Kev Mann / mbed-dev-OS5_10_4

RTC auf true

features/mbedtls/src/ecdsa.c@0:38ceb79fef03, 2018-11-28 (annotated)

Committer:
kevman
Date:
Wed Nov 28 15:10:15 2018 +0000
Revision:
0:38ceb79fef03
RTC modified

Who changed what in which revision?

UserRevisionLine numberNew contents of line
kevman 0:38ceb79fef03 1 /*
kevman 0:38ceb79fef03 2 * Elliptic curve DSA
kevman 0:38ceb79fef03 3 *
kevman 0:38ceb79fef03 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
kevman 0:38ceb79fef03 5 * SPDX-License-Identifier: Apache-2.0
kevman 0:38ceb79fef03 6 *
kevman 0:38ceb79fef03 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
kevman 0:38ceb79fef03 8 * not use this file except in compliance with the License.
kevman 0:38ceb79fef03 9 * You may obtain a copy of the License at
kevman 0:38ceb79fef03 10 *
kevman 0:38ceb79fef03 11 * http://www.apache.org/licenses/LICENSE-2.0
kevman 0:38ceb79fef03 12 *
kevman 0:38ceb79fef03 13 * Unless required by applicable law or agreed to in writing, software
kevman 0:38ceb79fef03 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
kevman 0:38ceb79fef03 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
kevman 0:38ceb79fef03 16 * See the License for the specific language governing permissions and
kevman 0:38ceb79fef03 17 * limitations under the License.
kevman 0:38ceb79fef03 18 *
kevman 0:38ceb79fef03 19 * This file is part of mbed TLS (https://tls.mbed.org)
kevman 0:38ceb79fef03 20 */
kevman 0:38ceb79fef03 21
kevman 0:38ceb79fef03 22 /*
kevman 0:38ceb79fef03 23 * References:
kevman 0:38ceb79fef03 24 *
kevman 0:38ceb79fef03 25 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
kevman 0:38ceb79fef03 26 */
kevman 0:38ceb79fef03 27
kevman 0:38ceb79fef03 28 #if !defined(MBEDTLS_CONFIG_FILE)
kevman 0:38ceb79fef03 29 #include "mbedtls/config.h"
kevman 0:38ceb79fef03 30 #else
kevman 0:38ceb79fef03 31 #include MBEDTLS_CONFIG_FILE
kevman 0:38ceb79fef03 32 #endif
kevman 0:38ceb79fef03 33
kevman 0:38ceb79fef03 34 #if defined(MBEDTLS_ECDSA_C)
kevman 0:38ceb79fef03 35
kevman 0:38ceb79fef03 36 #include "mbedtls/ecdsa.h"
kevman 0:38ceb79fef03 37 #include "mbedtls/asn1write.h"
kevman 0:38ceb79fef03 38
kevman 0:38ceb79fef03 39 #include <string.h>
kevman 0:38ceb79fef03 40
kevman 0:38ceb79fef03 41 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
kevman 0:38ceb79fef03 42 #include "mbedtls/hmac_drbg.h"
kevman 0:38ceb79fef03 43 #endif
kevman 0:38ceb79fef03 44
kevman 0:38ceb79fef03 45 /*
kevman 0:38ceb79fef03 46 * Derive a suitable integer for group grp from a buffer of length len
kevman 0:38ceb79fef03 47 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
kevman 0:38ceb79fef03 48 */
kevman 0:38ceb79fef03 49 static int derive_mpi( const mbedtls_ecp_group *grp, mbedtls_mpi *x,
kevman 0:38ceb79fef03 50 const unsigned char *buf, size_t blen )
kevman 0:38ceb79fef03 51 {
kevman 0:38ceb79fef03 52 int ret;
kevman 0:38ceb79fef03 53 size_t n_size = ( grp->nbits + 7 ) / 8;
kevman 0:38ceb79fef03 54 size_t use_size = blen > n_size ? n_size : blen;
kevman 0:38ceb79fef03 55
kevman 0:38ceb79fef03 56 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( x, buf, use_size ) );
kevman 0:38ceb79fef03 57 if( use_size * 8 > grp->nbits )
