Hannes Tschofenig / Mbed 2 deprecated aes-gcm-test-program

Example program to test AES-GCM functionality. Used for a workshop

Dependencies:   mbed

SSL/library/ecdsa.c@0:796d0f61a05b, 2018-09-27 (annotated)

Committer:
HannesTschofenig
Date:
Thu Sep 27 06:34:22 2018 +0000
Revision:
0:796d0f61a05b
Example AES-GCM test program

Who changed what in which revision?

UserRevisionLine numberNew contents of line
HannesTschofenig 0:796d0f61a05b 1 /*
HannesTschofenig 0:796d0f61a05b 2 * Elliptic curve DSA
HannesTschofenig 0:796d0f61a05b 3 *
HannesTschofenig 0:796d0f61a05b 4 * Copyright (C) 2006-2014, Brainspark B.V.
HannesTschofenig 0:796d0f61a05b 5 *
HannesTschofenig 0:796d0f61a05b 6 * This file is part of PolarSSL (http://www.polarssl.org)
HannesTschofenig 0:796d0f61a05b 7 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
HannesTschofenig 0:796d0f61a05b 8 *
HannesTschofenig 0:796d0f61a05b 9 * All rights reserved.
HannesTschofenig 0:796d0f61a05b 10 *
HannesTschofenig 0:796d0f61a05b 11 * This program is free software; you can redistribute it and/or modify
HannesTschofenig 0:796d0f61a05b 12 * it under the terms of the GNU General Public License as published by
HannesTschofenig 0:796d0f61a05b 13 * the Free Software Foundation; either version 2 of the License, or
HannesTschofenig 0:796d0f61a05b 14 * (at your option) any later version.
HannesTschofenig 0:796d0f61a05b 15 *
HannesTschofenig 0:796d0f61a05b 16 * This program is distributed in the hope that it will be useful,
HannesTschofenig 0:796d0f61a05b 17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
HannesTschofenig 0:796d0f61a05b 18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
HannesTschofenig 0:796d0f61a05b 19 * GNU General Public License for more details.
HannesTschofenig 0:796d0f61a05b 20 *
HannesTschofenig 0:796d0f61a05b 21 * You should have received a copy of the GNU General Public License along
HannesTschofenig 0:796d0f61a05b 22 * with this program; if not, write to the Free Software Foundation, Inc.,
HannesTschofenig 0:796d0f61a05b 23 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
HannesTschofenig 0:796d0f61a05b 24 */
HannesTschofenig 0:796d0f61a05b 25
HannesTschofenig 0:796d0f61a05b 26 /*
HannesTschofenig 0:796d0f61a05b 27 * References:
HannesTschofenig 0:796d0f61a05b 28 *
HannesTschofenig 0:796d0f61a05b 29 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
HannesTschofenig 0:796d0f61a05b 30 */
HannesTschofenig 0:796d0f61a05b 31
HannesTschofenig 0:796d0f61a05b 32 #if !defined(POLARSSL_CONFIG_FILE)
HannesTschofenig 0:796d0f61a05b 33 #include "polarssl/config.h"
HannesTschofenig 0:796d0f61a05b 34 #else
HannesTschofenig 0:796d0f61a05b 35 #include POLARSSL_CONFIG_FILE
HannesTschofenig 0:796d0f61a05b 36 #endif
HannesTschofenig 0:796d0f61a05b 37
HannesTschofenig 0:796d0f61a05b 38 #if defined(POLARSSL_ECDSA_C)
HannesTschofenig 0:796d0f61a05b 39
HannesTschofenig 0:796d0f61a05b 40 #include "polarssl/ecdsa.h"
HannesTschofenig 0:796d0f61a05b 41 #include "polarssl/asn1write.h"
HannesTschofenig 0:796d0f61a05b 42
HannesTschofenig 0:796d0f61a05b 43 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
HannesTschofenig 0:796d0f61a05b 44 #include "polarssl/hmac_drbg.h"
HannesTschofenig 0:796d0f61a05b 45 #endif
HannesTschofenig 0:796d0f61a05b 46
HannesTschofenig 0:796d0f61a05b 47 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
HannesTschofenig 0:796d0f61a05b 48 /*
HannesTschofenig 0:796d0f61a05b 49 * This a hopefully temporary compatibility function.
HannesTschofenig 0:796d0f61a05b 50 *
HannesTschofenig 0:796d0f61a05b 51 * Since we can't ensure the caller will pass a valid md_alg before the next
HannesTschofenig 0:796d0f61a05b 52 * interface change, try to pick up a decent md by size.
HannesTschofenig 0:796d0f61a05b 53 *
HannesTschofenig 0:796d0f61a05b 54 * Argument is the minimum size in bytes of the MD output.
