[thirdparty/openssl.git] / crypto / ecdsa / ecdsatest.c

/* crypto/ecdsa/ecdsatest.c */
/*
 * Written by Nils Larsch for the OpenSSL project.
 */
/* ====================================================================
 * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * Portions of the attached software ("Contribution") are developed by 
 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 *
 * The Contribution is licensed pursuant to the OpenSSL open source
 * license provided above.
 *
 * The elliptic curve binary polynomial software is originally written by 
 * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_ECDSA is defined */

#ifdef OPENSSL_NO_ECDSA
int main(int argc, char * argv[])
	{
	puts("Elliptic curves are disabled.");
	return 0;
	}
#else

#include <openssl/crypto.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/bn.h>
#include <openssl/ecdsa.h>
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
#include <openssl/err.h>
#include <openssl/rand.h>

static const char rnd_seed[] = "string to make the random number generator "
	"think it has entropy";

/* declaration of the test functions */
int x9_62_tests(BIO *);
int x9_62_test_internal(BIO *out, int nid, const char *r, const char *s);
int test_builtin(BIO *);

/* functions to change the RAND_METHOD */
int change_rand(void);
int restore_rand(void);
int fbytes(unsigned char *buf, int num);

RAND_METHOD	fake_rand;
const RAND_METHOD *old_rand;

int change_rand(void)
	{
	/* save old rand method */
	if ((old_rand = RAND_get_rand_method()) == NULL)
		return 0;

	fake_rand.seed    = old_rand->seed;
	fake_rand.cleanup = old_rand->cleanup;
	fake_rand.add     = old_rand->add;
	fake_rand.status  = old_rand->status;
	/* use own random function */
	fake_rand.bytes      = fbytes;
	fake_rand.pseudorand = old_rand->bytes;
	/* set new RAND_METHOD */
	if (!RAND_set_rand_method(&fake_rand))
		return 0;
	return 1;
	}

int restore_rand(void)
	{
	if (!RAND_set_rand_method(old_rand))
		return 0;
	else
		return 1;
	}

static int fbytes_counter = 0, use_fake = 0;
static const char *numbers[8] = {
	"651056770906015076056810763456358567190100156695615665659",
	"6140507067065001063065065565667405560006161556565665656654",
	"8763001015071075675010661307616710783570106710677817767166"
	"71676178726717",
	"7000000175690566466555057817571571075705015757757057795755"
	"55657156756655",
	"1275552191113212300012030439187146164646146646466749494799",
	"1542725565216523985789236956265265265235675811949404040041",
	"1456427555219115346513212300075341203043918714616464614664"
	"64667494947990",
	"1712787255652165239672857892369562652652652356758119494040"
	"40041670216363"};

int fbytes(unsigned char *buf, int num)
	{
	int	ret;
	BIGNUM	*tmp = NULL;

	if (use_fake == 0)
		return old_rand->bytes(buf, num);

	use_fake = 0;

	if (fbytes_counter >= 8)
		return 0;
	tmp = BN_new();
	if (!tmp)
		return 0;
	if (!BN_dec2bn(&tmp, numbers[fbytes_counter]))
		{
		BN_free(tmp);
		return 0;
		}
	fbytes_counter ++;
	if (num != BN_num_bytes(tmp) || !BN_bn2bin(tmp, buf))
		ret = 0;
	else 
		ret = 1;
	if (tmp)
		BN_free(tmp);
	return ret;
	}

/* some tests from the X9.62 draft */
int x9_62_test_internal(BIO *out, int nid, const char *r_in, const char *s_in)
	{
	int	ret = 0;
	const char message[] = "abc";
	unsigned char digest[20];
	unsigned int  dgst_len = 0;
	EVP_MD_CTX md_ctx;
	EC_KEY    *key = NULL;
	ECDSA_SIG *signature = NULL;
	BIGNUM    *r = NULL, *s = NULL;

	EVP_MD_CTX_init(&md_ctx);
	/* get the message digest */
	if (!EVP_DigestInit(&md_ctx, EVP_ecdsa())
	    || !EVP_DigestUpdate(&md_ctx, (const void*)message, 3)
	    || !EVP_DigestFinal(&md_ctx, digest, &dgst_len))
		goto x962_int_err;

	BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
	/* create the key */
	if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
		goto x962_int_err;
	use_fake = 1;
	if (!EC_KEY_generate_key(key))
		goto x962_int_err;
	BIO_printf(out, ".");
	(void)BIO_flush(out);
	/* create the signature */
	use_fake = 1;
	signature = ECDSA_do_sign(digest, 20, key);
	if (signature == NULL)
		goto x962_int_err;
	BIO_printf(out, ".");
	(void)BIO_flush(out);
	/* compare the created signature with the expected signature */
	if ((r = BN_new()) == NULL || (s = BN_new()) == NULL)
		goto x962_int_err;
	if (!BN_dec2bn(&r, r_in) ||
	    !BN_dec2bn(&s, s_in))
		goto x962_int_err;
	if (BN_cmp(signature->r ,r) || BN_cmp(signature->s, s))
		goto x962_int_err;
	BIO_printf(out, ".");
	(void)BIO_flush(out);
	/* verify the signature */
	if (ECDSA_do_verify(digest, 20, signature, key) != 1)
		goto x962_int_err;
	BIO_printf(out, ".");
	(void)BIO_flush(out);

