Nathen Gallardojohnson / WNCInterface

I added functionality to get the RSSI, BER, and Cell Neighbor for reporting connection issues to M2X

Dependencies:   WncControllerK64F

mbedtls/source/ecdsa.c@16:8a4105d407d3, 2016-11-14 (annotated)

Committer:
JMF
Date:
Mon Nov 14 21:15:42 2016 +0000
Revision:
16:8a4105d407d3
Parent:
12:0071cb144c7a 
updated to ensure it builds with TLS by correcting config defaults.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
JMF 12:0071cb144c7a 1 /*
JMF 12:0071cb144c7a 2 * Elliptic curve DSA
JMF 12:0071cb144c7a 3 *
JMF 12:0071cb144c7a 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
JMF 12:0071cb144c7a 5 * SPDX-License-Identifier: Apache-2.0
JMF 12:0071cb144c7a 6 *
JMF 12:0071cb144c7a 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
JMF 12:0071cb144c7a 8 * not use this file except in compliance with the License.
JMF 12:0071cb144c7a 9 * You may obtain a copy of the License at
JMF 12:0071cb144c7a 10 *
JMF 12:0071cb144c7a 11 * http://www.apache.org/licenses/LICENSE-2.0
JMF 12:0071cb144c7a 12 *
JMF 12:0071cb144c7a 13 * Unless required by applicable law or agreed to in writing, software
JMF 12:0071cb144c7a 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
JMF 12:0071cb144c7a 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
JMF 12:0071cb144c7a 16 * See the License for the specific language governing permissions and
JMF 12:0071cb144c7a 17 * limitations under the License.
JMF 12:0071cb144c7a 18 *
JMF 12:0071cb144c7a 19 * This file is part of mbed TLS (https://tls.mbed.org)
JMF 12:0071cb144c7a 20 */
JMF 12:0071cb144c7a 21
JMF 12:0071cb144c7a 22 /*
JMF 12:0071cb144c7a 23 * References:
JMF 12:0071cb144c7a 24 *
JMF 12:0071cb144c7a 25 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
JMF 12:0071cb144c7a 26 */
JMF 12:0071cb144c7a 27
JMF 12:0071cb144c7a 28 #if !defined(MBEDTLS_CONFIG_FILE)
JMF 12:0071cb144c7a 29 #include "mbedtls/config.h"
JMF 12:0071cb144c7a 30 #else
JMF 12:0071cb144c7a 31 #include MBEDTLS_CONFIG_FILE
JMF 12:0071cb144c7a 32 #endif
JMF 12:0071cb144c7a 33
JMF 12:0071cb144c7a 34 #if defined(MBEDTLS_ECDSA_C)
JMF 12:0071cb144c7a 35
JMF 12:0071cb144c7a 36 #include "mbedtls/ecdsa.h"
JMF 12:0071cb144c7a 37 #include "mbedtls/asn1write.h"
JMF 12:0071cb144c7a 38
JMF 12:0071cb144c7a 39 #include <string.h>
JMF 12:0071cb144c7a 40
JMF 12:0071cb144c7a 41 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
JMF 12:0071cb144c7a 42 #include "mbedtls/hmac_drbg.h"
JMF 12:0071cb144c7a 43 #endif
JMF 12:0071cb144c7a 44
JMF 12:0071cb144c7a 45 /*
JMF 12:0071cb144c7a 46 * Derive a suitable integer for group grp from a buffer of length len
JMF 12:0071cb144c7a 47 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
JMF 12:0071cb144c7a 48 */
JMF 12:0071cb144c7a 49 static int derive_mpi( const mbedtls_ecp_group *grp, mbedtls_mpi *x,
JMF 12:0071cb144c7a 50 const unsigned char *buf, size_t blen )
JMF 12:0071cb144c7a 51 {
JMF 12:0071cb144c7a 52 int ret;
JMF 12:0071cb144c7a 53 size_t n_size = ( grp->nbits + 7 ) / 8;
