wolf SSL
/
wolfSSL
Important changes to repositories hosted on mbed.com
Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.
To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.
It is also possible to export all your personal repositories from the account settings page.
Dependents: CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more
wolfcrypt/src/dsa.c@17:a5f916481144, 2020-06-05 (annotated)
- Committer:
- wolfSSL
- Date:
- Fri Jun 05 00:11:07 2020 +0000
- Revision:
- 17:a5f916481144
- Parent:
- 16:8e0d178b1d1e
wolfSSL 4.4.0
Who changed what in which revision?
| User | Revision | Line number | New contents of line |
|---|---|---|---|
| wolfSSL | 15:117db924cf7c | 1 | /* dsa.c |
| wolfSSL | 15:117db924cf7c | 2 | * |
| wolfSSL | 16:8e0d178b1d1e | 3 | * Copyright (C) 2006-2020 wolfSSL Inc. |
| wolfSSL | 15:117db924cf7c | 4 | * |
| wolfSSL | 15:117db924cf7c | 5 | * This file is part of wolfSSL. |
| wolfSSL | 15:117db924cf7c | 6 | * |
| wolfSSL | 15:117db924cf7c | 7 | * wolfSSL is free software; you can redistribute it and/or modify |
| wolfSSL | 15:117db924cf7c | 8 | * it under the terms of the GNU General Public License as published by |
| wolfSSL | 15:117db924cf7c | 9 | * the Free Software Foundation; either version 2 of the License, or |
| wolfSSL | 15:117db924cf7c | 10 | * (at your option) any later version. |
| wolfSSL | 15:117db924cf7c | 11 | * |
| wolfSSL | 15:117db924cf7c | 12 | * wolfSSL is distributed in the hope that it will be useful, |
| wolfSSL | 15:117db924cf7c | 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| wolfSSL | 15:117db924cf7c | 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| wolfSSL | 15:117db924cf7c | 15 | * GNU General Public License for more details. |
| wolfSSL | 15:117db924cf7c | 16 | * |
| wolfSSL | 15:117db924cf7c | 17 | * You should have received a copy of the GNU General Public License |
| wolfSSL | 15:117db924cf7c | 18 | * along with this program; if not, write to the Free Software |
| wolfSSL | 15:117db924cf7c | 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
| wolfSSL | 15:117db924cf7c | 20 | */ |
| wolfSSL | 15:117db924cf7c | 21 | |
| wolfSSL | 15:117db924cf7c | 22 | |
| wolfSSL | 15:117db924cf7c | 23 | #ifdef HAVE_CONFIG_H |
| wolfSSL | 15:117db924cf7c | 24 | #include <config.h> |
| wolfSSL | 15:117db924cf7c | 25 | #endif |
| wolfSSL | 15:117db924cf7c | 26 | |
| wolfSSL | 15:117db924cf7c | 27 | #include <wolfssl/wolfcrypt/settings.h> |
| wolfSSL | 15:117db924cf7c | 28 | |
| wolfSSL | 15:117db924cf7c | 29 | #ifndef NO_DSA |
| wolfSSL | 15:117db924cf7c | 30 | |
| wolfSSL | 15:117db924cf7c | 31 | #include <wolfssl/wolfcrypt/random.h> |
| wolfSSL | 15:117db924cf7c | 32 | #include <wolfssl/wolfcrypt/integer.h> |
| wolfSSL | 15:117db924cf7c | 33 | #include <wolfssl/wolfcrypt/error-crypt.h> |
| wolfSSL | 15:117db924cf7c | 34 | #include <wolfssl/wolfcrypt/logging.h> |
| wolfSSL | 15:117db924cf7c | 35 | #include <wolfssl/wolfcrypt/sha.h> |
| wolfSSL | 15:117db924cf7c | 36 | #include <wolfssl/wolfcrypt/dsa.h> |
| wolfSSL | 15:117db924cf7c | 37 | |
| wolfSSL | 15:117db924cf7c | 38 | #ifdef NO_INLINE |
| wolfSSL | 15:117db924cf7c | 39 | #include <wolfssl/wolfcrypt/misc.h> |
| wolfSSL | 15:117db924cf7c | 40 | #else |
| wolfSSL | 15:117db924cf7c | 41 | #define WOLFSSL_MISC_INCLUDED |
| wolfSSL | 15:117db924cf7c | 42 | #include <wolfcrypt/src/misc.c> |
| wolfSSL | 15:117db924cf7c | 43 | #endif |
| wolfSSL | 15:117db924cf7c | 44 | |
| wolfSSL | 15:117db924cf7c | 45 | int wc_InitDsaKey(DsaKey* key) |
| wolfSSL | 15:117db924cf7c | 46 | { |
| wolfSSL | 15:117db924cf7c | 47 | if (key == NULL) |
| wolfSSL | 15:117db924cf7c | 48 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 49 | |
| wolfSSL | 15:117db924cf7c | 50 | key->type = -1; /* haven't decided yet */ |
| wolfSSL | 15:117db924cf7c | 51 | key->heap = NULL; |
| wolfSSL | 15:117db924cf7c | 52 | |
| wolfSSL | 15:117db924cf7c | 53 | return mp_init_multi( |
| wolfSSL | 15:117db924cf7c | 54 | /* public alloc parts */ |
| wolfSSL | 15:117db924cf7c | 55 | &key->p, |
| wolfSSL | 15:117db924cf7c | 56 | &key->q, |
| wolfSSL | 15:117db924cf7c | 57 | &key->g, |
| wolfSSL | 15:117db924cf7c | 58 | &key->y, |
| wolfSSL | 15:117db924cf7c | 59 | |
| wolfSSL | 15:117db924cf7c | 60 | /* private alloc parts */ |
| wolfSSL | 15:117db924cf7c | 61 | &key->x, |
| wolfSSL | 15:117db924cf7c | 62 | NULL |
| wolfSSL | 15:117db924cf7c | 63 | ); |
| wolfSSL | 15:117db924cf7c | 64 | } |
| wolfSSL | 15:117db924cf7c | 65 | |
| wolfSSL | 15:117db924cf7c | 66 | |
| wolfSSL | 15:117db924cf7c | 67 | int wc_InitDsaKey_h(DsaKey* key, void* h) |
| wolfSSL | 15:117db924cf7c | 68 | { |
| wolfSSL | 15:117db924cf7c | 69 | int ret = wc_InitDsaKey(key); |
| wolfSSL | 15:117db924cf7c | 70 | if (ret == 0) |
| wolfSSL | 15:117db924cf7c | 71 | key->heap = h; |
| wolfSSL | 15:117db924cf7c | 72 | |
| wolfSSL | 15:117db924cf7c | 73 | return ret; |
| wolfSSL | 15:117db924cf7c | 74 | } |
| wolfSSL | 15:117db924cf7c | 75 | |
| wolfSSL | 15:117db924cf7c | 76 | |
| wolfSSL | 15:117db924cf7c | 77 | void wc_FreeDsaKey(DsaKey* key) |
| wolfSSL | 15:117db924cf7c | 78 | { |
| wolfSSL | 15:117db924cf7c | 79 | if (key == NULL) |
| wolfSSL | 15:117db924cf7c | 80 | return; |
| wolfSSL | 15:117db924cf7c | 81 | |
| wolfSSL | 15:117db924cf7c | 82 | if (key->type == DSA_PRIVATE) |
| wolfSSL | 15:117db924cf7c | 83 | mp_forcezero(&key->x); |
| wolfSSL | 15:117db924cf7c | 84 | |
| wolfSSL | 15:117db924cf7c | 85 | mp_clear(&key->x); |
| wolfSSL | 15:117db924cf7c | 86 | mp_clear(&key->y); |
| wolfSSL | 15:117db924cf7c | 87 | mp_clear(&key->g); |
| wolfSSL | 15:117db924cf7c | 88 | mp_clear(&key->q); |
| wolfSSL | 15:117db924cf7c | 89 | mp_clear(&key->p); |
| wolfSSL | 15:117db924cf7c | 90 | } |
| wolfSSL | 15:117db924cf7c | 91 | |
| wolfSSL | 15:117db924cf7c | 92 | |
| wolfSSL | 15:117db924cf7c | 93 | /* validate that (L,N) match allowed sizes from FIPS 186-4, Section 4.2. |
| wolfSSL | 15:117db924cf7c | 94 | * modLen - represents L, the size of p (prime modulus) in bits |
| wolfSSL | 15:117db924cf7c | 95 | * divLen - represents N, the size of q (prime divisor) in bits |
| wolfSSL | 15:117db924cf7c | 96 | * return 0 on success, -1 on error */ |
| wolfSSL | 15:117db924cf7c | 97 | static int CheckDsaLN(int modLen, int divLen) |
| wolfSSL | 15:117db924cf7c | 98 | { |
| wolfSSL | 15:117db924cf7c | 99 | int ret = -1; |
| wolfSSL | 15:117db924cf7c | 100 | |
| wolfSSL | 15:117db924cf7c | 101 | switch (modLen) { |
| wolfSSL | 15:117db924cf7c | 102 | case 1024: |
| wolfSSL | 15:117db924cf7c | 103 | if (divLen == 160) |
| wolfSSL | 15:117db924cf7c | 104 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 105 | break; |
| wolfSSL | 15:117db924cf7c | 106 | case 2048: |
| wolfSSL | 15:117db924cf7c | 107 | if (divLen == 224 || divLen == 256) |
| wolfSSL | 15:117db924cf7c | 108 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 109 | break; |
| wolfSSL | 15:117db924cf7c | 110 | case 3072: |
| wolfSSL | 15:117db924cf7c | 111 | if (divLen == 256) |
