MultiTech / CyaSSL

A library for setting up Secure Socket Layer (SSL) connections and verifying remote hosts using certificates. Contains only the source files for mbed platform implementation of the library.

Dependents:   HTTPClient-SSL HTTPClient-SSL HTTPClient-SSL HTTPClient-SSL

ctaocrypt/src/dsa.c@6:cf58d49e1a86, 2015-03-23 (annotated)

Committer:
Mike Fiore
Date:
Mon Mar 23 16:51:07 2015 -0500
Revision:
6:cf58d49e1a86
Parent:
0:b86d15c6ba29 
fix whitespace in sha512.c

Who changed what in which revision?

UserRevisionLine numberNew contents of line
Vanger 0:b86d15c6ba29 1 /* dsa.c
Vanger 0:b86d15c6ba29 2 *
Vanger 0:b86d15c6ba29 3 * Copyright (C) 2006-2014 wolfSSL Inc.
Vanger 0:b86d15c6ba29 4 *
Vanger 0:b86d15c6ba29 5 * This file is part of CyaSSL.
Vanger 0:b86d15c6ba29 6 *
Vanger 0:b86d15c6ba29 7 * CyaSSL is free software; you can redistribute it and/or modify
Vanger 0:b86d15c6ba29 8 * it under the terms of the GNU General Public License as published by
Vanger 0:b86d15c6ba29 9 * the Free Software Foundation; either version 2 of the License, or
Vanger 0:b86d15c6ba29 10 * (at your option) any later version.
Vanger 0:b86d15c6ba29 11 *
Vanger 0:b86d15c6ba29 12 * CyaSSL is distributed in the hope that it will be useful,
Vanger 0:b86d15c6ba29 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
Vanger 0:b86d15c6ba29 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
Vanger 0:b86d15c6ba29 15 * GNU General Public License for more details.
Vanger 0:b86d15c6ba29 16 *
Vanger 0:b86d15c6ba29 17 * You should have received a copy of the GNU General Public License
Vanger 0:b86d15c6ba29 18 * along with this program; if not, write to the Free Software
Vanger 0:b86d15c6ba29 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
Vanger 0:b86d15c6ba29 20 */
Vanger 0:b86d15c6ba29 21
Vanger 0:b86d15c6ba29 22 #ifdef HAVE_CONFIG_H
Vanger 0:b86d15c6ba29 23 #include <config.h>
Vanger 0:b86d15c6ba29 24 #endif
Vanger 0:b86d15c6ba29 25
Vanger 0:b86d15c6ba29 26 #include <cyassl/ctaocrypt/settings.h>
Vanger 0:b86d15c6ba29 27
Vanger 0:b86d15c6ba29 28 #ifndef NO_DSA
Vanger 0:b86d15c6ba29 29
Vanger 0:b86d15c6ba29 30 #include <cyassl/ctaocrypt/dsa.h>
Vanger 0:b86d15c6ba29 31 #include <cyassl/ctaocrypt/sha.h>
Vanger 0:b86d15c6ba29 32 #include <cyassl/ctaocrypt/random.h>
Vanger 0:b86d15c6ba29 33 #include <cyassl/ctaocrypt/error-crypt.h>
Vanger 0:b86d15c6ba29 34
Vanger 0:b86d15c6ba29 35
Vanger 0:b86d15c6ba29 36 enum {
Vanger 0:b86d15c6ba29 37 DSA_HALF_SIZE = 20, /* r and s size */
Vanger 0:b86d15c6ba29 38 DSA_SIG_SIZE = 40 /* signature size */
Vanger 0:b86d15c6ba29 39 };
Vanger 0:b86d15c6ba29 40
Vanger 0:b86d15c6ba29 41
Vanger 0:b86d15c6ba29 42 #ifndef min
Vanger 0:b86d15c6ba29 43
Vanger 0:b86d15c6ba29 44 static INLINE word32 min(word32 a, word32 b)
