]>
Commit | Line | Data |
---|---|---|
c6700d27 GT |
1 | /* |
2 | * Written by Nils Larsch for the OpenSSL project | |
3 | */ | |
4d94ae00 | 4 | /* ==================================================================== |
c6700d27 | 5 | * Copyright (c) 1998-2004 The OpenSSL Project. All rights reserved. |
4d94ae00 BM |
6 | * |
7 | * Redistribution and use in source and binary forms, with or without | |
8 | * modification, are permitted provided that the following conditions | |
9 | * are met: | |
10 | * | |
11 | * 1. Redistributions of source code must retain the above copyright | |
0f113f3e | 12 | * notice, this list of conditions and the following disclaimer. |
4d94ae00 BM |
13 | * |
14 | * 2. Redistributions in binary form must reproduce the above copyright | |
15 | * notice, this list of conditions and the following disclaimer in | |
16 | * the documentation and/or other materials provided with the | |
17 | * distribution. | |
18 | * | |
19 | * 3. All advertising materials mentioning features or use of this | |
20 | * software must display the following acknowledgment: | |
21 | * "This product includes software developed by the OpenSSL Project | |
22 | * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" | |
23 | * | |
24 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | |
25 | * endorse or promote products derived from this software without | |
26 | * prior written permission. For written permission, please contact | |
27 | * openssl-core@OpenSSL.org. | |
28 | * | |
29 | * 5. Products derived from this software may not be called "OpenSSL" | |
30 | * nor may "OpenSSL" appear in their names without prior written | |
31 | * permission of the OpenSSL Project. | |
32 | * | |
33 | * 6. Redistributions of any form whatsoever must retain the following | |
34 | * acknowledgment: | |
35 | * "This product includes software developed by the OpenSSL Project | |
36 | * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" | |
37 | * | |
38 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | |
39 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
40 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | |
41 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | |
42 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
43 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | |
44 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |
45 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
46 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | |
47 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | |
48 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | |
49 | * OF THE POSSIBILITY OF SUCH DAMAGE. | |
50 | * ==================================================================== | |
51 | * | |
52 | * This product includes cryptographic software written by Eric Young | |
53 | * (eay@cryptsoft.com). This product includes software written by Tim | |
54 | * Hudson (tjh@cryptsoft.com). | |
55 | * | |
56 | */ | |
0bee0e62 | 57 | |
a200a817 | 58 | #include <string.h> |
0bee0e62 | 59 | #include <openssl/err.h> |
14a7cfb3 | 60 | #include <openssl/obj_mac.h> |
0f814687 | 61 | #include <openssl/bn.h> |
8a99cb29 | 62 | #include <openssl/rand.h> |
6a47db45 DSH |
63 | #include <openssl/ec.h> |
64 | #include "ec_lcl.h" | |
190c615d | 65 | |
a200a817 DSH |
66 | int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, |
67 | unsigned char *sig, unsigned int *siglen, | |
68 | const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey) | |
69 | { | |
70 | ECDSA_SIG *s; | |
71 | RAND_seed(dgst, dlen); | |
72 | s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey); | |
73 | if (s == NULL) { | |
74 | *siglen = 0; | |
75 | return 0; | |
76 | } | |
77 | *siglen = i2d_ECDSA_SIG(s, &sig); | |
78 | ECDSA_SIG_free(s); | |
79 | return 1; | |