| wolfSSL | 15:117db924cf7c | 112 | ret = 0; |
| wolfSSL | 15:117db924cf7c | 113 | break; |
| wolfSSL | 15:117db924cf7c | 114 | default: |
| wolfSSL | 15:117db924cf7c | 115 | break; |
| wolfSSL | 15:117db924cf7c | 116 | } |
| wolfSSL | 15:117db924cf7c | 117 | |
| wolfSSL | 15:117db924cf7c | 118 | return ret; |
| wolfSSL | 15:117db924cf7c | 119 | } |
| wolfSSL | 15:117db924cf7c | 120 | |
| wolfSSL | 15:117db924cf7c | 121 | |
| wolfSSL | 15:117db924cf7c | 122 | #ifdef WOLFSSL_KEY_GEN |
| wolfSSL | 15:117db924cf7c | 123 | |
| wolfSSL | 15:117db924cf7c | 124 | /* Create DSA key pair (&dsa->x, &dsa->y) |
| wolfSSL | 15:117db924cf7c | 125 | * |
| wolfSSL | 15:117db924cf7c | 126 | * Based on NIST FIPS 186-4, |
| wolfSSL | 15:117db924cf7c | 127 | * "B.1.1 Key Pair Generation Using Extra Random Bits" |
| wolfSSL | 15:117db924cf7c | 128 | * |
| wolfSSL | 15:117db924cf7c | 129 | * rng - pointer to initialized WC_RNG structure |
| wolfSSL | 15:117db924cf7c | 130 | * dsa - pointer to initialized DsaKey structure, will hold generated key |
| wolfSSL | 15:117db924cf7c | 131 | * |
| wolfSSL | 15:117db924cf7c | 132 | * return 0 on success, negative on error */ |
| wolfSSL | 15:117db924cf7c | 133 | int wc_MakeDsaKey(WC_RNG *rng, DsaKey *dsa) |
| wolfSSL | 15:117db924cf7c | 134 | { |
| wolfSSL | 15:117db924cf7c | 135 | byte* cBuf; |
| wolfSSL | 15:117db924cf7c | 136 | int qSz, pSz, cSz, err; |
| wolfSSL | 15:117db924cf7c | 137 | mp_int tmpQ; |
| wolfSSL | 15:117db924cf7c | 138 | |
| wolfSSL | 15:117db924cf7c | 139 | if (rng == NULL || dsa == NULL) |
| wolfSSL | 15:117db924cf7c | 140 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 141 | |
| wolfSSL | 15:117db924cf7c | 142 | qSz = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 143 | pSz = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 144 | |
| wolfSSL | 15:117db924cf7c | 145 | /* verify (L,N) pair bit lengths */ |
| wolfSSL | 15:117db924cf7c | 146 | if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) |
| wolfSSL | 15:117db924cf7c | 147 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 148 | |
| wolfSSL | 15:117db924cf7c | 149 | /* generate extra 64 bits so that bias from mod function is negligible */ |
| wolfSSL | 15:117db924cf7c | 150 | cSz = qSz + (64 / WOLFSSL_BIT_SIZE); |
| wolfSSL | 15:117db924cf7c | 151 | cBuf = (byte*)XMALLOC(cSz, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 152 | if (cBuf == NULL) { |
| wolfSSL | 15:117db924cf7c | 153 | return MEMORY_E; |
| wolfSSL | 15:117db924cf7c | 154 | } |
| wolfSSL | 15:117db924cf7c | 155 | |
| wolfSSL | 15:117db924cf7c | 156 | if ((err = mp_init_multi(&dsa->x, &dsa->y, &tmpQ, NULL, NULL, NULL)) |
| wolfSSL | 15:117db924cf7c | 157 | != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 158 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 159 | return err; |
| wolfSSL | 15:117db924cf7c | 160 | } |
| wolfSSL | 15:117db924cf7c | 161 | |
| wolfSSL | 15:117db924cf7c | 162 | do { |
| wolfSSL | 15:117db924cf7c | 163 | /* generate N+64 bits (c) from RBG into &dsa->x, making sure positive. |
| wolfSSL | 15:117db924cf7c | 164 | * Hash_DRBG uses SHA-256 which matches maximum |
| wolfSSL | 15:117db924cf7c | 165 | * requested_security_strength of (L,N) */ |
| wolfSSL | 15:117db924cf7c | 166 | err = wc_RNG_GenerateBlock(rng, cBuf, cSz); |
| wolfSSL | 15:117db924cf7c | 167 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 168 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 169 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 170 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 171 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 172 | return err; |
| wolfSSL | 15:117db924cf7c | 173 | } |
| wolfSSL | 15:117db924cf7c | 174 | |
| wolfSSL | 15:117db924cf7c | 175 | err = mp_read_unsigned_bin(&dsa->x, cBuf, cSz); |
| wolfSSL | 15:117db924cf7c | 176 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 177 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 178 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 179 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 180 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 181 | return err; |
| wolfSSL | 15:117db924cf7c | 182 | } |
| wolfSSL | 15:117db924cf7c | 183 | } while (mp_cmp_d(&dsa->x, 1) != MP_GT); |
| wolfSSL | 15:117db924cf7c | 184 | |
| wolfSSL | 15:117db924cf7c | 185 | XFREE(cBuf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 186 | |
| wolfSSL | 15:117db924cf7c | 187 | /* tmpQ = q - 1 */ |
| wolfSSL | 15:117db924cf7c | 188 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 189 | err = mp_copy(&dsa->q, &tmpQ); |
| wolfSSL | 15:117db924cf7c | 190 | |
| wolfSSL | 15:117db924cf7c | 191 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 192 | err = mp_sub_d(&tmpQ, 1, &tmpQ); |
| wolfSSL | 15:117db924cf7c | 193 | |
| wolfSSL | 15:117db924cf7c | 194 | /* x = c mod (q-1), &dsa->x holds c */ |
| wolfSSL | 15:117db924cf7c | 195 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 196 | err = mp_mod(&dsa->x, &tmpQ, &dsa->x); |
| wolfSSL | 15:117db924cf7c | 197 | |
| wolfSSL | 15:117db924cf7c | 198 | /* x = c mod (q-1) + 1 */ |
| wolfSSL | 15:117db924cf7c | 199 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 200 | err = mp_add_d(&dsa->x, 1, &dsa->x); |
| wolfSSL | 15:117db924cf7c | 201 | |
| wolfSSL | 15:117db924cf7c | 202 | /* public key : y = g^x mod p */ |
| wolfSSL | 15:117db924cf7c | 203 | if (err == MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 204 | err = mp_exptmod_ex(&dsa->g, &dsa->x, dsa->q.used, &dsa->p, &dsa->y); |
| wolfSSL | 15:117db924cf7c | 205 | |
| wolfSSL | 15:117db924cf7c | 206 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 207 | dsa->type = DSA_PRIVATE; |
| wolfSSL | 15:117db924cf7c | 208 | |
| wolfSSL | 15:117db924cf7c | 209 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 210 | mp_clear(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 211 | mp_clear(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 212 | } |
| wolfSSL | 15:117db924cf7c | 213 | mp_clear(&tmpQ); |
| wolfSSL | 15:117db924cf7c | 214 | |
| wolfSSL | 15:117db924cf7c | 215 | return err; |
| wolfSSL | 15:117db924cf7c | 216 | } |
| wolfSSL | 15:117db924cf7c | 217 | |
| wolfSSL | 15:117db924cf7c | 218 | |
| wolfSSL | 15:117db924cf7c | 219 | /* modulus_size in bits */ |
| wolfSSL | 15:117db924cf7c | 220 | int wc_MakeDsaParameters(WC_RNG *rng, int modulus_size, DsaKey *dsa) |
| wolfSSL | 15:117db924cf7c | 221 | { |
| wolfSSL | 15:117db924cf7c | 222 | mp_int tmp, tmp2; |
| wolfSSL | 15:117db924cf7c | 223 | int err, msize, qsize, |
| wolfSSL | 15:117db924cf7c | 224 | loop_check_prime = 0, |
| wolfSSL | 15:117db924cf7c | 225 | check_prime = MP_NO; |
| wolfSSL | 15:117db924cf7c | 226 | unsigned char *buf; |
| wolfSSL | 15:117db924cf7c | 227 | |
| wolfSSL | 15:117db924cf7c | 228 | if (rng == NULL || dsa == NULL) |
| wolfSSL | 15:117db924cf7c | 229 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 230 | |
| wolfSSL | 15:117db924cf7c | 231 | /* set group size in bytes from modulus size |