HannesTschofenig 0:796d0f61a05b 55 */
HannesTschofenig 0:796d0f61a05b 56 static const md_info_t *md_info_by_size( size_t min_size )
HannesTschofenig 0:796d0f61a05b 57 {
HannesTschofenig 0:796d0f61a05b 58 const md_info_t *md_cur, *md_picked = NULL;
HannesTschofenig 0:796d0f61a05b 59 const int *md_alg;
HannesTschofenig 0:796d0f61a05b 60
HannesTschofenig 0:796d0f61a05b 61 for( md_alg = md_list(); *md_alg != 0; md_alg++ )
HannesTschofenig 0:796d0f61a05b 62 {
HannesTschofenig 0:796d0f61a05b 63 if( ( md_cur = md_info_from_type( *md_alg ) ) == NULL ||
HannesTschofenig 0:796d0f61a05b 64 (size_t) md_cur->size < min_size ||
HannesTschofenig 0:796d0f61a05b 65 ( md_picked != NULL && md_cur->size > md_picked->size ) )
HannesTschofenig 0:796d0f61a05b 66 continue;
HannesTschofenig 0:796d0f61a05b 67
HannesTschofenig 0:796d0f61a05b 68 md_picked = md_cur;
HannesTschofenig 0:796d0f61a05b 69 }
HannesTschofenig 0:796d0f61a05b 70
HannesTschofenig 0:796d0f61a05b 71 return( md_picked );
HannesTschofenig 0:796d0f61a05b 72 }
HannesTschofenig 0:796d0f61a05b 73 #endif /* POLARSSL_ECDSA_DETERMINISTIC */
HannesTschofenig 0:796d0f61a05b 74
HannesTschofenig 0:796d0f61a05b 75 /*
HannesTschofenig 0:796d0f61a05b 76 * Derive a suitable integer for group grp from a buffer of length len
HannesTschofenig 0:796d0f61a05b 77 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
HannesTschofenig 0:796d0f61a05b 78 */
HannesTschofenig 0:796d0f61a05b 79 static int derive_mpi( const ecp_group *grp, mpi *x,
HannesTschofenig 0:796d0f61a05b 80 const unsigned char *buf, size_t blen )
HannesTschofenig 0:796d0f61a05b 81 {
HannesTschofenig 0:796d0f61a05b 82 int ret;
HannesTschofenig 0:796d0f61a05b 83 size_t n_size = (grp->nbits + 7) / 8;
HannesTschofenig 0:796d0f61a05b 84 size_t use_size = blen > n_size ? n_size : blen;
HannesTschofenig 0:796d0f61a05b 85
HannesTschofenig 0:796d0f61a05b 86 MPI_CHK( mpi_read_binary( x, buf, use_size ) );
HannesTschofenig 0:796d0f61a05b 87 if( use_size * 8 > grp->nbits )
HannesTschofenig 0:796d0f61a05b 88 MPI_CHK( mpi_shift_r( x, use_size * 8 - grp->nbits ) );
HannesTschofenig 0:796d0f61a05b 89
HannesTschofenig 0:796d0f61a05b 90 /* While at it, reduce modulo N */
HannesTschofenig 0:796d0f61a05b 91 if( mpi_cmp_mpi( x, &grp->N ) >= 0 )
HannesTschofenig 0:796d0f61a05b 92 MPI_CHK( mpi_sub_mpi( x, x, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 93
HannesTschofenig 0:796d0f61a05b 94 cleanup:
HannesTschofenig 0:796d0f61a05b 95 return( ret );
HannesTschofenig 0:796d0f61a05b 96 }
HannesTschofenig 0:796d0f61a05b 97
HannesTschofenig 0:796d0f61a05b 98 /*
HannesTschofenig 0:796d0f61a05b 99 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
HannesTschofenig 0:796d0f61a05b 100 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
HannesTschofenig 0:796d0f61a05b 101 */
HannesTschofenig 0:796d0f61a05b 102 int ecdsa_sign( ecp_group *grp, mpi *r, mpi *s,
HannesTschofenig 0:796d0f61a05b 103 const mpi *d, const unsigned char *buf, size_t blen,
HannesTschofenig 0:796d0f61a05b 104 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
HannesTschofenig 0:796d0f61a05b 105 {
HannesTschofenig 0:796d0f61a05b 106 int ret, key_tries, sign_tries, blind_tries;
HannesTschofenig 0:796d0f61a05b 107 ecp_point R;
HannesTschofenig 0:796d0f61a05b 108 mpi k, e, t;
HannesTschofenig 0:796d0f61a05b 109
HannesTschofenig 0:796d0f61a05b 110 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
HannesTschofenig 0:796d0f61a05b 111 if( grp->N.p == NULL )
HannesTschofenig 0:796d0f61a05b 112 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
HannesTschofenig 0:796d0f61a05b 113
HannesTschofenig 0:796d0f61a05b 114 ecp_point_init( &R );
HannesTschofenig 0:796d0f61a05b 115 mpi_init( &k ); mpi_init( &e ); mpi_init( &t );
HannesTschofenig 0:796d0f61a05b 116
