crypto/sm2/sm2_sign.c

   1 /*
   2  * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright 2017 Ribose Inc. All Rights Reserved.
   4  * Ported from Ribose contributions from Botan.
   5  *
   6  * Licensed under the Apache License 2.0 (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include "internal/sm2.h"
  13 #include "internal/sm2err.h"
  14 #include "internal/ec_int.h" /* ec_group_do_inverse_ord() */
  15 #include "internal/numbers.h"
  16 #include <openssl/err.h>
  17 #include <openssl/evp.h>
  18 #include <openssl/err.h>
  19 #include <openssl/bn.h>
  20 #include <string.h>
  21
  22 int sm2_compute_z_digest(uint8_t *out,
  23                          const EVP_MD *digest,
  24                          const uint8_t *id,
  25                          const size_t id_len,
  26                          const EC_KEY *key)
  27 {
  28     int rc = 0;
  29     const EC_GROUP *group = EC_KEY_get0_group(key);
  30     BN_CTX *ctx = NULL;
  31     EVP_MD_CTX *hash = NULL;
  32     BIGNUM *p = NULL;
  33     BIGNUM *a = NULL;
  34     BIGNUM *b = NULL;
  35     BIGNUM *xG = NULL;
  36     BIGNUM *yG = NULL;
  37     BIGNUM *xA = NULL;
  38     BIGNUM *yA = NULL;
  39     int p_bytes = 0;
  40     uint8_t *buf = NULL;
  41     uint16_t entl = 0;
  42     uint8_t e_byte = 0;
  43
  44     hash = EVP_MD_CTX_new();
  45     ctx = BN_CTX_new();
  46     if (hash == NULL || ctx == NULL) {
  47         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_MALLOC_FAILURE);
  48         goto done;
  49     }
  50
  51     p = BN_CTX_get(ctx);
  52     a = BN_CTX_get(ctx);
  53     b = BN_CTX_get(ctx);
  54     xG = BN_CTX_get(ctx);
  55     yG = BN_CTX_get(ctx);
  56     xA = BN_CTX_get(ctx);
  57     yA = BN_CTX_get(ctx);
  58
  59     if (yA == NULL) {
  60         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_MALLOC_FAILURE);
  61         goto done;
  62     }
  63
  64     if (!EVP_DigestInit(hash, digest)) {
  65         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_EVP_LIB);
  66         goto done;
  67     }
  68
  69     /* Z = h(ENTL || ID || a || b || xG || yG || xA || yA) */
  70
  71     if (id_len >= (UINT16_MAX / 8)) {
  72         /* too large */
  73         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, SM2_R_ID_TOO_LARGE);
  74         goto done;
  75     }
  76
  77     entl = (uint16_t)(8 * id_len);
  78
  79     e_byte = entl >> 8;
  80     if (!EVP_DigestUpdate(hash, &e_byte, 1)) {
  81         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_EVP_LIB);
  82         goto done;
  83     }
  84     e_byte = entl & 0xFF;
  85     if (!EVP_DigestUpdate(hash, &e_byte, 1)) {
  86         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_EVP_LIB);
  87         goto done;
  88     }
  89
  90     if (id_len > 0 && !EVP_DigestUpdate(hash, id, id_len)) {
  91         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_EVP_LIB);
  92         goto done;
  93     }
  94
  95     if (!EC_GROUP_get_curve(group, p, a, b, ctx)) {
  96         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_EC_LIB);
  97         goto done;
  98     }
  99
 100     p_bytes = BN_num_bytes(p);
 101     buf = OPENSSL_zalloc(p_bytes);
 102     if (buf == NULL) {
 103         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_MALLOC_FAILURE);
 104         goto done;
 105     }
 106
 107     if (BN_bn2binpad(a, buf, p_bytes) < 0
 108             || !EVP_DigestUpdate(hash, buf, p_bytes)
 109             || BN_bn2binpad(b, buf, p_bytes) < 0
 110             || !EVP_DigestUpdate(hash, buf, p_bytes)
 111             || !EC_POINT_get_affine_coordinates(group,
 112                                                 EC_GROUP_get0_generator(group),
 113                                                 xG, yG, ctx)
 114             || BN_bn2binpad(xG, buf, p_bytes) < 0