Vanger 0:b86d15c6ba29 45 {
Vanger 0:b86d15c6ba29 46 return a > b ? b : a;
Vanger 0:b86d15c6ba29 47 }
Vanger 0:b86d15c6ba29 48
Vanger 0:b86d15c6ba29 49 #endif /* min */
Vanger 0:b86d15c6ba29 50
Vanger 0:b86d15c6ba29 51
Vanger 0:b86d15c6ba29 52 void InitDsaKey(DsaKey* key)
Vanger 0:b86d15c6ba29 53 {
Vanger 0:b86d15c6ba29 54 key->type = -1; /* haven't decided yet */
Vanger 0:b86d15c6ba29 55
Vanger 0:b86d15c6ba29 56 /* TomsFastMath doesn't use memory allocation */
Vanger 0:b86d15c6ba29 57 #ifndef USE_FAST_MATH
Vanger 0:b86d15c6ba29 58 key->p.dp = 0; /* public alloc parts */
Vanger 0:b86d15c6ba29 59 key->q.dp = 0;
Vanger 0:b86d15c6ba29 60 key->g.dp = 0;
Vanger 0:b86d15c6ba29 61 key->y.dp = 0;
Vanger 0:b86d15c6ba29 62
Vanger 0:b86d15c6ba29 63 key->x.dp = 0; /* private alloc parts */
Vanger 0:b86d15c6ba29 64 #endif
Vanger 0:b86d15c6ba29 65 }
Vanger 0:b86d15c6ba29 66
Vanger 0:b86d15c6ba29 67
Vanger 0:b86d15c6ba29 68 void FreeDsaKey(DsaKey* key)
Vanger 0:b86d15c6ba29 69 {
Vanger 0:b86d15c6ba29 70 (void)key;
Vanger 0:b86d15c6ba29 71 /* TomsFastMath doesn't use memory allocation */
Vanger 0:b86d15c6ba29 72 #ifndef USE_FAST_MATH
Vanger 0:b86d15c6ba29 73 if (key->type == DSA_PRIVATE)
Vanger 0:b86d15c6ba29 74 mp_clear(&key->x);
Vanger 0:b86d15c6ba29 75 mp_clear(&key->y);
Vanger 0:b86d15c6ba29 76 mp_clear(&key->g);
Vanger 0:b86d15c6ba29 77 mp_clear(&key->q);
Vanger 0:b86d15c6ba29 78 mp_clear(&key->p);
Vanger 0:b86d15c6ba29 79 #endif
Vanger 0:b86d15c6ba29 80 }
Vanger 0:b86d15c6ba29 81
Vanger 0:b86d15c6ba29 82
Vanger 0:b86d15c6ba29 83 int DsaSign(const byte* digest, byte* out, DsaKey* key, RNG* rng)
Vanger 0:b86d15c6ba29 84 {
Vanger 0:b86d15c6ba29 85 mp_int k, kInv, r, s, H;
Vanger 0:b86d15c6ba29 86 int ret, sz;
Vanger 0:b86d15c6ba29 87 byte buffer[DSA_HALF_SIZE];
Vanger 0:b86d15c6ba29 88
Vanger 0:b86d15c6ba29 89 sz = min(sizeof(buffer), mp_unsigned_bin_size(&key->q));
Vanger 0:b86d15c6ba29 90
Vanger 0:b86d15c6ba29 91 /* generate k */
Vanger 0:b86d15c6ba29 92 ret = RNG_GenerateBlock(rng, buffer, sz);
Vanger 0:b86d15c6ba29 93 if (ret != 0)
Vanger 0:b86d15c6ba29 94 return ret;
Vanger 0:b86d15c6ba29 95
Vanger 0:b86d15c6ba29 96 buffer[0] |= 0x0C;
Vanger 0:b86d15c6ba29 97
Vanger 0:b86d15c6ba29 98 if (mp_init_multi(&k, &kInv, &r, &s, &H, 0) != MP_OKAY)
Vanger 0:b86d15c6ba29 99 return MP_INIT_E;
Vanger 0:b86d15c6ba29 100
Vanger 0:b86d15c6ba29 101 if (mp_read_unsigned_bin(&k, buffer, sz) != MP_OKAY)
Vanger 0:b86d15c6ba29 102 ret = MP_READ_E;
Vanger 0:b86d15c6ba29 103
Vanger 0:b86d15c6ba29 104 if (ret == 0 && mp_cmp_d(&k, 1) != MP_GT)
Vanger 0:b86d15c6ba29 105 ret = MP_CMP_E;
Vanger 0:b86d15c6ba29 106
Vanger 0:b86d15c6ba29 107 /* inverse k mod q */
Vanger 0:b86d15c6ba29 108 if (ret == 0 && mp_invmod(&k, &key->q, &kInv) != MP_OKAY)
