[thirdparty/openssl.git] / crypto / ec / ecdsa_ossl.c

/*
 * Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <string.h>
#include <openssl/err.h>
#include <openssl/obj_mac.h>
#include <openssl/bn.h>
#include <openssl/rand.h>
#include <openssl/ec.h>
#include "ec_lcl.h"

int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen,
                    unsigned char *sig, unsigned int *siglen,
                    const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey)
{
    ECDSA_SIG *s;
    RAND_seed(dgst, dlen);
    s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey);
    if (s == NULL) {
        *siglen = 0;
        return 0;
    }
    *siglen = i2d_ECDSA_SIG(s, &sig);
    ECDSA_SIG_free(s);
    return 1;
}

static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in,
                            BIGNUM **kinvp, BIGNUM **rp,
                            const unsigned char *dgst, int dlen)
{
    BN_CTX *ctx = NULL;
    BIGNUM *k = NULL, *r = NULL, *X = NULL;
    const BIGNUM *order;
    EC_POINT *tmp_point = NULL;
    const EC_GROUP *group;
    int ret = 0;

    if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) {
        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);
        return 0;
    }

    if (!EC_KEY_can_sign(eckey)) {
        ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
        return 0;
    }

    if (ctx_in == NULL) {
        if ((ctx = BN_CTX_new()) == NULL) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
            return 0;
        }
    } else
        ctx = ctx_in;

    k = BN_new();               /* this value is later returned in *kinvp */
    r = BN_new();               /* this value is later returned in *rp */
    X = BN_new();
    if (k == NULL || r == NULL || X == NULL) {
        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if ((tmp_point = EC_POINT_new(group)) == NULL) {
        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
        goto err;
    }
    order = EC_GROUP_get0_order(group);
    if (order == NULL) {
        ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
        goto err;
    }

    do {
        /* get random k */
        do
            if (dgst != NULL) {
                if (!BN_generate_dsa_nonce
                    (k, order, EC_KEY_get0_private_key(eckey), dgst, dlen,
                     ctx)) {
                    ECerr(EC_F_ECDSA_SIGN_SETUP,
                             EC_R_RANDOM_NUMBER_GENERATION_FAILED);
                    goto err;
                }
            } else {
                if (!BN_rand_range(k, order)) {
                    ECerr(EC_F_ECDSA_SIGN_SETUP,
                             EC_R_RANDOM_NUMBER_GENERATION_FAILED);
                    goto err;
                }
            }
        while (BN_is_zero(k));

        /*
         * We do not want timing information to leak the length of k, so we
         * compute G*k using an equivalent scalar of fixed bit-length.
         */

        if (!BN_add(k, k, order))
            goto err;
        if (BN_num_bits(k) <= BN_num_bits(order))
            if (!BN_add(k, k, order))
                goto err;

        /* compute r the x-coordinate of generator * k */
        if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
            goto err;
        }
        if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
            NID_X9_62_prime_field) {
            if (!EC_POINT_get_affine_coordinates_GFp
                (group, tmp_point, X, NULL, ctx)) {
                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
                goto err;
            }
        }
#ifndef OPENSSL_NO_EC2M
        else {                  /* NID_X9_62_characteristic_two_field */

            if (!EC_POINT_get_affine_coordinates_GF2m(group,
                                                      tmp_point, X, NULL,
                                                      ctx)) {
                ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
                goto err;
            }
        }
#endif
        if (!BN_nnmod(r, X, order, ctx)) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
            goto err;
        }
    }
    while (BN_is_zero(r));

    /* compute the inverse of k */
    if (EC_GROUP_get_mont_data(group) != NULL) {
        /*
         * We want inverse in constant time, therefore we utilize the fact
         * order must be prime and use Fermats Little Theorem instead.
         */
        if (!BN_set_word(X, 2)) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
            goto err;
        }
        if (!BN_mod_sub(X, order, X, order, ctx)) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
            goto err;
        }
        BN_set_flags(X, BN_FLG_CONSTTIME);
        if (!BN_mod_exp_mont_consttime
            (k, k, X, order, ctx, EC_GROUP_get_mont_data(group))) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
            goto err;
        }
    } else {
        if (!BN_mod_inverse(k, k, order, ctx)) {
            ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
            goto err;
        }
    }