kevman 0:38ceb79fef03 58 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( x, use_size * 8 - grp->nbits ) );
kevman 0:38ceb79fef03 59
kevman 0:38ceb79fef03 60 /* While at it, reduce modulo N */
kevman 0:38ceb79fef03 61 if( mbedtls_mpi_cmp_mpi( x, &grp->N ) >= 0 )
kevman 0:38ceb79fef03 62 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
kevman 0:38ceb79fef03 63
kevman 0:38ceb79fef03 64 cleanup:
kevman 0:38ceb79fef03 65 return( ret );
kevman 0:38ceb79fef03 66 }
kevman 0:38ceb79fef03 67
kevman 0:38ceb79fef03 68 #if !defined(MBEDTLS_ECDSA_SIGN_ALT)
kevman 0:38ceb79fef03 69 /*
kevman 0:38ceb79fef03 70 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
kevman 0:38ceb79fef03 71 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
kevman 0:38ceb79fef03 72 */
kevman 0:38ceb79fef03 73 int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
kevman 0:38ceb79fef03 74 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
kevman 0:38ceb79fef03 75 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
kevman 0:38ceb79fef03 76 {
kevman 0:38ceb79fef03 77 int ret, key_tries, sign_tries, blind_tries;
kevman 0:38ceb79fef03 78 mbedtls_ecp_point R;
kevman 0:38ceb79fef03 79 mbedtls_mpi k, e, t;
kevman 0:38ceb79fef03 80
kevman 0:38ceb79fef03 81 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
kevman 0:38ceb79fef03 82 if( grp->N.p == NULL )
kevman 0:38ceb79fef03 83 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 84
kevman 0:38ceb79fef03 85 /* Make sure d is in range 1..n-1 */
kevman 0:38ceb79fef03 86 if( mbedtls_mpi_cmp_int( d, 1 ) < 0 || mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
kevman 0:38ceb79fef03 87 return( MBEDTLS_ERR_ECP_INVALID_KEY );
kevman 0:38ceb79fef03 88
kevman 0:38ceb79fef03 89 mbedtls_ecp_point_init( &R );
kevman 0:38ceb79fef03 90 mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
kevman 0:38ceb79fef03 91
kevman 0:38ceb79fef03 92 sign_tries = 0;
kevman 0:38ceb79fef03 93 do
kevman 0:38ceb79fef03 94 {
kevman 0:38ceb79fef03 95 /*
kevman 0:38ceb79fef03 96 * Steps 1-3: generate a suitable ephemeral keypair
kevman 0:38ceb79fef03 97 * and set r = xR mod n
kevman 0:38ceb79fef03 98 */
kevman 0:38ceb79fef03 99 key_tries = 0;
kevman 0:38ceb79fef03 100 do
kevman 0:38ceb79fef03 101 {
kevman 0:38ceb79fef03 102 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
kevman 0:38ceb79fef03 103 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( r, &R.X, &grp->N ) );
kevman 0:38ceb79fef03 104
kevman 0:38ceb79fef03 105 if( key_tries++ > 10 )
kevman 0:38ceb79fef03 106 {
kevman 0:38ceb79fef03 107 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
kevman 0:38ceb79fef03 108 goto cleanup;
kevman 0:38ceb79fef03 109 }
kevman 0:38ceb79fef03 110 }
kevman 0:38ceb79fef03 111 while( mbedtls_mpi_cmp_int( r, 0 ) == 0 );
kevman 0:38ceb79fef03 112
kevman 0:38ceb79fef03 113 /*
kevman 0:38ceb79fef03 114 * Step 5: derive MPI from hashed message
kevman 0:38ceb79fef03 115 */
kevman 0:38ceb79fef03 116 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
kevman 0:38ceb79fef03 117
kevman 0:38ceb79fef03 118 /*
kevman 0:38ceb79fef03 119 * Generate a random value to blind inv_mod in next step,
kevman 0:38ceb79fef03 120 * avoiding a potential timing leak.