| wolfSSL | 15:117db924cf7c | 232 | * FIPS 186-4 defines valid values (1024, 160) (2048, 256) (3072, 256) |
| wolfSSL | 15:117db924cf7c | 233 | */ |
| wolfSSL | 15:117db924cf7c | 234 | switch (modulus_size) { |
| wolfSSL | 15:117db924cf7c | 235 | case 1024: |
| wolfSSL | 15:117db924cf7c | 236 | qsize = 20; |
| wolfSSL | 15:117db924cf7c | 237 | break; |
| wolfSSL | 15:117db924cf7c | 238 | case 2048: |
| wolfSSL | 15:117db924cf7c | 239 | case 3072: |
| wolfSSL | 15:117db924cf7c | 240 | qsize = 32; |
| wolfSSL | 15:117db924cf7c | 241 | break; |
| wolfSSL | 15:117db924cf7c | 242 | default: |
| wolfSSL | 15:117db924cf7c | 243 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 244 | } |
| wolfSSL | 15:117db924cf7c | 245 | |
| wolfSSL | 15:117db924cf7c | 246 | /* modulus size in bytes */ |
| wolfSSL | 15:117db924cf7c | 247 | msize = modulus_size / WOLFSSL_BIT_SIZE; |
| wolfSSL | 15:117db924cf7c | 248 | |
| wolfSSL | 15:117db924cf7c | 249 | /* allocate ram */ |
| wolfSSL | 15:117db924cf7c | 250 | buf = (unsigned char *)XMALLOC(msize - qsize, |
| wolfSSL | 15:117db924cf7c | 251 | dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 252 | if (buf == NULL) { |
| wolfSSL | 15:117db924cf7c | 253 | return MEMORY_E; |
| wolfSSL | 15:117db924cf7c | 254 | } |
| wolfSSL | 15:117db924cf7c | 255 | |
| wolfSSL | 16:8e0d178b1d1e | 256 | /* make a random string that will be multiplied against q */ |
| wolfSSL | 15:117db924cf7c | 257 | err = wc_RNG_GenerateBlock(rng, buf, msize - qsize); |
| wolfSSL | 15:117db924cf7c | 258 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 259 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 260 | return err; |
| wolfSSL | 15:117db924cf7c | 261 | } |
| wolfSSL | 15:117db924cf7c | 262 | |
| wolfSSL | 15:117db924cf7c | 263 | /* force magnitude */ |
| wolfSSL | 15:117db924cf7c | 264 | buf[0] |= 0xC0; |
| wolfSSL | 15:117db924cf7c | 265 | |
| wolfSSL | 15:117db924cf7c | 266 | /* force even */ |
| wolfSSL | 15:117db924cf7c | 267 | buf[msize - qsize - 1] &= ~1; |
| wolfSSL | 15:117db924cf7c | 268 | |
| wolfSSL | 15:117db924cf7c | 269 | if (mp_init_multi(&tmp2, &dsa->p, &dsa->q, 0, 0, 0) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 270 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 271 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 272 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 273 | } |
| wolfSSL | 15:117db924cf7c | 274 | |
| wolfSSL | 15:117db924cf7c | 275 | err = mp_read_unsigned_bin(&tmp2, buf, msize - qsize); |
| wolfSSL | 15:117db924cf7c | 276 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 277 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 278 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 279 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 280 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 281 | return err; |
| wolfSSL | 15:117db924cf7c | 282 | } |
| wolfSSL | 15:117db924cf7c | 283 | XFREE(buf, dsa->heap, DYNAMIC_TYPE_TMP_BUFFER); |
| wolfSSL | 15:117db924cf7c | 284 | |
| wolfSSL | 15:117db924cf7c | 285 | /* make our prime q */ |
| wolfSSL | 15:117db924cf7c | 286 | err = mp_rand_prime(&dsa->q, qsize, rng, NULL); |
| wolfSSL | 15:117db924cf7c | 287 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 288 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 289 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 290 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 291 | return err; |
| wolfSSL | 15:117db924cf7c | 292 | } |
| wolfSSL | 15:117db924cf7c | 293 | |
| wolfSSL | 15:117db924cf7c | 294 | /* p = random * q */ |
| wolfSSL | 15:117db924cf7c | 295 | err = mp_mul(&dsa->q, &tmp2, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 296 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 297 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 298 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 299 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 300 | return err; |
| wolfSSL | 15:117db924cf7c | 301 | } |
| wolfSSL | 15:117db924cf7c | 302 | |
| wolfSSL | 15:117db924cf7c | 303 | /* p = random * q + 1, so q is a prime divisor of p-1 */ |
| wolfSSL | 15:117db924cf7c | 304 | err = mp_add_d(&dsa->p, 1, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 305 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 306 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 307 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 308 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 309 | return err; |
| wolfSSL | 15:117db924cf7c | 310 | } |
| wolfSSL | 15:117db924cf7c | 311 | |
| wolfSSL | 15:117db924cf7c | 312 | if (mp_init(&tmp) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 313 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 314 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 315 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 316 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 317 | } |
| wolfSSL | 15:117db924cf7c | 318 | |
| wolfSSL | 15:117db924cf7c | 319 | /* tmp = 2q */ |
| wolfSSL | 15:117db924cf7c | 320 | err = mp_add(&dsa->q, &dsa->q, &tmp); |
| wolfSSL | 15:117db924cf7c | 321 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 322 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 323 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 324 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 325 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 326 | return err; |
| wolfSSL | 15:117db924cf7c | 327 | } |
| wolfSSL | 15:117db924cf7c | 328 | |
| wolfSSL | 15:117db924cf7c | 329 | /* loop until p is prime */ |
| wolfSSL | 15:117db924cf7c | 330 | while (check_prime == MP_NO) { |
| wolfSSL | 16:8e0d178b1d1e | 331 | err = mp_prime_is_prime_ex(&dsa->p, 8, &check_prime, rng); |
| wolfSSL | 15:117db924cf7c | 332 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 333 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 334 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 335 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 336 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 337 | return err; |
| wolfSSL | 15:117db924cf7c | 338 | } |
| wolfSSL | 15:117db924cf7c | 339 | |
| wolfSSL | 15:117db924cf7c | 340 | if (check_prime != MP_YES) { |
| wolfSSL | 15:117db924cf7c | 341 | /* p += 2q */ |
| wolfSSL | 15:117db924cf7c | 342 | err = mp_add(&tmp, &dsa->p, &dsa->p); |
| wolfSSL | 15:117db924cf7c | 343 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 344 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 345 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 346 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 347 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 348 | return err; |
| wolfSSL | 15:117db924cf7c | 349 | } |
| wolfSSL | 15:117db924cf7c | 350 | |
| wolfSSL | 15:117db924cf7c | 351 | loop_check_prime++; |
| wolfSSL | 15:117db924cf7c | 352 | } |
| wolfSSL | 15:117db924cf7c | 353 | } |
| wolfSSL | 15:117db924cf7c | 354 | |