    /* clear old values if necessary */
    BN_clear_free(*rp);
    BN_clear_free(*kinvp);
    /* save the pre-computed values  */
    *rp = r;
    *kinvp = k;
    ret = 1;
 err:
    if (!ret) {
        BN_clear_free(k);
        BN_clear_free(r);
    }
    if (ctx != ctx_in)
        BN_CTX_free(ctx);
    EC_POINT_free(tmp_point);
    BN_clear_free(X);
    return (ret);
}

int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp,
                          BIGNUM **rp)
{
    return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0);
}

ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
                               const BIGNUM *in_kinv, const BIGNUM *in_r,
                               EC_KEY *eckey)
{
    int ok = 0, i;
    BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL;
    const BIGNUM *order, *ckinv;
    BN_CTX *ctx = NULL;
    const EC_GROUP *group;
    ECDSA_SIG *ret;
    const BIGNUM *priv_key;

    group = EC_KEY_get0_group(eckey);
    priv_key = EC_KEY_get0_private_key(eckey);

    if (group == NULL || priv_key == NULL) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER);
        return NULL;
    }

    if (!EC_KEY_can_sign(eckey)) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
        return NULL;
    }

    ret = ECDSA_SIG_new();
    if (ret == NULL) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    ret->r = BN_new();
    ret->s = BN_new();
    if (ret->r == NULL || ret->s == NULL) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    s = ret->s;

    if ((ctx = BN_CTX_new()) == NULL ||
        (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
        goto err;
    }

    order = EC_GROUP_get0_order(group);
    if (order == NULL) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_EC_LIB);
        goto err;
    }
    i = BN_num_bits(order);
    /*
     * Need to truncate digest if it is too long: first truncate whole bytes.
     */
    if (8 * dgst_len > i)
        dgst_len = (i + 7) / 8;
    if (!BN_bin2bn(dgst, dgst_len, m)) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /* If still too long truncate remaining bits with a shift */
    if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
        goto err;
    }
    do {
        if (in_kinv == NULL || in_r == NULL) {
            if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) {
                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB);
                goto err;
            }
            ckinv = kinv;
        } else {
            ckinv = in_kinv;
            if (BN_copy(ret->r, in_r) == NULL) {
                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
                goto err;
            }
        }

        if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
            goto err;
        }
        if (!BN_mod_add_quick(s, tmp, m, order)) {
            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
            goto err;
        }
        if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
            goto err;
        }
        if (BN_is_zero(s)) {
            /*
             * if kinv and r have been supplied by the caller don't to
             * generate new kinv and r values
             */
            if (in_kinv != NULL && in_r != NULL) {
                ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES);
                goto err;
            }
        } else
            /* s != 0 => we have a valid signature */
            break;
    }
    while (1);

    ok = 1;
 err:
    if (!ok) {
        ECDSA_SIG_free(ret);
        ret = NULL;
    }
    BN_CTX_free(ctx);
    BN_clear_free(m);
    BN_clear_free(tmp);
    BN_clear_free(kinv);
    return ret;
}

/*-
 * returns
 *      1: correct signature
 *      0: incorrect signature
 *     -1: error
 */
int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len,
                      const unsigned char *sigbuf, int sig_len, EC_KEY *eckey)
{
    ECDSA_SIG *s;
    const unsigned char *p = sigbuf;
    unsigned char *der = NULL;
    int derlen = -1;
    int ret = -1;

    s = ECDSA_SIG_new();
    if (s == NULL)
        return (ret);
    if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL)
        goto err;
    /* Ensure signature uses DER and doesn't have trailing garbage */
    derlen = i2d_ECDSA_SIG(s, &der);
    if (derlen != sig_len || memcmp(sigbuf, der, derlen) != 0)
        goto err;
    ret = ECDSA_do_verify(dgst, dgst_len, s, eckey);
 err:
    OPENSSL_clear_free(der, derlen);
    ECDSA_SIG_free(s);
    return (ret);
}

int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
                          const ECDSA_SIG *sig, EC_KEY *eckey)
{
    int ret = -1, i;
    BN_CTX *ctx;
    const BIGNUM *order;
    BIGNUM *u1, *u2, *m, *X;
    EC_POINT *point = NULL;
    const EC_GROUP *group;
    const EC_POINT *pub_key;