JMF 12:0071cb144c7a 54 size_t use_size = blen > n_size ? n_size : blen;
JMF 12:0071cb144c7a 55
JMF 12:0071cb144c7a 56 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( x, buf, use_size ) );
JMF 12:0071cb144c7a 57 if( use_size * 8 > grp->nbits )
JMF 12:0071cb144c7a 58 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( x, use_size * 8 - grp->nbits ) );
JMF 12:0071cb144c7a 59
JMF 12:0071cb144c7a 60 /* While at it, reduce modulo N */
JMF 12:0071cb144c7a 61 if( mbedtls_mpi_cmp_mpi( x, &grp->N ) >= 0 )
JMF 12:0071cb144c7a 62 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
JMF 12:0071cb144c7a 63
JMF 12:0071cb144c7a 64 cleanup:
JMF 12:0071cb144c7a 65 return( ret );
JMF 12:0071cb144c7a 66 }
JMF 12:0071cb144c7a 67
JMF 12:0071cb144c7a 68 /*
JMF 12:0071cb144c7a 69 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
JMF 12:0071cb144c7a 70 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
JMF 12:0071cb144c7a 71 */
JMF 12:0071cb144c7a 72 int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
JMF 12:0071cb144c7a 73 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
JMF 12:0071cb144c7a 74 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
JMF 12:0071cb144c7a 75 {
JMF 12:0071cb144c7a 76 int ret, key_tries, sign_tries, blind_tries;
JMF 12:0071cb144c7a 77 mbedtls_ecp_point R;
JMF 12:0071cb144c7a 78 mbedtls_mpi k, e, t;
JMF 12:0071cb144c7a 79
JMF 12:0071cb144c7a 80 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
JMF 12:0071cb144c7a 81 if( grp->N.p == NULL )
JMF 12:0071cb144c7a 82 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
JMF 12:0071cb144c7a 83
JMF 12:0071cb144c7a 84 mbedtls_ecp_point_init( &R );
JMF 12:0071cb144c7a 85 mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
JMF 12:0071cb144c7a 86
JMF 12:0071cb144c7a 87 sign_tries = 0;
JMF 12:0071cb144c7a 88 do
JMF 12:0071cb144c7a 89 {
JMF 12:0071cb144c7a 90 /*
JMF 12:0071cb144c7a 91 * Steps 1-3: generate a suitable ephemeral keypair
JMF 12:0071cb144c7a 92 * and set r = xR mod n
JMF 12:0071cb144c7a 93 */
JMF 12:0071cb144c7a 94 key_tries = 0;
JMF 12:0071cb144c7a 95 do
JMF 12:0071cb144c7a 96 {
JMF 12:0071cb144c7a 97 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
JMF 12:0071cb144c7a 98 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( r, &R.X, &grp->N ) );
JMF 12:0071cb144c7a 99
JMF 12:0071cb144c7a 100 if( key_tries++ > 10 )
JMF 12:0071cb144c7a 101 {
JMF 12:0071cb144c7a 102 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
JMF 12:0071cb144c7a 103 goto cleanup;
JMF 12:0071cb144c7a 104 }
JMF 12:0071cb144c7a 105 }
JMF 12:0071cb144c7a 106 while( mbedtls_mpi_cmp_int( r, 0 ) == 0 );
JMF 12:0071cb144c7a 107
JMF 12:0071cb144c7a 108 /*
JMF 12:0071cb144c7a 109 * Step 5: derive MPI from hashed message
JMF 12:0071cb144c7a 110 */
JMF 12:0071cb144c7a 111 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
JMF 12:0071cb144c7a 112
JMF 12:0071cb144c7a 113 /*
JMF 12:0071cb144c7a 114 * Generate a random value to blind inv_mod in next step,
JMF 12:0071cb144c7a 115 * avoiding a potential timing leak.