HannesTschofenig 0:796d0f61a05b 117 sign_tries = 0;
HannesTschofenig 0:796d0f61a05b 118 do
HannesTschofenig 0:796d0f61a05b 119 {
HannesTschofenig 0:796d0f61a05b 120 /*
HannesTschofenig 0:796d0f61a05b 121 * Steps 1-3: generate a suitable ephemeral keypair
HannesTschofenig 0:796d0f61a05b 122 * and set r = xR mod n
HannesTschofenig 0:796d0f61a05b 123 */
HannesTschofenig 0:796d0f61a05b 124 key_tries = 0;
HannesTschofenig 0:796d0f61a05b 125 do
HannesTschofenig 0:796d0f61a05b 126 {
HannesTschofenig 0:796d0f61a05b 127 MPI_CHK( ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
HannesTschofenig 0:796d0f61a05b 128 MPI_CHK( mpi_mod_mpi( r, &R.X, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 129
HannesTschofenig 0:796d0f61a05b 130 if( key_tries++ > 10 )
HannesTschofenig 0:796d0f61a05b 131 {
HannesTschofenig 0:796d0f61a05b 132 ret = POLARSSL_ERR_ECP_RANDOM_FAILED;
HannesTschofenig 0:796d0f61a05b 133 goto cleanup;
HannesTschofenig 0:796d0f61a05b 134 }
HannesTschofenig 0:796d0f61a05b 135 }
HannesTschofenig 0:796d0f61a05b 136 while( mpi_cmp_int( r, 0 ) == 0 );
HannesTschofenig 0:796d0f61a05b 137
HannesTschofenig 0:796d0f61a05b 138 /*
HannesTschofenig 0:796d0f61a05b 139 * Step 5: derive MPI from hashed message
HannesTschofenig 0:796d0f61a05b 140 */
HannesTschofenig 0:796d0f61a05b 141 MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
HannesTschofenig 0:796d0f61a05b 142
HannesTschofenig 0:796d0f61a05b 143 /*
HannesTschofenig 0:796d0f61a05b 144 * Generate a random value to blind inv_mod in next step,
HannesTschofenig 0:796d0f61a05b 145 * avoiding a potential timing leak.
HannesTschofenig 0:796d0f61a05b 146 */
HannesTschofenig 0:796d0f61a05b 147 blind_tries = 0;
HannesTschofenig 0:796d0f61a05b 148 do
HannesTschofenig 0:796d0f61a05b 149 {
HannesTschofenig 0:796d0f61a05b 150 size_t n_size = (grp->nbits + 7) / 8;
HannesTschofenig 0:796d0f61a05b 151 MPI_CHK( mpi_fill_random( &t, n_size, f_rng, p_rng ) );
HannesTschofenig 0:796d0f61a05b 152 MPI_CHK( mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
HannesTschofenig 0:796d0f61a05b 153
HannesTschofenig 0:796d0f61a05b 154 /* See ecp_gen_keypair() */
HannesTschofenig 0:796d0f61a05b 155 if( ++blind_tries > 30 )
HannesTschofenig 0:796d0f61a05b 156 return( POLARSSL_ERR_ECP_RANDOM_FAILED );
HannesTschofenig 0:796d0f61a05b 157 }
HannesTschofenig 0:796d0f61a05b 158 while( mpi_cmp_int( &t, 1 ) < 0 ||
HannesTschofenig 0:796d0f61a05b 159 mpi_cmp_mpi( &t, &grp->N ) >= 0 );
HannesTschofenig 0:796d0f61a05b 160
HannesTschofenig 0:796d0f61a05b 161 /*
HannesTschofenig 0:796d0f61a05b 162 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
HannesTschofenig 0:796d0f61a05b 163 */
HannesTschofenig 0:796d0f61a05b 164 MPI_CHK( mpi_mul_mpi( s, r, d ) );
HannesTschofenig 0:796d0f61a05b 165 MPI_CHK( mpi_add_mpi( &e, &e, s ) );
HannesTschofenig 0:796d0f61a05b 166 MPI_CHK( mpi_mul_mpi( &e, &e, &t ) );
HannesTschofenig 0:796d0f61a05b 167 MPI_CHK( mpi_mul_mpi( &k, &k, &t ) );
HannesTschofenig 0:796d0f61a05b 168 MPI_CHK( mpi_inv_mod( s, &k, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 169 MPI_CHK( mpi_mul_mpi( s, s, &e ) );
HannesTschofenig 0:796d0f61a05b 170 MPI_CHK( mpi_mod_mpi( s, s, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 171
HannesTschofenig 0:796d0f61a05b 172 if( sign_tries++ > 10 )
HannesTschofenig 0:796d0f61a05b 173 {
HannesTschofenig 0:796d0f61a05b 174 ret = POLARSSL_ERR_ECP_RANDOM_FAILED;
HannesTschofenig 0:796d0f61a05b 175 goto cleanup;
HannesTschofenig 0:796d0f61a05b 176 }
HannesTschofenig 0:796d0f61a05b 177 }
HannesTschofenig 0:796d0f61a05b 178 while( mpi_cmp_int( s, 0 ) == 0 );
HannesTschofenig 0:796d0f61a05b 179
HannesTschofenig 0:796d0f61a05b 180 cleanup:
HannesTschofenig 0:796d0f61a05b 181 ecp_point_free( &R );
HannesTschofenig 0:796d0f61a05b 182 mpi_free( &k ); mpi_free( &e ); mpi_free( &t );