    /* check input values */
    if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL ||
        (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_MISSING_PARAMETERS);
        return -1;
    }

    if (!EC_KEY_can_sign(eckey)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
        return -1;
    }

    ctx = BN_CTX_new();
    if (ctx == NULL) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
        return -1;
    }
    BN_CTX_start(ctx);
    u1 = BN_CTX_get(ctx);
    u2 = BN_CTX_get(ctx);
    m = BN_CTX_get(ctx);
    X = BN_CTX_get(ctx);
    if (X == NULL) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }

    order = EC_GROUP_get0_order(group);
    if (order == NULL) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
        goto err;
    }

    if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||
        BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) ||
        BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE);
        ret = 0;                /* signature is invalid */
        goto err;
    }
    /* calculate tmp1 = inv(S) mod order */
    if (!BN_mod_inverse(u2, sig->s, order, ctx)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /* digest -> m */
    i = BN_num_bits(order);
    /*
     * Need to truncate digest if it is too long: first truncate whole bytes.
     */
    if (8 * dgst_len > i)
        dgst_len = (i + 7) / 8;
    if (!BN_bin2bn(dgst, dgst_len, m)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /* If still too long truncate remaining bits with a shift */
    if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /* u1 = m * tmp mod order */
    if (!BN_mod_mul(u1, m, u2, order, ctx)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /* u2 = r * w mod q */
    if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }

    if ((point = EC_POINT_new(group)) == NULL) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
        goto err;
    }
    if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
        NID_X9_62_prime_field) {
        if (!EC_POINT_get_affine_coordinates_GFp(group, point, X, NULL, ctx)) {
            ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
            goto err;
        }
    }
#ifndef OPENSSL_NO_EC2M
    else {                      /* NID_X9_62_characteristic_two_field */