	BIO_printf(out, " ok\n");
	ret = 1;
x962_int_err:
	if (!ret)
		BIO_printf(out, " failed\n");
	if (key)
		EC_KEY_free(key);
	if (signature)
		ECDSA_SIG_free(signature);
	if (r)
		BN_free(r);
	if (s)
		BN_free(s);
	EVP_MD_CTX_cleanup(&md_ctx);
	return ret;
	}

int x9_62_tests(BIO *out)
	{
	int ret = 0;

	BIO_printf(out, "some tests from X9.62:\n");

	/* set own rand method */
	if (!change_rand())
		goto x962_err;

	if (!x9_62_test_internal(out, NID_X9_62_prime192v1,
		"3342403536405981729393488334694600415596881826869351677613",
		"5735822328888155254683894997897571951568553642892029982342"))
		goto x962_err;
	if (!x9_62_test_internal(out, NID_X9_62_prime239v1,
		"3086361431751678114926225473006680188549593787585317781474"
		"62058306432176",
		"3238135532097973577080787768312505059318910517550078427819"
		"78505179448783"))
		goto x962_err;
#ifndef OPENSSL_NO_EC2M
	if (!x9_62_test_internal(out, NID_X9_62_c2tnb191v1,
		"87194383164871543355722284926904419997237591535066528048",
		"308992691965804947361541664549085895292153777025772063598"))
		goto x962_err;
	if (!x9_62_test_internal(out, NID_X9_62_c2tnb239v1,
		"2159633321041961198501834003903461262881815148684178964245"
		"5876922391552",
		"1970303740007316867383349976549972270528498040721988191026"
		"49413465737174"))
		goto x962_err;
#endif
	ret = 1;
x962_err:
	if (!restore_rand())
		ret = 0;
	return ret;
	}

int test_builtin(BIO *out)
	{
	EC_builtin_curve *curves = NULL;
	size_t		crv_len = 0, n = 0;
	EC_KEY		*eckey = NULL, *wrong_eckey = NULL;
	EC_GROUP	*group;
	ECDSA_SIG	*ecdsa_sig = NULL;
	unsigned char	digest[20], wrong_digest[20];
	unsigned char	*signature = NULL;
	unsigned char	*sig_ptr;
	const unsigned char *csig_ptr;
	unsigned char	*raw_buf = NULL;
	unsigned int	sig_len, degree, r_len, s_len, bn_len, buf_len;
	int		nid, ret =  0;
	
	/* fill digest values with some random data */
	if (!RAND_pseudo_bytes(digest, 20) ||
	    !RAND_pseudo_bytes(wrong_digest, 20))
		{
		BIO_printf(out, "ERROR: unable to get random data\n");
		goto builtin_err;
		}

	/* create and verify a ecdsa signature with every availble curve
	 * (with ) */
	BIO_printf(out, "\ntesting ECDSA_sign() and ECDSA_verify() "
		"with some internal curves:\n");

	/* get a list of all internal curves */
	crv_len = EC_get_builtin_curves(NULL, 0);

	curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);

	if (curves == NULL)
		{
		BIO_printf(out, "malloc error\n");
		goto builtin_err;
		}
	
	if (!EC_get_builtin_curves(curves, crv_len))
		{
		BIO_printf(out, "unable to get internal curves\n");
		goto builtin_err;
		}

	/* now create and verify a signature for every curve */
	for (n = 0; n < crv_len; n++)
		{
		unsigned char dirt, offset;

		nid = curves[n].nid;
		if (nid == NID_ipsec4)
			continue;
		/* create new ecdsa key (== EC_KEY) */
		if ((eckey = EC_KEY_new()) == NULL)
			goto builtin_err;
		group = EC_GROUP_new_by_curve_name(nid);
		if (group == NULL)
			goto builtin_err;
		if (EC_KEY_set_group(eckey, group) == 0)
			goto builtin_err;
		EC_GROUP_free(group);
		degree = EC_GROUP_get_degree(EC_KEY_get0_group(eckey));
		if (degree < 160)
			/* drop the curve */ 
			{
			EC_KEY_free(eckey);
			eckey = NULL;
			continue;
			}
		BIO_printf(out, "%s: ", OBJ_nid2sn(nid));
		/* create key */
		if (!EC_KEY_generate_key(eckey))
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		/* create second key */
		if ((wrong_eckey = EC_KEY_new()) == NULL)
			goto builtin_err;
		group = EC_GROUP_new_by_curve_name(nid);
		if (group == NULL)
			goto builtin_err;
		if (EC_KEY_set_group(wrong_eckey, group) == 0)
			goto builtin_err;
		EC_GROUP_free(group);
		if (!EC_KEY_generate_key(wrong_eckey))
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}