| wolfSSL | 15:117db924cf7c | 355 | /* tmp2 += (2*loop_check_prime) |
| wolfSSL | 15:117db924cf7c | 356 | * to have p = (q * tmp2) + 1 prime |
| wolfSSL | 15:117db924cf7c | 357 | */ |
| wolfSSL | 15:117db924cf7c | 358 | if (loop_check_prime) { |
| wolfSSL | 15:117db924cf7c | 359 | err = mp_add_d(&tmp2, 2*loop_check_prime, &tmp2); |
| wolfSSL | 15:117db924cf7c | 360 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 361 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 362 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 363 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 364 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 365 | return err; |
| wolfSSL | 15:117db924cf7c | 366 | } |
| wolfSSL | 15:117db924cf7c | 367 | } |
| wolfSSL | 15:117db924cf7c | 368 | |
| wolfSSL | 15:117db924cf7c | 369 | if (mp_init(&dsa->g) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 370 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 371 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 372 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 373 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 374 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 375 | } |
| wolfSSL | 15:117db924cf7c | 376 | |
| wolfSSL | 15:117db924cf7c | 377 | /* find a value g for which g^tmp2 != 1 */ |
| wolfSSL | 15:117db924cf7c | 378 | if (mp_set(&dsa->g, 1) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 379 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 380 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 381 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 382 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 383 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 384 | } |
| wolfSSL | 15:117db924cf7c | 385 | |
| wolfSSL | 15:117db924cf7c | 386 | do { |
| wolfSSL | 15:117db924cf7c | 387 | err = mp_add_d(&dsa->g, 1, &dsa->g); |
| wolfSSL | 15:117db924cf7c | 388 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 389 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 390 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 391 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 392 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 393 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 394 | return err; |
| wolfSSL | 15:117db924cf7c | 395 | } |
| wolfSSL | 15:117db924cf7c | 396 | |
| wolfSSL | 15:117db924cf7c | 397 | err = mp_exptmod(&dsa->g, &tmp2, &dsa->p, &tmp); |
| wolfSSL | 15:117db924cf7c | 398 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 399 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 400 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 401 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 402 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 403 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 404 | return err; |
| wolfSSL | 15:117db924cf7c | 405 | } |
| wolfSSL | 15:117db924cf7c | 406 | |
| wolfSSL | 15:117db924cf7c | 407 | } while (mp_cmp_d(&tmp, 1) == MP_EQ); |
| wolfSSL | 15:117db924cf7c | 408 | |
| wolfSSL | 15:117db924cf7c | 409 | /* at this point tmp generates a group of order q mod p */ |
| wolfSSL | 15:117db924cf7c | 410 | mp_exch(&tmp, &dsa->g); |
| wolfSSL | 15:117db924cf7c | 411 | |
| wolfSSL | 15:117db924cf7c | 412 | mp_clear(&tmp); |
| wolfSSL | 15:117db924cf7c | 413 | mp_clear(&tmp2); |
| wolfSSL | 15:117db924cf7c | 414 | |
| wolfSSL | 15:117db924cf7c | 415 | return MP_OKAY; |
| wolfSSL | 15:117db924cf7c | 416 | } |
| wolfSSL | 15:117db924cf7c | 417 | #endif /* WOLFSSL_KEY_GEN */ |
| wolfSSL | 15:117db924cf7c | 418 | |
| wolfSSL | 15:117db924cf7c | 419 | |
| wolfSSL | 16:8e0d178b1d1e | 420 | static int _DsaImportParamsRaw(DsaKey* dsa, const char* p, const char* q, |
| wolfSSL | 16:8e0d178b1d1e | 421 | const char* g, int trusted, WC_RNG* rng) |
| wolfSSL | 15:117db924cf7c | 422 | { |
| wolfSSL | 15:117db924cf7c | 423 | int err; |
| wolfSSL | 15:117db924cf7c | 424 | word32 pSz, qSz; |
| wolfSSL | 15:117db924cf7c | 425 | |
| wolfSSL | 15:117db924cf7c | 426 | if (dsa == NULL || p == NULL || q == NULL || g == NULL) |
| wolfSSL | 15:117db924cf7c | 427 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 428 | |
| wolfSSL | 15:117db924cf7c | 429 | /* read p */ |
| wolfSSL | 15:117db924cf7c | 430 | err = mp_read_radix(&dsa->p, p, MP_RADIX_HEX); |
| wolfSSL | 16:8e0d178b1d1e | 431 | if (err == MP_OKAY && !trusted) { |
| wolfSSL | 16:8e0d178b1d1e | 432 | int isPrime = 1; |
| wolfSSL | 16:8e0d178b1d1e | 433 | if (rng == NULL) |
| wolfSSL | 16:8e0d178b1d1e | 434 | err = mp_prime_is_prime(&dsa->p, 8, &isPrime); |
| wolfSSL | 16:8e0d178b1d1e | 435 | else |
| wolfSSL | 16:8e0d178b1d1e | 436 | err = mp_prime_is_prime_ex(&dsa->p, 8, &isPrime, rng); |
| wolfSSL | 16:8e0d178b1d1e | 437 | |
| wolfSSL | 16:8e0d178b1d1e | 438 | if (err == MP_OKAY) { |
| wolfSSL | 16:8e0d178b1d1e | 439 | if (!isPrime) |
| wolfSSL | 16:8e0d178b1d1e | 440 | err = DH_CHECK_PUB_E; |
| wolfSSL | 16:8e0d178b1d1e | 441 | } |
| wolfSSL | 16:8e0d178b1d1e | 442 | } |
| wolfSSL | 15:117db924cf7c | 443 | |
| wolfSSL | 15:117db924cf7c | 444 | /* read q */ |
| wolfSSL | 15:117db924cf7c | 445 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 446 | err = mp_read_radix(&dsa->q, q, MP_RADIX_HEX); |
| wolfSSL | 15:117db924cf7c | 447 | |
| wolfSSL | 15:117db924cf7c | 448 | /* read g */ |
| wolfSSL | 15:117db924cf7c | 449 | if (err == MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 450 | err = mp_read_radix(&dsa->g, g, MP_RADIX_HEX); |
| wolfSSL | 15:117db924cf7c | 451 | |
| wolfSSL | 15:117db924cf7c | 452 | /* verify (L,N) pair bit lengths */ |
| wolfSSL | 15:117db924cf7c | 453 | pSz = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 454 | qSz = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 455 | |
| wolfSSL | 15:117db924cf7c | 456 | if (CheckDsaLN(pSz * WOLFSSL_BIT_SIZE, qSz * WOLFSSL_BIT_SIZE) != 0) { |
| wolfSSL | 15:117db924cf7c | 457 | WOLFSSL_MSG("Invalid DSA p or q parameter size"); |
| wolfSSL | 15:117db924cf7c | 458 | err = BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 459 | } |
| wolfSSL | 15:117db924cf7c | 460 | |
| wolfSSL | 15:117db924cf7c | 461 | if (err != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 462 | mp_clear(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 463 | mp_clear(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 464 | mp_clear(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 465 | } |
| wolfSSL | 15:117db924cf7c | 466 | |
| wolfSSL | 15:117db924cf7c | 467 | return err; |
| wolfSSL | 15:117db924cf7c | 468 | } |
| wolfSSL | 15:117db924cf7c | 469 | |
| wolfSSL | 15:117db924cf7c | 470 | |
| wolfSSL | 16:8e0d178b1d1e | 471 | /* Import raw DSA parameters into DsaKey structure for use with wc_MakeDsaKey(), |
| wolfSSL | 16:8e0d178b1d1e | 472 | * input parameters (p,q,g) should be represented as ASCII hex values. |
| wolfSSL | 16:8e0d178b1d1e | 473 | * |
| wolfSSL | 16:8e0d178b1d1e | 474 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 16:8e0d178b1d1e | 475 | * p - DSA (p) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 476 | * pSz - length of p |