HannesTschofenig 0:796d0f61a05b 183
HannesTschofenig 0:796d0f61a05b 184 return( ret );
HannesTschofenig 0:796d0f61a05b 185 }
HannesTschofenig 0:796d0f61a05b 186
HannesTschofenig 0:796d0f61a05b 187 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
HannesTschofenig 0:796d0f61a05b 188 /*
HannesTschofenig 0:796d0f61a05b 189 * Deterministic signature wrapper
HannesTschofenig 0:796d0f61a05b 190 */
HannesTschofenig 0:796d0f61a05b 191 int ecdsa_sign_det( ecp_group *grp, mpi *r, mpi *s,
HannesTschofenig 0:796d0f61a05b 192 const mpi *d, const unsigned char *buf, size_t blen,
HannesTschofenig 0:796d0f61a05b 193 md_type_t md_alg )
HannesTschofenig 0:796d0f61a05b 194 {
HannesTschofenig 0:796d0f61a05b 195 int ret;
HannesTschofenig 0:796d0f61a05b 196 hmac_drbg_context rng_ctx;
HannesTschofenig 0:796d0f61a05b 197 unsigned char data[2 * POLARSSL_ECP_MAX_BYTES];
HannesTschofenig 0:796d0f61a05b 198 size_t grp_len = ( grp->nbits + 7 ) / 8;
HannesTschofenig 0:796d0f61a05b 199 const md_info_t *md_info;
HannesTschofenig 0:796d0f61a05b 200 mpi h;
HannesTschofenig 0:796d0f61a05b 201
HannesTschofenig 0:796d0f61a05b 202 /* Temporary fallback */
HannesTschofenig 0:796d0f61a05b 203 if( md_alg == POLARSSL_MD_NONE )
HannesTschofenig 0:796d0f61a05b 204 md_info = md_info_by_size( blen );
HannesTschofenig 0:796d0f61a05b 205 else
HannesTschofenig 0:796d0f61a05b 206 md_info = md_info_from_type( md_alg );
HannesTschofenig 0:796d0f61a05b 207
HannesTschofenig 0:796d0f61a05b 208 if( md_info == NULL )
HannesTschofenig 0:796d0f61a05b 209 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
HannesTschofenig 0:796d0f61a05b 210
HannesTschofenig 0:796d0f61a05b 211 mpi_init( &h );
HannesTschofenig 0:796d0f61a05b 212 memset( &rng_ctx, 0, sizeof( hmac_drbg_context ) );
HannesTschofenig 0:796d0f61a05b 213
HannesTschofenig 0:796d0f61a05b 214 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
HannesTschofenig 0:796d0f61a05b 215 MPI_CHK( mpi_write_binary( d, data, grp_len ) );
HannesTschofenig 0:796d0f61a05b 216 MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
HannesTschofenig 0:796d0f61a05b 217 MPI_CHK( mpi_write_binary( &h, data + grp_len, grp_len ) );
HannesTschofenig 0:796d0f61a05b 218 hmac_drbg_init_buf( &rng_ctx, md_info, data, 2 * grp_len );
HannesTschofenig 0:796d0f61a05b 219
HannesTschofenig 0:796d0f61a05b 220 ret = ecdsa_sign( grp, r, s, d, buf, blen,
HannesTschofenig 0:796d0f61a05b 221 hmac_drbg_random, &rng_ctx );
HannesTschofenig 0:796d0f61a05b 222
HannesTschofenig 0:796d0f61a05b 223 cleanup:
HannesTschofenig 0:796d0f61a05b 224 hmac_drbg_free( &rng_ctx );
HannesTschofenig 0:796d0f61a05b 225 mpi_free( &h );
HannesTschofenig 0:796d0f61a05b 226
HannesTschofenig 0:796d0f61a05b 227 return( ret );
HannesTschofenig 0:796d0f61a05b 228 }
HannesTschofenig 0:796d0f61a05b 229 #endif /* POLARSSL_ECDSA_DETERMINISTIC */
HannesTschofenig 0:796d0f61a05b 230
HannesTschofenig 0:796d0f61a05b 231 /*
HannesTschofenig 0:796d0f61a05b 232 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
HannesTschofenig 0:796d0f61a05b 233 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
HannesTschofenig 0:796d0f61a05b 234 */
HannesTschofenig 0:796d0f61a05b 235 int ecdsa_verify( ecp_group *grp,
HannesTschofenig 0:796d0f61a05b 236 const unsigned char *buf, size_t blen,
HannesTschofenig 0:796d0f61a05b 237 const ecp_point *Q, const mpi *r, const mpi *s)
HannesTschofenig 0:796d0f61a05b 238 {
HannesTschofenig 0:796d0f61a05b 239 int ret;
HannesTschofenig 0:796d0f61a05b 240 mpi e, s_inv, u1, u2;
HannesTschofenig 0:796d0f61a05b 241 ecp_point R, P;
HannesTschofenig 0:796d0f61a05b 242
HannesTschofenig 0:796d0f61a05b 243 ecp_point_init( &R ); ecp_point_init( &P );
HannesTschofenig 0:796d0f61a05b 244 mpi_init( &e ); mpi_init( &s_inv ); mpi_init( &u1 ); mpi_init( &u2 );
