Timothy Beight / Mbed 2 deprecated 6_songs-from-the-cloud

This is a fork due to permission issues

Dependencies:   mbed Socket lwip-eth lwip-sys lwip

Fork of 6_songs-from-the-cloud by MakingMusicWorkshop

mbed-client/mbedtls/source/ecdsa.c@1:0ddbe2d3319c, 2016-05-19 (annotated)

Committer:
timbeight
Date:
Thu May 19 16:02:10 2016 +0000
Revision:
1:0ddbe2d3319c
Parent:
0:f7c60d3e7b8a 
This is my first commit while in the class.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
maclobdell 0:f7c60d3e7b8a 1 /*
maclobdell 0:f7c60d3e7b8a 2 * Elliptic curve DSA
maclobdell 0:f7c60d3e7b8a 3 *
maclobdell 0:f7c60d3e7b8a 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
maclobdell 0:f7c60d3e7b8a 5 * SPDX-License-Identifier: Apache-2.0
maclobdell 0:f7c60d3e7b8a 6 *
maclobdell 0:f7c60d3e7b8a 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
maclobdell 0:f7c60d3e7b8a 8 * not use this file except in compliance with the License.
maclobdell 0:f7c60d3e7b8a 9 * You may obtain a copy of the License at
maclobdell 0:f7c60d3e7b8a 10 *
maclobdell 0:f7c60d3e7b8a 11 * http://www.apache.org/licenses/LICENSE-2.0
maclobdell 0:f7c60d3e7b8a 12 *
maclobdell 0:f7c60d3e7b8a 13 * Unless required by applicable law or agreed to in writing, software
maclobdell 0:f7c60d3e7b8a 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
maclobdell 0:f7c60d3e7b8a 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
maclobdell 0:f7c60d3e7b8a 16 * See the License for the specific language governing permissions and
maclobdell 0:f7c60d3e7b8a 17 * limitations under the License.
maclobdell 0:f7c60d3e7b8a 18 *
maclobdell 0:f7c60d3e7b8a 19 * This file is part of mbed TLS (https://tls.mbed.org)
maclobdell 0:f7c60d3e7b8a 20 */
maclobdell 0:f7c60d3e7b8a 21
maclobdell 0:f7c60d3e7b8a 22 /*
maclobdell 0:f7c60d3e7b8a 23 * References:
maclobdell 0:f7c60d3e7b8a 24 *
maclobdell 0:f7c60d3e7b8a 25 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
maclobdell 0:f7c60d3e7b8a 26 */
maclobdell 0:f7c60d3e7b8a 27
maclobdell 0:f7c60d3e7b8a 28 #if !defined(MBEDTLS_CONFIG_FILE)
maclobdell 0:f7c60d3e7b8a 29 #include "mbedtls/config.h"
maclobdell 0:f7c60d3e7b8a 30 #else
maclobdell 0:f7c60d3e7b8a 31 #include MBEDTLS_CONFIG_FILE
maclobdell 0:f7c60d3e7b8a 32 #endif
maclobdell 0:f7c60d3e7b8a 33
maclobdell 0:f7c60d3e7b8a 34 #if defined(MBEDTLS_ECDSA_C)
maclobdell 0:f7c60d3e7b8a 35
maclobdell 0:f7c60d3e7b8a 36 #include "mbedtls/ecdsa.h"
maclobdell 0:f7c60d3e7b8a 37 #include "mbedtls/asn1write.h"
maclobdell 0:f7c60d3e7b8a 38
maclobdell 0:f7c60d3e7b8a 39 #include <string.h>
maclobdell 0:f7c60d3e7b8a 40
maclobdell 0:f7c60d3e7b8a 41 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
maclobdell 0:f7c60d3e7b8a 42 #include "mbedtls/hmac_drbg.h"
maclobdell 0:f7c60d3e7b8a 43 #endif
maclobdell 0:f7c60d3e7b8a 44
maclobdell 0:f7c60d3e7b8a 45 /*
maclobdell 0:f7c60d3e7b8a 46 * Derive a suitable integer for group grp from a buffer of length len
maclobdell 0:f7c60d3e7b8a 47 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
maclobdell 0:f7c60d3e7b8a 48 */
maclobdell 0:f7c60d3e7b8a 49 static int derive_mpi( const mbedtls_ecp_group *grp, mbedtls_mpi *x,
maclobdell 0:f7c60d3e7b8a 50 const unsigned char *buf, size_t blen )
maclobdell 0:f7c60d3e7b8a 51 {
maclobdell 0:f7c60d3e7b8a 52 int ret;
maclobdell 0:f7c60d3e7b8a 53 size_t n_size = ( grp->nbits + 7 ) / 8;