        if (!EC_POINT_get_affine_coordinates_GF2m(group, point, X, NULL, ctx)) {
            ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
            goto err;
        }
    }
#endif
    if (!BN_nnmod(u1, X, order, ctx)) {
        ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
        goto err;
    }
    /*  if the signature is correct u1 is equal to sig->r */
    ret = (BN_ucmp(u1, sig->r) == 0);
 err:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    EC_POINT_free(point);
    return ret;
}
Commit	Line	Data
c6700d27	1	/*
aa6bb135	2	* Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
4d94ae00	3	*
aa6bb135 RS	4	* Licensed under the OpenSSL license (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
4d94ae00	8	*/
0bee0e62	9
a200a817	10	#include <string.h>
0bee0e62	11	#include <openssl/err.h>
14a7cfb3	12	#include <openssl/obj_mac.h>
0f814687	13	#include <openssl/bn.h>
8a99cb29	14	#include <openssl/rand.h>
6a47db45 DSH	15	#include <openssl/ec.h>
6a47db45 DSH	16	#include "ec_lcl.h"
190c615d	17
a200a817 DSH	18	int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen,
	19	unsigned char sig, unsigned int siglen,
	20	const BIGNUM kinv, const BIGNUM r, EC_KEY *eckey)
	21	{
	22	ECDSA_SIG *s;
	23	RAND_seed(dgst, dlen);
	24	s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey);
	25	if (s == NULL) {
	26	*siglen = 0;
	27	return 0;
	28	}
	29	*siglen = i2d_ECDSA_SIG(s, &sig);
	30	ECDSA_SIG_free(s);
	31	return 1;
	32	}
	33
8d6a75dc	34	static int ecdsa_sign_setup(EC_KEY eckey, BN_CTX ctx_in,
0f113f3e MC	35	BIGNUM kinvp, BIGNUM rp,
0f113f3e MC	36	const unsigned char *dgst, int dlen)
4d94ae00	37	{
0f113f3e	38	BN_CTX *ctx = NULL;
be2e334f DSH	39	BIGNUM k = NULL, r = NULL, *X = NULL;
be2e334f DSH	40	const BIGNUM *order;
0f113f3e MC	41	EC_POINT *tmp_point = NULL;
	42	const EC_GROUP *group;
	43	int ret = 0;
9dd84053	44
0f113f3e	45	if (eckey == NULL \|\| (group = EC_KEY_get0_group(eckey)) == NULL) {
6a47db45	46	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);
0f113f3e MC	47	return 0;
0f113f3e MC	48	}
a74333f9	49
4b0555ec DSH	50	if (!EC_KEY_can_sign(eckey)) {
	51	ECerr(EC_F_ECDSA_SIGN_SETUP, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
	52	return 0;
	53	}
	54
0f113f3e MC	55	if (ctx_in == NULL) {
0f113f3e MC	56	if ((ctx = BN_CTX_new()) == NULL) {
6a47db45	57	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
0f113f3e MC	58	return 0;
	59	}
	60	} else
	61	ctx = ctx_in;
4d94ae00	62
0f113f3e MC	63	k = BN_new(); /* this value is later returned in kinvp /
0f113f3e MC	64	r = BN_new(); /* this value is later returned in rp /
0f113f3e	65	X = BN_new();
be2e334f	66	if (k == NULL \|\| r == NULL \|\| X == NULL) {
6a47db45	67	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE);
0f113f3e MC	68	goto err;
	69	}
	70	if ((tmp_point = EC_POINT_new(group)) == NULL) {
6a47db45	71	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
0f113f3e MC	72	goto err;
0f113f3e MC	73	}
be2e334f DSH	74	order = EC_GROUP_get0_order(group);
be2e334f DSH	75	if (order == NULL) {
6a47db45	76	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
0f113f3e MC	77	goto err;
0f113f3e MC	78	}
cac4fb58	79
0f113f3e MC	80	do {
	81	/* get random k */
	82	do
0f113f3e MC	83	if (dgst != NULL) {
	84	if (!BN_generate_dsa_nonce
	85	(k, order, EC_KEY_get0_private_key(eckey), dgst, dlen,
	86	ctx)) {
6a47db45 DSH	87	ECerr(EC_F_ECDSA_SIGN_SETUP,
6a47db45 DSH	88	EC_R_RANDOM_NUMBER_GENERATION_FAILED);
0f113f3e MC	89	goto err;
0f113f3e MC	90	}
474e469b	91	} else {
0f113f3e	92	if (!BN_rand_range(k, order)) {
6a47db45 DSH	93	ECerr(EC_F_ECDSA_SIGN_SETUP,
6a47db45 DSH	94	EC_R_RANDOM_NUMBER_GENERATION_FAILED);
0f113f3e MC	95	goto err;
	96	}
	97	}
	98	while (BN_is_zero(k));
4d94ae00	99
0f113f3e MC	100	/*
	101	* We do not want timing information to leak the length of k, so we
	102	* compute G*k using an equivalent scalar of fixed bit-length.
	103	*/
992bdde6	104
0f113f3e MC	105	if (!BN_add(k, k, order))
