ecdsa.h

00001 /**
00002  * \file ecdsa.h
00003  *
00004  * \brief The Elliptic Curve Digital Signature Algorithm (ECDSA).
00005  *
00006  * ECDSA is defined in <em>Standards for Efficient Cryptography Group (SECG):
00007  * SEC1 Elliptic Curve Cryptography</em>.
00008  * The use of ECDSA for TLS is defined in <em>RFC-4492: Elliptic Curve
00009  * Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)</em>.
00010  *
00011  */
00012 /*
00013  *  Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved
00014  *  SPDX-License-Identifier: Apache-2.0
00015  *
00016  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
00017  *  not use this file except in compliance with the License.
00018  *  You may obtain a copy of the License at
00019  *
00020  *  http://www.apache.org/licenses/LICENSE-2.0
00021  *
00022  *  Unless required by applicable law or agreed to in writing, software
00023  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
00024  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00025  *  See the License for the specific language governing permissions and
00026  *  limitations under the License.
00027  *
00028  *  This file is part of Mbed TLS (https://tls.mbed.org)
00029  */
00030 
00031 #ifndef MBEDTLS_ECDSA_H
00032 #define MBEDTLS_ECDSA_H
00033 
00034 #include "ecp.h"
00035 #include "md.h"
00036 
00037 /*
00038  * RFC-4492 page 20:
00039  *
00040  *     Ecdsa-Sig-Value ::= SEQUENCE {
00041  *         r       INTEGER,
00042  *         s       INTEGER
00043  *     }
00044  *
00045  * Size is at most
00046  *    1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
00047  *    twice that + 1 (tag) + 2 (len) for the sequence
00048  * (assuming ECP_MAX_BYTES is less than 126 for r and s,
00049  * and less than 124 (total len <= 255) for the sequence)
00050  */
00051 #if MBEDTLS_ECP_MAX_BYTES > 124
00052 #error "MBEDTLS_ECP_MAX_BYTES bigger than expected, please fix MBEDTLS_ECDSA_MAX_LEN"
00053 #endif
00054 /** The maximal size of an ECDSA signature in Bytes. */
00055 #define MBEDTLS_ECDSA_MAX_LEN  ( 3 + 2 * ( 3 + MBEDTLS_ECP_MAX_BYTES ) )
00056 
00057 /**
00058  * \brief           The ECDSA context structure.
00059  */
00060 typedef mbedtls_ecp_keypair mbedtls_ecdsa_context;
00061 
00062 #ifdef __cplusplus
00063 extern "C" {
00064 #endif
00065 
00066 /**
00067  * \brief           This function computes the ECDSA signature of a
00068  *                  previously-hashed message.
00069  *
00070  * \note            The deterministic version is usually preferred.
00071  *
00072  * \param grp       The ECP group.
00073  * \param r         The first output integer.
00074  * \param s         The second output integer.
00075  * \param d         The private signing key.
00076  * \param buf       The message hash.
00077  * \param blen      The length of \p buf.
00078  * \param f_rng     The RNG function.
00079  * \param p_rng     The RNG parameter.
00080  *
00081  * \note            If the bitlength of the message hash is larger than the
00082  *                  bitlength of the group order, then the hash is truncated
00083  *                  as defined in <em>Standards for Efficient Cryptography Group
00084  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00085  *                  4.1.3, step 5.
00086  *
00087  * \return          \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX
00088  *                  or \c MBEDTLS_MPI_XXX error code on failure.
00089  *
00090  * \see             ecp.h
00091  */
00092 int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
00093                 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
00094                 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
00095 
00096 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
00097 /**
00098  * \brief           This function computes the ECDSA signature of a
00099  *                  previously-hashed message, deterministic version.
00100  *                  For more information, see <em>RFC-6979: Deterministic
00101  *                  Usage of the Digital Signature Algorithm (DSA) and Elliptic
00102  *                  Curve Digital Signature Algorithm (ECDSA)</em>.
00103  *
00104  * \param grp       The ECP group.
00105  * \param r         The first output integer.
00106  * \param s         The second output integer.
00107  * \param d         The private signing key.
00108  * \param buf       The message hash.
00109  * \param blen      The length of \p buf.
00110  * \param md_alg    The MD algorithm used to hash the message.