maclobdell 0:f7c60d3e7b8a 54 size_t use_size = blen > n_size ? n_size : blen;
maclobdell 0:f7c60d3e7b8a 55
maclobdell 0:f7c60d3e7b8a 56 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( x, buf, use_size ) );
maclobdell 0:f7c60d3e7b8a 57 if( use_size * 8 > grp->nbits )
maclobdell 0:f7c60d3e7b8a 58 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( x, use_size * 8 - grp->nbits ) );
maclobdell 0:f7c60d3e7b8a 59
maclobdell 0:f7c60d3e7b8a 60 /* While at it, reduce modulo N */
maclobdell 0:f7c60d3e7b8a 61 if( mbedtls_mpi_cmp_mpi( x, &grp->N ) >= 0 )
maclobdell 0:f7c60d3e7b8a 62 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 63
maclobdell 0:f7c60d3e7b8a 64 cleanup:
maclobdell 0:f7c60d3e7b8a 65 return( ret );
maclobdell 0:f7c60d3e7b8a 66 }
maclobdell 0:f7c60d3e7b8a 67
maclobdell 0:f7c60d3e7b8a 68 /*
maclobdell 0:f7c60d3e7b8a 69 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
maclobdell 0:f7c60d3e7b8a 70 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
maclobdell 0:f7c60d3e7b8a 71 */
maclobdell 0:f7c60d3e7b8a 72 int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
maclobdell 0:f7c60d3e7b8a 73 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
maclobdell 0:f7c60d3e7b8a 74 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
maclobdell 0:f7c60d3e7b8a 75 {
maclobdell 0:f7c60d3e7b8a 76 int ret, key_tries, sign_tries, blind_tries;
maclobdell 0:f7c60d3e7b8a 77 mbedtls_ecp_point R;
maclobdell 0:f7c60d3e7b8a 78 mbedtls_mpi k, e, t;
maclobdell 0:f7c60d3e7b8a 79
maclobdell 0:f7c60d3e7b8a 80 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
maclobdell 0:f7c60d3e7b8a 81 if( grp->N.p == NULL )
maclobdell 0:f7c60d3e7b8a 82 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 83
maclobdell 0:f7c60d3e7b8a 84 mbedtls_ecp_point_init( &R );
maclobdell 0:f7c60d3e7b8a 85 mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
maclobdell 0:f7c60d3e7b8a 86
maclobdell 0:f7c60d3e7b8a 87 sign_tries = 0;
maclobdell 0:f7c60d3e7b8a 88 do
maclobdell 0:f7c60d3e7b8a 89 {
maclobdell 0:f7c60d3e7b8a 90 /*
maclobdell 0:f7c60d3e7b8a 91 * Steps 1-3: generate a suitable ephemeral keypair
maclobdell 0:f7c60d3e7b8a 92 * and set r = xR mod n
maclobdell 0:f7c60d3e7b8a 93 */
maclobdell 0:f7c60d3e7b8a 94 key_tries = 0;
maclobdell 0:f7c60d3e7b8a 95 do
maclobdell 0:f7c60d3e7b8a 96 {
maclobdell 0:f7c60d3e7b8a 97 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
maclobdell 0:f7c60d3e7b8a 98 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( r, &R.X, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 99
maclobdell 0:f7c60d3e7b8a 100 if( key_tries++ > 10 )
maclobdell 0:f7c60d3e7b8a 101 {
maclobdell 0:f7c60d3e7b8a 102 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
maclobdell 0:f7c60d3e7b8a 103 goto cleanup;
maclobdell 0:f7c60d3e7b8a 104 }
maclobdell 0:f7c60d3e7b8a 105 }
maclobdell 0:f7c60d3e7b8a 106 while( mbedtls_mpi_cmp_int( r, 0 ) == 0 );
maclobdell 0:f7c60d3e7b8a 107
maclobdell 0:f7c60d3e7b8a 108 /*
maclobdell 0:f7c60d3e7b8a 109 * Step 5: derive MPI from hashed message
maclobdell 0:f7c60d3e7b8a 110 */
maclobdell 0:f7c60d3e7b8a 111 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
maclobdell 0:f7c60d3e7b8a 112
maclobdell 0:f7c60d3e7b8a 113 /*
maclobdell 0:f7c60d3e7b8a 114 * Generate a random value to blind inv_mod in next step,
maclobdell 0:f7c60d3e7b8a 115 * avoiding a potential timing leak.