 115             || !EVP_DigestUpdate(hash, buf, p_bytes)
 116             || BN_bn2binpad(yG, buf, p_bytes) < 0
 117             || !EVP_DigestUpdate(hash, buf, p_bytes)
 118             || !EC_POINT_get_affine_coordinates(group,
 119                                                 EC_KEY_get0_public_key(key),
 120                                                 xA, yA, ctx)
 121             || BN_bn2binpad(xA, buf, p_bytes) < 0
 122             || !EVP_DigestUpdate(hash, buf, p_bytes)
 123             || BN_bn2binpad(yA, buf, p_bytes) < 0
 124             || !EVP_DigestUpdate(hash, buf, p_bytes)
 125             || !EVP_DigestFinal(hash, out, NULL)) {
 126         SM2err(SM2_F_SM2_COMPUTE_Z_DIGEST, ERR_R_INTERNAL_ERROR);
 127         goto done;
 128     }
 129
 130     rc = 1;
 131
 132  done:
 133     OPENSSL_free(buf);
 134     BN_CTX_free(ctx);
 135     EVP_MD_CTX_free(hash);
 136     return rc;
 137 }
 138
 139 static BIGNUM *sm2_compute_msg_hash(const EVP_MD *digest,
 140                                     const EC_KEY *key,
 141                                     const uint8_t *id,
 142                                     const size_t id_len,
 143                                     const uint8_t *msg, size_t msg_len)
 144 {
 145     EVP_MD_CTX *hash = EVP_MD_CTX_new();
 146     const int md_size = EVP_MD_size(digest);
 147     uint8_t *z = NULL;
 148     BIGNUM *e = NULL;
 149
 150     if (md_size < 0) {
 151         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, SM2_R_INVALID_DIGEST);
 152         goto done;
 153     }
 154
 155     z = OPENSSL_zalloc(md_size);
 156     if (hash == NULL || z == NULL) {
 157         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_MALLOC_FAILURE);
 158         goto done;
 159     }
 160
 161     if (!sm2_compute_z_digest(z, digest, id, id_len, key)) {
 162         /* SM2err already called */
 163         goto done;
 164     }
 165
 166     if (!EVP_DigestInit(hash, digest)
 167             || !EVP_DigestUpdate(hash, z, md_size)
 168             || !EVP_DigestUpdate(hash, msg, msg_len)
 169                /* reuse z buffer to hold H(Z || M) */
 170             || !EVP_DigestFinal(hash, z, NULL)) {
 171         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_EVP_LIB);
 172         goto done;
 173     }
 174
 175     e = BN_bin2bn(z, md_size, NULL);
 176     if (e == NULL)
 177         SM2err(SM2_F_SM2_COMPUTE_MSG_HASH, ERR_R_INTERNAL_ERROR);
 178
 179  done:
 180     OPENSSL_free(z);
 181     EVP_MD_CTX_free(hash);
 182     return e;
 183 }
 184
 185 static ECDSA_SIG *sm2_sig_gen(const EC_KEY *key, const BIGNUM *e)
 186 {
 187     const BIGNUM *dA = EC_KEY_get0_private_key(key);
 188     const EC_GROUP *group = EC_KEY_get0_group(key);
 189     const BIGNUM *order = EC_GROUP_get0_order(group);
 190     ECDSA_SIG *sig = NULL;
 191     EC_POINT *kG = NULL;
 192     BN_CTX *ctx = NULL;
 193     BIGNUM *k = NULL;
 194     BIGNUM *rk = NULL;
 195     BIGNUM *r = NULL;
 196     BIGNUM *s = NULL;
 197     BIGNUM *x1 = NULL;
 198     BIGNUM *tmp = NULL;
 199
 200     kG = EC_POINT_new(group);
 201     ctx = BN_CTX_new();
 202     if (kG == NULL || ctx == NULL) {
 203         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 204         goto done;
 205     }
 206
 207     BN_CTX_start(ctx);
 208     k = BN_CTX_get(ctx);
 209     rk = BN_CTX_get(ctx);
 210     x1 = BN_CTX_get(ctx);
 211     tmp = BN_CTX_get(ctx);
 212     if (tmp == NULL) {
 213         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 214         goto done;
 215     }
 216
 217     /*
 218      * These values are returned and so should not be allocated out of the
 219      * context
 220      */
 221     r = BN_new();
 222     s = BN_new();
 223
 224     if (r == NULL || s == NULL) {
 225         SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 226         goto done;
 227     }