| wolfSSL | 16:8e0d178b1d1e | 477 | * q - DSA (q) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 478 | * qSz - length of q |
| wolfSSL | 16:8e0d178b1d1e | 479 | * g - DSA (g) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 480 | * gSz - length of g |
| wolfSSL | 16:8e0d178b1d1e | 481 | * |
| wolfSSL | 16:8e0d178b1d1e | 482 | * returns 0 on success, negative upon failure |
| wolfSSL | 16:8e0d178b1d1e | 483 | */ |
| wolfSSL | 16:8e0d178b1d1e | 484 | int wc_DsaImportParamsRaw(DsaKey* dsa, const char* p, const char* q, |
| wolfSSL | 16:8e0d178b1d1e | 485 | const char* g) |
| wolfSSL | 16:8e0d178b1d1e | 486 | { |
| wolfSSL | 16:8e0d178b1d1e | 487 | return _DsaImportParamsRaw(dsa, p, q, g, 1, NULL); |
| wolfSSL | 16:8e0d178b1d1e | 488 | } |
| wolfSSL | 16:8e0d178b1d1e | 489 | |
| wolfSSL | 16:8e0d178b1d1e | 490 | |
| wolfSSL | 16:8e0d178b1d1e | 491 | /* Import raw DSA parameters into DsaKey structure for use with wc_MakeDsaKey(), |
| wolfSSL | 16:8e0d178b1d1e | 492 | * input parameters (p,q,g) should be represented as ASCII hex values. Check |
| wolfSSL | 16:8e0d178b1d1e | 493 | * that the p value is probably prime. |
| wolfSSL | 16:8e0d178b1d1e | 494 | * |
| wolfSSL | 16:8e0d178b1d1e | 495 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 16:8e0d178b1d1e | 496 | * p - DSA (p) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 497 | * pSz - length of p |
| wolfSSL | 16:8e0d178b1d1e | 498 | * q - DSA (q) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 499 | * qSz - length of q |
| wolfSSL | 16:8e0d178b1d1e | 500 | * g - DSA (g) parameter, ASCII hex string |
| wolfSSL | 16:8e0d178b1d1e | 501 | * gSz - length of g |
| wolfSSL | 16:8e0d178b1d1e | 502 | * trusted - trust that p is OK |
| wolfSSL | 16:8e0d178b1d1e | 503 | * rng - random number generator for the prime test |
| wolfSSL | 16:8e0d178b1d1e | 504 | * |
| wolfSSL | 16:8e0d178b1d1e | 505 | * returns 0 on success, negative upon failure |
| wolfSSL | 16:8e0d178b1d1e | 506 | */ |
| wolfSSL | 16:8e0d178b1d1e | 507 | int wc_DsaImportParamsRawCheck(DsaKey* dsa, const char* p, const char* q, |
| wolfSSL | 16:8e0d178b1d1e | 508 | const char* g, int trusted, WC_RNG* rng) |
| wolfSSL | 16:8e0d178b1d1e | 509 | { |
| wolfSSL | 16:8e0d178b1d1e | 510 | return _DsaImportParamsRaw(dsa, p, q, g, trusted, rng); |
| wolfSSL | 16:8e0d178b1d1e | 511 | } |
| wolfSSL | 16:8e0d178b1d1e | 512 | |
| wolfSSL | 16:8e0d178b1d1e | 513 | |
| wolfSSL | 15:117db924cf7c | 514 | /* Export raw DSA parameters from DsaKey structure |
| wolfSSL | 15:117db924cf7c | 515 | * |
| wolfSSL | 15:117db924cf7c | 516 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 15:117db924cf7c | 517 | * p - output location for DSA (p) parameter |
| wolfSSL | 15:117db924cf7c | 518 | * pSz - [IN/OUT] size of output buffer for p, size of p |
| wolfSSL | 15:117db924cf7c | 519 | * q - output location for DSA (q) parameter |
| wolfSSL | 15:117db924cf7c | 520 | * qSz - [IN/OUT] size of output buffer for q, size of q |
| wolfSSL | 15:117db924cf7c | 521 | * g - output location for DSA (g) parameter |
| wolfSSL | 15:117db924cf7c | 522 | * gSz - [IN/OUT] size of output buffer for g, size of g |
| wolfSSL | 15:117db924cf7c | 523 | * |
| wolfSSL | 15:117db924cf7c | 524 | * If p, q, and g pointers are all passed in as NULL, the function |
| wolfSSL | 15:117db924cf7c | 525 | * will set pSz, qSz, and gSz to the required output buffer sizes for p, |
| wolfSSL | 15:117db924cf7c | 526 | * q, and g. In this case, the function will return LENGTH_ONLY_E. |
| wolfSSL | 15:117db924cf7c | 527 | * |
| wolfSSL | 15:117db924cf7c | 528 | * returns 0 on success, negative upon failure |
| wolfSSL | 15:117db924cf7c | 529 | */ |
| wolfSSL | 15:117db924cf7c | 530 | int wc_DsaExportParamsRaw(DsaKey* dsa, byte* p, word32* pSz, |
| wolfSSL | 15:117db924cf7c | 531 | byte* q, word32* qSz, byte* g, word32* gSz) |
| wolfSSL | 15:117db924cf7c | 532 | { |
| wolfSSL | 15:117db924cf7c | 533 | int err; |
| wolfSSL | 15:117db924cf7c | 534 | word32 pLen, qLen, gLen; |
| wolfSSL | 15:117db924cf7c | 535 | |
| wolfSSL | 15:117db924cf7c | 536 | if (dsa == NULL || pSz == NULL || qSz == NULL || gSz == NULL) |
| wolfSSL | 15:117db924cf7c | 537 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 538 | |
| wolfSSL | 15:117db924cf7c | 539 | /* get required output buffer sizes */ |
| wolfSSL | 15:117db924cf7c | 540 | pLen = mp_unsigned_bin_size(&dsa->p); |
| wolfSSL | 15:117db924cf7c | 541 | qLen = mp_unsigned_bin_size(&dsa->q); |
| wolfSSL | 15:117db924cf7c | 542 | gLen = mp_unsigned_bin_size(&dsa->g); |
| wolfSSL | 15:117db924cf7c | 543 | |
| wolfSSL | 15:117db924cf7c | 544 | /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */ |
| wolfSSL | 15:117db924cf7c | 545 | if (p == NULL && q == NULL && g == NULL) { |
| wolfSSL | 15:117db924cf7c | 546 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 547 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 548 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 549 | return LENGTH_ONLY_E; |
| wolfSSL | 15:117db924cf7c | 550 | } |
| wolfSSL | 15:117db924cf7c | 551 | |
| wolfSSL | 15:117db924cf7c | 552 | if (p == NULL || q == NULL || g == NULL) |
| wolfSSL | 15:117db924cf7c | 553 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 554 | |
| wolfSSL | 15:117db924cf7c | 555 | /* export p */ |
| wolfSSL | 15:117db924cf7c | 556 | if (*pSz < pLen) { |
| wolfSSL | 15:117db924cf7c | 557 | WOLFSSL_MSG("Output buffer for DSA p parameter too small, " |
| wolfSSL | 15:117db924cf7c | 558 | "required size placed into pSz"); |
| wolfSSL | 15:117db924cf7c | 559 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 560 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 561 | } |
| wolfSSL | 15:117db924cf7c | 562 | *pSz = pLen; |
| wolfSSL | 15:117db924cf7c | 563 | err = mp_to_unsigned_bin(&dsa->p, p); |
| wolfSSL | 15:117db924cf7c | 564 | |
| wolfSSL | 15:117db924cf7c | 565 | /* export q */ |
| wolfSSL | 15:117db924cf7c | 566 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 567 | if (*qSz < qLen) { |
| wolfSSL | 15:117db924cf7c | 568 | WOLFSSL_MSG("Output buffer for DSA q parameter too small, " |
| wolfSSL | 15:117db924cf7c | 569 | "required size placed into qSz"); |
| wolfSSL | 15:117db924cf7c | 570 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 571 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 572 | } |
| wolfSSL | 15:117db924cf7c | 573 | *qSz = qLen; |
| wolfSSL | 15:117db924cf7c | 574 | err = mp_to_unsigned_bin(&dsa->q, q); |
| wolfSSL | 15:117db924cf7c | 575 | } |
| wolfSSL | 15:117db924cf7c | 576 | |
| wolfSSL | 15:117db924cf7c | 577 | /* export g */ |
| wolfSSL | 15:117db924cf7c | 578 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 579 | if (*gSz < gLen) { |
| wolfSSL | 15:117db924cf7c | 580 | WOLFSSL_MSG("Output buffer for DSA g parameter too small, " |
| wolfSSL | 15:117db924cf7c | 581 | "required size placed into gSz"); |
