Xuyi Wang
/
wolfSSL
Important changes to repositories hosted on mbed.com
Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.
To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.
It is also possible to export all your personal repositories from the account settings page.
wolfcrypt/src/dsa.c@15:117db924cf7c, 2018-08-18 (annotated)
- Committer:
- wolfSSL
- Date:
- Sat Aug 18 22:20:43 2018 +0000
- Revision:
- 15:117db924cf7c
wolfSSL 3.15.3
Who changed what in which revision?
| User | Revision | Line number | New contents of line |
|---|---|---|---|
| wolfSSL | 15:117db924cf7c | 1 | /* dsa.c |
| wolfSSL | 15:117db924cf7c | 2 | * |
| wolfSSL | 15:117db924cf7c | 3 | * Copyright (C) 2006-2017 wolfSSL Inc. |
| wolfSSL | 15:117db924cf7c | 4 | * |
| wolfSSL | 15:117db924cf7c | 5 | * This file is part of wolfSSL. |
| wolfSSL | 15:117db924cf7c | 6 | * |
| wolfSSL | 15:117db924cf7c | 7 | * wolfSSL is free software; you can redistribute it and/or modify |
| wolfSSL | 15:117db924cf7c | 8 | * it under the terms of the GNU General Public License as published by |
| wolfSSL | 15:117db924cf7c | 9 | * the Free Software Foundation; either version 2 of the License, or |
| wolfSSL | 15:117db924cf7c | 10 | * (at your option) any later version. |
| wolfSSL | 15:117db924cf7c | 11 | * |
| wolfSSL | 15:117db924cf7c | 12 | * wolfSSL is distributed in the hope that it will be useful, |
| wolfSSL | 15:117db924cf7c | 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| wolfSSL | 15:117db924cf7c | 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| wolfSSL | 15:117db924cf7c | 15 | * GNU General Public License for more details. |
| wolfSSL | 15:117db924cf7c | 16 | * |
| wolfSSL | 15:117db924cf7c | 17 | * You should have received a copy of the GNU General Public License |
| wolfSSL | 15:117db924cf7c | 18 | * along with this program; if not, write to the Free Software |
| wolfSSL | 15:117db924cf7c | 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
| wolfSSL | 15:117db924cf7c | 20 | */ |
| wolfSSL | 15:117db924cf7c | 21 | |
| wolfSSL | 15:117db924cf7c | 22 | |
| wolfSSL | 15:117db924cf7c | 23 | #ifdef HAVE_CONFIG_H |
| wolfSSL | 15:117db924cf7c | 24 | #include <config.h> |
| wolfSSL | 15:117db924cf7c | 25 | #endif |
| wolfSSL | 15:117db924cf7c | 26 | |
| wolfSSL | 15:117db924cf7c | 27 | #include <wolfssl/wolfcrypt/settings.h> |
| wolfSSL | 15:117db924cf7c | 28 | |
| wolfSSL | 15:117db924cf7c | 29 | #ifndef NO_DSA |
| wolfSSL | 15:117db924cf7c | 30 | |
| wolfSSL | 15:117db924cf7c | 31 | #include <wolfssl/wolfcrypt/random.h> |
| wolfSSL | 15:117db924cf7c | 32 | #include <wolfssl/wolfcrypt/integer.h> |
| wolfSSL | 15:117db924cf7c | 33 | #include <wolfssl/wolfcrypt/error-crypt.h> |
| wolfSSL | 15:117db924cf7c | 34 | #include <wolfssl/wolfcrypt/logging.h> |
| wolfSSL | 15:117db924cf7c | 35 | #include <wolfssl/wolfcrypt/sha.h> |
| wolfSSL | 15:117db924cf7c | 36 | #include <wolfssl/wolfcrypt/dsa.h> |
| wolfSSL | 15:117db924cf7c | 37 | |
| wolfSSL | 15:117db924cf7c | 38 | #ifdef NO_INLINE |
| wolfSSL | 15:117db924cf7c | 39 | #include <wolfssl/wolfcrypt/misc.h> |
| wolfSSL | 15:117db924cf7c | 40 | #else |
| wolfSSL | 15:117db924cf7c | 41 | #define WOLFSSL_MISC_INCLUDED |
| wolfSSL | 15:117db924cf7c | 42 | #include <wolfcrypt/src/misc.c> |
| wolfSSL | 15:117db924cf7c | 43 | #endif |
| wolfSSL | 15:117db924cf7c | 44 | |
| wolfSSL | 15:117db924cf7c | 45 | |
| wolfSSL | 15:117db924cf7c | 46 | enum { |
| wolfSSL | 15:117db924cf7c | 47 | DSA_HALF_SIZE = 20, /* r and s size */ |
| wolfSSL | 15:117db924cf7c | 48 | DSA_SIG_SIZE = 40 /* signature size */ |
| wolfSSL | 15:117db924cf7c | 49 | }; |
| wolfSSL | 15:117db924cf7c | 50 | |
| wolfSSL | 15:117db924cf7c | 51 | |
| wolfSSL | 15:117db924cf7c | 52 | |
| wolfSSL | 15:117db924cf7c | 53 | int wc_InitDsaKey(DsaKey* key) |
| wolfSSL | 15:117db924cf7c | 54 | { |
| wolfSSL | 15:117db924cf7c | 55 | if (key == NULL) |
| wolfSSL | 15:117db924cf7c | 56 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 57 | |
| wolfSSL | 15:117db924cf7c | 58 | key->type = -1; /* haven't decided yet */ |
| wolfSSL | 15:117db924cf7c | 59 | key->heap = NULL; |
| wolfSSL | 15:117db924cf7c | 60 | |
| wolfSSL | 15:117db924cf7c | 61 | return mp_init_multi( |
| wolfSSL | 15:117db924cf7c | 62 | /* public alloc parts */ |
| wolfSSL | 15:117db924cf7c | 63 | &key->p, |
| wolfSSL | 15:117db924cf7c | 64 | &key->q, |
| wolfSSL | 15:117db924cf7c | 65 | &key->g, |
| wolfSSL | 15:117db924cf7c | 66 | &key->y, |
| wolfSSL | 15:117db924cf7c | 67 | |
| wolfSSL | 15:117db924cf7c | 68 | /* private alloc parts */ |
| wolfSSL | 15:117db924cf7c | 69 | &key->x, |
| wolfSSL | 15:117db924cf7c | 70 | NULL |
| wolfSSL | 15:117db924cf7c | 71 | ); |
| wolfSSL | 15:117db924cf7c | 72 | } |
| wolfSSL | 15:117db924cf7c | 73 | |
| wolfSSL | 15:117db924cf7c | 74 | |
| wolfSSL | 15:117db924cf7c | 75 | int wc_InitDsaKey_h(DsaKey* key, void* h) |
| wolfSSL | 15:117db924cf7c | 76 | { |
| wolfSSL | 15:117db924cf7c | 77 | int ret = wc_InitDsaKey(key); |
| wolfSSL | 15:117db924cf7c | 78 | if (ret == 0) |
| wolfSSL | 15:117db924cf7c | 79 | key->heap = h; |
| wolfSSL | 15:117db924cf7c | 80 | |
| wolfSSL | 15:117db924cf7c | 81 | return ret; |
| wolfSSL | 15:117db924cf7c | 82 | } |
| wolfSSL | 15:117db924cf7c | 83 | |
| wolfSSL | 15:117db924cf7c | 84 | |
| wolfSSL | 15:117db924cf7c | 85 | void wc_FreeDsaKey(DsaKey* key) |
| wolfSSL | 15:117db924cf7c | 86 | { |
| wolfSSL | 15:117db924cf7c | 87 | if (key == NULL) |
| wolfSSL | 15:117db924cf7c | 88 | return; |
| wolfSSL | 15:117db924cf7c | 89 | |
| wolfSSL | 15:117db924cf7c | 90 | if (key->type == DSA_PRIVATE) |
| wolfSSL | 15:117db924cf7c | 91 | mp_forcezero(&key->x); |
| wolfSSL | 15:117db924cf7c | 92 | |
| wolfSSL | 15:117db924cf7c | 93 | mp_clear(&key->x); |
| wolfSSL | 15:117db924cf7c | 94 | mp_clear(&key->y); |
| wolfSSL | 15:117db924cf7c | 95 | mp_clear(&key->g); |
| wolfSSL | 15:117db924cf7c | 96 | mp_clear(&key->q); |