 228
 229     for (;;) {
 230         if (!BN_priv_rand_range(k, order)) {
 231             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 232             goto done;
 233         }
 234
 235         if (!EC_POINT_mul(group, kG, k, NULL, NULL, ctx)
 236                 || !EC_POINT_get_affine_coordinates(group, kG, x1, NULL,
 237                                                     ctx)
 238                 || !BN_mod_add(r, e, x1, order, ctx)) {
 239             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 240             goto done;
 241         }
 242
 243         /* try again if r == 0 or r+k == n */
 244         if (BN_is_zero(r))
 245             continue;
 246
 247         if (!BN_add(rk, r, k)) {
 248             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_INTERNAL_ERROR);
 249             goto done;
 250         }
 251
 252         if (BN_cmp(rk, order) == 0)
 253             continue;
 254
 255         if (!BN_add(s, dA, BN_value_one())
 256                 || !ec_group_do_inverse_ord(group, s, s, ctx)
 257                 || !BN_mod_mul(tmp, dA, r, order, ctx)
 258                 || !BN_sub(tmp, k, tmp)
 259                 || !BN_mod_mul(s, s, tmp, order, ctx)) {
 260             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_BN_LIB);
 261             goto done;
 262         }
 263
 264         sig = ECDSA_SIG_new();
 265         if (sig == NULL) {
 266             SM2err(SM2_F_SM2_SIG_GEN, ERR_R_MALLOC_FAILURE);
 267             goto done;
 268         }
 269
 270          /* takes ownership of r and s */
 271         ECDSA_SIG_set0(sig, r, s);
 272         break;
 273     }
 274
 275  done:
 276     if (sig == NULL) {
 277         BN_free(r);
 278         BN_free(s);
 279     }
 280
 281     BN_CTX_free(ctx);
 282     EC_POINT_free(kG);
 283     return sig;
 284 }
 285
 286 static int sm2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig,
 287                           const BIGNUM *e)
 288 {
 289     int ret = 0;
 290     const EC_GROUP *group = EC_KEY_get0_group(key);
 291     const BIGNUM *order = EC_GROUP_get0_order(group);
 292     BN_CTX *ctx = NULL;
 293     EC_POINT *pt = NULL;
 294     BIGNUM *t = NULL;
 295     BIGNUM *x1 = NULL;
 296     const BIGNUM *r = NULL;
 297     const BIGNUM *s = NULL;
 298
 299     ctx = BN_CTX_new();
 300     pt = EC_POINT_new(group);
 301     if (ctx == NULL || pt == NULL) {
 302         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_MALLOC_FAILURE);
 303         goto done;
 304     }
 305
 306     BN_CTX_start(ctx);
 307     t = BN_CTX_get(ctx);
 308     x1 = BN_CTX_get(ctx);
 309     if (x1 == NULL) {
 310         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_MALLOC_FAILURE);
 311         goto done;
 312     }
 313
 314     /*
 315      * B1: verify whether r' in [1,n-1], verification failed if not
 316      * B2: verify whether s' in [1,n-1], verification failed if not
 317      * B3: set M'~=ZA || M'
 318      * B4: calculate e'=Hv(M'~)
 319      * B5: calculate t = (r' + s') modn, verification failed if t=0
 320      * B6: calculate the point (x1', y1')=[s']G + [t]PA
 321      * B7: calculate R=(e'+x1') modn, verification pass if yes, otherwise failed
 322      */
 323
 324     ECDSA_SIG_get0(sig, &r, &s);
 325
 326     if (BN_cmp(r, BN_value_one()) < 0
 327             || BN_cmp(s, BN_value_one()) < 0
 328             || BN_cmp(order, r) <= 0
 329             || BN_cmp(order, s) <= 0) {
 330         SM2err(SM2_F_SM2_SIG_VERIFY, SM2_R_BAD_SIGNATURE);
 331         goto done;
 332     }
 333
 334     if (!BN_mod_add(t, r, s, order, ctx)) {
 335         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_BN_LIB);
 336         goto done;
 337     }
 338
 339     if (BN_is_zero(t)) {
 340         SM2err(SM2_F_SM2_SIG_VERIFY, SM2_R_BAD_SIGNATURE);
 341         goto done;
 342     }
 343