		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* check key */
		if (!EC_KEY_check_key(eckey))
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* create signature */
		sig_len = ECDSA_size(eckey);
		if ((signature = OPENSSL_malloc(sig_len)) == NULL)
			goto builtin_err;
                if (!ECDSA_sign(0, digest, 20, signature, &sig_len, eckey))
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* verify signature */
		if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* verify signature with the wrong key */
		if (ECDSA_verify(0, digest, 20, signature, sig_len, 
			wrong_eckey) == 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* wrong digest */
		if (ECDSA_verify(0, wrong_digest, 20, signature, sig_len,
			eckey) == 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		/* wrong length */
		if (ECDSA_verify(0, digest, 20, signature, sig_len - 1,
			eckey) == 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);

		/* Modify a single byte of the signature: to ensure we don't
		 * garble the ASN1 structure, we read the raw signature and
		 * modify a byte in one of the bignums directly. */
		csig_ptr = signature;
		if ((ecdsa_sig = d2i_ECDSA_SIG(NULL, &csig_ptr, sig_len)) == NULL)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}

		/* Store the two BIGNUMs in raw_buf. */
		r_len = BN_num_bytes(ecdsa_sig->r);
		s_len = BN_num_bytes(ecdsa_sig->s);
		bn_len = (degree + 7) / 8;
		if ((r_len > bn_len) || (s_len > bn_len))
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		buf_len = 2 * bn_len;
		if ((raw_buf = OPENSSL_malloc(buf_len)) == NULL)
			goto builtin_err;
		/* Pad the bignums with leading zeroes. */
		memset(raw_buf, 0, buf_len);
		BN_bn2bin(ecdsa_sig->r, raw_buf + bn_len - r_len);
		BN_bn2bin(ecdsa_sig->s, raw_buf + buf_len - s_len);

		/* Modify a single byte in the buffer. */
		offset = raw_buf[10] % buf_len;
		dirt   = raw_buf[11] ? raw_buf[11] : 1;
		raw_buf[offset] ^= dirt;
		/* Now read the BIGNUMs back in from raw_buf. */
		if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
			(BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
			goto builtin_err;

		sig_ptr = signature;
		sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
		if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) == 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		/* Sanity check: undo the modification and verify signature. */
		raw_buf[offset] ^= dirt;
		if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) ||
			(BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
			goto builtin_err;

		sig_ptr = signature;
		sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
		if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
			{
			BIO_printf(out, " failed\n");
			goto builtin_err;
			}
		BIO_printf(out, ".");
		(void)BIO_flush(out);
		
		BIO_printf(out, " ok\n");
		/* cleanup */
		/* clean bogus errors */
		ERR_clear_error();
		OPENSSL_free(signature);
		signature = NULL;
		EC_KEY_free(eckey);
		eckey = NULL;
		EC_KEY_free(wrong_eckey);
		wrong_eckey = NULL;
		ECDSA_SIG_free(ecdsa_sig);
		ecdsa_sig = NULL;
		OPENSSL_free(raw_buf);
		raw_buf = NULL;
		}

	ret = 1;	
builtin_err:
	if (eckey)
		EC_KEY_free(eckey);
	if (wrong_eckey)
		EC_KEY_free(wrong_eckey);
	if (ecdsa_sig)
		ECDSA_SIG_free(ecdsa_sig);
	if (signature)
		OPENSSL_free(signature);
	if (raw_buf)
		OPENSSL_free(raw_buf);
	if (curves)
		OPENSSL_free(curves);

	return ret;
	}

int main(void)
	{
	int 	ret = 1;
	BIO	*out;

	out = BIO_new_fp(stdout, BIO_NOCLOSE);
	
	/* enable memory leak checking unless explicitly disabled */
	if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && 
		(0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
		{
		CRYPTO_malloc_debug_init();
		CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
		}
	else
		{
		/* OPENSSL_DEBUG_MEMORY=off */
		CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
		}
	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);

	ERR_load_crypto_strings();

	/* initialize the prng */
	RAND_seed(rnd_seed, sizeof(rnd_seed));