| wolfSSL | 15:117db924cf7c | 97 | mp_clear(&key->p); |
| wolfSSL | 15:117db924cf7c | 98 | } |
| wolfSSL | 15:117db924cf7c | 99 | |
| wolfSSL | 15:117db924cf7c | 100 | |
| wolfSSL | 15:117db924cf7c | 101 | /* validate that (L,N) match allowed sizes from FIPS 186-4, Section 4.2. |
| wolfSSL | 15:117db924cf7c | 102 | * modLen - represents L, the size of p (prime modulus) in bits |
| wolfSSL | 15:117db924cf7c | 103 | * divLen - represents N, the size of q (prime divisor) in bits |
| wolfSSL | 15:117db924cf7c | 104 | * return 0 on success, -1 on error */ |
| wolfSSL | 15:117db924cf7c | 105 | static int CheckDsaLN(int modLen, int divLen) |
| wolfSSL | 15:117db924cf7c | 106 | { |
| wolfSSL | 15:117db924cf7c | 107 | int ret = -1; |
| wolfSSL | 15:117db924cf7c | 108 | |
| wolfSSL | 15:117db924cf7c | 109 | switch (modLen) { |
| wolfSSL | 15:117db924cf7c | 110 | case 1024: |
| wolfSSL | 15:117db924cf7c | 111 | if (divLen == 160) |
| wolfSSL | 15:117db924cf7c | 112 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 113 | break; |
| wolfSSL | 15:117db924cf7c | 114 | case 2048: |
| wolfSSL | 15:117db924cf7c | 115 | if (divLen == 224 || divLen == 256) |
| wolfSSL | 15:117db924cf7c | 116 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 117 | break; |
| wolfSSL | 15:117db924cf7c | 118 | case 3072: |
| wolfSSL | 15:117db924cf7c | 119 | if (divLen == 256) |
| wolfSSL | 15:117db924cf7c | 120 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 121 | break; |
| wolfSSL | 15:117db924cf7c | 122 | default: |
| wolfSSL | 15:117db924cf7c | 123 | break; |
| wolfSSL | 15:117db924cf7c | 124 | } |
| wolfSSL | 15:117db924cf7c | 125 | |
| wolfSSL | 15:117db924cf7c | 126 | return ret; |
| wolfSSL | 15:117db924cf7c | 127 | } |
| wolfSSL | 15:117db924cf7c | 128 | |
| wolfSSL | 15:117db924cf7c | 129 | |
| wolfSSL | 15:117db924cf7c | 130 | #ifdef WOLFSSL_KEY_GEN |
| wolfSSL | 15:117db924cf7c | 131 | |
| wolfSSL | 15:117db924cf7c | 132 | /* Create DSA key pair (&dsa->x, &dsa->y) |
| wolfSSL | 15:117db924cf7c | 133 | * |
| wolfSSL | 15:117db924cf7c | 134 | * Based on NIST FIPS 186-4, |
| wolfSSL | 15:117db924cf7c | 135 | * "B.1.1 Key Pair Generation Using Extra Random Bits" |
| wolfSSL | 15:117db924cf7c | 136 | * |
| wolfSSL | 15:117db924cf7c | 137 | * rng - pointer to initialized WC_RNG structure |
| wolfSSL | 15:117db924cf7c | 138 | * dsa - pointer to initialized DsaKey structure, will hold generated key |
| wolfSSL | 15:117db924cf7c | 139 | * |
| wolfSSL | 15:117db924cf7c | 140 | * return 0 on success, negative on error */ |
| wolfSSL | 15:117db924cf7c | 141 | int wc_MakeDsaKey(WC_RNG *rng, DsaKey *dsa) |
| wolfSSL | 15:117db924cf7c | 142 | { |
| wolfSSL | 15:117db924cf7c | 143 | byte* cBuf; |
| wolfSSL | 15:117db924cf7c | 144 | int qSz, pSz, cSz, err; |
| wolfSSL | 15:117db924cf7c | 145 | mp_int tmpQ; |
| wolfSSL | 15:117db924cf7c | 146 | |
| wolfSSL | 15:117db924cf7c | 147 | if (rng == NULL || dsa == NULL) |
| wolfSSL | 15:117db924cf7c | 148 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 149 | |
| wolfSSL | 15:117db924cf7c | 150 | qSz = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 151 | pSz = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 152 | |
| wolfSSL | 15:117db924cf7c | 153 | /* verify (L,N) pair bit lengths */ |
| wolfSSL | 15:117db924cf7c | 154 | if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) |
| wolfSSL | 15:117db924cf7c | 155 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 156 | |
| wolfSSL | 15:117db924cf7c | 157 | /* generate extra 64 bits so that bias from mod function is negligible */ |
| wolfSSL | 15:117db924cf7c | 158 | cSz = qSz + (64 / WOLFSSL_BIT_SIZE); |
| wolfSSL | 15:117db924cf7c | 159 | cBuf = (byte*)XMALLOC(cSz, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 160 | if (cBuf == NULL) { |
| wolfSSL | 15:117db924cf7c | 161 | return MEMORY_E; |
| wolfSSL | 15:117db924cf7c | 162 | } |
| wolfSSL | 15:117db924cf7c | 163 | |
| wolfSSL | 15:117db924cf7c | 164 | if ((err = mp_init_multi(&dsa->x, &dsa->y, &tmpQ, NULL, NULL, NULL)) |
| wolfSSL | 15:117db924cf7c | 165 | != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 166 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 167 | return err; |
| wolfSSL | 15:117db924cf7c | 168 | } |
| wolfSSL | 15:117db924cf7c | 169 | |
| wolfSSL | 15:117db924cf7c | 170 | do { |
| wolfSSL | 15:117db924cf7c | 171 | /* generate N+64 bits (c) from RBG into &dsa->x, making sure positive. |
| wolfSSL | 15:117db924cf7c | 172 | * Hash_DRBG uses SHA-256 which matches maximum |
| wolfSSL | 15:117db924cf7c | 173 | * requested_security_strength of (L,N) */ |
| wolfSSL | 15:117db924cf7c | 174 | err = wc_RNG_GenerateBlock(rng, cBuf, cSz); |
| wolfSSL | 15:117db924cf7c | 175 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 176 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 177 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 178 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 179 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 180 | return err; |
| wolfSSL | 15:117db924cf7c | 181 | } |
| wolfSSL | 15:117db924cf7c | 182 | |
| wolfSSL | 15:117db924cf7c | 183 | err = mp_read_unsigned_bin(&dsa->x, cBuf, cSz); |
| wolfSSL | 15:117db924cf7c | 184 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 185 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 186 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 187 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 188 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 189 | return err; |
| wolfSSL | 15:117db924cf7c | 190 | } |
| wolfSSL | 15:117db924cf7c | 191 | } while (mp_cmp_d(&dsa->x, 1) != MP_GT); |
| wolfSSL | 15:117db924cf7c | 192 | |
| wolfSSL | 15:117db924cf7c | 193 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 194 | |
| wolfSSL | 15:117db924cf7c | 195 | /* tmpQ = q - 1 */ |