HannesTschofenig 0:796d0f61a05b 245
HannesTschofenig 0:796d0f61a05b 246 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
HannesTschofenig 0:796d0f61a05b 247 if( grp->N.p == NULL )
HannesTschofenig 0:796d0f61a05b 248 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
HannesTschofenig 0:796d0f61a05b 249
HannesTschofenig 0:796d0f61a05b 250 /*
HannesTschofenig 0:796d0f61a05b 251 * Step 1: make sure r and s are in range 1..n-1
HannesTschofenig 0:796d0f61a05b 252 */
HannesTschofenig 0:796d0f61a05b 253 if( mpi_cmp_int( r, 1 ) < 0 || mpi_cmp_mpi( r, &grp->N ) >= 0 ||
HannesTschofenig 0:796d0f61a05b 254 mpi_cmp_int( s, 1 ) < 0 || mpi_cmp_mpi( s, &grp->N ) >= 0 )
HannesTschofenig 0:796d0f61a05b 255 {
HannesTschofenig 0:796d0f61a05b 256 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
HannesTschofenig 0:796d0f61a05b 257 goto cleanup;
HannesTschofenig 0:796d0f61a05b 258 }
HannesTschofenig 0:796d0f61a05b 259
HannesTschofenig 0:796d0f61a05b 260 /*
HannesTschofenig 0:796d0f61a05b 261 * Additional precaution: make sure Q is valid
HannesTschofenig 0:796d0f61a05b 262 */
HannesTschofenig 0:796d0f61a05b 263 MPI_CHK( ecp_check_pubkey( grp, Q ) );
HannesTschofenig 0:796d0f61a05b 264
HannesTschofenig 0:796d0f61a05b 265 /*
HannesTschofenig 0:796d0f61a05b 266 * Step 3: derive MPI from hashed message
HannesTschofenig 0:796d0f61a05b 267 */
HannesTschofenig 0:796d0f61a05b 268 MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
HannesTschofenig 0:796d0f61a05b 269
HannesTschofenig 0:796d0f61a05b 270 /*
HannesTschofenig 0:796d0f61a05b 271 * Step 4: u1 = e / s mod n, u2 = r / s mod n
HannesTschofenig 0:796d0f61a05b 272 */
HannesTschofenig 0:796d0f61a05b 273 MPI_CHK( mpi_inv_mod( &s_inv, s, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 274
HannesTschofenig 0:796d0f61a05b 275 MPI_CHK( mpi_mul_mpi( &u1, &e, &s_inv ) );
HannesTschofenig 0:796d0f61a05b 276 MPI_CHK( mpi_mod_mpi( &u1, &u1, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 277
HannesTschofenig 0:796d0f61a05b 278 MPI_CHK( mpi_mul_mpi( &u2, r, &s_inv ) );
HannesTschofenig 0:796d0f61a05b 279 MPI_CHK( mpi_mod_mpi( &u2, &u2, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 280
HannesTschofenig 0:796d0f61a05b 281 /*
HannesTschofenig 0:796d0f61a05b 282 * Step 5: R = u1 G + u2 Q
HannesTschofenig 0:796d0f61a05b 283 *
HannesTschofenig 0:796d0f61a05b 284 * Since we're not using any secret data, no need to pass a RNG to
HannesTschofenig 0:796d0f61a05b 285 * ecp_mul() for countermesures.
HannesTschofenig 0:796d0f61a05b 286 */
HannesTschofenig 0:796d0f61a05b 287 MPI_CHK( ecp_mul( grp, &R, &u1, &grp->G, NULL, NULL ) );
HannesTschofenig 0:796d0f61a05b 288 MPI_CHK( ecp_mul( grp, &P, &u2, Q, NULL, NULL ) );
HannesTschofenig 0:796d0f61a05b 289 MPI_CHK( ecp_add( grp, &R, &R, &P ) );
HannesTschofenig 0:796d0f61a05b 290
HannesTschofenig 0:796d0f61a05b 291 if( ecp_is_zero( &R ) )
HannesTschofenig 0:796d0f61a05b 292 {
HannesTschofenig 0:796d0f61a05b 293 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
HannesTschofenig 0:796d0f61a05b 294 goto cleanup;
HannesTschofenig 0:796d0f61a05b 295 }
HannesTschofenig 0:796d0f61a05b 296
HannesTschofenig 0:796d0f61a05b 297 /*
HannesTschofenig 0:796d0f61a05b 298 * Step 6: convert xR to an integer (no-op)
HannesTschofenig 0:796d0f61a05b 299 * Step 7: reduce xR mod n (gives v)
HannesTschofenig 0:796d0f61a05b 300 */
HannesTschofenig 0:796d0f61a05b 301 MPI_CHK( mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
HannesTschofenig 0:796d0f61a05b 302
HannesTschofenig 0:796d0f61a05b 303 /*
HannesTschofenig 0:796d0f61a05b 304 * Step 8: check if v (that is, R.X) is equal to r
HannesTschofenig 0:796d0f61a05b 305 */
HannesTschofenig 0:796d0f61a05b 306 if( mpi_cmp_mpi( &R.X, r ) != 0 )
HannesTschofenig 0:796d0f61a05b 307 {