	/* the tests */
	if (!x9_62_tests(out))  goto err;
	if (!test_builtin(out)) goto err;
	
	ret = 0;
err:	
	if (ret) 	
		BIO_printf(out, "\nECDSA test failed\n");
	else 
		BIO_printf(out, "\nECDSA test passed\n");
	if (ret)
		ERR_print_errors(out);
	CRYPTO_cleanup_all_ex_data();
	ERR_remove_thread_state(NULL);
	ERR_free_strings();
	CRYPTO_mem_leaks(out);
	if (out != NULL)
		BIO_free(out);
	return ret;
	}	
#endif
Commit	Line	Data
4d94ae00	1	/* crypto/ecdsa/ecdsatest.c */
2b32b281 BM	2	/*
	3	* Written by Nils Larsch for the OpenSSL project.
	4	*/
4d94ae00	5	/* ====================================================================
9dd84053	6	* Copyright (c) 2000-2005 The OpenSSL Project. All rights reserved.
4d94ae00 BM	7	*
	8	* Redistribution and use in source and binary forms, with or without
	9	* modification, are permitted provided that the following conditions
	10	* are met:
	11	*
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	*
	15	* 2. Redistributions in binary form must reproduce the above copyright
	16	* notice, this list of conditions and the following disclaimer in
	17	* the documentation and/or other materials provided with the
	18	* distribution.
	19	*
	20	* 3. All advertising materials mentioning features or use of this
	21	* software must display the following acknowledgment:
	22	* "This product includes software developed by the OpenSSL Project
	23	* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
	24	*
	25	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	26	* endorse or promote products derived from this software without
	27	* prior written permission. For written permission, please contact
	28	* licensing@OpenSSL.org.
	29	*
	30	* 5. Products derived from this software may not be called "OpenSSL"
	31	* nor may "OpenSSL" appear in their names without prior written
	32	* permission of the OpenSSL Project.
	33	*
	34	* 6. Redistributions of any form whatsoever must retain the following
	35	* acknowledgment:
	36	* "This product includes software developed by the OpenSSL Project
	37	* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
	38	*
	39	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	40	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	41	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	42	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	43	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	44	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	45	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	46	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	47	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	48	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	49	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	50	* OF THE POSSIBILITY OF SUCH DAMAGE.
	51	* ====================================================================
	52	*
	53	* This product includes cryptographic software written by Eric Young
	54	* (eay@cryptsoft.com). This product includes software written by Tim
	55	* Hudson (tjh@cryptsoft.com).
	56	*
	57	*/
e172d60d BM	58	/* ====================================================================
	59	* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
	60	*
	61	* Portions of the attached software ("Contribution") are developed by
	62	* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
	63	*
	64	* The Contribution is licensed pursuant to the OpenSSL open source
	65	* license provided above.
	66	*
e172d60d BM	67	* The elliptic curve binary polynomial software is originally written by
	68	* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
	69	*
	70	*/
	71
4d94ae00 BM	72	#include <stdio.h>
	73	#include <stdlib.h>
	74	#include <string.h>
4d94ae00	75
3b6aa36c RL	76	#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_ECDSA is defined */
3b6aa36c RL	77
4d94ae00	78	#ifdef OPENSSL_NO_ECDSA
2b32b281 BM	79	int main(int argc, char * argv[])
	80	{
	81	puts("Elliptic curves are disabled.");
	82	return 0;