| wolfSSL | 15:117db924cf7c | 196 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 197 | err = mp_copy(&dsa->q, &tmpQ); |
| wolfSSL | 15:117db924cf7c | 198 | |
| wolfSSL | 15:117db924cf7c | 199 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 200 | err = mp_sub_d(&tmpQ, 1, &tmpQ); |
| wolfSSL | 15:117db924cf7c | 201 | |
| wolfSSL | 15:117db924cf7c | 202 | /* x = c mod (q-1), &dsa->x holds c */ |
| wolfSSL | 15:117db924cf7c | 203 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 204 | err = mp_mod(&dsa->x, &tmpQ, &dsa->x); |
| wolfSSL | 15:117db924cf7c | 205 | |
| wolfSSL | 15:117db924cf7c | 206 | /* x = c mod (q-1) + 1 */ |
| wolfSSL | 15:117db924cf7c | 207 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 208 | err = mp_add_d(&dsa->x, 1, &dsa->x); |
| wolfSSL | 15:117db924cf7c | 209 | |
| wolfSSL | 15:117db924cf7c | 210 | /* public key : y = g^x mod p */ |
| wolfSSL | 15:117db924cf7c | 211 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 212 | err = mp_exptmod(&dsa->g, &dsa->x, &dsa->p, &dsa->y); |
| wolfSSL | 15:117db924cf7c | 213 | |
| wolfSSL | 15:117db924cf7c | 214 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 215 | dsa->type = DSA_PRIVATE; |
| wolfSSL | 15:117db924cf7c | 216 | |
| wolfSSL | 15:117db924cf7c | 217 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 218 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 219 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 220 | } |
| wolfSSL | 15:117db924cf7c | 221 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 222 | |
| wolfSSL | 15:117db924cf7c | 223 | return err; |
| wolfSSL | 15:117db924cf7c | 224 | } |
| wolfSSL | 15:117db924cf7c | 225 | |
| wolfSSL | 15:117db924cf7c | 226 | |
| wolfSSL | 15:117db924cf7c | 227 | /* modulus_size in bits */ |
| wolfSSL | 15:117db924cf7c | 228 | int wc_MakeDsaParameters(WC_RNG *rng, int modulus_size, DsaKey *dsa) |
| wolfSSL | 15:117db924cf7c | 229 | { |
| wolfSSL | 15:117db924cf7c | 230 | mp_int tmp, tmp2; |
| wolfSSL | 15:117db924cf7c | 231 | int err, msize, qsize, |
| wolfSSL | 15:117db924cf7c | 232 | loop_check_prime = 0, |
| wolfSSL | 15:117db924cf7c | 233 | check_prime = MP_NO; |
| wolfSSL | 15:117db924cf7c | 234 | unsigned char *buf; |
| wolfSSL | 15:117db924cf7c | 235 | |
| wolfSSL | 15:117db924cf7c | 236 | if (rng == NULL || dsa == NULL) |
| wolfSSL | 15:117db924cf7c | 237 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 238 | |
| wolfSSL | 15:117db924cf7c | 239 | /* set group size in bytes from modulus size |
| wolfSSL | 15:117db924cf7c | 240 | * FIPS 186-4 defines valid values (1024, 160) (2048, 256) (3072, 256) |
| wolfSSL | 15:117db924cf7c | 241 | */ |
| wolfSSL | 15:117db924cf7c | 242 | switch (modulus_size) { |
| wolfSSL | 15:117db924cf7c | 243 | case 1024: |
| wolfSSL | 15:117db924cf7c | 244 | qsize = 20; |
| wolfSSL | 15:117db924cf7c | 245 | break; |
| wolfSSL | 15:117db924cf7c | 246 | case 2048: |
| wolfSSL | 15:117db924cf7c | 247 | case 3072: |
| wolfSSL | 15:117db924cf7c | 248 | qsize = 32; |
| wolfSSL | 15:117db924cf7c | 249 | break; |
| wolfSSL | 15:117db924cf7c | 250 | default: |
| wolfSSL | 15:117db924cf7c | 251 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 252 | break; |
| wolfSSL | 15:117db924cf7c | 253 | } |
| wolfSSL | 15:117db924cf7c | 254 | |
| wolfSSL | 15:117db924cf7c | 255 | /* modulus size in bytes */ |
| wolfSSL | 15:117db924cf7c | 256 | msize = modulus_size / WOLFSSL_BIT_SIZE; |
| wolfSSL | 15:117db924cf7c | 257 | |
| wolfSSL | 15:117db924cf7c | 258 | /* allocate ram */ |
| wolfSSL | 15:117db924cf7c | 259 | buf = (unsigned char *)XMALLOC(msize - qsize, |
| wolfSSL | 15:117db924cf7c | 260 | dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 261 | if (buf == NULL) { |
| wolfSSL | 15:117db924cf7c | 262 | return MEMORY_E; |
| wolfSSL | 15:117db924cf7c | 263 | } |
| wolfSSL | 15:117db924cf7c | 264 | |
| wolfSSL | 15:117db924cf7c | 265 | /* make a random string that will be multplied against q */ |
| wolfSSL | 15:117db924cf7c | 266 | err = wc_RNG_GenerateBlock(rng, buf, msize - qsize); |
| wolfSSL | 15:117db924cf7c | 267 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 268 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 269 | return err; |
| wolfSSL | 15:117db924cf7c | 270 | } |
| wolfSSL | 15:117db924cf7c | 271 | |
| wolfSSL | 15:117db924cf7c | 272 | /* force magnitude */ |
| wolfSSL | 15:117db924cf7c | 273 | buf[0] |= 0xC0; |
| wolfSSL | 15:117db924cf7c | 274 | |
| wolfSSL | 15:117db924cf7c | 275 | /* force even */ |
| wolfSSL | 15:117db924cf7c | 276 | buf[msize - qsize - 1] &= ~1; |
| wolfSSL | 15:117db924cf7c | 277 | |
| wolfSSL | 15:117db924cf7c | 278 | if (mp_init_multi(&tmp2, &dsa->p, &dsa->q, 0, 0, 0) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 279 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 280 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 281 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 282 | } |
| wolfSSL | 15:117db924cf7c | 283 | |
| wolfSSL | 15:117db924cf7c | 284 | err = mp_read_unsigned_bin(&tmp2, buf, msize - qsize); |
| wolfSSL | 15:117db924cf7c | 285 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 286 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 287 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 288 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 289 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 290 | return err; |
| wolfSSL | 15:117db924cf7c | 291 | } |
| wolfSSL | 15:117db924cf7c | 292 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 293 | |
| wolfSSL | 15:117db924cf7c | 294 | /* make our prime q */ |
| wolfSSL | 15:117db924cf7c | 295 | err = mp_rand_prime(&dsa->q, qsize, rng, NULL); |
| wolfSSL | 15:117db924cf7c | 296 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 297 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 298 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 299 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 300 | return err; |