maclobdell 0:f7c60d3e7b8a 116 */
maclobdell 0:f7c60d3e7b8a 117 blind_tries = 0;
maclobdell 0:f7c60d3e7b8a 118 do
maclobdell 0:f7c60d3e7b8a 119 {
maclobdell 0:f7c60d3e7b8a 120 size_t n_size = ( grp->nbits + 7 ) / 8;
maclobdell 0:f7c60d3e7b8a 121 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &t, n_size, f_rng, p_rng ) );
maclobdell 0:f7c60d3e7b8a 122 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
maclobdell 0:f7c60d3e7b8a 123
maclobdell 0:f7c60d3e7b8a 124 /* See mbedtls_ecp_gen_keypair() */
maclobdell 0:f7c60d3e7b8a 125 if( ++blind_tries > 30 )
maclobdell 0:f7c60d3e7b8a 126 return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
maclobdell 0:f7c60d3e7b8a 127 }
maclobdell 0:f7c60d3e7b8a 128 while( mbedtls_mpi_cmp_int( &t, 1 ) < 0 ||
maclobdell 0:f7c60d3e7b8a 129 mbedtls_mpi_cmp_mpi( &t, &grp->N ) >= 0 );
maclobdell 0:f7c60d3e7b8a 130
maclobdell 0:f7c60d3e7b8a 131 /*
maclobdell 0:f7c60d3e7b8a 132 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
maclobdell 0:f7c60d3e7b8a 133 */
maclobdell 0:f7c60d3e7b8a 134 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, r, d ) );
maclobdell 0:f7c60d3e7b8a 135 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &e, &e, s ) );
maclobdell 0:f7c60d3e7b8a 136 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &e, &e, &t ) );
maclobdell 0:f7c60d3e7b8a 137 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &k, &k, &t ) );
maclobdell 0:f7c60d3e7b8a 138 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( s, &k, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( s, s, &e ) );
maclobdell 0:f7c60d3e7b8a 140 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( s, s, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 141
maclobdell 0:f7c60d3e7b8a 142 if( sign_tries++ > 10 )
maclobdell 0:f7c60d3e7b8a 143 {
maclobdell 0:f7c60d3e7b8a 144 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
maclobdell 0:f7c60d3e7b8a 145 goto cleanup;
maclobdell 0:f7c60d3e7b8a 146 }
maclobdell 0:f7c60d3e7b8a 147 }
maclobdell 0:f7c60d3e7b8a 148 while( mbedtls_mpi_cmp_int( s, 0 ) == 0 );
maclobdell 0:f7c60d3e7b8a 149
maclobdell 0:f7c60d3e7b8a 150 cleanup:
maclobdell 0:f7c60d3e7b8a 151 mbedtls_ecp_point_free( &R );
maclobdell 0:f7c60d3e7b8a 152 mbedtls_mpi_free( &k ); mbedtls_mpi_free( &e ); mbedtls_mpi_free( &t );
maclobdell 0:f7c60d3e7b8a 153
maclobdell 0:f7c60d3e7b8a 154 return( ret );
maclobdell 0:f7c60d3e7b8a 155 }
maclobdell 0:f7c60d3e7b8a 156
maclobdell 0:f7c60d3e7b8a 157 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
maclobdell 0:f7c60d3e7b8a 158 /*
maclobdell 0:f7c60d3e7b8a 159 * Deterministic signature wrapper
maclobdell 0:f7c60d3e7b8a 160 */
maclobdell 0:f7c60d3e7b8a 161 int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
maclobdell 0:f7c60d3e7b8a 162 const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
maclobdell 0:f7c60d3e7b8a 163 mbedtls_md_type_t md_alg )
maclobdell 0:f7c60d3e7b8a 164 {
maclobdell 0:f7c60d3e7b8a 165 int ret;
maclobdell 0:f7c60d3e7b8a 166 mbedtls_hmac_drbg_context rng_ctx;
maclobdell 0:f7c60d3e7b8a 167 unsigned char data[2 * MBEDTLS_ECP_MAX_BYTES];