80 | } | |
81 | ||
8d6a75dc | 82 | static int ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, |
0f113f3e MC |
83 | BIGNUM **kinvp, BIGNUM **rp, |
84 | const unsigned char *dgst, int dlen) | |
4d94ae00 | 85 | { |
0f113f3e | 86 | BN_CTX *ctx = NULL; |
be2e334f DSH |
87 | BIGNUM *k = NULL, *r = NULL, *X = NULL; |
88 | const BIGNUM *order; | |
0f113f3e MC |
89 | EC_POINT *tmp_point = NULL; |
90 | const EC_GROUP *group; | |
91 | int ret = 0; | |
9dd84053 | 92 | |
0f113f3e | 93 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) { |
6a47db45 | 94 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER); |
0f113f3e MC |
95 | return 0; |
96 | } | |
a74333f9 | 97 | |
0f113f3e MC |
98 | if (ctx_in == NULL) { |
99 | if ((ctx = BN_CTX_new()) == NULL) { | |
6a47db45 | 100 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
101 | return 0; |
102 | } | |
103 | } else | |
104 | ctx = ctx_in; | |
4d94ae00 | 105 | |
0f113f3e MC |
106 | k = BN_new(); /* this value is later returned in *kinvp */ |
107 | r = BN_new(); /* this value is later returned in *rp */ | |
0f113f3e | 108 | X = BN_new(); |
be2e334f | 109 | if (k == NULL || r == NULL || X == NULL) { |
6a47db45 | 110 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
111 | goto err; |
112 | } | |
113 | if ((tmp_point = EC_POINT_new(group)) == NULL) { | |
6a47db45 | 114 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
115 | goto err; |
116 | } | |
be2e334f DSH |
117 | order = EC_GROUP_get0_order(group); |
118 | if (order == NULL) { | |
6a47db45 | 119 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
120 | goto err; |
121 | } | |
cac4fb58 | 122 | |
0f113f3e MC |
123 | do { |
124 | /* get random k */ | |
125 | do | |
0f113f3e MC |
126 | if (dgst != NULL) { |
127 | if (!BN_generate_dsa_nonce | |
128 | (k, order, EC_KEY_get0_private_key(eckey), dgst, dlen, | |
129 | ctx)) { | |
6a47db45 DSH |
130 | ECerr(EC_F_ECDSA_SIGN_SETUP, |
131 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
0f113f3e MC |
132 | goto err; |
133 | } | |
474e469b | 134 | } else { |
0f113f3e | 135 | if (!BN_rand_range(k, order)) { |
6a47db45 DSH |
136 | ECerr(EC_F_ECDSA_SIGN_SETUP, |
137 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
0f113f3e MC |
138 | goto err; |
139 | } | |
140 | } | |
141 | while (BN_is_zero(k)); | |
4d94ae00 | 142 | |
0f113f3e MC |
143 | /* |
144 | * We do not want timing information to leak the length of k, so we | |
145 | * compute G*k using an equivalent scalar of fixed bit-length. | |
146 | */ | |
992bdde6 | 147 | |
0f113f3e MC |
148 | if (!BN_add(k, k, order)) |
149 | goto err; | |
150 | if (BN_num_bits(k) <= BN_num_bits(order)) | |
151 | if (!BN_add(k, k, order)) | |
152 | goto err; | |
992bdde6 | 153 | |
0f113f3e MC |
154 | /* compute r the x-coordinate of generator * k */ |
155 | if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) { | |
6a47db45 | 156 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
157 | goto err; |
158 | } | |
159 | if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == | |
160 | NID_X9_62_prime_field) { | |
161 | if (!EC_POINT_get_affine_coordinates_GFp | |
162 | (group, tmp_point, X, NULL, ctx)) { | |
6a47db45 | 163 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
164 | goto err; |
165 | } | |
166 | } | |
b3310161 | 167 | #ifndef OPENSSL_NO_EC2M |
0f113f3e MC |
168 | else { /* NID_X9_62_characteristic_two_field */ |
169 | ||
170 | if (!EC_POINT_get_affine_coordinates_GF2m(group, | |
171 | tmp_point, X, NULL, | |
172 | ctx)) { | |
6a47db45 | 173 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_EC_LIB); |
0f113f3e MC |
174 | goto err; |
175 | } | |
176 | } | |
b3310161 | 177 | #endif |
0f113f3e | 178 | if (!BN_nnmod(r, X, order, ctx)) { |
6a47db45 | 179 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