kevman 0:38ceb79fef03 121 */
kevman 0:38ceb79fef03 122 blind_tries = 0;
kevman 0:38ceb79fef03 123 do
kevman 0:38ceb79fef03 124 {
kevman 0:38ceb79fef03 125 size_t n_size = ( grp->nbits + 7 ) / 8;
kevman 0:38ceb79fef03 126 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &t, n_size, f_rng, p_rng ) );
kevman 0:38ceb79fef03 127 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
kevman 0:38ceb79fef03 128
kevman 0:38ceb79fef03 129 /* See mbedtls_ecp_gen_keypair() */
kevman 0:38ceb79fef03 130 if( ++blind_tries > 30 )
kevman 0:38ceb79fef03 131 return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
kevman 0:38ceb79fef03 132 }
kevman 0:38ceb79fef03 133 while( mbedtls_mpi_cmp_int( &t, 1 ) < 0 ||
kevman 0:38ceb79fef03 134 mbedtls_mpi_cmp_mpi( &t, &grp->N ) >= 0 );
kevman 0:38ceb79fef03 135
kevman 0:38ceb79fef03 136 /*
kevman 0:38ceb79fef03 137 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
kevman 0:38ceb79fef03 138 */
kevman 0:38ceb79fef03 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, r, d ) );
kevman 0:38ceb79fef03 140 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
kevman 0:38ceb79fef03 141 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
kevman 0:38ceb79fef03 142 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &k, &k, &t ) );
kevman 0:38ceb79fef03 143 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, &k, &grp->N ) );
kevman 0:38ceb79fef03 144 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
kevman 0:38ceb79fef03 145 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
kevman 0:38ceb79fef03 146
kevman 0:38ceb79fef03 147 if( sign_tries++ > 10 )
kevman 0:38ceb79fef03 148 {
kevman 0:38ceb79fef03 149 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
kevman 0:38ceb79fef03 150 goto cleanup;
kevman 0:38ceb79fef03 151 }
kevman 0:38ceb79fef03 152 }
kevman 0:38ceb79fef03 153 while( mbedtls_mpi_cmp_int( s, 0 ) == 0 );
kevman 0:38ceb79fef03 154
kevman 0:38ceb79fef03 155 cleanup:
kevman 0:38ceb79fef03 156 mbedtls_ecp_point_free( &R );
kevman 0:38ceb79fef03 157 mbedtls_mpi_free( &k ); mbedtls_mpi_free( &e ); mbedtls_mpi_free( &t );
kevman 0:38ceb79fef03 158
kevman 0:38ceb79fef03 159 return( ret );
kevman 0:38ceb79fef03 160 }
kevman 0:38ceb79fef03 161 #endif /* MBEDTLS_ECDSA_SIGN_ALT */
kevman 0:38ceb79fef03 162
kevman 0:38ceb79fef03 163 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
kevman 0:38ceb79fef03 164 /*
kevman 0:38ceb79fef03 165 * Deterministic signature wrapper
kevman 0:38ceb79fef03 166 */
kevman 0:38ceb79fef03 167 int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
kevman 0:38ceb79fef03 168 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
kevman 0:38ceb79fef03 169 mbedtls_md_type_t md_alg )
kevman 0:38ceb79fef03 170 {
kevman 0:38ceb79fef03 171 int ret;
kevman 0:38ceb79fef03 172 mbedtls_hmac_drbg_context rng_ctx;
kevman 0:38ceb79fef03 173 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
kevman 0:38ceb79fef03 174 size_t grp_len = ( grp->nbits + 7 ) / 8;
kevman 0:38ceb79fef03 175 const mbedtls_md_info_t *md_info;
kevman 0:38ceb79fef03 176 mbedtls_mpi h;
kevman 0:38ceb79fef03 177
kevman 0:38ceb79fef03 178 if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
kevman 0:38ceb79fef03 179 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 180
kevman 0:38ceb79fef03 181 mbedtls_mpi_init( &h );
kevman 0:38ceb79fef03 182 mbedtls_hmac_drbg_init( &rng_ctx );
kevman 0:38ceb79fef03 183
kevman 0:38ceb79fef03 184 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
kevman 0:38ceb79fef03 185 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( d, data, grp_len ) );
kevman 0:38ceb79fef03 186 MBEDTLS_MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
kevman 0:38ceb79fef03 187 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, data + grp_len, grp_len ) );