| wolfSSL | 15:117db924cf7c | 582 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 583 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 584 | } |
| wolfSSL | 15:117db924cf7c | 585 | *gSz = gLen; |
| wolfSSL | 15:117db924cf7c | 586 | err = mp_to_unsigned_bin(&dsa->g, g); |
| wolfSSL | 15:117db924cf7c | 587 | } |
| wolfSSL | 15:117db924cf7c | 588 | |
| wolfSSL | 15:117db924cf7c | 589 | return err; |
| wolfSSL | 15:117db924cf7c | 590 | } |
| wolfSSL | 15:117db924cf7c | 591 | |
| wolfSSL | 15:117db924cf7c | 592 | |
| wolfSSL | 15:117db924cf7c | 593 | /* Export raw DSA key (x, y) from DsaKey structure |
| wolfSSL | 15:117db924cf7c | 594 | * |
| wolfSSL | 15:117db924cf7c | 595 | * dsa - pointer to initialized DsaKey structure |
| wolfSSL | 15:117db924cf7c | 596 | * x - output location for private key |
| wolfSSL | 15:117db924cf7c | 597 | * xSz - [IN/OUT] size of output buffer for x, size of x |
| wolfSSL | 15:117db924cf7c | 598 | * y - output location for public key |
| wolfSSL | 15:117db924cf7c | 599 | * ySz - [IN/OUT] size of output buffer for y, size of y |
| wolfSSL | 15:117db924cf7c | 600 | * |
| wolfSSL | 15:117db924cf7c | 601 | * If x and y pointers are all passed in as NULL, the function |
| wolfSSL | 15:117db924cf7c | 602 | * will set xSz and ySz to the required output buffer sizes for x |
| wolfSSL | 15:117db924cf7c | 603 | * and y. In this case, the function will return LENGTH_ONLY_E. |
| wolfSSL | 15:117db924cf7c | 604 | * |
| wolfSSL | 15:117db924cf7c | 605 | * returns 0 on success, negative upon failure |
| wolfSSL | 15:117db924cf7c | 606 | */ |
| wolfSSL | 15:117db924cf7c | 607 | int wc_DsaExportKeyRaw(DsaKey* dsa, byte* x, word32* xSz, byte* y, word32* ySz) |
| wolfSSL | 15:117db924cf7c | 608 | { |
| wolfSSL | 15:117db924cf7c | 609 | int err; |
| wolfSSL | 15:117db924cf7c | 610 | word32 xLen, yLen; |
| wolfSSL | 15:117db924cf7c | 611 | |
| wolfSSL | 15:117db924cf7c | 612 | if (dsa == NULL || xSz == NULL || ySz == NULL) |
| wolfSSL | 15:117db924cf7c | 613 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 614 | |
| wolfSSL | 15:117db924cf7c | 615 | /* get required output buffer sizes */ |
| wolfSSL | 15:117db924cf7c | 616 | xLen = mp_unsigned_bin_size(&dsa->x); |
| wolfSSL | 15:117db924cf7c | 617 | yLen = mp_unsigned_bin_size(&dsa->y); |
| wolfSSL | 15:117db924cf7c | 618 | |
| wolfSSL | 15:117db924cf7c | 619 | /* return buffer sizes and LENGTH_ONLY_E if buffers are NULL */ |
| wolfSSL | 15:117db924cf7c | 620 | if (x == NULL && y == NULL) { |
| wolfSSL | 15:117db924cf7c | 621 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 622 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 623 | return LENGTH_ONLY_E; |
| wolfSSL | 15:117db924cf7c | 624 | } |
| wolfSSL | 15:117db924cf7c | 625 | |
| wolfSSL | 15:117db924cf7c | 626 | if (x == NULL || y == NULL) |
| wolfSSL | 15:117db924cf7c | 627 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 628 | |
| wolfSSL | 15:117db924cf7c | 629 | /* export x */ |
| wolfSSL | 15:117db924cf7c | 630 | if (*xSz < xLen) { |
| wolfSSL | 15:117db924cf7c | 631 | WOLFSSL_MSG("Output buffer for DSA private key (x) too small, " |
| wolfSSL | 15:117db924cf7c | 632 | "required size placed into xSz"); |
| wolfSSL | 15:117db924cf7c | 633 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 634 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 635 | } |
| wolfSSL | 15:117db924cf7c | 636 | *xSz = xLen; |
| wolfSSL | 15:117db924cf7c | 637 | err = mp_to_unsigned_bin(&dsa->x, x); |
| wolfSSL | 15:117db924cf7c | 638 | |
| wolfSSL | 15:117db924cf7c | 639 | /* export y */ |
| wolfSSL | 15:117db924cf7c | 640 | if (err == MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 641 | if (*ySz < yLen) { |
| wolfSSL | 15:117db924cf7c | 642 | WOLFSSL_MSG("Output buffer to DSA public key (y) too small, " |
| wolfSSL | 15:117db924cf7c | 643 | "required size placed into ySz"); |
| wolfSSL | 15:117db924cf7c | 644 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 645 | return BUFFER_E; |
| wolfSSL | 15:117db924cf7c | 646 | } |
| wolfSSL | 15:117db924cf7c | 647 | *ySz = yLen; |
| wolfSSL | 15:117db924cf7c | 648 | err = mp_to_unsigned_bin(&dsa->y, y); |
| wolfSSL | 15:117db924cf7c | 649 | } |
| wolfSSL | 15:117db924cf7c | 650 | |
| wolfSSL | 15:117db924cf7c | 651 | return err; |
| wolfSSL | 15:117db924cf7c | 652 | } |
| wolfSSL | 15:117db924cf7c | 653 | |
| wolfSSL | 15:117db924cf7c | 654 | |
| wolfSSL | 15:117db924cf7c | 655 | int wc_DsaSign(const byte* digest, byte* out, DsaKey* key, WC_RNG* rng) |
| wolfSSL | 15:117db924cf7c | 656 | { |
| wolfSSL | 16:8e0d178b1d1e | 657 | mp_int k, kInv, r, s, H; |
| wolfSSL | 16:8e0d178b1d1e | 658 | #ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME |
| wolfSSL | 16:8e0d178b1d1e | 659 | mp_int b; |
| wolfSSL | 16:8e0d178b1d1e | 660 | #endif |
| wolfSSL | 16:8e0d178b1d1e | 661 | mp_int* qMinus1; |
| wolfSSL | 16:8e0d178b1d1e | 662 | int ret = 0, sz; |
| wolfSSL | 16:8e0d178b1d1e | 663 | byte buffer[DSA_HALF_SIZE]; |
| wolfSSL | 16:8e0d178b1d1e | 664 | byte* tmp; /* initial output pointer */ |
| wolfSSL | 15:117db924cf7c | 665 | |
| wolfSSL | 15:117db924cf7c | 666 | if (digest == NULL || out == NULL || key == NULL || rng == NULL) { |
| wolfSSL | 15:117db924cf7c | 667 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 668 | } |
| wolfSSL | 15:117db924cf7c | 669 | |
| wolfSSL | 15:117db924cf7c | 670 | tmp = out; |
| wolfSSL | 15:117db924cf7c | 671 | |
| wolfSSL | 15:117db924cf7c | 672 | sz = min((int)sizeof(buffer), mp_unsigned_bin_size(&key->q)); |
| wolfSSL | 15:117db924cf7c | 673 | |
| wolfSSL | 16:8e0d178b1d1e | 674 | #ifdef WOLFSSL_MP_INVMOD_CONSTANT_TIME |
| wolfSSL | 15:117db924cf7c | 675 | if (mp_init_multi(&k, &kInv, &r, &s, &H, 0) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 676 | #else |
| wolfSSL | 16:8e0d178b1d1e | 677 | if (mp_init_multi(&k, &kInv, &r, &s, &H, &b) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 678 | #endif |
| wolfSSL | 16:8e0d178b1d1e | 679 | { |
| wolfSSL | 15:117db924cf7c | 680 | return MP_INIT_E; |
| wolfSSL | 16:8e0d178b1d1e | 681 | } |
| wolfSSL | 16:8e0d178b1d1e | 682 | qMinus1 = &kInv; |
| wolfSSL | 15:117db924cf7c | 683 | |
| wolfSSL | 16:8e0d178b1d1e | 684 | /* NIST FIPS 186-4: B.2.2 |
| wolfSSL | 16:8e0d178b1d1e | 685 | * Per-Message Secret Number Generation by Testing Candidates |
| wolfSSL | 16:8e0d178b1d1e | 686 | * Generate k in range [1, q-1]. |
| wolfSSL | 16:8e0d178b1d1e | 687 | * Check that k is less than q-1: range [0, q-2]. |
| wolfSSL | 16:8e0d178b1d1e | 688 | * Add 1 to k: range [1, q-1]. |
| wolfSSL | 16:8e0d178b1d1e | 689 | */ |
| wolfSSL | 16:8e0d178b1d1e | 690 | if (mp_sub_d(&key->q, 1, qMinus1)) |
| wolfSSL | 16:8e0d178b1d1e | 691 | ret = MP_SUB_E; |
| wolfSSL | 15:117db924cf7c | 692 | |
| wolfSSL | 16:8e0d178b1d1e | 693 | if (ret == 0) { |
| wolfSSL | 16:8e0d178b1d1e | 694 | do { |
| wolfSSL | 16:8e0d178b1d1e | 695 | /* Step 4: generate k */ |
| wolfSSL | 16:8e0d178b1d1e | 696 | ret = wc_RNG_GenerateBlock(rng, buffer, sz); |