180 | goto err; |
181 | } | |
182 | } | |
183 | while (BN_is_zero(r)); | |
4d94ae00 | 184 | |
0f113f3e MC |
185 | /* compute the inverse of k */ |
186 | if (EC_GROUP_get_mont_data(group) != NULL) { | |
187 | /* | |
188 | * We want inverse in constant time, therefore we utilize the fact | |
189 | * order must be prime and use Fermats Little Theorem instead. | |
190 | */ | |
191 | if (!BN_set_word(X, 2)) { | |
6a47db45 | 192 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
193 | goto err; |
194 | } | |
195 | if (!BN_mod_sub(X, order, X, order, ctx)) { | |
6a47db45 | 196 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
197 | goto err; |
198 | } | |
199 | BN_set_flags(X, BN_FLG_CONSTTIME); | |
200 | if (!BN_mod_exp_mont_consttime | |
201 | (k, k, X, order, ctx, EC_GROUP_get_mont_data(group))) { | |
6a47db45 | 202 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
203 | goto err; |
204 | } | |
205 | } else { | |
206 | if (!BN_mod_inverse(k, k, order, ctx)) { | |
6a47db45 | 207 | ECerr(EC_F_ECDSA_SIGN_SETUP, ERR_R_BN_LIB); |
0f113f3e MC |
208 | goto err; |
209 | } | |
210 | } | |
f54be179 | 211 | |
0f113f3e | 212 | /* clear old values if necessary */ |
23a1d5e9 RS |
213 | BN_clear_free(*rp); |
214 | BN_clear_free(*kinvp); | |
0f113f3e MC |
215 | /* save the pre-computed values */ |
216 | *rp = r; | |
217 | *kinvp = k; | |
218 | ret = 1; | |
219 | err: | |
220 | if (!ret) { | |
23a1d5e9 RS |
221 | BN_clear_free(k); |
222 | BN_clear_free(r); | |
0f113f3e | 223 | } |
23a1d5e9 | 224 | if (ctx != ctx_in) |
0f113f3e | 225 | BN_CTX_free(ctx); |
8fdc3734 | 226 | EC_POINT_free(tmp_point); |
23a1d5e9 | 227 | BN_clear_free(X); |
0f113f3e | 228 | return (ret); |
4d94ae00 BM |
229 | } |
230 | ||
6a47db45 DSH |
231 | int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
232 | BIGNUM **rp) | |
233 | { | |
234 | return ecdsa_sign_setup(eckey, ctx_in, kinvp, rp, NULL, 0); | |
235 | } | |
236 | ||
237 | ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len, | |
238 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
239 | EC_KEY *eckey) | |
4d94ae00 | 240 | { |
0f113f3e | 241 | int ok = 0, i; |
be2e334f DSH |
242 | BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL; |
243 | const BIGNUM *order, *ckinv; | |
0f113f3e MC |
244 | BN_CTX *ctx = NULL; |
245 | const EC_GROUP *group; | |
246 | ECDSA_SIG *ret; | |
0f113f3e MC |
247 | const BIGNUM *priv_key; |
248 | ||
0f113f3e MC |
249 | group = EC_KEY_get0_group(eckey); |
250 | priv_key = EC_KEY_get0_private_key(eckey); | |
14a7cfb3 | 251 | |
6a47db45 DSH |
252 | if (group == NULL || priv_key == NULL) { |
253 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_PASSED_NULL_PARAMETER); | |
0f113f3e MC |
254 | return NULL; |
255 | } | |
4d94ae00 | 256 | |
0f113f3e | 257 | ret = ECDSA_SIG_new(); |
90945fa3 | 258 | if (ret == NULL) { |
6a47db45 | 259 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
260 | return NULL; |
261 | } | |
262 | s = ret->s; | |
c6700d27 | 263 | |
be2e334f | 264 | if ((ctx = BN_CTX_new()) == NULL || |
0f113f3e | 265 | (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) { |
6a47db45 | 266 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
267 | goto err; |
268 | } | |
4d94ae00 | 269 | |
be2e334f DSH |
270 | order = EC_GROUP_get0_order(group); |
271 | if (order == NULL) { | |
6a47db45 | 272 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
273 | goto err; |
274 | } | |
275 | i = BN_num_bits(order); | |
276 | /* | |
277 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
278 | */ | |
279 | if (8 * dgst_len > i) | |
280 | dgst_len = (i + 7) / 8; | |
281 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
6a47db45 | 282 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
283 | goto err; |
284 | } | |
285 | /* If still too long truncate remaining bits with a shift */ | |