maclobdell 0:f7c60d3e7b8a 168 size_t grp_len = ( grp->nbits + 7 ) / 8;
maclobdell 0:f7c60d3e7b8a 169 const mbedtls_md_info_t *md_info;
maclobdell 0:f7c60d3e7b8a 170 mbedtls_mpi h;
maclobdell 0:f7c60d3e7b8a 171
maclobdell 0:f7c60d3e7b8a 172 if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 173 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 174
maclobdell 0:f7c60d3e7b8a 175 mbedtls_mpi_init( &h );
maclobdell 0:f7c60d3e7b8a 176 mbedtls_hmac_drbg_init( &rng_ctx );
maclobdell 0:f7c60d3e7b8a 177
maclobdell 0:f7c60d3e7b8a 178 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
maclobdell 0:f7c60d3e7b8a 179 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( d, data, grp_len ) );
maclobdell 0:f7c60d3e7b8a 180 MBEDTLS_MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
maclobdell 0:f7c60d3e7b8a 181 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &h, data + grp_len, grp_len ) );
maclobdell 0:f7c60d3e7b8a 182 mbedtls_hmac_drbg_seed_buf( &rng_ctx, md_info, data, 2 * grp_len );
maclobdell 0:f7c60d3e7b8a 183
maclobdell 0:f7c60d3e7b8a 184 ret = mbedtls_ecdsa_sign( grp, r, s, d, buf, blen,
maclobdell 0:f7c60d3e7b8a 185 mbedtls_hmac_drbg_random, &rng_ctx );
maclobdell 0:f7c60d3e7b8a 186
maclobdell 0:f7c60d3e7b8a 187 cleanup:
maclobdell 0:f7c60d3e7b8a 188 mbedtls_hmac_drbg_free( &rng_ctx );
maclobdell 0:f7c60d3e7b8a 189 mbedtls_mpi_free( &h );
maclobdell 0:f7c60d3e7b8a 190
maclobdell 0:f7c60d3e7b8a 191 return( ret );
maclobdell 0:f7c60d3e7b8a 192 }
maclobdell 0:f7c60d3e7b8a 193 #endif /* MBEDTLS_ECDSA_DETERMINISTIC */
maclobdell 0:f7c60d3e7b8a 194
maclobdell 0:f7c60d3e7b8a 195 /*
maclobdell 0:f7c60d3e7b8a 196 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
maclobdell 0:f7c60d3e7b8a 197 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
maclobdell 0:f7c60d3e7b8a 198 */
maclobdell 0:f7c60d3e7b8a 199 int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp,
maclobdell 0:f7c60d3e7b8a 200 const unsigned char *buf, size_t blen,
maclobdell 0:f7c60d3e7b8a 201 const mbedtls_ecp_point *Q, const mbedtls_mpi *r, const mbedtls_mpi *s)
maclobdell 0:f7c60d3e7b8a 202 {
maclobdell 0:f7c60d3e7b8a 203 int ret;
maclobdell 0:f7c60d3e7b8a 204 mbedtls_mpi e, s_inv, u1, u2;
maclobdell 0:f7c60d3e7b8a 205 mbedtls_ecp_point R;
maclobdell 0:f7c60d3e7b8a 206
maclobdell 0:f7c60d3e7b8a 207 mbedtls_ecp_point_init( &R );
maclobdell 0:f7c60d3e7b8a 208 mbedtls_mpi_init( &e ); mbedtls_mpi_init( &s_inv ); mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
maclobdell 0:f7c60d3e7b8a 209
maclobdell 0:f7c60d3e7b8a 210 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
maclobdell 0:f7c60d3e7b8a 211 if( grp->N.p == NULL )
maclobdell 0:f7c60d3e7b8a 212 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 213
maclobdell 0:f7c60d3e7b8a 214 /*
maclobdell 0:f7c60d3e7b8a 215 * Step 1: make sure r and s are in range 1..n-1
maclobdell 0:f7c60d3e7b8a 216 */
maclobdell 0:f7c60d3e7b8a 217 if( mbedtls_mpi_cmp_int( r, 1 ) < 0 || mbedtls_mpi_cmp_mpi( r, &grp->N ) >= 0 ||