| wolfSSL | 16:8e0d178b1d1e | 697 | |
| wolfSSL | 16:8e0d178b1d1e | 698 | /* Step 5 */ |
| wolfSSL | 16:8e0d178b1d1e | 699 | if (ret == 0 && mp_read_unsigned_bin(&k, buffer, sz) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 700 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 701 | |
| wolfSSL | 16:8e0d178b1d1e | 702 | /* k is a random numnber and it should be less than q-1 |
| wolfSSL | 16:8e0d178b1d1e | 703 | * if k greater than repeat |
| wolfSSL | 16:8e0d178b1d1e | 704 | */ |
| wolfSSL | 16:8e0d178b1d1e | 705 | /* Step 6 */ |
| wolfSSL | 16:8e0d178b1d1e | 706 | } while (ret == 0 && mp_cmp(&k, qMinus1) != MP_LT); |
| wolfSSL | 16:8e0d178b1d1e | 707 | } |
| wolfSSL | 16:8e0d178b1d1e | 708 | /* Step 7 */ |
| wolfSSL | 16:8e0d178b1d1e | 709 | if (ret == 0 && mp_add_d(&k, 1, &k) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 710 | ret = MP_MOD_E; |
| wolfSSL | 15:117db924cf7c | 711 | |
| wolfSSL | 16:8e0d178b1d1e | 712 | #ifdef WOLFSSL_MP_INVMOD_CONSTANT_TIME |
| wolfSSL | 15:117db924cf7c | 713 | /* inverse k mod q */ |
| wolfSSL | 15:117db924cf7c | 714 | if (ret == 0 && mp_invmod(&k, &key->q, &kInv) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 715 | ret = MP_INVMOD_E; |
| wolfSSL | 15:117db924cf7c | 716 | |
| wolfSSL | 15:117db924cf7c | 717 | /* generate r, r = (g exp k mod p) mod q */ |
| wolfSSL | 16:8e0d178b1d1e | 718 | if (ret == 0 && mp_exptmod_ex(&key->g, &k, key->q.used, &key->p, |
| wolfSSL | 16:8e0d178b1d1e | 719 | &r) != MP_OKAY) { |
| wolfSSL | 15:117db924cf7c | 720 | ret = MP_EXPTMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 721 | } |
| wolfSSL | 15:117db924cf7c | 722 | |
| wolfSSL | 15:117db924cf7c | 723 | if (ret == 0 && mp_mod(&r, &key->q, &r) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 724 | ret = MP_MOD_E; |
| wolfSSL | 15:117db924cf7c | 725 | |
| wolfSSL | 15:117db924cf7c | 726 | /* generate H from sha digest */ |
| wolfSSL | 15:117db924cf7c | 727 | if (ret == 0 && mp_read_unsigned_bin(&H, digest,WC_SHA_DIGEST_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 728 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 729 | |
| wolfSSL | 15:117db924cf7c | 730 | /* generate s, s = (kInv * (H + x*r)) % q */ |
| wolfSSL | 15:117db924cf7c | 731 | if (ret == 0 && mp_mul(&key->x, &r, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 732 | ret = MP_MUL_E; |
| wolfSSL | 15:117db924cf7c | 733 | |
| wolfSSL | 15:117db924cf7c | 734 | if (ret == 0 && mp_add(&s, &H, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 735 | ret = MP_ADD_E; |
| wolfSSL | 15:117db924cf7c | 736 | |
| wolfSSL | 15:117db924cf7c | 737 | if (ret == 0 && mp_mulmod(&s, &kInv, &key->q, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 738 | ret = MP_MULMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 739 | #else |
| wolfSSL | 16:8e0d178b1d1e | 740 | /* Blinding value |
| wolfSSL | 16:8e0d178b1d1e | 741 | * Generate b in range [1, q-1]. |
| wolfSSL | 16:8e0d178b1d1e | 742 | */ |
| wolfSSL | 16:8e0d178b1d1e | 743 | if (ret == 0) { |
| wolfSSL | 16:8e0d178b1d1e | 744 | do { |
| wolfSSL | 16:8e0d178b1d1e | 745 | ret = wc_RNG_GenerateBlock(rng, buffer, sz); |
| wolfSSL | 16:8e0d178b1d1e | 746 | if (ret == 0 && mp_read_unsigned_bin(&b, buffer, sz) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 747 | ret = MP_READ_E; |
| wolfSSL | 16:8e0d178b1d1e | 748 | } while (ret == 0 && mp_cmp(&b, qMinus1) != MP_LT); |
| wolfSSL | 16:8e0d178b1d1e | 749 | } |
| wolfSSL | 16:8e0d178b1d1e | 750 | if (ret == 0 && mp_add_d(&b, 1, &b) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 751 | ret = MP_MOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 752 | |
| wolfSSL | 16:8e0d178b1d1e | 753 | /* set H from sha digest */ |
| wolfSSL | 16:8e0d178b1d1e | 754 | if (ret == 0 && mp_read_unsigned_bin(&H, digest, |
| wolfSSL | 16:8e0d178b1d1e | 755 | WC_SHA_DIGEST_SIZE) != MP_OKAY) { |
| wolfSSL | 16:8e0d178b1d1e | 756 | ret = MP_READ_E; |
| wolfSSL | 16:8e0d178b1d1e | 757 | } |
| wolfSSL | 16:8e0d178b1d1e | 758 | |
| wolfSSL | 16:8e0d178b1d1e | 759 | /* generate r, r = (g exp k mod p) mod q */ |
| wolfSSL | 16:8e0d178b1d1e | 760 | if (ret == 0 && mp_exptmod_ex(&key->g, &k, key->q.used, &key->p, |
| wolfSSL | 16:8e0d178b1d1e | 761 | &r) != MP_OKAY) { |
| wolfSSL | 16:8e0d178b1d1e | 762 | ret = MP_EXPTMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 763 | } |
| wolfSSL | 16:8e0d178b1d1e | 764 | |
| wolfSSL | 16:8e0d178b1d1e | 765 | /* calculate s = (H + xr)/k |
| wolfSSL | 16:8e0d178b1d1e | 766 | = b.(H/k.b + x.r/k.b) */ |
| wolfSSL | 16:8e0d178b1d1e | 767 | |
| wolfSSL | 16:8e0d178b1d1e | 768 | /* k = k.b */ |
| wolfSSL | 16:8e0d178b1d1e | 769 | if (ret == 0 && mp_mulmod(&k, &b, &key->q, &k) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 770 | ret = MP_MULMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 771 | |
| wolfSSL | 16:8e0d178b1d1e | 772 | /* kInv = 1/k.b mod q */ |
| wolfSSL | 16:8e0d178b1d1e | 773 | if (ret == 0 && mp_invmod(&k, &key->q, &kInv) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 774 | ret = MP_INVMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 775 | |
| wolfSSL | 16:8e0d178b1d1e | 776 | if (ret == 0 && mp_mod(&r, &key->q, &r) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 777 | ret = MP_MOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 778 | |
| wolfSSL | 16:8e0d178b1d1e | 779 | /* s = x.r */ |
| wolfSSL | 16:8e0d178b1d1e | 780 | if (ret == 0 && mp_mul(&key->x, &r, &s) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 781 | ret = MP_MUL_E; |
| wolfSSL | 16:8e0d178b1d1e | 782 | |
| wolfSSL | 16:8e0d178b1d1e | 783 | /* s = x.r/k.b */ |
| wolfSSL | 16:8e0d178b1d1e | 784 | if (ret == 0 && mp_mulmod(&s, &kInv, &key->q, &s) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 785 | ret = MP_MULMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 786 | |
| wolfSSL | 16:8e0d178b1d1e | 787 | /* H = H/k.b */ |
| wolfSSL | 16:8e0d178b1d1e | 788 | if (ret == 0 && mp_mulmod(&H, &kInv, &key->q, &H) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 789 | ret = MP_MULMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 790 | |
| wolfSSL | 16:8e0d178b1d1e | 791 | /* s = H/k.b + x.r/k.b |
| wolfSSL | 16:8e0d178b1d1e | 792 | = (H + x.r)/k.b */ |
| wolfSSL | 16:8e0d178b1d1e | 793 | if (ret == 0 && mp_add(&s, &H, &s) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 794 | ret = MP_ADD_E; |
| wolfSSL | 16:8e0d178b1d1e | 795 | |
| wolfSSL | 16:8e0d178b1d1e | 796 | /* s = b.(e + x.r)/k.b |
| wolfSSL | 16:8e0d178b1d1e | 797 | = (e + x.r)/k */ |
| wolfSSL | 16:8e0d178b1d1e | 798 | if (ret == 0 && mp_mulmod(&s, &b, &key->q, &s) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 799 | ret = MP_MULMOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 800 | |
| wolfSSL | 16:8e0d178b1d1e | 801 | /* s = (e + x.r)/k */ |
| wolfSSL | 16:8e0d178b1d1e | 802 | if (ret == 0 && mp_mod(&s, &key->q, &s) != MP_OKAY) |
| wolfSSL | 16:8e0d178b1d1e | 803 | ret = MP_MOD_E; |
| wolfSSL | 16:8e0d178b1d1e | 804 | #endif |