HannesTschofenig 0:796d0f61a05b 308 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
HannesTschofenig 0:796d0f61a05b 309 goto cleanup;
HannesTschofenig 0:796d0f61a05b 310 }
HannesTschofenig 0:796d0f61a05b 311
HannesTschofenig 0:796d0f61a05b 312 cleanup:
HannesTschofenig 0:796d0f61a05b 313 ecp_point_free( &R ); ecp_point_free( &P );
HannesTschofenig 0:796d0f61a05b 314 mpi_free( &e ); mpi_free( &s_inv ); mpi_free( &u1 ); mpi_free( &u2 );
HannesTschofenig 0:796d0f61a05b 315
HannesTschofenig 0:796d0f61a05b 316 return( ret );
HannesTschofenig 0:796d0f61a05b 317 }
HannesTschofenig 0:796d0f61a05b 318
HannesTschofenig 0:796d0f61a05b 319 /*
HannesTschofenig 0:796d0f61a05b 320 * RFC 4492 page 20:
HannesTschofenig 0:796d0f61a05b 321 *
HannesTschofenig 0:796d0f61a05b 322 * Ecdsa-Sig-Value ::= SEQUENCE {
HannesTschofenig 0:796d0f61a05b 323 * r INTEGER,
HannesTschofenig 0:796d0f61a05b 324 * s INTEGER
HannesTschofenig 0:796d0f61a05b 325 * }
HannesTschofenig 0:796d0f61a05b 326 *
HannesTschofenig 0:796d0f61a05b 327 * Size is at most
HannesTschofenig 0:796d0f61a05b 328 * 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
HannesTschofenig 0:796d0f61a05b 329 * twice that + 1 (tag) + 2 (len) for the sequence
HannesTschofenig 0:796d0f61a05b 330 * (assuming ECP_MAX_BYTES is less than 126 for r and s,
HannesTschofenig 0:796d0f61a05b 331 * and less than 124 (total len <= 255) for the sequence)
HannesTschofenig 0:796d0f61a05b 332 */
HannesTschofenig 0:796d0f61a05b 333 #if POLARSSL_ECP_MAX_BYTES > 124
HannesTschofenig 0:796d0f61a05b 334 #error "POLARSSL_ECP_MAX_BYTES bigger than expected, please fix MAX_SIG_LEN"
HannesTschofenig 0:796d0f61a05b 335 #endif
HannesTschofenig 0:796d0f61a05b 336 #define MAX_SIG_LEN ( 3 + 2 * ( 2 + POLARSSL_ECP_MAX_BYTES ) )
HannesTschofenig 0:796d0f61a05b 337
HannesTschofenig 0:796d0f61a05b 338 /*
HannesTschofenig 0:796d0f61a05b 339 * Convert a signature (given by context) to ASN.1
HannesTschofenig 0:796d0f61a05b 340 */
HannesTschofenig 0:796d0f61a05b 341 static int ecdsa_signature_to_asn1( ecdsa_context *ctx,
HannesTschofenig 0:796d0f61a05b 342 unsigned char *sig, size_t *slen )
HannesTschofenig 0:796d0f61a05b 343 {
HannesTschofenig 0:796d0f61a05b 344 int ret;
HannesTschofenig 0:796d0f61a05b 345 unsigned char buf[MAX_SIG_LEN];
HannesTschofenig 0:796d0f61a05b 346 unsigned char *p = buf + sizeof( buf );
HannesTschofenig 0:796d0f61a05b 347 size_t len = 0;
HannesTschofenig 0:796d0f61a05b 348
HannesTschofenig 0:796d0f61a05b 349 ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->s ) );
HannesTschofenig 0:796d0f61a05b 350 ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->r ) );
HannesTschofenig 0:796d0f61a05b 351
HannesTschofenig 0:796d0f61a05b 352 ASN1_CHK_ADD( len, asn1_write_len( &p, buf, len ) );
HannesTschofenig 0:796d0f61a05b 353 ASN1_CHK_ADD( len, asn1_write_tag( &p, buf,
HannesTschofenig 0:796d0f61a05b 354 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) );
HannesTschofenig 0:796d0f61a05b 355
HannesTschofenig 0:796d0f61a05b 356 memcpy( sig, p, len );
HannesTschofenig 0:796d0f61a05b 357 *slen = len;
HannesTschofenig 0:796d0f61a05b 358
HannesTschofenig 0:796d0f61a05b 359 return( 0 );
HannesTschofenig 0:796d0f61a05b 360 }
HannesTschofenig 0:796d0f61a05b 361
HannesTschofenig 0:796d0f61a05b 362 /*
HannesTschofenig 0:796d0f61a05b 363 * Compute and write signature
HannesTschofenig 0:796d0f61a05b 364 */
HannesTschofenig 0:796d0f61a05b 365 int ecdsa_write_signature( ecdsa_context *ctx,
HannesTschofenig 0:796d0f61a05b 366 const unsigned char *hash, size_t hlen,
HannesTschofenig 0:796d0f61a05b 367 unsigned char *sig, size_t *slen,
HannesTschofenig 0:796d0f61a05b 368 int (*f_rng)(void *, unsigned char *, size_t),
HannesTschofenig 0:796d0f61a05b 369 void *p_rng )
HannesTschofenig 0:796d0f61a05b 370 {