| wolfSSL | 15:117db924cf7c | 301 | } |
| wolfSSL | 15:117db924cf7c | 302 | |
| wolfSSL | 15:117db924cf7c | 303 | /* p = random * q */ |
| wolfSSL | 15:117db924cf7c | 304 | err = mp_mul(&dsa->q, &tmp2, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 305 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 306 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 307 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 308 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 309 | return err; |
| wolfSSL | 15:117db924cf7c | 310 | } |
| wolfSSL | 15:117db924cf7c | 311 | |
| wolfSSL | 15:117db924cf7c | 312 | /* p = random * q + 1, so q is a prime divisor of p-1 */ |
| wolfSSL | 15:117db924cf7c | 313 | err = mp_add_d(&dsa->p, 1, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 314 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 315 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 316 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 317 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 318 | return err; |
| wolfSSL | 15:117db924cf7c | 319 | } |
| wolfSSL | 15:117db924cf7c | 320 | |
| wolfSSL | 15:117db924cf7c | 321 | if (mp_init(&tmp) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 322 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 323 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 324 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 325 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 326 | } |
| wolfSSL | 15:117db924cf7c | 327 | |
| wolfSSL | 15:117db924cf7c | 328 | /* tmp = 2q */ |
| wolfSSL | 15:117db924cf7c | 329 | err = mp_add(&dsa->q, &dsa->q, &tmp); |
| wolfSSL | 15:117db924cf7c | 330 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 331 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 332 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 333 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 334 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 335 | return err; |
| wolfSSL | 15:117db924cf7c | 336 | } |
| wolfSSL | 15:117db924cf7c | 337 | |
| wolfSSL | 15:117db924cf7c | 338 | /* loop until p is prime */ |
| wolfSSL | 15:117db924cf7c | 339 | while (check_prime == MP_NO) { |
| wolfSSL | 15:117db924cf7c | 340 | err = mp_prime_is_prime(&dsa->p, 8, &check_prime); |
| wolfSSL | 15:117db924cf7c | 341 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 342 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 343 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 344 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 345 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 346 | return err; |
| wolfSSL | 15:117db924cf7c | 347 | } |
| wolfSSL | 15:117db924cf7c | 348 | |
| wolfSSL | 15:117db924cf7c | 349 | if (check_prime != MP_YES) { |
| wolfSSL | 15:117db924cf7c | 350 | /* p += 2q */ |
| wolfSSL | 15:117db924cf7c | 351 | err = mp_add(&tmp, &dsa->p, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 352 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 353 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 354 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 355 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 356 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 357 | return err; |
| wolfSSL | 15:117db924cf7c | 358 | } |
| wolfSSL | 15:117db924cf7c | 359 | |
| wolfSSL | 15:117db924cf7c | 360 | loop_check_prime++; |
| wolfSSL | 15:117db924cf7c | 361 | } |
| wolfSSL | 15:117db924cf7c | 362 | } |
| wolfSSL | 15:117db924cf7c | 363 | |
| wolfSSL | 15:117db924cf7c | 364 | /* tmp2 += (2*loop_check_prime) |
| wolfSSL | 15:117db924cf7c | 365 | * to have p = (q * tmp2) + 1 prime |
| wolfSSL | 15:117db924cf7c | 366 | */ |
| wolfSSL | 15:117db924cf7c | 367 | if (loop_check_prime) { |
| wolfSSL | 15:117db924cf7c | 368 | err = mp_add_d(&tmp2, 2*loop_check_prime, &tmp2); |
| wolfSSL | 15:117db924cf7c | 369 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 370 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 371 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 372 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 373 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 374 | return err; |
| wolfSSL | 15:117db924cf7c | 375 | } |
| wolfSSL | 15:117db924cf7c | 376 | } |
| wolfSSL | 15:117db924cf7c | 377 | |
| wolfSSL | 15:117db924cf7c | 378 | if (mp_init(&dsa->g) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 379 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 380 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 381 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 382 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 383 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 384 | } |
| wolfSSL | 15:117db924cf7c | 385 | |
| wolfSSL | 15:117db924cf7c | 386 | /* find a value g for which g^tmp2 != 1 */ |
| wolfSSL | 15:117db924cf7c | 387 | if (mp_set(&dsa->g, 1) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 388 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 389 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 390 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 391 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 392 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 393 | } |
| wolfSSL | 15:117db924cf7c | 394 | |
| wolfSSL | 15:117db924cf7c | 395 | do { |
| wolfSSL | 15:117db924cf7c | 396 | err = mp_add_d(&dsa->g, 1, &dsa->g); |
| wolfSSL | 15:117db924cf7c | 397 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 398 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 399 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 400 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 401 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 402 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 403 | return err; |
| wolfSSL | 15:117db924cf7c | 404 | } |
| wolfSSL | 15:117db924cf7c | 405 | |