	83	}
4d94ae00 BM	84	#else
4d94ae00 BM	85
690ecff7 BM	86	#include <openssl/crypto.h>
	87	#include <openssl/bio.h>
	88	#include <openssl/evp.h>
3eeaab4b	89	#include <openssl/bn.h>
690ecff7	90	#include <openssl/ecdsa.h>
97b70891	91	#ifndef OPENSSL_NO_ENGINE
690ecff7	92	#include <openssl/engine.h>
97b70891	93	#endif
690ecff7	94	#include <openssl/err.h>
3a87a9b9	95	#include <openssl/rand.h>
690ecff7	96
2b32b281 BM	97	static const char rnd_seed[] = "string to make the random number generator "
	98	"think it has entropy";
	99
	100	/* declaration of the test functions */
	101	int x9_62_tests(BIO *);
	102	int x9_62_test_internal(BIO out, int nid, const char r, const char *s);
	103	int test_builtin(BIO *);
	104
	105	/* functions to change the RAND_METHOD */
	106	int change_rand(void);
	107	int restore_rand(void);
6343829a	108	int fbytes(unsigned char *buf, int num);
2b32b281 BM	109
	110	RAND_METHOD fake_rand;
	111	const RAND_METHOD *old_rand;
	112
	113	int change_rand(void)
4d94ae00	114	{
2b32b281 BM	115	/* save old rand method */
	116	if ((old_rand = RAND_get_rand_method()) == NULL)
	117	return 0;
	118
	119	fake_rand.seed = old_rand->seed;
	120	fake_rand.cleanup = old_rand->cleanup;
	121	fake_rand.add = old_rand->add;
	122	fake_rand.status = old_rand->status;
	123	/* use own random function */
	124	fake_rand.bytes = fbytes;
31182ad3	125	fake_rand.pseudorand = old_rand->bytes;
2b32b281 BM	126	/* set new RAND_METHOD */
	127	if (!RAND_set_rand_method(&fake_rand))
	128	return 0;
	129	return 1;
4d94ae00	130	}
2b32b281 BM	131
2b32b281 BM	132	int restore_rand(void)
4d94ae00	133	{
2b32b281 BM	134	if (!RAND_set_rand_method(old_rand))
	135	return 0;
	136	else
	137	return 1;
4d94ae00	138	}
4d94ae00	139
d80399a3	140	static int fbytes_counter = 0, use_fake = 0;
2b32b281 BM	141	static const char *numbers[8] = {
	142	"651056770906015076056810763456358567190100156695615665659",
	143	"6140507067065001063065065565667405560006161556565665656654",
	144	"8763001015071075675010661307616710783570106710677817767166"
	145	"71676178726717",
	146	"7000000175690566466555057817571571075705015757757057795755"
	147	"55657156756655",
	148	"1275552191113212300012030439187146164646146646466749494799",
	149	"1542725565216523985789236956265265265235675811949404040041",
	150	"1456427555219115346513212300075341203043918714616464614664"
	151	"64667494947990",
	152	"1712787255652165239672857892369562652652652356758119494040"
	153	"40041670216363"};
	154
6343829a	155	int fbytes(unsigned char *buf, int num)
2b32b281 BM	156	{
	157	int ret;
	158	BIGNUM *tmp = NULL;
4d94ae00	159
d80399a3 DSH	160	if (use_fake == 0)
	161	return old_rand->bytes(buf, num);
	162
	163	use_fake = 0;
	164
2b32b281	165	if (fbytes_counter >= 8)
4d94ae00	166	return 0;
2b32b281 BM	167	tmp = BN_new();
	168	if (!tmp)
	169	return 0;
	170	if (!BN_dec2bn(&tmp, numbers[fbytes_counter]))
	171	{
	172	BN_free(tmp);
	173	return 0;
	174	}
	175	fbytes_counter ++;
acd410dc	176	if (num != BN_num_bytes(tmp) \|\| !BN_bn2bin(tmp, buf))
2b32b281	177	ret = 0;
acd410dc	178	else
2b32b281 BM	179	ret = 1;
	180	if (tmp)
	181	BN_free(tmp);
	182	return ret;
4d94ae00	183	}
2b32b281 BM	184
	185	/* some tests from the X9.62 draft */
	186	int x9_62_test_internal(BIO out, int nid, const char r_in, const char *s_in)
4d94ae00	187	{
2b32b281 BM	188	int ret = 0;
	189	const char message[] = "abc";
	190	unsigned char digest[20];
	191	unsigned int dgst_len = 0;
	192	EVP_MD_CTX md_ctx;
	193	EC_KEY *key = NULL;
	194	ECDSA_SIG *signature = NULL;
	195	BIGNUM r = NULL, s = NULL;
	196
	197	EVP_MD_CTX_init(&md_ctx);
	198	/* get the message digest */
ae551760 BL	199	if (!EVP_DigestInit(&md_ctx, EVP_ecdsa())
	200	\|\| !EVP_DigestUpdate(&md_ctx, (const void*)message, 3)
	201	\|\| !EVP_DigestFinal(&md_ctx, digest, &dgst_len))
	202	goto x962_int_err;
2b32b281 BM	203
	204	BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
	205	/* create the key */
9dd84053	206	if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