	106	goto err;
	107	if (BN_num_bits(k) <= BN_num_bits(order))
	108	if (!BN_add(k, k, order))
	109	goto err;
992bdde6	110
0f113f3e MC	111	/* compute r the x-coordinate of generator * k */
0f113f3e MC	112	if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
6a47db45	113	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
0f113f3e MC	114	goto err;
	115	}
	116	if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
	117	NID_X9_62_prime_field) {
	118	if (!EC_POINT_get_affine_coordinates_GFp
	119	(group, tmp_point, X, NULL, ctx)) {
6a47db45	120	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
0f113f3e MC	121	goto err;
	122	}
	123	}
b3310161	124	#ifndef OPENSSL_NO_EC2M
0f113f3e MC	125	else { /* NID_X9_62_characteristic_two_field */
	126
	127	if (!EC_POINT_get_affine_coordinates_GF2m(group,
	128	tmp_point, X, NULL,
	129	ctx)) {
6a47db45	130	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB);
0f113f3e MC	131	goto err;
	132	}
	133	}
b3310161	134	#endif
0f113f3e	135	if (!BN_nnmod(r, X, order, ctx)) {
6a47db45	136	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
0f113f3e MC	137	goto err;
	138	}
	139	}
	140	while (BN_is_zero(r));
4d94ae00	141
0f113f3e MC	142	/* compute the inverse of k */
	143	if (EC_GROUP_get_mont_data(group) != NULL) {
	144	/*
	145	* We want inverse in constant time, therefore we utilize the fact
	146	* order must be prime and use Fermats Little Theorem instead.
	147	*/
	148	if (!BN_set_word(X, 2)) {
6a47db45	149	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
0f113f3e MC	150	goto err;
	151	}
	152	if (!BN_mod_sub(X, order, X, order, ctx)) {
6a47db45	153	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
0f113f3e MC	154	goto err;
	155	}
	156	BN_set_flags(X, BN_FLG_CONSTTIME);
	157	if (!BN_mod_exp_mont_consttime
	158	(k, k, X, order, ctx, EC_GROUP_get_mont_data(group))) {
6a47db45	159	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
0f113f3e MC	160	goto err;
	161	}
	162	} else {
	163	if (!BN_mod_inverse(k, k, order, ctx)) {
6a47db45	164	ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB);
0f113f3e MC	165	goto err;
	166	}
	167	}
f54be179	168
0f113f3e	169	/* clear old values if necessary */
23a1d5e9 RS	170	BN_clear_free(*rp);
23a1d5e9 RS	171	BN_clear_free(*kinvp);
0f113f3e MC	172	/* save the pre-computed values */
	173	*rp = r;
	174	*kinvp = k;
	175	ret = 1;
	176	err:
	177	if (!ret) {
23a1d5e9 RS	178	BN_clear_free(k);
23a1d5e9 RS	179	BN_clear_free(r);
0f113f3e	180	}
23a1d5e9	181	if (ctx != ctx_in)
0f113f3e	182	BN_CTX_free(ctx);
8fdc3734	183	EC_POINT_free(tmp_point);
23a1d5e9	184	BN_clear_free(X);
0f113f3e	185	return (ret);
4d94ae00 BM	186	}
4d94ae00 BM	187
6a47db45 DSH	188	int ossl_ecdsa_sign_setup(EC_KEY eckey, BN_CTX ctx_in, BIGNUM **kinvp,
	189	BIGNUM **rp)
	190	{
	191	return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0);
	192	}
	193
	194	ECDSA_SIG ossl_ecdsa_sign_sig(const unsigned char dgst, int dgst_len,
	195	const BIGNUM in_kinv, const BIGNUM in_r,
	196	EC_KEY *eckey)
4d94ae00	197	{
0f113f3e	198	int ok = 0, i;
be2e334f DSH	199	BIGNUM kinv = NULL, s, m = NULL, tmp = NULL;
be2e334f DSH	200	const BIGNUM order, ckinv;
0f113f3e MC	201	BN_CTX *ctx = NULL;
	202	const EC_GROUP *group;
	203	ECDSA_SIG *ret;
0f113f3e MC	204	const BIGNUM *priv_key;
0f113f3e MC	205
0f113f3e MC	206	group = EC_KEY_get0_group(eckey);
0f113f3e MC	207	priv_key = EC_KEY_get0_private_key(eckey);
14a7cfb3	208
6a47db45 DSH	209	if (group == NULL \|\| priv_key == NULL) {
6a47db45 DSH	210	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER);
0f113f3e MC	211	return NULL;
0f113f3e MC	212	}
4d94ae00	213
4b0555ec DSH	214	if (!EC_KEY_can_sign(eckey)) {
	215	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
	216	return NULL;
	217	}
	218
0f113f3e	219	ret = ECDSA_SIG_new();
90945fa3	220	if (ret == NULL) {
6a47db45	221	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
0f113f3e MC	222	return NULL;
0f113f3e MC	223	}
8cc44d97 DSH	224	ret->r = BN_new();