| wolfSSL | 15:117db924cf7c | 406 | err = mp_exptmod(&dsa->g, &tmp2, &dsa->p, &tmp); |
| wolfSSL | 15:117db924cf7c | 407 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 408 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 409 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 410 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 411 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 412 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 413 | return err; |
| wolfSSL | 15:117db924cf7c | 414 | } |
| wolfSSL | 15:117db924cf7c | 415 | |
| wolfSSL | 15:117db924cf7c | 416 | } while (mp_cmp_d(&tmp, 1) == MP_EQ); |
| wolfSSL | 15:117db924cf7c | 417 | |
| wolfSSL | 15:117db924cf7c | 418 | /* at this point tmp generates a group of order q mod p */ |
| wolfSSL | 15:117db924cf7c | 419 | mp_exch(&tmp, &dsa->g); |
| wolfSSL | 15:117db924cf7c | 420 | |
| wolfSSL | 15:117db924cf7c | 421 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 422 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 423 | |
| wolfSSL | 15:117db924cf7c | 424 | return MP_OKAY; |
| wolfSSL | 15:117db924cf7c | 425 | } |
| wolfSSL | 15:117db924cf7c | 426 | #endif /* WOLFSSL_KEY_GEN */ |
| wolfSSL | 15:117db924cf7c | 427 | |
| wolfSSL | 15:117db924cf7c | 428 | |
| wolfSSL | 15:117db924cf7c | 429 | /* Import raw DSA parameters into DsaKey structure for use with wc_MakeDsaKey(), |
| wolfSSL | 15:117db924cf7c | 430 | * input parameters (p,q,g) should be represented as ASCII hex values. |
| wolfSSL | 15:117db924cf7c | 431 | * |
| wolfSSL | 15:117db924cf7c | 432 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 15:117db924cf7c | 433 | * p - DSA (p) parameter, ASCII hex string |
| wolfSSL | 15:117db924cf7c | 434 | * pSz - length of p |
| wolfSSL | 15:117db924cf7c | 435 | * q - DSA (q) parameter, ASCII hex string |
| wolfSSL | 15:117db924cf7c | 436 | * qSz - length of q |
| wolfSSL | 15:117db924cf7c | 437 | * g - DSA (g) parameter, ASCII hex string |
| wolfSSL | 15:117db924cf7c | 438 | * gSz - length of g |
| wolfSSL | 15:117db924cf7c | 439 | * |
| wolfSSL | 15:117db924cf7c | 440 | * returns 0 on success, negative upon failure |
| wolfSSL | 15:117db924cf7c | 441 | */ |
| wolfSSL | 15:117db924cf7c | 442 | int wc_DsaImportParamsRaw(DsaKey* dsa, const char* p, const char* q, |
| wolfSSL | 15:117db924cf7c | 443 | const char* g) |
| wolfSSL | 15:117db924cf7c | 444 | { |
| wolfSSL | 15:117db924cf7c | 445 | int err; |
| wolfSSL | 15:117db924cf7c | 446 | word32 pSz, qSz; |
| wolfSSL | 15:117db924cf7c | 447 | |
| wolfSSL | 15:117db924cf7c | 448 | if (dsa == NULL || p == NULL || q == NULL || g == NULL) |
| wolfSSL | 15:117db924cf7c | 449 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 450 | |
| wolfSSL | 15:117db924cf7c | 451 | /* read p */ |
| wolfSSL | 15:117db924cf7c | 452 | err = mp_read_radix(&dsa->p, p, MP_RADIX_HEX); |
| wolfSSL | 15:117db924cf7c | 453 | |
| wolfSSL | 15:117db924cf7c | 454 | /* read q */ |
| wolfSSL | 15:117db924cf7c | 455 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 456 | err = mp_read_radix(&dsa->q, q, MP_RADIX_HEX); |
| wolfSSL | 15:117db924cf7c | 457 | |
| wolfSSL | 15:117db924cf7c | 458 | /* read g */ |
| wolfSSL | 15:117db924cf7c | 459 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 460 | err = mp_read_radix(&dsa->g, g, MP_RADIX_HEX); |
| wolfSSL | 15:117db924cf7c | 461 | |
| wolfSSL | 15:117db924cf7c | 462 | /* verify (L,N) pair bit lengths */ |
| wolfSSL | 15:117db924cf7c | 463 | pSz = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 464 | qSz = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 465 | |
| wolfSSL | 15:117db924cf7c | 466 | if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) { |
| wolfSSL | 15:117db924cf7c | 467 | WOLFSSL_MSG("Invalid DSA p or q parameter size"); |
| wolfSSL | 15:117db924cf7c | 468 | err = BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 469 | } |
| wolfSSL | 15:117db924cf7c | 470 | |
| wolfSSL | 15:117db924cf7c | 471 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 472 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 473 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 474 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 475 | } |
| wolfSSL | 15:117db924cf7c | 476 | |
| wolfSSL | 15:117db924cf7c | 477 | return err; |
| wolfSSL | 15:117db924cf7c | 478 | } |
| wolfSSL | 15:117db924cf7c | 479 | |
| wolfSSL | 15:117db924cf7c | 480 | |
| wolfSSL | 15:117db924cf7c | 481 | /* Export raw DSA parameters from DsaKey structure |
| wolfSSL | 15:117db924cf7c | 482 | * |
| wolfSSL | 15:117db924cf7c | 483 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 15:117db924cf7c | 484 | * p - output location for DSA (p) parameter |
| wolfSSL | 15:117db924cf7c | 485 | * pSz - [IN/OUT] size of output buffer for p, size of p |
| wolfSSL | 15:117db924cf7c | 486 | * q - output location for DSA (q) parameter |
| wolfSSL | 15:117db924cf7c | 487 | * qSz - [IN/OUT] size of output buffer for q, size of q |
| wolfSSL | 15:117db924cf7c | 488 | * g - output location for DSA (g) parameter |
| wolfSSL | 15:117db924cf7c | 489 | * gSz - [IN/OUT] size of output buffer for g, size of g |
| wolfSSL | 15:117db924cf7c | 490 | * |
| wolfSSL | 15:117db924cf7c | 491 | * If p, q, and g pointers are all passed in as NULL, the function |
| wolfSSL | 15:117db924cf7c | 492 | * will set pSz, qSz, and gSz to the required output buffer sizes for p, |
| wolfSSL | 15:117db924cf7c | 493 | * q, and g. In this case, the function will return LENGTH_ONLY_E. |
| wolfSSL | 15:117db924cf7c | 494 | * |
| wolfSSL | 15:117db924cf7c | 495 | * returns 0 on success, negative upon failure |
| wolfSSL | 15:117db924cf7c | 496 | */ |
| wolfSSL | 15:117db924cf7c | 497 | int wc_DsaExportParamsRaw(DsaKey* dsa, byte* p, word32* pSz, |
| wolfSSL | 15:117db924cf7c | 498 | byte* q, word32* qSz, byte* g, word32* gSz) |
| wolfSSL | 15:117db924cf7c | 499 | { |
| wolfSSL | 15:117db924cf7c | 500 | int err; |