Vanger 0:b86d15c6ba29 109 ret = MP_INVMOD_E;
Vanger 0:b86d15c6ba29 110
Vanger 0:b86d15c6ba29 111 /* generate r, r = (g exp k mod p) mod q */
Vanger 0:b86d15c6ba29 112 if (ret == 0 && mp_exptmod(&key->g, &k, &key->p, &r) != MP_OKAY)
Vanger 0:b86d15c6ba29 113 ret = MP_EXPTMOD_E;
Vanger 0:b86d15c6ba29 114
Vanger 0:b86d15c6ba29 115 if (ret == 0 && mp_mod(&r, &key->q, &r) != MP_OKAY)
Vanger 0:b86d15c6ba29 116 ret = MP_MOD_E;
Vanger 0:b86d15c6ba29 117
Vanger 0:b86d15c6ba29 118 /* generate H from sha digest */
Vanger 0:b86d15c6ba29 119 if (ret == 0 && mp_read_unsigned_bin(&H, digest,SHA_DIGEST_SIZE) != MP_OKAY)
Vanger 0:b86d15c6ba29 120 ret = MP_READ_E;
Vanger 0:b86d15c6ba29 121
Vanger 0:b86d15c6ba29 122 /* generate s, s = (kInv * (H + x*r)) % q */
Vanger 0:b86d15c6ba29 123 if (ret == 0 && mp_mul(&key->x, &r, &s) != MP_OKAY)
Vanger 0:b86d15c6ba29 124 ret = MP_MUL_E;
Vanger 0:b86d15c6ba29 125
Vanger 0:b86d15c6ba29 126 if (ret == 0 && mp_add(&s, &H, &s) != MP_OKAY)
Vanger 0:b86d15c6ba29 127 ret = MP_ADD_E;
Vanger 0:b86d15c6ba29 128
Vanger 0:b86d15c6ba29 129 if (ret == 0 && mp_mulmod(&s, &kInv, &key->q, &s) != MP_OKAY)
Vanger 0:b86d15c6ba29 130 ret = MP_MULMOD_E;
Vanger 0:b86d15c6ba29 131
Vanger 0:b86d15c6ba29 132 /* write out */
Vanger 0:b86d15c6ba29 133 if (ret == 0) {
Vanger 0:b86d15c6ba29 134 int rSz = mp_unsigned_bin_size(&r);
Vanger 0:b86d15c6ba29 135 int sSz = mp_unsigned_bin_size(&s);
Vanger 0:b86d15c6ba29 136
Vanger 0:b86d15c6ba29 137 if (rSz == DSA_HALF_SIZE - 1) {
Vanger 0:b86d15c6ba29 138 out[0] = 0;
Vanger 0:b86d15c6ba29 139 out++;
Vanger 0:b86d15c6ba29 140 }
Vanger 0:b86d15c6ba29 141
Vanger 0:b86d15c6ba29 142 if (mp_to_unsigned_bin(&r, out) != MP_OKAY)
Vanger 0:b86d15c6ba29 143 ret = MP_TO_E;
Vanger 0:b86d15c6ba29 144 else {
Vanger 0:b86d15c6ba29 145 if (sSz == DSA_HALF_SIZE - 1) {
Vanger 0:b86d15c6ba29 146 out[rSz] = 0;
Vanger 0:b86d15c6ba29 147 out++;
Vanger 0:b86d15c6ba29 148 }
Vanger 0:b86d15c6ba29 149 ret = mp_to_unsigned_bin(&s, out + rSz);
Vanger 0:b86d15c6ba29 150 }
Vanger 0:b86d15c6ba29 151 }
Vanger 0:b86d15c6ba29 152
Vanger 0:b86d15c6ba29 153 mp_clear(&H);
Vanger 0:b86d15c6ba29 154 mp_clear(&s);
Vanger 0:b86d15c6ba29 155 mp_clear(&r);
Vanger 0:b86d15c6ba29 156 mp_clear(&kInv);
Vanger 0:b86d15c6ba29 157 mp_clear(&k);
Vanger 0:b86d15c6ba29 158
Vanger 0:b86d15c6ba29 159 return ret;
Vanger 0:b86d15c6ba29 160 }
Vanger 0:b86d15c6ba29 161
Vanger 0:b86d15c6ba29 162
Vanger 0:b86d15c6ba29 163 int DsaVerify(const byte* digest, const byte* sig, DsaKey* key, int* answer)
Vanger 0:b86d15c6ba29 164 {
Vanger 0:b86d15c6ba29 165 mp_int w, u1, u2, v, r, s;
Vanger 0:b86d15c6ba29 166 int ret = 0;
Vanger 0:b86d15c6ba29 167
Vanger 0:b86d15c6ba29 168 if (mp_init_multi(&w, &u1, &u2, &v, &r, &s) != MP_OKAY)