JMF 12:0071cb144c7a 116 */
JMF 12:0071cb144c7a 117 blind_tries = 0;
JMF 12:0071cb144c7a 118 do
JMF 12:0071cb144c7a 119 {
JMF 12:0071cb144c7a 120 size_t n_size = ( grp->nbits + 7 ) / 8;
JMF 12:0071cb144c7a 121 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &t, n_size, f_rng, p_rng ) );
JMF 12:0071cb144c7a 122 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
JMF 12:0071cb144c7a 123
JMF 12:0071cb144c7a 124 /* See mbedtls_ecp_gen_keypair() */
JMF 12:0071cb144c7a 125 if( ++blind_tries > 30 )
JMF 12:0071cb144c7a 126 return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
JMF 12:0071cb144c7a 127 }
JMF 12:0071cb144c7a 128 while( mbedtls_mpi_cmp_int( &t, 1 ) < 0 ||
JMF 12:0071cb144c7a 129 mbedtls_mpi_cmp_mpi( &t, &grp->N ) >= 0 );
JMF 12:0071cb144c7a 130
JMF 12:0071cb144c7a 131 /*
JMF 12:0071cb144c7a 132 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
JMF 12:0071cb144c7a 133 */
JMF 12:0071cb144c7a 134 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, r, d ) );
JMF 12:0071cb144c7a 135 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
JMF 12:0071cb144c7a 136 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
JMF 12:0071cb144c7a 137 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &k, &k, &t ) );
JMF 12:0071cb144c7a 138 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, &k, &grp->N ) );
JMF 12:0071cb144c7a 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
JMF 12:0071cb144c7a 140 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
JMF 12:0071cb144c7a 141
JMF 12:0071cb144c7a 142 if( sign_tries++ > 10 )
JMF 12:0071cb144c7a 143 {
JMF 12:0071cb144c7a 144 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
JMF 12:0071cb144c7a 145 goto cleanup;
JMF 12:0071cb144c7a 146 }
JMF 12:0071cb144c7a 147 }
JMF 12:0071cb144c7a 148 while( mbedtls_mpi_cmp_int( s, 0 ) == 0 );
JMF 12:0071cb144c7a 149
JMF 12:0071cb144c7a 150 cleanup:
JMF 12:0071cb144c7a 151 mbedtls_ecp_point_free( &R );
JMF 12:0071cb144c7a 152 mbedtls_mpi_free( &k ); mbedtls_mpi_free( &e ); mbedtls_mpi_free( &t );
JMF 12:0071cb144c7a 153
JMF 12:0071cb144c7a 154 return( ret );
JMF 12:0071cb144c7a 155 }
JMF 12:0071cb144c7a 156
JMF 12:0071cb144c7a 157 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
JMF 12:0071cb144c7a 158 /*
JMF 12:0071cb144c7a 159 * Deterministic signature wrapper
JMF 12:0071cb144c7a 160 */
JMF 12:0071cb144c7a 161 int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
JMF 12:0071cb144c7a 162 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
JMF 12:0071cb144c7a 163 mbedtls_md_type_t md_alg )
JMF 12:0071cb144c7a 164 {
JMF 12:0071cb144c7a 165 int ret;
JMF 12:0071cb144c7a 166 mbedtls_hmac_drbg_context rng_ctx;
JMF 12:0071cb144c7a 167 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
JMF 12:0071cb144c7a 168 size_t grp_len = ( grp->nbits + 7 ) / 8;
JMF 12:0071cb144c7a 169 const mbedtls_md_info_t *md_info;
JMF 12:0071cb144c7a 170 mbedtls_mpi h;
JMF 12:0071cb144c7a 171
JMF 12:0071cb144c7a 172 if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
JMF 12:0071cb144c7a 173 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
JMF 12:0071cb144c7a 174
JMF 12:0071cb144c7a 175 mbedtls_mpi_init( &h );
JMF 12:0071cb144c7a 176 mbedtls_hmac_drbg_init( &rng_ctx );
JMF 12:0071cb144c7a 177
JMF 12:0071cb144c7a 178 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
JMF 12:0071cb144c7a 179 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( d, data, grp_len ) );
JMF 12:0071cb144c7a 180 MBEDTLS_MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
JMF 12:0071cb144c7a 181 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, data + grp_len, grp_len ) );