| wolfSSL | 15:117db924cf7c | 501 | word32 pLen, qLen, gLen; |
| wolfSSL | 15:117db924cf7c | 502 | |
| wolfSSL | 15:117db924cf7c | 503 | if (dsa == NULL || pSz == NULL || qSz == NULL || gSz == NULL) |
| wolfSSL | 15:117db924cf7c | 504 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 505 | |
| wolfSSL | 15:117db924cf7c | 506 | /* get required output buffer sizes */ |
| wolfSSL | 15:117db924cf7c | 507 | pLen = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 508 | qLen = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 509 | gLen = mp_unsigned_bin_size(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 510 | |
| wolfSSL | 15:117db924cf7c | 511 | /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */ |
| wolfSSL | 15:117db924cf7c | 512 | if (p == NULL && q == NULL && g == NULL) { |
| wolfSSL | 15:117db924cf7c | 513 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 514 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 515 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 516 | return LENGTH_ONLY_E; |
| wolfSSL | 15:117db924cf7c | 517 | } |
| wolfSSL | 15:117db924cf7c | 518 | |
| wolfSSL | 15:117db924cf7c | 519 | if (p == NULL || q == NULL || g == NULL) |
| wolfSSL | 15:117db924cf7c | 520 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 521 | |
| wolfSSL | 15:117db924cf7c | 522 | /* export p */ |
| wolfSSL | 15:117db924cf7c | 523 | if (*pSz < pLen) { |
| wolfSSL | 15:117db924cf7c | 524 | WOLFSSL_MSG("Output buffer for DSA p parameter too small, " |
| wolfSSL | 15:117db924cf7c | 525 | "required size placed into pSz"); |
| wolfSSL | 15:117db924cf7c | 526 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 527 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 528 | } |
| wolfSSL | 15:117db924cf7c | 529 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 530 | err = mp_to_unsigned_bin(&dsa->p, p); |
| wolfSSL | 15:117db924cf7c | 531 | |
| wolfSSL | 15:117db924cf7c | 532 | /* export q */ |
| wolfSSL | 15:117db924cf7c | 533 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 534 | if (*qSz < qLen) { |
| wolfSSL | 15:117db924cf7c | 535 | WOLFSSL_MSG("Output buffer for DSA q parameter too small, " |
| wolfSSL | 15:117db924cf7c | 536 | "required size placed into qSz"); |
| wolfSSL | 15:117db924cf7c | 537 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 538 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 539 | } |
| wolfSSL | 15:117db924cf7c | 540 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 541 | err = mp_to_unsigned_bin(&dsa->q, q); |
| wolfSSL | 15:117db924cf7c | 542 | } |
| wolfSSL | 15:117db924cf7c | 543 | |
| wolfSSL | 15:117db924cf7c | 544 | /* export g */ |
| wolfSSL | 15:117db924cf7c | 545 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 546 | if (*gSz < gLen) { |
| wolfSSL | 15:117db924cf7c | 547 | WOLFSSL_MSG("Output buffer for DSA g parameter too small, " |
| wolfSSL | 15:117db924cf7c | 548 | "required size placed into gSz"); |
| wolfSSL | 15:117db924cf7c | 549 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 550 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 551 | } |
| wolfSSL | 15:117db924cf7c | 552 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 553 | err = mp_to_unsigned_bin(&dsa->g, g); |
| wolfSSL | 15:117db924cf7c | 554 | } |
| wolfSSL | 15:117db924cf7c | 555 | |
| wolfSSL | 15:117db924cf7c | 556 | return err; |
| wolfSSL | 15:117db924cf7c | 557 | } |
| wolfSSL | 15:117db924cf7c | 558 | |
| wolfSSL | 15:117db924cf7c | 559 | |
| wolfSSL | 15:117db924cf7c | 560 | /* Export raw DSA key (x, y) from DsaKey structure |
| wolfSSL | 15:117db924cf7c | 561 | * |
| wolfSSL | 15:117db924cf7c | 562 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 15:117db924cf7c | 563 | * x - output location for private key |
| wolfSSL | 15:117db924cf7c | 564 | * xSz - [IN/OUT] size of output buffer for x, size of x |
| wolfSSL | 15:117db924cf7c | 565 | * y - output location for public key |
| wolfSSL | 15:117db924cf7c | 566 | * ySz - [IN/OUT] size of output buffer for y, size of y |
| wolfSSL | 15:117db924cf7c | 567 | * |
| wolfSSL | 15:117db924cf7c | 568 | * If x and y pointers are all passed in as NULL, the function |
| wolfSSL | 15:117db924cf7c | 569 | * will set xSz and ySz to the required output buffer sizes for x |
| wolfSSL | 15:117db924cf7c | 570 | * and y. In this case, the function will return LENGTH_ONLY_E. |
| wolfSSL | 15:117db924cf7c | 571 | * |
| wolfSSL | 15:117db924cf7c | 572 | * returns 0 on success, negative upon failure |
| wolfSSL | 15:117db924cf7c | 573 | */ |
| wolfSSL | 15:117db924cf7c | 574 | int wc_DsaExportKeyRaw(DsaKey* dsa, byte* x, word32* xSz, byte* y, word32* ySz) |
| wolfSSL | 15:117db924cf7c | 575 | { |
| wolfSSL | 15:117db924cf7c | 576 | int err; |
| wolfSSL | 15:117db924cf7c | 577 | word32 xLen, yLen; |
| wolfSSL | 15:117db924cf7c | 578 | |
| wolfSSL | 15:117db924cf7c | 579 | if (dsa == NULL || xSz == NULL || ySz == NULL) |
| wolfSSL | 15:117db924cf7c | 580 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 581 | |
| wolfSSL | 15:117db924cf7c | 582 | /* get required output buffer sizes */ |
| wolfSSL | 15:117db924cf7c | 583 | xLen = mp_unsigned_bin_size(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 584 | yLen = mp_unsigned_bin_size(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 585 | |
| wolfSSL | 15:117db924cf7c | 586 | /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */ |
| wolfSSL | 15:117db924cf7c | 587 | if (x == NULL && y == NULL) { |
| wolfSSL | 15:117db924cf7c | 588 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 589 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 590 | return LENGTH_ONLY_E; |
| wolfSSL | 15:117db924cf7c | 591 | } |
| wolfSSL | 15:117db924cf7c | 592 | |
| wolfSSL | 15:117db924cf7c | 593 | if (x == NULL || y == NULL) |
| wolfSSL | 15:117db924cf7c | 594 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 595 | |
| wolfSSL | 15:117db924cf7c | 596 | /* export x */ |