maclobdell 0:f7c60d3e7b8a 218 mbedtls_mpi_cmp_int( s, 1 ) < 0 || mbedtls_mpi_cmp_mpi( s, &grp->N ) >= 0 )
maclobdell 0:f7c60d3e7b8a 219 {
maclobdell 0:f7c60d3e7b8a 220 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
maclobdell 0:f7c60d3e7b8a 221 goto cleanup;
maclobdell 0:f7c60d3e7b8a 222 }
maclobdell 0:f7c60d3e7b8a 223
maclobdell 0:f7c60d3e7b8a 224 /*
maclobdell 0:f7c60d3e7b8a 225 * Additional precaution: make sure Q is valid
maclobdell 0:f7c60d3e7b8a 226 */
maclobdell 0:f7c60d3e7b8a 227 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, Q ) );
maclobdell 0:f7c60d3e7b8a 228
maclobdell 0:f7c60d3e7b8a 229 /*
maclobdell 0:f7c60d3e7b8a 230 * Step 3: derive MPI from hashed message
maclobdell 0:f7c60d3e7b8a 231 */
maclobdell 0:f7c60d3e7b8a 232 MBEDTLS_MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
maclobdell 0:f7c60d3e7b8a 233
maclobdell 0:f7c60d3e7b8a 234 /*
maclobdell 0:f7c60d3e7b8a 235 * Step 4: u1 = e / s mod n, u2 = r / s mod n
maclobdell 0:f7c60d3e7b8a 236 */
maclobdell 0:f7c60d3e7b8a 237 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &s_inv, s, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 238
maclobdell 0:f7c60d3e7b8a 239 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u1, &e, &s_inv ) );
maclobdell 0:f7c60d3e7b8a 240 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u1, &u1, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 241
maclobdell 0:f7c60d3e7b8a 242 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u2, r, &s_inv ) );
maclobdell 0:f7c60d3e7b8a 243 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &u2, &u2, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 244
maclobdell 0:f7c60d3e7b8a 245 /*
maclobdell 0:f7c60d3e7b8a 246 * Step 5: R = u1 G + u2 Q
maclobdell 0:f7c60d3e7b8a 247 *
maclobdell 0:f7c60d3e7b8a 248 * Since we're not using any secret data, no need to pass a RNG to
maclobdell 0:f7c60d3e7b8a 249 * mbedtls_ecp_mul() for countermesures.
maclobdell 0:f7c60d3e7b8a 250 */
maclobdell 0:f7c60d3e7b8a 251 MBEDTLS_MPI_CHK( mbedtls_ecp_muladd( grp, &R, &u1, &grp->G, &u2, Q ) );
maclobdell 0:f7c60d3e7b8a 252
maclobdell 0:f7c60d3e7b8a 253 if( mbedtls_ecp_is_zero( &R ) )
maclobdell 0:f7c60d3e7b8a 254 {
maclobdell 0:f7c60d3e7b8a 255 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
maclobdell 0:f7c60d3e7b8a 256 goto cleanup;
maclobdell 0:f7c60d3e7b8a 257 }
maclobdell 0:f7c60d3e7b8a 258
maclobdell 0:f7c60d3e7b8a 259 /*
maclobdell 0:f7c60d3e7b8a 260 * Step 6: convert xR to an integer (no-op)
maclobdell 0:f7c60d3e7b8a 261 * Step 7: reduce xR mod n (gives v)
maclobdell 0:f7c60d3e7b8a 262 */
maclobdell 0:f7c60d3e7b8a 263 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
maclobdell 0:f7c60d3e7b8a 264
maclobdell 0:f7c60d3e7b8a 265 /*
maclobdell 0:f7c60d3e7b8a 266 * Step 8: check if v (that is, R.X) is equal to r
maclobdell 0:f7c60d3e7b8a 267 */
maclobdell 0:f7c60d3e7b8a 268 if( mbedtls_mpi_cmp_mpi( &R.X, r ) != 0 )
maclobdell 0:f7c60d3e7b8a 269 {
maclobdell 0:f7c60d3e7b8a 270 ret = MBEDTLS_ERR_ECP_VERIFY_FAILED;
maclobdell 0:f7c60d3e7b8a 271 goto cleanup;
maclobdell 0:f7c60d3e7b8a 272 }