00111  *
00112  * \note            If the bitlength of the message hash is larger than the
00113  *                  bitlength of the group order, then the hash is truncated as
00114  *                  defined in <em>Standards for Efficient Cryptography Group
00115  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00116  *                  4.1.3, step 5.
00117  *
00118  * \return          \c 0 on success,
00119  *                  or an \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
00120  *                  error code on failure.
00121  *
00122  * \see             ecp.h
00123  */
00124 int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
00125                     const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
00126                     mbedtls_md_type_t md_alg );
00127 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
00128 
00129 /**
00130  * \brief           This function verifies the ECDSA signature of a
00131  *                  previously-hashed message.
00132  *
00133  * \param grp       The ECP group.
00134  * \param buf       The message hash.
00135  * \param blen      The length of \p buf.
00136  * \param Q         The public key to use for verification.
00137  * \param r         The first integer of the signature.
00138  * \param s         The second integer of the signature.
00139  *
00140  * \note            If the bitlength of the message hash is larger than the
00141  *                  bitlength of the group order, then the hash is truncated as
00142  *                  defined in <em>Standards for Efficient Cryptography Group
00143  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00144  *                  4.1.4, step 3.
00145  *
00146  * \return          \c 0 on success,
00147  *                  #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid,
00148  *                  or an \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
00149  *                  error code on failure for any other reason.
00150  *
00151  * \see             ecp.h
00152  */
00153 int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
00154                   const unsigned char *buf, size_t blen,
00155                   const mbedtls_ecp_point *Q, const mbedtls_mpi *r, const mbedtls_mpi *s);
00156 
00157 /**
00158  * \brief           This function computes the ECDSA signature and writes it
00159  *                  to a buffer, serialized as defined in <em>RFC-4492:
00160  *                  Elliptic Curve Cryptography (ECC) Cipher Suites for
00161  *                  Transport Layer Security (TLS)</em>.
00162  *
00163  * \warning         It is not thread-safe to use the same context in
00164  *                  multiple threads.
00165  *
00166  * \note            The deterministic version is used if
00167  *                  #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more
00168  *                  information, see <em>RFC-6979: Deterministic Usage
00169  *                  of the Digital Signature Algorithm (DSA) and Elliptic
00170  *                  Curve Digital Signature Algorithm (ECDSA)</em>.
00171  *
00172  * \param ctx       The ECDSA context.
00173  * \param md_alg    The message digest that was used to hash the message.
00174  * \param hash      The message hash.
00175  * \param hlen      The length of the hash.
00176  * \param sig       The buffer that holds the signature.
00177  * \param slen      The length of the signature written.
00178  * \param f_rng     The RNG function.
00179  * \param p_rng     The RNG parameter.
00180  *
00181  * \note            The \p sig buffer must be at least twice as large as the
00182  *                  size of the curve used, plus 9. For example, 73 Bytes if
00183  *                  a 256-bit curve is used. A buffer length of
00184  *                  #MBEDTLS_ECDSA_MAX_LEN is always safe.
00185  *
00186  * \note            If the bitlength of the message hash is larger than the
00187  *                  bitlength of the group order, then the hash is truncated as
00188  *                  defined in <em>Standards for Efficient Cryptography Group
00189  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00190  *                  4.1.3, step 5.
00191  *
00192  * \return          \c 0 on success,
00193  *                  or an \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or
00194  *                  \c MBEDTLS_ERR_ASN1_XXX error code on failure.
00195  *
00196  * \see             ecp.h
00197  */
00198 int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, mbedtls_md_type_t md_alg,
00199                            const unsigned char *hash, size_t hlen,
00200                            unsigned char *sig, size_t *slen,
00201                            int (*f_rng)(void *, unsigned char *, size_t),
00202                            void *p_rng );
00203 
00204 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
00205 #if ! defined(MBEDTLS_DEPRECATED_REMOVED)
00206 #if defined(MBEDTLS_DEPRECATED_WARNING)
00207 #define MBEDTLS_DEPRECATED    __attribute__((deprecated))
00208 #else
00209 #define MBEDTLS_DEPRECATED
00210 #endif
00211 /**
00212  * \brief   This function computes an ECDSA signature and writes it to a buffer,
00213  *          serialized as defined in <em>RFC-4492: Elliptic Curve Cryptography
00214  *          (ECC) Cipher Suites for Transport Layer Security (TLS)</em>.