	225	ret->s = BN_new();
	226	if (ret->r == NULL \|\| ret->s == NULL) {
	227	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
	228	goto err;
	229	}
0f113f3e	230	s = ret->s;
c6700d27	231
be2e334f	232	if ((ctx = BN_CTX_new()) == NULL \|\|
0f113f3e	233	(tmp = BN_new()) == NULL \|\| (m = BN_new()) == NULL) {
6a47db45	234	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
0f113f3e MC	235	goto err;
0f113f3e MC	236	}
4d94ae00	237
be2e334f DSH	238	order = EC_GROUP_get0_order(group);
be2e334f DSH	239	if (order == NULL) {
6a47db45	240	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_EC_LIB);
0f113f3e MC	241	goto err;
	242	}
	243	i = BN_num_bits(order);
	244	/*
	245	* Need to truncate digest if it is too long: first truncate whole bytes.
	246	*/
	247	if (8 * dgst_len > i)
	248	dgst_len = (i + 7) / 8;
	249	if (!BN_bin2bn(dgst, dgst_len, m)) {
6a47db45	250	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
0f113f3e MC	251	goto err;
	252	}
	253	/* If still too long truncate remaining bits with a shift */
	254	if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
6a47db45	255	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
0f113f3e MC	256	goto err;
	257	}
	258	do {
	259	if (in_kinv == NULL \|\| in_r == NULL) {
	260	if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) {
6a47db45	261	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB);
0f113f3e MC	262	goto err;
	263	}
	264	ckinv = kinv;
	265	} else {
	266	ckinv = in_kinv;
	267	if (BN_copy(ret->r, in_r) == NULL) {
6a47db45	268	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
0f113f3e MC	269	goto err;
	270	}
	271	}
4d94ae00	272
0f113f3e	273	if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
6a47db45	274	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
0f113f3e MC	275	goto err;
	276	}
	277	if (!BN_mod_add_quick(s, tmp, m, order)) {
6a47db45	278	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
0f113f3e MC	279	goto err;
	280	}
	281	if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
6a47db45	282	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
0f113f3e MC	283	goto err;
	284	}
	285	if (BN_is_zero(s)) {
	286	/*
	287	* if kinv and r have been supplied by the caller don't to
	288	* generate new kinv and r values
	289	*/
	290	if (in_kinv != NULL && in_r != NULL) {
6a47db45	291	ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES);
0f113f3e MC	292	goto err;
	293	}
	294	} else
	295	/* s != 0 => we have a valid signature */
	296	break;
	297	}
	298	while (1);
4d94ae00	299
0f113f3e MC	300	ok = 1;
	301	err:
	302	if (!ok) {
	303	ECDSA_SIG_free(ret);
	304	ret = NULL;
	305	}
23a1d5e9 RS	306	BN_CTX_free(ctx);
	307	BN_clear_free(m);
	308	BN_clear_free(tmp);
23a1d5e9	309	BN_clear_free(kinv);
0f113f3e	310	return ret;
4d94ae00 BM	311	}
4d94ae00 BM	312
a200a817 DSH	313	/*-
	314	* returns
	315	* 1: correct signature
	316	* 0: incorrect signature
	317	* -1: error
	318	*/
	319	int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len,
	320	const unsigned char sigbuf, int sig_len, EC_KEY eckey)
	321	{
	322	ECDSA_SIG *s;
	323	const unsigned char *p = sigbuf;
	324	unsigned char *der = NULL;
	325	int derlen = -1;
	326	int ret = -1;
	327
	328	s = ECDSA_SIG_new();
	329	if (s == NULL)
	330	return (ret);
	331	if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL)
	332	goto err;
	333	/* Ensure signature uses DER and doesn't have trailing garbage */
	334	derlen = i2d_ECDSA_SIG(s, &der);
91e7bcc2	335	if (derlen != sig_len \|\| memcmp(sigbuf, der, derlen) != 0)
a200a817 DSH	336	goto err;
	337	ret = ECDSA_do_verify(dgst, dgst_len, s, eckey);
	338	err:
	339	OPENSSL_clear_free(der, derlen);
	340	ECDSA_SIG_free(s);
	341	return (ret);
	342	}
	343
6a47db45 DSH	344	int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
6a47db45 DSH	345	const ECDSA_SIG sig, EC_KEY eckey)
4d94ae00	346	{
0f113f3e MC	347	int ret = -1, i;
0f113f3e MC	348	BN_CTX *ctx;
be2e334f DSH	349	const BIGNUM *order;
be2e334f DSH	350	BIGNUM u1, u2, m, X;