286 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
6a47db45 | 287 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
288 | goto err; |
289 | } | |
290 | do { | |
291 | if (in_kinv == NULL || in_r == NULL) { | |
292 | if (!ecdsa_sign_setup(eckey, ctx, &kinv, &ret->r, dgst, dgst_len)) { | |
6a47db45 | 293 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_ECDSA_LIB); |
0f113f3e MC |
294 | goto err; |
295 | } | |
296 | ckinv = kinv; | |
297 | } else { | |
298 | ckinv = in_kinv; | |
299 | if (BN_copy(ret->r, in_r) == NULL) { | |
6a47db45 | 300 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
301 | goto err; |
302 | } | |
303 | } | |
4d94ae00 | 304 | |
0f113f3e | 305 | if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) { |
6a47db45 | 306 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
307 | goto err; |
308 | } | |
309 | if (!BN_mod_add_quick(s, tmp, m, order)) { | |
6a47db45 | 310 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
311 | goto err; |
312 | } | |
313 | if (!BN_mod_mul(s, s, ckinv, order, ctx)) { | |
6a47db45 | 314 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
315 | goto err; |
316 | } | |
317 | if (BN_is_zero(s)) { | |
318 | /* | |
319 | * if kinv and r have been supplied by the caller don't to | |
320 | * generate new kinv and r values | |
321 | */ | |
322 | if (in_kinv != NULL && in_r != NULL) { | |
6a47db45 | 323 | ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, EC_R_NEED_NEW_SETUP_VALUES); |
0f113f3e MC |
324 | goto err; |
325 | } | |
326 | } else | |
327 | /* s != 0 => we have a valid signature */ | |
328 | break; | |
329 | } | |
330 | while (1); | |
4d94ae00 | 331 | |
0f113f3e MC |
332 | ok = 1; |
333 | err: | |
334 | if (!ok) { | |
335 | ECDSA_SIG_free(ret); | |
336 | ret = NULL; | |
337 | } | |
23a1d5e9 RS |
338 | BN_CTX_free(ctx); |
339 | BN_clear_free(m); | |
340 | BN_clear_free(tmp); | |
23a1d5e9 | 341 | BN_clear_free(kinv); |
0f113f3e | 342 | return ret; |
4d94ae00 BM |
343 | } |
344 | ||
a200a817 DSH |
345 | /*- |
346 | * returns | |
347 | * 1: correct signature | |
348 | * 0: incorrect signature | |
349 | * -1: error | |
350 | */ | |
351 | int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len, | |
352 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey) | |
353 | { | |
354 | ECDSA_SIG *s; | |
355 | const unsigned char *p = sigbuf; | |
356 | unsigned char *der = NULL; | |
357 | int derlen = -1; | |
358 | int ret = -1; | |
359 | ||
360 | s = ECDSA_SIG_new(); | |
361 | if (s == NULL) | |
362 | return (ret); | |
363 | if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) | |
364 | goto err; | |
365 | /* Ensure signature uses DER and doesn't have trailing garbage */ | |
366 | derlen = i2d_ECDSA_SIG(s, &der); | |
91e7bcc2 | 367 | if (derlen != sig_len || memcmp(sigbuf, der, derlen) != 0) |
a200a817 DSH |
368 | goto err; |
369 | ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); | |
370 | err: | |
371 | OPENSSL_clear_free(der, derlen); | |
372 | ECDSA_SIG_free(s); | |
373 | return (ret); | |
374 | } | |
375 | ||
6a47db45 DSH |
376 | int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len, |
377 | const ECDSA_SIG *sig, EC_KEY *eckey) | |
4d94ae00 | 378 | { |
0f113f3e MC |
379 | int ret = -1, i; |
380 | BN_CTX *ctx; | |
be2e334f DSH |
381 | const BIGNUM *order; |
382 | BIGNUM *u1, *u2, *m, *X; | |
0f113f3e MC |
383 | EC_POINT *point = NULL; |
384 | const EC_GROUP *group; | |
385 | const EC_POINT *pub_key; | |
9dd84053 | 386 | |
0f113f3e MC |
387 | /* check input values */ |
388 | if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL || | |
389 | (pub_key = EC_KEY_get0_public_key(eckey)) == NULL || sig == NULL) { | |
6a47db45 | 390 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_MISSING_PARAMETERS); |