JMF 12:0071cb144c7a 182 mbedtls_hmac_drbg_seed_buf( &rng_ctx, md_info, data, 2 * grp_len );
JMF 12:0071cb144c7a 183
JMF 12:0071cb144c7a 184 ret = mbedtls_ecdsa_sign( grp, r, s, d, buf, blen,
JMF 12:0071cb144c7a 185 mbedtls_hmac_drbg_random, &rng_ctx );
JMF 12:0071cb144c7a 186
JMF 12:0071cb144c7a 187 cleanup:
JMF 12:0071cb144c7a 188 mbedtls_hmac_drbg_free( &rng_ctx );
JMF 12:0071cb144c7a 189 mbedtls_mpi_free( &h );
JMF 12:0071cb144c7a 190
JMF 12:0071cb144c7a 191 return( ret );
JMF 12:0071cb144c7a 192 }
JMF 12:0071cb144c7a 193 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
JMF 12:0071cb144c7a 194
JMF 12:0071cb144c7a 195 /*
JMF 12:0071cb144c7a 196 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
JMF 12:0071cb144c7a 197 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
JMF 12:0071cb144c7a 198 */
JMF 12:0071cb144c7a 199 int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
JMF 12:0071cb144c7a 200 const unsigned char *buf, size_t blen,
JMF 12:0071cb144c7a 201 const mbedtls_ecp_point *Q, const mbedtls_mpi *r, const mbedtls_mpi *s)
JMF 12:0071cb144c7a 202 {
JMF 12:0071cb144c7a 203 int ret;
JMF 12:0071cb144c7a 204 mbedtls_mpi e, s_inv, u1, u2;
JMF 12:0071cb144c7a 205 mbedtls_ecp_point R;
JMF 12:0071cb144c7a 206
JMF 12:0071cb144c7a 207 mbedtls_ecp_point_init( &R );
JMF 12:0071cb144c7a 208 mbedtls_mpi_init( &e ); mbedtls_mpi_init( &s_inv ); mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
JMF 12:0071cb144c7a 209
JMF 12:0071cb144c7a 210 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
JMF 12:0071cb144c7a 211 if( grp->N.p == NULL )
JMF 12:0071cb144c7a 212 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
JMF 12:0071cb144c7a 213
JMF 12:0071cb144c7a 214 /*
JMF 12:0071cb144c7a 215 * Step 1: make sure r and s are in range 1..n-1
JMF 12:0071cb144c7a 216 */
JMF 12:0071cb144c7a 217 if( mbedtls_mpi_cmp_int( r, 1 ) < 0 || mbedtls_mpi_cmp_mpi( r, &grp->N ) >= 0 ||
JMF 12:0071cb144c7a 218 mbedtls_mpi_cmp_int( s, 1 ) < 0 || mbedtls_mpi_cmp_mpi( s, &grp->N ) >= 0 )
JMF 12:0071cb144c7a 219 {
JMF 12:0071cb144c7a 220 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
JMF 12:0071cb144c7a 221 goto cleanup;
JMF 12:0071cb144c7a 222 }
JMF 12:0071cb144c7a 223
JMF 12:0071cb144c7a 224 /*
JMF 12:0071cb144c7a 225 * Additional precaution: make sure Q is valid
JMF 12:0071cb144c7a 226 */
JMF 12:0071cb144c7a 227 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, Q ) );
JMF 12:0071cb144c7a 228
JMF 12:0071cb144c7a 229 /*
JMF 12:0071cb144c7a 230 * Step 3: derive MPI from hashed message
JMF 12:0071cb144c7a 231 */
JMF 12:0071cb144c7a 232 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
JMF 12:0071cb144c7a 233
JMF 12:0071cb144c7a 234 /*
JMF 12:0071cb144c7a 235 * Step 4: u1 = e / s mod n, u2 = r / s mod n
JMF 12:0071cb144c7a 236 */
JMF 12:0071cb144c7a 237 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &s_inv, s, &grp->N ) );
JMF 12:0071cb144c7a 238
JMF 12:0071cb144c7a 239 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u1, &e, &s_inv ) );
JMF 12:0071cb144c7a 240 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u1, &u1, &grp->N ) );
JMF 12:0071cb144c7a 241
JMF 12:0071cb144c7a 242 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u2, r, &s_inv ) );
JMF 12:0071cb144c7a 243 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u2, &u2, &grp->N ) );
JMF 12:0071cb144c7a 244
JMF 12:0071cb144c7a 245 /*
JMF 12:0071cb144c7a 246 * Step 5: R = u1 G + u2 Q
JMF 12:0071cb144c7a 247 *
JMF 12:0071cb144c7a 248 * Since we're not using any secret data, no need to pass a RNG to
JMF 12:0071cb144c7a 249 * mbedtls_ecp_mul() for countermesures.