kevman 0:38ceb79fef03 188 mbedtls_hmac_drbg_seed_buf( &rng_ctx, md_info, data, 2 * grp_len );
kevman 0:38ceb79fef03 189
kevman 0:38ceb79fef03 190 ret = mbedtls_ecdsa_sign( grp, r, s, d, buf, blen,
kevman 0:38ceb79fef03 191 mbedtls_hmac_drbg_random, &rng_ctx );
kevman 0:38ceb79fef03 192
kevman 0:38ceb79fef03 193 cleanup:
kevman 0:38ceb79fef03 194 mbedtls_hmac_drbg_free( &rng_ctx );
kevman 0:38ceb79fef03 195 mbedtls_mpi_free( &h );
kevman 0:38ceb79fef03 196
kevman 0:38ceb79fef03 197 return( ret );
kevman 0:38ceb79fef03 198 }
kevman 0:38ceb79fef03 199 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
kevman 0:38ceb79fef03 200
kevman 0:38ceb79fef03 201 #if !defined(MBEDTLS_ECDSA_VERIFY_ALT)
kevman 0:38ceb79fef03 202 /*
kevman 0:38ceb79fef03 203 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
kevman 0:38ceb79fef03 204 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
kevman 0:38ceb79fef03 205 */
kevman 0:38ceb79fef03 206 int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
kevman 0:38ceb79fef03 207 const unsigned char *buf, size_t blen,
kevman 0:38ceb79fef03 208 const mbedtls_ecp_point *Q, const mbedtls_mpi *r, const mbedtls_mpi *s)
kevman 0:38ceb79fef03 209 {
kevman 0:38ceb79fef03 210 int ret;
kevman 0:38ceb79fef03 211 mbedtls_mpi e, s_inv, u1, u2;
kevman 0:38ceb79fef03 212 mbedtls_ecp_point R;
kevman 0:38ceb79fef03 213
kevman 0:38ceb79fef03 214 mbedtls_ecp_point_init( &R );
kevman 0:38ceb79fef03 215 mbedtls_mpi_init( &e ); mbedtls_mpi_init( &s_inv ); mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
kevman 0:38ceb79fef03 216
kevman 0:38ceb79fef03 217 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
kevman 0:38ceb79fef03 218 if( grp->N.p == NULL )
kevman 0:38ceb79fef03 219 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kevman 0:38ceb79fef03 220
kevman 0:38ceb79fef03 221 /*
kevman 0:38ceb79fef03 222 * Step 1: make sure r and s are in range 1..n-1
kevman 0:38ceb79fef03 223 */
kevman 0:38ceb79fef03 224 if( mbedtls_mpi_cmp_int( r, 1 ) < 0 || mbedtls_mpi_cmp_mpi( r, &grp->N ) >= 0 ||
kevman 0:38ceb79fef03 225 mbedtls_mpi_cmp_int( s, 1 ) < 0 || mbedtls_mpi_cmp_mpi( s, &grp->N ) >= 0 )
kevman 0:38ceb79fef03 226 {
kevman 0:38ceb79fef03 227 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
kevman 0:38ceb79fef03 228 goto cleanup;
kevman 0:38ceb79fef03 229 }
kevman 0:38ceb79fef03 230
kevman 0:38ceb79fef03 231 /*
kevman 0:38ceb79fef03 232 * Additional precaution: make sure Q is valid
kevman 0:38ceb79fef03 233 */
kevman 0:38ceb79fef03 234 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, Q ) );
kevman 0:38ceb79fef03 235
kevman 0:38ceb79fef03 236 /*
kevman 0:38ceb79fef03 237 * Step 3: derive MPI from hashed message
kevman 0:38ceb79fef03 238 */
kevman 0:38ceb79fef03 239 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
kevman 0:38ceb79fef03 240
kevman 0:38ceb79fef03 241 /*
kevman 0:38ceb79fef03 242 * Step 4: u1 = e / s mod n, u2 = r / s mod n
kevman 0:38ceb79fef03 243 */
kevman 0:38ceb79fef03 244 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &s_inv, s, &grp->N ) );
kevman 0:38ceb79fef03 245
kevman 0:38ceb79fef03 246 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u1, &e, &s_inv ) );
kevman 0:38ceb79fef03 247 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u1, &u1, &grp->N ) );
kevman 0:38ceb79fef03 248
kevman 0:38ceb79fef03 249 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u2, r, &s_inv ) );
kevman 0:38ceb79fef03 250 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u2, &u2, &grp->N ) );
kevman 0:38ceb79fef03 251
kevman 0:38ceb79fef03 252 /*
kevman 0:38ceb79fef03 253 * Step 5: R = u1 G + u2 Q
kevman 0:38ceb79fef03 254 *
kevman 0:38ceb79fef03 255 * Since we're not using any secret data, no need to pass a RNG to
kevman 0:38ceb79fef03 256 * mbedtls_ecp_mul() for countermesures.