Vanger 0:b86d15c6ba29 169 return MP_INIT_E;
Vanger 0:b86d15c6ba29 170
Vanger 0:b86d15c6ba29 171 /* set r and s from signature */
Vanger 0:b86d15c6ba29 172 if (mp_read_unsigned_bin(&r, sig, DSA_HALF_SIZE) != MP_OKAY ||
Vanger 0:b86d15c6ba29 173 mp_read_unsigned_bin(&s, sig + DSA_HALF_SIZE, DSA_HALF_SIZE) != MP_OKAY)
Vanger 0:b86d15c6ba29 174 ret = MP_READ_E;
Vanger 0:b86d15c6ba29 175
Vanger 0:b86d15c6ba29 176 /* sanity checks */
Vanger 0:b86d15c6ba29 177
Vanger 0:b86d15c6ba29 178
Vanger 0:b86d15c6ba29 179 /* put H into u1 from sha digest */
Vanger 0:b86d15c6ba29 180 if (ret == 0 && mp_read_unsigned_bin(&u1,digest,SHA_DIGEST_SIZE) != MP_OKAY)
Vanger 0:b86d15c6ba29 181 ret = MP_READ_E;
Vanger 0:b86d15c6ba29 182
Vanger 0:b86d15c6ba29 183 /* w = s invmod q */
Vanger 0:b86d15c6ba29 184 if (ret == 0 && mp_invmod(&s, &key->q, &w) != MP_OKAY)
Vanger 0:b86d15c6ba29 185 ret = MP_INVMOD_E;
Vanger 0:b86d15c6ba29 186
Vanger 0:b86d15c6ba29 187 /* u1 = (H * w) % q */
Vanger 0:b86d15c6ba29 188 if (ret == 0 && mp_mulmod(&u1, &w, &key->q, &u1) != MP_OKAY)
Vanger 0:b86d15c6ba29 189 ret = MP_MULMOD_E;
Vanger 0:b86d15c6ba29 190
Vanger 0:b86d15c6ba29 191 /* u2 = (r * w) % q */
Vanger 0:b86d15c6ba29 192 if (ret == 0 && mp_mulmod(&r, &w, &key->q, &u2) != MP_OKAY)
Vanger 0:b86d15c6ba29 193 ret = MP_MULMOD_E;
Vanger 0:b86d15c6ba29 194
Vanger 0:b86d15c6ba29 195 /* verify v = ((g^u1 * y^u2) mod p) mod q */
Vanger 0:b86d15c6ba29 196 if (ret == 0 && mp_exptmod(&key->g, &u1, &key->p, &u1) != MP_OKAY)
Vanger 0:b86d15c6ba29 197 ret = MP_EXPTMOD_E;
Vanger 0:b86d15c6ba29 198
Vanger 0:b86d15c6ba29 199 if (ret == 0 && mp_exptmod(&key->y, &u2, &key->p, &u2) != MP_OKAY)
Vanger 0:b86d15c6ba29 200 ret = MP_EXPTMOD_E;
Vanger 0:b86d15c6ba29 201
Vanger 0:b86d15c6ba29 202 if (ret == 0 && mp_mulmod(&u1, &u2, &key->p, &v) != MP_OKAY)
Vanger 0:b86d15c6ba29 203 ret = MP_MULMOD_E;
Vanger 0:b86d15c6ba29 204
Vanger 0:b86d15c6ba29 205 if (ret == 0 && mp_mod(&v, &key->q, &v) != MP_OKAY)
Vanger 0:b86d15c6ba29 206 ret = MP_MULMOD_E;
Vanger 0:b86d15c6ba29 207
Vanger 0:b86d15c6ba29 208 /* do they match */
Vanger 0:b86d15c6ba29 209 if (ret == 0 && mp_cmp(&r, &v) == MP_EQ)
Vanger 0:b86d15c6ba29 210 *answer = 1;
Vanger 0:b86d15c6ba29 211 else
Vanger 0:b86d15c6ba29 212 *answer = 0;
Vanger 0:b86d15c6ba29 213
Vanger 0:b86d15c6ba29 214 mp_clear(&s);
Vanger 0:b86d15c6ba29 215 mp_clear(&r);
Vanger 0:b86d15c6ba29 216 mp_clear(&u1);
Vanger 0:b86d15c6ba29 217 mp_clear(&u2);
Vanger 0:b86d15c6ba29 218 mp_clear(&w);
Vanger 0:b86d15c6ba29 219 mp_clear(&v);
Vanger 0:b86d15c6ba29 220
Vanger 0:b86d15c6ba29 221 return ret;
Vanger 0:b86d15c6ba29 222 }
Vanger 0:b86d15c6ba29 223
Vanger 0:b86d15c6ba29 224
Vanger 0:b86d15c6ba29 225 #endif /* NO_DSA */
Vanger 0:b86d15c6ba29 226