a1f1 374
gustavatmel 1:9c5af431a1f1 375 mbedtls_mpi_init( &r );
gustavatmel 1:9c5af431a1f1 376 mbedtls_mpi_init( &s );
gustavatmel 1:9c5af431a1f1 377
gustavatmel 1:9c5af431a1f1 378 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
gustavatmel 1:9c5af431a1f1 379 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
gustavatmel 1:9c5af431a1f1 380 {
gustavatmel 1:9c5af431a1f1 381 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
gustavatmel 1:9c5af431a1f1 382 goto cleanup;
gustavatmel 1:9c5af431a1f1 383 }
gustavatmel 1:9c5af431a1f1 384
gustavatmel 1:9c5af431a1f1 385 if( p + len != end )
gustavatmel 1:9c5af431a1f1 386 {
gustavatmel 1:9c5af431a1f1 387 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA +
gustavatmel 1:9c5af431a1f1 388 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
gustavatmel 1:9c5af431a1f1 389 goto cleanup;
gustavatmel 1:9c5af431a1f1 390 }
gustavatmel 1:9c5af431a1f1 391
gustavatmel 1:9c5af431a1f1 392 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &r ) ) != 0 ||
gustavatmel 1:9c5af431a1f1 393 ( ret = mbedtls_asn1_get_mpi( &p, end, &s ) ) != 0 )
gustavatmel 1:9c5af431a1f1 394 {
gustavatmel 1:9c5af431a1f1 395 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
gustavatmel 1:9c5af431a1f1 396 goto cleanup;
gustavatmel 1:9c5af431a1f1 397 }
gustavatmel 1:9c5af431a1f1 398
gustavatmel 1:9c5af431a1f1 399 if( ( ret = mbedtls_ecdsa_verify( &ctx->grp, hash, hlen,
gustavatmel 1:9c5af431a1f1 400 &ctx->Q, &r, &s ) ) != 0 )
gustavatmel 1:9c5af431a1f1 401 goto cleanup;
gustavatmel 1:9c5af431a1f1 402
gustavatmel 1:9c5af431a1f1 403 if( p != end )
gustavatmel 1:9c5af431a1f1 404 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
gustavatmel 1:9c5af431a1f1 405
gustavatmel 1:9c5af431a1f1 406 cleanup:
gustavatmel 1:9c5af431a1f1 407 mbedtls_mpi_free( &r );
gustavatmel 1:9c5af431a1f1 408 mbedtls_mpi_free( &s );
gustavatmel 1:9c5af431a1f1 409
gustavatmel 1:9c5af431a1f1 410 return( ret );
gustavatmel 1:9c5af431a1f1 411 }
gustavatmel 1:9c5af431a1f1 412
gustavatmel 1:9c5af431a1f1 413 #if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
gustavatmel 1:9c5af431a1f1 414 /*
gustavatmel 1:9c5af431a1f1 415 * Generate key pair
gustavatmel 1:9c5af431a1f1 416 */
gustavatmel 1:9c5af431a1f1 417 int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
gustavatmel 1:9c5af431a1f1 418 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
gustavatmel 1:9c5af431a1f1 419 {
gustavatmel 1:9c5af431a1f1 420 return( mbedtls_ecp_group_load( &ctx->grp, gid ) ||
gustavatmel 1:9c5af431a1f1 421 mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
gustavatmel 1:9c5af431a1f1 422 }
gustavatmel 1:9c5af431a1f1 423 #endif /* MBEDTLS_ECDSA_GENKEY_ALT */
gustavatmel 1:9c5af431a1f1 424
gustavatmel 1:9c5af431a1f1 425 /*
gustavatmel 1:9c5af431a1f1 426 * Set context from an mbedtls_ecp_keypair
gustavatmel 1:9c5af431a1f1 427 */
gustavatmel 1:9c5af431a1f1 428 int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key )
gustavatmel 1:9c5af431a1f1 429 {
gustavatmel 1:9c5af431a1f1 430 int ret;
gustavatmel 1:9c5af431a1f1 431
gustavatmel 1:9c5af431a1f1 432 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
gustavatmel 1:9c5af431a1f1 433 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 ||
gustavatmel 1:9c5af431a1f1 434 ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
gustavatmel 1:9c5af431a1f1 435 {
gustavatmel 1:9c5af431a1f1 436 mbedtls_ecdsa_free( ctx );
gustavatmel 1:9c5af431a1f1 437 }
gustavatmel 1:9c5af431a1f1 438
gustavatmel 1:9c5af431a1f1 439 return( ret );
gustavatmel 1:9c5af431a1f1 440 }
gustavatmel 1:9c5af431a1f1 441
gustavatmel 1:9c5af431a1f1 442 /*
gustavatmel 1:9c5af431a1f1 443 * Initialize context
gustavatmel 1:9c5af431a1f1 444 */
gustavatmel 1:9c5af431a1f1 445 void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx )
gustavatmel 1:9c5af431a1f1 446 {
gustavatmel 1:9c5af431a1f1 447 mbedtls_ecp_keypair_init( ctx );
gustavatmel 1:9c5af431a1f1 448 }
gustavatmel 1:9c5af431a1f1 449
gustavatmel 1:9c5af431a1f1 450 /*
gustavatmel 1:9c5af431a1f1 451 * Free context
gustavatmel 1:9c5af431a1f1 452 */
gustavatmel 1:9c5af431a1f1 453 void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx )
gustavatmel 1:9c5af431a1f1 454 {
gustavatmel 1:9c5af431a1f1 455 mbedtls_ecp_keypair_free( ctx );
gustavatmel 1:9c5af431a1f1 456 }
gustavatmel 1:9c5af431a1f1 457
gustavatmel 1:9c5af431a1f1 458 #endif /* MBEDTLS_ECDSA_C */