0f113f3e MC	351	EC_POINT *point = NULL;
	352	const EC_GROUP *group;
	353	const EC_POINT *pub_key;
9dd84053	354
0f113f3e MC	355	/* check input values */
	356	if (eckey == NULL \|\| (group = EC_KEY_get0_group(eckey)) == NULL \|\|
	357	(pub_key = EC_KEY_get0_public_key(eckey)) == NULL \|\| sig == NULL) {
6a47db45	358	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_MISSING_PARAMETERS);
0f113f3e MC	359	return -1;
0f113f3e MC	360	}
4d94ae00	361
4b0555ec DSH	362	if (!EC_KEY_can_sign(eckey)) {
	363	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
	364	return -1;
	365	}
	366
0f113f3e	367	ctx = BN_CTX_new();
90945fa3	368	if (ctx == NULL) {
6a47db45	369	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
0f113f3e MC	370	return -1;
	371	}
	372	BN_CTX_start(ctx);
0f113f3e MC	373	u1 = BN_CTX_get(ctx);
	374	u2 = BN_CTX_get(ctx);
	375	m = BN_CTX_get(ctx);
	376	X = BN_CTX_get(ctx);
91e7bcc2	377	if (X == NULL) {
6a47db45	378	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	379	goto err;
0f113f3e MC	380	}
c6700d27	381
be2e334f DSH	382	order = EC_GROUP_get0_order(group);
be2e334f DSH	383	if (order == NULL) {
6a47db45	384	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
0f113f3e MC	385	goto err;
0f113f3e MC	386	}
4d94ae00	387
0f113f3e MC	388	if (BN_is_zero(sig->r) \|\| BN_is_negative(sig->r) \|\|
	389	BN_ucmp(sig->r, order) >= 0 \|\| BN_is_zero(sig->s) \|\|
	390	BN_is_negative(sig->s) \|\| BN_ucmp(sig->s, order) >= 0) {
6a47db45	391	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE);
0f113f3e MC	392	ret = 0; /* signature is invalid */
	393	goto err;
	394	}
	395	/* calculate tmp1 = inv(S) mod order */
	396	if (!BN_mod_inverse(u2, sig->s, order, ctx)) {
6a47db45	397	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	398	goto err;
	399	}
	400	/* digest -> m */
	401	i = BN_num_bits(order);
	402	/*
	403	* Need to truncate digest if it is too long: first truncate whole bytes.
	404	*/
	405	if (8 * dgst_len > i)
	406	dgst_len = (i + 7) / 8;
	407	if (!BN_bin2bn(dgst, dgst_len, m)) {
6a47db45	408	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	409	goto err;
	410	}
	411	/* If still too long truncate remaining bits with a shift */
	412	if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
6a47db45	413	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	414	goto err;
	415	}
	416	/* u1 = m * tmp mod order */
	417	if (!BN_mod_mul(u1, m, u2, order, ctx)) {
6a47db45	418	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	419	goto err;
	420	}
	421	/* u2 = r * w mod q */
	422	if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
6a47db45	423	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	424	goto err;
	425	}
	426
	427	if ((point = EC_POINT_new(group)) == NULL) {
6a47db45	428	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
0f113f3e MC	429	goto err;
	430	}
	431	if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
6a47db45	432	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
0f113f3e MC	433	goto err;
	434	}
	435	if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==
	436	NID_X9_62_prime_field) {
	437	if (!EC_POINT_get_affine_coordinates_GFp(group, point, X, NULL, ctx)) {
6a47db45	438	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
0f113f3e MC	439	goto err;
	440	}
	441	}
b3310161	442	#ifndef OPENSSL_NO_EC2M
0f113f3e MC	443	else { /* NID_X9_62_characteristic_two_field */
	444
	445	if (!EC_POINT_get_affine_coordinates_GF2m(group, point, X, NULL, ctx)) {
6a47db45	446	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
0f113f3e MC	447	goto err;
	448	}
	449	}
	450	#endif
	451	if (!BN_nnmod(u1, X, order, ctx)) {
6a47db45	452	ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
0f113f3e MC	453	goto err;
	454	}
	455	/* if the signature is correct u1 is equal to sig->r */
	456	ret = (BN_ucmp(u1, sig->r) == 0);
	457	err:
	458	BN_CTX_end(ctx);
	459	BN_CTX_free(ctx);
8fdc3734	460	EC_POINT_free(point);
0f113f3e	461	return ret;
4d94ae00	462	}