2b32b281	207	goto x962_int_err;
d80399a3	208	use_fake = 1;
2b32b281 BM	209	if (!EC_KEY_generate_key(key))
	210	goto x962_int_err;
	211	BIO_printf(out, ".");
710069c1	212	(void)BIO_flush(out);
2b32b281	213	/* create the signature */
d80399a3	214	use_fake = 1;
2b32b281 BM	215	signature = ECDSA_do_sign(digest, 20, key);
	216	if (signature == NULL)
	217	goto x962_int_err;
	218	BIO_printf(out, ".");
710069c1	219	(void)BIO_flush(out);
2b32b281 BM	220	/* compare the created signature with the expected signature */
	221	if ((r = BN_new()) == NULL \|\| (s = BN_new()) == NULL)
	222	goto x962_int_err;
	223	if (!BN_dec2bn(&r, r_in) \|\|
	224	!BN_dec2bn(&s, s_in))
	225	goto x962_int_err;
	226	if (BN_cmp(signature->r ,r) \|\| BN_cmp(signature->s, s))
	227	goto x962_int_err;
	228	BIO_printf(out, ".");
710069c1	229	(void)BIO_flush(out);
2b32b281 BM	230	/* verify the signature */
	231	if (ECDSA_do_verify(digest, 20, signature, key) != 1)
	232	goto x962_int_err;
	233	BIO_printf(out, ".");
710069c1	234	(void)BIO_flush(out);
2b32b281 BM	235
	236	BIO_printf(out, " ok\n");
	237	ret = 1;
	238	x962_int_err:
	239	if (!ret)
	240	BIO_printf(out, " failed\n");
	241	if (key)
	242	EC_KEY_free(key);
	243	if (signature)
	244	ECDSA_SIG_free(signature);
	245	if (r)
	246	BN_free(r);
	247	if (s)
	248	BN_free(s);
	249	EVP_MD_CTX_cleanup(&md_ctx);
	250	return ret;
4d94ae00 BM	251	}
4d94ae00 BM	252
2b32b281	253	int x9_62_tests(BIO *out)
4d94ae00	254	{
2b32b281 BM	255	int ret = 0;
	256
	257	BIO_printf(out, "some tests from X9.62:\n");
	258
	259	/* set own rand method */
	260	if (!change_rand())
	261	goto x962_err;
	262
	263	if (!x9_62_test_internal(out, NID_X9_62_prime192v1,
	264	"3342403536405981729393488334694600415596881826869351677613",
	265	"5735822328888155254683894997897571951568553642892029982342"))
	266	goto x962_err;
	267	if (!x9_62_test_internal(out, NID_X9_62_prime239v1,
	268	"3086361431751678114926225473006680188549593787585317781474"
	269	"62058306432176",
	270	"3238135532097973577080787768312505059318910517550078427819"
	271	"78505179448783"))
	272	goto x962_err;
b3310161	273	#ifndef OPENSSL_NO_EC2M
2b32b281 BM	274	if (!x9_62_test_internal(out, NID_X9_62_c2tnb191v1,
	275	"87194383164871543355722284926904419997237591535066528048",
	276	"308992691965804947361541664549085895292153777025772063598"))
	277	goto x962_err;
	278	if (!x9_62_test_internal(out, NID_X9_62_c2tnb239v1,
	279	"2159633321041961198501834003903461262881815148684178964245"
	280	"5876922391552",
	281	"1970303740007316867383349976549972270528498040721988191026"
	282	"49413465737174"))
	283	goto x962_err;
b3310161	284	#endif
2b32b281 BM	285	ret = 1;
	286	x962_err:
	287	if (!restore_rand())
	288	ret = 0;
4d94ae00	289	return ret;
2b32b281 BM	290	}
	291
	292	int test_builtin(BIO *out)
	293	{
	294	EC_builtin_curve *curves = NULL;
	295	size_t crv_len = 0, n = 0;
	296	EC_KEY eckey = NULL, wrong_eckey = NULL;
9dd84053	297	EC_GROUP *group;
ea8c77a5	298	ECDSA_SIG *ecdsa_sig = NULL;
2b32b281	299	unsigned char digest[20], wrong_digest[20];
ea8c77a5 BM	300	unsigned char *signature = NULL;
ea8c77a5 BM	301	unsigned char *sig_ptr;
afb14cda	302	const unsigned char *csig_ptr;
ea8c77a5 BM	303	unsigned char *raw_buf = NULL;
ea8c77a5 BM	304	unsigned int sig_len, degree, r_len, s_len, bn_len, buf_len;
2b32b281 BM	305	int nid, ret = 0;
	306
	307	/* fill digest values with some random data */
	308	if (!RAND_pseudo_bytes(digest, 20) \|\|
	309	!RAND_pseudo_bytes(wrong_digest, 20))
	310	{
	311	BIO_printf(out, "ERROR: unable to get random data\n");
	312	goto builtin_err;
	313	}
4d94ae00	314
2b32b281 BM	315	/* create and verify a ecdsa signature with every availble curve
	316	* (with ) */
	317	BIO_printf(out, "\ntesting ECDSA_sign() and ECDSA_verify() "
	318	"with some internal curves:\n");
4d94ae00	319
2b32b281 BM	320	/* get a list of all internal curves */
	321	crv_len = EC_get_builtin_curves(NULL, 0);
	322
	323	curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);