HannesTschofenig 0:796d0f61a05b 371 int ret;
HannesTschofenig 0:796d0f61a05b 372
HannesTschofenig 0:796d0f61a05b 373 if( ( ret = ecdsa_sign( &ctx->grp, &ctx->r, &ctx->s, &ctx->d,
HannesTschofenig 0:796d0f61a05b 374 hash, hlen, f_rng, p_rng ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 375 {
HannesTschofenig 0:796d0f61a05b 376 return( ret );
HannesTschofenig 0:796d0f61a05b 377 }
HannesTschofenig 0:796d0f61a05b 378
HannesTschofenig 0:796d0f61a05b 379 return( ecdsa_signature_to_asn1( ctx, sig, slen ) );
HannesTschofenig 0:796d0f61a05b 380 }
HannesTschofenig 0:796d0f61a05b 381
HannesTschofenig 0:796d0f61a05b 382 #if defined(POLARSSL_ECDSA_DETERMINISTIC)
HannesTschofenig 0:796d0f61a05b 383 /*
HannesTschofenig 0:796d0f61a05b 384 * Compute and write signature deterministically
HannesTschofenig 0:796d0f61a05b 385 */
HannesTschofenig 0:796d0f61a05b 386 int ecdsa_write_signature_det( ecdsa_context *ctx,
HannesTschofenig 0:796d0f61a05b 387 const unsigned char *hash, size_t hlen,
HannesTschofenig 0:796d0f61a05b 388 unsigned char *sig, size_t *slen,
HannesTschofenig 0:796d0f61a05b 389 md_type_t md_alg )
HannesTschofenig 0:796d0f61a05b 390 {
HannesTschofenig 0:796d0f61a05b 391 int ret;
HannesTschofenig 0:796d0f61a05b 392
HannesTschofenig 0:796d0f61a05b 393 if( ( ret = ecdsa_sign_det( &ctx->grp, &ctx->r, &ctx->s, &ctx->d,
HannesTschofenig 0:796d0f61a05b 394 hash, hlen, md_alg ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 395 {
HannesTschofenig 0:796d0f61a05b 396 return( ret );
HannesTschofenig 0:796d0f61a05b 397 }
HannesTschofenig 0:796d0f61a05b 398
HannesTschofenig 0:796d0f61a05b 399 return( ecdsa_signature_to_asn1( ctx, sig, slen ) );
HannesTschofenig 0:796d0f61a05b 400 }
HannesTschofenig 0:796d0f61a05b 401 #endif /* POLARSSL_ECDSA_DETERMINISTIC */
HannesTschofenig 0:796d0f61a05b 402
HannesTschofenig 0:796d0f61a05b 403 /*
HannesTschofenig 0:796d0f61a05b 404 * Read and check signature
HannesTschofenig 0:796d0f61a05b 405 */
HannesTschofenig 0:796d0f61a05b 406 int ecdsa_read_signature( ecdsa_context *ctx,
HannesTschofenig 0:796d0f61a05b 407 const unsigned char *hash, size_t hlen,
HannesTschofenig 0:796d0f61a05b 408 const unsigned char *sig, size_t slen )
HannesTschofenig 0:796d0f61a05b 409 {
HannesTschofenig 0:796d0f61a05b 410 int ret;
HannesTschofenig 0:796d0f61a05b 411 unsigned char *p = (unsigned char *) sig;
HannesTschofenig 0:796d0f61a05b 412 const unsigned char *end = sig + slen;
HannesTschofenig 0:796d0f61a05b 413 size_t len;
HannesTschofenig 0:796d0f61a05b 414
HannesTschofenig 0:796d0f61a05b 415 if( ( ret = asn1_get_tag( &p, end, &len,
HannesTschofenig 0:796d0f61a05b 416 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 417 {
HannesTschofenig 0:796d0f61a05b 418 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
HannesTschofenig 0:796d0f61a05b 419 }
HannesTschofenig 0:796d0f61a05b 420
HannesTschofenig 0:796d0f61a05b 421 if( p + len != end )
HannesTschofenig 0:796d0f61a05b 422 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA +
HannesTschofenig 0:796d0f61a05b 423 POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
HannesTschofenig 0:796d0f61a05b 424
HannesTschofenig 0:796d0f61a05b 425 if( ( ret = asn1_get_mpi( &p, end, &ctx->r ) ) != 0 ||
HannesTschofenig 0:796d0f61a05b 426 ( ret = asn1_get_mpi( &p, end, &ctx->s ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 427 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
HannesTschofenig 0:796d0f61a05b 428
HannesTschofenig 0:796d0f61a05b 429 if( ( ret = ecdsa_verify( &ctx->grp, hash, hlen,
HannesTschofenig 0:796d0f61a05b 430 &ctx->Q, &ctx->r, &ctx->s ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 431 return( ret );
HannesTschofenig 0:796d0f61a05b 432
HannesTschofenig 0:796d0f61a05b 433 if( p != end )