kevman 0:38ceb79fef03 257 */
kevman 0:38ceb79fef03 258 MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, &R, &u1, &grp->G, &u2, Q ) );
kevman 0:38ceb79fef03 259
kevman 0:38ceb79fef03 260 if( mbedtls_ecp_is_zero( &R ) )
kevman 0:38ceb79fef03 261 {
kevman 0:38ceb79fef03 262 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
kevman 0:38ceb79fef03 263 goto cleanup;
kevman 0:38ceb79fef03 264 }
kevman 0:38ceb79fef03 265
kevman 0:38ceb79fef03 266 /*
kevman 0:38ceb79fef03 267 * Step 6: convert xR to an integer (no-op)
kevman 0:38ceb79fef03 268 * Step 7: reduce xR mod n (gives v)
kevman 0:38ceb79fef03 269 */
kevman 0:38ceb79fef03 270 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
kevman 0:38ceb79fef03 271
kevman 0:38ceb79fef03 272 /*
kevman 0:38ceb79fef03 273 * Step 8: check if v (that is, R.X) is equal to r
kevman 0:38ceb79fef03 274 */
kevman 0:38ceb79fef03 275 if( mbedtls_mpi_cmp_mpi( &R.X, r ) != 0 )
kevman 0:38ceb79fef03 276 {
kevman 0:38ceb79fef03 277 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
kevman 0:38ceb79fef03 278 goto cleanup;
kevman 0:38ceb79fef03 279 }
kevman 0:38ceb79fef03 280
kevman 0:38ceb79fef03 281 cleanup:
kevman 0:38ceb79fef03 282 mbedtls_ecp_point_free( &R );
kevman 0:38ceb79fef03 283 mbedtls_mpi_free( &e ); mbedtls_mpi_free( &s_inv ); mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
kevman 0:38ceb79fef03 284
kevman 0:38ceb79fef03 285 return( ret );
kevman 0:38ceb79fef03 286 }
kevman 0:38ceb79fef03 287 #endif /* MBEDTLS_ECDSA_VERIFY_ALT */
kevman 0:38ceb79fef03 288
kevman 0:38ceb79fef03 289 /*
kevman 0:38ceb79fef03 290 * Convert a signature (given by context) to ASN.1
kevman 0:38ceb79fef03 291 */
kevman 0:38ceb79fef03 292 static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
kevman 0:38ceb79fef03 293 unsigned char *sig, size_t *slen )
kevman 0:38ceb79fef03 294 {
kevman 0:38ceb79fef03 295 int ret;
kevman 0:38ceb79fef03 296 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
kevman 0:38ceb79fef03 297 unsigned char *p = buf + sizeof( buf );
kevman 0:38ceb79fef03 298 size_t len = 0;
kevman 0:38ceb79fef03 299
kevman 0:38ceb79fef03 300 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, s ) );
kevman 0:38ceb79fef03 301 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, r ) );
kevman 0:38ceb79fef03 302
kevman 0:38ceb79fef03 303 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, len ) );
kevman 0:38ceb79fef03 304 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
kevman 0:38ceb79fef03 305 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
kevman 0:38ceb79fef03 306
kevman 0:38ceb79fef03 307 memcpy( sig, p, len );
kevman 0:38ceb79fef03 308 *slen = len;
kevman 0:38ceb79fef03 309
kevman 0:38ceb79fef03 310 return( 0 );
kevman 0:38ceb79fef03 311 }
kevman 0:38ceb79fef03 312
kevman 0:38ceb79fef03 313 /*
kevman 0:38ceb79fef03 314 * Compute and write signature
kevman 0:38ceb79fef03 315 */
kevman 0:38ceb79fef03 316 int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, mbedtls_md_type_t md_alg,
kevman 0:38ceb79fef03 317 const unsigned char *hash, size_t hlen,
kevman 0:38ceb79fef03 318 unsigned char *sig, size_t *slen,
kevman 0:38ceb79fef03 319 int (*f_rng)(void *, unsigned char *, size_t),
kevman 0:38ceb79fef03 320 void *p_rng )
kevman 0:38ceb79fef03 321 {
kevman 0:38ceb79fef03 322 int ret;
kevman 0:38ceb79fef03 323 mbedtls_mpi r, s;
kevman 0:38ceb79fef03 324
kevman 0:38ceb79fef03 325 mbedtls_mpi_init( &r );
kevman 0:38ceb79fef03 326 mbedtls_mpi_init( &s );
kevman 0:38ceb79fef03 327
kevman 0:38ceb79fef03 328 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
kevman 0:38ceb79fef03 329 (void) f_rng;
kevman 0:38ceb79fef03 330 (void) p_rng;