 344     if (!EC_POINT_mul(group, pt, s, EC_KEY_get0_public_key(key), t, ctx)
 345             || !EC_POINT_get_affine_coordinates(group, pt, x1, NULL, ctx)) {
 346         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_EC_LIB);
 347         goto done;
 348     }
 349
 350     if (!BN_mod_add(t, e, x1, order, ctx)) {
 351         SM2err(SM2_F_SM2_SIG_VERIFY, ERR_R_BN_LIB);
 352         goto done;
 353     }
 354
 355     if (BN_cmp(r, t) == 0)
 356         ret = 1;
 357
 358  done:
 359     EC_POINT_free(pt);
 360     BN_CTX_free(ctx);
 361     return ret;
 362 }
 363
 364 ECDSA_SIG *sm2_do_sign(const EC_KEY *key,
 365                        const EVP_MD *digest,
 366                        const uint8_t *id,
 367                        const size_t id_len,
 368                        const uint8_t *msg, size_t msg_len)
 369 {
 370     BIGNUM *e = NULL;
 371     ECDSA_SIG *sig = NULL;
 372
 373     e = sm2_compute_msg_hash(digest, key, id, id_len, msg, msg_len);
 374     if (e == NULL) {
 375         /* SM2err already called */
 376         goto done;
 377     }
 378
 379     sig = sm2_sig_gen(key, e);
 380
 381  done:
 382     BN_free(e);
 383     return sig;
 384 }
 385
 386 int sm2_do_verify(const EC_KEY *key,
 387                   const EVP_MD *digest,
 388                   const ECDSA_SIG *sig,
 389                   const uint8_t *id,
 390                   const size_t id_len,
 391                   const uint8_t *msg, size_t msg_len)
 392 {
 393     BIGNUM *e = NULL;
 394     int ret = 0;
 395
 396     e = sm2_compute_msg_hash(digest, key, id, id_len, msg, msg_len);
 397     if (e == NULL) {
 398         /* SM2err already called */
 399         goto done;
 400     }
 401
 402     ret = sm2_sig_verify(key, sig, e);
 403
 404  done:
 405     BN_free(e);
 406     return ret;
 407 }
 408
 409 int sm2_sign(const unsigned char *dgst, int dgstlen,
 410              unsigned char *sig, unsigned int *siglen, EC_KEY *eckey)
 411 {
 412     BIGNUM *e = NULL;
 413     ECDSA_SIG *s = NULL;
 414     int sigleni;
 415     int ret = -1;
 416
 417     e = BN_bin2bn(dgst, dgstlen, NULL);
 418     if (e == NULL) {
 419        SM2err(SM2_F_SM2_SIGN, ERR_R_BN_LIB);
 420        goto done;
 421     }
 422
 423     s = sm2_sig_gen(eckey, e);
 424
 425     sigleni = i2d_ECDSA_SIG(s, &sig);
 426     if (sigleni < 0) {
 427        SM2err(SM2_F_SM2_SIGN, ERR_R_INTERNAL_ERROR);
 428        goto done;
 429     }
 430     *siglen = (unsigned int)sigleni;
 431
 432     ret = 1;
 433
 434  done:
 435     ECDSA_SIG_free(s);
 436     BN_free(e);
 437     return ret;
 438 }
 439
 440 int sm2_verify(const unsigned char *dgst, int dgstlen,
 441                const unsigned char *sig, int sig_len, EC_KEY *eckey)
 442 {
 443     ECDSA_SIG *s = NULL;
 444     BIGNUM *e = NULL;
 445     const unsigned char *p = sig;
 446     unsigned char *der = NULL;
 447     int derlen = -1;
 448     int ret = -1;
 449
 450     s = ECDSA_SIG_new();
 451     if (s == NULL) {
 452         SM2err(SM2_F_SM2_VERIFY, ERR_R_MALLOC_FAILURE);
 453         goto done;
 454     }
 455     if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) {
 456         SM2err(SM2_F_SM2_VERIFY, SM2_R_INVALID_ENCODING);
 457         goto done;
 458     }
 459     /* Ensure signature uses DER and doesn't have trailing garbage */
 460     derlen = i2d_ECDSA_SIG(s, &der);
 461     if (derlen != sig_len || memcmp(sig, der, derlen) != 0) {
 462         SM2err(SM2_F_SM2_VERIFY, SM2_R_INVALID_ENCODING);
 463         goto done;
 464     }
 465
 466     e = BN_bin2bn(dgst, dgstlen, NULL);
 467     if (e == NULL) {
 468         SM2err(SM2_F_SM2_VERIFY, ERR_R_BN_LIB);
 469         goto done;
 470     }
 471
 472     ret = sm2_sig_verify(eckey, s, e);
 473
 474  done:
 475     OPENSSL_free(der);
 476     BN_free(e);
 477     ECDSA_SIG_free(s);
 478     return ret;
 479 }