	324
	325	if (curves == NULL)
	326	{
	327	BIO_printf(out, "malloc error\n");
	328	goto builtin_err;
	329	}
4d94ae00	330
2b32b281 BM	331	if (!EC_get_builtin_curves(curves, crv_len))
	332	{
	333	BIO_printf(out, "unable to get internal curves\n");
	334	goto builtin_err;
	335	}
4d94ae00	336
2b32b281 BM	337	/* now create and verify a signature for every curve */
	338	for (n = 0; n < crv_len; n++)
	339	{
ac9c6e10 UM	340	unsigned char dirt, offset;
ac9c6e10 UM	341
2b32b281	342	nid = curves[n].nid;
a9f2330f UM	343	if (nid == NID_ipsec4)
a9f2330f UM	344	continue;
2b32b281 BM	345	/* create new ecdsa key (== EC_KEY) */
	346	if ((eckey = EC_KEY_new()) == NULL)
	347	goto builtin_err;
9dd84053 NL	348	group = EC_GROUP_new_by_curve_name(nid);
	349	if (group == NULL)
	350	goto builtin_err;
	351	if (EC_KEY_set_group(eckey, group) == 0)
2b32b281	352	goto builtin_err;
9dd84053	353	EC_GROUP_free(group);
ea8c77a5 BM	354	degree = EC_GROUP_get_degree(EC_KEY_get0_group(eckey));
ea8c77a5 BM	355	if (degree < 160)
2b32b281 BM	356	/* drop the curve */
	357	{
	358	EC_KEY_free(eckey);
	359	eckey = NULL;
	360	continue;
	361	}
	362	BIO_printf(out, "%s: ", OBJ_nid2sn(nid));
	363	/* create key */
	364	if (!EC_KEY_generate_key(eckey))
	365	{
	366	BIO_printf(out, " failed\n");
	367	goto builtin_err;
	368	}
	369	/* create second key */
	370	if ((wrong_eckey = EC_KEY_new()) == NULL)
	371	goto builtin_err;
9dd84053 NL	372	group = EC_GROUP_new_by_curve_name(nid);
	373	if (group == NULL)
	374	goto builtin_err;
	375	if (EC_KEY_set_group(wrong_eckey, group) == 0)
2b32b281	376	goto builtin_err;
9dd84053	377	EC_GROUP_free(group);
2b32b281 BM	378	if (!EC_KEY_generate_key(wrong_eckey))
	379	{
	380	BIO_printf(out, " failed\n");
	381	goto builtin_err;
	382	}
	383
	384	BIO_printf(out, ".");
710069c1	385	(void)BIO_flush(out);
2b32b281 BM	386	/* check key */
	387	if (!EC_KEY_check_key(eckey))
	388	{
	389	BIO_printf(out, " failed\n");
	390	goto builtin_err;
	391	}
	392	BIO_printf(out, ".");
710069c1	393	(void)BIO_flush(out);
2b32b281 BM	394	/* create signature */
	395	sig_len = ECDSA_size(eckey);
	396	if ((signature = OPENSSL_malloc(sig_len)) == NULL)
	397	goto builtin_err;
	398	if (!ECDSA_sign(0, digest, 20, signature, &sig_len, eckey))
	399	{
	400	BIO_printf(out, " failed\n");
	401	goto builtin_err;
	402	}
	403	BIO_printf(out, ".");
710069c1	404	(void)BIO_flush(out);
2b32b281 BM	405	/* verify signature */
	406	if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
	407	{
	408	BIO_printf(out, " failed\n");
	409	goto builtin_err;
	410	}
	411	BIO_printf(out, ".");
710069c1	412	(void)BIO_flush(out);
2b32b281 BM	413	/* verify signature with the wrong key */
	414	if (ECDSA_verify(0, digest, 20, signature, sig_len,
	415	wrong_eckey) == 1)
	416	{
	417	BIO_printf(out, " failed\n");
	418	goto builtin_err;
	419	}
	420	BIO_printf(out, ".");
710069c1	421	(void)BIO_flush(out);
2b32b281 BM	422	/* wrong digest */
	423	if (ECDSA_verify(0, wrong_digest, 20, signature, sig_len,
	424	eckey) == 1)
	425	{
	426	BIO_printf(out, " failed\n");
	427	goto builtin_err;
	428	}
	429	BIO_printf(out, ".");
710069c1	430	(void)BIO_flush(out);
ea8c77a5 BM	431	/* wrong length */
	432	if (ECDSA_verify(0, digest, 20, signature, sig_len - 1,
	433	eckey) == 1)
	434	{
	435	BIO_printf(out, " failed\n");
	436	goto builtin_err;
	437	}
	438	BIO_printf(out, ".");
	439	(void)BIO_flush(out);
	440
	441	/* Modify a single byte of the signature: to ensure we don't
	442	* garble the ASN1 structure, we read the raw signature and
	443	* modify a byte in one of the bignums directly. */
afb14cda DSH	444	csig_ptr = signature;
afb14cda DSH	445	if ((ecdsa_sig = d2i_ECDSA_SIG(NULL, &csig_ptr, sig_len)) == NULL)
ea8c77a5 BM	446	{
	447	BIO_printf(out, " failed\n");
	448	goto builtin_err;
	449	}
	450
	451	/* Store the two BIGNUMs in raw_buf. */
	452	r_len = BN_num_bytes(ecdsa_sig->r);
	453	s_len = BN_num_bytes(ecdsa_sig->s);
	454	bn_len = (degree + 7) / 8;
	455	if ((r_len > bn_len) \|\| (s_len > bn_len))