00215  *
00216  *          The deterministic version is defined in <em>RFC-6979:
00217  *          Deterministic Usage of the Digital Signature Algorithm (DSA) and
00218  *          Elliptic Curve Digital Signature Algorithm (ECDSA)</em>.
00219  *
00220  * \warning         It is not thread-safe to use the same context in
00221  *                  multiple threads.
00222 
00223  *
00224  * \deprecated      Superseded by mbedtls_ecdsa_write_signature() in 2.0.0
00225  *
00226  * \param ctx       The ECDSA context.
00227  * \param hash      The Message hash.
00228  * \param hlen      The length of the hash.
00229  * \param sig       The buffer that holds the signature.
00230  * \param slen      The length of the signature written.
00231  * \param md_alg    The MD algorithm used to hash the message.
00232  *
00233  * \note            The \p sig buffer must be at least twice as large as the
00234  *                  size of the curve used, plus 9. For example, 73 Bytes if a
00235  *                  256-bit curve is used. A buffer length of
00236  *                  #MBEDTLS_ECDSA_MAX_LEN is always safe.
00237  *
00238  * \note            If the bitlength of the message hash is larger than the
00239  *                  bitlength of the group order, then the hash is truncated as
00240  *                  defined in <em>Standards for Efficient Cryptography Group
00241  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00242  *                  4.1.3, step 5.
00243  *
00244  * \return          \c 0 on success,
00245  *                  or an \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or
00246  *                  \c MBEDTLS_ERR_ASN1_XXX error code on failure.
00247  *
00248  * \see             ecp.h
00249  */
00250 int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
00251                                const unsigned char *hash, size_t hlen,
00252                                unsigned char *sig, size_t *slen,
00253                                mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED;
00254 #undef MBEDTLS_DEPRECATED
00255 #endif /* MBEDTLS_DEPRECATED_REMOVED */
00256 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
00257 
00258 /**
00259  * \brief           This function reads and verifies an ECDSA signature.
00260  *
00261  * \param ctx       The ECDSA context.
00262  * \param hash      The message hash.
00263  * \param hlen      The size of the hash.
00264  * \param sig       The signature to read and verify.
00265  * \param slen      The size of \p sig.
00266  *
00267  * \note            If the bitlength of the message hash is larger than the
00268  *                  bitlength of the group order, then the hash is truncated as
00269  *                  defined in <em>Standards for Efficient Cryptography Group
00270  *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
00271  *                  4.1.4, step 3.
00272  *
00273  * \return          \c 0 on success,
00274  *                  #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid,
00275  *                  #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if the signature is
00276  *                  valid but its actual length is less than \p siglen,
00277  *                  or an \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX
00278  *                  error code on failure for any other reason.
00279  *
00280  * \see             ecp.h
00281  */
00282 int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
00283                           const unsigned char *hash, size_t hlen,
00284                           const unsigned char *sig, size_t slen );
00285 
00286 /**
00287  * \brief          This function generates an ECDSA keypair on the given curve.
00288  *
00289  * \param ctx      The ECDSA context to store the keypair in.
00290  * \param gid      The elliptic curve to use. One of the various
00291  *                 \c MBEDTLS_ECP_DP_XXX macros depending on configuration.
00292  * \param f_rng    The RNG function.
00293  * \param p_rng    The RNG parameter.
00294  *
00295  * \return         \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX code on
00296  *                 failure.
00297  *
00298  * \see            ecp.h
00299  */
00300 int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
00301                   int (*f_rng)(void *, unsigned char *, size_t), void *p_rng );
00302 
00303 /**
00304  * \brief           This function sets an ECDSA context from an EC key pair.
00305  *
00306  * \param ctx       The ECDSA context to set.
00307  * \param key       The EC key to use.
00308  *
00309  * \return          \c 0 on success, or an \c MBEDTLS_ERR_ECP_XXX code on
00310  *                  failure.
00311  *
00312  * \see             ecp.h
00313  */
00314 int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key );
00315 
00316 /**
00317  * \brief           This function initializes an ECDSA context.
00318  *
00319  * \param ctx       The ECDSA context to initialize.
00320  */
00321 void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx );
00322 
00323 /**
00324  * \brief           This function frees an ECDSA context.
00325  *
00326  * \param ctx       The ECDSA context to free.
00327  */
00328 void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx );
00329 
00330 #ifdef __cplusplus
00331 }
00332 #endif
00333 
00334 #endif /* ecdsa.h */