HannesTschofenig 0:796d0f61a05b 434 return( POLARSSL_ERR_ECP_SIG_LEN_MISMATCH );
HannesTschofenig 0:796d0f61a05b 435
HannesTschofenig 0:796d0f61a05b 436 return( 0 );
HannesTschofenig 0:796d0f61a05b 437 }
HannesTschofenig 0:796d0f61a05b 438
HannesTschofenig 0:796d0f61a05b 439 /*
HannesTschofenig 0:796d0f61a05b 440 * Generate key pair
HannesTschofenig 0:796d0f61a05b 441 */
HannesTschofenig 0:796d0f61a05b 442 int ecdsa_genkey( ecdsa_context *ctx, ecp_group_id gid,
HannesTschofenig 0:796d0f61a05b 443 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
HannesTschofenig 0:796d0f61a05b 444 {
HannesTschofenig 0:796d0f61a05b 445 return( ecp_use_known_dp( &ctx->grp, gid ) ||
HannesTschofenig 0:796d0f61a05b 446 ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
HannesTschofenig 0:796d0f61a05b 447 }
HannesTschofenig 0:796d0f61a05b 448
HannesTschofenig 0:796d0f61a05b 449 /*
HannesTschofenig 0:796d0f61a05b 450 * Set context from an ecp_keypair
HannesTschofenig 0:796d0f61a05b 451 */
HannesTschofenig 0:796d0f61a05b 452 int ecdsa_from_keypair( ecdsa_context *ctx, const ecp_keypair *key )
HannesTschofenig 0:796d0f61a05b 453 {
HannesTschofenig 0:796d0f61a05b 454 int ret;
HannesTschofenig 0:796d0f61a05b 455
HannesTschofenig 0:796d0f61a05b 456 if( ( ret = ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
HannesTschofenig 0:796d0f61a05b 457 ( ret = mpi_copy( &ctx->d, &key->d ) ) != 0 ||
HannesTschofenig 0:796d0f61a05b 458 ( ret = ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
HannesTschofenig 0:796d0f61a05b 459 {
HannesTschofenig 0:796d0f61a05b 460 ecdsa_free( ctx );
HannesTschofenig 0:796d0f61a05b 461 }
HannesTschofenig 0:796d0f61a05b 462
HannesTschofenig 0:796d0f61a05b 463 return( ret );
HannesTschofenig 0:796d0f61a05b 464 }
HannesTschofenig 0:796d0f61a05b 465
HannesTschofenig 0:796d0f61a05b 466 /*
HannesTschofenig 0:796d0f61a05b 467 * Initialize context
HannesTschofenig 0:796d0f61a05b 468 */
HannesTschofenig 0:796d0f61a05b 469 void ecdsa_init( ecdsa_context *ctx )
HannesTschofenig 0:796d0f61a05b 470 {
HannesTschofenig 0:796d0f61a05b 471 ecp_group_init( &ctx->grp );
HannesTschofenig 0:796d0f61a05b 472 mpi_init( &ctx->d );
HannesTschofenig 0:796d0f61a05b 473 ecp_point_init( &ctx->Q );
HannesTschofenig 0:796d0f61a05b 474 mpi_init( &ctx->r );
HannesTschofenig 0:796d0f61a05b 475 mpi_init( &ctx->s );
HannesTschofenig 0:796d0f61a05b 476 }
HannesTschofenig 0:796d0f61a05b 477
HannesTschofenig 0:796d0f61a05b 478 /*
HannesTschofenig 0:796d0f61a05b 479 * Free context
HannesTschofenig 0:796d0f61a05b 480 */
HannesTschofenig 0:796d0f61a05b 481 void ecdsa_free( ecdsa_context *ctx )
HannesTschofenig 0:796d0f61a05b 482 {
HannesTschofenig 0:796d0f61a05b 483 ecp_group_free( &ctx->grp );
HannesTschofenig 0:796d0f61a05b 484 mpi_free( &ctx->d );
HannesTschofenig 0:796d0f61a05b 485 ecp_point_free( &ctx->Q );
HannesTschofenig 0:796d0f61a05b 486 mpi_free( &ctx->r );
HannesTschofenig 0:796d0f61a05b 487 mpi_free( &ctx->s );
HannesTschofenig 0:796d0f61a05b 488 }
HannesTschofenig 0:796d0f61a05b 489
HannesTschofenig 0:796d0f61a05b 490 #if defined(POLARSSL_SELF_TEST)
HannesTschofenig 0:796d0f61a05b 491
HannesTschofenig 0:796d0f61a05b 492 /*
HannesTschofenig 0:796d0f61a05b 493 * Checkup routine
HannesTschofenig 0:796d0f61a05b 494 */
HannesTschofenig 0:796d0f61a05b 495 int ecdsa_self_test( int verbose )
HannesTschofenig 0:796d0f61a05b 496 {
HannesTschofenig 0:796d0f61a05b 497 ((void) verbose );
HannesTschofenig 0:796d0f61a05b 498 return( 0 );
HannesTschofenig 0:796d0f61a05b 499 }
HannesTschofenig 0:796d0f61a05b 500
HannesTschofenig 0:796d0f61a05b 501 #endif /* POLARSSL_SELF_TEST */
HannesTschofenig 0:796d0f61a05b 502
HannesTschofenig 0:796d0f61a05b 503 #endif /* POLARSSL_ECDSA_C */
HannesTschofenig 0:796d0f61a05b 504
HannesTschofenig 0:796d0f61a05b 505