	456	{
	457	BIO_printf(out, " failed\n");
	458	goto builtin_err;
	459	}
	460	buf_len = 2 * bn_len;
	461	if ((raw_buf = OPENSSL_malloc(buf_len)) == NULL)
	462	goto builtin_err;
	463	/* Pad the bignums with leading zeroes. */
	464	memset(raw_buf, 0, buf_len);
	465	BN_bn2bin(ecdsa_sig->r, raw_buf + bn_len - r_len);
	466	BN_bn2bin(ecdsa_sig->s, raw_buf + buf_len - s_len);
	467
	468	/* Modify a single byte in the buffer. */
	469	offset = raw_buf[10] % buf_len;
	470	dirt = raw_buf[11] ? raw_buf[11] : 1;
	471	raw_buf[offset] ^= dirt;
	472	/* Now read the BIGNUMs back in from raw_buf. */
	473	if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) \|\|
	474	(BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
	475	goto builtin_err;
	476
	477	sig_ptr = signature;
	478	sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
2b32b281 BM	479	if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) == 1)
	480	{
	481	BIO_printf(out, " failed\n");
	482	goto builtin_err;
	483	}
ea8c77a5 BM	484	/* Sanity check: undo the modification and verify signature. */
	485	raw_buf[offset] ^= dirt;
	486	if ((BN_bin2bn(raw_buf, bn_len, ecdsa_sig->r) == NULL) \|\|
	487	(BN_bin2bn(raw_buf + bn_len, bn_len, ecdsa_sig->s) == NULL))
	488	goto builtin_err;
	489
	490	sig_ptr = signature;
	491	sig_len = i2d_ECDSA_SIG(ecdsa_sig, &sig_ptr);
	492	if (ECDSA_verify(0, digest, 20, signature, sig_len, eckey) != 1)
	493	{
	494	BIO_printf(out, " failed\n");
	495	goto builtin_err;
	496	}
2b32b281	497	BIO_printf(out, ".");
710069c1	498	(void)BIO_flush(out);
2b32b281 BM	499
	500	BIO_printf(out, " ok\n");
	501	/* cleanup */
ea8c77a5 BM	502	/* clean bogus errors */
ea8c77a5 BM	503	ERR_clear_error();
2b32b281 BM	504	OPENSSL_free(signature);
	505	signature = NULL;
	506	EC_KEY_free(eckey);
	507	eckey = NULL;
	508	EC_KEY_free(wrong_eckey);
	509	wrong_eckey = NULL;
ea8c77a5 BM	510	ECDSA_SIG_free(ecdsa_sig);
	511	ecdsa_sig = NULL;
	512	OPENSSL_free(raw_buf);
	513	raw_buf = NULL;
2b32b281 BM	514	}
	515
	516	ret = 1;
	517	builtin_err:
	518	if (eckey)
	519	EC_KEY_free(eckey);
	520	if (wrong_eckey)
	521	EC_KEY_free(wrong_eckey);
ea8c77a5 BM	522	if (ecdsa_sig)
ea8c77a5 BM	523	ECDSA_SIG_free(ecdsa_sig);
f42e6d24	524	if (signature)
2b32b281	525	OPENSSL_free(signature);
ea8c77a5 BM	526	if (raw_buf)
ea8c77a5 BM	527	OPENSSL_free(raw_buf);
2b32b281 BM	528	if (curves)
2b32b281 BM	529	OPENSSL_free(curves);
4d94ae00	530
4d94ae00	531	return ret;
2b32b281	532	}
4d94ae00 BM	533
4d94ae00 BM	534	int main(void)
2b32b281	535	{
b3b67209	536	int ret = 1;
2b32b281 BM	537	BIO *out;
	538
	539	out = BIO_new_fp(stdout, BIO_NOCLOSE);
4d94ae00	540
8f06b003	541	/* enable memory leak checking unless explicitly disabled */
2b32b281 BM	542	if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) &&
2b32b281 BM	543	(0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
8f06b003 BM	544	{
	545	CRYPTO_malloc_debug_init();
	546	CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
	547	}
	548	else
	549	{
	550	/* OPENSSL_DEBUG_MEMORY=off */
	551	CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
	552	}
	553	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
4d94ae00	554
8f06b003	555	ERR_load_crypto_strings();
4d94ae00	556
2b32b281	557	/* initialize the prng */
8f06b003	558	RAND_seed(rnd_seed, sizeof(rnd_seed));
4d94ae00	559
2b32b281 BM	560	/* the tests */
	561	if (!x9_62_tests(out)) goto err;
	562	if (!test_builtin(out)) goto err;
4d94ae00	563
b3b67209	564	ret = 0;
2b32b281	565	err:
b3b67209	566	if (ret)
2b32b281	567	BIO_printf(out, "\nECDSA test failed\n");
4d94ae00	568	else
2b32b281	569	BIO_printf(out, "\nECDSA test passed\n");
0210065b	570	if (ret)
2b32b281	571	ERR_print_errors(out);
4d94ae00	572	CRYPTO_cleanup_all_ex_data();
4c329696	573	ERR_remove_thread_state(NULL);
4d94ae00	574	ERR_free_strings();
2b32b281 BM	575	CRYPTO_mem_leaks(out);
	576	if (out != NULL)
	577	BIO_free(out);
b3b67209	578	return ret;
2b32b281	579	}
4d94ae00	580	#endif