kevman 0:38ceb79fef03 331
kevman 0:38ceb79fef03 332 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ctx->grp, &r, &s, &ctx->d,
kevman 0:38ceb79fef03 333 hash, hlen, md_alg ) );
kevman 0:38ceb79fef03 334 #else
kevman 0:38ceb79fef03 335 (void) md_alg;
kevman 0:38ceb79fef03 336
kevman 0:38ceb79fef03 337 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ctx->grp, &r, &s, &ctx->d,
kevman 0:38ceb79fef03 338 hash, hlen, f_rng, p_rng ) );
kevman 0:38ceb79fef03 339 #endif
kevman 0:38ceb79fef03 340
kevman 0:38ceb79fef03 341 MBEDTLS_MPI_CHK( ecdsa_signature_to_asn1( &r, &s, sig, slen ) );
kevman 0:38ceb79fef03 342
kevman 0:38ceb79fef03 343 cleanup:
kevman 0:38ceb79fef03 344 mbedtls_mpi_free( &r );
kevman 0:38ceb79fef03 345 mbedtls_mpi_free( &s );
kevman 0:38ceb79fef03 346
kevman 0:38ceb79fef03 347 return( ret );
kevman 0:38ceb79fef03 348 }
kevman 0:38ceb79fef03 349
kevman 0:38ceb79fef03 350 #if ! defined(MBEDTLS_DEPRECATED_REMOVED) && \
kevman 0:38ceb79fef03 351 defined(MBEDTLS_ECDSA_DETERMINISTIC)
kevman 0:38ceb79fef03 352 int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
kevman 0:38ceb79fef03 353 const unsigned char *hash, size_t hlen,
kevman 0:38ceb79fef03 354 unsigned char *sig, size_t *slen,
kevman 0:38ceb79fef03 355 mbedtls_md_type_t md_alg )
kevman 0:38ceb79fef03 356 {
kevman 0:38ceb79fef03 357 return( mbedtls_ecdsa_write_signature( ctx, md_alg, hash, hlen, sig, slen,
kevman 0:38ceb79fef03 358 NULL, NULL ) );
kevman 0:38ceb79fef03 359 }
kevman 0:38ceb79fef03 360 #endif
kevman 0:38ceb79fef03 361
kevman 0:38ceb79fef03 362 /*
kevman 0:38ceb79fef03 363 * Read and check signature
kevman 0:38ceb79fef03 364 */
kevman 0:38ceb79fef03 365 int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
kevman 0:38ceb79fef03 366 const unsigned char *hash, size_t hlen,
kevman 0:38ceb79fef03 367 const unsigned char *sig, size_t slen )
kevman 0:38ceb79fef03 368 {
kevman 0:38ceb79fef03 369 int ret;
kevman 0:38ceb79fef03 370 unsigned char *p = (unsigned char *) sig;
kevman 0:38ceb79fef03 371 const unsigned char *end = sig + slen;
kevman 0:38ceb79fef03 372 size_t len;
kevman 0:38ceb79fef03 373 mbedtls_mpi r, s;
kevman 0:38ceb79fef03 374
kevman 0:38ceb79fef03 375 mbedtls_mpi_init( &r );
kevman 0:38ceb79fef03 376 mbedtls_mpi_init( &s );
kevman 0:38ceb79fef03 377
kevman 0:38ceb79fef03 378 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
kevman 0:38ceb79fef03 379 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
kevman 0:38ceb79fef03 380 {
kevman 0:38ceb79fef03 381 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kevman 0:38ceb79fef03 382 goto cleanup;
kevman 0:38ceb79fef03 383 }
kevman 0:38ceb79fef03 384
kevman 0:38ceb79fef03 385 if( p + len != end )
kevman 0:38ceb79fef03 386 {
kevman 0:38ceb79fef03 387 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA +
kevman 0:38ceb79fef03 388 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
kevman 0:38ceb79fef03 389 goto cleanup;
kevman 0:38ceb79fef03 390 }
kevman 0:38ceb79fef03 391
kevman 0:38ceb79fef03 392 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &r ) ) != 0 ||
kevman 0:38ceb79fef03 393 ( ret = mbedtls_asn1_get_mpi( &p, end, &s ) ) != 0 )
kevman 0:38ceb79fef03 394 {
kevman 0:38ceb79fef03 395 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kevman 0:38ceb79fef03 396 goto cleanup;
kevman 0:38ceb79fef03 397 }
kevman 0:38ceb79fef03 398
kevman 0:38ceb79fef03 399 if( ( ret = mbedtls_ecdsa_verify( &ctx->grp, hash, hlen,
kevman 0:38ceb79fef03 400 &ctx->Q, &r, &s ) ) != 0 )
kevman 0:38ceb79fef03 401 goto cleanup;
kevman 0:38ceb79fef03 402
kevman 0:38ceb79fef03 403 /* At this point we know that the buffer starts with a valid signature.