| wolfSSL | 15:117db924cf7c | 805 | |
| wolfSSL | 15:117db924cf7c | 806 | /* detect zero r or s */ |
| wolfSSL | 15:117db924cf7c | 807 | if (ret == 0 && (mp_iszero(&r) == MP_YES || mp_iszero(&s) == MP_YES)) |
| wolfSSL | 15:117db924cf7c | 808 | ret = MP_ZERO_E; |
| wolfSSL | 15:117db924cf7c | 809 | |
| wolfSSL | 15:117db924cf7c | 810 | /* write out */ |
| wolfSSL | 15:117db924cf7c | 811 | if (ret == 0) { |
| wolfSSL | 15:117db924cf7c | 812 | int rSz = mp_unsigned_bin_size(&r); |
| wolfSSL | 15:117db924cf7c | 813 | int sSz = mp_unsigned_bin_size(&s); |
| wolfSSL | 15:117db924cf7c | 814 | |
| wolfSSL | 15:117db924cf7c | 815 | while (rSz++ < DSA_HALF_SIZE) { |
| wolfSSL | 15:117db924cf7c | 816 | *out++ = 0x00; /* pad front with zeros */ |
| wolfSSL | 15:117db924cf7c | 817 | } |
| wolfSSL | 15:117db924cf7c | 818 | |
| wolfSSL | 15:117db924cf7c | 819 | if (mp_to_unsigned_bin(&r, out) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 820 | ret = MP_TO_E; |
| wolfSSL | 15:117db924cf7c | 821 | else { |
| wolfSSL | 15:117db924cf7c | 822 | out = tmp + DSA_HALF_SIZE; /* advance to s in output */ |
| wolfSSL | 15:117db924cf7c | 823 | while (sSz++ < DSA_HALF_SIZE) { |
| wolfSSL | 15:117db924cf7c | 824 | *out++ = 0x00; /* pad front with zeros */ |
| wolfSSL | 15:117db924cf7c | 825 | } |
| wolfSSL | 15:117db924cf7c | 826 | ret = mp_to_unsigned_bin(&s, out); |
| wolfSSL | 15:117db924cf7c | 827 | } |
| wolfSSL | 15:117db924cf7c | 828 | } |
| wolfSSL | 15:117db924cf7c | 829 | |
| wolfSSL | 16:8e0d178b1d1e | 830 | ForceZero(buffer, sz); |
| wolfSSL | 16:8e0d178b1d1e | 831 | mp_forcezero(&kInv); |
| wolfSSL | 16:8e0d178b1d1e | 832 | mp_forcezero(&k); |
| wolfSSL | 16:8e0d178b1d1e | 833 | #ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME |
| wolfSSL | 16:8e0d178b1d1e | 834 | mp_forcezero(&b); |
| wolfSSL | 16:8e0d178b1d1e | 835 | |
| wolfSSL | 16:8e0d178b1d1e | 836 | mp_clear(&b); |
| wolfSSL | 16:8e0d178b1d1e | 837 | #endif |
| wolfSSL | 15:117db924cf7c | 838 | mp_clear(&H); |
| wolfSSL | 15:117db924cf7c | 839 | mp_clear(&s); |
| wolfSSL | 15:117db924cf7c | 840 | mp_clear(&r); |
| wolfSSL | 15:117db924cf7c | 841 | mp_clear(&kInv); |
| wolfSSL | 15:117db924cf7c | 842 | mp_clear(&k); |
| wolfSSL | 15:117db924cf7c | 843 | |
| wolfSSL | 15:117db924cf7c | 844 | return ret; |
| wolfSSL | 15:117db924cf7c | 845 | } |
| wolfSSL | 15:117db924cf7c | 846 | |
| wolfSSL | 15:117db924cf7c | 847 | |
| wolfSSL | 15:117db924cf7c | 848 | int wc_DsaVerify(const byte* digest, const byte* sig, DsaKey* key, int* answer) |
| wolfSSL | 15:117db924cf7c | 849 | { |
| wolfSSL | 15:117db924cf7c | 850 | mp_int w, u1, u2, v, r, s; |
| wolfSSL | 15:117db924cf7c | 851 | int ret = 0; |
| wolfSSL | 15:117db924cf7c | 852 | |
| wolfSSL | 15:117db924cf7c | 853 | if (digest == NULL || sig == NULL || key == NULL || answer == NULL) { |
| wolfSSL | 15:117db924cf7c | 854 | return BAD_FUNC_ARG; |
| wolfSSL | 15:117db924cf7c | 855 | } |
| wolfSSL | 15:117db924cf7c | 856 | |
| wolfSSL | 15:117db924cf7c | 857 | if (mp_init_multi(&w, &u1, &u2, &v, &r, &s) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 858 | return MP_INIT_E; |
| wolfSSL | 15:117db924cf7c | 859 | |
| wolfSSL | 15:117db924cf7c | 860 | /* set r and s from signature */ |
| wolfSSL | 15:117db924cf7c | 861 | if (mp_read_unsigned_bin(&r, sig, DSA_HALF_SIZE) != MP_OKAY || |
| wolfSSL | 15:117db924cf7c | 862 | mp_read_unsigned_bin(&s, sig + DSA_HALF_SIZE, DSA_HALF_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 863 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 864 | |
| wolfSSL | 15:117db924cf7c | 865 | /* sanity checks */ |
| wolfSSL | 15:117db924cf7c | 866 | if (ret == 0) { |
| wolfSSL | 15:117db924cf7c | 867 | if (mp_iszero(&r) == MP_YES || mp_iszero(&s) == MP_YES || |
| wolfSSL | 15:117db924cf7c | 868 | mp_cmp(&r, &key->q) != MP_LT || mp_cmp(&s, &key->q) != MP_LT) { |
| wolfSSL | 15:117db924cf7c | 869 | ret = MP_ZERO_E; |
| wolfSSL | 15:117db924cf7c | 870 | } |
| wolfSSL | 15:117db924cf7c | 871 | } |
| wolfSSL | 15:117db924cf7c | 872 | |
| wolfSSL | 15:117db924cf7c | 873 | /* put H into u1 from sha digest */ |
| wolfSSL | 15:117db924cf7c | 874 | if (ret == 0 && mp_read_unsigned_bin(&u1,digest,WC_SHA_DIGEST_SIZE) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 875 | ret = MP_READ_E; |
| wolfSSL | 15:117db924cf7c | 876 | |
| wolfSSL | 15:117db924cf7c | 877 | /* w = s invmod q */ |
| wolfSSL | 15:117db924cf7c | 878 | if (ret == 0 && mp_invmod(&s, &key->q, &w) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 879 | ret = MP_INVMOD_E; |
| wolfSSL | 15:117db924cf7c | 880 | |
| wolfSSL | 15:117db924cf7c | 881 | /* u1 = (H * w) % q */ |
| wolfSSL | 15:117db924cf7c | 882 | if (ret == 0 && mp_mulmod(&u1, &w, &key->q, &u1) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 883 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 884 | |
| wolfSSL | 15:117db924cf7c | 885 | /* u2 = (r * w) % q */ |
| wolfSSL | 15:117db924cf7c | 886 | if (ret == 0 && mp_mulmod(&r, &w, &key->q, &u2) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 887 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 888 | |
| wolfSSL | 15:117db924cf7c | 889 | /* verify v = ((g^u1 * y^u2) mod p) mod q */ |
| wolfSSL | 15:117db924cf7c | 890 | if (ret == 0 && mp_exptmod(&key->g, &u1, &key->p, &u1) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 891 | ret = MP_EXPTMOD_E; |
| wolfSSL | 15:117db924cf7c | 892 | |
| wolfSSL | 15:117db924cf7c | 893 | if (ret == 0 && mp_exptmod(&key->y, &u2, &key->p, &u2) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 894 | ret = MP_EXPTMOD_E; |
| wolfSSL | 15:117db924cf7c | 895 | |
| wolfSSL | 15:117db924cf7c | 896 | if (ret == 0 && mp_mulmod(&u1, &u2, &key->p, &v) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 897 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 898 | |
| wolfSSL | 15:117db924cf7c | 899 | if (ret == 0 && mp_mod(&v, &key->q, &v) != MP_OKAY) |
| wolfSSL | 15:117db924cf7c | 900 | ret = MP_MULMOD_E; |
| wolfSSL | 15:117db924cf7c | 901 | |
| wolfSSL | 15:117db924cf7c | 902 | /* do they match */ |
| wolfSSL | 15:117db924cf7c | 903 | if (ret == 0 && mp_cmp(&r, &v) == MP_EQ) |
| wolfSSL | 15:117db924cf7c | 904 | *answer = 1; |
| wolfSSL | 15:117db924cf7c | 905 | else |
| wolfSSL | 15:117db924cf7c | 906 | *answer = 0; |
| wolfSSL | 15:117db924cf7c | 907 | |
| wolfSSL | 15:117db924cf7c | 908 | mp_clear(&s); |
| wolfSSL | 15:117db924cf7c | 909 | mp_clear(&r); |
| wolfSSL | 15:117db924cf7c | 910 | mp_clear(&u1); |
| wolfSSL | 15:117db924cf7c | 911 | mp_clear(&u2); |
| wolfSSL | 15:117db924cf7c | 912 | mp_clear(&w); |
| wolfSSL | 15:117db924cf7c | 913 | mp_clear(&v); |
| wolfSSL | 15:117db924cf7c | 914 | |
| wolfSSL | 15:117db924cf7c | 915 | return ret; |
| wolfSSL | 15:117db924cf7c | 916 | } |
| wolfSSL | 15:117db924cf7c | 917 | |
| wolfSSL | 15:117db924cf7c | 918 | |
| wolfSSL | 15:117db924cf7c | 919 | #endif /* NO_DSA */ |
| wolfSSL | 15:117db924cf7c | 920 | |
| wolfSSL | 15:117db924cf7c | 921 |