| wolfSSL | 15:117db924cf7c | 597 | if (*xSz < xLen) { |
| wolfSSL | 15:117db924cf7c | 598 | WOLFSSL_MSG("Output buffer for DSA private key (x) too small, " |
| wolfSSL | 15:117db924cf7c | 599 | "required size placed into xSz"); |
| wolfSSL | 15:117db924cf7c | 600 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 601 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 602 | } |
| wolfSSL | 15:117db924cf7c | 603 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 604 | err = mp_to_unsigned_bin(&dsa->x, x); |
| wolfSSL | 15:117db924cf7c | 605 | |
| wolfSSL | 15:117db924cf7c | 606 | /* export y */ |
| wolfSSL | 15:117db924cf7c | 607 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 608 | if (*ySz < yLen) { |
| wolfSSL | 15:117db924cf7c | 609 | WOLFSSL_MSG("Output buffer to DSA public key (y) too small, " |
| wolfSSL | 15:117db924cf7c | 610 | "required size placed into ySz"); |
| wolfSSL | 15:117db924cf7c | 611 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 612 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 613 | } |
| wolfSSL | 15:117db924cf7c | 614 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 615 | err = mp_to_unsigned_bin(&dsa->y, y); |
| wolfSSL | 15:117db924cf7c | 616 | } |
| wolfSSL | 15:117db924cf7c | 617 | |
| wolfSSL | 15:117db924cf7c | 618 | return err; |
| wolfSSL | 15:117db924cf7c | 619 | } |
| wolfSSL | 15:117db924cf7c | 620 | |
| wolfSSL | 15:117db924cf7c | 621 | |
| wolfSSL | 15:117db924cf7c | 622 | int wc_DsaSign(const byte* digest, byte* out, DsaKey* key, WC_RNG* rng) |
| wolfSSL | 15:117db924cf7c | 623 | { |
| wolfSSL | 15:117db924cf7c | 624 | mp_int k, kInv, r, s, H; |
| wolfSSL | 15:117db924cf7c | 625 | int ret, sz; |
| wolfSSL | 15:117db924cf7c | 626 | byte buffer[DSA_HALF_SIZE]; |
| wolfSSL | 15:117db924cf7c | 627 | byte* tmp; /* initial output pointer */ |
| wolfSSL | 15:117db924cf7c | 628 | |
| wolfSSL | 15:117db924cf7c | 629 | if (digest == NULL || out == NULL || key == NULL || rng == NULL) { |
| wolfSSL | 15:117db924cf7c | 630 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 631 | } |
| wolfSSL | 15:117db924cf7c | 632 | |
| wolfSSL | 15:117db924cf7c | 633 | tmp = out; |
| wolfSSL | 15:117db924cf7c | 634 | |
| wolfSSL | 15:117db924cf7c | 635 | sz = min((int)sizeof(buffer), mp_unsigned_bin_size(&key->q)); |
| wolfSSL | 15:117db924cf7c | 636 | |
| wolfSSL | 15:117db924cf7c | 637 | if (mp_init_multi(&k, &kInv, &r, &s, &H, 0) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 638 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 639 | |
| wolfSSL | 15:117db924cf7c | 640 | do { |
| wolfSSL | 15:117db924cf7c | 641 | /* generate k */ |
| wolfSSL | 15:117db924cf7c | 642 | ret = wc_RNG_GenerateBlock(rng, buffer, sz); |
| wolfSSL | 15:117db924cf7c | 643 | if (ret != 0) |
| wolfSSL | 15:117db924cf7c | 644 | return ret; |
| wolfSSL | 15:117db924cf7c | 645 | |
| wolfSSL | 15:117db924cf7c | 646 | buffer[0] |= 0x0C; |
| wolfSSL | 15:117db924cf7c | 647 | |
| wolfSSL | 15:117db924cf7c | 648 | if (mp_read_unsigned_bin(&k, buffer, sz) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 649 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 650 | |
| wolfSSL | 15:117db924cf7c | 651 | /* k is a random numnber and it should be less than q |
| wolfSSL | 15:117db924cf7c | 652 | * if k greater than repeat |
| wolfSSL | 15:117db924cf7c | 653 | */ |
| wolfSSL | 15:117db924cf7c | 654 | } while (mp_cmp(&k, &key->q) != MP_LT); |
| wolfSSL | 15:117db924cf7c | 655 | |
| wolfSSL | 15:117db924cf7c | 656 | if (ret == 0 && mp_cmp_d(&k, 1) != MP_GT) |
| wolfSSL | 15:117db924cf7c | 657 | ret = MP_CMP_E; |
| wolfSSL | 15:117db924cf7c | 658 | |
| wolfSSL | 15:117db924cf7c | 659 | /* inverse k mod q */ |
| wolfSSL | 15:117db924cf7c | 660 | if (ret == 0 && mp_invmod(&k, &key->q, &kInv) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 661 | ret = MP_INVMOD_E; |
| wolfSSL | 15:117db924cf7c | 662 | |
| wolfSSL | 15:117db924cf7c | 663 | /* generate r, r = (g exp k mod p) mod q */ |
| wolfSSL | 15:117db924cf7c | 664 | if (ret == 0 && mp_exptmod(&key->g, &k, &key->p, &r) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 665 | ret = MP_EXPTMOD_E; |
| wolfSSL | 15:117db924cf7c | 666 | |
| wolfSSL | 15:117db924cf7c | 667 | if (ret == 0 && mp_mod(&r, &key->q, &r) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 668 | ret = MP_MOD_E; |
| wolfSSL | 15:117db924cf7c | 669 | |
| wolfSSL | 15:117db924cf7c | 670 | /* generate H from sha digest */ |
| wolfSSL | 15:117db924cf7c | 671 | if (ret == 0 && mp_read_unsigned_bin(&H, digest,WC_SHA_DIGEST_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 672 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 673 | |
| wolfSSL | 15:117db924cf7c | 674 | /* generate s, s = (kInv * (H + x*r)) % q */ |
| wolfSSL | 15:117db924cf7c | 675 | if (ret == 0 && mp_mul(&key->x, &r, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 676 | ret = MP_MUL_E; |
| wolfSSL | 15:117db924cf7c | 677 | |
| wolfSSL | 15:117db924cf7c | 678 | if (ret == 0 && mp_add(&s, &H, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 679 | ret = MP_ADD_E; |
| wolfSSL | 15:117db924cf7c | 680 | |
| wolfSSL | 15:117db924cf7c | 681 | if (ret == 0 && mp_mulmod(&s, &kInv, &key->q, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 682 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 683 | |
| wolfSSL | 15:117db924cf7c | 684 | /* detect zero r or s */ |
| wolfSSL | 15:117db924cf7c | 685 | if (ret == 0 && (mp_iszero(&r) == MP_YES || mp_iszero(&s) == MP_YES)) |
| wolfSSL | 15:117db924cf7c | 686 | ret = MP_ZERO_E; |
| wolfSSL | 15:117db924cf7c | 687 | |
| wolfSSL | 15:117db924cf7c | 688 | /* write out */ |
| wolfSSL | 15:117db924cf7c | 689 | if (ret == 0) { |
| wolfSSL | 15:117db924cf7c | 690 | int rSz = mp_unsigned_bin_size(&r); |
| wolfSSL | 15:117db924cf7c | 691 | int sSz = mp_unsigned_bin_size(&s); |
| wolfSSL | 15:117db924cf7c | 692 | |