maclobdell 0:f7c60d3e7b8a 273
maclobdell 0:f7c60d3e7b8a 274 cleanup:
maclobdell 0:f7c60d3e7b8a 275 mbedtls_ecp_point_free( &R );
maclobdell 0:f7c60d3e7b8a 276 mbedtls_mpi_free( &e ); mbedtls_mpi_free( &s_inv ); mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
maclobdell 0:f7c60d3e7b8a 277
maclobdell 0:f7c60d3e7b8a 278 return( ret );
maclobdell 0:f7c60d3e7b8a 279 }
maclobdell 0:f7c60d3e7b8a 280
maclobdell 0:f7c60d3e7b8a 281 /*
maclobdell 0:f7c60d3e7b8a 282 * Convert a signature (given by context) to ASN.1
maclobdell 0:f7c60d3e7b8a 283 */
maclobdell 0:f7c60d3e7b8a 284 static int ecdsa_signature_to_asn1( const mbedtls_mpi *r, const mbedtls_mpi *s,
maclobdell 0:f7c60d3e7b8a 285 unsigned char *sig, size_t *slen )
maclobdell 0:f7c60d3e7b8a 286 {
maclobdell 0:f7c60d3e7b8a 287 int ret;
maclobdell 0:f7c60d3e7b8a 288 unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
maclobdell 0:f7c60d3e7b8a 289 unsigned char *p = buf + sizeof( buf );
maclobdell 0:f7c60d3e7b8a 290 size_t len = 0;
maclobdell 0:f7c60d3e7b8a 291
maclobdell 0:f7c60d3e7b8a 292 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, s ) );
maclobdell 0:f7c60d3e7b8a 293 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_mpi( &p, buf, r ) );
maclobdell 0:f7c60d3e7b8a 294
maclobdell 0:f7c60d3e7b8a 295 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &p, buf, len ) );
maclobdell 0:f7c60d3e7b8a 296 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &p, buf,
maclobdell 0:f7c60d3e7b8a 297 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
maclobdell 0:f7c60d3e7b8a 298
maclobdell 0:f7c60d3e7b8a 299 memcpy( sig, p, len );
maclobdell 0:f7c60d3e7b8a 300 *slen = len;
maclobdell 0:f7c60d3e7b8a 301
maclobdell 0:f7c60d3e7b8a 302 return( 0 );
maclobdell 0:f7c60d3e7b8a 303 }
maclobdell 0:f7c60d3e7b8a 304
maclobdell 0:f7c60d3e7b8a 305 /*
maclobdell 0:f7c60d3e7b8a 306 * Compute and write signature
maclobdell 0:f7c60d3e7b8a 307 */
maclobdell 0:f7c60d3e7b8a 308 int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, mbedtls_md_type_t md_alg,
maclobdell 0:f7c60d3e7b8a 309 const unsigned char *hash, size_t hlen,
maclobdell 0:f7c60d3e7b8a 310 unsigned char *sig, size_t *slen,
maclobdell 0:f7c60d3e7b8a 311 int (*f_rng)(void *, unsigned char *, size_t),
maclobdell 0:f7c60d3e7b8a 312 void *p_rng )
maclobdell 0:f7c60d3e7b8a 313 {
maclobdell 0:f7c60d3e7b8a 314 int ret;
maclobdell 0:f7c60d3e7b8a 315 mbedtls_mpi r, s;
maclobdell 0:f7c60d3e7b8a 316
maclobdell 0:f7c60d3e7b8a 317 mbedtls_mpi_init( &r );
maclobdell 0:f7c60d3e7b8a 318 mbedtls_mpi_init( &s );
maclobdell 0:f7c60d3e7b8a 319
maclobdell 0:f7c60d3e7b8a 320 #if defined(MBEDTLS_ECDSA_DETERMINISTIC)
maclobdell 0:f7c60d3e7b8a 321 (void) f_rng;
maclobdell 0:f7c60d3e7b8a 322 (void) p_rng;
maclobdell 0:f7c60d3e7b8a 323
maclobdell 0:f7c60d3e7b8a 324 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ctx->grp, &r, &s, &ctx->d,
maclobdell 0:f7c60d3e7b8a 325 hash, hlen, md_alg ) );
maclobdell 0:f7c60d3e7b8a 326 #else
maclobdell 0:f7c60d3e7b8a 327 (void) md_alg;
maclobdell 0:f7c60d3e7b8a 328