0f113f3e MC |
391 | return -1; |
392 | } | |
4d94ae00 | 393 | |
0f113f3e | 394 | ctx = BN_CTX_new(); |
90945fa3 | 395 | if (ctx == NULL) { |
6a47db45 | 396 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
397 | return -1; |
398 | } | |
399 | BN_CTX_start(ctx); | |
0f113f3e MC |
400 | u1 = BN_CTX_get(ctx); |
401 | u2 = BN_CTX_get(ctx); | |
402 | m = BN_CTX_get(ctx); | |
403 | X = BN_CTX_get(ctx); | |
91e7bcc2 | 404 | if (X == NULL) { |
6a47db45 | 405 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
406 | goto err; |
407 | } | |
c6700d27 | 408 | |
be2e334f DSH |
409 | order = EC_GROUP_get0_order(group); |
410 | if (order == NULL) { | |
6a47db45 | 411 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
412 | goto err; |
413 | } | |
4d94ae00 | 414 | |
0f113f3e MC |
415 | if (BN_is_zero(sig->r) || BN_is_negative(sig->r) || |
416 | BN_ucmp(sig->r, order) >= 0 || BN_is_zero(sig->s) || | |
417 | BN_is_negative(sig->s) || BN_ucmp(sig->s, order) >= 0) { | |
6a47db45 | 418 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, EC_R_BAD_SIGNATURE); |
0f113f3e MC |
419 | ret = 0; /* signature is invalid */ |
420 | goto err; | |
421 | } | |
422 | /* calculate tmp1 = inv(S) mod order */ | |
423 | if (!BN_mod_inverse(u2, sig->s, order, ctx)) { | |
6a47db45 | 424 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
425 | goto err; |
426 | } | |
427 | /* digest -> m */ | |
428 | i = BN_num_bits(order); | |
429 | /* | |
430 | * Need to truncate digest if it is too long: first truncate whole bytes. | |
431 | */ | |
432 | if (8 * dgst_len > i) | |
433 | dgst_len = (i + 7) / 8; | |
434 | if (!BN_bin2bn(dgst, dgst_len, m)) { | |
6a47db45 | 435 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
436 | goto err; |
437 | } | |
438 | /* If still too long truncate remaining bits with a shift */ | |
439 | if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) { | |
6a47db45 | 440 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
441 | goto err; |
442 | } | |
443 | /* u1 = m * tmp mod order */ | |
444 | if (!BN_mod_mul(u1, m, u2, order, ctx)) { | |
6a47db45 | 445 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
446 | goto err; |
447 | } | |
448 | /* u2 = r * w mod q */ | |
449 | if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) { | |
6a47db45 | 450 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
451 | goto err; |
452 | } | |
453 | ||
454 | if ((point = EC_POINT_new(group)) == NULL) { | |
6a47db45 | 455 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
456 | goto err; |
457 | } | |
458 | if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) { | |
6a47db45 | 459 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
460 | goto err; |
461 | } | |
462 | if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == | |
463 | NID_X9_62_prime_field) { | |
464 | if (!EC_POINT_get_affine_coordinates_GFp(group, point, X, NULL, ctx)) { | |
6a47db45 | 465 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
466 | goto err; |
467 | } | |
468 | } | |
b3310161 | 469 | #ifndef OPENSSL_NO_EC2M |
0f113f3e MC |
470 | else { /* NID_X9_62_characteristic_two_field */ |
471 | ||
472 | if (!EC_POINT_get_affine_coordinates_GF2m(group, point, X, NULL, ctx)) { | |
6a47db45 | 473 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB); |
0f113f3e MC |
474 | goto err; |
475 | } | |
476 | } | |
477 | #endif | |
478 | if (!BN_nnmod(u1, X, order, ctx)) { | |
6a47db45 | 479 | ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB); |
0f113f3e MC |
480 | goto err; |
481 | } | |
482 | /* if the signature is correct u1 is equal to sig->r */ | |
483 | ret = (BN_ucmp(u1, sig->r) == 0); | |
484 | err: | |
485 | BN_CTX_end(ctx); | |
486 | BN_CTX_free(ctx); | |
8fdc3734 | 487 | EC_POINT_free(point); |
0f113f3e | 488 | return ret; |
4d94ae00 | 489 | } |