JMF 12:0071cb144c7a 250 */
JMF 12:0071cb144c7a 251 MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, &R, &u1, &grp->G, &u2, Q ) );
JMF 12:0071cb144c7a 252
JMF 12:0071cb144c7a 253 if( mbedtls_ecp_is_zero( &R ) )
JMF 12:0071cb144c7a 254 {
JMF 12:0071cb144c7a 255 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
JMF 12:0071cb144c7a 256 goto cleanup;
JMF 12:0071cb144c7a 257 }
JMF 12:0071cb144c7a 258
JMF 12:0071cb144c7a 259 /*
JMF 12:0071cb144c7a 260 * Step 6: convert xR to an integer (no-op)
JMF 12:0071cb144c7a 261 * Step 7: reduce xR mod n (gives v)
JMF 12:0071cb144c7a 262 */
JMF 12:0071cb144c7a 263 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
JMF 12:0071cb144c7a 264
JMF 12:0071cb144c7a 265 /*
JMF 12:0071cb144c7a 266 * Step 8: check if v (that is, R.X) is equal to r
JMF 12:0071cb144c7a 267 */
JMF 12:0071cb144c7a 268 if( mbedtls_mpi_cmp_mpi( &R.X, r ) != 0 )
JMF 12:0071cb144c7a 269 {
JMF 12:0071cb144c7a 270 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
JMF 12:0071cb144c7a 271 goto cleanup;
JMF 12:0071cb144c7a 272 }
JMF 12:0071cb144c7a 273
JMF 12:0071cb144c7a 274 cleanup:
JMF 12:0071cb144c7a 275 mbedtls_ecp_point_free( &R );
JMF 12:0071cb144c7a 276 mbedtls_mpi_free( &e ); mbedtls_mpi_free( &s_inv ); mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
JMF 12:0071cb144c7a 277
JMF 12:0071cb144c7a 278 return( ret );
JMF 12:0071cb144c7a 279 }
JMF 12:0071cb144c7a 280
JMF 12:0071cb144c7a 281 /*
JMF 12:0071cb144c7a 282 * Convert a signature (given by context) to ASN.1
JMF 12:0071cb144c7a 283 */
JMF 12:0071cb144c7a 284 static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
JMF 12:0071cb144c7a 285 unsigned char *sig, size_t *slen )
JMF 12:0071cb144c7a 286 {
JMF 12:0071cb144c7a 287 int ret;
JMF 12:0071cb144c7a 288 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
JMF 12:0071cb144c7a 289 unsigned char *p = buf + sizeof( buf );
JMF 12:0071cb144c7a 290 size_t len = 0;
JMF 12:0071cb144c7a 291
JMF 12:0071cb144c7a 292 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, s ) );
JMF 12:0071cb144c7a 293 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, r ) );
JMF 12:0071cb144c7a 294
JMF 12:0071cb144c7a 295 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, len ) );
JMF 12:0071cb144c7a 296 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
JMF 12:0071cb144c7a 297 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
JMF 12:0071cb144c7a 298
JMF 12:0071cb144c7a 299 memcpy( sig, p, len );
JMF 12:0071cb144c7a 300 *slen = len;
JMF 12:0071cb144c7a 301
JMF 12:0071cb144c7a 302 return( 0 );
JMF 12:0071cb144c7a 303 }
JMF 12:0071cb144c7a 304
JMF 12:0071cb144c7a 305 /*
JMF 12:0071cb144c7a 306 * Compute and write signature
JMF 12:0071cb144c7a 307 */
JMF 12:0071cb144c7a 308 int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, mbedtls_md_type_t md_alg,
JMF 12:0071cb144c7a 309 const unsigned char *hash, size_t hlen,
JMF 12:0071cb144c7a 310 unsigned char *sig, size_t *slen,
JMF 12:0071cb144c7a 311 int (*f_rng)(void *, unsigned char *, size_t),
JMF 12:0071cb144c7a 312 void *p_rng )