kevman 0:38ceb79fef03 404 * Return 0 if the buffer just contains the signature, and a specific
kevman 0:38ceb79fef03 405 * error code if the valid signature is followed by more data. */
kevman 0:38ceb79fef03 406 if( p != end )
kevman 0:38ceb79fef03 407 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
kevman 0:38ceb79fef03 408
kevman 0:38ceb79fef03 409 cleanup:
kevman 0:38ceb79fef03 410 mbedtls_mpi_free( &r );
kevman 0:38ceb79fef03 411 mbedtls_mpi_free( &s );
kevman 0:38ceb79fef03 412
kevman 0:38ceb79fef03 413 return( ret );
kevman 0:38ceb79fef03 414 }
kevman 0:38ceb79fef03 415
kevman 0:38ceb79fef03 416 #if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
kevman 0:38ceb79fef03 417 /*
kevman 0:38ceb79fef03 418 * Generate key pair
kevman 0:38ceb79fef03 419 */
kevman 0:38ceb79fef03 420 int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
kevman 0:38ceb79fef03 421 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
kevman 0:38ceb79fef03 422 {
kevman 0:38ceb79fef03 423 return( mbedtls_ecp_group_load( &ctx->grp, gid ) ||
kevman 0:38ceb79fef03 424 mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
kevman 0:38ceb79fef03 425 }
kevman 0:38ceb79fef03 426 #endif /* MBEDTLS_ECDSA_GENKEY_ALT */
kevman 0:38ceb79fef03 427
kevman 0:38ceb79fef03 428 /*
kevman 0:38ceb79fef03 429 * Set context from an mbedtls_ecp_keypair
kevman 0:38ceb79fef03 430 */
kevman 0:38ceb79fef03 431 int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key )
kevman 0:38ceb79fef03 432 {
kevman 0:38ceb79fef03 433 int ret;
kevman 0:38ceb79fef03 434
kevman 0:38ceb79fef03 435 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
kevman 0:38ceb79fef03 436 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 ||
kevman 0:38ceb79fef03 437 ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
kevman 0:38ceb79fef03 438 {
kevman 0:38ceb79fef03 439 mbedtls_ecdsa_free( ctx );
kevman 0:38ceb79fef03 440 }
kevman 0:38ceb79fef03 441
kevman 0:38ceb79fef03 442 return( ret );
kevman 0:38ceb79fef03 443 }
kevman 0:38ceb79fef03 444
kevman 0:38ceb79fef03 445 /*
kevman 0:38ceb79fef03 446 * Initialize context
kevman 0:38ceb79fef03 447 */
kevman 0:38ceb79fef03 448 void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx )
kevman 0:38ceb79fef03 449 {
kevman 0:38ceb79fef03 450 mbedtls_ecp_keypair_init( ctx );
kevman 0:38ceb79fef03 451 }
kevman 0:38ceb79fef03 452
kevman 0:38ceb79fef03 453 /*
kevman 0:38ceb79fef03 454 * Free context
kevman 0:38ceb79fef03 455 */
kevman 0:38ceb79fef03 456 void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx )
kevman 0:38ceb79fef03 457 {
kevman 0:38ceb79fef03 458 mbedtls_ecp_keypair_free( ctx );
kevman 0:38ceb79fef03 459 }
kevman 0:38ceb79fef03 460
kevman 0:38ceb79fef03 461 #endif /* MBEDTLS_ECDSA_C */