maclobdell 0:f7c60d3e7b8a 329 MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ctx->grp, &r, &s, &ctx->d,
maclobdell 0:f7c60d3e7b8a 330 hash, hlen, f_rng, p_rng ) );
maclobdell 0:f7c60d3e7b8a 331 #endif
maclobdell 0:f7c60d3e7b8a 332
maclobdell 0:f7c60d3e7b8a 333 MBEDTLS_MPI_CHK( ecdsa_signature_to_asn1( &r, &s, sig, slen ) );
maclobdell 0:f7c60d3e7b8a 334
maclobdell 0:f7c60d3e7b8a 335 cleanup:
maclobdell 0:f7c60d3e7b8a 336 mbedtls_mpi_free( &r );
maclobdell 0:f7c60d3e7b8a 337 mbedtls_mpi_free( &s );
maclobdell 0:f7c60d3e7b8a 338
maclobdell 0:f7c60d3e7b8a 339 return( ret );
maclobdell 0:f7c60d3e7b8a 340 }
maclobdell 0:f7c60d3e7b8a 341
maclobdell 0:f7c60d3e7b8a 342 #if ! defined(MBEDTLS_DEPRECATED_REMOVED) && \
maclobdell 0:f7c60d3e7b8a 343 defined(MBEDTLS_ECDSA_DETERMINISTIC)
maclobdell 0:f7c60d3e7b8a 344 int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx,
maclobdell 0:f7c60d3e7b8a 345 const unsigned char *hash, size_t hlen,
maclobdell 0:f7c60d3e7b8a 346 unsigned char *sig, size_t *slen,
maclobdell 0:f7c60d3e7b8a 347 mbedtls_md_type_t md_alg )
maclobdell 0:f7c60d3e7b8a 348 {
maclobdell 0:f7c60d3e7b8a 349 return( mbedtls_ecdsa_write_signature( ctx, md_alg, hash, hlen, sig, slen,
maclobdell 0:f7c60d3e7b8a 350 NULL, NULL ) );
maclobdell 0:f7c60d3e7b8a 351 }
maclobdell 0:f7c60d3e7b8a 352 #endif
maclobdell 0:f7c60d3e7b8a 353
maclobdell 0:f7c60d3e7b8a 354 /*
maclobdell 0:f7c60d3e7b8a 355 * Read and check signature
maclobdell 0:f7c60d3e7b8a 356 */
maclobdell 0:f7c60d3e7b8a 357 int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx,
maclobdell 0:f7c60d3e7b8a 358 const unsigned char *hash, size_t hlen,
maclobdell 0:f7c60d3e7b8a 359 const unsigned char *sig, size_t slen )
maclobdell 0:f7c60d3e7b8a 360 {
maclobdell 0:f7c60d3e7b8a 361 int ret;
maclobdell 0:f7c60d3e7b8a 362 unsigned char *p = (unsigned char *) sig;
maclobdell 0:f7c60d3e7b8a 363 const unsigned char *end = sig + slen;
maclobdell 0:f7c60d3e7b8a 364 size_t len;
maclobdell 0:f7c60d3e7b8a 365 mbedtls_mpi r, s;
maclobdell 0:f7c60d3e7b8a 366
maclobdell 0:f7c60d3e7b8a 367 mbedtls_mpi_init( &r );
maclobdell 0:f7c60d3e7b8a 368 mbedtls_mpi_init( &s );
maclobdell 0:f7c60d3e7b8a 369
maclobdell 0:f7c60d3e7b8a 370 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
maclobdell 0:f7c60d3e7b8a 371 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 372 {
maclobdell 0:f7c60d3e7b8a 373 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
maclobdell 0:f7c60d3e7b8a 374 goto cleanup;
maclobdell 0:f7c60d3e7b8a 375 }
maclobdell 0:f7c60d3e7b8a 376
maclobdell 0:f7c60d3e7b8a 377 if( p + len != end )
maclobdell 0:f7c60d3e7b8a 378 {
maclobdell 0:f7c60d3e7b8a 379 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA +
maclobdell 0:f7c60d3e7b8a 380 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
maclobdell 0:f7c60d3e7b8a 381 goto cleanup;
maclobdell 0:f7c60d3e7b8a 382 }
maclobdell 0:f7c60d3e7b8a 383
maclobdell 0:f7c60d3e7b8a 384 if( ( ret = mbedtls_asn1_get_mpi( &p, end, &r ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 385 ( ret = mbedtls_asn1_get_mpi( &p, end, &s ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 386 {