JMF 12:0071cb144c7a 313 {
JMF 12:0071cb144c7a 314 int ret;
JMF 12:0071cb144c7a 315 mbedtls_mpi r, s;
JMF 12:0071cb144c7a 316
JMF 12:0071cb144c7a 317 mbedtls_mpi_init( &r );
JMF 12:0071cb144c7a 318 mbedtls_mpi_init( &s );
JMF 12:0071cb144c7a 319
JMF 12:0071cb144c7a 320 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
JMF 12:0071cb144c7a 321 (void) f_rng;
JMF 12:0071cb144c7a 322 (void) p_rng;
JMF 12:0071cb144c7a 323
JMF 12:0071cb144c7a 324 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ctx->grp, &r, &s, &ctx->d,
JMF 12:0071cb144c7a 325 hash, hlen, md_alg ) );
JMF 12:0071cb144c7a 326 #else
JMF 12:0071cb144c7a 327 (void) md_alg;
JMF 12:0071cb144c7a 328
JMF 12:0071cb144c7a 329 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ctx->grp, &r, &s, &ctx->d,
JMF 12:0071cb144c7a 330 hash, hlen, f_rng, p_rng ) );
JMF 12:0071cb144c7a 331 #endif
JMF 12:0071cb144c7a 332
JMF 12:0071cb144c7a 333 MBEDTLS_MPI_CHK( ecdsa_signature_to_asn1( &r, &s, sig, slen ) );
JMF 12:0071cb144c7a 334
JMF 12:0071cb144c7a 335 cleanup:
JMF 12:0071cb144c7a 336 mbedtls_mpi_free( &r );
JMF 12:0071cb144c7a 337 mbedtls_mpi_free( &s );
JMF 12:0071cb144c7a 338
JMF 12:0071cb144c7a 339 return( ret );
JMF 12:0071cb144c7a 340 }
JMF 12:0071cb144c7a 341
JMF 12:0071cb144c7a 342 #if ! defined(MBEDTLS_DEPRECATED_REMOVED) && \
JMF 12:0071cb144c7a 343 defined(MBEDTLS_ECDSA_DETERMINISTIC)
JMF 12:0071cb144c7a 344 int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
JMF 12:0071cb144c7a 345 const unsigned char *hash, size_t hlen,
JMF 12:0071cb144c7a 346 unsigned char *sig, size_t *slen,
JMF 12:0071cb144c7a 347 mbedtls_md_type_t md_alg )
JMF 12:0071cb144c7a 348 {
JMF 12:0071cb144c7a 349 return( mbedtls_ecdsa_write_signature( ctx, md_alg, hash, hlen, sig, slen,
JMF 12:0071cb144c7a 350 NULL, NULL ) );
JMF 12:0071cb144c7a 351 }
JMF 12:0071cb144c7a 352 #endif
JMF 12:0071cb144c7a 353
JMF 12:0071cb144c7a 354 /*
JMF 12:0071cb144c7a 355 * Read and check signature
JMF 12:0071cb144c7a 356 */
JMF 12:0071cb144c7a 357 int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
JMF 12:0071cb144c7a 358 const unsigned char *hash, size_t hlen,
JMF 12:0071cb144c7a 359 const unsigned char *sig, size_t slen )
JMF 12:0071cb144c7a 360 {
JMF 12:0071cb144c7a 361 int ret;
JMF 12:0071cb144c7a 362 unsigned char *p = (unsigned char *) sig;
JMF 12:0071cb144c7a 363 const unsigned char *end = sig + slen;
JMF 12:0071cb144c7a 364 size_t len;
JMF 12:0071cb144c7a 365 mbedtls_mpi r, s;
JMF 12:0071cb144c7a 366
JMF 12:0071cb144c7a 367 mbedtls_mpi_init( &r );
JMF 12:0071cb144c7a 368 mbedtls_mpi_init( &s );
JMF 12:0071cb144c7a 369
JMF 12:0071cb144c7a 370 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
JMF 12:0071cb144c7a 371 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
JMF 12:0071cb144c7a 372 {
JMF 12:0071cb144c7a 373 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
JMF 12:0071cb144c7a 374 goto cleanup;
JMF 12:0071cb144c7a 375 }
JMF 12:0071cb144c7a 376
JMF 12:0071cb144c7a 377 if( p + len != end )
JMF 12:0071cb144c7a 378 {
JMF 12:0071cb144c7a 379 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA +
JMF 12:0071cb144c7a 380 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
JMF 12:0071cb144c7a 381 goto cleanup;
JMF 12:0071cb144c7a 382 }
JMF 12:0071cb144c7a 383
JMF 12:0071cb144c7a 384 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &r ) ) != 0 ||
JMF 12:0071cb144c7a 385 ( ret = mbedtls_asn1_get_mpi( &p, end, &s ) ) != 0 )
JMF 12:0071cb144c7a 386 {
JMF 12:0071cb144c7a 387 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
JMF 12:0071cb144c7a 388 goto cleanup;
JMF 12:0071cb144c7a 389 }
JMF 12:0071cb144c7a 390
JMF 12:0071cb144c7a 391 if( ( ret = mbedtls_ecdsa_verify( &ctx->grp, hash, hlen,
JMF 12:0071cb144c7a 392 &ctx->Q, &r, &s ) ) != 0 )
JMF 12:0071cb144c7a 393 goto cleanup;
JMF 12:0071cb144c7a 394
JMF 12:0071cb144c7a 395 if( p != end )
JMF 12:0071cb144c7a 396 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
JMF 12:0071cb144c7a 397
JMF 12:0071cb144c7a 398 cleanup:
JMF 12:0071cb144c7a 399 mbedtls_mpi_free( &r );
JMF 12:0071cb144c7a 400 mbedtls_mpi_free( &s );
JMF 12:0071cb144c7a 401
JMF 12:0071cb144c7a 402 return( ret );
JMF 12:0071cb144c7a 403 }
JMF 12:0071cb144c7a 404
JMF 12:0071cb144c7a 405 /*
JMF 12:0071cb144c7a 406 * Generate key pair
JMF 12:0071cb144c7a 407 */
JMF 12:0071cb144c7a 408 int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
JMF 12:0071cb144c7a 409 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
JMF 12:0071cb144c7a 410 {
JMF 12:0071cb144c7a 411 return( mbedtls_ecp_group_load( &ctx->grp, gid ) ||
JMF 12:0071cb144c7a 412 mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
JMF 12:0071cb144c7a 413 }
JMF 12:0071cb144c7a 414
JMF 12:0071cb144c7a 415 /*
JMF 12:0071cb144c7a 416 * Set context from an mbedtls_ecp_keypair
JMF 12:0071cb144c7a 417 */
JMF 12:0071cb144c7a 418 int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key )
JMF 12:0071cb144c7a 419 {
JMF 12:0071cb144c7a 420 int ret;
JMF 12:0071cb144c7a 421
JMF 12:0071cb144c7a 422 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
JMF 12:0071cb144c7a 423 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 ||
JMF 12:0071cb144c7a 424 ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
JMF 12:0071cb144c7a 425 {
JMF 12:0071cb144c7a 426 mbedtls_ecdsa_free( ctx );
JMF 12:0071cb144c7a 427 }
JMF 12:0071cb144c7a 428
JMF 12:0071cb144c7a 429 return( ret );
JMF 12:0071cb144c7a 430 }
JMF 12:0071cb144c7a 431
JMF 12:0071cb144c7a 432 /*
JMF 12:0071cb144c7a 433 * Initialize context
JMF 12:0071cb144c7a 434 */
JMF 12:0071cb144c7a 435 void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx )
JMF 12:0071cb144c7a 436 {
JMF 12:0071cb144c7a 437 mbedtls_ecp_keypair_init( ctx );
JMF 12:0071cb144c7a 438 }
JMF 12:0071cb144c7a 439
JMF 12:0071cb144c7a 440 /*
JMF 12:0071cb144c7a 441 * Free context
JMF 12:0071cb144c7a 442 */
JMF 12:0071cb144c7a 443 void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx )
JMF 12:0071cb144c7a 444 {
JMF 12:0071cb144c7a 445 mbedtls_ecp_keypair_free( ctx );
JMF 12:0071cb144c7a 446 }
JMF 12:0071cb144c7a 447
JMF 12:0071cb144c7a 448 #endif /* MBEDTLS_ECDSA_C */