| wolfSSL | 15:117db924cf7c | 693 | while (rSz++ < DSA_HALF_SIZE) { |
| wolfSSL | 15:117db924cf7c | 694 | *out++ = 0x00; /* pad front with zeros */ |
| wolfSSL | 15:117db924cf7c | 695 | } |
| wolfSSL | 15:117db924cf7c | 696 | |
| wolfSSL | 15:117db924cf7c | 697 | if (mp_to_unsigned_bin(&r, out) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 698 | ret = MP_TO_E; |
| wolfSSL | 15:117db924cf7c | 699 | else { |
| wolfSSL | 15:117db924cf7c | 700 | out = tmp + DSA_HALF_SIZE; /* advance to s in output */ |
| wolfSSL | 15:117db924cf7c | 701 | while (sSz++ < DSA_HALF_SIZE) { |
| wolfSSL | 15:117db924cf7c | 702 | *out++ = 0x00; /* pad front with zeros */ |
| wolfSSL | 15:117db924cf7c | 703 | } |
| wolfSSL | 15:117db924cf7c | 704 | ret = mp_to_unsigned_bin(&s, out); |
| wolfSSL | 15:117db924cf7c | 705 | } |
| wolfSSL | 15:117db924cf7c | 706 | } |
| wolfSSL | 15:117db924cf7c | 707 | |
| wolfSSL | 15:117db924cf7c | 708 | mp_clear(&H); |
| wolfSSL | 15:117db924cf7c | 709 | mp_clear(&s); |
| wolfSSL | 15:117db924cf7c | 710 | mp_clear(&r); |
| wolfSSL | 15:117db924cf7c | 711 | mp_clear(&kInv); |
| wolfSSL | 15:117db924cf7c | 712 | mp_clear(&k); |
| wolfSSL | 15:117db924cf7c | 713 | |
| wolfSSL | 15:117db924cf7c | 714 | return ret; |
| wolfSSL | 15:117db924cf7c | 715 | } |
| wolfSSL | 15:117db924cf7c | 716 | |
| wolfSSL | 15:117db924cf7c | 717 | |
| wolfSSL | 15:117db924cf7c | 718 | int wc_DsaVerify(const byte* digest, const byte* sig, DsaKey* key, int* answer) |
| wolfSSL | 15:117db924cf7c | 719 | { |
| wolfSSL | 15:117db924cf7c | 720 | mp_int w, u1, u2, v, r, s; |
| wolfSSL | 15:117db924cf7c | 721 | int ret = 0; |
| wolfSSL | 15:117db924cf7c | 722 | |
| wolfSSL | 15:117db924cf7c | 723 | if (digest == NULL || sig == NULL || key == NULL || answer == NULL) { |
| wolfSSL | 15:117db924cf7c | 724 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 725 | } |
| wolfSSL | 15:117db924cf7c | 726 | |
| wolfSSL | 15:117db924cf7c | 727 | if (mp_init_multi(&w, &u1, &u2, &v, &r, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 728 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 729 | |
| wolfSSL | 15:117db924cf7c | 730 | /* set r and s from signature */ |
| wolfSSL | 15:117db924cf7c | 731 | if (mp_read_unsigned_bin(&r, sig, DSA_HALF_SIZE) != MP_OKAY || |
| wolfSSL | 15:117db924cf7c | 732 | mp_read_unsigned_bin(&s, sig + DSA_HALF_SIZE, DSA_HALF_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 733 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 734 | |
| wolfSSL | 15:117db924cf7c | 735 | /* sanity checks */ |
| wolfSSL | 15:117db924cf7c | 736 | if (ret == 0) { |
| wolfSSL | 15:117db924cf7c | 737 | if (mp_iszero(&r) == MP_YES || mp_iszero(&s) == MP_YES || |
| wolfSSL | 15:117db924cf7c | 738 | mp_cmp(&r, &key->q) != MP_LT || mp_cmp(&s, &key->q) != MP_LT) { |
| wolfSSL | 15:117db924cf7c | 739 | ret = MP_ZERO_E; |
| wolfSSL | 15:117db924cf7c | 740 | } |
| wolfSSL | 15:117db924cf7c | 741 | } |
| wolfSSL | 15:117db924cf7c | 742 | |
| wolfSSL | 15:117db924cf7c | 743 | /* put H into u1 from sha digest */ |
| wolfSSL | 15:117db924cf7c | 744 | if (ret == 0 && mp_read_unsigned_bin(&u1,digest,WC_SHA_DIGEST_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 745 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 746 | |
| wolfSSL | 15:117db924cf7c | 747 | /* w = s invmod q */ |
| wolfSSL | 15:117db924cf7c | 748 | if (ret == 0 && mp_invmod(&s, &key->q, &w) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 749 | ret = MP_INVMOD_E; |
| wolfSSL | 15:117db924cf7c | 750 | |
| wolfSSL | 15:117db924cf7c | 751 | /* u1 = (H * w) % q */ |
| wolfSSL | 15:117db924cf7c | 752 | if (ret == 0 && mp_mulmod(&u1, &w, &key->q, &u1) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 753 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 754 | |
| wolfSSL | 15:117db924cf7c | 755 | /* u2 = (r * w) % q */ |
| wolfSSL | 15:117db924cf7c | 756 | if (ret == 0 && mp_mulmod(&r, &w, &key->q, &u2) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 757 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 758 | |
| wolfSSL | 15:117db924cf7c | 759 | /* verify v = ((g^u1 * y^u2) mod p) mod q */ |
| wolfSSL | 15:117db924cf7c | 760 | if (ret == 0 && mp_exptmod(&key->g, &u1, &key->p, &u1) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 761 | ret = MP_EXPTMOD_E; |
| wolfSSL | 15:117db924cf7c | 762 | |
| wolfSSL | 15:117db924cf7c | 763 | if (ret == 0 && mp_exptmod(&key->y, &u2, &key->p, &u2) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 764 | ret = MP_EXPTMOD_E; |
| wolfSSL | 15:117db924cf7c | 765 | |
| wolfSSL | 15:117db924cf7c | 766 | if (ret == 0 && mp_mulmod(&u1, &u2, &key->p, &v) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 767 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 768 | |
| wolfSSL | 15:117db924cf7c | 769 | if (ret == 0 && mp_mod(&v, &key->q, &v) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 770 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 771 | |
| wolfSSL | 15:117db924cf7c | 772 | /* do they match */ |
| wolfSSL | 15:117db924cf7c | 773 | if (ret == 0 && mp_cmp(&r, &v) == MP_EQ) |
| wolfSSL | 15:117db924cf7c | 774 | *answer = 1; |
| wolfSSL | 15:117db924cf7c | 775 | else |
| wolfSSL | 15:117db924cf7c | 776 | *answer = 0; |
| wolfSSL | 15:117db924cf7c | 777 | |
| wolfSSL | 15:117db924cf7c | 778 | mp_clear(&s); |
| wolfSSL | 15:117db924cf7c | 779 | mp_clear(&r); |
| wolfSSL | 15:117db924cf7c | 780 | mp_clear(&u1); |
| wolfSSL | 15:117db924cf7c | 781 | mp_clear(&u2); |
| wolfSSL | 15:117db924cf7c | 782 | mp_clear(&w); |
| wolfSSL | 15:117db924cf7c | 783 | mp_clear(&v); |
| wolfSSL | 15:117db924cf7c | 784 | |
| wolfSSL | 15:117db924cf7c | 785 | return ret; |
| wolfSSL | 15:117db924cf7c | 786 | } |
| wolfSSL | 15:117db924cf7c | 787 | |
| wolfSSL | 15:117db924cf7c | 788 | |
| wolfSSL | 15:117db924cf7c | 789 | #endif /* NO_DSA */ |
| wolfSSL | 15:117db924cf7c | 790 | |
| wolfSSL | 15:117db924cf7c | 791 |