maclobdell 0:f7c60d3e7b8a 387 ret += MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
maclobdell 0:f7c60d3e7b8a 388 goto cleanup;
maclobdell 0:f7c60d3e7b8a 389 }
maclobdell 0:f7c60d3e7b8a 390
maclobdell 0:f7c60d3e7b8a 391 if( ( ret = mbedtls_ecdsa_verify( &ctx->grp, hash, hlen,
maclobdell 0:f7c60d3e7b8a 392 &ctx->Q, &r, &s ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 393 goto cleanup;
maclobdell 0:f7c60d3e7b8a 394
maclobdell 0:f7c60d3e7b8a 395 if( p != end )
maclobdell 0:f7c60d3e7b8a 396 ret = MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH;
maclobdell 0:f7c60d3e7b8a 397
maclobdell 0:f7c60d3e7b8a 398 cleanup:
maclobdell 0:f7c60d3e7b8a 399 mbedtls_mpi_free( &r );
maclobdell 0:f7c60d3e7b8a 400 mbedtls_mpi_free( &s );
maclobdell 0:f7c60d3e7b8a 401
maclobdell 0:f7c60d3e7b8a 402 return( ret );
maclobdell 0:f7c60d3e7b8a 403 }
maclobdell 0:f7c60d3e7b8a 404
maclobdell 0:f7c60d3e7b8a 405 /*
maclobdell 0:f7c60d3e7b8a 406 * Generate key pair
maclobdell 0:f7c60d3e7b8a 407 */
maclobdell 0:f7c60d3e7b8a 408 int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid,
maclobdell 0:f7c60d3e7b8a 409 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
maclobdell 0:f7c60d3e7b8a 410 {
maclobdell 0:f7c60d3e7b8a 411 return( mbedtls_ecp_group_load( &ctx->grp, gid ) ||
maclobdell 0:f7c60d3e7b8a 412 mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
maclobdell 0:f7c60d3e7b8a 413 }
maclobdell 0:f7c60d3e7b8a 414
maclobdell 0:f7c60d3e7b8a 415 /*
maclobdell 0:f7c60d3e7b8a 416 * Set context from an mbedtls_ecp_keypair
maclobdell 0:f7c60d3e7b8a 417 */
maclobdell 0:f7c60d3e7b8a 418 int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, const mbedtls_ecp_keypair *key )
maclobdell 0:f7c60d3e7b8a 419 {
maclobdell 0:f7c60d3e7b8a 420 int ret;
maclobdell 0:f7c60d3e7b8a 421
maclobdell 0:f7c60d3e7b8a 422 if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 423 ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 424 ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 425 {
maclobdell 0:f7c60d3e7b8a 426 mbedtls_ecdsa_free( ctx );
maclobdell 0:f7c60d3e7b8a 427 }
maclobdell 0:f7c60d3e7b8a 428
maclobdell 0:f7c60d3e7b8a 429 return( ret );
maclobdell 0:f7c60d3e7b8a 430 }
maclobdell 0:f7c60d3e7b8a 431
maclobdell 0:f7c60d3e7b8a 432 /*
maclobdell 0:f7c60d3e7b8a 433 * Initialize context
maclobdell 0:f7c60d3e7b8a 434 */
maclobdell 0:f7c60d3e7b8a 435 void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx )
maclobdell 0:f7c60d3e7b8a 436 {
maclobdell 0:f7c60d3e7b8a 437 mbedtls_ecp_keypair_init( ctx );
maclobdell 0:f7c60d3e7b8a 438 }
maclobdell 0:f7c60d3e7b8a 439
maclobdell 0:f7c60d3e7b8a 440 /*
maclobdell 0:f7c60d3e7b8a 441 * Free context
maclobdell 0:f7c60d3e7b8a 442 */
maclobdell 0:f7c60d3e7b8a 443 void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx )
maclobdell 0:f7c60d3e7b8a 444 {
maclobdell 0:f7c60d3e7b8a 445 mbedtls_ecp_keypair_free( ctx );
maclobdell 0:f7c60d3e7b8a 446 }
maclobdell 0:f7c60d3e7b8a 447
maclobdell 0:f7c60d3e7b8a 448 #endif /* MBEDTLS_ECDSA_C */